CVEs published February 16, 2023
171 CVEs were published on February 16, 2023: 11 critical, 54 high. 1 is now in CISA KEV.
- Published
- 171
- Critical
- 11
- High
- 54
- Medium
- 95
- Low
- 11
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 35
Most affected products
- Fortinet FortiWeb
- 16
- Fortinet FortiNAC
- 8
- Intel(R) SUR software
- 8
- Intel(R) Processors
- 6
- Intel(R) Media SDK software
- 5
- Intel(R) Quartus Prime Pro and Standard edition software
- 5
- Intel(R) Battery Life Diagnostic Tool software
- 3
- Intel(R) Trace Analyzer and Collector software
- 3
- Palantir Gotham
- 3
- PHP Group PHP
- 3
Critical 11
- CVE-2022-39952A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11,Fortinet FortiNAC
- CVE-2021-42756Multiple stack-based buffer overflow vulnerabilities [CWE-121] in the proxy daemon of FortiWeb 5.x all versions, 6.0.7 and below, 6.1.2 and Fortinet FortiWeb
- CVE-2023-23947Argo CD users with any cluster secret update access may update out-of-bounds cluster secretsargoproj argo-cd · github.com/argoproj/argo-cd +1
- CVE-2023-20032On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ partition file pCisco Secure Web Appliance · Cisco Secure Endpoint
- CVE-2022-3843WAGO: Exposure of configuration interface in unmanaged switchesWAGO Unmanaged Switch 852-111/000-001
- CVE-2023-22579Sequalize - Unsafe fall-through in getWhereConditionsFeathers-Sequalize Sequelize.js · sequelize +1
- CVE-2023-22578Sequalize - Default support for “raw attributes” when using parenthesesFeathers-Sequalize Sequelize.js · @sequelize/core +1
- CVE-2021-43529Thunderbird versions prior to 91.3.0 are vulnerable to the heap overflow described in CVE-2021-43527 when processing S/MIME messages.Mozilla Thunderbird
- CVE-2022-43969Ricoh mp_c4504ex devices with firmware 1.06 mishandle credentials.
- CVE-2023-24236TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the province parameter at setting/de
- CVE-2023-24238TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the city parameter at setting/delSta
High 54
- CVE-2022-36369Improper access control in some QATzip software maintained by Intel(R) before version 1.0.9 may allow an authenticated user to potentially eQATzip software maintained by Intel
- CVE-2022-36397Incorrect default permissions in the software installer for some Intel(R) QAT drivers for Linux before version 4.17 may allow an authenticatIntel(R) QAT drivers for Linux
- CVE-2022-21163Improper access control in the Crypto API Toolkit for Intel(R) SGX before version 2.0 commit ID 91ee496 may allow an authenticated user to pCrypto API Toolkit for Intel(R) SGX
- CVE-2022-33196Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R) Processors when using Intel(R) Software GuaIntel(R) Xeon(R) Processors with Intel® Software Guard Ext…
- CVE-2022-35729Out of bounds read in firmware for OpenBMC in some Intel(R) platforms before version 0.72 may allow unauthenticated user to potentially enabOpenBMC
- CVE-2022-33190Improper input validation in the Intel(R) SUR software before version 2.4.8902 may allow an authenticated user to potentially enable escalatIntel(R) SUR software
- CVE-2022-33964Improper input validation in the Intel(R) SUR software before version 2.4.8902 may allow an unauthenticated user to potentially enable escalIntel(R) SUR software
- CVE-2022-29514Improper access control in the Intel(R) SUR software before version 2.4.8902 may allow an unauthenticated user to potentially enable escalatIntel(R) SUR software
- CVE-2022-34153Improper initialization in the Intel(R) Battery Life Diagnostic Tool software before version 2.2.0 may allow an authenticated user to potentIntel(R) Battery Life Diagnostic Tool software
- CVE-2022-36278Insufficient control flow management in the Intel(R) Battery Life Diagnostic Tool software before version 2.2.0 may allow an authenticated uIntel(R) Battery Life Diagnostic Tool software
- CVE-2022-32764Description: Race condition in the Intel(R) DSA software before version 22.4.26 may allow an authenticated user to potentially enable escalaIntel(R) DSA software
- CVE-2022-30530Protection mechanism failure in the Intel(R) DSA software before version 22.4.26 may allow an authenticated user to potentially enable escalIntel(R) DSA software
- CVE-2022-36348Active debug code in some Intel (R) SPS firmware before version SPS_E5_04.04.04.300.0 may allow an authenticated user to potentially enable Intel (R) SPS firmware
- CVE-2022-30704Improper initialization in the Intel(R) TXT SINIT ACM for some Intel(R) Processors may allow a privileged user to potentially enable escalatIntel(R) Processors
- CVE-2022-26837Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of Intel(R) Processors
- CVE-2022-32231Improper initialization in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of prIntel(R) Processors
- CVE-2022-30539Use after free in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege vIntel(R) Processors
- CVE-2022-26343Improper access control in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of prIntel(R) Processors
- CVE-2022-26840Improper neutralization in the Intel(R) Quartus Prime Pro and Standard edition software may allow an authenticated user to potentially enablIntel(R) Quartus Prime Pro and Standard edition software
- CVE-2022-33902Insufficient control flow management in the Intel(R) Quartus Prime Pro and Standard edition software may allow an authenticated user to poteIntel(R) Quartus Prime Pro and Standard edition software
- CVE-2022-33892Path traversal in the Intel(R) Quartus Prime Pro and Standard edition software may allow an authenticated user to potentially enable escalatIntel(R) Quartus Prime Pro and Standard edition software
- CVE-2022-21216Insufficient granularity of access control in out-of-band management in some Intel(R) Atom and Intel Xeon Scalable Processors may allow a prIntel(R) Atom and Intel Xeon Scalable Processors
- CVE-2022-25992Insecure inherited permissions in the Intel(R) oneAPI Toolkits oneapi-cli before version 0.2.0 may allow an authenticated user to potentiallIntel(R) oneAPI Toolkits oneapi-cli
- CVE-2022-26843Insufficient visual distinction of homoglyphs presented to user in the Intel(R) oneAPI DPC++/C++ Compiler before version 2022.1 for Intel(R)Intel(R) oneAPI DPC++/C++ Compiler
- CVE-2022-25987Improper handling of Unicode encoding in source code to be compiled by the Intel(R) C++ Compiler Classic before version 2021.6 for Intel(R) Intel(R) C++ Compiler Classic
- CVE-2023-25653Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS)cisco node-jose · node-jose
- CVE-2022-33869An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiWAN 4.0.0 thFortinet FortiWAN
- CVE-2022-40683A double free in Fortinet FortiWeb version 7.0.0 through 7.0.3 may allows attacker to execute unauthorized code or commands via specially crFortinet FortiWeb
- CVE-2022-40677A improper neutralization of argument delimiters in a command ('argument injection') in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.Fortinet FortiNAC
- CVE-2022-40678An insufficiently protected credentials in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11,Fortinet FortiNAC
- CVE-2022-27482A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiADC version 7.0.0 through 7.0.Fortinet FortiADC
- CVE-2022-27489A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7.0.0 through 7.0.3, Fortinet FortiExtender
- CVE-2022-41334An improper neutralization of input during web page generation [CWE-79] vulnerability in FortiOS versions 7.0.0 to 7.0.7 and 7.2.0 to 7.2.3 Fortinet FortiOS
- CVE-2022-38375An improper authorization vulnerability [CWE-285] in Fortinet FortiNAC version 9.4.0 through 9.4.1 and before 9.2.6 allows an unauthenticatFortinet FortiNAC
- CVE-2023-23782A heap-based buffer overflow in Fortinet FortiWeb version 7.0.0 through 7.0.1, FortiWeb version 6.3.0 through 6.3.19, FortiWeb 6.4 all versiFortinet FortiWeb
- CVE-2023-23780A stack-based buffer overflow in Fortinet FortiWeb version 7.0.0 through 7.0.1, Fortinet FortiWeb version 6.3.6 through 6.3.19, Fortinet ForFortinet FortiWeb
- CVE-2023-25602A stack-based buffer overflow in Fortinet FortiWeb 6.4 all versions, FortiWeb versions 6.3.17 and earlier, FortiWeb versions 6.2.6 and earliFortinet FortiWeb
- CVE-2021-42761A condition for session fixation vulnerability [CWE-384] in the session management of FortiWeb versions 6.4 all versions, 6.3.0 through 6.3.Fortinet FortiWeb
- CVE-2022-30303An improper neutralization of special elements used in an os command ('OS Command Injection') [CWE-78] in FortiWeb 7.0.0 through 7.0.1, 6.3.Fortinet FortiWeb
- CVE-2022-41335A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.10, ForFortinet FortiSwitchManager · Fortinet FortiOS +1
- CVE-2023-24807Undici vulnerable to Regular Expression Denial of Service in Headersnodejs undici · undici
- CVE-2023-20014A vulnerability in the DNS functionality of Cisco Nexus Dashboard Software could allow an unauthenticated, remote attacker to cause a denialCisco Nexus Dashboard
- CVE-2023-0862Path Traversal in NetModule NSRWNetModule NSRW
- CVE-2023-0861Authenticated Command Injection in NetModule NSRWNetModule NSRW
- CVE-2023-0568Array overrun in common path resolve codePHP Group PHP
- CVE-2023-0662DoS vulnerability when parsing multipart request bodyPHP Group PHP
- CVE-2023-0567password_verify() always returns true for some invalid hashesPHP Group PHP
- CVE-2020-6817bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS).Mozilla Bleach · bleach
- CVE-2022-40080Stack overflow vulnerability in Aspire E5-475G 's BIOS firmware, in the FpGui module, a second call to GetVariable services allows local att
- CVE-2022-47703TIANJIE CPE906-3 is vulnerable to password disclosure.
- CVE-2023-0860Improper Restriction of Excessive Authentication Attempts in modoboa/modoboa-installermodoboa/modoboa-installer · modoboa
- CVE-2023-0866Heap-based Buffer Overflow in gpac/gpacgpac/gpac
- CVE-2023-24483Privilege Escalation to NT AUTHORITY\SYSTEM on the vulnerable VDACitrix Virtual Apps and Desktops
- CVE-2023-24485Privilege Escalation on the system running a vulnerable version of Citrix Workspace app for WindowsCitrix Workspace App for Windows
Medium, low and unrated 106
- CVE-2023-0821Nomad Client Vulnerable to Decompression Bombs in Artifact BlockHashiCorp Nomad · github.com/hashicorp/nomad
- CVE-2022-41614Insufficiently protected credentials in the Intel(R) ON Event Series Android application before version 2.0 may allow an authenticated user Intel(R) ON Event Series Android application
- CVE-2022-41314Uncontrolled search path in some Intel(R) Network Adapter installer software may allow an authenticated user to potentially enable escalatioIntel(R) Network Adapter installer software
- CVE-2021-33104Improper access control in the Intel(R) OFU software before version 14.1.28 may allow an authenticated user to potentially enable denial of Intel(R) OFU software
- CVE-2022-38090Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard Extensions may allow a privileged userIntel(R) Processors with Intel(R) Software Guard Extensions
- CVE-2022-38056Improper neutralization in the Intel(R) EMA software before version 1.8.1.0 may allow a privileged user to potentially enable escalation of Intel(R) EMA software
- CVE-2022-27234Server-side request forgery in the CVAT software maintained by Intel(R) before version 2.0.1 may allow an authenticated user to potentially CVAT software maintained by Intel
- CVE-2022-27808Insufficient control flow management in some Intel(R) Ethernet Controller Administrative Tools drivers for Windows before version 1.5.0.2 maIntel(R) Ethernet Controller Administrative Tools drivers f…
- CVE-2022-36382Out-of-bounds write in firmware for some Intel(R) Ethernet Network Controllers and Adapters E810 Series before version 1.7.0.8 and some InteIntel(R) Ethernet Network Controllers and Adapters E810 Ser…
- CVE-2022-37340Uncontrolled search path in some Intel(R) QAT drivers for Windows before version 1.6 may allow an authenticated user to potentially enable eIntel(R) QAT drivers for Windows
- CVE-2022-36797Protection mechanism failure in the Intel(R) Ethernet 500 Series Controller drivers for VMware before version 1.10.0.1 may allow an authentiIntel(R) Ethernet 500 Series Controller drivers for VMware
- CVE-2022-36416Protection mechanism failure in the Intel(R) Ethernet 500 Series Controller drivers for VMware before version 1.10.0.13 may allow an authentIntel(R) Ethernet 500 Series Controller drivers for VMware
- CVE-2022-36287Uncaught exception in the FCS Server software maintained by Intel before version 1.1.79.3 may allow a privileged user to potentially enable FCS Server software maintained by Intel
- CVE-2022-29493Uncaught exception in webserver for the Integrated BMC in some Intel(R) platforms before versions 2.86, 2.09 and 2.78 may allow a privilegedIntegrated BMC
- CVE-2022-29494Improper input validation in firmware for OpenBMC in some Intel(R) platforms before versions egs-0.91-179 and bhs-04-45 may allow an authentOpenBMC
- CVE-2022-29523Improper conditions check in the Open CAS software maintained by Intel(R) before version 22.3.1 may allow an authenticated user to potentialOpen CAS software maintained by Intel
- CVE-2022-34864Out-of-bounds read in the Intel(R) Trace Analyzer and Collector software before version 2021.5 may allow an authenticated user to potentiallIntel(R) Trace Analyzer and Collector software
- CVE-2022-32575Out-of-bounds write in the Intel(R) Trace Analyzer and Collector software before version 2021.5 may allow an authenticated user to potentialIntel(R) Trace Analyzer and Collector software
- CVE-2022-34843Integer overflow in the Intel(R) Trace Analyzer and Collector software before version 2021.5 may allow an authenticated user to potentially Intel(R) Trace Analyzer and Collector software
- CVE-2022-35883NULL pointer dereference in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable deniIntel(R) Media SDK software
- CVE-2022-36289Protection mechanism failure in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable Intel(R) Media SDK software
- CVE-2022-34346Out-of-bounds read in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable escalationIntel(R) Media SDK software
- CVE-2022-27170Protection mechanism failure in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable Intel(R) Media SDK software
- CVE-2022-34841Improper buffer restrictions in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable Intel(R) Media SDK software
- CVE-2022-33972Incorrect calculation in microcode keying mechanism for some 3rd Generation Intel(R) Xeon(R) Scalable Processors may allow a privileged user3rd Generation Intel(R) Xeon(R) Scalable Processors
- CVE-2022-32971Improper authentication in the Intel(R) SUR software before version 2.4.8902 may allow a privileged user to potentially enable escalation ofIntel(R) SUR software
- CVE-2022-31476Improper access control in the Intel(R) SUR software before version 2.4.8902 may allow an authenticated user to potentially enable denial ofIntel(R) SUR software
- CVE-2022-33946Improper authentication in the Intel(R) SUR software before version 2.4.8902 may allow an authenticated user to potentially enable escalatioIntel(R) SUR software
- CVE-2022-30692Improper conditions check in the Intel(R) SUR software before version 2.4.8902 may allow an unauthenticated user to potentially enable deniaIntel(R) SUR software
- CVE-2022-34854Improper access control in the Intel(R) SUR software before version 2.4.8902 may allow an authenticated user to potentially enable escalatioIntel(R) SUR software
- CVE-2022-34157Improper access control in the Intel(R) FPGA SDK for OpenCL(TM) with Intel(R) Quartus(R) Prime Pro Edition software before version 22.1 may Intel(R) FPGA SDK for OpenCL(TM) with Intel(R) Quartus(R) P…
- CVE-2022-37329Uncontrolled search path in some Intel(R) Quartus(R) Prime Pro and Standard Edition software may allow an authenticated user to potentially Intel(R) Quartus(R) Prime Pro and Standard Edition software
- CVE-2022-34849Uncaught exception in the Intel(R) Iris(R) Xe MAX drivers for Windows before version 100.0.5.1436(v2) may allow a privileged user to potentiIntel(R) Iris(R) Xe MAX drivers for Windows
- CVE-2022-30531Out-of-bounds read in the Intel(R) Iris(R) Xe MAX drivers for Windows before version 100.0.5.1474 may allow a privileged user to potentiallyIntel(R) Iris(R) Xe MAX drivers for Windows
- CVE-2022-36398Uncontrolled search path in the Intel(R) Battery Life Diagnostic Tool software before version 2.2.0 may allow an authenticated user to potenIntel(R) Battery Life Diagnostic Tool software
- CVE-2022-30339Out-of-bounds read in firmware for the Intel(R) Integrated Sensor Solution before versions 5.4.2.4579v3, 5.4.1.4479 and 5.0.0.4143 may allowIntel(R) Integrated Sensor Solution
- CVE-2022-36794Improper condition check in some Intel(R) SPS firmware before version SPS_E3_06.00.03.300.0 may allow a privileged user to potentially enablIntel(R) SPS firmware
- CVE-2022-26888Cross-site scripting in the Intel(R) Quartus Prime Pro and Standard edition software may allow an authenticated user to potentially enable iIntel(R) Quartus Prime Pro and Standard edition software
- CVE-2022-32570Improper authentication in the Intel(R) Quartus Prime Pro and Standard edition software may allow an authenticated user to potentially enablIntel(R) Quartus Prime Pro and Standard edition software
- CVE-2022-26841Insufficient control flow management for the Intel(R) SGX SDK software for Linux before version 2.16.100.1 may allow an authenticated user tIntel(R) SGX SDK software for Linux
- CVE-2022-26509Improper conditions check in the Intel(R) SGX SDK software may allow a privileged user to potentially enable information disclosure via locaIntel(R) SGX SDK software
- CVE-2022-26052Uncontrolled search path element in the Intel(R) MPI Library before version 2021.6 for Intel(R) oneAPI HPC Toolkit may allow an authenticateIntel(R) MPI Library for Intel(R) oneAPI HPC Toolkit
- CVE-2022-26421Uncontrolled search path element in the Intel(R) oneAPI DPC++/C++ Compiler Runtime before version 2022.0 may allow an authenticated user to Intel(R) oneAPI DPC++/C++ Compiler Runtime
- CVE-2022-26032Uncontrolled search path element in the Intel(R) Distribution for Python programming language before version 2022.1 for Intel(R) oneAPI ToolIntel(R) Distribution for Python programming language for I…
- CVE-2022-26076Uncontrolled search path element in the Intel(R) oneAPI Deep Neural Network (oneDNN) before version 2022.1 may allow an authenticated user tIntel(R) oneAPI Deep Neural Network
- CVE-2022-26425Uncontrolled search path element in the Intel(R) oneAPI Collective Communications Library (oneCCL) before version 2021.6 for Intel(R) oneAPIIntel(R) oneAPI Collective Communications Library (oneCCL)…
- CVE-2022-25905Uncontrolled search path element in the Intel(R) oneAPI Data Analytics Library (oneDAL) before version 2021.5 for Intel(R) oneAPI Base ToolkIntel(R) oneAPI Data Analytics Library (oneDAL) for Intel(R…
- CVE-2022-26062Uncontrolled search path element in the Intel(R) Trace Analyzer and Collector before version 2021.6 for Intel(R) oneAPI HPC Toolkit may alloIntel(R) Trace Analyzer and Collector for Intel(R) oneAPI H…
- CVE-2022-26345Uncontrolled search path element in the Intel(R) oneAPI Toolkit OpenMP before version 2022.1 may allow an authenticated user to potentially Intel(R) oneAPI Toolkit OpenMP
- CVE-2022-26512Uncontrolled search path element in the Intel(R) FPGA Add-on for Intel(R) oneAPI Base Toolkit before version 2022.2 may allow an authenticatIntel(R) FPGA Add-on for Intel(R) oneAPI Base Toolkit
- CVE-2023-0475Go-Getter Vulnerable to Decompression BombsHashiCorp go-getter · github.com/hashicorp/go-getter +1
- CVE-2022-29054A missing cryptographic steps vulnerability [CWE-325] in the functions that encrypt the DHCP and DNS keys in Fortinet FortiOS version 7.2.0,Fortinet FortiOS · Fortinet FortiProxy
- CVE-2022-26115A use of password hash with insufficient computational effort vulnerability [CWE-916] in FortiSandbox before 4.2.0 may allow an attacker witFortinet FortiSandbox
- CVE-2023-22638Several improper neutralization of inputs during web page generation vulnerability [CWE-79] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9Fortinet FortiNAC
- CVE-2022-42472A improper neutralization of crlf sequences in http headers ('http response splitting') vulnerability in Fortinet FortiOS 7.2.0 through 7.2.Fortinet FortiProxy · Fortinet FortiOS
- CVE-2022-40675Some cryptographic issues in Fortinet FortiNAC versions 9.4.0 through 9.4.1, 9.2.0 through 9.2.7, 9.1.0 through 9.1.8, 8.8.0 through 8.8.11,Fortinet FortiNAC
- CVE-2022-39954An improper restriction of xml external entity reference in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.Fortinet FortiNAC
- CVE-2022-38378An improper privilege management vulnerability [CWE-269] in Fortinet FortiOS version 7.2.0 and before 7.0.7 and FortiProxy version 7.2.0 thrFortinet FortiOS · Fortinet FortiProxy
- CVE-2022-39948An improper certificate validation vulnerability [CWE-295] in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.7, 6.4 all versions, 6.2 all veFortinet FortiProxy · Fortinet FortiOS
- CVE-2022-30304An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiAnalyzer versions prior to 7.2.1, 7.0.4 and 6.Fortinet FortiAnalyzer
- CVE-2022-38376Multiple improper neutralization of input during web page generation ('Cross-site Scripting') vulnerabilities [CWE-79] in Fortinet FortiNAC Fortinet FortiNAC
- CVE-2023-23778A relative path traversal vulnerability [CWE-23] in FortiWeb version 7.0.1 and below, 6.4 all versions, 6.3 all versions, 6.2 all versions mFortinet FortiWeb
- CVE-2023-23779Multiple improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in FortiWeb verFortinet FortiWeb
- CVE-2022-30306A stack-based buffer overflow vulnerability [CWE-121] in the CA sign functionality of FortiWeb version 7.0.1 and below, 6.4 all versions, veFortinet FortiWeb
- CVE-2022-33871A stack-based buffer overflow vulnerability [CWE-121] in FortiWeb version 7.0.1 and earlier, 6.4 all versions, version 6.3.19 and earlier maFortinet FortiWeb
- CVE-2023-23781A stack-based buffer overflow vulnerability [CWE-121] in FortiWeb version 7.0.1 and below, 6.4 all versions, version 6.3.19 and below SAML sFortinet FortiWeb
- CVE-2023-23783A use of externally-controlled format string in Fortinet FortiWeb version 7.0.0 through 7.0.1, FortiWeb 6.4 all versions allows attacker to Fortinet FortiWeb
- CVE-2023-23784A relative path traversal in Fortinet FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.3.6 through 6.3.20, FortiWeb 6.4 all versionsFortinet FortiWeb
- CVE-2022-30299A path traversal vulnerability [CWE-23] in the API of FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, 6.4 all versions, 6.2 all versionsFortinet FortiWeb
- CVE-2021-43074An improper verification of cryptographic signature vulnerability [CWE-347] in FortiWeb 6.4 all versions, 6.3.16 and below, 6.2 all versionsFortinet FortiSwitch · Fortinet FortiWeb +2
- CVE-2022-30300A relative path traversal vulnerability [CWE-23] in FortiWeb 7.0.0 through 7.0.1, 6.3.6 through 6.3.18, 6.4 all versions may allow an authenFortinet FortiWeb
- CVE-2022-43954An insertion of sensitive information into log file vulnerability [CWE-532] in the FortiPortal management interface 7.0.0 through 7.0.2 may Fortinet FortiPortal
- CVE-2023-23936CRLF Injection in Nodejs ‘undici’ via hostnodejs undici · undici
- CVE-2023-23752[20230201] - Core - Improper access check in webservice endpointsJoomla! Project Joomla! CMS
- CVE-2023-20085A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attackeCisco Identity Services Engine Software
- CVE-2023-20053A vulnerability in the web-based management interface of Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to conduct a Cisco Nexus Dashboard
- CVE-2022-20952A vulnerability in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web Appliance, formerly known as Cisco Web Security AppliCisco Secure Web Appliance
- CVE-2023-20052On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the DMG file parser of ClCisco Secure Endpoint
- CVE-2023-20075Vulnerability in the CLI of Cisco Secure Email Gateway could allow an authenticated, remote attacker to execute arbitrary commands.Cisco Secure Email
- CVE-2023-20009A vulnerability in the Web UI and administrative CLI of the Cisco Secure Email Gateway (ESA) and Cisco Secure Email and Web Manager (SMA) coCisco Secure Email
- CVE-2023-22580Sequalize - Bad query filtering leading to SQL errorsFeathers-Sequalize Sequelize.js · sequelize +1
- CVE-2023-25173containerd supplementary groups are not set up properlycontainerd · github.com/containerd/containerd
- CVE-2023-25153containerd OCI image importer memory exhaustioncontainerd · github.com/containerd/containerd
- CVE-2019-17003Scanning a QR code that contained a javascript: URL would have resulted in the Javascript being executed.Mozilla Firefox for iOS
- CVE-2020-12413The Raccoon attack is a timing attack on DHE ciphersuites inherit in the TLS specification.Mozilla Firefox
- CVE-2021-0187Improper access control in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable an escalation ofIntel(R) Processors
- CVE-2021-23980A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscripMozilla Bleach · bleach
- CVE-2021-40555Cross site scripting (XSS) vulnerability in flatCore-CMS 2.2.15 allows attackers to execute arbitrary code via description field on the new
- CVE-2022-0637open redirect in pollbot (pollbot.services.mozilla.com) in versions before 1.4.6mozilla/pollbot · pollbot
- CVE-2022-27890It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactoryPalantir AtlasDB
- CVE-2022-27891Palantir Gotham included an unauthenticated endpoint that listed all active usernames in the platform with an active session. Palantir Gotham
- CVE-2022-27892Palantir Gotham included an endpoint that would log arbitrary sized payloads. Palantir Gotham
- CVE-2022-27897Palantir Gotham included an endpoint that would log arbitrary sized zip files. Palantir Gotham
- CVE-2022-38731Qaelum DOSE 18.08 through 21.1 before 21.2 allows Directory Traversal via the loadimages name parameter.
- CVE-2022-44299SiteServerCMS 7.1.3 sscms has a file read vulnerability.
- CVE-2022-48306Gotham Chat IRC help does not validate hostnames in TLS certificatesPalantir Gotham Chat IRC helper
- CVE-2022-48307It was discovered that the Magritte-ftp was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactorPalantir Foundry Magritte
- CVE-2022-48308It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactoryPalantir sls-logging
- CVE-2022-48324Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code.
- CVE-2022-48325Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code.
- CVE-2022-48326Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code.
- CVE-2022-48327Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code.
- CVE-2023-22380Path traversal in GitHub Enterprise Server leading to arbitrary file reading when building a GitHub Pages siteGitHub Enterprise Server
- CVE-2023-23558In Eternal Terminal 6.2.1, TelemetryService uses fixed paths in /tmp.
- CVE-2023-23926APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j.neo4j apoc · org.neo4j.procedure:apoc-core
- CVE-2023-24484A malicious user can cause log files to be written to a directory that they do not have permission to write to.Citrix Workspace App for Windows