Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: February 2023

90 records · 10 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2023-22374
    56Plan

    iControl SOAP vulnerability

    HighCVSS 8.5No exploitEPSS 72%

    f5 · big-ip access policy managerFeb 1, 2023

  • CVE-2023-22501
    41Plan

    An authentication vulnerability was discovered in Jira Service Management Server and Data Center which allows an attacker to impersonate ano

    CriticalCVSS 9.1No exploitEPSS 15%

    atlassian · jira service managementFeb 1, 2023

  • CVE-2023-23969
    44Plan

    In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avo

    HighCVSS 7.5No exploitEPSS 47%

    djangoproject · djangoFeb 1, 2023

  • CVE-2023-23074
    49Plan

    Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via embedding videos in the language component.

    MediumCVSS 6.1No exploitEPSS 83%

    zohocorp · manageengine servicedesk plusFeb 1, 2023

  • CVE-2023-23076
    61This week

    OS Command injection vulnerability in Support Center Plus 11 via Executor in Action when creating new schedules.

    CriticalCVSS 9.8No exploitEPSS 74%

    zohocorp · manageengine supportcenter plusFeb 1, 2023

  • CVE-2022-46552
    38Monitor

    D-Link DIR-846 Firmware FW100A53DBR was discovered to contain a remote command execution (RCE) vulnerability via the lan(0)_dhcps_staticlist

    HighCVSS 8.8Proof of conceptEPSS 10%

    dlink · dir-846 firmwareFeb 2, 2023

  • CVE-2023-25135
    46Plan

    vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers dese

    CriticalCVSS 9.8Proof of conceptEPSS 23%

    vbulletin · vbulletinFeb 3, 2023

  • CVE-2023-25136
    53Plan

    OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling.

    MediumCVSS 6.5Proof of conceptEPSS 89%

    openbsd · opensshFeb 3, 2023

  • CVE-2023-0678
    32Monitor

    Missing Authorization in phpipam/phpipam

    MediumCVSS 5.3Proof of conceptEPSS 37%

    phpipam · phpipamFeb 4, 2023

  • CVE-2022-47071
    47Plan

    In NVS365 V01, the background network test function can trigger command execution.

    CriticalCVSS 9.8No exploitEPSS 25%

    nvs365 · nvs-365-v01 firmwareFeb 6, 2023

  • CVE-2023-0234
    40Plan

    SiteGround Security < 1.3.1 - Admin+ SQLi

    HighCVSS 8.8No exploitEPSS 17%

    siteground · siteground securityFeb 6, 2023

  • CVE-2023-0669
    88Now

    Fortra GoAnywhere MFT License Response Servlet Command Injection

    HighCVSS 7.2KEVWeaponizedEPSS 99%

    fortra · goanywhere managed file transferFeb 6, 2023

  • CVE-2022-44267
    49Plan

    ImageMagick 7.1.0-49 is vulnerable to Denial of Service.

    MediumCVSS 6.5Proof of conceptEPSS 76%

    imagemagick · imagemagickFeb 6, 2023

  • CVE-2022-44268
    53Plan

    ImageMagick 7.1.0-49 is vulnerable to Information Disclosure.

    MediumCVSS 6.5Proof of conceptEPSS 89%

    imagemagick · imagemagickFeb 6, 2023

  • CVE-2023-23333
    69This week

    There is a command injection vulnerability in SolarView Compact through 6.00, attackers can execute commands by bypassing internal restricti

    CriticalCVSS 9.8WeaponizedEPSS 99%

    contec · solarview compact firmwareFeb 6, 2023

  • CVE-2022-3229
    60This week

    Because the web management interface for Unified Intents' Unified Remote solution does not itself require authentication, a remote, unauthen

    CriticalCVSS 9.8WeaponizedEPSS 66%

    unifiedremote · unified remoteFeb 6, 2023

  • CVE-2022-40224
    49Plan

    A denial of service vulnerability exists in the web server functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1.

    HighCVSS 7.5No exploitEPSS 64%

    moxa · sds-3008 firmwareFeb 7, 2023

  • CVE-2022-24990
    85Now

    TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/a

    HighCVSS 7.5KEVWeaponizedEPSS 83%

    terra-master · terramaster operating systemFeb 7, 2023

  • CVE-2023-25194
    64This week

    Apache Kafka Connect API: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration using Kafka Connect

    HighCVSS 8.8WeaponizedEPSS 95%

    apache · kafka connectFeb 7, 2023

  • CVE-2022-45768
    44Plan

    Command Injection vulnerability in Edimax Technology Co., Ltd.

    HighCVSS 8.8No exploitEPSS 28%

    edimax · br-6428ns firmwareFeb 7, 2023

  • CVE-2022-4304
    30Monitor

    Timing Oracle in RSA Decryption

    MediumCVSS 5.9Proof of conceptEPSS 23%

    openssl · opensslFeb 8, 2023

  • CVE-2022-4450
    39Monitor

    Double free after calling PEM_read_bio_ex

    HighCVSS 7.5No exploitEPSS 28%

    openssl · opensslFeb 8, 2023

  • CVE-2023-0286
    50Plan

    X.400 address type confusion in X.509 GeneralName

    HighCVSS 7.4No exploitEPSS 71%

    openssl · opensslFeb 8, 2023

  • CVE-2023-21434
    28Monitor

    Improper input validation vulnerability in Galaxy Store prior to version 4.5.49.8 allows local attackers to execute JavaScript by launching

    MediumCVSS 6.1No exploitEPSS 12%

    samsung · galaxy storeFeb 9, 2023

  • CVE-2023-24322
    34Monitor

    A reflected cross-site scripting (XSS) vulnerability in the FileDialog.aspx component of mojoPortal v2.7.0.0 allows attackers to execute arb

    MediumCVSS 6.1Proof of conceptEPSS 31%

    mojoportal · mojoportalFeb 9, 2023

  • CVE-2022-45699
    62This week

    Command injection in the administration interface in APSystems ECU-R version 5203 allows a remote unauthenticated attacker to execute arbitr

    CriticalCVSS 9.8Proof of conceptEPSS 76%

    apsystems · ecu-r firmwareFeb 9, 2023

  • CVE-2022-46649
    36Monitor

    Acemanager in ALEOS before version 4.16 allows a user with valid credentials to manipulate the IP logging operation to execute arbitrary she

    HighCVSS 8.8Proof of conceptEPSS 2%

    sierrawireless · aleosFeb 10, 2023

  • CVE-2022-46650
    23Monitor

    Acemanager in ALEOS before version 4.16 allows a user with valid credentials to reconfigure the device to expose the ACEManager credentials

    MediumCVSS 4.9No exploitEPSS 12%

    sierrawireless · aleosFeb 10, 2023

  • CVE-2023-0777
    44Plan

    Authentication Bypass by Primary Weakness in modoboa/modoboa

    CriticalCVSS 9.8Proof of conceptEPSS 15%

    modoboa · modoboaFeb 10, 2023

  • CVE-2022-48323
    56Plan

    Sunlogin Sunflower Simplified (aka Sunflower Simple and Personal) 1.0.1.43315 is vulnerable to a path traversal issue.

    CriticalCVSS 9.8Proof of conceptEPSS 56%

    sunlogin · sunflowerFeb 13, 2023

  • CVE-2022-40022
    67This week

    Microchip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability.

    CriticalCVSS 9.8WeaponizedEPSS 92%

    microchip · syncserver s650 firmwareFeb 13, 2023

  • CVE-2022-4830
    41Plan

    Paid Memberships Pro < 2.9.9 - Contributor+ Stored XSS via Shortcode

    MediumCVSS 5.4No exploitEPSS 65%

    strangerstudios · paid memberships proFeb 13, 2023

  • CVE-2023-0159
    47Plan

    Extensive VC Addons for WPBakery page builder < 1.9.1 - Unauthenticated RCE

    HighCVSS 7.5Proof of conceptEPSS 55%

    wprealize · extensive vc addons for wpbakery page builderFeb 13, 2023

  • CVE-2023-25717
    98Now

    Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin

    CriticalCVSS 9.8KEVWeaponizedEPSS 98%

    ruckuswireless · ruckus wireless adminFeb 13, 2023

  • CVE-2023-0830
    27Monitor

    EasyNAS backup.pl system os command injection

    MediumCVSS 5.3Proof of conceptEPSS 20%

    easynas · easynasFeb 14, 2023

  • CVE-2023-21529
    83Now

    Microsoft Exchange Server Remote Code Execution Vulnerability

    HighCVSS 8.8KEVWeaponizedEPSS 59%

    microsoft · exchange serverFeb 14, 2023

  • CVE-2023-21689
    47Plan

    Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability

    CriticalCVSS 9.8No exploitEPSS 26%

    microsoft · windows 10 1507Feb 14, 2023

  • CVE-2023-21690
    47Plan

    Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability

    CriticalCVSS 9.8No exploitEPSS 27%

    microsoft · windows 10 1507Feb 14, 2023

  • CVE-2023-21692
    45Plan

    Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability

    CriticalCVSS 9.8No exploitEPSS 21%

    microsoft · windows 10 1507Feb 14, 2023

  • CVE-2023-21707
    60This week

    Microsoft Exchange Server Remote Code Execution Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 82%

    microsoft · exchange serverFeb 14, 2023

  • CVE-2023-21715
    63This week

    Microsoft Publisher Security Feature Bypass Vulnerability

    HighCVSS 7.3KEVWeaponizedEPSS 12%

    microsoft · 365 appsFeb 14, 2023

  • CVE-2023-21716
    64This week

    Microsoft Word Remote Code Execution Vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 84%

    microsoft · officeFeb 14, 2023

  • CVE-2023-21806
    32Monitor

    Power BI Report Server Spoofing Vulnerability

    HighCVSS 8.2No exploitEPSS 0%

    microsoft · power bi report serverFeb 14, 2023

  • CVE-2023-21818
    43Plan

    Windows Secure Channel Denial of Service Vulnerability

    HighCVSS 7.5No exploitEPSS 43%

    microsoft · windows 10Feb 14, 2023

  • CVE-2023-21819
    39Monitor

    Windows Secure Channel Denial of Service Vulnerability

    HighCVSS 7.5No exploitEPSS 30%

    microsoft · windows 10 1809Feb 14, 2023

  • CVE-2023-22629
    39Monitor

    An issue was discovered in TitanFTP through 1.94.1205.

    HighCVSS 8.8Proof of conceptEPSS 12%

    southrivertech · titan ftp serverFeb 14, 2023

  • CVE-2023-23376
    64This week

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 10%

    microsoft · windows 10 1507Feb 14, 2023

  • CVE-2023-21823
    63This week

    Windows Graphics Component Remote Code Execution Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 5%

    microsoft · windows 10 1507Feb 14, 2023

  • CVE-2023-24580
    49Plan

    An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7.

    HighCVSS 7.5No exploitEPSS 62%

    djangoproject · djangoFeb 14, 2023

  • CVE-2023-25762
    45Plan

    Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Gener

    MediumCVSS 5.4No exploitEPSS 81%

    jenkins · pipeline\Feb 15, 2023

  • CVE-2022-38111
    53Plan

    SolarWinds Platform Deserialization of Untrusted Data Vulnerability

    HighCVSS 7.2No exploitEPSS 84%

    solarwinds · orion platformFeb 15, 2023

  • CVE-2022-47503
    35Monitor

    SolarWinds Platform Deserialization of Untrusted Data Vulnerability

    HighCVSS 7.2No exploitEPSS 24%

    solarwinds · orion platformFeb 15, 2023

  • CVE-2022-47504
    36Monitor

    SolarWinds Platform Deserialization of Untrusted Data Vulnerability

    HighCVSS 7.2No exploitEPSS 25%

    solarwinds · orion platformFeb 15, 2023

  • CVE-2023-23836
    52Plan

    SolarWinds Platform Deserialization of Untrusted Data Vulnerability

    HighCVSS 7.2No exploitEPSS 80%

    solarwinds · orion platformFeb 15, 2023

  • CVE-2023-22855
    43Plan

    Kardex Mlog MCC 5.7.12+0-a203c2a213-master allows remote code execution.

    CriticalCVSS 9.8Proof of conceptEPSS 14%

    kardex · kardex control centerFeb 15, 2023

  • CVE-2023-0861
    44Plan

    Authenticated Command Injection in NetModule NSRW

    HighCVSS 8.8Proof of conceptEPSS 28%

    netmodule · netmodule router softwareFeb 16, 2023

  • CVE-2023-22579
    35Monitor

    Sequalize - Unsafe fall-through in getWhereConditions

    HighCVSS 8.8No exploitEPSS 0%

    sequelizejs · sequelizeFeb 16, 2023

  • CVE-2023-23752
    81Now

    [20230201] - Core - Improper access check in webservice endpoints

    MediumCVSS 5.3KEVWeaponizedEPSS 99%

    joomla · joomla\!Feb 16, 2023

  • CVE-2021-42756
    49Plan

    Multiple stack-based buffer overflow vulnerabilities [CWE-121] in the proxy daemon of FortiWeb 5.x all versions, 6.0.7 and below, 6.1.2 and

    CriticalCVSS 9.8Proof of conceptEPSS 34%

    fortinet · fortiwebFeb 16, 2023

  • CVE-2022-39952
    69This week

    A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11,

    CriticalCVSS 9.8WeaponizedEPSS 99%

    fortinet · fortinacFeb 16, 2023

  • CVE-2023-24078
    51Plan

    Real Time Logic FuguHub v8.1 and earlier was discovered to contain a remote code execution (RCE) vulnerability via the component /FuguHub/cm

    HighCVSS 8.8Proof of conceptEPSS 52%

    realtimelogic · fuguhubFeb 17, 2023

  • CVE-2022-40032
    45Plan

    SQL Injection vulnerability in Simple Task Managing System version 1.0 in login.php in 'username' and 'password' parameters, allows attacker

    CriticalCVSS 9.8Proof of conceptEPSS 20%

    simple task managing system project · simple task managing systemFeb 17, 2023

  • CVE-2022-45701
    48Plan

    Arris TG2482A firmware through 9.1.103GEM9 allow Remote Code Execution (RCE) via the ping utility feature.

    HighCVSS 8.8Proof of conceptEPSS 42%

    commscope · arris tg2482a firmwareFeb 17, 2023

  • CVE-2022-47986
    99Now

    IBM Aspera Faspex code execution

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    ibm · aspera faspexFeb 17, 2023

  • CVE-2021-33391
    39Monitor

    An issue in HTACG HTML Tidy v5.7.28 allows attacker to execute arbitrary code via the -g option of the CleanNode() function in gdoc.c.

    CriticalCVSS 9.8No exploitEPSS 1%

    htacg · tidyFeb 17, 2023

  • CVE-2023-24329
    36Monitor

    An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that start

    HighCVSS 7.5Proof of conceptEPSS 20%

    python · pythonFeb 17, 2023

  • CVE-2023-22232
    46Plan

    Adobe Connect Improper Access Control Security feature bypass

    MediumCVSS 5.3Proof of conceptEPSS 83%

    adobe · connectFeb 17, 2023

  • CVE-2023-24998
    45Plan

    Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts

    HighCVSS 7.5Proof of conceptEPSS 48%

    apache · commons fileuploadFeb 20, 2023

  • CVE-2023-25157
    65This week

    Unfiltered SQL Injection Vulnerabilities in Geoserver

    CriticalCVSS 9.8Proof of conceptEPSS 85%

    osgeo · geoserverFeb 21, 2023

  • CVE-2023-20858
    33Monitor

    VMware Carbon Black App Control 8.7.x prior to 8.7.8, 8.8.x prior to 8.8.6, and 8.9.x.prior to 8.9.4 contain an injection vulnerability.

    HighCVSS 7.2No exploitEPSS 16%

    vmware · carbon black app controlFeb 21, 2023

  • CVE-2022-29273
    42Plan

    pfSense CE through 2.6.0 and pfSense Plus before 22.05 allow XSS in the WebGUI via URL Table Alias URL parameters.

    MediumCVSS 6.1No exploitEPSS 59%

    netgate · pfsenseFeb 22, 2023

  • CVE-2023-0104
    38Monitor

    The listed versions for Weintek EasyBuilder Pro are vulnerable to a ZipSlip attack caused by decompiling a malicious project file.

    HighCVSS 7.8No exploitEPSS 21%

    weintek · easybuilder proFeb 22, 2023

  • CVE-2022-48343
    42Plan

    In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the user creation process.

    MediumCVSS 6.1No exploitEPSS 59%

    jetbrains · teamcityFeb 23, 2023

  • CVE-2023-0755
    43Plan

    The affected products are vulnerable to an improper validation of array index, which could allow an attacker to crash the server and remote

    CriticalCVSS 9.8No exploitEPSS 11%

    ge · digital industrial gateway serverFeb 23, 2023

  • CVE-2023-1009
    27Monitor

    DrayTek Vigor 2960 Web Management Interface mainfunction.cgi sub_1DF14 path traversal

    MediumCVSS 5.5No exploitEPSS 15%

    draytek · vigor2960 firmwareFeb 24, 2023

  • CVE-2023-1034
    43Plan

    Path Traversal: '\..\filename' in salesagility/suitecrm

    HighCVSS 8.8No exploitEPSS 26%

    salesagility · suitecrmFeb 24, 2023

  • CVE-2023-26035
    63This week

    ZoneMinder vulnerable to Missing Authorization

    CriticalCVSS 9.8WeaponizedEPSS 80%

    zoneminder · zoneminderFeb 24, 2023

  • CVE-2022-2024
    68This week

    OS Command Injection in gogs/gogs

    CriticalCVSS 9.8No exploitEPSS 97%

    gogs · gogsFeb 25, 2023

  • CVE-2023-26602
    44Plan

    ASUS ASMB8 iKVM firmware through 1.14.51 allows remote attackers to execute arbitrary code by using SNMP to create extensions, as demonstrat

    CriticalCVSS 9.8Proof of conceptEPSS 17%

    asus · asmb8-ikvm firmwareFeb 26, 2023

  • CVE-2023-26609
    40Plan

    ABUS TVIP 20000-21150 devices allows remote attackers to execute arbitrary code via shell metacharacters in the /cgi-bin/mft/wireless_mft ap

    HighCVSS 7.2Proof of conceptEPSS 38%

    abus · tvip 20000-21150 firmwareFeb 26, 2023

  • CVE-2023-0552
    28Monitor

    Pie Register < 3.8.2.3 - Open Redirect

    MediumCVSS 5.4Proof of conceptEPSS 24%

    genetechsolutions · pie registerFeb 27, 2023

  • CVE-2023-25234
    44Plan

    Tenda AC500 V2.0.1.9(1307) is vulnerable to Buffer Overflow in function fromAddressNat via parameters entrys and mitInterface.

    CriticalCVSS 9.8Proof of conceptEPSS 16%

    tenda · ac500 firmwareFeb 27, 2023

  • CVE-2023-25235
    33Monitor

    Tenda AC500 V2.0.1.9(1307) is vulnerable to Buffer Overflow in function formOneSsidCfgSet via parameter ssid.

    HighCVSS 7.5No exploitEPSS 11%

    tenda · ac500 firmwareFeb 27, 2023

  • CVE-2022-22582
    27Monitor

    A validation issue existed in the handling of symlinks.

    MediumCVSS 5.5Proof of conceptEPSS 17%

    apple · mac os xFeb 27, 2023

  • CVE-2023-23529
    68This week

    A type confusion issue was addressed with improved checks.

    HighCVSS 8.8KEVWeaponizedEPSS 9%

    apple · safariFeb 27, 2023

  • CVE-2023-26255
    44Plan

    An unauthenticated path traversal vulnerability affects the "STAGIL Navigation for Jira - Menu & Themes" plugin before 2.0.52 for Jira.

    HighCVSS 7.5Proof of conceptEPSS 47%

    stagil · stagil navigationFeb 28, 2023

  • CVE-2023-26256
    33Monitor

    An unauthenticated path traversal vulnerability affects the "STAGIL Navigation for Jira - Menu & Themes" plugin before 2.0.52 for Jira.

    HighCVSS 7.5Proof of conceptEPSS 11%

    stagil · stagil navigationFeb 28, 2023

  • CVE-2023-27293
    41Plan

    Improper neutralization of input during web page generation allows an unauthenticated attacker to submit malicious Javascript as the answer

    MediumCVSS 6.1No exploitEPSS 57%

    opencats · opencatsFeb 28, 2023

  • CVE-2023-27372
    69This week

    SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled.

    CriticalCVSS 9.8WeaponizedEPSS 99%

    spip · spipFeb 28, 2023

  • CVE-2022-47075
    48Plan

    An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to download sensitive information via the action name paramet

    HighCVSS 7.5Proof of conceptEPSS 59%

    smartofficepayroll · smartofficeFeb 28, 2023