CVEs published December 1, 2022
47 CVEs were published on December 1, 2022: 7 critical, 14 high.
- Published
- 47
- Critical
- 7
- High
- 14
- Medium
- 17
- Low
- 9
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 20
Most affected products
- Sophos Firewall
- 6
- Movie Ticket Booking System
- 5
- nextcloud security-advisories
- 4
- IBM Db2U
- 2
- SourceCodester Canteen Management System
- 2
- Symantec Endpoint Protection
- 2
- thinkcmf/thinkcmf
- 2
- Asus NAS-M25
- 1
- Axiell Iguana
- 1
- C-DATA Web Management System
- 1
Critical 7
- CVE-2022-3270Incomplete Documentation of remote functions in FESTO products.Festo SE Bus module CPX-E-EP · Festo SE Bus node CPX-FB… +53
- CVE-2022-4221OS command injection in ASUS M25 NASAsus NAS-M25
- CVE-2022-30528SQL Injection vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to execute arbitr
- CVE-2022-36431An arbitrary file upload vulnerability in Rocket TRUfusion Enterprise before 7.9.6.1 allows unauthenticated attackers to execute arbitrary c
- CVE-2022-37016Symantec Endpoint Protection (Windows) agent may be susceptible to a Privilege Escalation vulnerability, which is a type of issue whereby anSymantec Endpoint Protection
- CVE-2022-43333Telenia Software s.r.l TVox before v22.0.17 was discovered to contain a remote code execution (RCE) vulnerability in the component action_ex
- CVE-2022-44262ff4j 1.8.1 is vulnerable to Remote Code Execution (RCE).org.ff4j:ff4j-core
High 14
- CVE-2022-2969ICSA-22-307-03 Delta Industrial Automation DIALink Path traversalDelta Industrial Automation DIALink
- CVE-2022-45797An arbitrary file deletion vulnerability in the Damage Cleanup Engine component of Trend Micro Apex One and Trend Micro Apex One as a ServicTrend Micro Apex One
- CVE-2022-1471Remote Code execution in SnakeYAMLSnakeYAML · org.yaml:snakeyaml
- CVE-2022-28607An issue was discovered in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to gain sensitive inf
- CVE-2022-3226An OS command injection vulnerability allows admins to execute code via SSL VPN configuration uploads in Sophos Firewall releases older thanSophos Firewall
- CVE-2022-35120IXPdata EasyInstall 6.6.14725 contains an access control issue.
- CVE-2022-3696A post-auth code injection vulnerability allows admins to execute code in Webadmin of Sophos Firewall releases older than version 19.5 GA.Sophos Firewall
- CVE-2022-37017Symantec Endpoint Protection (Windows) agent, prior to 14.3 RU6/14.3 RU5 Patch 1, may be susceptible to a Security Control Bypass vulnerabilSymantec Endpoint Protection
- CVE-2022-3713A code injection vulnerability allows adjacent attackers to execute code in the Wifi controller of Sophos Firewall releases older than versiSophos Firewall
- CVE-2022-40489ThinkCMF version 6.0.7 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows a Super Administrator user to be injectethinkcmf/thinkcmf
- CVE-2022-42718Incorrect default permissions in the installation folder for NI LabVIEW Command Line Interface (CLI) may allow an authenticated user to pote
- CVE-2022-44211In GL.iNet Goodcloud 1.1 Incorrect access control allows a remote attacker to access/change devices' settings.
- CVE-2022-45045Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.0000
- CVE-2022-45640Tenda Tenda AC6V1.0 V15.03.05.19 is affected by buffer overflow.
Medium, low and unrated 26
- CVE-2022-41971Nextcloud Talk guests can continue to receive video streams from call after being removed from a conversationnextcloud security-advisories
- CVE-2022-41970Nextcloud Server's disabled download shares still allow download through preview imagesnextcloud security-advisories
- CVE-2022-41969Nextcloud Server has no password length limit when creating a user as an administratornextcloud security-advisories
- CVE-2022-41968Nextcloud Server's calendar name length not validated before writing to databasenextcloud security-advisories
- CVE-2022-43901IBM WebSphere Automation for IBM Cloud Pak for Watson AIOps information disclosureIBM WebSphere Automation for Cloud Pak for Watson AIOps
- CVE-2022-43900IBM WebSphere Automation for IBM Cloud Pak for Watson AIOps security bypassWebSphere Automation for IBM Cloud Pak for Watson AIOps
- CVE-2022-41297IBM Db2U cross-site request forgeryIBM Db2U
- CVE-2022-41296IBM Db2U cross-site respect forgeryIBM Db2U
- CVE-2021-38997IBM API Connect HOST header injectionIBM API Connect
- CVE-2022-45050Reflected XSS in Axiell Iguana CMSAxiell Iguana
- CVE-2022-23737Improper Privilege Management in GitHub Enterprise Server leading to page creation and deletionGitHub Enterprise Server
- CVE-2022-29837Path traversal Vulnerability in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi DevicesWestern Digital My Cloud Home · SanDisk ibi
- CVE-2022-3709A stored XSS vulnerability allows admin to super-admin privilege escalation in the Webadmin import group wizard of Sophos Firewall releases Sophos Firewall
- CVE-2022-3710A post-auth read-only SQL injection vulnerability allows API clients to read non-sensitive configuration database contents in the API controSophos Firewall
- CVE-2022-3711A post-auth read-only SQL injection vulnerability allows users to read non-sensitive configuration database contents in the User Portal of SSophos Firewall
- CVE-2022-40849ThinkCMF version 6.0.7 is affected by Stored Cross-Site Scripting (XSS).thinkcmf/thinkcmf
- CVE-2022-4246Kakao PotPlayer MID File denial of serviceKakao PotPlayer
- CVE-2022-4247Movie Ticket Booking System booking.php sql injectionMovie Ticket Booking System
- CVE-2022-4248Movie Ticket Booking System editBooking.php sql injectionMovie Ticket Booking System
- CVE-2022-4249Movie Ticket Booking System POST Request cross site scriptingMovie Ticket Booking System
- CVE-2022-4250Movie Ticket Booking System booking.php cross site scriptingMovie Ticket Booking System
- CVE-2022-4251Movie Ticket Booking System editBooking.php cross site scriptingMovie Ticket Booking System
- CVE-2022-4252SourceCodester Canteen Management System categories.php builtin_echo cross site scriptingSourceCodester Canteen Management System
- CVE-2022-4253SourceCodester Canteen Management System customer.php builtin_echo cross site scriptingSourceCodester Canteen Management System
- CVE-2022-4257C-DATA Web Management System GET Parameter jumpto.php argument injectionC-DATA Web Management System
- CVE-2022-44212In GL.iNet Goodcloud 1.0, insecure design allows remote attacker to access devices' admin panel.