CVEs published February 17, 2023
100 CVEs were published on February 17, 2023: 18 critical, 41 high. 1 is now in CISA KEV.
- Published
- 100
- Critical
- 18
- High
- 41
- Medium
- 38
- Low
- 0
- Unrated
- 3
- Now in CISA KEV
- 1
- Fix available
- 20
Most affected products
- Adobe Bridge
- 7
- Adobe FrameMaker
- 5
- Adobe Photoshop
- 5
- Adobe After Effects
- 4
- moby hyperkit
- 4
- Adobe Animate
- 3
- IBM Db2 for Linux, UNIX and Windows
- 3
- IBM Sterling B2B Integrator Standard Edition
- 3
- moodle · moodle/moodle
- 3
- Adobe Premiere Rush
- 2
Critical 18
- CVE-2022-47986IBM Aspera Faspex code executionIBM Aspera Faspex
- CVE-2020-29168SQL Injection vulnerability in Projectworlds Online Doctor Appointment Booking System, allows attackers to gain sensitive information via th
- CVE-2021-32163Authentication vulnerability in MOSN v.0.23.0 allows attacker to escalate privileges via case-sensitive JWT authorization.mosn.io/mosn
- CVE-2021-33226Buffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute arbitrary code via the func variable in salt/salt/mosalt
- CVE-2021-33391An issue in HTACG HTML Tidy v5.7.28 allows attacker to execute arbitrary code via the -g option of the CleanNode() function in gdoc.c.
- CVE-2021-33948SQL injection vulnerability in FantasticLBP Hotels Server v1.0 allows attacker to execute arbitrary code via the username parameter.
- CVE-2021-33949An issue in FeMiner WMS v1.1 allows attackers to execute arbitrary code via the filename parameter and the exec function.
- CVE-2021-34182An issue in ttyd v.1.6.3 allows attacker to execute arbitrary code via default configuration permissions.
- CVE-2021-35261File Upload Vulnerability in Yupoxion BearAdmin before commit 10176153528b0a914eb4d726e200fd506b73b075 allows attacker to execute arbitrary
- CVE-2022-40021QVidium Technologies Amino A140 (prior to firmware version 1.0.0-283) was discovered to contain a command injection vulnerability.
- CVE-2022-40032SQL Injection vulnerability in Simple Task Managing System version 1.0 in login.php in 'username' and 'password' parameters, allows attacker
- CVE-2022-40347SQL Injection vulnerability in Intern Record System version 1.0 in /intern/controller.php in 'phone', 'email', 'deptType' and 'name' paramet
- CVE-2023-0877 Code Injection in froxlor/froxlorfroxlor/froxlor
- CVE-2023-23064TOTOLINK A720R V4.1.5cu.532_ B20210610 is vulnerable to Incorrect Access Control.
- CVE-2023-23279Canteen Management System 1.0 is vulnerable to SQL Injection via /php_action/getOrderReport.php.
- CVE-2023-24219LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/UserMapper.xml.
- CVE-2023-24220LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/RoleMapper.xml.
- CVE-2023-24221LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/DeptMapper.xml.
High 41
- CVE-2023-24960IBM InfoSphere Information Server information disclosureIBM InfoSphere Information Server
- CVE-2023-0895WP Coder – add custom html, css and js code <= 2.5.3 - Authenticated (Admin+) SQL Injectionwpcalc WP Coder – Insert & Manage Code Snippets
- CVE-2023-0822Improper AuthorizationDelta Electronics DIAEnergie
- CVE-2023-0887phjounin TFTPD64-SE tftpd64_svc.exe unquoted search pathphjounin TFTPD64-SE
- CVE-2023-0882Authorization Bypass Through User-Controlled Key on Single ConnectKron Tech Single Connect
- CVE-2020-19824An issue in MPV v.0.29.1 fixed in v0.30 allows attackers to execute arbitrary code and crash program via the ao_c parameter.
- CVE-2021-3172An issue in Php-Fusion v9.03.90 fixed in v9.10.00 allows authenticated attackers to cause a Distributed Denial of Service via the Polling fe
- CVE-2021-32142Buffer Overflow vulnerability in LibRaw linux/unix v0.20.0 allows attacker to escalate privileges via the LibRaw_buffer_datastream::gets(cha
- CVE-2021-32441SQL Injection vulnerability in Exponent-CMS v.2.6.0 fixed in 2.7.0 allows attackers to gain access to sensitive information via the selectVa
- CVE-2021-32845Moby HyperKit uninitialized memory use vtrnd pci_vtrnd_notifymoby hyperkit
- CVE-2021-32846Moby HyperKit uninitialized memory use in virtio-sock pci_vtsock_proc_txmoby hyperkit
- CVE-2021-33926An issue in Plone CMS v.plone
- CVE-2021-33950An issue discovered in OpenKM v6.3.10 allows attackers to obtain sensitive information via the XMLTextExtractor function.
- CVE-2021-33983Buffer Overflow vulnerability in Dvidelabs flatcc v.0.6.0 allows local attacker to execute arbitrary code via the fltacc execution of the er
- CVE-2021-34164Permissions vulnerability in LIZHIFAKA v.2.2.0 allows authenticated attacker to execute arbitrary commands via the set password function in
- CVE-2022-20803ClamAV Double-free Vulnerability in the OLE2 File ParserCisco ClamAV
- CVE-2022-32972Infoblox BloxOne Endpoint for Windows through 2.2.7 allows DLL injection that can result in local privilege escalation.
- CVE-2022-45701Arris TG2482A firmware through 9.1.103GEM9 allow Remote Code Execution (RCE) via the ping utility feature.
- CVE-2023-0880Misinterpretation of Input in thorsten/phpmyfaqthorsten/phpmyfaq
- CVE-2023-21574Adobe Photoshop Improper Input Validation Remote Code Execution VulnerabilityAdobe Photoshop
- CVE-2023-21575Adobe Photoshop Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Photoshop
- CVE-2023-21576Adobe Photoshop Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Photoshop
- CVE-2023-21619Adobe FrameMaker Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe FrameMaker
- CVE-2023-21621Adobe FrameMaker Improper Input Validation Remote Code Execution VulnerabilityAdobe FrameMaker
- CVE-2023-21622Adobe FrameMaker Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe FrameMaker
- CVE-2023-22226Adobe Bridge SVG file Stack-based Buffer Overflow Arbitrary code execution Adobe Bridge
- CVE-2023-22227Adobe Bridge Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Bridge
- CVE-2023-22228Adobe Bridge Improper Input Validation Remote Code Execution VulnerabilityAdobe Bridge
- CVE-2023-22229Adobe Bridge Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Bridge
- CVE-2023-22230Adobe Bridge Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Bridge
- CVE-2023-22234Adobe Premiere Rush PSD file Stack-based Buffer Overflow Arbitrary code execution Adobe Premiere Rush
- CVE-2023-22236Adobe Animate Heap-based Buffer Overflow Arbitrary code executionAdobe Animate
- CVE-2023-22237Adobe After Effects Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe After Effects
- CVE-2023-22238Adobe After Effects Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe After Effects
- CVE-2023-22239Adobe After Effects Improper Input Validation Remote Code Execution VulnerabilityAdobe After Effects
- CVE-2023-22243Adobe Animate SVG file Stack-based Buffer Overflow Arbitrary code executionAdobe Animate
- CVE-2023-22244Adobe Premiere Rush PSD files Use After Free Arbitrary code executionAdobe Premiere Rush
- CVE-2023-22246Adobe Animate FLA files Use After Free Arbitrary code executionAdobe Animate
- CVE-2023-23007An issue was discovered in ESPCMS P8.21120101 after logging in to the background, there is a SQL injection vulnerability in the function nod
- CVE-2023-24078Real Time Logic FuguHub v8.1 and earlier was discovered to contain a remote code execution (RCE) vulnerability via the component /FuguHub/cm
- CVE-2023-24329An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that startlibpython · python +1
Medium, low and unrated 41
- CVE-2023-24809NetHack Call command buffer overflowNetHack
- CVE-2022-34351IBM QRadar SIEM information disclosureIBM QRadar SIEM
- CVE-2022-40231IBM Sterling B2B Integrator Standard Edition improper access controlIBM Sterling B2B Integrator Standard Edition
- CVE-2022-43579IBM Sterling B2B Integrator Standard Edition cross-site scriptingIBM Sterling B2B Integrator Standard Edition
- CVE-2022-40232IBM Sterling B2B Integrator Standard Edition improper access controlIBM Sterling B2B Integrator Standard Edition
- CVE-2022-41734IBM Maximo Asset Management information disclosureIBM Maximo Asset Management
- CVE-2023-26020Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Crafter StudioCrafterCMS
- CVE-2022-43930IBM Db2 for Linux, UNIX and Windows information disclosureIBM Db2 for Linux, UNIX and Windows
- CVE-2022-43929IBM Db2 for Linux, UNIX and Windows denial of serviceIBM Db2 for Linux, UNIX and Windows
- CVE-2022-43927IBM Db2 for Linux, UNIX and Windows information disclosureIBM Db2 for Linux, UNIX and Windows
- CVE-2023-24964IBM InfoSphere Information Server information disclosureIBM InfoSphere Information Server
- CVE-2022-36775IBM Security Verify Access HOST header injectionIBM Security Verify Access
- CVE-2023-22868IBM Aspera Faspex cross-site scriptingIBM Aspera Faspex
- CVE-2023-24388WordPress Booking calendar, Appointment Booking System Plugin <= 3.2.3 is vulnerable to Cross Site Request Forgery (CSRF)WpDevArt Booking calendar, Appointment Booking System
- CVE-2023-23899WordPress Extensions For CF7 Plugin <= 2.0.8 is vulnerable to Cross Site Request Forgery (CSRF)HasThemes Extensions For CF7
- CVE-2023-23586Use after free in io_uring in the Linux KernelLinux Kernel
- CVE-2023-0883SourceCodester Online Pizza Ordering System index.php sql injectionSourceCodester Online Pizza Ordering System
- CVE-2023-23695 Dell Secure Connect Gateway (SCG) version 5.14.00.12 contains a broken cryptographic algorithm vulnerability.Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS
- CVE-2021-26277Security Advisory | PendingIntent hijacking vulnerability in Framework Servicesvivo Frame service
- CVE-2021-32419An issue in Schism Tracker v20200412 fixed in v.20200412 allows attacker to obtain sensitive information via the fmt_mtm_load_song function
- CVE-2021-32843HyperKit is a toolkit for embedding hypervisor capabilities in an application.moby hyperkit
- CVE-2021-32844HyperKit is a toolkit for embedding hypervisor capabilities in an application.moby hyperkit
- CVE-2022-48115The dropdown menu in jspreadsheet before v4.6.0 was discovered to be vulnerable to cross-site scripting (XSS).jspreadsheet-ce
- CVE-2023-0482In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates teRESTEasy · org.jboss.resteasy:resteasy-core +1
- CVE-2023-0878Cross-site Scripting (XSS) - Generic in nuxt/frameworknuxt/framework
- CVE-2023-0879Cross-site Scripting (XSS) - Stored in btcpayserver/btcpayserverbtcpayserver/btcpayserver
- CVE-2023-21577Adobe Photoshop Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Photoshop
- CVE-2023-21578Adobe Photoshop Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Photoshop
- CVE-2023-21583Adobe Bridge Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Bridge
- CVE-2023-21584Adobe FrameMaker Font Parsing Use-After-Free Information Disclosure VulnerabilityAdobe FrameMaker
- CVE-2023-21593Adobe InDesign SVG file NULL Pointer Dereference Application denial-of-serviceAdobe InDesign
- CVE-2023-21620Adobe FrameMaker Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe FrameMaker
- CVE-2023-22231Adobe Bridge Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Bridge
- CVE-2023-22232Adobe Connect Improper Access Control Security feature bypassAdobe Connect
- CVE-2023-22233Adobe After Effects Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe After Effects
- CVE-2023-23921Moodle: reflected xss risk in some returnurl parametersmoodle · moodle/moodle
- CVE-2023-23922Moodle: reflected xss risk in blog searchmoodle · moodle/moodle
- CVE-2023-23923Moodle: possible to set the preferred "start page" of other usersmoodle · moodle/moodle
- CVE-2023-24369A cross-site scripting (XSS) vulnerability in UJCMS v4.1.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted
- CVE-2023-24769Changedetection.io before v0.40.1.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the main page.changedetection-io
- CVE-2023-24785An issue in Giorgio Tani peazip v.9.0.0 allows attackers to cause a denial of service via the End of Archive tag function of the peazip/pea