CVEs published in January 2023
4,262 vulnerabilities, 224 critical, 8 exploited.
- github enterprise serverIncorrect authorization check in GitHub Enterprise Server leading to escalation of privileges in GraphQL API requests from GitHub Apps using scoped user-to-server tokens9.8 Critical
- gitlab runnerImproper sanitization of branch names in GitLab Runner affecting all versions prior to 15.3.5, 15...4.8 Medium
- arm mbed tlsUse of a Broken or Risky Cryptographic Algorithm in the function mbedtls_mpi_exp_mod() in lignum...4.7 Medium
- mechanize project mechanizemechanize vulnerable to ReDoS7.5 High
- samba, fedoraproject fedora +1 moreAn information leak vulnerability was discovered in Samba's LDAP server. Due to missing access...4.3 Medium
- fuji electric tellus lite v-simulatorFuji Electric Tellus Lite V-Simulator versions 4.0.12.0 and prior are vulnerable to an out-of...7.8 High
- little apps software stats, little-apps little software stats +1 moreLittle Apps Little Software Stats Password Reset class.securelogin.php access control4.6 Medium
- 2071174a vinylmap, vinylmaps project vinylmaps +1 more2071174A vinylmap views.py contact sql injection5.5 Medium
- saemorris theradsystemsaemorris TheRadSystem users.php cross site scripting3.5 Low
- picturethiswebserver project picturethiswebserverPictureThisWebServer user.js router.post sql injection5.5 Medium
- githuis p2managegithuis P2Manage Database.cs Execute sql injection5.5 Medium
- faplanet project faplanetfrontaccounting faplanet path traversal5.5 Medium
- unknown wp spell check, wp spell check spell check, wpspellcheck +2 moreWP Spell Check < 9.13 - Admin+ Stored Cross-Site Scripting4.8 Medium
- metricoolMetricool < 1.18 - Admin+ Stored XSS4.8 Medium
- unknown woocs, pluginus fox - currency switcher professional for woocommerce +1 moreWOOCS < 1.3.9.4 - Contributor+ Stored XSS5.4 Medium
- subscribe2 project subscribe2Subscribe2 < 10.38 - User Deletion via CSRF3.1 Low
- appjetty show all commentsShow All Comments < 7.0.1 - Reflected XSS6.1 Medium
- deepen bajracharya video conferencing with zoom, video conferencing with zoom project conferencing with zoom +1 moreVideo Conferencing with Zoom < 4.0.10 - Contributor+ Stored XSS5.4 Medium
- heateor super socializer, unknown social share, social login and social comments plugin +1 moreSuper Socializer < 7.13.44 - Contributor+ Stored XSS5.4 Medium
- heateor sassy social share, social rocket sharing plugin, unknown social sharing plugin +2 moreSassy Social Share < 3.3.45 - Contributor+ Stored XSS5.4 Medium
- fontsy project fontsyFontsy <= 1.8.6 - Multiple Unauthenticated SQLi9.8 Critical
- odude user post galleryUser Post Gallery <= 2.19 - Unauthenticated RCE9.8 Critical
- wpchill mashshare, dearhive social media share buttons | mashshare +1 moreMashShare < 3.8.7 - Contributor+ Stored XSS5.4 Medium
- insert pages project pages, unknown insert pages +1 moreInsert Pages < 3.7.5 - Contributor+ Stored XSS5.4 Medium
- codename065 download managerDownload Manager < 3.2.62 - Contributor+ Stored XSS5.4 Medium
- rsukhar sidebar widgets by codelights, codelights-shortcodes-and-widgets project codelights-shortcodes-and-widgets +1 moreSidebar Widgets by CodeLights <= 1.4 - Contributor+ Stored XSS5.4 Medium
- smashballoon smash balloon social post feedSmash Balloon Social Post Feed < 4.1.6 - Contributor+ Stored XSS5.4 Medium
- convertkit, convertkit - email marketing\, email newsletter and landing pages +1 moreConvertKit < 2.0.5 - Contributor+ Stored XSS5.4 Medium
- tickeraTickera < 3.5.1.0 - Plugin Data Deletion via CSRF4.3 Medium
- unknown carousel, slider, gallery by wp carousel, techearty carousel\, slider\, gallery by wp carousel +1 moreCarousel, Slider, Gallery by WP Carousel < 2.5.3 - Contributor+ Stored XSS5.4 Medium
- fontawesome font awesomeFont Awesome < 4.3.2 - Contributor+ Stored XSS5.4 Medium
- extendthemes mesmerize companionMesmerize Companion < 1.6.135 - Contributor+ Stored XSS5.4 Medium
- nanbu welcart e-commerce, welcart e-commerce +1 moreWelcart e-Commerce < 2.8.9 - Contributor+ Stored XSS via Shortcode5.4 Medium
- devowl wordpress real cookie banner, unknown real cookie banner: gdpr (dsgvo) & eprivacy cookie consent +1 moreReal Cookie Banner < 3.4.10 - Contributor+ Stored XSS5.4 Medium
- cozmoslabs custom post types and custom fields creatorWCK < 2.3.3 - Admin+ Stored XSS4.8 Medium
- mhsoftware wordpress events calendar pluginWordPress Events Calendar Plugin < 1.4.5 - Multiple Reflected XSS6.1 Medium
- rssimport project rssimportRSSImport <= 4.6.1 - Contributor+ Stored XSS via Shortcode5.4 Medium
- castos seriously simple podcastingSeriously Simple Podcasting < 2.19.1 - Contributor+ Stored XSS5.4 Medium
- unknown link libraryLink Library < 7.4.1 - Admin+ Stored XSS4.8 Medium
- thedotstore conditional payment methods for woocommerceConditional Payment Methods for WooCommerce <= 1.0 - Admin+ SQLi7.2 High
- images optimize and upload cf7 project optimize and upload cf7, unknown images optimize and upload cf7 +1 moreImages Optimize and Upload CF7 <= 2.1.4 - Unauthenticated Arbitrary File Deletion9.1 Critical
- holithemes click to chatClick to Chat < 3.18.1 - Contributor+ Stored XSS5.4 Medium
- themify portfolio post, themifyme themify portfolio post +1 moreThemify Portfolio Post < 1.2.1 - Contributor+ Stored XSS5.4 Medium
- techearty easy accordionEasy Accordion < 2.2.0 - Contributor+ Stored XSS5.4 Medium
- unknown greenshiftGreenshift – animation and page builder blocks < 4.8.9 - Contributor+ Stored XSS via Shortcode5.4 Medium
- 3dflipbook 3d flipbook3D FlipBook <= 1.13.2 - Contributor+ Stored XSS5.4 Medium
- monsterinsightsMonsterInsights < 8.9.1 - Stored Cross-Site Scripting via Google Analytics6.1 Medium
- simple-membership-plugin simple membershipSimple Membership < 4.2.2 - Contributor+ Stored XSS5.4 Medium
- meteor slides project slides, unknown meteor slides +1 moreMeteor Slides < 1.5.7 - Contributor+ Stored XSS5.4 Medium
- malihu page scroll to id, page scroll to id project scroll to id +1 morePage Scroll To ID < 1.7.6 - Contributor+ Stored XSS5.4 Medium
- Show moreLoading…