CVEs published in February 2023
2,729 vulnerabilities, 255 critical, 10 exploited.
- qtQt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin...7.5 High
- visio globe visiowebVisioweb.js - Prototype Pollution can results in XSS7.2 High
- rtcwcooprtcwcoop Team Command ai_cast_script.c AICast_ScriptLoad denial of service3.5 Low
- meta4creations post duplicator plugin, metaphorcreations post duplicator +1 moremeta4creations Post Duplicator Plugin notices.php mtphr_post_duplicator_notice cross site scripting3.5 Low
- checkmkCSRF in add-visual endpoint5.4 Medium
- checkmkHost secret disclosed in Checkmk logs6.5 Medium
- checkmkInsecure access control mechanisms for RestAPI documentation5.3 Medium
- checkmkInsecure Termination of RestAPI Session Tokens5.6 Medium
- checkmkSSRF in agent-receiver API6.8 Medium
- checkmkLQL Injection in Livestatus HTTP headers6.8 Medium
- checkmkPHP code injection in watolib9.1 Critical
- checkmkCommand injection in SMS notifications8.0 High
- arnoldle submitbymailpluginarnoldle submitByMailPlugin edit_list.php cross-site request forgery4.3 Medium
- apache commons fileupload, apache software foundation tomcat, debian linux +2 moreApache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts7.5 High
- commenthol versionnversionn Command Injection Vulnerability9.8 Critical
- apache kerby ldap backendLDAP Injection Vulnerability in Apache Kerby9.8 Critical
- apolloconfig apolloApollo has potential access control security issue in eureka7.5 High
- apolloconfig apolloapollo-portal has potential CSRF issue5.7 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreMembers of the <code>DEVMODEW</code> struct set by the printer device driver weren't being...6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreAfter downloading a Windows <code>.url</code> shortcut from the local filesystem, an attacker...8.1 High
libavcOSS-FuzzUNKNOWN READ in isvce_cabac_flushNo scoreftpcrates.ioftp is unmaintained, use suppaftp insteadNo scorepartial_sortcrates.iopartial_sort contains Out-of-bounds Read in release modeNo score- 3breadt dd-plist3breadt dd-plist xml external entity reference5.3 Medium
- generator-hottowel project generator-hottowelgenerator-hottowel 404 Error _app.js cross site scripting3.5 Low
- nrel api-umbrella-web, api umbrella +1 moreNREL api-umbrella-web Admin Data Table cross site scripting3.5 Low
- qt-users silkqt-users-jp silk header.qml cross site scripting3.5 Low
- oclc oaicatOCLC-Research OAICat sql injection6.3 Medium
- oneapp project oneappuakfdotb oneapp sql injection6.3 Medium
isc-dhcpDebianisc-dhcp - security updateNo score- jd-gui project jd-guiJD-GUI 1.6.6 allows XSS via util/net/InterProcessCommunicationUtil.java.6.1 Medium
- jd-gui project jd-guiJD-GUI 1.6.6 allows deserialization via UIMainWindowPreferencesProvider.singleInstance.6.6 Medium
- puzzle liimaLiima before 1.17.28 allows Hibernate query language (HQL) injection, related to colToSort in the...9.8 Critical
- puzzle liimaLiima before 1.17.28 allows server-side template injection.9.8 Critical
- gnome epiphany, fedoraproject fedora +1 moreIn Epiphany (aka GNOME Web) through 43.0, untrusted web content can trick users into exfiltrating...7.5 High
- mozilla firefox, firefox esr, firefox focus +2 moreA lack of in app notification for entering fullscreen mode could have lead to a malicious website...7.5 High
- notaryproject notation-gonotation-go has excessive memory allocation on verification7.5 High
- sick fx0-gent00000 firmware, fx0-gent00010 firmware +1 moreMissing Authentication for Critical Function in SICK FX0-GENT v3 Firmware Version V3.04 and V3.05...9.8 Critical
- sick fx0-gpnt00000 firmware, fx0-gpnt00010 firmware +1 moreMissing Authentication for Critical Function in SICK FX0-GPNT v3 Firmware Version V3.04 and V3.05...9.8 Critical
- gnu emacsAn issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection...7.8 High
- gnu emacsAn issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file...7.3 High
- gnu emacs, debian linux +1 moreGNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name...9.8 Critical
- misp-project mispMISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model...9.8 Critical
- misp-project mispapp/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles...9.8 Critical
- sir gnuboardGnuboard 5.5.4 and 5.5.5 is vulnerable to Insecure Permissions. An attacker can change password...7.5 High
- izimodal project izimodaliziModal vulnerable to Cross-site Scripting6.1 Medium
- baremetrics date range picker, baremetrics-calendar +1 moreBaremetrics date range picker vulnerable to Cross-site Scripting6.1 Medium
- esdoc esdoc-publish-html-pluginesdoc-publish-html-plugin vulnerable to Cross-site Scripting6.1 Medium
- agentejo cockpit, microweber +1 moreCockpit vulnerable to Cross-site Scripting6.1 Medium
- microweberMicroweber vulnerable to Cross-site Scripting6.1 Medium
- Show moreLoading…