Skip to content
OpenAdvisories

Archive

31 January 2023

Vulnerabilities first published on this day (UTC), newest first.

← December 2022 2023 / January /31 February 2023 →
  1. 123
  2. 276
  3. 394
  4. 480
  5. 584
  6. 678
  7. 748
  8. 818
  9. 965
  10. 10215
  11. 11149
  12. 12103
  13. 1380
  14. 1428
  15. 1531
  16. 1667
  17. 17164
  18. 1893
  19. 1956
  20. 20103
  21. 219
  22. 227
  23. 2394
  24. 24125
  25. 2560
  26. 26174
  27. 2786
  28. 287
  29. 2912
  30. 30102
  31. 3151
All Critical High Medium Low Exploited only Public exploit

17 results · Clear filters · Feed

  • Critical 10.0
    CVE-2023-23924 Public exploit

    URI validation failure on SVG parsing in Dompdf

    Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing `<image>` tags with uppercase letters. This may lead to arbitrary object unserialize on PHP < 8, through the `phar` URL wrapper. An attacker can e…

    dompdf dompdf dompdf/dompdf Packagist
  • Critical 9.8
    CVE-2022-28331

    Apache Portable Runtime (APR): Windows out-of-bounds write in apr_socket_sendv function

    On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in apr_socket_sendv(). This is a result of integer overflow.

    Apache Software Foundation Apache Portable Runtime (APR) apr Alpine
  • Critical 9.8
    CVE-2022-24963

    Apache Portable Runtime (APR): out-of-bound writes in the apr_encode family of functions

    Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0.

    Apache Software Foundation Apache Portable Runtime (APR) apr apr Debian Ubuntu Azure Linux Alpine
  • Critical 9.8
    CVE-2023-24163

    Dromara hutool vulnerable to SQL Injection

    SQL Inection vulnerability in Dromara hutool before 5.8.21 allows attacker to execute arbitrary code via the aviator template engine.

    cn.hutool:hutool-all Maven
  • Critical 9.8
    CVE-2023-24162

    Dromara Hutool Deserialization of Untrusted Data vulnerability

    Deserialization vulnerability in Dromara Hutool v5.8.11 allows attacker to execute arbitrary code via the XmlUtil.readObjectFromXml parameter.

    cn.hutool:hutool-all Maven
  • Critical 9.8
    CVE-2023-24241

    Forget Heart Message Box v1.1 was discovered to contain a SQL injection vulnerability via the name parameter at /admin/…

  • Critical 9.8
    CVE-2023-22900

    Thinking Software Technology Co., Ltd. Efence - SQL Injection

    Efence login function has insufficient validation for user input. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands to access, modify or delete database.

    Thinking Software Technology Efence
  • Critical 9.1
    CVE-2023-22610

    A CWE-863: Incorrect Authorization vulnerability exists that could cause Denial of Service against the Geo SCADA server…

    Schneider Electric EcoStruxure Geo SCADA Expert 2019 - 2021 (formerly known as ClearSCADA) ICS / OT
  • Critical 9.8
    CVE-2022-39060

    ChangingTec MegaServiSignAdapter - Improper Input Validation

    ChangingTech MegaServiSignAdapter component has a vulnerability of improper input validation. An unauthenticated remote attacker can exploit this vulnerability to access and modify HKEY_CURRENT_USER subkey (ex: AutoRUN) in Registry where malicious scripts can…

    ChangingTec MegaServiSignAdapter
  • Critical 9.8
    CVE-2022-45172

    An issue was discovered in LIVEBOX Collaboration vDesk before v018. Broken Access Control can occur under the /api/v1/r…

  • Critical 9.8
    CVE-2022-45297 Public exploit

    EQ v1.5.31 to v2.2.0 was discovered to contain a SQL injection vulnerability via the UserPwd parameter.

  • Critical 9.8
    CVE-2022-47873

    Netcad KEOS 1.0 is vulnerable to XML External Entity (XXE) resulting in SSRF with XXE (remote).

  • Critical 9.8
    CVE-2022-47854

    i-librarian 4.10 is vulnerable to Arbitrary file upload in ajaxsupplement.php.

  • Critical 9.8
    CVE-2022-47699

    COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 is vulnerable to Inco…

  • Critical 9.8
    CVE-2022-47780

    SQL Injection vulnerability in Bangresto 1.0 via the itemID parameter.

  • Critical 9.8
    CVE-2022-47697

    COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 and before is vulnera…

  • Critical 9.8
    CVE-2022-47035

    Buffer Overflow Vulnerability in D-Link DIR-825 v1.33.0.44ebdd4-embedded and below allows attacker to execute arbitrary…