Skip to content
OpenAdvisories

Archive

January 2023

Vulnerabilities first published in this month (UTC), newest first.

← December 2022 2023 / January February 2023 →
  1. 123
  2. 276
  3. 394
  4. 480
  5. 584
  6. 678
  7. 748
  8. 818
  9. 965
  10. 10215
  11. 11149
  12. 12103
  13. 1380
  14. 1428
  15. 1531
  16. 1667
  17. 17164
  18. 1893
  19. 1956
  20. 20103
  21. 219
  22. 227
  23. 2394
  24. 24125
  25. 2560
  26. 26174
  27. 2786
  28. 287
  29. 2912
  30. 30102
  31. 3151
All Critical High Medium Low Exploited only Public exploit

2,382 results · Feed

  • Medium 6.5
    CVE-2020-22661

    In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n…

  • Critical 9.8
    CVE-2020-22658

    In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n…

  • High 8.8
    CVE-2023-0101

    A privilege escalation vulnerability was identified in Nessus versions 8.10.1 through 8.15.8 and 10.0.0 through 10.4.1.…

  • Medium 6.1
    CVE-2023-0410

    Cross-site Scripting (XSS) - Generic in builderio/qwik

    Cross-site Scripting (XSS) - Generic in GitHub repository builderio/qwik prior to 0.1.0-beta5.

    BuilderIO builderio/qwik @builder.io/qwik npm
  • High 7.5
    CVE-2023-24025

    CRYSTALS-DILITHIUM (in Post-Quantum Cryptography Selected Algorithms 2022) in PQClean d03da30 may allow universal forge…

  • Critical 9.8
    CVE-2023-24028

    In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import functio…

  • Medium 6.1
    CVE-2023-24027

    In MISP 2.4.167, app/webroot/js/action_table.js allows XSS via a network history name.

  • Medium 6.1
    CVE-2023-24026

    In MISP 2.4.167, app/webroot/js/event-graph.js has an XSS vulnerability via an event-graph preview payload.

  • High 7.5
    CVE-2023-24021

    Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall byp…

    modsecurity-apache mod_security modsecurity-apache Debian Ubuntu Azure Linux
  • Medium 6.1
    CVE-2023-23491 Scanner template

    The Quick Event Manager WordPress Plugin, version < 9.7.5, is affected by a reflected cross-site scripting vulnerabilit…

    Web / CMS
  • Medium 6.1
    CVE-2023-23012

    Cross Site Scripting (XSS) vulnerability in craigrodway classroombookings 2.6.4 allows attackers to execute arbitrary c…

  • High 8.8
    CVE-2023-23490

    The Survey Maker WordPress Plugin, version < 3.1.2, is affected by an authenticated SQL injection vulnerability in the …

    Web / CMS
  • Medium 6.1
    CVE-2023-23024

    Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/inde…

  • Medium 6.1
    CVE-2023-23014

    Cross Site Scripting (XSS) vulnerability in InventorySystem thru commit e08fbbe17902146313501ed0b5feba81d58f455c (on Ap…

  • Critical 9.8
    CVE-2023-23489 Scanner template EPSS 11%

    The Easy Digital Downloads WordPress Plugin, versions 3.1.0.2 & 3.1.0.3, is affected by an unauthenticated SQL injectio…

    Web / CMS
  • High 7.8
    CVE-2023-23143

    Buffer overflow vulnerability in function avc_parse_slice in file media_tools/av_parsers.c. GPAC version 2.3-DEV-rev1-g…

    gpac gpac Debian Ubuntu
  • Medium 6.1
    CVE-2023-23010

    Cross Site Scripting (XSS) vulnerability in Ecommerce-CodeIgniter-Bootstrap thru commit d5904379ca55014c5df34c67deda982…

  • Critical 9.8
    CVE-2023-23488 Public exploit Scanner template EPSS 92%

    The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerabili…

    Web / CMS
  • High 8.8
    CVE-2023-23492 Scanner template EPSS 57%

    The Login with Phone Number WordPress Plugin, version < 1.4.2, is affected by an authenticated SQL injection vulnerabil…

    Web / CMS
  • High 8.8
    CVE-2023-23596 EPSS 16%

    jc21 NGINX Proxy Manager through 2.9.19 allows OS command injection. When creating an access list, the backend builds a…

  • Medium 6.1
    CVE-2023-23015

    Cross Site Scripting (XSS) vulnerability in Kalkun 0.8.0 via username input in file User_model.php.

  • High 7.8
    CVE-2023-23145

    GPAC version 2.2-rev0-gab012bbfb-master was discovered to contain a memory leak in lsr_read_rare_full function.

    gpac gpac Debian Ubuntu
  • Medium 5.5
    CVE-2023-23144

    Integer overflow vulnerability in function Q_DecCoordOnUnitSphere file bifs/unquantize.c in GPAC version 2.2-rev0-gab01…

    gpac gpac Debian Ubuntu
  • Medium 5.4
    CVE-2023-22373

    Cross-site scripting vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remote authenticated at…

    Contec CONPROSYS HMI System(CHS)
  • Medium 5.4
    CVE-2023-22910

    An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. Ther…

  • High 7.5
    CVE-2023-22339

    Improper access control vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remote unauthenticat…

    Contec CONPROSYS HMI System(CHS)
  • Critical 9.1
    CVE-2023-22964

    Zoho ManageEngine ServiceDesk Plus MSP before 10611, and 13x before 13004, is vulnerable to authentication bypass when …

  • Medium 5.3
    CVE-2023-22912

    An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. Chec…

  • Medium 5.3
    CVE-2023-22334

    Use of password hash instead of password for authentication vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and e…

    Contec CONPROSYS HMI System(CHS)
  • High 7.5
    CVE-2023-22331

    Use of default credentials vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remote unauthenti…

    Contec CONPROSYS HMI System(CHS)
  • Medium 5.3
    CVE-2022-39193

    An issue was discovered in the CheckUser extension for MediaWiki through 1.39.x. Various components of this extension c…

  • Medium 5.4
    CVE-2022-38110

    Reflected Cross-Site Scripting Vulnerability

    In Database Performance Analyzer (DPA) 2022.4 and older releases, certain URL vectors are susceptible to authenticated reflected cross-site scripting.

    SolarWinds Database Performance Analyzer (DPA)
  • High 7.5
    CVE-2022-38112

    Sensitive Information Disclosure Vulnerability

    In DPA 2022.4 and older releases, generated heap memory dumps contain sensitive information in cleartext.

    SolarWinds Database Performance Analyzer (DPA)
  • High 7.5
    CVE-2022-48279

    In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the …

    modsecurity modsecurity modsecurity-apache mod_security Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2022-48123

    TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the servername p…

  • Critical 9.8
    CVE-2022-48152

    SQL Injection vulnerability in RemoteClinic 2.0 allows attackers to execute arbitrary commands and gain sensitive infor…

  • Critical 9.8
    CVE-2022-48126

    TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the username par…

  • Critical 9.8
    CVE-2022-48122

    TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the dayvalid par…

  • Critical 9.8
    CVE-2022-48125

    TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the password par…

  • Critical 9.8
    CVE-2022-48124

    TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the FileName par…