# CVEs published 2023-02-20

50 CVEs were published on February 20, 2023: 8 critical, 11 high. Days are UTC.

- [CVE-2022-3901](https://cve.now/CVE-2022-3901.md): Visioweb.js - Prototype Pollution can results in XSS (CVSS 7.2, Visio Globe Visioweb)
- [CVE-2019-25104](https://cve.now/CVE-2019-25104.md): rtcwcoop Team Command ai\_cast\_script.c AICast\_ScriptLoad denial of service (CVSS 3.5, rtcwcoop)
- [CVE-2016-15027](https://cve.now/CVE-2016-15027.md): meta4creations Post Duplicator Plugin notices.php mtphr\_post\_duplicator\_notice cross site scripting (CVSS 3.5, meta4creations Post Duplicator Plugin)
- [CVE-2022-48320](https://cve.now/CVE-2022-48320.md): CSRF in add-visual endpoint (CVSS 5.4, Tribe29 Checkmk)
- [CVE-2022-48319](https://cve.now/CVE-2022-48319.md): Host secret disclosed in Checkmk logs (CVSS 6.5, Tribe29 Checkmk)
- [CVE-2022-48318](https://cve.now/CVE-2022-48318.md): Insecure access control mechanisms for RestAPI documentation (CVSS 5.3, Tribe29 Checkmk)
- [CVE-2022-48317](https://cve.now/CVE-2022-48317.md): Insecure Termination of RestAPI Session Tokens (CVSS 5.6, Tribe29 Checkmk)
- [CVE-2022-48321](https://cve.now/CVE-2022-48321.md): SSRF in agent-receiver API (CVSS 6.8, Tribe29 Checkmk)
- [CVE-2022-47909](https://cve.now/CVE-2022-47909.md): LQL Injection in Livestatus HTTP headers (CVSS 6.8, Tribe29 Checkmk)
- [CVE-2022-46836](https://cve.now/CVE-2022-46836.md): PHP code injection in watolib (CVSS 9.1, Tribe29 Checkmk)
- [CVE-2022-46303](https://cve.now/CVE-2022-46303.md): Command injection in SMS notifications (CVSS 8.0, Tribe29 Checkmk)
- [CVE-2015-10081](https://cve.now/CVE-2015-10081.md): arnoldle submitByMailPlugin edit\_list.php cross-site request forgery (CVSS 4.3, arnoldle submitByMailPlugin)
- [CVE-2023-24998](https://cve.now/CVE-2023-24998.md): Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts (CVSS 7.5, Apache Software Foundation Apache Commons FileUpload · A… +4)
- [CVE-2023-25805](https://cve.now/CVE-2023-25805.md): versionn Command Injection Vulnerability (CVSS 9.8, commenthol versionn · versionn)
- [CVE-2023-25613](https://cve.now/CVE-2023-25613.md): LDAP Injection Vulnerability in Apache Kerby (no CVSS, Apache Software Foundation Apache Kerby LDAP Backend · org.…)
- [CVE-2023-25570](https://cve.now/CVE-2023-25570.md): Apollo has potential access control security issue in eureka (CVSS 7.5, apolloconfig apollo · com.ctrip.framework.apollo:apollo)
- [CVE-2023-25569](https://cve.now/CVE-2023-25569.md): apollo-portal has potential CSRF issue (CVSS 5.7, apolloconfig apollo · com.ctrip.framework.apollo:apollo)
- [CVE-2016-15026](https://cve.now/CVE-2016-15026.md): 3breadt dd-plist xml external entity reference (CVSS 5.3, 3breadt dd-plist · com.googlecode.plist:dd-plist)
- [CVE-2016-15025](https://cve.now/CVE-2016-15025.md): generator-hottowel 404 Error \_app.js cross site scripting (CVSS 3.5, generator-hottowel)
- [CVE-2015-10080](https://cve.now/CVE-2015-10080.md): NREL api-umbrella-web Admin Data Table cross site scripting (CVSS 3.5, NREL api-umbrella-web)
- [CVE-2014-125088](https://cve.now/CVE-2014-125088.md): qt-users-jp silk header.qml cross site scripting (CVSS 3.5, qt-users-jp silk)
- [CVE-2013-10019](https://cve.now/CVE-2013-10019.md): OCLC-Research OAICat sql injection (CVSS 6.3, OCLC-Research OAICat)
- [CVE-2012-10008](https://cve.now/CVE-2012-10008.md): uakfdotb oneapp sql injection (CVSS 6.3, uakfdotb oneapp)
- [CVE-2021-32847](https://cve.now/CVE-2021-32847.md): Moby HyperKit uninitialized memory use in virtio-sock pci\_vtsock\_proc\_tx (CVSS 7.1, moby hyperkit)
- [CVE-2021-32848](https://cve.now/CVE-2021-32848.md): Octobox ReDoS vulnerability (CVSS 7.5, octobox)
- [CVE-2021-32850](https://cve.now/CVE-2021-32850.md): jQuery MiniColors vulnerable to Cross-site Scripting (CVSS 6.1, npm @claviska/jquery-minicolors · @claviska/jquery-minicolo…)
- [CVE-2021-32851](https://cve.now/CVE-2021-32851.md): jQuery MiniColors vulnerable to Cross-site Scripting (CVSS 6.1, npm mind-elixir · mind-elixir)
- [CVE-2021-32852](https://cve.now/CVE-2021-32852.md): countly-server vulnerable to Cross-site Scripting (CVSS 5.4, countly-server)
- [CVE-2021-32853](https://cve.now/CVE-2021-32853.md): Erxes vulnerable to Cross-site Scripting (CVSS 6.1, npm erxes · erxes)
- [CVE-2021-32854](https://cve.now/CVE-2021-32854.md): textAngular text editor vulnerable to Cross-site Scripting (CVSS 6.1, npm textangular · textangular)
- [CVE-2021-32855](https://cve.now/CVE-2021-32855.md): vditor vulnerable to Cross-site Scripting (CVSS 6.1, npm vditor · vditor)
- [CVE-2021-32856](https://cve.now/CVE-2021-32856.md): Microweber vulnerable to Cross-site Scripting (CVSS 6.1, microweber · microweber/microweber)
- [CVE-2021-32857](https://cve.now/CVE-2021-32857.md): Cockpit vulnerable to Cross-site Scripting (CVSS 6.1, microweber)
- [CVE-2021-32858](https://cve.now/CVE-2021-32858.md): esdoc-publish-html-plugin vulnerable to Cross-site Scripting (CVSS 6.1, esdoc-publish-html-plugin)
- [CVE-2021-32859](https://cve.now/CVE-2021-32859.md): Baremetrics date range picker vulnerable to Cross-site Scripting (CVSS 6.1, baremetrics-calendar)
- [CVE-2021-32860](https://cve.now/CVE-2021-32860.md): iziModal vulnerable to Cross-site Scripting (CVSS 6.1, npm iziModal · izimodal)
- [CVE-2022-44216](https://cve.now/CVE-2022-44216.md): Gnuboard 5.5.4 and 5.5.5 is vulnerable to Insecure Permissions. (CVSS 7.5)
- [CVE-2022-48328](https://cve.now/CVE-2022-48328.md): app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles ordered\_url\_params and additional\_delimiters. (no CVSS)
- [CVE-2022-48329](https://cve.now/CVE-2022-48329.md): MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/M (CVSS 9.8)
- [CVE-2022-48337](https://cve.now/CVE-2022-48337.md): GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etag (CVSS 9.8)
- [CVE-2022-48338](https://cve.now/CVE-2022-48338.md): An issue was discovered in GNU Emacs through 28.2. (CVSS 7.3)
- [CVE-2022-48339](https://cve.now/CVE-2022-48339.md): An issue was discovered in GNU Emacs through 28.2. (CVSS 7.8)
- [CVE-2023-23452](https://cve.now/CVE-2023-23452.md): Missing Authentication for Critical Function in SICK FX0-GPNT v3 Firmware Version V3.04 and V3.05 allows an unprivileged remote attacker to (CVSS 9.8, FX0-GPNT v3 Firmware)
- [CVE-2023-23453](https://cve.now/CVE-2023-23453.md): Missing Authentication for Critical Function in SICK FX0-GENT v3 Firmware Version V3.04 and V3.05 allows an unprivileged remote attacker to (CVSS 9.8, FX0-GENT v3 Firmware)
- [CVE-2023-25656](https://cve.now/CVE-2023-25656.md): notation-go has excessive memory allocation on verification (CVSS 7.5, notaryproject notation-go · github.com/notaryproject/notati…)
- [CVE-2023-26081](https://cve.now/CVE-2023-26081.md): In Epiphany (aka GNOME Web) through 43.0, untrusted web content can trick users into exfiltrating passwords, because autofill occurs in sand (CVSS 7.5)
- [CVE-2023-26092](https://cve.now/CVE-2023-26092.md): Liima before 1.17.28 allows server-side template injection. (CVSS 9.8)
- [CVE-2023-26093](https://cve.now/CVE-2023-26093.md): Liima before 1.17.28 allows Hibernate query language (HQL) injection, related to colToSort in the deployment filter. (CVSS 9.8)
- [CVE-2023-26234](https://cve.now/CVE-2023-26234.md): JD-GUI 1.6.6 allows deserialization via UIMainWindowPreferencesProvider.singleInstance. (CVSS 6.6)
- [CVE-2023-26235](https://cve.now/CVE-2023-26235.md): JD-GUI 1.6.6 allows XSS via util/net/InterProcessCommunicationUtil.java. (CVSS 6.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-02-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.