Skip to content
OpenAdvisories

Archive

9 January 2023

Vulnerabilities first published on this day (UTC), newest first.

← December 2022 2023 / January /9 February 2023 →
  1. 123
  2. 276
  3. 394
  4. 480
  5. 584
  6. 678
  7. 748
  8. 818
  9. 965
  10. 10215
  11. 11149
  12. 12103
  13. 1380
  14. 1428
  15. 1531
  16. 1667
  17. 17164
  18. 1893
  19. 1956
  20. 20103
  21. 219
  22. 227
  23. 2394
  24. 24125
  25. 2560
  26. 26174
  27. 2786
  28. 287
  29. 2912
  30. 30102
  31. 3151
All Critical High Medium Low Exploited only Public exploit

15 results · Clear filters · Feed

  • High 8.8
    CVE-2022-3679

    Starter Templates by Kadence WP < 1.2.17 - Admin+ PHP Object Injection

    The Starter Templates by Kadence WP WordPress plugin before 1.2.17 unserialises the content of an imported file, which could lead to PHP object injection issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is presen…

    Web / CMS
  • High 8.8
    CVE-2022-3417

    WPtouch < 4.3.45 - Admin+ PHP Object Injection

    The WPtouch WordPress plugin before 4.3.45 unserialises the content of an imported settings file, which could lead to PHP object injections issues when an user import (intentionally or not) a malicious settings file and a suitable gadget chain is present on t…

    Web / CMS
  • High 7.2
    CVE-2022-4043 EPSS 18%

    WP Custom Admin Interface < 7.29 - Admin+ PHP Object Injection

    The WP Custom Admin Interface WordPress plugin before 7.29 unserialize user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.

    Web / CMS
  • High 7.2
    CVE-2022-3416 EPSS 17%

    WPtouch < 4.3.45 - Admin+ Arbitrary File Upload

    The WPtouch WordPress plugin before 4.3.45 does not properly validate images to be uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)

    Web / CMS
  • High 7.4
    CVE-2022-23509

    Weave Gitops Run vulnerable to insecure communication

    Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. GitOps run has a local S3 bucket which it uses for synchronizing files that are later applied against a Kubernetes clu…

    weaveworks weave-gitops github.com/weaveworks/weave-gitops Go
  • High 8.9
    CVE-2022-23508

    GitOps Run allows for Kubernetes workload injection

    Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. A vulnerability in GitOps run could allow a local user or process to alter a Kubernetes cluster's resources. GitOps ru…

    weaveworks weave-gitops github.com/weaveworks/weave-gitops Go
  • High 7.4
    CVE-2022-25890

    wifey vulnerable to Command Injection due to improper input sanitization

    All versions of the package wifey are vulnerable to Command Injection via the connect() function due to improper input sanitization.

    wifey npm
  • High 8.8
    CVE-2022-36927

    Local Privilege Escalation in Zoom Rooms for macOS Clients

    Zoom Rooms for macOS clients before version 5.11.3 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability to escalate their privileges to root.

    Zoom Video Communications Zoom Rooms for macOS macOS
  • High 8.8
    CVE-2022-36930

    Local Privilege Escalation in Zoom Rooms for Windows Installers

    Zoom Rooms for Windows installers before version 5.13.0 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability in an attack chain to escalate their privileges to the SYSTEM user.

    Zoom Video Communications Zoom Rooms for Windows Windows
  • High 8.8
    CVE-2022-36926

    Local Privilege Escalation in Zoom Rooms for macOS Clients

    Zoom Rooms for macOS clients before version 5.11.3 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability to escalate their privileges to root.

    Zoom Video Communications Zoom Rooms for macOS macOS
  • High 7.8
    CVE-2022-36929

    Local Privilege Escalation in Zoom Rooms for Windows Clients

    The Zoom Rooms Installer for Windows prior to 5.12.6 contains a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability during the install process to escalate their privileges to the SYSTEM user.

    Zoom Video Communications Zoom Rooms for Windows Windows
  • High 8.1
    CVE-2022-43974

    MatrixSSL 4.0.4 through 4.5.1 has an integer overflow in matrixSslDecodeTls13. A remote attacker might be able to send …

  • High 7.2
    CVE-2022-43973 Public exploit

    Arbitrary code execution in Linksys WRT54GL

    An arbitrary code execution vulnerability exisits in Linksys WRT54GL Wireless-G Broadband Router with firmware <= 4.30.18.006. The Check_TSSI function within the httpd binary uses unvalidated user input in the construction of a system command. An authenticate…

    Linksys WRT54GL Wireless-G Broadband Router
  • High 7.2
    CVE-2022-43971

    Arbitrary code execution in Linksys WUMC710

    An arbitrary code exection vulnerability exists in Linksys WUMC710 Wireless-AC Universal Media Connector with firmware <= 1.0.02 (build3). The do_setNTP function within the httpd binary uses unvalidated user input in the construction of a system command. An a…

    Linksys Linksys WUMC710 Wireless-AC Universal Media Connector
  • High 7.2
    CVE-2022-43970 EPSS 19%

    Buffer overflow in Linksys WRT54GL

    A buffer overflow vulnerability exists in Linksys WRT54GL Wireless-G Broadband Router with firmware <= 4.30.18.006. A stack-based buffer overflow in the Start_EPI function within the httpd binary allows an authenticated attacker with administrator privileges …

    Linksys WRT54GL Wireless-G Broadband Router