CVEs published in February 2023
2,729 vulnerabilities, 255 critical, 10 exploited.
- mozilla firefox esr, thunderbird +1 moreMozilla developers Philipp and Gabriele Svelto reported memory safety bugs present in Firefox ESR...8.8 High
- mozilla firefoxMozilla developers Timothy Nikkel, Gabriele Svelto, Jeff Muizelaar and the Mozilla Fuzzing Team...8.8 High
- mozilla firefox, firefox esr +1 moreMozilla developers Kershaw Chang and the Mozilla Fuzzing Team reported memory safety bugs present...8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreWhen importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing...6.5 Medium
- mozilla firefoxWhen dragging and dropping an image cross-origin, the image's size could potentially be leaked....6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreModule load requests that failed were not being checked as to whether or not they were cancelled...8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreAn invalid downcast from <code>nsTextNode</code> to <code>SVGElement</code> could have lead to...8.8 High
- mozilla firefoxAn invalid downcast from `nsHTMLDocument` to `nsIContent` could have lead to undefined behavior....9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreCross-compartment wrappers wrapping a scripted proxy could have caused objects from other...8.8 High
- mozilla firefoxThe return value from `gfx::SourceSurfaceSkia::Map()` wasn't being verified which could have...7.5 High
- mozilla firefox, firefox esr, thunderbird +2 moreWhen encoding data from an <code>inputStream</code> in <code>xpcom</code> the size of the input...8.8 High
- mozilla firefoxDue to URL previews in the network panel of developer tools improperly storing URLs, query...8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreA background script invoking <code>requestFullscreen</code> and then blocking the main thread...5.4 Medium
- mozilla firefox, firefox esr, thunderbird +2 morePermission prompts for opening external schemes were only shown for <code>ContentPrincipals</code...8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreThe <code>Content-Security-Policy-Report-Only</code> header could allow an attacker to leak a...6.5 Medium
- gnu binutils, fedora extra packages for enterprise linux 7, extra packages for enterprise linux 8 +7 more +9 moreField `the_bfd` of `asymbol` is uninitialized in function `bfd_mach_o_get_synthetic_symtab`4.7 Medium
- gnu binutils, fedora extra packages for enterprise linux 7, extra packages for enterprise linux 8 +7 more +9 moreField `file_table` of `struct module *module` is uninitialized4.7 Medium
- gnu binutils, fedora extra packages for enterprise linux 7, extra packages for enterprise linux 8 +7 more +9 moreOut of bounds read in parse_module function in bfd/vms-alpha.c6.3 Medium
- ami megarac sp-xAMI MegaRAC SPX devices allow User Enumeration through Redfish. The fixed versions are SPx12...5.3 Medium
- ami megarac sp-xAMI MegaRAC SPX devices allow Password Disclosure through Redfish. The fixed versions are SPx_12...7.5 High
- kiwitcms kiwi, kiwi tcms +1 moreKiwi TCMS has denial of service vulnerability on Password reset page7.5 High
- kiwitcms kiwi, kiwi tcms +1 moreKiwi TCMS has no protection against brute-force attacks on login page7.5 High
- nec pc settings toolPC settings tool Ver10.1.26.0 and earlier, PC settings tool Ver11.0.22.0 and earlier allows a...7.8 High
- butterfly button plugin, butterfly-button project butterfly-button +1 moreButterfly Button plugin may leave traces of its use on user's device4.3 Medium
- netgear prosafe 24 port 10/100 fs726tp, prosafe fs726tp firmware +1 moreNetgear ProSAFE 24 Port 10/100 FS726TP - CWE-522: Insufficiently Protected Credentials.7.5 High
- haxx curl, debian linux, fedoraproject fedora +9 more +11 moreAn allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0...6.5 Medium
- haxx curl, netapp active iq unified manager, clustered data ontap +8 more +10 moreA cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that...6.5 Medium
- haxx curl, netapp active iq unified manager, clustered data ontap +8 more +10 moreA cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that...9.1 Critical
- synopsys jenkins coverity plugin, jenkins synopsys coverity +1 moreSynopsys Jenkins Coverity Plugin has Incorrect Default Permissions4.3 Medium
- synopsys jenkins coverity plugin, jenkins synopsys coverity +1 moreCSRF vulnerability in Jenkins Coverity Plugin allow capturing credentials4.3 Medium
- synopsys jenkins coverity plugin, jenkins synopsys coverity +1 moreCSRF vulnerability in Synopsys Jenkins Coverity Plugin3.5 Low
- solarwinds platform, orion platform +1 moreSolarWinds Platform Deserialization of Untrusted Data Vulnerability7.2 High
- apple ipados, macos, safari +3 more +5 moreA type confusion issue was addressed with improved checks. This issue is fixed in macOS Ventura...8.8 High
- media cp control panel, mediacp media control panel +1 moreMedia CP Media Control Panel – Reflected XSS8.1 High
- media cp control panel, mediacp media control panel +1 moreMedia CP Media Control Panel – insufficiently protected credential change6.5 Medium
- media cp control panel, mediacp media control panel +1 moreMedia CP Media Control Panel – CSRF9.1 Critical
- media cp control panel, mediacp media control panel +1 moreMedia CP Media Control Panel – Information Disclosure8.1 High
- rifatron co., ltd. dvr, sunellsecurity sn-adr3804e1 firmware, sn-adr3808e1 firmware +5 more +7 moreSunell DVR – Insufficiently Protected Credentials5.3 Medium
- hasherezade (github) libpeconvLibpeconv – integer overflow9.8 Critical
- hasherezade (github) libpeconvLibpeconv – access violation9.8 Critical
- priority web, priority-software priority +1 morePriority Web – Authentication bypass9.1 Critical
- priority-software priority, priority for windows +1 morePriority Windows – Command Execution via SQL Injection9.1 Critical
- rifatron co., ltd. dvr, sunellsecurity sn-adr3804e1 firmware, sn-adr3808e1 firmware +5 more +7 moreSunell DVR – Exposure of Sensitive Information6.5 Medium
- kardex control centerKardex Mlog MCC 5.7.12+0-a203c2a213-master allows remote code execution. It spawns a web...9.8 Critical
- fujitsu tsclinical define.xml generator, tsclinical metadata desktop tools, fujitsu limited tsclinical define.xml generator and tsclinical metadata desktop tools +2 moreImproper restriction of XML external entity reference (XXE) vulnerability exists in tsClinical Define.xml Generator all versions (v1.0.0 to v1.4.0) and tsClinical Metadata Desktop Tools Version 1.0.3…7.4 High
- elecom camera assistant, quickfiledealer, elecom co.,ltd. camera assistant and quickfiledealer +2 moreUntrusted search path vulnerability in ELECOM Camera Assistant 1.00 and QuickFileDealer Ver.1.2.1...7.8 High
- google androidIn permissions of AndroidManifest.xml, there is a possible way to grant signature permissions due...7.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreAn attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary...8.8 High
- phppassword_verify() always returns true for some invalid hashes7.7 High
- c-ares, fedoraproject fedora, redhat enterprise linux +1 more +3 moreA flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the...8.6 High
- Show moreLoading…