CVEs published in January 2023
4,262 vulnerabilities, 224 critical, 8 exploited.
- twinkletoessoftware bookedBooked Scheduler 2.5.5 allows authenticated users to create and schedule events for any other...4.3 Medium
- pkgconfIn pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to...5.5 Medium
- keepass** DISPUTED ** KeePass through 2.53 (in a default installation) allows an attacker, who has write...5.5 Medium
- plesk obsidianA Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows...6.1 Medium
- pyload, pyload pyload/pyload +1 moreExcessive Attack Surface in pyload/pyload4.0 Medium
- pyload, pyload pyload/pyload +1 moreImproper Input Validation in pyload/pyload5.4 Medium
- apache airflow, apache software foundation airflow mysql provider, apache apache-airflow-providers-mysql +2 moreApache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache Airflow9.8 Critical
kuchikicrates.io`kuchiki` is unmaintainedNo scoretoropenSUSESecurity update for torNo score- hfiref0x lightftpA race condition in LightFTP through 2.2 allows an attacker to achieve path traversal via a...7.5 High
- opengroup common desktop environment** UNSUPPORTED WHEN ASSIGNED ** dtprintinfo in Common Desktop Environment 1.6 has a bug in the...7.1 High
- opengroup common desktop environment** UNSUPPORTED WHEN ASSIGNED ** A stack-based buffer overflow in ParseColors in libXm in Common...7.8 High
- html-stripscripts project html-stripscripts, debian linux +1 moreThe HTML-StripScripts module through 1.06 for Perl allows _hss_attval_style ReDoS because of...7.5 High
- powerdns recursorA remote attacker might be able to cause infinite recursion in PowerDNS Recursor 4.8.0 via a DNS...7.5 High
- vim, vim vim/vim, apple macos +2 more +4 moreHeap-based Buffer Overflow in vim/vim7.8 High
- yiiframework giiCommand injection in yiisoft/yii2-gii8.8 High
cakephp/cakephpPackagistCakePHP vulnerable to Cross-site Scripting in some development error pagesNo scorecakephp/cakephpPackagistCakePHP vulnerable to Remote File Inclusion through View template name manipulationNo scorecakephp/cakephpPackagistCakePHP allows direct access of prefixed controller actionsNo scorecakephp/cakephpPackagistCakePHP vulnerable to Denial of Service attack through XML payloadsNo scorecakephp/cakephpPackagistCakePHP SecurityComponent cross form submission issueNo scorecakephp/cakephpPackagistCakePHP has incorrect Cross-Site Request Forgery validationNo score- sauter controls modunet300 (ey-am300f001, ey-am300f002), nova 106 (eyk300f001) bacnet communication card, nova 220 (eyk220f001) ddc with bacnet connection +6 more +8 moreSAUTER Controls Nova 200–220 Series Missing Authentication for Critical Function9.8 Critical
- dasherr project dasherrUnrestricted file upload leads to Remote Code Execution in erohtar/Dasherr9.8 Critical
exiftool_vendoredRubyGemsExifTool vulnerable to arbitrary code execution7.8 High- lenovo leyunAn incorrect default permissions vulnerability in Lenovo Leyun cloud music application could...5.5 Medium
- ibm infosphere information serverIBM InfoSphere Information Server denial of service5.3 Medium
- redisInteger overflow in certain command arguments can drive Redis to OOM panic5.5 Medium
- redisInteger overflow in multiple Redis commands can lead to denial-of-service5.5 Medium
- ibm cloud pak for securityIBM Cloud Pak for Security information disclosure4.3 Medium
- ibm cloud pak for securityIBM Cloud Pak for Security information disclosure4.2 Medium
- act project actUnrestricted file upload leading to privilege escalation in act8.0 High
ndpiOSS-FuzzHeap-buffer-overflow in ndpi_search_bittorrentNo score- libgit2libgit2 fails to verify SSH keys by default5.3 Medium
- mitsubishi electric corporation melsec iq-f series fx5uc-32mr/ds-ts, melsec iq-f series fx5uc-32mt/d, melsec iq-f series fx5uc-32mt/ds-ts +117 more +119 moreAuthentication Bypass Vulnerability in Web Server Function on MELSEC Series5.9 Medium
- dell powervault me5, powervault me5012 firmware, powervault me5024 firmware +1 more +3 moreDell EMC PV ME5, versions ME5.1.0.0.0 and ME5.1.0.1.0, contains a Client-side desync...8.1 High
- misp-project mispIn MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the...9.8 Critical
- misp-project mispIn MISP 2.4.167, app/webroot/js/action_table.js allows XSS via a network history name.6.1 Medium
- misp-project mispIn MISP 2.4.167, app/webroot/js/event-graph.js has an XSS vulnerability via an event-graph...6.1 Medium
- pqclean project pqcleanCRYSTALS-DILITHIUM (in Post-Quantum Cryptography Selected Algorithms 2022) in PQClean d03da30 may...7.5 High
- trustwave modsecurity, debian linux +1 moreIn ModSecurity before 2.9.7, FILES_TMP_CONTENT sometimes lacked the complete content. This can...7.5 High
- jc21 nginx proxy managerjc21 NGINX Proxy Manager through 2.9.19 allows OS command injection. When creating an access list...8.8 High
- idehweb login with phone numberThe Login with Phone Number WordPress Plugin, version < 1.4.2, is affected by an authenticated...8.8 High
- fullworksplugins quick event managerThe Quick Event Manager WordPress Plugin, version < 9.7.5, is affected by a reflected cross-site...6.1 Medium
- ays-pro survey makerThe Survey Maker WordPress Plugin, version < 3.1.2, is affected by an authenticated SQL injection...8.8 High
- sandhillsdev easy digital downloadsThe Easy Digital Downloads WordPress Plugin, version < 3.1.0.4, is affected by an unauthenticated...9.8 Critical
- strangerstudios paid memberships proThe Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL...9.8 Critical
- gpacGPAC version 2.2-rev0-gab012bbfb-master was discovered to contain a memory leak in...7.8 High
- gpacInteger overflow vulnerability in function Q_DecCoordOnUnitSphere file bifs/unquantize.c in GPAC...5.5 Medium
- gpacBuffer overflow vulnerability in function avc_parse_slice in file media_tools/av_parsers.c. GPAC...7.8 High
- Show moreLoading…