CVEs published February 20, 2023
50 CVEs were published on February 20, 2023: 8 critical, 11 high.
- Published
- 50
- Critical
- 8
- High
- 11
- Medium
- 24
- Low
- 5
- Unrated
- 2
- Now in CISA KEV
- 0
- Fix available
- 21
Most affected products
- Tribe29 Checkmk
- 8
- apolloconfig apollo · com.ctrip.framework.apollo:apollo
- 2
- 3breadt dd-plist · com.googlecode.plist:dd-plist
- 1
- Apache Software Foundation Apache Commons FileUpload · A… +4
- 1
- Apache Software Foundation Apache Kerby LDAP Backend · org.…
- 1
- arnoldle submitByMailPlugin
- 1
- baremetrics-calendar
- 1
- commenthol versionn · versionn
- 1
- countly-server
- 1
- esdoc-publish-html-plugin
- 1
Critical 8
- CVE-2022-46836PHP code injection in watolibTribe29 Checkmk
- CVE-2023-25805versionn Command Injection Vulnerabilitycommenthol versionn · versionn
- CVE-2022-48329MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/M
- CVE-2022-48337GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etag
- CVE-2023-23452Missing Authentication for Critical Function in SICK FX0-GPNT v3 Firmware Version V3.04 and V3.05 allows an unprivileged remote attacker to FX0-GPNT v3 Firmware
- CVE-2023-23453Missing Authentication for Critical Function in SICK FX0-GENT v3 Firmware Version V3.04 and V3.05 allows an unprivileged remote attacker to FX0-GENT v3 Firmware
- CVE-2023-26092Liima before 1.17.28 allows server-side template injection.
- CVE-2023-26093Liima before 1.17.28 allows Hibernate query language (HQL) injection, related to colToSort in the deployment filter.
High 11
- CVE-2022-3901Visioweb.js - Prototype Pollution can results in XSSVisio Globe Visioweb
- CVE-2022-46303Command injection in SMS notificationsTribe29 Checkmk
- CVE-2023-24998Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive partsApache Software Foundation Apache Commons FileUpload · A… +4
- CVE-2023-25570Apollo has potential access control security issue in eurekaapolloconfig apollo · com.ctrip.framework.apollo:apollo
- CVE-2021-32847Moby HyperKit uninitialized memory use in virtio-sock pci_vtsock_proc_txmoby hyperkit
- CVE-2021-32848Octobox ReDoS vulnerabilityoctobox
- CVE-2022-44216Gnuboard 5.5.4 and 5.5.5 is vulnerable to Insecure Permissions.
- CVE-2022-48338An issue was discovered in GNU Emacs through 28.2.
- CVE-2022-48339An issue was discovered in GNU Emacs through 28.2.
- CVE-2023-25656notation-go has excessive memory allocation on verificationnotaryproject notation-go · github.com/notaryproject/notati…
- CVE-2023-26081In Epiphany (aka GNOME Web) through 43.0, untrusted web content can trick users into exfiltrating passwords, because autofill occurs in sand
Medium, low and unrated 31
- CVE-2019-25104rtcwcoop Team Command ai_cast_script.c AICast_ScriptLoad denial of servicertcwcoop
- CVE-2016-15027meta4creations Post Duplicator Plugin notices.php mtphr_post_duplicator_notice cross site scriptingmeta4creations Post Duplicator Plugin
- CVE-2022-48320CSRF in add-visual endpointTribe29 Checkmk
- CVE-2022-48319Host secret disclosed in Checkmk logsTribe29 Checkmk
- CVE-2022-48318Insecure access control mechanisms for RestAPI documentationTribe29 Checkmk
- CVE-2022-48317Insecure Termination of RestAPI Session TokensTribe29 Checkmk
- CVE-2022-48321SSRF in agent-receiver APITribe29 Checkmk
- CVE-2022-47909LQL Injection in Livestatus HTTP headersTribe29 Checkmk
- CVE-2015-10081arnoldle submitByMailPlugin edit_list.php cross-site request forgeryarnoldle submitByMailPlugin
- CVE-2023-25613LDAP Injection Vulnerability in Apache KerbyApache Software Foundation Apache Kerby LDAP Backend · org.…
- CVE-2023-25569apollo-portal has potential CSRF issueapolloconfig apollo · com.ctrip.framework.apollo:apollo
- CVE-2016-150263breadt dd-plist xml external entity reference3breadt dd-plist · com.googlecode.plist:dd-plist
- CVE-2016-15025generator-hottowel 404 Error _app.js cross site scriptinggenerator-hottowel
- CVE-2015-10080NREL api-umbrella-web Admin Data Table cross site scriptingNREL api-umbrella-web
- CVE-2014-125088qt-users-jp silk header.qml cross site scriptingqt-users-jp silk
- CVE-2013-10019OCLC-Research OAICat sql injectionOCLC-Research OAICat
- CVE-2012-10008uakfdotb oneapp sql injectionuakfdotb oneapp
- CVE-2021-32850jQuery MiniColors vulnerable to Cross-site Scriptingnpm @claviska/jquery-minicolors · @claviska/jquery-minicolo…
- CVE-2021-32851jQuery MiniColors vulnerable to Cross-site Scriptingnpm mind-elixir · mind-elixir
- CVE-2021-32852countly-server vulnerable to Cross-site Scriptingcountly-server
- CVE-2021-32853Erxes vulnerable to Cross-site Scriptingnpm erxes · erxes
- CVE-2021-32854textAngular text editor vulnerable to Cross-site Scriptingnpm textangular · textangular
- CVE-2021-32855vditor vulnerable to Cross-site Scriptingnpm vditor · vditor
- CVE-2021-32856Microweber vulnerable to Cross-site Scriptingmicroweber · microweber/microweber
- CVE-2021-32857Cockpit vulnerable to Cross-site Scriptingmicroweber
- CVE-2021-32858esdoc-publish-html-plugin vulnerable to Cross-site Scriptingesdoc-publish-html-plugin
- CVE-2021-32859Baremetrics date range picker vulnerable to Cross-site Scriptingbaremetrics-calendar
- CVE-2021-32860iziModal vulnerable to Cross-site Scriptingnpm iziModal · izimodal
- CVE-2022-48328app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles ordered_url_params and additional_delimiters.
- CVE-2023-26234JD-GUI 1.6.6 allows deserialization via UIMainWindowPreferencesProvider.singleInstance.
- CVE-2023-26235JD-GUI 1.6.6 allows XSS via util/net/InterProcessCommunicationUtil.java.