CVEs published in February 2023
2,729 vulnerabilities, 255 critical, 10 exploited.
- wickedplugins wicked folders, wicked folders – folder organizer for pages, posts, and custom post types +1 moreWicked Folders <= 2.18.16 - Missing Authorization on ajax_edit_folder5.4 Medium
shimDebianshim - security updateNo score- caphyon advanced installerPrivilege escalation in the MSI repair functionality in Caphyon Advanced Installer 20.0 and below...7.8 High
- btcpayserver, btcpayserver btcpayserver/btcpayserver +1 moreOpen Redirect in btcpayserver/btcpayserver6.4 Medium
- btcpayserver, btcpayserver btcpayserver/btcpayserver +1 moreCross-site Scripting (XSS) - Stored in btcpayserver/btcpayserver5.5 Medium
- answer, answerdev answerdev/answer +1 moreImproper Access Control in answerdev/answer9.8 Critical
- answer, answerdev answerdev/answer +1 moreCross-site Scripting (XSS) - Generic in answerdev/answer8.2 High
- answer, answerdev answerdev/answer +1 moreCross-site Scripting (XSS) - Stored in answerdev/answer8.0 High
- answer, answerdev answerdev/answer +1 moreCross-site Scripting (XSS) - DOM in answerdev/answer8.0 High
- answer, answerdev answerdev/answer +1 moreCross-site Scripting (XSS) - Stored in answerdev/answer8.2 High
- answer, answerdev answerdev/answer +1 moreConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in answerdev/answer8.1 High
- bosch b420, b420 firmware +1 moreBosch Security Systems B420 firmware 02.02.0001 employs IP based authorization in its...7.6 High
- thinkphpDeserialization of Untrusted Data in thinkphp9.8 Critical
- eyoucmsCross-site scripting (XSS) vulnerability in EyouCMS v1.6.0 allows attackers to execute arbitrary...5.4 Medium
- institutional management website project management websiteFile upload vulnerability in Future-Depth Institutional Management Website (IMS) 1.0, allows...9.8 Critical
- institutional management website project management websiteSQL Injection vulnerability in Future-Depth Institutional Management Website (IMS) 1.0, allows...9.8 Critical
- heimdal project heimdal, samba +1 moreThe fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a...7.5 High
- elastic kibana, decode-uri-component project decode-uri-component +1 moreA flaw (CVE-2022-38900) was discovered in one of Kibana’s third party dependencies, that could...6.5 Medium
- elastic endpoint security, endgame +1 moreAn issue was discovered in the rollback feature of Elastic Endpoint Security for Windows, which...7.8 High
- onedev project onedevUse of Cryptographically Weak Pseudo-Random Number Generator in Onedev8.1 High
- wickedplugins wicked folders, wicked folders – folder organizer for pages, posts, and custom post types +1 moreWicked Folders <= 2.18.16 - Missing Authorization on ajax_save_folder5.4 Medium
- wickedplugins wicked folders, wicked folders – folder organizer for pages, posts, and custom post types +1 moreWicked Folders <= 2.18.16 - Cross-Site Request Forgery on ajax_move_object5.4 Medium
- wickedplugins wicked folders, wicked folders – folder organizer for pages, posts, and custom post types +1 moreWicked Folders <= 2.18.16 - Missing Authorization on ajax_move_object5.4 Medium
- wickedplugins wicked folders, wicked folders – folder organizer for pages, posts, and custom post types +1 moreWicked Folders <= 2.18.16 - Missing Authorization on ajax_save_sort_order5.4 Medium
- wickedplugins wicked folders, wicked folders – folder organizer for pages, posts, and custom post types +1 moreWicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_save_folder_order5.4 Medium
- wickedplugins wicked folders, wicked folders – folder organizer for pages, posts, and custom post types +1 moreWicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_delete_folder5.4 Medium
- interactive geo maps project geo maps, interactivegeomaps mapgeo – interactive geo maps +1 moreInteractive Geo Maps <= 1.5.9 - Authenticated (Editor+) Stored Cross-Site Scripting6.4 Medium
- logicaldoc, logicaldoc community edition, enterprise +2 moreLogicalDOC Document Version Comment Stored XSS5.4 Medium
- logicaldoc, logicaldoc community edition, enterprise +2 moreLogicalDOC Document File Name Stored XSS5.4 Medium
- mayan edms edms, mayan-edms mayan edms +1 moreMayan EDMS Tag XSS5.4 Medium
- logicaldoc, logicaldoc enterprise +1 moreLogicalDOC Chat Stored XSS5.4 Medium
- openkmIf an attacker has access to the console for OpenKM (and is authenticated), a stored XSS...5.4 Medium
- openkmGiven a malicious document provided by an attacker, the OpenKM DMS is vulnerable to a stored ...5.4 Medium
- logicaldoc, logicaldoc community edition, enterprise +2 moreLogicalDOC Messaging Stored XSS5.4 Medium
- wickedplugins wicked folders, wicked folders – folder organizer for pages, posts, and custom post types +1 moreWicked Folders <= 2.18.16 - Missing Authorization on ajax_add_folder5.4 Medium
- wickedplugins wicked folders, wicked folders – folder organizer for pages, posts, and custom post types +1 moreWicked Folders <= 2.18.16 - Cross-Site Request Forgery on ajax_save_folder5.4 Medium
- xpressengineXpressEngine Update Query sql injection5.5 Medium
- cryptography.io cryptographyCipher.update_into can corrupt memory in pyca cryptography4.8 Medium
- oretnom23 online eyewear shopSourceCodester Online Eyewear Shop POST Request Users.php registration cross site scripting3.5 Low
- citrix workspaceONLYOFFICE Workspace Search Stored XSS5.4 Medium
- apache kafka connect, apache software foundation kafka connect api +1 moreApache Kafka Connect API: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration using Kafka Connect8.8 High
- zulip, zulip server +1 moreUser uploads proxied from S3 lack `Content-Security-Policy` headers, may be served with `Content-Disposition: inline` in zulip4.4 Medium
github.com/pion/dtlsGo,github.com/pion/dtls/v2Go +1 morePanic during unmarshal of Hello Verify Request in github.com/pion/dtls/v25.9 Mediumgithub.com/pion/dtlsGo,github.com/pion/dtls/v2Go +1 morePanic during unmarshal of Hello Verify Request in github.com/pion/dtls/v25.9 Medium- typo3Persisted Cross-Site Scripting in Frontend Rendering in typo38.8 High
- dompdfURI validation failure on SVG parsing. Bypass of CVE-2023-2392410.0 Critical
- weblabyrinth project weblabyrinthweblabyrinth labyrinth.inc.php Labyrinth sql injection5.5 Medium
- moxa sds-3008 series industrial ethernet switch, sds-3008-t firmware, sds-3008 firmware +2 moreA cleartext transmission vulnerability exists in the web application functionality of Moxa SDS...5.9 Medium
- moxa sds-3008 series industrial ethernet switch, sds-3008-t firmware, sds-3008 firmware +2 moreA stored cross-site scripting vulnerability exists in the web application functionality of Moxa...4.3 Medium
- moxa sds-3008 series industrial ethernet switch, sds-3008-t firmware, sds-3008 firmware +2 moreA stored cross-site scripting vulnerability exists in the web application functionality of Moxa...4.3 Medium
- Show moreLoading…