CVEs published February 22, 2023
61 CVEs were published on February 22, 2023: 11 critical, 25 high.
- Published
- 61
- Critical
- 11
- High
- 25
- Medium
- 12
- Low
- 5
- Unrated
- 8
- Now in CISA KEV
- 0
- Fix available
- 28
Most affected products
- Google Chrome
- 8
- misskey-dev misskey
- 4
- Devolutions Server
- 3
- Hewlett Packard Enterprise (HPE) HPE Serviceguard for Linux
- 3
- SourceCodester Music Gallery Site
- 3
- Executable Books markdown-it-py · markdown-it-py
- 2
- Hybrid Software Cloudflow
- 2
- IBM Spectrum Virtualize
- 2
- TIBCO Software TIBCO BusinessConnect
- 2
- flatpressblog/flatpress
- 1
Critical 11
- CVE-2022-37938Unauthenticated server side request forgery in HPE Serviceguard ManagerHewlett Packard Enterprise (HPE) HPE Serviceguard for Linux
- CVE-2022-37937Pre-auth memory corruption in HPE ServiceguardHewlett Packard Enterprise (HPE) HPE Serviceguard for Linux
- CVE-2022-37936Unauthenticated Java deserialization vulnerability in Serviceguard Manager Hewlett Packard Enterprise (HPE) HPE Serviceguard for Linux
- CVE-2023-0104 The listed versions for Weintek EasyBuilder Pro are vulnerable to a ZipSlip attack caused by decompiling a malicious project file.Weintek EasyBuilder Pro cMT
- CVE-2023-25813SQL Injection via replacements in sequelizesequelize
- CVE-2022-41217Cloudflow - Unauthenticated file upload vulnerabilityHybrid Software Cloudflow
- CVE-2022-45599Aztech WMB250AC Mesh Routers Firmware Version 016 2020 is vulnerable to PHP Type Juggling in file /var/www/login.php, allows attackers to ga
- CVE-2023-24093An access control issue in H3C A210-G A210-GV100R005 allows attackers to authenticate without a password.
- CVE-2023-24107hour_of_code_python_2015 commit 520929797b9ca43bb818b2e8f963fb2025459fa3 was discovered to contain a code execution backdoor via the request
- CVE-2023-24108MvcTools 6d48cd6830fc1df1d8c9d61caa1805fd6a1b7737 was discovered to contain a code execution backdoor via the request package (requirements.
- CVE-2023-24114typecho 1.1/17.10.30 was discovered to contain a remote code execution (RCE) vulnerability via install.php.
High 25
- CVE-2023-0941Use after free in Prompts in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crGoogle Chrome
- CVE-2023-0933Integer overflow in PDF in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2023-0932Use after free in WebRTC in Google Chrome on Windows prior to 110.0.5481.177 allowed a remote attacker who convinced the user to engage in sGoogle Chrome
- CVE-2023-0931Use after free in Video in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2023-0930Heap buffer overflow in Video in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via Google Chrome
- CVE-2023-0929Use after free in Vulkan in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a craGoogle Chrome
- CVE-2023-0928Use after free in SwiftShader in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via Google Chrome
- CVE-2023-0927Use after free in Web Payments API in Google Chrome on Android prior to 110.0.5481.177 allowed a remote attacker who had compromised the renGoogle Chrome
- CVE-2023-24810Cross site scripting (XSS) vulnerability using authentication callback in Misskeymisskey-dev misskey
- CVE-2023-24811Cross site scripting (XSS) vulnerability using url preview in Misskeymisskey-dev misskey
- CVE-2023-24812SQL injection of notes/search-by-tagmisskey-dev misskey
- CVE-2023-25154Cross site scripting (XSS) of ActivityPub URI in misskeymisskey-dev misskey
- CVE-2023-0963SourceCodester Music Gallery Site POST Request Users.php access controlSourceCodester Music Gallery Site
- CVE-2022-41216Cloudflow - Local File Inclusion VulnerabilityHybrid Software Cloudflow
- CVE-2023-0951Improper access controls on some API endpoints in Devolutions Server 2022.3.12 and earlier could allow a standard privileged user to perforDevolutions Server
- CVE-2023-0953Insufficient input sanitization in the documentation feature of Devolutions Server 2022.3.12 and earlier allows an authenticated attacker toDevolutions Server
- CVE-2022-2883In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of ServiceOctopus Deploy Octopus Server
- CVE-2022-41565TIBCO EBX Cross Site Scripting (XSS) VulnerabilityTIBCO Software TIBCO EBX · TIBCO Software TIBCO Product and…
- CVE-2022-41566TIBCO EBX Add-ons Cross Site Scripting (XSS) VulnerabilityTIBCO Software TIBCO EBX Add-ons
- CVE-2022-41567TIBCO BusinessConnect Stored XSS VulnerabilityTIBCO Software TIBCO BusinessConnect
- CVE-2022-45600Aztech WMB250AC Mesh Routers Firmware Version 016 2020 devices improperly manage sessions, which allows remote attackers to bypass authentic
- CVE-2023-0947Path Traversal in flatpressblog/flatpressflatpressblog/flatpress
- CVE-2023-23040TP-Link router TL-WR940N V6 3.19.1 Build 180119 uses a deprecated MD5 algorithm to hash the admin password used for basic authentication.
- CVE-2023-26214TIBCO BusinessConnect Reflected XSS VulnerabilityTIBCO Software TIBCO BusinessConnect
- CVE-2023-26314The mono package before 6.8.0.105+dfsg-3.3 for Debian allows arbitrary code execution because the application/x-ms-dos-executable MIME type
Medium, low and unrated 25
- CVE-2023-26303markdown-it-py crash on null assertionsExecutable Books markdown-it-py · markdown-it-py
- CVE-2023-26302markdown-it-py CLI crash on invalid UTF-8 charactersExecutable Books markdown-it-py · markdown-it-py
- CVE-2023-0966SourceCodester Online Eyewear Shop cross site scriptingSourceCodester Online Eyewear Shop
- CVE-2023-0846Unauthenticated, stored XSS in display of alarm reduction-keyThe OpenNMS Group Horizon · The OpenNMS Group Meridian +1
- CVE-2023-0964SourceCodester Sales Tracker Management System view_product.php sql injectionSourceCodester Sales Tracker Management System
- CVE-2023-25579Directory traversal in Nextcloud servernextcloud security-advisories
- CVE-2023-0962SourceCodester Music Gallery Site GET Request Master.php sql injectionSourceCodester Music Gallery Site
- CVE-2023-0961SourceCodester Music Gallery Site GET Request view_music_details.php sql injectionSourceCodester Music Gallery Site
- CVE-2023-0960SeaCMS Picture Management config.ftp.php deserializationSeaCMS
- CVE-2022-43578IBM Sterling B2B Integrator Standard Edition cross-site scriptingIBM Sterling B2B Integrator Standard Edition
- CVE-2022-43873IBM Spectrum Virtualize privilege escalationIBM Spectrum Virtualize
- CVE-2022-43870IBM Spectrum Virtualize information disclosureIBM Spectrum Virtualize
- CVE-2021-4326Imperative Local Command Injection allows Activity MaskingOpen Mainframe Project Zowe · @zowe/imperative
- CVE-2023-0952Improper access controls on entries in Devolutions Server 2022.3.12 and earlier could allow an authenticated user to access sensitive dataDevolutions Server
- CVE-2021-4325NHN TOAST UI Chart Legend cross site scriptingNHN TOAST UI Chart
- CVE-2021-33367Buffer Overflow vulnerability in Freeimage v3.18.0 allows attacker to cause a denial of service via a crafted JXR file.
- CVE-2022-29273pfSense CE through 2.6.0 and pfSense Plus before 22.05 allow XSS in the WebGUI via URL Table Alias URL parameters.
- CVE-2022-39983File upload vulnerability in Pro Gamma Instant Developer RD3 22.5 r23, r30, and possibly earlier versions, allows attackers to execute arbit
- CVE-2022-48149Online Student Admission System in PHP Free Source Code 1.0 was discovered to contain a SQL injection vulnerability via the username paramet
- CVE-2023-0949Cross-site Scripting (XSS) - Reflected in modoboa/modoboamodoboa/modoboa · modoboa
- CVE-2023-22972A Reflected Cross-site scripting (XSS) vulnerability in interface/forms/eye_mag/php/eye_mag_functions.php in OpenEMR < 7.0.0 allows remote a
- CVE-2023-22973A Local File Inclusion (LFI) vulnerability in interface/forms/LBF/new.php in OpenEMR < 7.0.0 allows remote authenticated users to execute co
- CVE-2023-22974A Path Traversal in setup.php in OpenEMR < 7.0.0 allows remote unauthenticated users to read arbitrary files by controlling a connection to
- CVE-2023-23039An issue was discovered in the Linux kernel through 6.2.0-rc2.
- CVE-2023-23063Cellinx NVT v1.0.6.002b was discovered to contain a local file disclosure vulnerability via the component /cgi-bin/GetFileContent.cgi.