# CVEs published 2023-02-16

171 CVEs were published on February 16, 2023: 11 critical, 54 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2023-0821](https://cve.now/CVE-2023-0821.md): Nomad Client Vulnerable to Decompression Bombs in Artifact Block (CVSS 6.5, HashiCorp Nomad · github.com/hashicorp/nomad)
- [CVE-2022-41614](https://cve.now/CVE-2022-41614.md): Insufficiently protected credentials in the Intel(R) ON Event Series Android application before version 2.0 may allow an authenticated user (CVSS 5.5, Intel(R) ON Event Series Android application)
- [CVE-2022-41314](https://cve.now/CVE-2022-41314.md): Uncontrolled search path in some Intel(R) Network Adapter installer software may allow an authenticated user to potentially enable escalatio (CVSS 6.7, Intel(R) Network Adapter installer software)
- [CVE-2021-33104](https://cve.now/CVE-2021-33104.md): Improper access control in the Intel(R) OFU software before version 14.1.28 may allow an authenticated user to potentially enable denial of (CVSS 6.5, Intel(R) OFU software)
- [CVE-2022-38090](https://cve.now/CVE-2022-38090.md): Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard Extensions may allow a privileged user (CVSS 6.0, Intel(R) Processors with Intel(R) Software Guard Extensions)
- [CVE-2022-36369](https://cve.now/CVE-2022-36369.md): Improper access control in some QATzip software maintained by Intel(R) before version 1.0.9 may allow an authenticated user to potentially e (CVSS 7.8, QATzip software maintained by Intel)
- [CVE-2022-38056](https://cve.now/CVE-2022-38056.md): Improper neutralization in the Intel(R) EMA software before version 1.8.1.0 may allow a privileged user to potentially enable escalation of (CVSS 3.8, Intel(R) EMA software)
- [CVE-2022-27234](https://cve.now/CVE-2022-27234.md): Server-side request forgery in the CVAT software maintained by Intel(R) before version 2.0.1 may allow an authenticated user to potentially (CVSS 4.3, CVAT software maintained by Intel)
- [CVE-2022-27808](https://cve.now/CVE-2022-27808.md): Insufficient control flow management in some Intel(R) Ethernet Controller Administrative Tools drivers for Windows before version 1.5.0.2 ma (CVSS 6.3, Intel(R) Ethernet Controller Administrative Tools drivers f…)
- [CVE-2022-36382](https://cve.now/CVE-2022-36382.md): Out-of-bounds write in firmware for some Intel(R) Ethernet Network Controllers and Adapters E810 Series before version 1.7.0.8 and some Inte (CVSS 6.0, Intel(R) Ethernet Network Controllers and Adapters E810 Ser…)
- [CVE-2022-37340](https://cve.now/CVE-2022-37340.md): Uncontrolled search path in some Intel(R) QAT drivers for Windows before version 1.6 may allow an authenticated user to potentially enable e (CVSS 6.7, Intel(R) QAT drivers for Windows)
- [CVE-2022-36397](https://cve.now/CVE-2022-36397.md): Incorrect default permissions in the software installer for some Intel(R) QAT drivers for Linux before version 4.17 may allow an authenticat (CVSS 7.3, Intel(R) QAT drivers for Linux)
- [CVE-2022-36797](https://cve.now/CVE-2022-36797.md): Protection mechanism failure in the Intel(R) Ethernet 500 Series Controller drivers for VMware before version 1.10.0.1 may allow an authenti (CVSS 3.3, Intel(R) Ethernet 500 Series Controller drivers for VMware)
- [CVE-2022-36416](https://cve.now/CVE-2022-36416.md): Protection mechanism failure in the Intel(R) Ethernet 500 Series Controller drivers for VMware before version 1.10.0.13 may allow an authent (CVSS 4.4, Intel(R) Ethernet 500 Series Controller drivers for VMware)
- [CVE-2022-21163](https://cve.now/CVE-2022-21163.md): Improper access control in the Crypto API Toolkit for Intel(R) SGX before version 2.0 commit ID 91ee496 may allow an authenticated user to p (CVSS 8.4, Crypto API Toolkit for Intel(R) SGX)
- [CVE-2022-36287](https://cve.now/CVE-2022-36287.md): Uncaught exception in the FCS Server software maintained by Intel before version 1.1.79.3 may allow a privileged user to potentially enable (CVSS 4.0, FCS Server software maintained by Intel)
- [CVE-2022-33196](https://cve.now/CVE-2022-33196.md): Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R) Processors when using Intel(R) Software Gua (CVSS 7.2, Intel(R) Xeon(R) Processors with Intel® Software Guard Ext…)
- [CVE-2022-29493](https://cve.now/CVE-2022-29493.md): Uncaught exception in webserver for the Integrated BMC in some Intel(R) platforms before versions 2.86, 2.09 and 2.78 may allow a privileged (CVSS 4.5, Integrated BMC)
- [CVE-2022-29494](https://cve.now/CVE-2022-29494.md): Improper input validation in firmware for OpenBMC in some Intel(R) platforms before versions egs-0.91-179 and bhs-04-45 may allow an authent (CVSS 6.5, OpenBMC)
- [CVE-2022-35729](https://cve.now/CVE-2022-35729.md): Out of bounds read in firmware for OpenBMC in some Intel(R) platforms before version 0.72 may allow unauthenticated user to potentially enab (CVSS 7.5, OpenBMC)
- [CVE-2022-29523](https://cve.now/CVE-2022-29523.md): Improper conditions check in the Open CAS software maintained by Intel(R) before version 22.3.1 may allow an authenticated user to potential (CVSS 3.3, Open CAS software maintained by Intel)
- [CVE-2022-34864](https://cve.now/CVE-2022-34864.md): Out-of-bounds read in the Intel(R) Trace Analyzer and Collector software before version 2021.5 may allow an authenticated user to potentiall (CVSS 4.2, Intel(R) Trace Analyzer and Collector software)
- [CVE-2022-32575](https://cve.now/CVE-2022-32575.md): Out-of-bounds write in the Intel(R) Trace Analyzer and Collector software before version 2021.5 may allow an authenticated user to potential (CVSS 4.8, Intel(R) Trace Analyzer and Collector software)
- [CVE-2022-34843](https://cve.now/CVE-2022-34843.md): Integer overflow in the Intel(R) Trace Analyzer and Collector software before version 2021.5 may allow an authenticated user to potentially (CVSS 4.8, Intel(R) Trace Analyzer and Collector software)
- [CVE-2022-35883](https://cve.now/CVE-2022-35883.md): NULL pointer dereference in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable deni (CVSS 2.2, Intel(R) Media SDK software)
- [CVE-2022-36289](https://cve.now/CVE-2022-36289.md): Protection mechanism failure in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable (CVSS 2.8, Intel(R) Media SDK software)
- [CVE-2022-34346](https://cve.now/CVE-2022-34346.md): Out-of-bounds read in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable escalation (CVSS 4.8, Intel(R) Media SDK software)
- [CVE-2022-27170](https://cve.now/CVE-2022-27170.md): Protection mechanism failure in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable (CVSS 5.7, Intel(R) Media SDK software)
- [CVE-2022-34841](https://cve.now/CVE-2022-34841.md): Improper buffer restrictions in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable (CVSS 5.7, Intel(R) Media SDK software)
- [CVE-2022-33972](https://cve.now/CVE-2022-33972.md): Incorrect calculation in microcode keying mechanism for some 3rd Generation Intel(R) Xeon(R) Scalable Processors may allow a privileged user (CVSS 6.1, 3rd Generation Intel(R) Xeon(R) Scalable Processors)
- [CVE-2022-32971](https://cve.now/CVE-2022-32971.md): Improper authentication in the Intel(R) SUR software before version 2.4.8902 may allow a privileged user to potentially enable escalation of (CVSS 3.1, Intel(R) SUR software)
- [CVE-2022-31476](https://cve.now/CVE-2022-31476.md): Improper access control in the Intel(R) SUR software before version 2.4.8902 may allow an authenticated user to potentially enable denial of (CVSS 5.5, Intel(R) SUR software)
- [CVE-2022-33946](https://cve.now/CVE-2022-33946.md): Improper authentication in the Intel(R) SUR software before version 2.4.8902 may allow an authenticated user to potentially enable escalatio (CVSS 5.6, Intel(R) SUR software)
- [CVE-2022-30692](https://cve.now/CVE-2022-30692.md): Improper conditions check in the Intel(R) SUR software before version 2.4.8902 may allow an unauthenticated user to potentially enable denia (CVSS 5.9, Intel(R) SUR software)
- [CVE-2022-34854](https://cve.now/CVE-2022-34854.md): Improper access control in the Intel(R) SUR software before version 2.4.8902 may allow an authenticated user to potentially enable escalatio (CVSS 6.7, Intel(R) SUR software)
- [CVE-2022-33190](https://cve.now/CVE-2022-33190.md): Improper input validation in the Intel(R) SUR software before version 2.4.8902 may allow an authenticated user to potentially enable escalat (CVSS 7.1, Intel(R) SUR software)
- [CVE-2022-33964](https://cve.now/CVE-2022-33964.md): Improper input validation in the Intel(R) SUR software before version 2.4.8902 may allow an unauthenticated user to potentially enable escal (CVSS 7.4, Intel(R) SUR software)
- [CVE-2022-29514](https://cve.now/CVE-2022-29514.md): Improper access control in the Intel(R) SUR software before version 2.4.8902 may allow an unauthenticated user to potentially enable escalat (CVSS 7.7, Intel(R) SUR software)
- [CVE-2022-34157](https://cve.now/CVE-2022-34157.md): Improper access control in the Intel(R) FPGA SDK for OpenCL(TM) with Intel(R) Quartus(R) Prime Pro Edition software before version 22.1 may (CVSS 6.7, Intel(R) FPGA SDK for OpenCL(TM) with Intel(R) Quartus(R) P…)
- [CVE-2022-37329](https://cve.now/CVE-2022-37329.md): Uncontrolled search path in some Intel(R) Quartus(R) Prime Pro and Standard Edition software may allow an authenticated user to potentially (CVSS 6.7, Intel(R) Quartus(R) Prime Pro and Standard Edition software)
- [CVE-2022-34849](https://cve.now/CVE-2022-34849.md): Uncaught exception in the Intel(R) Iris(R) Xe MAX drivers for Windows before version 100.0.5.1436(v2) may allow a privileged user to potenti (CVSS 4.4, Intel(R) Iris(R) Xe MAX drivers for Windows)
- [CVE-2022-30531](https://cve.now/CVE-2022-30531.md): Out-of-bounds read in the Intel(R) Iris(R) Xe MAX drivers for Windows before version 100.0.5.1474 may allow a privileged user to potentially (CVSS 4.4, Intel(R) Iris(R) Xe MAX drivers for Windows)
- [CVE-2022-36398](https://cve.now/CVE-2022-36398.md): Uncontrolled search path in the Intel(R) Battery Life Diagnostic Tool software before version 2.2.0 may allow an authenticated user to poten (CVSS 6.7, Intel(R) Battery Life Diagnostic Tool software)
- [CVE-2022-34153](https://cve.now/CVE-2022-34153.md): Improper initialization in the Intel(R) Battery Life Diagnostic Tool software before version 2.2.0 may allow an authenticated user to potent (CVSS 8.2, Intel(R) Battery Life Diagnostic Tool software)
- [CVE-2022-36278](https://cve.now/CVE-2022-36278.md): Insufficient control flow management in the Intel(R) Battery Life Diagnostic Tool software before version 2.2.0 may allow an authenticated u (CVSS 8.2, Intel(R) Battery Life Diagnostic Tool software)
- [CVE-2022-32764](https://cve.now/CVE-2022-32764.md): Description: Race condition in the Intel(R) DSA software before version 22.4.26 may allow an authenticated user to potentially enable escala (CVSS 7.5, Intel(R) DSA software)
- [CVE-2022-30530](https://cve.now/CVE-2022-30530.md): Protection mechanism failure in the Intel(R) DSA software before version 22.4.26 may allow an authenticated user to potentially enable escal (CVSS 7.8, Intel(R) DSA software)
- [CVE-2022-30339](https://cve.now/CVE-2022-30339.md): Out-of-bounds read in firmware for the Intel(R) Integrated Sensor Solution before versions 5.4.2.4579v3, 5.4.1.4479 and 5.0.0.4143 may allow (CVSS 6.0, Intel(R) Integrated Sensor Solution)
- [CVE-2022-36794](https://cve.now/CVE-2022-36794.md): Improper condition check in some Intel(R) SPS firmware before version SPS\_E3\_06.00.03.300.0 may allow a privileged user to potentially enabl (CVSS 6.0, Intel(R) SPS firmware)
- [CVE-2022-36348](https://cve.now/CVE-2022-36348.md): Active debug code in some Intel (R) SPS firmware before version SPS\_E5\_04.04.04.300.0 may allow an authenticated user to potentially enable (CVSS 8.8, Intel (R) SPS firmware)
- [CVE-2022-30704](https://cve.now/CVE-2022-30704.md): Improper initialization in the Intel(R) TXT SINIT ACM for some Intel(R) Processors may allow a privileged user to potentially enable escalat (CVSS 7.2, Intel(R) Processors)
- [CVE-2022-26837](https://cve.now/CVE-2022-26837.md): Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of (CVSS 7.5, Intel(R) Processors)
- [CVE-2022-32231](https://cve.now/CVE-2022-32231.md): Improper initialization in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of pr (CVSS 7.5, Intel(R) Processors)
- [CVE-2022-30539](https://cve.now/CVE-2022-30539.md): Use after free in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege v (CVSS 7.5, Intel(R) Processors)
- [CVE-2022-26343](https://cve.now/CVE-2022-26343.md): Improper access control in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of pr (CVSS 8.2, Intel(R) Processors)
- [CVE-2022-26888](https://cve.now/CVE-2022-26888.md): Cross-site scripting in the Intel(R) Quartus Prime Pro and Standard edition software may allow an authenticated user to potentially enable i (CVSS 2.8, Intel(R) Quartus Prime Pro and Standard edition software)
- [CVE-2022-32570](https://cve.now/CVE-2022-32570.md): Improper authentication in the Intel(R) Quartus Prime Pro and Standard edition software may allow an authenticated user to potentially enabl (CVSS 6.7, Intel(R) Quartus Prime Pro and Standard edition software)
- [CVE-2022-26840](https://cve.now/CVE-2022-26840.md): Improper neutralization in the Intel(R) Quartus Prime Pro and Standard edition software may allow an authenticated user to potentially enabl (CVSS 7.3, Intel(R) Quartus Prime Pro and Standard edition software)
- [CVE-2022-33902](https://cve.now/CVE-2022-33902.md): Insufficient control flow management in the Intel(R) Quartus Prime Pro and Standard edition software may allow an authenticated user to pote (CVSS 7.3, Intel(R) Quartus Prime Pro and Standard edition software)
- [CVE-2022-33892](https://cve.now/CVE-2022-33892.md): Path traversal in the Intel(R) Quartus Prime Pro and Standard edition software may allow an authenticated user to potentially enable escalat (CVSS 7.3, Intel(R) Quartus Prime Pro and Standard edition software)
- [CVE-2022-21216](https://cve.now/CVE-2022-21216.md): Insufficient granularity of access control in out-of-band management in some Intel(R) Atom and Intel Xeon Scalable Processors may allow a pr (CVSS 7.5, Intel(R) Atom and Intel Xeon Scalable Processors)
- [CVE-2022-26841](https://cve.now/CVE-2022-26841.md): Insufficient control flow management for the Intel(R) SGX SDK software for Linux before version 2.16.100.1 may allow an authenticated user t (CVSS 2.5, Intel(R) SGX SDK software for Linux)
- [CVE-2022-26509](https://cve.now/CVE-2022-26509.md): Improper conditions check in the Intel(R) SGX SDK software may allow a privileged user to potentially enable information disclosure via loca (CVSS 2.5, Intel(R) SGX SDK software)
- [CVE-2022-26052](https://cve.now/CVE-2022-26052.md): Uncontrolled search path element in the Intel(R) MPI Library before version 2021.6 for Intel(R) oneAPI HPC Toolkit may allow an authenticate (CVSS 6.7, Intel(R) MPI Library for Intel(R) oneAPI HPC Toolkit)
- [CVE-2022-26421](https://cve.now/CVE-2022-26421.md): Uncontrolled search path element in the Intel(R) oneAPI DPC++/C++ Compiler Runtime before version 2022.0 may allow an authenticated user to (CVSS 6.7, Intel(R) oneAPI DPC++/C++ Compiler Runtime)
- [CVE-2022-26032](https://cve.now/CVE-2022-26032.md): Uncontrolled search path element in the Intel(R) Distribution for Python programming language before version 2022.1 for Intel(R) oneAPI Tool (CVSS 6.7, Intel(R) Distribution for Python programming language for I…)
- [CVE-2022-26076](https://cve.now/CVE-2022-26076.md): Uncontrolled search path element in the Intel(R) oneAPI Deep Neural Network (oneDNN) before version 2022.1 may allow an authenticated user t (CVSS 6.7, Intel(R) oneAPI Deep Neural Network)
- [CVE-2022-26425](https://cve.now/CVE-2022-26425.md): Uncontrolled search path element in the Intel(R) oneAPI Collective Communications Library (oneCCL) before version 2021.6 for Intel(R) oneAPI (CVSS 6.7, Intel(R) oneAPI Collective Communications Library (oneCCL)…)
- [CVE-2022-25905](https://cve.now/CVE-2022-25905.md): Uncontrolled search path element in the Intel(R) oneAPI Data Analytics Library (oneDAL) before version 2021.5 for Intel(R) oneAPI Base Toolk (CVSS 6.7, Intel(R) oneAPI Data Analytics Library (oneDAL) for Intel(R…)
- [CVE-2022-26062](https://cve.now/CVE-2022-26062.md): Uncontrolled search path element in the Intel(R) Trace Analyzer and Collector before version 2021.6 for Intel(R) oneAPI HPC Toolkit may allo (CVSS 6.7, Intel(R) Trace Analyzer and Collector for Intel(R) oneAPI H…)
- [CVE-2022-26345](https://cve.now/CVE-2022-26345.md): Uncontrolled search path element in the Intel(R) oneAPI Toolkit OpenMP before version 2022.1 may allow an authenticated user to potentially (CVSS 6.7, Intel(R) oneAPI Toolkit OpenMP)
- [CVE-2022-26512](https://cve.now/CVE-2022-26512.md): Uncontrolled search path element in the Intel(R) FPGA Add-on for Intel(R) oneAPI Base Toolkit before version 2022.2 may allow an authenticat (CVSS 6.7, Intel(R) FPGA Add-on for Intel(R) oneAPI Base Toolkit)
- [CVE-2022-25992](https://cve.now/CVE-2022-25992.md): Insecure inherited permissions in the Intel(R) oneAPI Toolkits oneapi-cli before version 0.2.0 may allow an authenticated user to potentiall (CVSS 7.5, Intel(R) oneAPI Toolkits oneapi-cli)
- [CVE-2022-26843](https://cve.now/CVE-2022-26843.md): Insufficient visual distinction of homoglyphs presented to user in the Intel(R) oneAPI DPC++/C++ Compiler before version 2022.1 for Intel(R) (CVSS 8.3, Intel(R) oneAPI DPC++/C++ Compiler)
- [CVE-2022-25987](https://cve.now/CVE-2022-25987.md): Improper handling of Unicode encoding in source code to be compiled by the Intel(R) C++ Compiler Classic before version 2021.6 for Intel(R) (CVSS 8.3, Intel(R) C++ Compiler Classic)
- [CVE-2023-0475](https://cve.now/CVE-2023-0475.md): Go-Getter Vulnerable to Decompression Bombs (CVSS 4.2, HashiCorp go-getter · github.com/hashicorp/go-getter +1)
- [CVE-2023-25653](https://cve.now/CVE-2023-25653.md): Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS) (CVSS 7.5, cisco node-jose · node-jose)
- [CVE-2022-33869](https://cve.now/CVE-2022-33869.md): An improper neutralization of special elements used in an OS command vulnerability \[CWE-78\] in the management interface of FortiWAN 4.0.0 th (CVSS 8.0, Fortinet FortiWAN)
- [CVE-2022-29054](https://cve.now/CVE-2022-29054.md): A missing cryptographic steps vulnerability \[CWE-325\] in the functions that encrypt the DHCP and DNS keys in Fortinet FortiOS version 7.2.0, (CVSS 3.1, Fortinet FortiOS · Fortinet FortiProxy)
- [CVE-2022-26115](https://cve.now/CVE-2022-26115.md): A use of password hash with insufficient computational effort vulnerability \[CWE-916\] in FortiSandbox before 4.2.0 may allow an attacker wit (CVSS 5.4, Fortinet FortiSandbox)
- [CVE-2023-22638](https://cve.now/CVE-2023-22638.md): Several improper neutralization of inputs during web page generation vulnerability \[CWE-79\] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9 (CVSS 6.7, Fortinet FortiNAC)
- [CVE-2022-40683](https://cve.now/CVE-2022-40683.md): A double free in Fortinet FortiWeb version 7.0.0 through 7.0.3 may allows attacker to execute unauthorized code or commands via specially cr (CVSS 7.1, Fortinet FortiWeb)
- [CVE-2022-42472](https://cve.now/CVE-2022-42472.md): A improper neutralization of crlf sequences in http headers ('http response splitting') vulnerability in Fortinet FortiOS 7.2.0 through 7.2. (CVSS 4.0, Fortinet FortiProxy · Fortinet FortiOS)
- [CVE-2022-40677](https://cve.now/CVE-2022-40677.md): A improper neutralization of argument delimiters in a command ('argument injection') in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2. (CVSS 7.2, Fortinet FortiNAC)
- [CVE-2022-39952](https://cve.now/CVE-2022-39952.md): A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, (CVSS 9.8, Fortinet FortiNAC)
- [CVE-2022-40675](https://cve.now/CVE-2022-40675.md): Some cryptographic issues in Fortinet FortiNAC versions 9.4.0 through 9.4.1, 9.2.0 through 9.2.7, 9.1.0 through 9.1.8, 8.8.0 through 8.8.11, (CVSS 6.0, Fortinet FortiNAC)
- [CVE-2022-39954](https://cve.now/CVE-2022-39954.md): An improper restriction of xml external entity reference in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9. (CVSS 6.9, Fortinet FortiNAC)
- [CVE-2022-40678](https://cve.now/CVE-2022-40678.md): An insufficiently protected credentials in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, (CVSS 7.4, Fortinet FortiNAC)
- [CVE-2022-27482](https://cve.now/CVE-2022-27482.md): A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiADC version 7.0.0 through 7.0. (CVSS 7.4, Fortinet FortiADC)
- [CVE-2022-27489](https://cve.now/CVE-2022-27489.md): A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7.0.0 through 7.0.3, (CVSS 7.0, Fortinet FortiExtender)
- [CVE-2022-38378](https://cve.now/CVE-2022-38378.md): An improper privilege management vulnerability \[CWE-269\] in Fortinet FortiOS version 7.2.0 and before 7.0.7 and FortiProxy version 7.2.0 thr (CVSS 4.0, Fortinet FortiOS · Fortinet FortiProxy)
- [CVE-2022-41334](https://cve.now/CVE-2022-41334.md): An improper neutralization of input during web page generation \[CWE-79\] vulnerability in FortiOS versions 7.0.0 to 7.0.7 and 7.2.0 to 7.2.3 (CVSS 8.6, Fortinet FortiOS)
- [CVE-2022-39948](https://cve.now/CVE-2022-39948.md): An improper certificate validation vulnerability \[CWE-295\] in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.7, 6.4 all versions, 6.2 all ve (CVSS 4.4, Fortinet FortiProxy · Fortinet FortiOS)
- [CVE-2022-30304](https://cve.now/CVE-2022-30304.md): An improper neutralization of input during web page generation vulnerability \[CWE-79\] in FortiAnalyzer versions prior to 7.2.1, 7.0.4 and 6. (CVSS 4.2, Fortinet FortiAnalyzer)
- [CVE-2022-38376](https://cve.now/CVE-2022-38376.md): Multiple improper neutralization of input during web page generation ('Cross-site Scripting') vulnerabilities \[CWE-79\] in Fortinet FortiNAC (CVSS 5.8, Fortinet FortiNAC)
- [CVE-2022-38375](https://cve.now/CVE-2022-38375.md): An improper authorization vulnerability \[CWE-285\] in Fortinet FortiNAC version 9.4.0 through 9.4.1 and before 9.2.6 allows an unauthenticat (CVSS 8.6, Fortinet FortiNAC)
- [CVE-2023-23778](https://cve.now/CVE-2023-23778.md): A relative path traversal vulnerability \[CWE-23\] in FortiWeb version 7.0.1 and below, 6.4 all versions, 6.3 all versions, 6.2 all versions m (CVSS 4.7, Fortinet FortiWeb)
- [CVE-2023-23779](https://cve.now/CVE-2023-23779.md): Multiple improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities \[CWE-78\] in FortiWeb ver (CVSS 6.6, Fortinet FortiWeb)
- [CVE-2022-30306](https://cve.now/CVE-2022-30306.md): A stack-based buffer overflow vulnerability \[CWE-121\] in the CA sign functionality of FortiWeb version 7.0.1 and below, 6.4 all versions, ve (CVSS 6.3, Fortinet FortiWeb)
- [CVE-2022-33871](https://cve.now/CVE-2022-33871.md): A stack-based buffer overflow vulnerability \[CWE-121\] in FortiWeb version 7.0.1 and earlier, 6.4 all versions, version 6.3.19 and earlier ma (CVSS 6.3, Fortinet FortiWeb)
- [CVE-2023-23781](https://cve.now/CVE-2023-23781.md): A stack-based buffer overflow vulnerability \[CWE-121\] in FortiWeb version 7.0.1 and below, 6.4 all versions, version 6.3.19 and below SAML s (CVSS 6.1, Fortinet FortiWeb)
- [CVE-2023-23782](https://cve.now/CVE-2023-23782.md): A heap-based buffer overflow in Fortinet FortiWeb version 7.0.0 through 7.0.1, FortiWeb version 6.3.0 through 6.3.19, FortiWeb 6.4 all versi (CVSS 7.1, Fortinet FortiWeb)
- [CVE-2023-23783](https://cve.now/CVE-2023-23783.md): A use of externally-controlled format string in Fortinet FortiWeb version 7.0.0 through 7.0.1, FortiWeb 6.4 all versions allows attacker to (CVSS 6.5, Fortinet FortiWeb)
- [CVE-2023-23784](https://cve.now/CVE-2023-23784.md): A relative path traversal in Fortinet FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.3.6 through 6.3.20, FortiWeb 6.4 all versions (CVSS 5.6, Fortinet FortiWeb)
- [CVE-2023-23780](https://cve.now/CVE-2023-23780.md): A stack-based buffer overflow in Fortinet FortiWeb version 7.0.0 through 7.0.1, Fortinet FortiWeb version 6.3.6 through 6.3.19, Fortinet For (CVSS 7.6, Fortinet FortiWeb)
- [CVE-2023-25602](https://cve.now/CVE-2023-25602.md): A stack-based buffer overflow in Fortinet FortiWeb 6.4 all versions, FortiWeb versions 6.3.17 and earlier, FortiWeb versions 6.2.6 and earli (CVSS 7.4, Fortinet FortiWeb)
- [CVE-2021-42756](https://cve.now/CVE-2021-42756.md): Multiple stack-based buffer overflow vulnerabilities \[CWE-121\] in the proxy daemon of FortiWeb 5.x all versions, 6.0.7 and below, 6.1.2 and (CVSS 9.3, Fortinet FortiWeb)
- [CVE-2021-42761](https://cve.now/CVE-2021-42761.md): A condition for session fixation vulnerability \[CWE-384\] in the session management of FortiWeb versions 6.4 all versions, 6.3.0 through 6.3. (CVSS 8.5, Fortinet FortiWeb)
- [CVE-2022-30299](https://cve.now/CVE-2022-30299.md): A path traversal vulnerability \[CWE-23\] in the API of FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, 6.4 all versions, 6.2 all versions (CVSS 5.0, Fortinet FortiWeb)
- [CVE-2021-43074](https://cve.now/CVE-2021-43074.md): An improper verification of cryptographic signature vulnerability \[CWE-347\] in FortiWeb 6.4 all versions, 6.3.16 and below, 6.2 all versions (CVSS 4.1, Fortinet FortiSwitch · Fortinet FortiWeb +2)
- [CVE-2022-30300](https://cve.now/CVE-2022-30300.md): A relative path traversal vulnerability \[CWE-23\] in FortiWeb 7.0.0 through 7.0.1, 6.3.6 through 6.3.18, 6.4 all versions may allow an authen (CVSS 6.2, Fortinet FortiWeb)
- [CVE-2022-30303](https://cve.now/CVE-2022-30303.md): An improper neutralization of special elements used in an os command ('OS Command Injection') \[CWE-78\] in FortiWeb 7.0.0 through 7.0.1, 6.3. (CVSS 8.6, Fortinet FortiWeb)
- [CVE-2022-43954](https://cve.now/CVE-2022-43954.md): An insertion of sensitive information into log file vulnerability \[CWE-532\] in the FortiPortal management interface 7.0.0 through 7.0.2 may (CVSS 4.1, Fortinet FortiPortal)
- [CVE-2022-41335](https://cve.now/CVE-2022-41335.md): A relative path traversal vulnerability \[CWE-23\] in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.10, For (CVSS 8.6, Fortinet FortiSwitchManager · Fortinet FortiOS +1)
- [CVE-2023-23947](https://cve.now/CVE-2023-23947.md): Argo CD users with any cluster secret update access may update out-of-bounds cluster secrets (CVSS 9.1, argoproj argo-cd · github.com/argoproj/argo-cd +1)
- [CVE-2023-23936](https://cve.now/CVE-2023-23936.md): CRLF Injection in Nodejs ‘undici’ via host (CVSS 6.5, nodejs undici · undici)
- [CVE-2023-24807](https://cve.now/CVE-2023-24807.md): Undici vulnerable to Regular Expression Denial of Service in Headers (CVSS 7.5, nodejs undici · undici)
- [CVE-2023-23752](https://cve.now/CVE-2023-23752.md): \[20230201\] - Core - Improper access check in webservice endpoints (CVSS 5.3, KEV, Joomla! Project Joomla! CMS)
- [CVE-2023-20085](https://cve.now/CVE-2023-20085.md): A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacke (CVSS 6.1, Cisco Identity Services Engine Software)
- [CVE-2023-20053](https://cve.now/CVE-2023-20053.md): A vulnerability in the web-based management interface of Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to conduct a (CVSS 6.1, Cisco Nexus Dashboard)
- [CVE-2022-20952](https://cve.now/CVE-2022-20952.md): A vulnerability in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web Appliance, formerly known as Cisco Web Security Appli (CVSS 5.3, Cisco Secure Web Appliance)
- [CVE-2023-20052](https://cve.now/CVE-2023-20052.md): On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the DMG file parser of Cl (CVSS 5.3, Cisco Secure Endpoint)
- [CVE-2023-20075](https://cve.now/CVE-2023-20075.md): Vulnerability in the CLI of Cisco Secure Email Gateway could allow an authenticated, remote attacker to execute arbitrary commands. (CVSS 6.0, Cisco Secure Email)
- [CVE-2023-20009](https://cve.now/CVE-2023-20009.md): A vulnerability in the Web UI and administrative CLI of the Cisco Secure Email Gateway (ESA) and Cisco Secure Email and Web Manager (SMA) co (CVSS 6.5, Cisco Secure Email)
- [CVE-2023-20014](https://cve.now/CVE-2023-20014.md): A vulnerability in the DNS functionality of Cisco Nexus Dashboard Software could allow an unauthenticated, remote attacker to cause a denial (CVSS 7.5, Cisco Nexus Dashboard)
- [CVE-2023-20032](https://cve.now/CVE-2023-20032.md): On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ partition file p (CVSS 9.8, Cisco Secure Web Appliance · Cisco Secure Endpoint)
- [CVE-2022-3843](https://cve.now/CVE-2022-3843.md): WAGO: Exposure of configuration interface in unmanaged switches (CVSS 9.1, WAGO Unmanaged Switch 852-111/000-001)
- [CVE-2023-22579](https://cve.now/CVE-2023-22579.md): Sequalize - Unsafe fall-through in getWhereConditions (CVSS 9.9, Feathers-Sequalize Sequelize.js · sequelize +1)
- [CVE-2023-22578](https://cve.now/CVE-2023-22578.md): Sequalize - Default support for “raw attributes” when using parentheses (CVSS 10.0, Feathers-Sequalize Sequelize.js · @sequelize/core +1)
- [CVE-2023-22580](https://cve.now/CVE-2023-22580.md): Sequalize - Bad query filtering leading to SQL errors (CVSS 5.3, Feathers-Sequalize Sequelize.js · sequelize +1)
- [CVE-2023-25173](https://cve.now/CVE-2023-25173.md): containerd supplementary groups are not set up properly (CVSS 5.3, containerd · github.com/containerd/containerd)
- [CVE-2023-25153](https://cve.now/CVE-2023-25153.md): containerd OCI image importer memory exhaustion (CVSS 6.2, containerd · github.com/containerd/containerd)
- [CVE-2023-0862](https://cve.now/CVE-2023-0862.md): Path Traversal in NetModule NSRW (CVSS 7.2, NetModule NSRW)
- [CVE-2023-0861](https://cve.now/CVE-2023-0861.md): Authenticated Command Injection in NetModule NSRW (CVSS 7.2, NetModule NSRW)
- [CVE-2023-0568](https://cve.now/CVE-2023-0568.md): Array overrun in common path resolve code (CVSS 7.5, PHP Group PHP)
- [CVE-2023-0662](https://cve.now/CVE-2023-0662.md): DoS vulnerability when parsing multipart request body (CVSS 7.5, PHP Group PHP)
- [CVE-2023-0567](https://cve.now/CVE-2023-0567.md): password\_verify() always returns true for some invalid hashes (CVSS 7.7, PHP Group PHP)
- [CVE-2019-17003](https://cve.now/CVE-2019-17003.md): Scanning a QR code that contained a javascript: URL would have resulted in the Javascript being executed. (CVSS 6.1, Mozilla Firefox for iOS)
- [CVE-2020-12413](https://cve.now/CVE-2020-12413.md): The Raccoon attack is a timing attack on DHE ciphersuites inherit in the TLS specification. (CVSS 5.9, Mozilla Firefox)
- [CVE-2020-6817](https://cve.now/CVE-2020-6817.md): bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). (CVSS 7.5, Mozilla Bleach · bleach)
- [CVE-2021-0187](https://cve.now/CVE-2021-0187.md): Improper access control in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable an escalation of (CVSS 3.2, Intel(R) Processors)
- [CVE-2021-23980](https://cve.now/CVE-2021-23980.md): A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscrip (CVSS 6.1, Mozilla Bleach · bleach)
- [CVE-2021-40555](https://cve.now/CVE-2021-40555.md): Cross site scripting (XSS) vulnerability in flatCore-CMS 2.2.15 allows attackers to execute arbitrary code via description field on the new (CVSS 5.4)
- [CVE-2021-43529](https://cve.now/CVE-2021-43529.md): Thunderbird versions prior to 91.3.0 are vulnerable to the heap overflow described in CVE-2021-43527 when processing S/MIME messages. (CVSS 9.8, Mozilla Thunderbird)
- [CVE-2022-0637](https://cve.now/CVE-2022-0637.md): open redirect in pollbot (pollbot.services.mozilla.com) in versions before 1.4.6 (CVSS 6.1, mozilla/pollbot · pollbot)
- [CVE-2022-27890](https://cve.now/CVE-2022-27890.md): It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory (CVSS 6.3, Palantir AtlasDB)
- [CVE-2022-27891](https://cve.now/CVE-2022-27891.md): Palantir Gotham included an unauthenticated endpoint that listed all active usernames in the platform with an active session. (CVSS 5.3, Palantir Gotham)
- [CVE-2022-27892](https://cve.now/CVE-2022-27892.md): Palantir Gotham included an endpoint that would log arbitrary sized payloads. (CVSS 5.3, Palantir Gotham)
- [CVE-2022-27897](https://cve.now/CVE-2022-27897.md): Palantir Gotham included an endpoint that would log arbitrary sized zip files. (CVSS 5.3, Palantir Gotham)
- [CVE-2022-38731](https://cve.now/CVE-2022-38731.md): Qaelum DOSE 18.08 through 21.1 before 21.2 allows Directory Traversal via the loadimages name parameter. (CVSS 4.3)
- [CVE-2022-40080](https://cve.now/CVE-2022-40080.md): Stack overflow vulnerability in Aspire E5-475G 's BIOS firmware, in the FpGui module, a second call to GetVariable services allows local att (CVSS 7.8)
- [CVE-2022-43969](https://cve.now/CVE-2022-43969.md): Ricoh mp\_c4504ex devices with firmware 1.06 mishandle credentials. (CVSS 9.1)
- [CVE-2022-44299](https://cve.now/CVE-2022-44299.md): SiteServerCMS 7.1.3 sscms has a file read vulnerability. (CVSS 4.9)
- [CVE-2022-47703](https://cve.now/CVE-2022-47703.md): TIANJIE CPE906-3 is vulnerable to password disclosure. (CVSS 7.5)
- [CVE-2022-48306](https://cve.now/CVE-2022-48306.md): Gotham Chat IRC help does not validate hostnames in TLS certificates (CVSS 5.7, Palantir Gotham Chat IRC helper)
- [CVE-2022-48307](https://cve.now/CVE-2022-48307.md): It was discovered that the Magritte-ftp was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactor (CVSS 6.3, Palantir Foundry Magritte)
- [CVE-2022-48308](https://cve.now/CVE-2022-48308.md): It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory (CVSS 6.3, Palantir sls-logging)
- [CVE-2022-48324](https://cve.now/CVE-2022-48324.md): Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. (CVSS 6.1)
- [CVE-2022-48325](https://cve.now/CVE-2022-48325.md): Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. (CVSS 6.1)
- [CVE-2022-48326](https://cve.now/CVE-2022-48326.md): Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. (CVSS 6.1)
- [CVE-2022-48327](https://cve.now/CVE-2022-48327.md): Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. (CVSS 6.1)
- [CVE-2023-0860](https://cve.now/CVE-2023-0860.md): Improper Restriction of Excessive Authentication Attempts in modoboa/modoboa-installer (CVSS 7.8, modoboa/modoboa-installer · modoboa)
- [CVE-2023-0866](https://cve.now/CVE-2023-0866.md): Heap-based Buffer Overflow in gpac/gpac (CVSS 7.8, gpac/gpac)
- [CVE-2023-22380](https://cve.now/CVE-2023-22380.md): Path traversal in GitHub Enterprise Server leading to arbitrary file reading when building a GitHub Pages site (CVSS 6.5, GitHub Enterprise Server)
- [CVE-2023-23558](https://cve.now/CVE-2023-23558.md): In Eternal Terminal 6.2.1, TelemetryService uses fixed paths in /tmp. (CVSS 6.3)
- [CVE-2023-23926](https://cve.now/CVE-2023-23926.md): APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j. (CVSS 5.9, neo4j apoc · org.neo4j.procedure:apoc-core)
- [CVE-2023-24236](https://cve.now/CVE-2023-24236.md): TOTOlink A7100RU(V7.4cu.2313\_B20191024) was discovered to contain a command injection vulnerability via the province parameter at setting/de (CVSS 9.8)
- [CVE-2023-24238](https://cve.now/CVE-2023-24238.md): TOTOlink A7100RU(V7.4cu.2313\_B20191024) was discovered to contain a command injection vulnerability via the city parameter at setting/delSta (CVSS 9.8)
- [CVE-2023-24483](https://cve.now/CVE-2023-24483.md): Privilege Escalation to NT AUTHORITY\\SYSTEM on the vulnerable VDA (CVSS 7.8, Citrix Virtual Apps and Desktops)
- [CVE-2023-24484](https://cve.now/CVE-2023-24484.md): A malicious user can cause log files to be written to a directory that they do not have permission to write to. (CVSS 5.5, Citrix Workspace App for Windows)
- [CVE-2023-24485](https://cve.now/CVE-2023-24485.md): Privilege Escalation on the system running a vulnerable version of Citrix Workspace app for Windows (CVSS 7.8, Citrix Workspace App for Windows)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-02-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.