Skip to content
OpenAdvisories

Archive

23 February 2023

Vulnerabilities first published on this day (UTC), newest first.

← January 2023 2023 / February /23 March 2023 →
  1. 1120
  2. 250
  3. 3117
  4. 416
  5. 53
  6. 6187
  7. 784
  8. 875
  9. 9125
  10. 1074
  11. 115
  12. 1216
  13. 13119
  14. 14203
  15. 1594
  16. 16172
  17. 17101
  18. 1814
  19. 199
  20. 2051
  21. 2185
  22. 2261
  23. 2357
  24. 2452
  25. 2518
  26. 2621
  27. 27145
  28. 28115
All Critical High Medium Low Exploited only Public exploit

57 results · Feed

  • Unscored —
    CVE-2023-26462

    ThingsBoard 3.4.1 could allow a remote attacker to gain elevated privileges because hard-coded service credentials (usa…

  • Unscored —
    CVE-2023-26468

    Cerebrate 1.12 does not properly consider organisation_id during creation of API keys.

  • Unscored —
    CVE-2023-26326 Public exploit

    The BuddyForms WordPress plugin, in versions prior to 2.7.8, was affected by an unauthenticated insecure deserializatio…

    Web / CMS
  • Unscored —
    CVE-2023-26325

    The 'rx_export_review' action in the ReviewX WordPress Plugin, is affected by an authenticated SQL injection vulnerabil…

    Web / CMS
  • Medium 6.0
    CVE-2023-20015

    Cisco Firepower 4100 Series, Firepower 9300 Security Appliances, and UCS Fabric Interconnects Command Injection Vulnerability

    A vulnerability in the CLI of Cisco Firepower 4100 Series, Cisco Firepower 9300 Security Appliances, and Cisco UCS 6200, 6300, 6400, and 6500 Series Fabric Interconnects could allow an authenticated, local attacker to inject unauthorized commands. This vulner…

    Cisco Cisco Unified Computing System (Managed) Network devices
  • Medium 4.4
    CVE-2023-20050

    Cisco NX-OS Software CLI Command Injection Vulnerability

    A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of arguments that are …

    Cisco Cisco NX-OS Software Network devices
  • High 8.8
    CVE-2023-20011

    Cisco Application Policy Infrastructure Controller and Cisco Cloud Network Controller Cross-Site Request Forgery Vulnerability

    A vulnerability in the web-based management interface of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Network Controller, formerly Cisco Cloud APIC, could allow an unauthenticated, remote attacker to conduct a cross-site request f…

    Cisco Cisco Application Policy Infrastructure Controller (APIC) Network devices
  • High 7.4
    CVE-2023-20089

    Cisco Nexus 9000 Series Fabric Switches in ACI Mode Link Layer Discovery Protocol Memory Leak Denial of Service Vulnerability

    A vulnerability in the Link Layer Discovery Protocol (LLDP) feature for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) Mode could allow an unauthenticated, adjacent attacker to cause a memory leak, which could result in an…

    Cisco Cisco NX-OS System Software in ACI Mode Network devices
  • Medium 6.3
    CVE-2023-20016

    Cisco FXOS Software and UCS Manager Software Configuration Backup Static Key Vulnerability

    A vulnerability in the backup configuration feature of Cisco UCS Manager Software and in the configuration export feature of Cisco FXOS Software could allow an unauthenticated attacker with access to a backup file to decrypt sensitive information stored in th…

    Cisco Cisco Unified Computing System (Managed) Network devices
  • Medium 5.3
    CVE-2023-20012

    Cisco Nexus 9300-FX3 Series Fabric Extender for UCS Fabric Interconnects Authentication Bypass Vulnerability

    A vulnerability in the CLI console login authentication of Cisco Nexus 9300-FX3 Series Fabric Extender (FEX) when used in UCS Fabric Interconnect deployments could allow an unauthenticated attacker with physical access to bypass authentication. This vulnerabi…

    Cisco Cisco Unified Computing System (Managed) Network devices
  • Critical 9.8
    CVE-2022-4492

    Undertow client not checking server identity presented by server certificate in https connections

    The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS client protocol.

    undertow undertow io.undertow:undertow-core Debian Ubuntu Maven
  • Critical 9.8
    CVE-2022-36231 Public exploit

    Code injection in pdf_info

    pdf_info 0.5.3 is vulnerable to Command Execution because the Ruby code uses backticks instead of Open3.

    pdf_info RubyGems
  • Unscored —
    CVE-2022-48341

    ThingsBoard 3.4.1 could allow a remote authenticated attacker to achieve Vertical Privilege Escalation. A Tenant Admini…

  • Low 3.3
    CVE-2022-3219

    GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatur…

    gnupg2 gnupg2 gnupg Debian Ubuntu
  • Unscored —
    CVE-2022-46785

    SquaredUp Dashboard Server SCOM edition before 5.7.1 GA allows XSS (issue 1 of 2).

  • Unscored —
    CVE-2022-46786

    SquaredUp Dashboard Server SCOM edition before 5.7.1 GA allows XSS (issue 2 of 2).

  • Unscored —
    CVE-2022-46784

    SquaredUp Dashboard Server SCOM edition before 5.7.1 GA allows open redirection. (The issue was originally found in 5.5…