# CVEs published 2022-12-01

47 CVEs were published on December 1, 2022: 7 critical, 14 high. Days are UTC.

- [CVE-2022-41971](https://cve.now/CVE-2022-41971.md): Nextcloud Talk guests can continue to receive video streams from call after being removed from a conversation (CVSS 4.8, nextcloud security-advisories)
- [CVE-2022-41970](https://cve.now/CVE-2022-41970.md): Nextcloud Server's disabled download shares still allow download through preview images (CVSS 2.6, nextcloud security-advisories)
- [CVE-2022-41969](https://cve.now/CVE-2022-41969.md): Nextcloud Server has no password length limit when creating a user as an administrator (CVSS 2.4, nextcloud security-advisories)
- [CVE-2022-41968](https://cve.now/CVE-2022-41968.md): Nextcloud Server's calendar name length not validated before writing to database (CVSS 3.5, nextcloud security-advisories)
- [CVE-2022-43901](https://cve.now/CVE-2022-43901.md): IBM WebSphere Automation for IBM Cloud Pak for Watson AIOps information disclosure (CVSS 5.7, IBM WebSphere Automation for Cloud Pak for Watson AIOps)
- [CVE-2022-43900](https://cve.now/CVE-2022-43900.md): IBM WebSphere Automation for IBM Cloud Pak for Watson AIOps security bypass (CVSS 5.3, WebSphere Automation for IBM Cloud Pak for Watson AIOps)
- [CVE-2022-41297](https://cve.now/CVE-2022-41297.md): IBM Db2U cross-site request forgery (CVSS 4.3, IBM Db2U)
- [CVE-2022-41296](https://cve.now/CVE-2022-41296.md): IBM Db2U cross-site respect forgery (CVSS 6.5, IBM Db2U)
- [CVE-2022-2969](https://cve.now/CVE-2022-2969.md): ICSA-22-307-03 Delta Industrial Automation DIALink Path traversal (CVSS 8.1, Delta Industrial Automation DIALink)
- [CVE-2021-38997](https://cve.now/CVE-2021-38997.md): IBM API Connect HOST header injection (CVSS 5.4, IBM API Connect)
- [CVE-2022-45797](https://cve.now/CVE-2022-45797.md): An arbitrary file deletion vulnerability in the Damage Cleanup Engine component of Trend Micro Apex One and Trend Micro Apex One as a Servic (CVSS 7.1, Trend Micro Apex One)
- [CVE-2022-1471](https://cve.now/CVE-2022-1471.md): Remote Code execution in SnakeYAML (CVSS 8.3, SnakeYAML · org.yaml:snakeyaml)
- [CVE-2022-3270](https://cve.now/CVE-2022-3270.md): Incomplete Documentation of remote functions in FESTO products. (CVSS 9.8, Festo SE Bus module CPX-E-EP · Festo SE Bus node CPX-FB… +53)
- [CVE-2022-4221](https://cve.now/CVE-2022-4221.md): OS command injection in ASUS M25 NAS (CVSS 9.8, Asus NAS-M25)
- [CVE-2022-45050](https://cve.now/CVE-2022-45050.md): Reflected XSS in Axiell Iguana CMS (CVSS 6.1, Axiell Iguana)
- [CVE-2022-23737](https://cve.now/CVE-2022-23737.md): Improper Privilege Management in GitHub Enterprise Server leading to page creation and deletion (CVSS 6.5, GitHub Enterprise Server)
- [CVE-2022-28607](https://cve.now/CVE-2022-28607.md): An issue was discovered in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to gain sensitive inf (CVSS 7.5)
- [CVE-2022-29837](https://cve.now/CVE-2022-29837.md): Path traversal Vulnerability in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi Devices (CVSS 4.7, Western Digital My Cloud Home · SanDisk ibi)
- [CVE-2022-30528](https://cve.now/CVE-2022-30528.md): SQL Injection vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to execute arbitr (CVSS 9.8)
- [CVE-2022-3226](https://cve.now/CVE-2022-3226.md): An OS command injection vulnerability allows admins to execute code via SSL VPN configuration uploads in Sophos Firewall releases older than (CVSS 7.2, Sophos Firewall)
- [CVE-2022-35120](https://cve.now/CVE-2022-35120.md): IXPdata EasyInstall 6.6.14725 contains an access control issue. (CVSS 8.8)
- [CVE-2022-36431](https://cve.now/CVE-2022-36431.md): An arbitrary file upload vulnerability in Rocket TRUfusion Enterprise before 7.9.6.1 allows unauthenticated attackers to execute arbitrary c (CVSS 9.8)
- [CVE-2022-3696](https://cve.now/CVE-2022-3696.md): A post-auth code injection vulnerability allows admins to execute code in Webadmin of Sophos Firewall releases older than version 19.5 GA. (CVSS 7.2, Sophos Firewall)
- [CVE-2022-37016](https://cve.now/CVE-2022-37016.md): Symantec Endpoint Protection (Windows) agent may be susceptible to a Privilege Escalation vulnerability, which is a type of issue whereby an (CVSS 9.8, Symantec Endpoint Protection)
- [CVE-2022-37017](https://cve.now/CVE-2022-37017.md): Symantec Endpoint Protection (Windows) agent, prior to 14.3 RU6/14.3 RU5 Patch 1, may be susceptible to a Security Control Bypass vulnerabil (CVSS 7.5, Symantec Endpoint Protection)
- [CVE-2022-3709](https://cve.now/CVE-2022-3709.md): A stored XSS vulnerability allows admin to super-admin privilege escalation in the Webadmin import group wizard of Sophos Firewall releases (CVSS 6.8, Sophos Firewall)
- [CVE-2022-3710](https://cve.now/CVE-2022-3710.md): A post-auth read-only SQL injection vulnerability allows API clients to read non-sensitive configuration database contents in the API contro (CVSS 2.7, Sophos Firewall)
- [CVE-2022-3711](https://cve.now/CVE-2022-3711.md): A post-auth read-only SQL injection vulnerability allows users to read non-sensitive configuration database contents in the User Portal of S (CVSS 4.3, Sophos Firewall)
- [CVE-2022-3713](https://cve.now/CVE-2022-3713.md): A code injection vulnerability allows adjacent attackers to execute code in the Wifi controller of Sophos Firewall releases older than versi (CVSS 8.8, Sophos Firewall)
- [CVE-2022-40489](https://cve.now/CVE-2022-40489.md): ThinkCMF version 6.0.7 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows a Super Administrator user to be injecte (CVSS 8.8, thinkcmf/thinkcmf)
- [CVE-2022-40849](https://cve.now/CVE-2022-40849.md): ThinkCMF version 6.0.7 is affected by Stored Cross-Site Scripting (XSS). (CVSS 5.4, thinkcmf/thinkcmf)
- [CVE-2022-4246](https://cve.now/CVE-2022-4246.md): Kakao PotPlayer MID File denial of service (CVSS 4.3, Kakao PotPlayer)
- [CVE-2022-4247](https://cve.now/CVE-2022-4247.md): Movie Ticket Booking System booking.php sql injection (CVSS 6.3, Movie Ticket Booking System)
- [CVE-2022-4248](https://cve.now/CVE-2022-4248.md): Movie Ticket Booking System editBooking.php sql injection (CVSS 5.0, Movie Ticket Booking System)
- [CVE-2022-4249](https://cve.now/CVE-2022-4249.md): Movie Ticket Booking System POST Request cross site scripting (CVSS 3.5, Movie Ticket Booking System)
- [CVE-2022-4250](https://cve.now/CVE-2022-4250.md): Movie Ticket Booking System booking.php cross site scripting (CVSS 3.5, Movie Ticket Booking System)
- [CVE-2022-4251](https://cve.now/CVE-2022-4251.md): Movie Ticket Booking System editBooking.php cross site scripting (CVSS 2.4, Movie Ticket Booking System)
- [CVE-2022-4252](https://cve.now/CVE-2022-4252.md): SourceCodester Canteen Management System categories.php builtin\_echo cross site scripting (CVSS 3.5, SourceCodester Canteen Management System)
- [CVE-2022-4253](https://cve.now/CVE-2022-4253.md): SourceCodester Canteen Management System customer.php builtin\_echo cross site scripting (CVSS 3.5, SourceCodester Canteen Management System)
- [CVE-2022-4257](https://cve.now/CVE-2022-4257.md): C-DATA Web Management System GET Parameter jumpto.php argument injection (CVSS 6.3, C-DATA Web Management System)
- [CVE-2022-42718](https://cve.now/CVE-2022-42718.md): Incorrect default permissions in the installation folder for NI LabVIEW Command Line Interface (CLI) may allow an authenticated user to pote (CVSS 7.8)
- [CVE-2022-43333](https://cve.now/CVE-2022-43333.md): Telenia Software s.r.l TVox before v22.0.17 was discovered to contain a remote code execution (RCE) vulnerability in the component action\_ex (CVSS 9.8)
- [CVE-2022-44211](https://cve.now/CVE-2022-44211.md): In GL.iNet Goodcloud 1.1 Incorrect access control allows a remote attacker to access/change devices' settings. (CVSS 7.4)
- [CVE-2022-44212](https://cve.now/CVE-2022-44212.md): In GL.iNet Goodcloud 1.0, insecure design allows remote attacker to access devices' admin panel. (CVSS 5.9)
- [CVE-2022-44262](https://cve.now/CVE-2022-44262.md): ff4j 1.8.1 is vulnerable to Remote Code Execution (RCE). (CVSS 9.8, org.ff4j:ff4j-core)
- [CVE-2022-45045](https://cve.now/CVE-2022-45045.md): Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.0000 (CVSS 8.8)
- [CVE-2022-45640](https://cve.now/CVE-2022-45640.md): Tenda Tenda AC6V1.0 V15.03.05.19 is affected by buffer overflow. (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-12-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.