# CVEs published 2023-02-17

100 CVEs were published on February 17, 2023: 18 critical, 41 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2023-24809](https://cve.now/CVE-2023-24809.md): NetHack Call command buffer overflow (CVSS 5.5, NetHack)
- [CVE-2022-34351](https://cve.now/CVE-2022-34351.md): IBM QRadar SIEM information disclosure (CVSS 5.9, IBM QRadar SIEM)
- [CVE-2023-24960](https://cve.now/CVE-2023-24960.md): IBM InfoSphere Information Server information disclosure (CVSS 7.5, IBM InfoSphere Information Server)
- [CVE-2022-40231](https://cve.now/CVE-2022-40231.md): IBM Sterling B2B Integrator Standard Edition improper access control (CVSS 4.3, IBM Sterling B2B Integrator Standard Edition)
- [CVE-2022-43579](https://cve.now/CVE-2022-43579.md): IBM Sterling B2B Integrator Standard Edition cross-site scripting (CVSS 4.6, IBM Sterling B2B Integrator Standard Edition)
- [CVE-2022-40232](https://cve.now/CVE-2022-40232.md): IBM Sterling B2B Integrator Standard Edition improper access control (CVSS 6.3, IBM Sterling B2B Integrator Standard Edition)
- [CVE-2022-41734](https://cve.now/CVE-2022-41734.md): IBM Maximo Asset Management information disclosure (CVSS 5.3, IBM Maximo Asset Management)
- [CVE-2023-26020](https://cve.now/CVE-2023-26020.md): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Crafter Studio (CVSS 5.7, CrafterCMS)
- [CVE-2022-43930](https://cve.now/CVE-2022-43930.md): IBM Db2 for Linux, UNIX and Windows information disclosure (CVSS 6.2, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2023-0895](https://cve.now/CVE-2023-0895.md): WP Coder – add custom html, css and js code \<= 2.5.3 - Authenticated (Admin+) SQL Injection (CVSS 7.2, wpcalc WP Coder – Insert & Manage Code Snippets)
- [CVE-2022-43929](https://cve.now/CVE-2022-43929.md): IBM Db2 for Linux, UNIX and Windows denial of service (CVSS 4.9, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2022-43927](https://cve.now/CVE-2022-43927.md): IBM Db2 for Linux, UNIX and Windows information disclosure (CVSS 5.9, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2023-0822](https://cve.now/CVE-2023-0822.md): Improper Authorization (CVSS 8.8, Delta Electronics DIAEnergie)
- [CVE-2023-24964](https://cve.now/CVE-2023-24964.md): IBM InfoSphere Information Server information disclosure (CVSS 6.2, IBM InfoSphere Information Server)
- [CVE-2022-36775](https://cve.now/CVE-2022-36775.md): IBM Security Verify Access HOST header injection (CVSS 6.5, IBM Security Verify Access)
- [CVE-2023-22868](https://cve.now/CVE-2023-22868.md): IBM Aspera Faspex cross-site scripting (CVSS 5.4, IBM Aspera Faspex)
- [CVE-2022-47986](https://cve.now/CVE-2022-47986.md): IBM Aspera Faspex code execution (CVSS 9.8, KEV, IBM Aspera Faspex)
- [CVE-2023-24388](https://cve.now/CVE-2023-24388.md): WordPress Booking calendar, Appointment Booking System Plugin \<= 3.2.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, WpDevArt Booking calendar, Appointment Booking System)
- [CVE-2023-23899](https://cve.now/CVE-2023-23899.md): WordPress Extensions For CF7 Plugin \<= 2.0.8 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, HasThemes Extensions For CF7)
- [CVE-2023-23586](https://cve.now/CVE-2023-23586.md): Use after free in io\_uring in the Linux Kernel (CVSS 5.5, Linux Kernel)
- [CVE-2023-0887](https://cve.now/CVE-2023-0887.md): phjounin TFTPD64-SE tftpd64\_svc.exe unquoted search path (CVSS 7.0, phjounin TFTPD64-SE)
- [CVE-2023-0883](https://cve.now/CVE-2023-0883.md): SourceCodester Online Pizza Ordering System index.php sql injection (CVSS 6.3, SourceCodester Online Pizza Ordering System)
- [CVE-2023-0882](https://cve.now/CVE-2023-0882.md): Authorization Bypass Through User-Controlled Key on Single Connect (CVSS 8.8, Kron Tech Single Connect)
- [CVE-2023-23695](https://cve.now/CVE-2023-23695.md): Dell Secure Connect Gateway (SCG) version 5.14.00.12 contains a broken cryptographic algorithm vulnerability. (CVSS 5.9, Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS)
- [CVE-2020-19824](https://cve.now/CVE-2020-19824.md): An issue in MPV v.0.29.1 fixed in v0.30 allows attackers to execute arbitrary code and crash program via the ao\_c parameter. (CVSS 7.0)
- [CVE-2020-29168](https://cve.now/CVE-2020-29168.md): SQL Injection vulnerability in Projectworlds Online Doctor Appointment Booking System, allows attackers to gain sensitive information via th (CVSS 9.8)
- [CVE-2021-26277](https://cve.now/CVE-2021-26277.md): Security Advisory | PendingIntent hijacking vulnerability in Framework Services (CVSS 5.6, vivo Frame service)
- [CVE-2021-3172](https://cve.now/CVE-2021-3172.md): An issue in Php-Fusion v9.03.90 fixed in v9.10.00 allows authenticated attackers to cause a Distributed Denial of Service via the Polling fe (CVSS 8.1)
- [CVE-2021-32142](https://cve.now/CVE-2021-32142.md): Buffer Overflow vulnerability in LibRaw linux/unix v0.20.0 allows attacker to escalate privileges via the LibRaw\_buffer\_datastream::gets(cha (CVSS 7.8)
- [CVE-2021-32163](https://cve.now/CVE-2021-32163.md): Authentication vulnerability in MOSN v.0.23.0 allows attacker to escalate privileges via case-sensitive JWT authorization. (CVSS 9.8, mosn.io/mosn)
- [CVE-2021-32419](https://cve.now/CVE-2021-32419.md): An issue in Schism Tracker v20200412 fixed in v.20200412 allows attacker to obtain sensitive information via the fmt\_mtm\_load\_song function (CVSS 5.3)
- [CVE-2021-32441](https://cve.now/CVE-2021-32441.md): SQL Injection vulnerability in Exponent-CMS v.2.6.0 fixed in 2.7.0 allows attackers to gain access to sensitive information via the selectVa (CVSS 7.5)
- [CVE-2021-32843](https://cve.now/CVE-2021-32843.md): HyperKit is a toolkit for embedding hypervisor capabilities in an application. (CVSS 6.2, moby hyperkit)
- [CVE-2021-32844](https://cve.now/CVE-2021-32844.md): HyperKit is a toolkit for embedding hypervisor capabilities in an application. (CVSS 6.2, moby hyperkit)
- [CVE-2021-32845](https://cve.now/CVE-2021-32845.md): Moby HyperKit uninitialized memory use vtrnd pci\_vtrnd\_notify (CVSS 7.7, moby hyperkit)
- [CVE-2021-32846](https://cve.now/CVE-2021-32846.md): Moby HyperKit uninitialized memory use in virtio-sock pci\_vtsock\_proc\_tx (CVSS 7.7, moby hyperkit)
- [CVE-2021-33226](https://cve.now/CVE-2021-33226.md): Buffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute arbitrary code via the func variable in salt/salt/mo (CVSS 9.8, salt)
- [CVE-2021-33391](https://cve.now/CVE-2021-33391.md): An issue in HTACG HTML Tidy v5.7.28 allows attacker to execute arbitrary code via the -g option of the CleanNode() function in gdoc.c. (CVSS 9.8)
- [CVE-2021-33926](https://cve.now/CVE-2021-33926.md): An issue in Plone CMS v. (CVSS 8.8, plone)
- [CVE-2021-33948](https://cve.now/CVE-2021-33948.md): SQL injection vulnerability in FantasticLBP Hotels Server v1.0 allows attacker to execute arbitrary code via the username parameter. (CVSS 9.8)
- [CVE-2021-33949](https://cve.now/CVE-2021-33949.md): An issue in FeMiner WMS v1.1 allows attackers to execute arbitrary code via the filename parameter and the exec function. (CVSS 9.8)
- [CVE-2021-33950](https://cve.now/CVE-2021-33950.md): An issue discovered in OpenKM v6.3.10 allows attackers to obtain sensitive information via the XMLTextExtractor function. (CVSS 7.5)
- [CVE-2021-33983](https://cve.now/CVE-2021-33983.md): Buffer Overflow vulnerability in Dvidelabs flatcc v.0.6.0 allows local attacker to execute arbitrary code via the fltacc execution of the er (CVSS 7.8)
- [CVE-2021-34164](https://cve.now/CVE-2021-34164.md): Permissions vulnerability in LIZHIFAKA v.2.2.0 allows authenticated attacker to execute arbitrary commands via the set password function in (CVSS 8.8)
- [CVE-2021-34182](https://cve.now/CVE-2021-34182.md): An issue in ttyd v.1.6.3 allows attacker to execute arbitrary code via default configuration permissions. (CVSS 9.8)
- [CVE-2021-35261](https://cve.now/CVE-2021-35261.md): File Upload Vulnerability in Yupoxion BearAdmin before commit 10176153528b0a914eb4d726e200fd506b73b075 allows attacker to execute arbitrary (CVSS 9.8)
- [CVE-2022-20803](https://cve.now/CVE-2022-20803.md): ClamAV Double-free Vulnerability in the OLE2 File Parser (CVSS 8.6, Cisco ClamAV)
- [CVE-2022-32972](https://cve.now/CVE-2022-32972.md): Infoblox BloxOne Endpoint for Windows through 2.2.7 allows DLL injection that can result in local privilege escalation. (CVSS 7.8)
- [CVE-2022-40021](https://cve.now/CVE-2022-40021.md): QVidium Technologies Amino A140 (prior to firmware version 1.0.0-283) was discovered to contain a command injection vulnerability. (CVSS 9.8)
- [CVE-2022-40032](https://cve.now/CVE-2022-40032.md): SQL Injection vulnerability in Simple Task Managing System version 1.0 in login.php in 'username' and 'password' parameters, allows attacker (CVSS 9.8)
- [CVE-2022-40347](https://cve.now/CVE-2022-40347.md): SQL Injection vulnerability in Intern Record System version 1.0 in /intern/controller.php in 'phone', 'email', 'deptType' and 'name' paramet (CVSS 9.8)
- [CVE-2022-45701](https://cve.now/CVE-2022-45701.md): Arris TG2482A firmware through 9.1.103GEM9 allow Remote Code Execution (RCE) via the ping utility feature. (CVSS 8.8)
- [CVE-2022-48115](https://cve.now/CVE-2022-48115.md): The dropdown menu in jspreadsheet before v4.6.0 was discovered to be vulnerable to cross-site scripting (XSS). (CVSS 6.1, jspreadsheet-ce)
- [CVE-2023-0482](https://cve.now/CVE-2023-0482.md): In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates te (CVSS 5.5, RESTEasy · org.jboss.resteasy:resteasy-core +1)
- [CVE-2023-0877](https://cve.now/CVE-2023-0877.md): Code Injection in froxlor/froxlor (CVSS 9.1, froxlor/froxlor)
- [CVE-2023-0878](https://cve.now/CVE-2023-0878.md): Cross-site Scripting (XSS) - Generic in nuxt/framework (CVSS 6.1, nuxt/framework)
- [CVE-2023-0879](https://cve.now/CVE-2023-0879.md): Cross-site Scripting (XSS) - Stored in btcpayserver/btcpayserver (CVSS 6.3, btcpayserver/btcpayserver)
- [CVE-2023-0880](https://cve.now/CVE-2023-0880.md): Misinterpretation of Input in thorsten/phpmyfaq (CVSS 8.3, thorsten/phpmyfaq)
- [CVE-2023-21574](https://cve.now/CVE-2023-21574.md): Adobe Photoshop Improper Input Validation Remote Code Execution Vulnerability (CVSS 7.8, Adobe Photoshop)
- [CVE-2023-21575](https://cve.now/CVE-2023-21575.md): Adobe Photoshop Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Photoshop)
- [CVE-2023-21576](https://cve.now/CVE-2023-21576.md): Adobe Photoshop Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Photoshop)
- [CVE-2023-21577](https://cve.now/CVE-2023-21577.md): Adobe Photoshop Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Photoshop)
- [CVE-2023-21578](https://cve.now/CVE-2023-21578.md): Adobe Photoshop Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Photoshop)
- [CVE-2023-21583](https://cve.now/CVE-2023-21583.md): Adobe Bridge Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Bridge)
- [CVE-2023-21584](https://cve.now/CVE-2023-21584.md): Adobe FrameMaker Font Parsing Use-After-Free Information Disclosure Vulnerability (CVSS 5.5, Adobe FrameMaker)
- [CVE-2023-21593](https://cve.now/CVE-2023-21593.md): Adobe InDesign SVG file NULL Pointer Dereference Application denial-of-service (CVSS 5.5, Adobe InDesign)
- [CVE-2023-21619](https://cve.now/CVE-2023-21619.md): Adobe FrameMaker Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe FrameMaker)
- [CVE-2023-21620](https://cve.now/CVE-2023-21620.md): Adobe FrameMaker Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe FrameMaker)
- [CVE-2023-21621](https://cve.now/CVE-2023-21621.md): Adobe FrameMaker Improper Input Validation Remote Code Execution Vulnerability (CVSS 7.8, Adobe FrameMaker)
- [CVE-2023-21622](https://cve.now/CVE-2023-21622.md): Adobe FrameMaker Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe FrameMaker)
- [CVE-2023-22226](https://cve.now/CVE-2023-22226.md): Adobe Bridge SVG file Stack-based Buffer Overflow Arbitrary code execution (CVSS 7.8, Adobe Bridge)
- [CVE-2023-22227](https://cve.now/CVE-2023-22227.md): Adobe Bridge Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Bridge)
- [CVE-2023-22228](https://cve.now/CVE-2023-22228.md): Adobe Bridge Improper Input Validation Remote Code Execution Vulnerability (CVSS 7.8, Adobe Bridge)
- [CVE-2023-22229](https://cve.now/CVE-2023-22229.md): Adobe Bridge Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Bridge)
- [CVE-2023-22230](https://cve.now/CVE-2023-22230.md): Adobe Bridge Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Bridge)
- [CVE-2023-22231](https://cve.now/CVE-2023-22231.md): Adobe Bridge Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Bridge)
- [CVE-2023-22232](https://cve.now/CVE-2023-22232.md): Adobe Connect Improper Access Control Security feature bypass (CVSS 5.3, Adobe Connect)
- [CVE-2023-22233](https://cve.now/CVE-2023-22233.md): Adobe After Effects Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe After Effects)
- [CVE-2023-22234](https://cve.now/CVE-2023-22234.md): Adobe Premiere Rush PSD file Stack-based Buffer Overflow Arbitrary code execution (CVSS 7.8, Adobe Premiere Rush)
- [CVE-2023-22236](https://cve.now/CVE-2023-22236.md): Adobe Animate Heap-based Buffer Overflow Arbitrary code execution (CVSS 7.8, Adobe Animate)
- [CVE-2023-22237](https://cve.now/CVE-2023-22237.md): Adobe After Effects Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe After Effects)
- [CVE-2023-22238](https://cve.now/CVE-2023-22238.md): Adobe After Effects Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe After Effects)
- [CVE-2023-22239](https://cve.now/CVE-2023-22239.md): Adobe After Effects Improper Input Validation Remote Code Execution Vulnerability (CVSS 7.8, Adobe After Effects)
- [CVE-2023-22243](https://cve.now/CVE-2023-22243.md): Adobe Animate SVG file Stack-based Buffer Overflow Arbitrary code execution (CVSS 7.8, Adobe Animate)
- [CVE-2023-22244](https://cve.now/CVE-2023-22244.md): Adobe Premiere Rush PSD files Use After Free Arbitrary code execution (CVSS 7.8, Adobe Premiere Rush)
- [CVE-2023-22246](https://cve.now/CVE-2023-22246.md): Adobe Animate FLA files Use After Free Arbitrary code execution (CVSS 7.8, Adobe Animate)
- [CVE-2023-23007](https://cve.now/CVE-2023-23007.md): An issue was discovered in ESPCMS P8.21120101 after logging in to the background, there is a SQL injection vulnerability in the function nod (CVSS 7.2)
- [CVE-2023-23064](https://cve.now/CVE-2023-23064.md): TOTOLINK A720R V4.1.5cu.532\_ B20210610 is vulnerable to Incorrect Access Control. (CVSS 9.8)
- [CVE-2023-23279](https://cve.now/CVE-2023-23279.md): Canteen Management System 1.0 is vulnerable to SQL Injection via /php\_action/getOrderReport.php. (CVSS 9.8)
- [CVE-2023-23921](https://cve.now/CVE-2023-23921.md): Moodle: reflected xss risk in some returnurl parameters (no CVSS, moodle · moodle/moodle)
- [CVE-2023-23922](https://cve.now/CVE-2023-23922.md): Moodle: reflected xss risk in blog search (no CVSS, moodle · moodle/moodle)
- [CVE-2023-23923](https://cve.now/CVE-2023-23923.md): Moodle: possible to set the preferred "start page" of other users (no CVSS, moodle · moodle/moodle)
- [CVE-2023-24078](https://cve.now/CVE-2023-24078.md): Real Time Logic FuguHub v8.1 and earlier was discovered to contain a remote code execution (RCE) vulnerability via the component /FuguHub/cm (CVSS 8.8)
- [CVE-2023-24219](https://cve.now/CVE-2023-24219.md): LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/UserMapper.xml. (CVSS 9.8)
- [CVE-2023-24220](https://cve.now/CVE-2023-24220.md): LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/RoleMapper.xml. (CVSS 9.8)
- [CVE-2023-24221](https://cve.now/CVE-2023-24221.md): LuckyframeWEB v3.5 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /system/DeptMapper.xml. (CVSS 9.8)
- [CVE-2023-24329](https://cve.now/CVE-2023-24329.md): An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that start (CVSS 7.5, libpython · python +1)
- [CVE-2023-24369](https://cve.now/CVE-2023-24369.md): A cross-site scripting (XSS) vulnerability in UJCMS v4.1.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted (CVSS 6.1)
- [CVE-2023-24769](https://cve.now/CVE-2023-24769.md): Changedetection.io before v0.40.1.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the main page. (CVSS 5.4, changedetection-io)
- [CVE-2023-24785](https://cve.now/CVE-2023-24785.md): An issue in Giorgio Tani peazip v.9.0.0 allows attackers to cause a denial of service via the End of Archive tag function of the peazip/pea (CVSS 5.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-02-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.