Security Vulnerabilities - CVEs Published In January 2023
Versions of the package servst before 2.0.3 are vulnerable to Directory Traversal due to improper sanitization of the filePath variable.
CVSS Score
7.5
EPSS Score
0.004
Published
2023-01-30
Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution (RCE) by overwriting template engine configuration variables with view options received from The Express render API.
**Note:** This is exploitable only for users who are rendering templates with user-defined data.
CVSS Score
8.1
EPSS Score
0.05
Published
2023-01-30
isInList in the safeurl-python package before 1.2 for Python has an insufficiently restrictive regular expression for external domains, leading to SSRF.
CVSS Score
5.3
EPSS Score
0.002
Published
2023-01-30
Paranoidhttp before 0.3.0 allows SSRF because [::] is equivalent to the 127.0.0.1 address, but does not match the filter for private addresses.
CVSS Score
7.5
EPSS Score
0.001
Published
2023-01-30
GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.
CVSS Score
5.5
EPSS Score
0.0
Published
2023-01-30
The PdfBook extension through 2.0.5 before b07b6a64 for MediaWiki allows command injection via an option.
CVSS Score
9.8
EPSS Score
0.005
Published
2023-01-30
A vulnerability has been reported to affect QNAP device running QuTS hero, QTS. If exploited, this vulnerability allows remote attackers to inject malicious code.
We have already fixed this vulnerability in the following versions of QuTS hero, QTS:
QuTS hero h5.0.1.2248 build 20221215 and later
QTS 5.0.1.2234 build 20221201 and later
CVSS Score
9.8
EPSS Score
0.26
Published
2023-01-30
WireGuard, such as WireGuard 0.5.3 on Windows, does not fully account for the possibility that an adversary might be able to set a victim's system time to a future value, e.g., because unauthenticated NTP is used. This can lead to an outcome in which one static private key becomes permanently useless.
CVSS Score
5.3
EPSS Score
0.0
Published
2023-01-29
Unchecked Error Condition in GitHub repository froxlor/froxlor prior to 2.0.10.
CVSS Score
5.3
EPSS Score
0.001
Published
2023-01-29
NOSH 4a5cfdb allows stored XSS via the create user page. For example, a first name (of a physician, assistant, or billing user) can have a JavaScript payload that is executed upon visiting the /users/2/1 page. This may allow attackers to steal Protected Health Information because the product is for health charting.
CVSS Score
5.4
EPSS Score
0.001
Published
2023-01-29