# CVEs published 2023-02-22

61 CVEs were published on February 22, 2023: 11 critical, 25 high. Days are UTC.

- [CVE-2023-26303](https://cve.now/CVE-2023-26303.md): markdown-it-py crash on null assertions (CVSS 3.3, Executable Books markdown-it-py · markdown-it-py)
- [CVE-2023-26302](https://cve.now/CVE-2023-26302.md): markdown-it-py CLI crash on invalid UTF-8 characters (CVSS 3.3, Executable Books markdown-it-py · markdown-it-py)
- [CVE-2022-37938](https://cve.now/CVE-2022-37938.md): Unauthenticated server side request forgery in HPE Serviceguard Manager (CVSS 9.8, Hewlett Packard Enterprise (HPE) HPE Serviceguard for Linux)
- [CVE-2022-37937](https://cve.now/CVE-2022-37937.md): Pre-auth memory corruption in HPE Serviceguard (CVSS 9.8, Hewlett Packard Enterprise (HPE) HPE Serviceguard for Linux)
- [CVE-2022-37936](https://cve.now/CVE-2022-37936.md): Unauthenticated Java deserialization vulnerability in Serviceguard Manager (CVSS 9.8, Hewlett Packard Enterprise (HPE) HPE Serviceguard for Linux)
- [CVE-2023-0104](https://cve.now/CVE-2023-0104.md): The listed versions for Weintek EasyBuilder Pro are vulnerable to a ZipSlip attack caused by decompiling a malicious project file. (CVSS 9.3, Weintek EasyBuilder Pro cMT)
- [CVE-2023-0941](https://cve.now/CVE-2023-0941.md): Use after free in Prompts in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a cr (CVSS 8.8, Google Chrome)
- [CVE-2023-0933](https://cve.now/CVE-2023-0933.md): Integer overflow in PDF in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a craf (CVSS 8.8, Google Chrome)
- [CVE-2023-0932](https://cve.now/CVE-2023-0932.md): Use after free in WebRTC in Google Chrome on Windows prior to 110.0.5481.177 allowed a remote attacker who convinced the user to engage in s (CVSS 8.8, Google Chrome)
- [CVE-2023-0931](https://cve.now/CVE-2023-0931.md): Use after free in Video in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a craf (CVSS 8.8, Google Chrome)
- [CVE-2023-0930](https://cve.now/CVE-2023-0930.md): Heap buffer overflow in Video in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via (CVSS 8.8, Google Chrome)
- [CVE-2023-0929](https://cve.now/CVE-2023-0929.md): Use after free in Vulkan in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a cra (CVSS 8.8, Google Chrome)
- [CVE-2023-0928](https://cve.now/CVE-2023-0928.md): Use after free in SwiftShader in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via (CVSS 8.8, Google Chrome)
- [CVE-2023-0927](https://cve.now/CVE-2023-0927.md): Use after free in Web Payments API in Google Chrome on Android prior to 110.0.5481.177 allowed a remote attacker who had compromised the ren (CVSS 8.8, Google Chrome)
- [CVE-2023-0966](https://cve.now/CVE-2023-0966.md): SourceCodester Online Eyewear Shop cross site scripting (CVSS 2.4, SourceCodester Online Eyewear Shop)
- [CVE-2023-24810](https://cve.now/CVE-2023-24810.md): Cross site scripting (XSS) vulnerability using authentication callback in Misskey (CVSS 7.1, misskey-dev misskey)
- [CVE-2023-24811](https://cve.now/CVE-2023-24811.md): Cross site scripting (XSS) vulnerability using url preview in Misskey (CVSS 7.1, misskey-dev misskey)
- [CVE-2023-24812](https://cve.now/CVE-2023-24812.md): SQL injection of notes/search-by-tag (CVSS 8.8, misskey-dev misskey)
- [CVE-2023-25154](https://cve.now/CVE-2023-25154.md): Cross site scripting (XSS) of ActivityPub URI in misskey (CVSS 7.1, misskey-dev misskey)
- [CVE-2023-0846](https://cve.now/CVE-2023-0846.md): Unauthenticated, stored XSS in display of alarm reduction-key (CVSS 6.7, The OpenNMS Group Horizon · The OpenNMS Group Meridian +1)
- [CVE-2023-0964](https://cve.now/CVE-2023-0964.md): SourceCodester Sales Tracker Management System view\_product.php sql injection (CVSS 5.0, SourceCodester Sales Tracker Management System)
- [CVE-2023-25579](https://cve.now/CVE-2023-25579.md): Directory traversal in Nextcloud server (CVSS 6.0, nextcloud security-advisories)
- [CVE-2023-25813](https://cve.now/CVE-2023-25813.md): SQL Injection via replacements in sequelize (CVSS 10.0, sequelize)
- [CVE-2023-0963](https://cve.now/CVE-2023-0963.md): SourceCodester Music Gallery Site POST Request Users.php access control (CVSS 7.3, SourceCodester Music Gallery Site)
- [CVE-2023-0962](https://cve.now/CVE-2023-0962.md): SourceCodester Music Gallery Site GET Request Master.php sql injection (CVSS 6.3, SourceCodester Music Gallery Site)
- [CVE-2023-0961](https://cve.now/CVE-2023-0961.md): SourceCodester Music Gallery Site GET Request view\_music\_details.php sql injection (CVSS 6.3, SourceCodester Music Gallery Site)
- [CVE-2023-0960](https://cve.now/CVE-2023-0960.md): SeaCMS Picture Management config.ftp.php deserialization (CVSS 4.7, SeaCMS)
- [CVE-2022-43578](https://cve.now/CVE-2022-43578.md): IBM Sterling B2B Integrator Standard Edition cross-site scripting (CVSS 4.6, IBM Sterling B2B Integrator Standard Edition)
- [CVE-2022-43873](https://cve.now/CVE-2022-43873.md): IBM Spectrum Virtualize privilege escalation (CVSS 6.3, IBM Spectrum Virtualize)
- [CVE-2022-43870](https://cve.now/CVE-2022-43870.md): IBM Spectrum Virtualize information disclosure (CVSS 6.5, IBM Spectrum Virtualize)
- [CVE-2021-4326](https://cve.now/CVE-2021-4326.md): Imperative Local Command Injection allows Activity Masking (CVSS 3.3, Open Mainframe Project Zowe · @zowe/imperative)
- [CVE-2022-41216](https://cve.now/CVE-2022-41216.md): Cloudflow - Local File Inclusion Vulnerability (CVSS 8.3, Hybrid Software Cloudflow)
- [CVE-2022-41217](https://cve.now/CVE-2022-41217.md): Cloudflow - Unauthenticated file upload vulnerability (CVSS 9.8, Hybrid Software Cloudflow)
- [CVE-2023-0952](https://cve.now/CVE-2023-0952.md): Improper access controls on entries in Devolutions Server 2022.3.12 and earlier could allow an authenticated user to access sensitive data (CVSS 6.5, Devolutions Server)
- [CVE-2023-0951](https://cve.now/CVE-2023-0951.md): Improper access controls on some API endpoints in Devolutions Server 2022.3.12 and earlier could allow a standard privileged user to perfor (CVSS 8.8, Devolutions Server)
- [CVE-2023-0953](https://cve.now/CVE-2023-0953.md): Insufficient input sanitization in the documentation feature of Devolutions Server 2022.3.12 and earlier allows an authenticated attacker to (CVSS 8.8, Devolutions Server)
- [CVE-2021-4325](https://cve.now/CVE-2021-4325.md): NHN TOAST UI Chart Legend cross site scripting (CVSS 3.5, NHN TOAST UI Chart)
- [CVE-2021-33367](https://cve.now/CVE-2021-33367.md): Buffer Overflow vulnerability in Freeimage v3.18.0 allows attacker to cause a denial of service via a crafted JXR file. (no CVSS)
- [CVE-2022-2883](https://cve.now/CVE-2022-2883.md): In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service (CVSS 7.5, Octopus Deploy Octopus Server)
- [CVE-2022-29273](https://cve.now/CVE-2022-29273.md): pfSense CE through 2.6.0 and pfSense Plus before 22.05 allow XSS in the WebGUI via URL Table Alias URL parameters. (no CVSS)
- [CVE-2022-39983](https://cve.now/CVE-2022-39983.md): File upload vulnerability in Pro Gamma Instant Developer RD3 22.5 r23, r30, and possibly earlier versions, allows attackers to execute arbit (no CVSS)
- [CVE-2022-41565](https://cve.now/CVE-2022-41565.md): TIBCO EBX Cross Site Scripting (XSS) Vulnerability (CVSS 8.7, TIBCO Software TIBCO EBX · TIBCO Software TIBCO Product and…)
- [CVE-2022-41566](https://cve.now/CVE-2022-41566.md): TIBCO EBX Add-ons Cross Site Scripting (XSS) Vulnerability (CVSS 8.7, TIBCO Software TIBCO EBX Add-ons)
- [CVE-2022-41567](https://cve.now/CVE-2022-41567.md): TIBCO BusinessConnect Stored XSS Vulnerability (CVSS 7.3, TIBCO Software TIBCO BusinessConnect)
- [CVE-2022-45599](https://cve.now/CVE-2022-45599.md): Aztech WMB250AC Mesh Routers Firmware Version 016 2020 is vulnerable to PHP Type Juggling in file /var/www/login.php, allows attackers to ga (CVSS 9.8)
- [CVE-2022-45600](https://cve.now/CVE-2022-45600.md): Aztech WMB250AC Mesh Routers Firmware Version 016 2020 devices improperly manage sessions, which allows remote attackers to bypass authentic (CVSS 8.8)
- [CVE-2022-48149](https://cve.now/CVE-2022-48149.md): Online Student Admission System in PHP Free Source Code 1.0 was discovered to contain a SQL injection vulnerability via the username paramet (no CVSS)
- [CVE-2023-0947](https://cve.now/CVE-2023-0947.md): Path Traversal in flatpressblog/flatpress (CVSS 8.1, flatpressblog/flatpress)
- [CVE-2023-0949](https://cve.now/CVE-2023-0949.md): Cross-site Scripting (XSS) - Reflected in modoboa/modoboa (CVSS 4.8, modoboa/modoboa · modoboa)
- [CVE-2023-22972](https://cve.now/CVE-2023-22972.md): A Reflected Cross-site scripting (XSS) vulnerability in interface/forms/eye\_mag/php/eye\_mag\_functions.php in OpenEMR \< 7.0.0 allows remote a (no CVSS)
- [CVE-2023-22973](https://cve.now/CVE-2023-22973.md): A Local File Inclusion (LFI) vulnerability in interface/forms/LBF/new.php in OpenEMR \< 7.0.0 allows remote authenticated users to execute co (no CVSS)
- [CVE-2023-22974](https://cve.now/CVE-2023-22974.md): A Path Traversal in setup.php in OpenEMR \< 7.0.0 allows remote unauthenticated users to read arbitrary files by controlling a connection to (no CVSS)
- [CVE-2023-23039](https://cve.now/CVE-2023-23039.md): An issue was discovered in the Linux kernel through 6.2.0-rc2. (CVSS 5.7)
- [CVE-2023-23040](https://cve.now/CVE-2023-23040.md): TP-Link router TL-WR940N V6 3.19.1 Build 180119 uses a deprecated MD5 algorithm to hash the admin password used for basic authentication. (CVSS 7.5)
- [CVE-2023-23063](https://cve.now/CVE-2023-23063.md): Cellinx NVT v1.0.6.002b was discovered to contain a local file disclosure vulnerability via the component /cgi-bin/GetFileContent.cgi. (no CVSS)
- [CVE-2023-24093](https://cve.now/CVE-2023-24093.md): An access control issue in H3C A210-G A210-GV100R005 allows attackers to authenticate without a password. (CVSS 9.8)
- [CVE-2023-24107](https://cve.now/CVE-2023-24107.md): hour\_of\_code\_python\_2015 commit 520929797b9ca43bb818b2e8f963fb2025459fa3 was discovered to contain a code execution backdoor via the request (CVSS 9.8)
- [CVE-2023-24108](https://cve.now/CVE-2023-24108.md): MvcTools 6d48cd6830fc1df1d8c9d61caa1805fd6a1b7737 was discovered to contain a code execution backdoor via the request package (requirements. (CVSS 9.8)
- [CVE-2023-24114](https://cve.now/CVE-2023-24114.md): typecho 1.1/17.10.30 was discovered to contain a remote code execution (RCE) vulnerability via install.php. (CVSS 9.8)
- [CVE-2023-26214](https://cve.now/CVE-2023-26214.md): TIBCO BusinessConnect Reflected XSS Vulnerability (CVSS 7.3, TIBCO Software TIBCO BusinessConnect)
- [CVE-2023-26314](https://cve.now/CVE-2023-26314.md): The mono package before 6.8.0.105+dfsg-3.3 for Debian allows arbitrary code execution because the application/x-ms-dos-executable MIME type (CVSS 8.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-02-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.