CVEs published in February 2023
2,729 vulnerabilities, 255 critical, 10 exploited.
- apache software foundation sling app cms, apache sling cms +1 moreApache Sling App CMS: XSS in CMS Reference / UI Components6.1 Medium
libavcOSS-FuzzGlobal-buffer-overflow in isvce_write_coeff4x4_cavlcNo scoreimcrates.ioAliasing violation in `OrdSet` insertionNo score- onshift turbogearsOnShift TurboGears HTTP Header controllers.py response splitting6.3 Medium
- mobiledetectMobileDetect Example session_example.php initLayoutType cross site scripting3.5 Low
- calendar event management system project event management systemCalendar Event Management System sql injection6.3 Medium
- xuxueli xxl-jobXXL-JOB New Password updatePwd cross-site request forgery4.3 Medium
- oretnom23 online eyewear shopSourceCodester Online Eyewear Shop sql injection5.0 Medium
- segment is-urlSegmentio is-url index.js redos4.3 Medium
- nrel api-umbrella-web, api umbrella web +1 moreNREL api-umbrella-web Flash Message cross site scripting3.5 Low
- harfbuzz project harfbuzz, fedoraproject fedora +1 morehb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via...7.5 High
- phpipam, phpipam phpipam/phpipam +1 moreMissing Authorization in phpipam/phpipam7.5 High
- phpipam, phpipam phpipam/phpipam +1 moreCross-site Scripting (XSS) - Reflected in phpipam/phpipam4.4 Medium
- phpipam, phpipam phpipam/phpipam +1 moreCross-site Scripting (XSS) - Reflected in phpipam/phpipam2.4 Low
- froxlor, froxlor froxlor/froxlor +1 moreCode Injection in froxlor/froxlor9.9 Critical
- fanzila webfinancefanzila WebFinance save_contact.php sql injection5.5 Medium
- fanzila webfinancefanzila WebFinance save_roles.php sql injection5.5 Medium
- discourseMalicious users in Discourse can create spam topics as any user due to improper access control5.3 Medium
- grafanaWhen query caching is enabled in Grafana users can query another users session7.1 High
- ckanCKAN is vulnerable to session secret shared across instances using Docker images8.6 High
- calendar event management system project event management systemCalendar Event Management System Login Page sql injection7.3 High
- shopware swagpaypalSwagPayPal payment not sent to PayPal correctly7.5 High
- objectcomputing openddsSpecially crafted RTPS message may cause an OpenDDS application to crash5.3 Medium
- fanzila webfinancefanzila WebFinance save_taxes.php sql injection5.5 Medium
- fanzila webfinancefanzila WebFinance save_Contract_Signer_Role.php sql injection5.5 Medium
- amazon opensearch, opensearch-project anomaly-detection +1 moreIssue in Anomaly Detection with document and field level rules in numerical feature aggregations5.7 Medium
- ibm websphere application serverIBM WebSphere Application Server code execution8.1 High
- dell emc networker, networker, nve +1 moreEMC NetWorker may potentially be vulnerable to an unauthenticated remote code execution...7.5 High
- hp inc. factory preinstalled windows 10 20h2 images, microsoft windows 10 1507, windows 10 1511 +8 more +10 moreHP Factory Preinstalled Images on certain systems that shipped with Windows 10 versions 20H2 and...7.8 High
- hp inc. pc products using ami uefi firmware, hp 218 pro g5 mt firmware, 260 g2 desktop mini firmware +23 more +25 moreA potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP...7.0 High
- devolutions serverImproper access control in Devolutions Server allows an authenticated user to access unauthorized...6.5 Medium
- bdcom 1704-wgl, 1704-wgl firmware +1 moreBDCOM 1704-WGL Backup File param.file.tgz information disclosure5.3 Medium
libredwgOSS-FuzzHeap-buffer-overflow in json_cquoteNo score- gnu glibc, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +1 more +3 moresprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some...9.8 Critical
- openbsd openssh, fedoraproject fedora, netapp 500f firmware +6 more +8 moreOpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms...6.5 Medium
- vbulletinvBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code...9.8 Critical
- arraynetworks arrayos agThe user interface of Array Networks AG Series and vxAG through 9.4.0.470 could allow a remote...4.9 Medium
- totolink t8 firmwareA command injection vulnerability in the serverIp parameter in the function updateWifiInfo of...9.8 Critical
- totolink t8 firmwareA command injection vulnerability in the ip parameter in the function recvSlaveUpgstatus of...9.8 Critical
- totolink t8 firmwareTOTOLINK T8 V4.1.5cu was discovered to contain a hard code password for the telnet service which...9.8 Critical
- totolink t8 firmwareTOTOLINK T8 V4.1.5cu was discovered to contain a command injection vulnerability via the...9.8 Critical
- totolink t8 firmwareA command injection vulnerability in the version parameter in the function...9.8 Critical
- totolink t8 firmwareA command injection vulnerability in the serverIp parameter in the function meshSlaveUpdate of...9.8 Critical
- totolink t8 firmwareA command injection vulnerability in the ip parameter in the function recvSlaveCloudCheckStatus...9.8 Critical
- totolink t8 firmwareA command injection vulnerability in the serverIp parameter in the function meshSlaveDlfw of...9.8 Critical
- totolink ca300-poe firmwareTOTOLINK CA300-PoE V6.2c.884 was discovered to contain a hard code password for root which is...9.8 Critical
- totolink ca300-poe firmwareTOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the...9.8 Critical
- totolink ca300-poe firmwareTOTOLINK CA300-PoE V6.2c.884 was discovered to contain a hard code password for the telnet...7.5 High
- totolink ca300-poe firmwareTOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the...9.8 Critical
- totolink ca300-poe firmwareTOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the...9.8 Critical
- Show moreLoading…