Skip to content
OpenAdvisories

Archive

February 2023

Vulnerabilities first published in this month (UTC), newest first.

← January 2023 2023 / February March 2023 →
  1. 1120
  2. 250
  3. 3117
  4. 416
  5. 53
  6. 6187
  7. 784
  8. 875
  9. 9125
  10. 1074
  11. 115
  12. 1216
  13. 13119
  14. 14203
  15. 1594
  16. 16172
  17. 17101
  18. 1814
  19. 199
  20. 2051
  21. 2185
  22. 2261
  23. 2357
  24. 2452
  25. 2518
  26. 2621
  27. 27145
  28. 28115
All Critical High Medium Low Exploited only Public exploit

22 results · Clear filters · Feed

  • Critical 9.8
    CVE-2023-27372 Public exploit Scanner template EPSS 100%

    SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. …

    spip spip Debian Ubuntu
  • Critical 9.8
    CVE-2023-25234 Public exploit EPSS 17%

    Tenda AC500 V2.0.1.9(1307) is vulnerable to Buffer Overflow in function fromAddressNat via parameters entrys and mitInt…

  • Critical 9.8
    CVE-2022-36231 Public exploit

    Code injection in pdf_info

    pdf_info 0.5.3 is vulnerable to Command Execution because the Ruby code uses backticks instead of Open3.

    pdf_info RubyGems
  • Critical 10.0
    CVE-2023-25813 Public exploit

    SQL Injection via replacements in sequelize

    Sequelize is a Node.js ORM tool. In versions prior to 6.19.1 a SQL injection exploit exists related to replacements. Parameters which are passed through replacements are not properly escaped which can lead to arbitrary SQL injection depending on the specific …

    sequelize sequelize sequelize npm
  • Critical 9.8
    CVE-2022-45599 Public exploit

    Aztech WMB250AC Mesh Routers Firmware Version 016 2020 is vulnerable to PHP Type Juggling in file /var/www/login.php, a…

  • Critical 9.8
    CVE-2023-25157 Public exploit Scanner template EPSS 86%

    Unfiltered SQL Injection Vulnerabilities in Geoserver

    GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language (CQL) as part of the Web Feature Service (WFS)…

    geoserver geoserver org.geoserver.community:gs-jdbcconfig Maven
  • Critical 9.8
    CVE-2022-47986 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    IBM Aspera Faspex code execution

    IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to e…

    IBM Aspera Faspex
    KEV Feb 21, 2023
  • Critical 9.8
    CVE-2023-23279 Public exploit

    Canteen Management System 1.0 is vulnerable to SQL Injection via /php_action/getOrderReport.php.

  • Critical 9.8
    CVE-2022-40032 Public exploit Scanner template EPSS 21%

    SQL Injection vulnerability in Simple Task Managing System version 1.0 in login.php in 'username' and 'password' parame…

  • Critical 9.8
    CVE-2022-40347 Public exploit

    SQL Injection vulnerability in Intern Record System version 1.0 in /intern/controller.php in 'phone', 'email', 'deptTyp…

  • Critical 9.8
    CVE-2022-39952 Public exploit Scanner template EPSS 100%

    A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, …

    Fortinet FortiNAC Network devices
  • Critical 9.3
    CVE-2021-42756 Public exploit EPSS 35%

    Multiple stack-based buffer overflow vulnerabilities [CWE-121] in the proxy daemon of FortiWeb 5.x all versions, 6.0.7 …

    Fortinet FortiWeb Network devices
  • Critical 9.8
    CVE-2023-22855 Public exploit EPSS 15%

    Kardex Mlog MCC 5.7.12+0-a203c2a213-master allows remote code execution. It spawns a web interface listening on port 80…

  • Critical 9.8
    CVE-2023-21716 Public exploit EPSS 85%

    Microsoft Word Remote Code Execution Vulnerability

    Microsoft Word Remote Code Execution Vulnerability

    Microsoft Microsoft 365 Apps for Enterprise Microsoft Office LTSC 2021 Microsoft Office LTSC for Mac 2021
  • Critical 9.1
    CVE-2023-25725 Public exploit

    HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situati…

    haproxy haproxy haproxy Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2022-40022 Public exploit Scanner template EPSS 92%

    Microchip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability.

  • Critical 9.8
    CVE-2023-0744 Public exploit

    Improper Access Control in answerdev/answer

    Improper Access Control in GitHub repository answerdev/answer prior to 1.0.4.

    answerdev answerdev/answer github.com/answerdev/answer Go
  • Critical 9.8
    CVE-2022-24990 Exploited · Ransomware Public exploit Scanner template EPSS 83%

    TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Age…

    KEV Feb 10, 2023
  • Critical 9.8
    CVE-2022-3229 Public exploit EPSS 66%

    Because the web management interface for Unified Intents' Unified Remote solution does not itself require authenticatio…

    Unified Intents AB Unified Remote
  • Critical 9.8
    CVE-2022-4681 Public exploit

    Hide My WP < 6.2.9 - Unauthenticated SQLi

    The Hide My WP WordPress plugin before 6.2.9 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.

    Web / CMS
  • Critical 9.8
    CVE-2023-23333 Public exploit Scanner template EPSS 99%

    There is a command injection vulnerability in SolarView Compact through 6.00, attackers can execute commands by bypassi…

  • Critical 9.0
    CVE-2022-48311 Public exploit

    **UNSUPPORTED WHEN ASSIGNED** Cross Site Scripting (XSS) in HP Deskjet 2540 series printer Firmware Version CEP1FN1418B…