CVEs published February 21, 2023
85 CVEs were published on February 21, 2023: 10 critical, 11 high.
- Published
- 85
- Critical
- 10
- High
- 11
- Medium
- 48
- Low
- 5
- Unrated
- 11
- Now in CISA KEV
- 0
- Fix available
- 43
Most affected products
- SourceCodester Best POS Management System
- 3
- Intuitive Custom Post Order
- 2
- Loan Comparison
- 2
- louislam uptime-kuma
- 2
- ShopLentor
- 2
- Watu Quiz
- 2
- answerdev/answer · github.com/answerdev/answer
- 1
- BackupBuddy
- 1
- Bootstrap Shortcodes
- 1
- cention-chatserver
- 1
Critical 10
- CVE-2023-25157Unfiltered SQL Injection Vulnerabilities in Geoservergeoserver · org.geoserver.community:gs-jdbcconfig
- CVE-2023-25158Unfiltered SQL Injection in Geotoolsgeotools · org.geotools:gt-jdbc
- CVE-2023-0232ShopLentor < 2.5.4 - PHP Object InjectionShopLentor
- CVE-2022-45564SQL Injection vulnerability in znfit Home improvement ERP management system V50_20220207,v42 allows attackers to execute arbitrary sql comma
- CVE-2022-45677SQL Injection Vulnerability in tanujpatra228 Tution Management System (TMS) via the email parameter to processes/student_login.process.php.
- CVE-2022-46637Prolink router PRS1841 was discovered to contain hardcoded credentials for its Telnet and FTP services.
- CVE-2023-22920A security misconfiguration vulnerability exists in the Zyxel LTE3316-M604 firmware version V2.00(ABMP.6)C0 due to a factory default misconfZyxel LTE3316-M604
- CVE-2023-24080A lack of rate limiting on the password reset endpoint of Chamberlain myQ v5.222.0.32277 (on iOS) allows attackers to compromise user accoun
- CVE-2023-24184TOTOLink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability.
- CVE-2023-24320An access control issue in Axcora POS #0~gitf77ec09 allows unauthenticated attackers to execute arbitrary commands via unspecified vectors.
High 11
- CVE-2023-25657Remote code execution in Jinja2 template rendering in Nautobotnautobot
- CVE-2023-0428Watu Quiz < 3.3.8.2 - Reflected XSSWatu Quiz
- CVE-2023-24575 Dell Multifunction Printer E525w Driver and Software Suite, versions prior to 1.047.2022, A05, contain a local privilege escalation vulneraDell Multifunction Printer E525w Driver and Software Suite
- CVE-2022-31394Hyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method in the H2 third-party software, allowing a
- CVE-2022-48340In Gluster GlusterFS 11.0, there is an xlators/cluster/dht/src/dht-common.c dht_setxattr_mds_cbk use-after-free.
- CVE-2023-20855VMware vRealize Orchestrator contains an XML External Entity (XXE) vulnerability.VMware vRealize Orchestrator, VMware vRealize Automation, V…
- CVE-2023-20858VMware Carbon Black App Control 8.7.x prior to 8.7.8, 8.8.x prior to 8.8.6, and 8.9.x.prior to 8.9.4 contain an injection vulnerability.VMware Carbon Black App Control
- CVE-2023-26242afu_mmio_region_get_by_offset in drivers/fpga/dfl-afu-region.c in the Linux kernel through 6.1.12 has an integer overflow.
- CVE-2023-26249Knot Resolver before 5.6.0 enables attackers to consume its resources, launching amplification attacks and potentially causing a denial of s
- CVE-2023-26253In Gluster GlusterFS 11.0, there is an xlators/mount/fuse/src/fuse-bridge.c notify stack-based buffer over-read.
- CVE-2023-26266In AFL++ 4.05c, the CmpLog component uses the current working directory to resolve and execute unprefixed fuzzing targets, allowing code exe
Medium, low and unrated 64
- CVE-2023-25811Persistent Cross site scripting (XSS) in Uptime Kumalouislam uptime-kuma
- CVE-2023-25810Persistent Cross site scripting (XSS) through description in status page in Uptime Kumalouislam uptime-kuma
- CVE-2023-25812Allowed DELETE on resources on object locked buckets under Governance mode in Miniominio
- CVE-2017-20179InSTEDD Pollit tour_controller.rb TourController Privilege EscalationInSTEDD Pollit
- CVE-2023-0946SourceCodester Best POS Management System sql injectionSourceCodester Best POS Management System
- CVE-2023-0945SourceCodester Best POS Management System cross site scriptingSourceCodester Best POS Management System
- CVE-2023-0943SourceCodester Best POS Management System Image save_settings unrestricted uploadSourceCodester Best POS Management System
- CVE-2023-0942Japanized For WooCommerce <= 2.5.4 - Reflected Cross-Site Scriptingshoheitanaka Japanized for WooCommerce
- CVE-2022-48282Deserializing compromised object with MongoDB .NET/C# Driver may cause remote code executionMongoDB .NET/C# Driver · MongoDB.Driver
- CVE-2017-20178Codiad process.php saveJSON information disclosureCodiad · codiad/codiad
- CVE-2015-10085GoPistolet MTA denial of serviceGoPistolet · github.com/gopistolet/gopistolet
- CVE-2015-10084irontec klear-library BaseController.php _prepareWhere sql injectionirontec klear-library
- CVE-2015-10083harrystech Dynosaur-Rails application_controller.rb basic_auth improper authenticationharrystech Dynosaur-Rails
- CVE-2023-25928IBM InfoSphere Information Server cross-site scriptingIBM InfoSphere Information Server
- CVE-2022-3353IEC 61850 MMS-Server Vulnerability in multiple Hitachi Energy ProductsHitachi Energy FOX61x TEGO1 · Hitachi Energy GMS600 +9
- CVE-2023-0938SourceCodester Music Gallery Site GET Request music_list.php sql injectionSourceCodester Music Gallery Site
- CVE-2023-0936TP-Link Archer C50 Web Management Interface denial of serviceTP-Link Archer C50
- CVE-2023-0935DolphinPHP Incomplete Fix CVE-2021-46097 common.php os command injectionDolphinPHP
- CVE-2023-0442Loan Comparison < 1.5.2 - Reflected XSS via shortcodeLoan Comparison
- CVE-2023-0419Shortcode for Font Awesome < 1.4.1 - Contributor+ Stored XSSShortcode for Font Awesome
- CVE-2022-4714WP Dark Mode < 4.0.0 - Contributor+ Stored XSS in ShortcodeWP Dark Mode
- CVE-2022-4754Easy Social Box <= 4.1.2 - Contributor+ Stored XSS via ShortcodeEasy Social Box / Page Plugin
- CVE-2022-4386Intuitive Custom Post Order < 3.1.4 - Arbitrary Menu Order Update via CSRFIntuitive Custom Post Order
- CVE-2022-4666Markup <= 4.8.1 - Contributor+ Stored XSS via ShortcodeMarkup (JSON-LD) structured in schema.org
- CVE-2023-0059Youzify < 1.2.2 - Contributor+ Stored XSSYouzify
- CVE-2023-0366Loan Comparison < 1.5.3 - Contributor+ Stored XSS via shortcodeLoan Comparison
- CVE-2022-4786Video.js - HTML5 Video Player for WordPress <= 4.5.0 - Contributor+ Stored XSS via ShortcodeVideo.js
- CVE-2023-0540GS Filterable Portfolio < 1.6.1 - Contributor+ Stored XSSGS Filterable Portfolio
- CVE-2023-0429Watu Quiz < 3.3.8.3 - Admin+ Stored XSSWatu Quiz
- CVE-2022-4764Simple File Downloader <= 1.0.4 - Contributor+ Stored XSS via ShortcodeSimple File Downloader
- CVE-2023-0541GS Books Showcase < 1.3.1 - Contributor+ Stored XSSGS Books Showcase
- CVE-2023-0453WP Private Message < 1.0.6 - Private Message Disclosure via IDORWP Private Message
- CVE-2022-4752Opening Hours <= 2.3.0 - Contributor+ Stored XSS via ShortcodeOpening Hours
- CVE-2023-0371EmbedSocial < 1.1.28 - Contributor+ Stored XSSEmbedSocial
- CVE-2022-4791Product Slider and Carousel with Category for WooCommerce < 2.8 - Contributor+ Stored XSS via ShortcodeProduct Slider and Carousel with Category for WooCommerce
- CVE-2022-4897BackupBuddy < 8.8.3 - Multiple Reflected Cross-Site ScriptingBackupBuddy
- CVE-2022-4784Hueman Addons <= 2.3.3 - Contributor+ Stored XSS via ShortcodeHueman Addons
- CVE-2023-0372EmbedStories < 0.7.5 - Contributor+ Stored XSSEmbedStories
- CVE-2022-4622Login Logout Menu <= 1.3.3 - Contributor+ Stored XSS in ShortcodeLogin Logout Menu
- CVE-2023-0492GS Products Slider for WooCommerce < 1.5.9 - Contributor+ Stored XSSGS Products Slider for WooCommerce
- CVE-2023-0559GS Portfolio for Envato < 1.4.0 - Contributor+ Stored XSSGS Portfolio for Envato
- CVE-2022-4785Download Video Sidebar Widgets <= 6.1 - Contributor+ Stored XSS via ShortcodeVideo Sidebar Widgets
- CVE-2022-4750WP Responsive Testimonials Slider And Widget <= 1.5 - Contributor+ Stored XSSWP Responsive Testimonials Slider And Widget
- CVE-2022-4761Post Views Count <= 3.0.2 - Contributor+ Stored XSS in ShortcodePost Views Count
- CVE-2023-0378Greenshift < 5.0 - Contributor+ Stored XSSGreenshift
- CVE-2023-0285Real Media Library < 4.18.29 - Author+ Stored XSSReal Media Library: Media Library Folder & File Manager
- CVE-2022-4777Bootstrap Shortcodes <= 3.4.0 - Contributor+ Stored XSS via ShortcodeBootstrap Shortcodes
- CVE-2023-0067Timed Content < 2.73 - Contributor+ Stored XSSTimed Content
- CVE-2022-4385Intuitive Custom Post Order < 3.1.4 - Subscriber+ Arbitrary Menu Order UpdateIntuitive Custom Post Order
- CVE-2022-4669Page Builder: Live Composer < 1.5.23 - Contributor+ Stored XSS via ShortcodePage Builder: Live Composer
- CVE-2023-0231ShopLentor < 2.5.4 - Contributor+ Stored XSSShopLentor
- CVE-2023-0375Easy Affiliate Links < 3.7.1 - Contributor+ Stored XSSEasy Affiliate Links
- CVE-2020-36656Spectra < 1.15.0 - Contributor+ Stored Cross-Side ScriptingSpectra
- CVE-2023-0271WP Font Awesome < 1.7.9 - Contributor+ Stored XSSWP Font Awesome
- CVE-2023-0380Easy Digital Downloads < 3.1.0.5 - Contributor+ Stored XSSEasy Digital Downloads
- CVE-2015-10082UIKit0 libplist XML xplist.c plist_from_xml xml external entity referenceUIKit0 libplist
- CVE-2014-125089cention-chatserver InternalChatProtocol.fe _formatBody cross site scriptingcention-chatserver
- CVE-2022-38779An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciouslyElastic kibana
- CVE-2023-0934Cross-site Scripting (XSS) - Stored in answerdev/answeranswerdev/answer · github.com/answerdev/answer
- CVE-2023-22984A Vulnerability was discovered in Axis 207W network camera.
- CVE-2023-23009Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via crafted TS payload with an incorr
- CVE-2023-24081Multiple stored cross-site scripting (XSS) vulnerabilities in Redrock Software TutorTrac before v4.2.170210 allows attackers to execute arbi
- CVE-2023-26265The Borg theme before 1.1.19 for Backdrop CMS does not sufficiently sanitize path arguments that are passed in via a URL.
- CVE-2023-26267php-saml-sp before 1.1.1 and 2.x before 2.1.1 allows reading arbitrary files as the webserver user because resolving XML external entities w