CVEs published December 2, 2022
92 CVEs were published on December 2, 2022: 16 critical, 37 high. 1 is now in CISA KEV.
- Published
- 92
- Critical
- 16
- High
- 37
- Medium
- 38
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 8
Most affected products
- prasunsen Chained Quiz
- 13
- thisAAY Lazy Mouse
- 2
- vim/vim
- 2
- Apache Software Foundation Apache Tapestry · org.apache.tap…
- 1
- clastix capsule · github.com/clastix/capsule
- 1
- discourse
- 1
- goauthentik authentik
- 1
- Google Chrome
- 1
- M-Files Web
- 1
- migueldeicaza SwiftTerm
- 1
Critical 16
- CVE-2022-43325An unauthenticated command injection vulnerability in the product license validation function of Telos Alliance Omnia MPX Node 1.3.* - 1.4.*
- CVE-2022-44290webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in deleteapprovalstages.php.
- CVE-2022-44291webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in phasesets.php.
- CVE-2022-44362Tenda i21 V1.0.0.14(4656) is vulnerable to Buffer Overflow via /goform/AddSysLogRule.
- CVE-2022-44363Tenda i21 V1.0.0.14(4656) is vulnerable to Buffer Overflow via /goform/setSnmpInfo.
- CVE-2022-44365Tenda i21 V1.0.0.14(4656) has a stack overflow vulnerability via /goform/setSysPwd.
- CVE-2022-44366Tenda i21 V1.0.0.14(4656) is vulnerable to Buffer Overflow via /goform/setDiagnoseInfo.
- CVE-2022-44367Tenda i21 V1.0.0.14(4656) is vulnerable to Buffer Overflow via /goform/setUplinkInfo.
- CVE-2022-44928D-Link DVG-G5402SP GE_1.03 was discovered to contain a command injection vulnerability via the Maintenance function.
- CVE-2022-44929An access control issue in D-Link DVG-G5402SP GE_1.03 allows unauthenticated attackers to escalate privileges via arbitrarily editing VoIP S
- CVE-2022-44930D-Link DHP-W310AV 3.10EU was discovered to contain a command injection vulnerability via the System Checks function.
- CVE-2022-44945Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the heading_field_id parameter.
- CVE-2022-45482Lazy Mouse server enforces weak password requirements and doesn't implement rate limiting, allowing remote unauthenticated users to easily athisAAY Lazy Mouse
- CVE-2022-45651Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the list parameter in the formSetVirtualSer function.
- CVE-2022-45652Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the startIp parameter in the formSetPPTPServer function.
- CVE-2022-46366Apache Tapestry prior to version 4 (EOL) allows RCE though deserialization of untrusted inputApache Software Foundation Apache Tapestry · org.apache.tap…
High 37
- CVE-2022-23465SwiftTerm vulnerable to arbitrary command executionmigueldeicaza SwiftTerm
- CVE-2022-46167Capsule vulnerable to privilege escalation by ServiceAccount deployed in a Tenant Namespaceclastix capsule · github.com/clastix/capsule
- CVE-2022-46145authentik vulnerable to unauthorized user creation and potential account takeovergoauthentik authentik
- CVE-2022-3520Heap-based Buffer Overflow in vim/vimvim/vim
- CVE-2022-3591Use After Free in vim/vimvim/vim
- CVE-2022-4262Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2022-4271Cross-site Scripting (XSS) - Reflected in osticket/osticketosticket/osticket
- CVE-2022-43272DCMTK v3.6.7 was discovered to contain a memory leak via the T_ASC_Association object.
- CVE-2022-44277Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/classes/Master.php?f=delete_product.
- CVE-2022-44345Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=quotes/view_quote&id=.
- CVE-2022-44347Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=inquiries/view_inquiry&id=.
- CVE-2022-44348Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/orders/update_status.php?id=.
- CVE-2022-45562Insecure permissions in Telos Alliance Omnia MPX Node v1.0.0 to v1.4.9 allow attackers to manipulate and access system settings with backdoo
- CVE-2022-45641Tenda AC6V1.0 V15.03.05.19 is vulnerable to Buffer Overflow via formSetMacFilterCfg.
- CVE-2022-45643Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the deviceId parameter in the addWifiMacFilter function.
- CVE-2022-45644Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the deviceId parameter in the formSetClientState function.
- CVE-2022-45645Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the deviceMac parameter in the addWifiMacFilter function.
- CVE-2022-45646Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the limitSpeedUp parameter in the formSetClientState function.
- CVE-2022-45647Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the limitSpeed parameter in the formSetClientState function.
- CVE-2022-45648Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the devName parameter in the formSetDeviceName function.
- CVE-2022-45649Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the endIp parameter in the formSetPPTPServer function.
- CVE-2022-45650Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the firewallEn parameter in the formSetFirewallCfg function.
- CVE-2022-45653Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the page parameter in the fromNatStaticSetting function.
- CVE-2022-45654Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the ssid parameter in the form_fast_setting_wifi_set function.
- CVE-2022-45655Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the timeZone parameter in the form_fast_setting_wifi_set function
- CVE-2022-45656Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the time parameter in the fromSetSysTime function.
- CVE-2022-45657Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the list parameter in the fromSetIpMacBind function.
- CVE-2022-45658Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the schedEndTime parameter in the setSchedWifi function.
- CVE-2022-45659Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the wpapsk_crypto parameter in the fromSetWirelessRepeat function
- CVE-2022-45660Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the schedStartTime parameter in the setSchedWifi function.
- CVE-2022-45661Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the time parameter in the setSmartPowerManagement function.
- CVE-2022-45663Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the index parameter in the formWifiMacFilterSet function.
- CVE-2022-45664Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the list parameter in the formwrlSSIDget function.
- CVE-2022-45669Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the index parameter in the formWifiMacFilterGet function.
- CVE-2022-45670Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the ping1 parameter in the formSetAutoPing function.
- CVE-2022-45671Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the appData parameter in the formSetAppFilterRule function.
- CVE-2022-45672Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the formWx3AuthorizeSet function.
Medium, low and unrated 39
- CVE-2022-4216Chained Quiz <= 1.3.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Facebook App IDprasunsen Chained Quiz
- CVE-2022-4217Chained Quiz <= 1.3.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Mailchimp API Keyprasunsen Chained Quiz
- CVE-2022-4212Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via ipfprasunsen Chained Quiz
- CVE-2022-4211Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via emailfprasunsen Chained Quiz
- CVE-2022-4210Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via dnfprasunsen Chained Quiz
- CVE-2022-4209Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via pointsfprasunsen Chained Quiz
- CVE-2022-4208Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via datefprasunsen Chained Quiz
- CVE-2022-4213Chained Quiz <= 1.3.2.2 - Reflected Cross-Site Scripting via dnprasunsen Chained Quiz
- CVE-2022-4214Chained Quiz <= 1.3.2.3 - Reflected Cross-Site Scripting via ipprasunsen Chained Quiz
- CVE-2022-4215Chained Quiz <= 1.3.2.3 - Reflected Cross-Site Scripting via dateprasunsen Chained Quiz
- CVE-2022-4220Chained Quiz <= 1.3.2.4 - Cross-Site Request Forgery to Question Deletionprasunsen Chained Quiz
- CVE-2022-4219Chained Quiz <= 1.3.2.4 - Cross-Site Request Forgery to Submitted Response Deletionprasunsen Chained Quiz
- CVE-2022-4218Chained Quiz <= 1.3.2.4 - Cross-Site Request Forgery to Arbitrary Quiz Deletion and Copyingprasunsen Chained Quiz
- CVE-2022-46159Any authenticated Discourse user can create an unlisted topicdiscourse
- CVE-2022-4270Incorrect privilege assignment in M-Files Web ServerM-Files Web
- CVE-2022-44944Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Announcement function at /index.ph
- CVE-2022-44946Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Page function at /index.php?module
- CVE-2022-44947Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Highlight Row feature at /index.php?mo
- CVE-2022-44948Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Entities Group feature at/index.php?mo
- CVE-2022-44949Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?m
- CVE-2022-44950Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?m
- CVE-2022-44951Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Form tab function at /index.ph
- CVE-2022-44952Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in /index.php?module=configuration/applicatio
- CVE-2022-44953webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /linkedcontent/listfiles.php.
- CVE-2022-44954webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /contacts/listcontacts.php.
- CVE-2022-44955webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the Chat function.
- CVE-2022-44956webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /projects/listprojects.php.
- CVE-2022-44957webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /clients/listclients.php.
- CVE-2022-44959webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /meetings/listmeetings.php.
- CVE-2022-44960webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /general/search.php?searchtype=simple.
- CVE-2022-44961webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /forums/editforum.php.
- CVE-2022-44962webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /calendar/viewcalendar.php.
- CVE-2022-45215A cross-site scripting (XSS) vulnerability in Book Store Management System v1.0.0 allows attackers to execute arbitrary web scripts or HTML
- CVE-2022-45480PC Keyboard WiFi & Bluetooth allows an attacker (in a man-in-the-middle position between the server and a connected device) to see all data Telepad PC Keyboard WiFi & Bluetooth
- CVE-2022-45483Lazy Mouse allows an attacker (in a man in the middle position between the server and a connected device) to see all data (including keypresthisAAY Lazy Mouse
- CVE-2022-45667Tenda i22 V1.0.0.3(4687) is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolRestoreSet.
- CVE-2022-45668Tenda i22 V1.0.0.3(4687) is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolReboot.
- CVE-2022-45673Tenda AC6V1.0 V15.03.05.19 is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolRestoreSet.
- CVE-2022-45674Tenda AC6V1.0 V15.03.05.19 is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolReboot.