# CVEs published 2022-12-13 222 CVEs were published on December 13, 2022: 15 critical, 121 high. 2 are now in CISA KEV. Days are UTC. - [CVE-2022-40264](https://cve.now/CVE-2022-40264.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ICONICS/Mitsubishi Electric GENESIS64… (CVSS 6.3, ICONICS and Mitsubishi Electric GENESIS64) - [CVE-2022-2660](https://cve.now/CVE-2022-2660.md): Delta Industrial Automation DIALink versions 1.4.0.0 and prior are vulnerable to the use of a hard-coded cryptographic key which could… (CVSS 9.8, Delta Electronics Industrial Automation DIALink) - [CVE-2022-2757](https://cve.now/CVE-2022-2757.md): Due to the lack of adequately implemented access-control rules, all versions Kingspan TMS300 CS are vulnerable to an attacker viewing and… (CVSS 9.8, Kingspan TMS300 CS) - [CVE-2022-38355](https://cve.now/CVE-2022-38355.md): Daikin SVMPC1 version 2.1.22 and prior and SVMPC2 version 1.2.3 and prior are vulnerable to attackers with access to the local area… (CVSS 7.5, Daikin SVMPC1 · Daikin SVMPC2) - [CVE-2022-41653](https://cve.now/CVE-2022-41653.md): Daikin SVMPC1 version 2.1.22 and prior and SVMPC2 version 1.2.3 and prior are vulnerable to an attacker obtaining user login credentials… (CVSS 9.8, Daikin SVMPC1 · Daikin SVMPC2) - [CVE-2022-2947](https://cve.now/CVE-2022-2947.md): Altair HyperView Player versions 2021.1.0.27 and prior perform operations on a memory buffer but can read from or write to a memory… (CVSS 7.8, Altair HyperView Player) - [CVE-2022-2949](https://cve.now/CVE-2022-2949.md): Altair HyperView Player versions 2021.1.0.27 and prior are vulnerable to the use of uninitialized memory vulnerability during parsing of… (CVSS 7.8, Altair HyperView Player) - [CVE-2022-23499](https://cve.now/CVE-2022-23499.md): Cross-Site Scripting Protection bypass in HTML Sanitizer (CVSS 6.1, TYPO3 html-sanitizer · typo3/html-sanitizer +1) - [CVE-2022-2950](https://cve.now/CVE-2022-2950.md): Altair HyperView Player versions 2021.1.0.27 and prior are vulnerable to the use of uninitialized memory vulnerability during parsing of… (CVSS 7.8, Altair HyperView Player) - [CVE-2022-2951](https://cve.now/CVE-2022-2951.md): Altair HyperView Player versions 2021.1.0.27 and prior are vulnerable to improper validation of array index vulnerability during… (CVSS 7.8, Altair HyperView Player) - [CVE-2022-4207](https://cve.now/CVE-2022-4207.md): The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several values that can be added to… (CVSS 5.5, biplob018 Image Hover Effects Ultimate) - [CVE-2022-4171](https://cve.now/CVE-2022-4171.md): demon image annotation \<= 5.0 - Improper Input Restriction Validation (CVSS 6.5, demonisblack demon image annotation) - [CVE-2022-46364](https://cve.now/CVE-2022-46364.md): Apache CXF SSRF Vulnerability (CVSS 9.8, Apache Software Foundation Apache CXF · org.apache.cxf:cxf-…) - [CVE-2022-3996](https://cve.now/CVE-2022-3996.md): X.509 Policy Constraints Double Locking (CVSS 7.5, OpenSSL · openssl-src) - [CVE-2022-46363](https://cve.now/CVE-2022-46363.md): Apache CXF directory listing / code exfiltration (CVSS 7.5, Apache Software Foundation Apache CXF · org.apache.cxf:cxf-…) - [CVE-2022-29580](https://cve.now/CVE-2022-29580.md): Path Traversal in Android Google Search App (CVSS 8.9, Android Google Search App) - [CVE-2022-38124](https://cve.now/CVE-2022-38124.md): Unwanted debug tool (CVSS 5.7, Secomea SiteManager) - [CVE-2022-23523](https://cve.now/CVE-2022-23523.md): rust-vmm linux-loader vulnerable to Out-of-bounds Read (CVSS 4.0, rust-vmm linux-loader · linux-loader) - [CVE-2022-4098](https://cve.now/CVE-2022-4098.md): Wiesemann & Theis: Multiple products prone to missing authentication through spoofing (CVSS 8.0, Wiesemann & Theis Com-Server ++ · Wiesemann & Theis Com… +14) - [CVE-2022-23505](https://cve.now/CVE-2022-23505.md): Passport-wsfed-saml2 vulnerable to Authentication Bypass for WSFed authentication (CVSS 5.3, auth0 passport-wsfed-saml2 · passport-wsfed-saml2) - [CVE-2022-23473](https://cve.now/CVE-2022-23473.md): Tuleap MediaWiki standalone "readers" can also edit pages (CVSS 4.3, Enalean tuleap) - [CVE-2022-46160](https://cve.now/CVE-2022-46160.md): Tuleap dashboards vulnerable to Incorrect Authorization (CVSS 4.3, Enalean tuleap) - [CVE-2022-41275](https://cve.now/CVE-2022-41275.md): In SAP Solution Manager (Enterprise Search) - versions 740, and 750, an unauthenticated attacker can generate a link that, if clicked by a… (CVSS 6.1, SAP Solution Manager) - [CVE-2022-41274](https://cve.now/CVE-2022-41274.md): SAP Disclosure Management - version 10.1, allows an authenticated attacker to exploit certain misconfigured application endpoints to read… (CVSS 6.5, SAP Disclosure Management) - [CVE-2022-41273](https://cve.now/CVE-2022-41273.md): Due to improper input sanitization in SAP Sourcing and SAP Contract Lifecycle Management - version 1100, an attacker can redirect a user… (CVSS 4.3, Sourcing and SAP Contract Lifecycle Management) - [CVE-2022-41272](https://cve.now/CVE-2022-41272.md): An unauthenticated attacker over the network can attach to an open interface exposed through JNDI by the User Defined Search (UDS) of SAP… (CVSS 9.9, SAP NetWeaver Process Integration) - [CVE-2022-41271](https://cve.now/CVE-2022-41271.md): An unauthenticated user can attach to an open interface exposed through JNDI by the Messaging System of SAP NetWeaver Process Integration… (CVSS 9.4, SAP NetWeaver Process Integration) - [CVE-2022-41268](https://cve.now/CVE-2022-41268.md): In some SAP standard roles in SAP Business Planning and Consolidation - versions - SAP\_BW 750, 751, 752, 753, 754, 755, 756, 757, DWCORE… (CVSS 8.5, SAP Business Planning and Consolidation) - [CVE-2022-41267](https://cve.now/CVE-2022-41267.md): SAP Business Objects Platform - versions 420, and 430, allows an attacker with normal BI user privileges to upload/replace any file on… (CVSS 9.9, SAP BusinessObjects Business Intelligence Platform) - [CVE-2022-41266](https://cve.now/CVE-2022-41266.md): Due to a lack of proper input validation, SAP Commerce Webservices 2.0 (Swagger UI) - versions 1905, 2005, 2105, 2011, 2205, allows… (CVSS 8.0, SAP Commerce Webservices) - [CVE-2022-41264](https://cve.now/CVE-2022-41264.md): Due to the unrestricted scope of the RFC function module, SAP BASIS - versions 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790… (CVSS 8.8, SAP BASIS) - [CVE-2019-25078](https://cve.now/CVE-2019-25078.md): pacparser pacparser.c pacparser\_find\_proxy buffer overflow (CVSS 5.3, pacparser) - [CVE-2021-0934](https://cve.now/CVE-2021-0934.md): In findAllDeAccounts of AccountsDb.java, there is a possible denial of service due to resource exhaustion. (CVSS 5.5, Android) - [CVE-2021-32415](https://cve.now/CVE-2021-32415.md): EXEMSI MSI Wrapper Versions prior to 10.0.50 and at least since version 6.0.91 will introduce a local privilege escalation vulnerability… (CVSS 7.8) - [CVE-2021-39660](https://cve.now/CVE-2021-39660.md): In TBD of TBD, there is a possible way to archive arbitrary code execution in kernel due to a race condition. (CVSS 7.0, Android) - [CVE-2021-40365](https://cve.now/CVE-2021-40365.md): Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a… (CVSS 7.5, Siemens SIMATIC Drive Controller CPU 1504D TF · Siemens… +60) - [CVE-2021-44693](https://cve.now/CVE-2021-44693.md): Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a… (CVSS 4.9, Siemens SIMATIC Drive Controller CPU 1504D TF · Siemens… +60) - [CVE-2021-44694](https://cve.now/CVE-2021-44694.md): Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a… (CVSS 5.5, Siemens SIMATIC Drive Controller CPU 1504D TF · Siemens… +60) - [CVE-2021-44695](https://cve.now/CVE-2021-44695.md): Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a… (CVSS 4.9, Siemens SIMATIC Drive Controller CPU 1504D TF · Siemens… +60) - [CVE-2022-20240](https://cve.now/CVE-2022-20240.md): In sOpAllowSystemRestrictionBypass of AppOpsManager.java, there is a possible leak of location information due to a missing permission… (CVSS 2.3, Android) - [CVE-2022-20411](https://cve.now/CVE-2022-20411.md): In avdt\_msg\_asmbl of avdt\_msg.cc, there is a possible out of bounds write due to a missing bounds check. (CVSS 8.8, Android) - [CVE-2022-20442](https://cve.now/CVE-2022-20442.md): In onCreate of ReviewPermissionsActivity.java, there is a possible way to grant permissions for a separate app with API level \< 23 due to… (CVSS 7.3, Android) - [CVE-2022-20449](https://cve.now/CVE-2022-20449.md): In writeApplicationRestrictionsLAr of UserManagerService.java, there is a possible overwrite of system files due to a path traversal error. (CVSS 4.4, Android) - [CVE-2022-20466](https://cve.now/CVE-2022-20466.md): In applyKeyguardFlags of NotificationShadeWindowControllerImpl.java, there is a possible way to observe the user's password on a secondary… (CVSS 5.5, Android) - [CVE-2022-20468](https://cve.now/CVE-2022-20468.md): In BNEP\_ConnectResp of bnep\_api.cc, there is a possible out of bounds read due to an incorrect bounds check. (CVSS 6.5, Android) - [CVE-2022-20469](https://cve.now/CVE-2022-20469.md): In avct\_lcb\_msg\_asmbl of avct\_lcb\_act.cc, there is a possible out of bounds write due to a missing bounds check. (CVSS 8.8, Android) - [CVE-2022-20470](https://cve.now/CVE-2022-20470.md): In bindRemoteViewsService of AppWidgetServiceImpl.java, there is a possible way to bypass background activity launch due to improper input… (CVSS 7.8, Android) - [CVE-2022-20471](https://cve.now/CVE-2022-20471.md): In SendIncDecRestoreCmdPart2 of NxpMfcReader.cc, there is a possible out of bounds read due to a missing bounds check. (CVSS 5.5, Android) - [CVE-2022-20472](https://cve.now/CVE-2022-20472.md): In toLanguageTag of LocaleListCache.cpp, there is a possible out of bounds read due to an incorrect bounds check. (CVSS 9.8, Android) - [CVE-2022-20473](https://cve.now/CVE-2022-20473.md): In toLanguageTag of LocaleListCache.cpp, there is a possible out of bounds read due to an incorrect bounds check. (CVSS 9.8, Android) - [CVE-2022-20474](https://cve.now/CVE-2022-20474.md): In readLazyValue of Parcel.java, there is a possible loading of arbitrary code into the System Settings app due to a confused deputy. (CVSS 7.8, Android) - [CVE-2022-20475](https://cve.now/CVE-2022-20475.md): In test of ResetTargetTaskHelper.java, there is a possible hijacking of any app which sets allowTaskReparenting="true" due to a confused… (CVSS 7.8, Android) - [CVE-2022-20476](https://cve.now/CVE-2022-20476.md): In setEnabledSetting of PackageManager.java, there is a possible way to get the device into an infinite reboot loop due to resource… (CVSS 5.5, Android) - [CVE-2022-20477](https://cve.now/CVE-2022-20477.md): In shouldHideNotification of KeyguardNotificationVisibilityProvider.kt, there is a possible way to show hidden notifications due to a… (CVSS 7.8, Android) - [CVE-2022-20478](https://cve.now/CVE-2022-20478.md): In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. (CVSS 7.8, Android) - [CVE-2022-20479](https://cve.now/CVE-2022-20479.md): In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. (CVSS 7.8, Android) - [CVE-2022-20480](https://cve.now/CVE-2022-20480.md): In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. (CVSS 7.8, Android) - [CVE-2022-20482](https://cve.now/CVE-2022-20482.md): In createNotificationChannel of NotificationManager.java, there is a possible way to make the device unusable and require factory reset… (CVSS 5.5, Android) - [CVE-2022-20483](https://cve.now/CVE-2022-20483.md): In several functions that parse avrc response in avrc\_pars\_ct.cc and related files, there are possible out of bounds reads due to integer… (CVSS 7.5, Android) - [CVE-2022-20484](https://cve.now/CVE-2022-20484.md): In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. (CVSS 7.8, Android) - [CVE-2022-20485](https://cve.now/CVE-2022-20485.md): In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. (CVSS 7.8, Android) - [CVE-2022-20486](https://cve.now/CVE-2022-20486.md): In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. (CVSS 7.8, Android) - [CVE-2022-20487](https://cve.now/CVE-2022-20487.md): In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. (CVSS 7.8, Android) - [CVE-2022-20488](https://cve.now/CVE-2022-20488.md): In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. (CVSS 7.8, Android) - [CVE-2022-20491](https://cve.now/CVE-2022-20491.md): In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. (CVSS 7.8, Android) - [CVE-2022-20495](https://cve.now/CVE-2022-20495.md): In getEnabledAccessibilityServiceList of AccessibilityManager.java, there is a possible way to hide an accessibility service due to a… (CVSS 7.8, Android) - [CVE-2022-20496](https://cve.now/CVE-2022-20496.md): In setDataSource of initMediaExtractor.cpp, there is a possibility of arbitrary code execution due to a use after free. (CVSS 5.5, Android) - [CVE-2022-20497](https://cve.now/CVE-2022-20497.md): In updatePublicMode of NotificationLockscreenUserManagerImpl.java, there is a possible way to reveal sensitive notifications on the… (CVSS 4.6, Android) - [CVE-2022-20498](https://cve.now/CVE-2022-20498.md): In fdt\_path\_offset\_namelen of fdt\_ro.c, there is a possible out of bounds read due to an incorrect bounds check. (CVSS 4.4, Android) - [CVE-2022-20500](https://cve.now/CVE-2022-20500.md): In loadFromXml of ShortcutPackage.java, there is a possible crash on boot due to an uncaught exception. (CVSS 5.5, Android) - [CVE-2022-20501](https://cve.now/CVE-2022-20501.md): In onCreate of EnableAccountPreferenceActivity.java, there is a possible way to mislead the user into enabling a malicious phone account… (CVSS 7.3, Android) - [CVE-2022-20502](https://cve.now/CVE-2022-20502.md): In GetResolvedMethod of entrypoint\_utils-inl.h, there is a possible use after free due to a stale cache. (CVSS 5.5, Android) - [CVE-2022-20611](https://cve.now/CVE-2022-20611.md): In deletePackageVersionedInternal of DeletePackageHelper.java, there is a possible way to bypass carrier restrictions due to a permissions… (CVSS 7.8, Android) - [CVE-2022-24480](https://cve.now/CVE-2022-24480.md): Outlook for Android Elevation of Privilege Vulnerability (CVSS 6.3, Microsoft Outlook for Android) - [CVE-2022-25672](https://cve.now/CVE-2022-25672.md): Denial of service in MODEM due to reachable assertion while processing SIB1 with invalid Bandwidth in Snapdragon Mobile (CVSS 7.5, Qualcomm Snapdragon Mobile) - [CVE-2022-25673](https://cve.now/CVE-2022-25673.md): Denial of service in MODEM due to reachable assertion while processing configuration from network in Snapdragon Mobile (CVSS 7.5, Qualcomm Snapdragon Mobile) - [CVE-2022-25675](https://cve.now/CVE-2022-25675.md): Denial of service due to reachable assertion in modem while processing filter rule from application client in Snapdragon Compute… (CVSS 5.5, Qualcomm Snapdragon Compute, Snapdragon Industrial IOT, Sna…) - [CVE-2022-25677](https://cve.now/CVE-2022-25677.md): Memory corruption in diag due to use after free while processing dci packet in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer… (CVSS 6.7, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…) - [CVE-2022-25681](https://cve.now/CVE-2022-25681.md): Possible memory corruption in kernel while performing memory access due to hypervisor not correctly invalidated the processor translation… (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…) - [CVE-2022-25682](https://cve.now/CVE-2022-25682.md): Memory corruption in MODEM UIM due to usage of out of range pointer offset while decoding command from card in Snapdragon Auto, Snapdragon… (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…) - [CVE-2022-25685](https://cve.now/CVE-2022-25685.md): Denial of service in Modem module due to improper authorization while error handling in Snapdragon Auto, Snapdragon Compute, Snapdragon… (CVSS 7.5, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…) - [CVE-2022-25689](https://cve.now/CVE-2022-25689.md): Denial of service in Modem due to reachable assertion in Snapdragon Mobile (CVSS 7.5, Qualcomm Snapdragon Mobile) - [CVE-2022-25691](https://cve.now/CVE-2022-25691.md): Denial of service in Modem due to reachable assertion while processing SIB1 with invalid SCS and bandwidth settings in Snapdragon Mobile (CVSS 7.5, Qualcomm Snapdragon Mobile) - [CVE-2022-25692](https://cve.now/CVE-2022-25692.md): Denial of service in Modem due to reachable assertion while processing the common config procedure in Snapdragon Auto, Snapdragon Compute… (CVSS 7.5, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon In…) - [CVE-2022-25695](https://cve.now/CVE-2022-25695.md): Memory corruption in MODEM due to Improper Validation of Array Index while processing GSTK Proactive commands in Snapdragon Auto… (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…) - [CVE-2022-25697](https://cve.now/CVE-2022-25697.md): Memory corruption in i2c buses due to improper input validation while reading address configuration from i2c driver in Snapdragon Mobile… (CVSS 8.4, Qualcomm Snapdragon Mobile, Snapdragon Wearables) - [CVE-2022-25698](https://cve.now/CVE-2022-25698.md): Memory corruption in SPI buses due to improper input validation while reading address configuration from spi buses in Snapdragon Mobile… (CVSS 8.4, Qualcomm Snapdragon Mobile, Snapdragon Wearables) - [CVE-2022-25702](https://cve.now/CVE-2022-25702.md): Denial of service in modem due to reachable assertion while processing reconfiguration message in Snapdragon Auto, Snapdragon Compute… (CVSS 7.5, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon In…) - [CVE-2022-25711](https://cve.now/CVE-2022-25711.md): Memory corruption in camera due to improper validation of array index in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT… (CVSS 6.7, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…) - [CVE-2022-25712](https://cve.now/CVE-2022-25712.md): Memory corruption in camera due to buffer copy without checking size of input in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer… (CVSS 6.7, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…) - [CVE-2022-26804](https://cve.now/CVE-2022-26804.md): Microsoft Office Graphics Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise) - [CVE-2022-26805](https://cve.now/CVE-2022-26805.md): Microsoft Office Graphics Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise) - [CVE-2022-26806](https://cve.now/CVE-2022-26806.md): Microsoft Office Graphics Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise) - [CVE-2022-27518](https://cve.now/CVE-2022-27518.md): Unauthenticated remote arbitrary code execution (CVSS 9.8, KEV, Citrix Gateway, Citrix ADC) - [CVE-2022-27581](https://cve.now/CVE-2022-27581.md): Use of a Broken or Risky Cryptographic Algorithm in SICK RFU61x firmware version \= 7.0 \< V8.06). (CVSS 7.5, Siemens SICAM PAS/PQS) - [CVE-2022-43724](https://cve.now/CVE-2022-43724.md): A vulnerability has been identified in SICAM PAS/PQS (All versions \< V7.0). (CVSS 9.8, Siemens SICAM PAS/PQS) - [CVE-2022-43996](https://cve.now/CVE-2022-43996.md): The csaf\_provider package before 0.8.2 allows XSS via a crafted CSAF document uploaded as text/html. (CVSS 5.4, github.com/csaf-poc/csaf\_distribution) - [CVE-2022-44303](https://cve.now/CVE-2022-44303.md): Resque Scheduler version 1.27.4 is vulnerable to Cross-site scripting (XSS). (CVSS 6.1, resque-scheduler) - [CVE-2022-4444](https://cve.now/CVE-2022-4444.md): ipti br.tag cross site scripting (CVSS 3.5, ipti br.tag) - [CVE-2022-4446](https://cve.now/CVE-2022-4446.md): PHP Remote File Inclusion in tsolucio/corebos (CVSS 9.8, tsolucio/corebos) - [CVE-2022-4454](https://cve.now/CVE-2022-4454.md): m0ver bible-online Search search.java query sql injection (CVSS 5.5, m0ver bible-online) - [CVE-2022-4455](https://cve.now/CVE-2022-4455.md): sproctor php-calendar index.php cross site scripting (CVSS 5.1, sproctor php-calendar) - [CVE-2022-4456](https://cve.now/CVE-2022-4456.md): falling-fruit cross site scripting (CVSS 3.5, falling-fruit) - [CVE-2022-44575](https://cve.now/CVE-2022-44575.md): A vulnerability has been identified in PLM Help Server V4.2 (All versions). (CVSS 6.1, Siemens PLM Help Server) - [CVE-2022-44636](https://cve.now/CVE-2022-44636.md): The Samsung TV (2021 and 2022 model) smart remote control allows attackers to enable microphone access via Bluetooth spoofing when a user… (CVSS 4.6) - [CVE-2022-44666](https://cve.now/CVE-2022-44666.md): Windows Contacts Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2022-44667](https://cve.now/CVE-2022-44667.md): Windows Media Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2022-44668](https://cve.now/CVE-2022-44668.md): Windows Media Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2022-44669](https://cve.now/CVE-2022-44669.md): Windows Error Reporting Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2022-44670](https://cve.now/CVE-2022-44670.md): Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows) - [CVE-2022-44671](https://cve.now/CVE-2022-44671.md): Windows Graphics Component Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2022-44673](https://cve.now/CVE-2022-44673.md): Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2022-44674](https://cve.now/CVE-2022-44674.md): Windows Bluetooth Driver Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2022-44675](https://cve.now/CVE-2022-44675.md): Windows Bluetooth Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2022-44676](https://cve.now/CVE-2022-44676.md): Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows) - [CVE-2022-44677](https://cve.now/CVE-2022-44677.md): Windows Projected File System Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2022-44678](https://cve.now/CVE-2022-44678.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2022-44679](https://cve.now/CVE-2022-44679.md): Windows Graphics Component Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows) - [CVE-2022-44680](https://cve.now/CVE-2022-44680.md): Windows Graphics Component Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2022-44681](https://cve.now/CVE-2022-44681.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2022-44682](https://cve.now/CVE-2022-44682.md): Windows Hyper-V Denial of Service Vulnerability (CVSS 6.8, Microsoft Windows) - [CVE-2022-44683](https://cve.now/CVE-2022-44683.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2022-44687](https://cve.now/CVE-2022-44687.md): Raw Image Extension Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Raw Image Extension) - [CVE-2022-44688](https://cve.now/CVE-2022-44688.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 4.3, Microsoft Edge) - [CVE-2022-44689](https://cve.now/CVE-2022-44689.md): Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2022-44690](https://cve.now/CVE-2022-44690.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft Share… +1) - [CVE-2022-44691](https://cve.now/CVE-2022-44691.md): Microsoft Office OneNote Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office LTSC · Microsoft 365 Apps for Enterprise +1) - [CVE-2022-44692](https://cve.now/CVE-2022-44692.md): Microsoft Office Graphics Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office 2019 for Mac · Microsoft 365 Apps for E… +2) - [CVE-2022-44693](https://cve.now/CVE-2022-44693.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft Share… +1) - [CVE-2022-44694](https://cve.now/CVE-2022-44694.md): Microsoft Office Visio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise) - [CVE-2022-44695](https://cve.now/CVE-2022-44695.md): Microsoft Office Visio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise +2) - [CVE-2022-44696](https://cve.now/CVE-2022-44696.md): Microsoft Office Visio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise) - [CVE-2022-44697](https://cve.now/CVE-2022-44697.md): Windows Graphics Component Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2022-44698](https://cve.now/CVE-2022-44698.md): Windows SmartScreen Security Feature Bypass Vulnerability (CVSS 5.4, KEV, Microsoft Windows) - [CVE-2022-44699](https://cve.now/CVE-2022-44699.md): Azure Network Watcher Agent Security Feature Bypass Vulnerability (CVSS 5.5, Microsoft Azure Network Watcher VM Extension) - [CVE-2022-44702](https://cve.now/CVE-2022-44702.md): Windows Terminal Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows Terminal for Windows) - [CVE-2022-44704](https://cve.now/CVE-2022-44704.md): Microsoft Windows System Monitor (Sysmon) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Sysmon) - [CVE-2022-44707](https://cve.now/CVE-2022-44707.md): Windows Kernel Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows) - [CVE-2022-44708](https://cve.now/CVE-2022-44708.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 8.3, Microsoft Edge for iOS · Microsoft Edge) - [CVE-2022-44710](https://cve.now/CVE-2022-44710.md): DirectX Graphics Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2022-44713](https://cve.now/CVE-2022-44713.md): Microsoft Outlook for Mac Spoofing Vulnerability (CVSS 7.5, Microsoft Office LTSC for Mac · Microsoft Office 2019 for M…) - [CVE-2022-44731](https://cve.now/CVE-2022-44731.md): A vulnerability has been identified in SIMATIC WinCC OA V3.15 (All versions \< V3.15 P038), SIMATIC WinCC OA V3.16 (All versions \< V3.16… (CVSS 5.4, Siemens SIMATIC WinCC OA) - [CVE-2022-44874](https://cve.now/CVE-2022-44874.md): wasm3 commit 7890a2097569fde845881e0b352d813573e371f9 was discovered to contain a segmentation fault via the component op\_CallIndirect at… (CVSS 5.5) - [CVE-2022-45005](https://cve.now/CVE-2022-45005.md): IP-COM EW9 V15.11.0.14(9732) was discovered to contain a command injection vulnerability in the cmd\_get\_ping\_output function. (CVSS 9.8) - [CVE-2022-45028](https://cve.now/CVE-2022-45028.md): A cross-site scripting (XSS) vulnerability in Arris NVG443B 9.3.0h3d36 allows attackers to execute arbitrary web scripts or HTML via a… (CVSS 6.1) - [CVE-2022-45044](https://cve.now/CVE-2022-45044.md): A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions \< V9.50), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC… (CVSS 5.3, Siemens SIPROTEC 5 6MD84 · Siemens SIPROTEC 5 6MD85 +38) - [CVE-2022-45484](https://cve.now/CVE-2022-45484.md): A vulnerability has been identified in JT2Go (All versions \< V14.1.0.6), Teamcenter Visualization V13.2 (All versions \< V13.2.0.12)… (CVSS 3.3, Siemens JT2Go · Siemens Teamcenter Visualization) - [CVE-2022-45685](https://cve.now/CVE-2022-45685.md): A stack overflow in Jettison before v1.5.2 allows attackers to cause a Denial of Service (DoS) via crafted JSON data. (CVSS 7.5, org.codehaus.jettison:jettison) - [CVE-2022-45688](https://cve.now/CVE-2022-45688.md): A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted… (CVSS 7.5, cn.hutool:hutool-json · org.json:json) - [CVE-2022-45689](https://cve.now/CVE-2022-45689.md): hutool-json v5.8.10 was discovered to contain an out of memory error. (CVSS 7.5, cn.hutool:hutool-json) - [CVE-2022-45690](https://cve.now/CVE-2022-45690.md): A stack overflow in the org.json.JSONTokener.nextValue::JSONTokener.java component of hutool-json v5.8.10 allows attackers to cause a… (CVSS 7.5, cn.hutool:hutool-json) - [CVE-2022-45693](https://cve.now/CVE-2022-45693.md): Jettison before v1.5.2 was discovered to contain a stack overflow via the map parameter. (CVSS 7.5, org.codehaus.jettison:jettison) - [CVE-2022-45871](https://cve.now/CVE-2022-45871.md): Denial-of-Service (DoS) Vulnerability (CVSS 4.3) - [CVE-2022-45936](https://cve.now/CVE-2022-45936.md): A vulnerability has been identified in Mendix Email Connector (All versions \< V2.0.0). (CVSS 8.1, Siemens Mendix Email Connector) - [CVE-2022-45937](https://cve.now/CVE-2022-45937.md): A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions \< V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions… (CVSS 8.8, Siemens APOGEE PXC Compact · Siemens APOGEE PXC Modular +2) - [CVE-2022-46047](https://cve.now/CVE-2022-46047.md): AeroCMS v0.0.1 is vulnerable to SQL Injection via the delete parameter. (CVSS 4.9) - [CVE-2022-46051](https://cve.now/CVE-2022-46051.md): The approve parameter from the AeroCMS-v0.0.1 CMS system is vulnerable to SQL injection attacks. (CVSS 7.2) - [CVE-2022-46058](https://cve.now/CVE-2022-46058.md): AeroCMS v0.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via add\_post.php. (CVSS 4.8) - [CVE-2022-46059](https://cve.now/CVE-2022-46059.md): AeroCMS v0.0.1 is vulnerable to Cross Site Request Forgery (CSRF). (CVSS 6.5) - [CVE-2022-46061](https://cve.now/CVE-2022-46061.md): AeroCMS v0.0.1 is vulnerable to ClickJacking. (CVSS 6.1) - [CVE-2022-46062](https://cve.now/CVE-2022-46062.md): Gym Management System v0.0.1 is vulnerable to Cross Site Request Forgery (CSRF). (CVSS 4.5) - [CVE-2022-46140](https://cve.now/CVE-2022-46140.md): Affected devices use a weak encryption scheme to encrypt the debug zip file. (CVSS 6.5, Siemens RUGGEDCOM RM1224 LTE(4G) EU · Siemens RUGGEDCOM… +87) - [CVE-2022-46142](https://cve.now/CVE-2022-46142.md): Affected devices store the CLI user passwords encrypted in flash memory. (CVSS 5.7, Siemens RUGGEDCOM RM1224 LTE(4G) EU · Siemens RUGGEDCOM… +87) - [CVE-2022-46143](https://cve.now/CVE-2022-46143.md): Affected devices do not check the TFTP blocksize correctly. (CVSS 2.7, Siemens RUGGEDCOM RM1224 LTE(4G) EU · Siemens RUGGEDCOM… +89) - [CVE-2022-46144](https://cve.now/CVE-2022-46144.md): A vulnerability has been identified in SCALANCE SC622-2C (6GK5622-2GS00-2AC2) (All versions \< V2.3), SCALANCE SC622-2C… (CVSS 6.5, Siemens SCALANCE SC622-2C · Siemens SCALANCE SC626-2C +8) - [CVE-2022-46265](https://cve.now/CVE-2022-46265.md): A vulnerability has been identified in Polarion ALM (All versions \< V2304.0). (CVSS 5.4, Siemens Polarion ALM) - [CVE-2022-46345](https://cve.now/CVE-2022-46345.md): A vulnerability has been identified in Parasolid V33.1 (All versions \< V33.1.264), Parasolid V34.0 (All versions \< V34.0.252), Parasolid… (CVSS 7.8, Siemens Parasolid · Siemens Solid Edge SE2022 +1) - [CVE-2022-46346](https://cve.now/CVE-2022-46346.md): A vulnerability has been identified in Parasolid V33.1 (All versions \< V33.1.264), Parasolid V34.0 (All versions \< V34.0.252), Parasolid… (CVSS 7.8, Siemens Parasolid · Siemens Solid Edge SE2022 +1) - [CVE-2022-46347](https://cve.now/CVE-2022-46347.md): A vulnerability has been identified in Parasolid V33.1 (All versions \< V33.1.264), Parasolid V34.0 (All versions \< V34.0.252), Parasolid… (CVSS 7.8, Siemens Parasolid · Siemens Solid Edge SE2022 +1) - [CVE-2022-46348](https://cve.now/CVE-2022-46348.md): A vulnerability has been identified in Parasolid V33.1 (All versions \< V33.1.264), Parasolid V34.0 (All versions \< V34.0.252), Parasolid… (CVSS 7.8, Siemens Parasolid · Siemens Solid Edge SE2022 +1) - [CVE-2022-46349](https://cve.now/CVE-2022-46349.md): A vulnerability has been identified in Parasolid V33.1 (All versions \< V33.1.264), Parasolid V34.0 (All versions \< V34.0.252), Parasolid… (CVSS 7.8, Siemens Parasolid · Siemens Solid Edge SE2022 +1) - [CVE-2022-46350](https://cve.now/CVE-2022-46350.md): A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions \< V3.2.7), SCALANCE X204RNA (PRP) (All versions \< V3.2.7)… (CVSS 6.1, Siemens SCALANCE X204RNA) - [CVE-2022-46351](https://cve.now/CVE-2022-46351.md): A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions \< V3.2.7), SCALANCE X204RNA (PRP) (All versions \< V3.2.7)… (CVSS 5.5, Siemens SCALANCE X204RNA) - [CVE-2022-46352](https://cve.now/CVE-2022-46352.md): A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions \< V3.2.7), SCALANCE X204RNA (PRP) (All versions \< V3.2.7)… (CVSS 7.5, Siemens SCALANCE X204RNA) - [CVE-2022-46353](https://cve.now/CVE-2022-46353.md): A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions \< V3.2.7), SCALANCE X204RNA (PRP) (All versions \< V3.2.7)… (CVSS 9.8, Siemens SCALANCE X204RNA) - [CVE-2022-46354](https://cve.now/CVE-2022-46354.md): A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions \< V3.2.7), SCALANCE X204RNA (PRP) (All versions \< V3.2.7)… (CVSS 5.3, Siemens SCALANCE X204RNA) - [CVE-2022-46355](https://cve.now/CVE-2022-46355.md): A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions \< V3.2.7), SCALANCE X204RNA (PRP) (All versions \< V3.2.7)… (CVSS 7.5, Siemens SCALANCE X204RNA) - [CVE-2022-46381](https://cve.now/CVE-2022-46381.md): Certain Linear eMerge E3-Series devices are vulnerable to XSS via the type parameter (e.g., to the badging/badge\_template\_v0.php component). (CVSS 6.1) - [CVE-2022-46404](https://cve.now/CVE-2022-46404.md): A command injection vulnerability has been identified in Atos Unify OpenScape 4000 Assistant and Unify OpenScape 4000 Manager (8 before… (CVSS 9.8) - [CVE-2022-46664](https://cve.now/CVE-2022-46664.md): A vulnerability has been identified in Mendix Workflow Commons (All versions \< V2.4.0), Mendix Workflow Commons V2.1 (All versions \<… (CVSS 8.1, Siemens Mendix Workflow Commons) - [CVE-2022-46832](https://cve.now/CVE-2022-46832.md): Use of a Broken or Risky Cryptographic Algorithm in SICK RFU62x firmware version \< 2.21 allows a low-privileged remote attacker to decrypt… (CVSS 6.5, SICK RFU62x Firmware) - [CVE-2022-46833](https://cve.now/CVE-2022-46833.md): Use of a Broken or Risky Cryptographic Algorithm in SICK RFU63x firmware version \< v2.21 allows a low-privileged remote attacker to… (CVSS 6.5, SICK RFU63x Firmware) - [CVE-2022-46834](https://cve.now/CVE-2022-46834.md): Use of a Broken or Risky Cryptographic Algorithm in SICK RFU65x firmware version \< v2.21 allows a low-privileged remote attacker to… (CVSS 6.5, SICK RFU65x Firmware) - [CVE-2022-47211](https://cve.now/CVE-2022-47211.md): Microsoft Office Graphics Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise) - [CVE-2022-47212](https://cve.now/CVE-2022-47212.md): Microsoft Office Graphics Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise) - [CVE-2022-47213](https://cve.now/CVE-2022-47213.md): Microsoft Office Graphics Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/archive/2022-12-13 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.