Skip to content
OpenAdvisories

Archive

January 2023

Vulnerabilities first published in this month (UTC), newest first.

← December 2022 2023 / January February 2023 →
  1. 123
  2. 276
  3. 394
  4. 480
  5. 584
  6. 678
  7. 748
  8. 818
  9. 965
  10. 10215
  11. 11149
  12. 12103
  13. 1380
  14. 1428
  15. 1531
  16. 1667
  17. 17164
  18. 1893
  19. 1956
  20. 20103
  21. 219
  22. 227
  23. 2394
  24. 24125
  25. 2560
  26. 26174
  27. 2786
  28. 287
  29. 2912
  30. 30102
  31. 3151
All Critical High Medium Low Exploited only Public exploit

28 results · Clear filters · Feed

  • Medium 5.4
    CVE-2022-46087 Public exploit

    CloudSchool v3.0.1 is vulnerable to Cross Site Scripting (XSS). A normal user can steal session cookies of the admin us…

  • Medium 5.2
    CVE-2022-43980 Public exploit

    Cross-site scripting vulnerability in the network maps edit functionality

    There is a stored cross-site scripting vulnerability in Pandora FMS v765 in the network maps editing functionality. An attacker could modify a network map, including on purpose the name of an XSS payload. Once created, if a user with admin privileges clicks o…

    Artica PFMS Pandora FMS
  • Medium 5.3
    CVE-2023-0493 Public exploit

    Improper Neutralization of Equivalent Special Elements in btcpayserver/btcpayserver

    Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5.

    BTCPay Server btcpayserver/btcpayserver
  • Medium 5.3
    CVE-2022-25927 Public exploit

    ReDoS Vulnerability in ua-parser-js version

    Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function.

    ua-parser-js node-ua-parser-js node-ua-parser-js Debian Ubuntu npm
  • Medium 5.3
    CVE-2022-31711 Public exploit Scanner template EPSS 22%

    VMware vRealize Log Insight contains an Information Disclosure Vulnerability. A malicious actor can remotely collect se…

  • Medium 6.1
    CVE-2022-47052 Public exploit

    The web interface of the 'Nighthawk R6220 AC1200 Smart Wi-Fi Router' is vulnerable to a CRLF Injection attack that can …

  • Medium 5.5
    CVE-2022-20494 Public exploit

    In AutomaticZenRule of AutomaticZenRule.java, there is a possible persistent DoS due to resource exhaustion. This could…

    Android
  • Medium 6.1
    CVE-2023-24044 Public exploit

    A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to…

  • Medium 6.1
    CVE-2022-41441 Public exploit Scanner template

    Multiple cross-site scripting (XSS) vulnerabilities in ReQlogic v11.3 allow attackers to execute arbitrary web scripts …

  • Medium 5.9
    CVE-2022-43704 Public exploit

    The Sinilink XY-WFT1 WiFi Remote Thermostat, running firmware 1.3.6, allows an attacker to bypass the intended requirem…

  • Medium 4.9
    CVE-2022-43959 Public exploit

    Insufficiently Protected Credentials in the AD/LDAP server settings in 1C-Bitrix Bitrix24 through 22.200.200 allow remo…

  • Medium 6.5
    CVE-2022-31901 Public exploit

    Buffer overflow in function Notepad_plus::addHotSpot in Notepad++ v8.4.3 and earlier allows attackers to crash the appl…

  • Medium 6.1
    CVE-2023-0214 Public exploit

    XSS in Skyhigh Security SWG

    A cross-site scripting vulnerability in Skyhigh SWG in main releases 11.x prior to 11.2.6, 10.x prior to 10.2.17, and controlled release 12.x prior to 12.0.1 allows a remote attacker to craft SWG-specific internal requests with URL paths to any third-party we…

    Skyhigh Security Secure Web Gateway (SWG)
  • Medium 4.9
    CVE-2023-21887 Public exploit EPSS 43%

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: GIS). Supported versions that are affecte…

    Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  • Medium 6.1
    CVE-2022-39195 Public exploit Scanner template

    A cross-site scripting (XSS) vulnerability in the LISTSERV 17 web interface allows remote attackers to inject arbitrary…

  • Medium 6.1
    CVE-2022-3904 Public exploit

    MonsterInsights < 8.9.1 - Stored Cross-Site Scripting via Google Analytics

    The MonsterInsights WordPress plugin before 8.9.1 does not sanitize or escape page titles in the top posts/pages section, allowing an unauthenticated attacker to inject arbitrary web scripts into the titles by spoofing requests to google analytics.

    Web / CMS
  • Medium 4.6
    CVE-2018-25075 Public exploit

    karsany OBridge ProcedureDao.java getAllStandaloneProcedureAndFunction sql injection

    A vulnerability classified as critical has been found in karsany OBridge up to 1.3. Affected is the function getAllStandaloneProcedureAndFunction of the file obridge-main/src/main/java/org/obridge/dao/ProcedureDao.java. The manipulation leads to sql injection…

    karsany OBridge
  • Medium 6.1
    CVE-2022-46622 Public exploit

    A cross-site scripting (XSS) vulnerability in Judging Management System v1.0 allows attackers to execute arbitrary web …

  • Medium 6.1
    CVE-2022-45729 Public exploit

    A cross-site scripting (XSS) vulnerability in Doctor Appointment Management System v1.0.0 allows attackers to execute a…

  • Medium 6.1
    CVE-2022-45728 Public exploit

    Doctor Appointment Management System v1.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability.

  • Medium 5.4
    CVE-2022-47102 Public exploit

    A cross-site scripting (XSS) vulnerability in Student Study Center Management System V 1.0 allows attackers to execute …

  • Medium 5.5
    CVE-2022-4543 Public exploit

    A flaw named "EntryBleed" was found in the Linux Kernel Page Table Isolation (KPTI). This issue could allow a local att…

    linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu Azure Linux
  • Medium 4.7
    CVE-2023-21766 Public exploit

    Windows Overlay Filter Information Disclosure Vulnerability

    Windows Overlay Filter Information Disclosure Vulnerability

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  • Medium 6.8
    CVE-2023-21563 Public exploit

    BitLocker Security Feature Bypass Vulnerability

    BitLocker Security Feature Bypass Vulnerability

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  • Medium 6.6
    CVE-2023-21560 Public exploit

    Windows Boot Manager Security Feature Bypass Vulnerability

    Windows Boot Manager Security Feature Bypass Vulnerability

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  • Medium 5.5
    CVE-2015-10034 Public exploit

    j-nowak workout-organizer sql injection

    A vulnerability has been found in j-nowak workout-organizer and classified as critical. This vulnerability affects unknown code. The manipulation leads to sql injection. The patch is identified as 13cd6c3d1210640bfdb39872b2bb3597aa991279. It is recommended to…

    j-nowak workout-organizer
  • Medium 6.1
    CVE-2022-44870 Public exploit

    A reflected cross-site scripting (XSS) vulnerability in maccms10 v2022.1000.3032 allows attackers to execute arbitrary …

  • Medium 5.3
    CVE-2023-22622 Public exploit

    WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting securit…

    wordpress Ubuntu