CVEs published February 23, 2023
57 CVEs were published on February 23, 2023: 8 critical, 7 high.
- Published
- 57
- Critical
- 8
- High
- 7
- Medium
- 27
- Low
- 2
- Unrated
- 13
- Now in CISA KEV
- 0
- Fix available
- 18
Most affected products
- The OpenNMS Group Meridian · The OpenNMS Group Horizon +1
- 4
- Cisco Unified Computing System
- 3
- https://github.com/curl/curl
- 3
- JetBrains TeamCity
- 3
- NodeJS Node
- 3
- SourceCodester Yoga Class Registration System
- 3
- PTC ThingWorx Edge C-SDK · Microsoft .NET-SDK +7
- 2
- SourceCodester Online Pizza Ordering System
- 2
- airtower-luna mod_gnutls
- 1
- Apache Software Foundation Apache Sling · org.apache.sling:…
- 1
Critical 8
- CVE-2023-0754 The affected products are vulnerable to an integer overflow or wraparound, which could allow an attacker to crash the server and remotely PTC ThingWorx Edge C-SDK · Microsoft .NET-SDK +7
- CVE-2023-0755 The affected products are vulnerable to an improper validation of array index, which could allow an attacker to crash the server and remotePTC ThingWorx Edge C-SDK · Microsoft .NET-SDK +7
- CVE-2022-2504SQLi in SDD-BaroSDD Computer Software SDD-Baro
- CVE-2023-0939Multiple SQL Injection on NTN Information Technologies' Online Services softwareNTN Information Technologies Online Services Software
- CVE-2022-36231pdf_info 0.5.3 is vulnerable to Command Execution because the Ruby code uses backticks instead of Open3.pdf_info
- CVE-2023-23914A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiphttps://github.com/curl/curl
- CVE-2023-24104Ubiquiti Networks UniFi Dream Machine Pro v7.2.95 allows attackers to bypass domain restrictions via crafted packets.
- CVE-2023-24205Clash for Windows v0.20.12 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via overwriting the conf
High 7
- CVE-2023-25824mod_gnutls contains Infinite Loop on request read timeoutairtower-luna mod_gnutls
- CVE-2023-20011Cisco Application Policy Infrastructure Controller and Cisco Cloud Network Controller Cross-Site Request Forgery VulnerabilityCisco Application Policy Infrastructure Controller
- CVE-2023-20089Cisco Nexus 9000 Series Fabric Switches in ACI Mode Link Layer Discovery Protocol Memory Leak Denial of Service VulnerabilityCisco NX-OS System Software in ACI Mode
- CVE-2023-23295Korenix Jetwave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection via /goform/formSysCmd.
- CVE-2023-23917A prototype pollution vulnerability exists in Rocket.Chat server <5.2.0 that could allow an attacker to a RCE under the admin account.Rocket.chat
- CVE-2023-23918A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimeNodeJS Node
- CVE-2023-23919A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL erroNodeJS Node
Medium, low and unrated 42
- CVE-2023-25823Gradio contains Use of Hard-coded Credentialsgradio-app gradio · gradio
- CVE-2023-22476MantisBT: Exposure of Private issues' summary to unauthorized usersmantisbt · mantisbt/mantisbt
- CVE-2022-48344In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the group creation process.JetBrains TeamCity
- CVE-2022-48343In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the user creation process.JetBrains TeamCity
- CVE-2022-48342In JetBrains TeamCity before 2022.10.2 jVMTI was enabled by default on agents.JetBrains TeamCity
- CVE-2023-0988SourceCodester Online Pizza Ordering System cross-site request forgerySourceCodester Online Pizza Ordering System
- CVE-2023-0987SourceCodester Online Pizza Ordering System cross site scriptingSourceCodester Online Pizza Ordering System
- CVE-2023-0986SourceCodester Sales Tracker Management System Edit User sql injectionSourceCodester Sales Tracker Management System
- CVE-2023-24415WordPress AI ChatBot plugin <= 4.2.8 is vulnerable to Cross Site Request Forgery (CSRF)QuantumCloud AI ChatBot
- CVE-2023-24384WordPress Organization chart Plugin <= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF)WpDevArt Organization chart
- CVE-2023-0815Plaintext Password Present in the Web logsThe OpenNMS Group Meridian · The OpenNMS Group Horizon +1
- CVE-2023-0867Multiple stored and reflected Cross-site Scripting in webappThe OpenNMS Group Meridian · The OpenNMS Group Horizon +1
- CVE-2023-23659WordPress MainWP Matomo Extension Plugin <= 4.0.4 is vulnerable to Cross Site Request Forgery (CSRF)MainWP Matomo Extension
- CVE-2023-0868Stealing Cookies using Reflected XSS via graph resultsThe OpenNMS Group Meridian · The OpenNMS Group Horizon +1
- CVE-2023-0869Cross-site scripting in outage/list.htmThe OpenNMS Group Meridian · The OpenNMS Group Horizon +1
- CVE-2023-0982SourceCodester Yoga Class Registration System Add Class Entry sql injectionSourceCodester Yoga Class Registration System
- CVE-2023-0981SourceCodester Yoga Class Registration System Delete User sql injectionSourceCodester Yoga Class Registration System
- CVE-2023-0980SourceCodester Yoga Class Registration System Status Update update_status.php sql injectionSourceCodester Yoga Class Registration System
- CVE-2023-25621Apache Sling does not allow to handle i18n content in a secure wayApache Software Foundation Apache Sling · org.apache.sling:…
- CVE-2022-3219GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressgnupg
- CVE-2022-4492The undertow client is not checking the server identity presented by the server certificate in https connections.undertow · io.undertow:undertow-core
- CVE-2022-46784SquaredUp Dashboard Server SCOM edition before 5.7.1 GA allows open redirection.
- CVE-2022-46785SquaredUp Dashboard Server SCOM edition before 5.7.1 GA allows XSS (issue 1 of 2).
- CVE-2022-46786SquaredUp Dashboard Server SCOM edition before 5.7.1 GA allows XSS (issue 2 of 2).
- CVE-2022-48341ThingsBoard 3.4.1 could allow a remote authenticated attacker to achieve Vertical Privilege Escalation.
- CVE-2023-0044If the Quarkus Form Authentication session cookie Path attribute is set to `/` then a cross-site attack may be initiated which might lead toquarkus-vertx-http · io.quarkus:quarkus-vertx-http
- CVE-2023-0597A flaw possibility of memory leak in the Linux kernel cpu_entry_area mapping of X86 CPU data to memory was found in the way user can guess lKernel
- CVE-2023-20012Cisco Nexus 9300-FX3 Series Fabric Extender for UCS Fabric Interconnects Authentication Bypass VulnerabilityCisco Unified Computing System
- CVE-2023-20015Cisco Firepower 4100 Series, Firepower 9300 Security Appliances, and UCS Fabric Interconnects Command Injection VulnerabilityCisco Unified Computing System
- CVE-2023-20016Cisco FXOS Software and UCS Manager Software Configuration Backup Static Key VulnerabilityCisco Unified Computing System
- CVE-2023-20050Cisco NX-OS Software CLI Command Injection VulnerabilityCisco NX-OS Software
- CVE-2023-23294Korenix JetWave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection.
- CVE-2023-23296Korenix JetWave 4200 Series 1.3.0 and JetWave 3200 Series 1.6.0 are vulnerable to Denial of Service via /goform/formDefault.
- CVE-2023-23915A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrhttps://github.com/curl/curl
- CVE-2023-23916An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorihttps://github.com/curl/curl
- CVE-2023-23920An untrusted search path vulnerability exists in Node.js.NodeJS Node
- CVE-2023-24212Tenda AX3 V16.03.12.11 was discovered to contain a stack overflow via the timeType function at /goform/SetSysTimeCfg.
- CVE-2023-24317Judging Management System 1.0 was discovered to contain an arbitrary file upload vulnerability via the component edit_organizer.php.
- CVE-2023-26325The 'rx_export_review' action in the ReviewX WordPress Plugin, is affected by an authenticated SQL injection vulnerability in the 'filterValReviewX WordPress Plugin
- CVE-2023-26326The BuddyForms WordPress plugin, in versions prior to 2.7.8, was affected by an unauthenticated insecure deserialization issue.BuddyForms WordPress Plugin
- CVE-2023-26462ThingsBoard 3.4.1 could allow a remote attacker to gain elevated privileges because hard-coded service credentials (usable for privilege esc
- CVE-2023-26468Cerebrate 1.12 does not properly consider organisation_id during creation of API keys.