Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: January 2023

91 records · 8 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2022-34324
    39Monitor

    Multiple SQL injections in Sage XRT Business Exchange 12.4.302 allow an authenticated attacker to inject malicious data in SQL queries: Add

    HighCVSS 8.8No exploitEPSS 11%

    sage · sage xrt business exchangeJan 1, 2023

  • CVE-2022-42475
    99Now

    A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    fortinet · fortiosJan 2, 2023

  • CVE-2022-4302
    33Monitor

    White Label CMS < 2.5 - Admin+ PHP Object Injection

    HighCVSS 7.2No exploitEPSS 17%

    videousermanuals · white label cmsJan 2, 2023

  • CVE-2022-4324
    33Monitor

    Custom Field Template < 2.5.8 - Admin+ PHP Object Injection

    HighCVSS 7.2No exploitEPSS 17%

    wpgogo · custom field templateJan 2, 2023

  • CVE-2021-30558
    38Monitor

    Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass conten

    HighCVSS 8.8No exploitEPSS 11%

    google · chromeJan 2, 2023

  • CVE-2022-3842
    35Monitor

    Use after free in Passwords in Google Chrome prior to 105.0.5195.125 allowed a remote attacker who had compromised the renderer process to p

    HighCVSS 7.5No exploitEPSS 18%

    google · chromeJan 2, 2023

  • CVE-2022-43931
    45Plan

    Out-of-bounds write vulnerability in Remote Desktop Functionality in Synology VPN Plus Server before 1.4.3-0534 and 1.4.4-0635 allows remote

    CriticalCVSS 10.0No exploitEPSS 16%

    synology · vpn plus serverJan 3, 2023

  • CVE-2023-0048
    44Plan

    Code Injection in lirantal/daloradius

    HighCVSS 8.8No exploitEPSS 30%

    daloradius · daloradiusJan 4, 2023

  • CVE-2023-22457
    41Plan

    org.xwiki.contrib:application-ckeditor-ui vulnerable to Remote Code Execution via Cross-Site Request Forgery

    HighCVSS 8.8No exploitEPSS 19%

    xwiki · ckeditor integrationJan 4, 2023

  • CVE-2023-22463
    60This week

    KubePi's Hardcoded Jwtsigkeys allows malicious actor to login with a forged JWT token

    CriticalCVSS 9.8Proof of conceptEPSS 69%

    fit2cloud · kubepiJan 4, 2023

  • CVE-2022-47523
    60This week

    Zoho ManageEngine Access Manager Plus before 4309, Password Manager Pro before 12210, and PAM360 before 5801 are vulnerable to SQL Injection

    CriticalCVSS 9.8No exploitEPSS 70%

    zohocorp · manageengine password manager proJan 5, 2023

  • CVE-2022-44877
    99Now

    login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS comma

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    control-webpanel · webpanelJan 5, 2023

  • CVE-2022-42979
    42Plan

    Information disclosure due to an insecure hostname validation in the RYDE application 5.8.43 for Android and iOS allows attackers to take ov

    HighCVSS 8.8No exploitEPSS 24%

    rydesharing · rydeJan 6, 2023

  • CVE-2022-44149
    54Plan

    The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by placing &telnetd in

    HighCVSS 8.8Proof of conceptEPSS 64%

    nexxtsolutions · amp300 firmwareJan 6, 2023

  • CVE-2022-43970
    34Monitor

    Buffer overflow in Linksys WRT54GL

    HighCVSS 7.2No exploitEPSS 19%

    linksys · wrt54gl firmwareJan 9, 2023

  • CVE-2022-3416
    33Monitor

    WPtouch < 4.3.45 - Admin+ Arbitrary File Upload

    HighCVSS 7.2No exploitEPSS 17%

    bravenewcode · wptouchJan 9, 2023

  • CVE-2022-4043
    33Monitor

    WP Custom Admin Interface < 7.29 - Admin+ PHP Object Injection

    HighCVSS 7.2No exploitEPSS 17%

    wp custom admin interface project · wp custom admin interfaceJan 9, 2023

  • CVE-2023-0017
    44Plan

    Improper access control in SAP NetWeaver AS for Java

    CriticalCVSS 9.8No exploitEPSS 15%

    sap · netweaver application server for javaJan 10, 2023

  • CVE-2022-45092
    44Plan

    A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 1).

    HighCVSS 8.8No exploitEPSS 31%

    siemens · sinec insJan 10, 2023

  • CVE-2022-3792
    43Plan

    SQL Injection in GullsEye Terminal Operating System

    CriticalCVSS 9.8No exploitEPSS 14%

    gullseye · gullseye terminal operating systemJan 10, 2023

  • CVE-2022-46610
    40Plan

    72crm v9 was discovered to contain an arbitrary file upload vulnerability via the avatar upload function.

    HighCVSS 8.8No exploitEPSS 18%

    72crm · wukong crmJan 10, 2023

  • CVE-2022-47083
    40Plan

    A PHP Object Injection vulnerability in the unserialize() function Spitfire CMS v1.0.475 allows authenticated attackers to execute arbitrary

    HighCVSS 8.8No exploitEPSS 18%

    spitfire project · spitfireJan 10, 2023

  • CVE-2022-35401
    38Monitor

    An authentication bypass vulnerability exists in the get_IFTTTTtoken.cgi functionality of Asus RT-AX82U 3.0.0.4.386_49674-ge182230.

    HighCVSS 8.1No exploitEPSS 20%

    asus · rt-ax82u firmwareJan 10, 2023

  • CVE-2022-38393
    36Monitor

    A denial of service vulnerability exists in the cfg_server cm_processConnDiagPktList opcode of Asus RT-AX82U 3.0.0.4.386_49674-ge182230 rout

    HighCVSS 7.5No exploitEPSS 18%

    asus · rt-ax82u firmwareJan 10, 2023

  • CVE-2023-21547
    57Plan

    Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability

    HighCVSS 7.5No exploitEPSS 89%

    microsoft · windows 10 1607Jan 10, 2023

  • CVE-2023-21674
    77This week

    Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability

    HighCVSS 8.8KEVWeaponizedEPSS 40%

    microsoft · windows 10 1507Jan 10, 2023

  • CVE-2023-21742
    52Plan

    Microsoft SharePoint Server Remote Code Execution Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 55%

    microsoft · sharepoint foundationJan 10, 2023

  • CVE-2023-21758
    58Plan

    Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability

    HighCVSS 7.5No exploitEPSS 92%

    microsoft · windows 10Jan 10, 2023

  • CVE-2023-21768
    51Plan

    Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

    HighCVSS 7.8WeaponizedEPSS 65%

    microsoft · windows 11Jan 10, 2023

  • CVE-2023-22959
    39Monitor

    WebChess through 0.9.0 and 1.0.0.rc2 allows SQL injection: mainmenu.php, chess.php, and opponentspassword.php (txtFirstName, txtLastName).

    HighCVSS 8.8No exploitEPSS 13%

    webchess project · webchessJan 11, 2023

  • CVE-2023-22952
    89Now

    In SugarCRM before 12.0.

    HighCVSS 8.8KEVWeaponizedEPSS 80%

    sugarcrm · sugarcrmJan 11, 2023

  • CVE-2022-4874
    33Monitor

    Authenticated bypass in Netcomm router models NF20MESH, NF20, and NL1902 allows unauthenticated user to get access to content.

    HighCVSS 7.5No exploitEPSS 11%

    netcommwireless · nf20 firmwareJan 11, 2023

  • CVE-2022-25026
    37Monitor

    A Server-Side Request Forgery (SSRF) in Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to gain access to sensitive resources on th

    HighCVSS 7.5No exploitEPSS 24%

    rocketsoftware · trufusion enterpriseJan 12, 2023

  • CVE-2022-46502
    43Plan

    Online Student Enrollment System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at /student_enrollm

    CriticalCVSS 9.8No exploitEPSS 13%

    online student enrollment system project · online student enrollment systemJan 12, 2023

  • CVE-2023-22480
    59Plan

    KubeOperator is vulnerable to unauthorized access to system API

    CriticalCVSS 9.8Proof of conceptEPSS 66%

    fit2cloud · kubeoperatorJan 13, 2023

  • CVE-2023-22496
    50Plan

    Netdata vulnerable to command injection

    CriticalCVSS 9.8Proof of conceptEPSS 36%

    netdata · netdataJan 13, 2023

  • CVE-2023-0297
    68This week

    Code Injection in pyload/pyload

    CriticalCVSS 9.8WeaponizedEPSS 95%

    pyload · pyloadJan 13, 2023

  • CVE-2022-1812
    48Plan

    Integer Overflow or Wraparound in publify/publify

    CriticalCVSS 9.8No exploitEPSS 30%

    publify project · publifyJan 14, 2023

  • CVE-2023-23590
    38Monitor

    Mercedes-Benz XENTRY Retail Data Storage 7.8.1 allows remote attackers to cause a denial of service (device restart) via an unauthenticated

    HighCVSS 7.5No exploitEPSS 26%

    mercedes-benz · xentry retail data storage firmwareJan 15, 2023

  • CVE-2023-0315
    64This week

    Command Injection in froxlor/froxlor

    HighCVSS 8.8WeaponizedEPSS 97%

    froxlor · froxlorJan 15, 2023

  • CVE-2023-0324
    45Plan

    SourceCodester Online Tours & Travels Management System page-login.php sql injection

    CriticalCVSS 9.8No exploitEPSS 18%

    online tours \& travels management system project · online tours \& travels management systemJan 16, 2023

  • CVE-2022-4060
    52Plan

    User Post Gallery <= 2.19 - Unauthenticated RCE

    CriticalCVSS 9.8Proof of conceptEPSS 42%

    odude · user post galleryJan 16, 2023

  • CVE-2022-4101
    45Plan

    Images Optimize and Upload CF7 <= 2.1.4 - Unauthenticated Arbitrary File Deletion

    CriticalCVSS 9.1No exploitEPSS 29%

    images optimize and upload cf7 project · images optimize and upload cf7Jan 16, 2023

  • CVE-2022-37436
    38Monitor

    Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting

    MediumCVSS 5.3No exploitEPSS 55%

    apache · http serverJan 17, 2023

  • CVE-2021-32837
    39Monitor

    mechanize vulnerable to ReDoS

    HighCVSS 7.5No exploitEPSS 28%

    mechanize project · mechanizeJan 17, 2023

  • CVE-2022-23521
    56Plan

    gitattributes parsing integer overflow in git

    CriticalCVSS 9.8No exploitEPSS 56%

    git-scm · gitJan 17, 2023

  • CVE-2022-41903
    52Plan

    Integer overflow in `git archive`, `git log --format` leading to RCE in git

    CriticalCVSS 9.8Proof of conceptEPSS 44%

    git-scm · gitJan 17, 2023

  • CVE-2023-21839
    90Now

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).

    HighCVSS 7.5KEVWeaponizedEPSS 99%

    oracle · weblogic serverJan 17, 2023

  • CVE-2023-21887
    32Monitor

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: GIS).

    MediumCVSS 4.9Proof of conceptEPSS 43%

    oracle · mysqlJan 17, 2023

  • CVE-2021-33959
    35Monitor

    Plex media server 1.21 and before is vulnerable to ddos reflection attack via plex service.

    HighCVSS 7.5Proof of conceptEPSS 15%

    plex · media serverJan 18, 2023

  • CVE-2023-22809
    48Plan

    In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_ED

    HighCVSS 7.8WeaponizedEPSS 55%

    sudo project · sudoJan 18, 2023

  • CVE-2022-47966
    99Now

    Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache San

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    zohocorp · manageengine access manager plusJan 18, 2023

  • CVE-2020-35326
    43Plan

    SQL Injection vulnerability in file /inxedu/demo_inxedu_open/src/main/resources/mybatis/inxedu/website/WebsiteImagesMapper.xml in inxedu 2.0

    CriticalCVSS 9.8No exploitEPSS 13%

    inxedu · inxeduJan 18, 2023

  • CVE-2023-21608
    79This week

    Adobe Acrobat Reader DC resetForm Use-After-Free Remote Code Execution Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 59%

    adobe · acrobat dcJan 18, 2023

  • CVE-2022-45925
    35Monitor

    An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803).

    HighCVSS 7.5No exploitEPSS 16%

    opentext · opentext extended ecmJan 18, 2023

  • CVE-2022-45926
    40Plan

    An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803).

    HighCVSS 8.8No exploitEPSS 16%

    opentext · opentext extended ecmJan 18, 2023

  • CVE-2022-47745
    40Plan

    ZenTao 16.4 to 18.0.beta1 is vulnerable to SQL injection.

    HighCVSS 8.8No exploitEPSS 15%

    easycorp · zentaoJan 19, 2023

  • CVE-2022-46887
    45Plan

    Multiple SQL injection vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to execute arbitrary SQL commands via the conuser[]

    CriticalCVSS 9.8No exploitEPSS 19%

    nexusphp · nexusphpJan 19, 2023

  • CVE-2022-46889
    39Monitor

    A persistent cross-site scripting (XSS) vulnerability in NexusPHP before 1.7.33 allows remote authenticated attackers to permanently inject

    MediumCVSS 5.4No exploitEPSS 60%

    nexusphp · nexusphpJan 19, 2023

  • CVE-2023-0126
    52Plan

    Pre-authentication path traversal vulnerability in SMA1000 firmware version 12.4.2, which allows an unauthenticated attacker to access arbit

    HighCVSS 7.5Proof of conceptEPSS 73%

    sonicwall · sma1000 firmwareJan 19, 2023

  • CVE-2022-46476
    51Plan

    D-Link DIR-859 A1 1.05 was discovered to contain a command injection vulnerability via the service= variable in the soapcgi_main function.

    CriticalCVSS 9.8No exploitEPSS 41%

    dlink · dir-859 a1 firmwareJan 19, 2023

  • CVE-2022-20964
    44Plan

    A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to inj

    HighCVSS 8.8No exploitEPSS 30%

    cisco · identity services engineJan 20, 2023

  • CVE-2022-20966
    29Monitor

    A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to con

    MediumCVSS 5.4No exploitEPSS 27%

    cisco · identity services engineJan 20, 2023

  • CVE-2023-23596
    40Plan

    jc21 NGINX Proxy Manager through 2.9.19 allows OS command injection.

    HighCVSS 8.8No exploitEPSS 15%

    jc21 · nginx proxy managerJan 20, 2023

  • CVE-2023-23488
    67This week

    The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerability in the 'code' para

    CriticalCVSS 9.8WeaponizedEPSS 92%

    strangerstudios · paid memberships proJan 20, 2023

  • CVE-2023-23489
    42Plan

    The Easy Digital Downloads WordPress Plugin, versions 3.1.0.2 & 3.1.0.3, is affected by an unauthenticated SQL injection vulnerability in th

    CriticalCVSS 9.8Proof of conceptEPSS 11%

    sandhillsdev · easy digital downloadsJan 20, 2023

  • CVE-2022-35977
    26Monitor

    Integer overflow in certain command arguments can drive Redis to OOM panic

    MediumCVSS 5.5No exploitEPSS 13%

    redis · redisJan 20, 2023

  • CVE-2023-22458
    44Plan

    Integer overflow in multiple Redis commands can lead to denial-of-service

    MediumCVSS 5.5No exploitEPSS 71%

    redis · redisJan 20, 2023

  • CVE-2023-23492
    52Plan

    The Login with Phone Number WordPress Plugin, version < 1.4.2, is affected by an authenticated SQL injection vulnerability in the 'ID' param

    HighCVSS 8.8Proof of conceptEPSS 57%

    idehweb · login with phone numberJan 20, 2023

  • CVE-2023-22884
    42Plan

    Apache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache Airflow

    CriticalCVSS 9.8Proof of conceptEPSS 11%

    apache · airflowJan 21, 2023

  • CVE-2022-4230
    46Plan

    WP Statistics < 13.2.9 - Authenticated SQLi

    HighCVSS 8.8No exploitEPSS 35%

    veronalabs · wp statisticsJan 23, 2023

  • CVE-2022-4305
    51Plan

    Login as User or Customer < 3.3 - Unauthenticated Privilege Escalation to Admin

    CriticalCVSS 9.8Proof of conceptEPSS 38%

    wp-buy · login as user or customer \(user switching\)Jan 23, 2023

  • CVE-2023-22960
    38Monitor

    Lexmark products through 2023-01-10 have Improper Control of Interaction Frequency.

    HighCVSS 7.5Proof of conceptEPSS 27%

    lexmark · b2236 firmwareJan 23, 2023

  • CVE-2023-23560
    43Plan

    In certain Lexmark products through 2023-01-12, SSRF can occur because of a lack of input validation.

    CriticalCVSS 9.8No exploitEPSS 13%

    lexmark · b2236 firmwareJan 23, 2023

  • CVE-2022-41142
    61This week

    This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon.

    HighCVSS 8.8No exploitEPSS 85%

    centreon · centreonJan 26, 2023

  • CVE-2021-41988
    31Monitor

    Qlik NPrinting Designer through 21.14.3.0 creates a Temporary File in a Directory with Insecure Permissions.

    HighCVSS 7.8No exploitEPSS 0%

    qlik · nprinting designerJan 26, 2023

  • CVE-2022-29844
    50Plan

    Western Digital My Cloud OS 5 arbitrary file read and write vulnerability via ftp

    CriticalCVSS 9.8No exploitEPSS 36%

    westerndigital · my cloud pr2100 firmwareJan 26, 2023

  • CVE-2022-31704
    63This week

    The vRealize Log Insight contains a broken access control vulnerability.

    CriticalCVSS 9.8WeaponizedEPSS 81%

    vmware · vrealize log insightJan 26, 2023

  • CVE-2022-31706
    65This week

    The vRealize Log Insight contains a Directory Traversal Vulnerability.

    CriticalCVSS 9.8WeaponizedEPSS 87%

    vmware · vrealize log insightJan 26, 2023

  • CVE-2022-31711
    28Monitor

    VMware vRealize Log Insight contains an Information Disclosure Vulnerability.

    MediumCVSS 5.3WeaponizedEPSS 23%

    vmware · vrealize log insightJan 26, 2023

  • CVE-2022-3094
    34Monitor

    An UPDATE message flood may cause named to exhaust all available memory

    HighCVSS 7.5No exploitEPSS 13%

    isc · bindJan 26, 2023

  • CVE-2022-3488
    36Monitor

    named may terminate unexpectedly when processing ECS options in repeated responses to iterative queries

    HighCVSS 7.5No exploitEPSS 19%

    isc · bindJan 26, 2023

  • CVE-2022-3736
    45Plan

    named configured to answer from stale cache may terminate unexpectedly while processing RRSIG queries

    HighCVSS 7.5No exploitEPSS 48%

    isc · bindJan 26, 2023

  • CVE-2022-3924
    35Monitor

    named configured to answer from stale cache may terminate unexpectedly at recursive-clients soft quota

    HighCVSS 7.5No exploitEPSS 16%

    isc · bindJan 26, 2023

  • CVE-2022-4510
    38Monitor

    Path Traversal in binwalk

    HighCVSS 7.8Proof of conceptEPSS 22%

    microsoft · binwalkJan 26, 2023

  • CVE-2023-0448
    37Monitor

    The WP Helper Lite WordPress plugin, in versions < 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected cro

    MediumCVSS 6.1Proof of conceptEPSS 42%

    matbao · wp helper premiumJan 26, 2023

  • CVE-2023-0562
    52Plan

    PHPGurukul Bank Locker Management System Login index.php sql injection

    CriticalCVSS 9.8Proof of conceptEPSS 44%

    phpgurukul · bank locker management systemJan 28, 2023

  • CVE-2023-0563
    30Monitor

    PHPGurukul Bank Locker Management System Assign Locker add-locker-form.php cross site scripting

    MediumCVSS 4.8Proof of conceptEPSS 37%

    phpgurukul · bank locker management systemJan 28, 2023

  • CVE-2023-0266
    59Plan

    Use after free in SNDRV_CTL_IOCTL_ELEM in Linux Kernel

    HighCVSS 7.0KEVWeaponizedEPSS 3%

    linux · linux kernelJan 30, 2023

  • CVE-2022-4395
    44Plan

    Membership For WooCommerce < 2.1.7 - Unauthenticated Arbitrary File Upload

    CriticalCVSS 9.8Proof of conceptEPSS 17%

    wpswings · membership for woocommerceJan 30, 2023

  • CVE-2023-0587
    54Plan

    A file upload vulnerability in exists in Trend Micro Apex One server build 11110.

    CriticalCVSS 9.1No exploitEPSS 59%

    trendmicro · apex oneJan 31, 2023