# CVEs published 2022-12-02

92 CVEs were published on December 2, 2022: 16 critical, 37 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2022-23465](https://cve.now/CVE-2022-23465.md): SwiftTerm vulnerable to arbitrary command execution (CVSS 7.1, migueldeicaza SwiftTerm)
- [CVE-2022-4216](https://cve.now/CVE-2022-4216.md): Chained Quiz \<= 1.3.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Facebook App ID (CVSS 5.5, prasunsen Chained Quiz)
- [CVE-2022-4217](https://cve.now/CVE-2022-4217.md): Chained Quiz \<= 1.3.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Mailchimp API Key (CVSS 5.5, prasunsen Chained Quiz)
- [CVE-2022-4212](https://cve.now/CVE-2022-4212.md): Chained Quiz \<= 1.3.2 - Reflected Cross-Site Scripting via ipf (CVSS 6.1, prasunsen Chained Quiz)
- [CVE-2022-4211](https://cve.now/CVE-2022-4211.md): Chained Quiz \<= 1.3.2 - Reflected Cross-Site Scripting via emailf (CVSS 6.1, prasunsen Chained Quiz)
- [CVE-2022-4210](https://cve.now/CVE-2022-4210.md): Chained Quiz \<= 1.3.2 - Reflected Cross-Site Scripting via dnf (CVSS 6.1, prasunsen Chained Quiz)
- [CVE-2022-4209](https://cve.now/CVE-2022-4209.md): Chained Quiz \<= 1.3.2 - Reflected Cross-Site Scripting via pointsf (CVSS 6.1, prasunsen Chained Quiz)
- [CVE-2022-4208](https://cve.now/CVE-2022-4208.md): Chained Quiz \<= 1.3.2 - Reflected Cross-Site Scripting via datef (CVSS 6.1, prasunsen Chained Quiz)
- [CVE-2022-4213](https://cve.now/CVE-2022-4213.md): Chained Quiz \<= 1.3.2.2 - Reflected Cross-Site Scripting via dn (CVSS 6.1, prasunsen Chained Quiz)
- [CVE-2022-4214](https://cve.now/CVE-2022-4214.md): Chained Quiz \<= 1.3.2.3 - Reflected Cross-Site Scripting via ip (CVSS 6.1, prasunsen Chained Quiz)
- [CVE-2022-4215](https://cve.now/CVE-2022-4215.md): Chained Quiz \<= 1.3.2.3 - Reflected Cross-Site Scripting via date (CVSS 6.1, prasunsen Chained Quiz)
- [CVE-2022-4220](https://cve.now/CVE-2022-4220.md): Chained Quiz \<= 1.3.2.4 - Cross-Site Request Forgery to Question Deletion (CVSS 5.4, prasunsen Chained Quiz)
- [CVE-2022-4219](https://cve.now/CVE-2022-4219.md): Chained Quiz \<= 1.3.2.4 - Cross-Site Request Forgery to Submitted Response Deletion (CVSS 5.4, prasunsen Chained Quiz)
- [CVE-2022-4218](https://cve.now/CVE-2022-4218.md): Chained Quiz \<= 1.3.2.4 - Cross-Site Request Forgery to Arbitrary Quiz Deletion and Copying (CVSS 5.4, prasunsen Chained Quiz)
- [CVE-2022-46167](https://cve.now/CVE-2022-46167.md): Capsule vulnerable to privilege escalation by ServiceAccount deployed in a Tenant Namespace (CVSS 8.8, clastix capsule · github.com/clastix/capsule)
- [CVE-2022-46145](https://cve.now/CVE-2022-46145.md): authentik vulnerable to unauthorized user creation and potential account takeover (CVSS 8.1, goauthentik authentik)
- [CVE-2022-46159](https://cve.now/CVE-2022-46159.md): Any authenticated Discourse user can create an unlisted topic (CVSS 4.3, discourse)
- [CVE-2022-4270](https://cve.now/CVE-2022-4270.md): Incorrect privilege assignment in M-Files Web Server (CVSS 2.0, M-Files Web)
- [CVE-2022-3520](https://cve.now/CVE-2022-3520.md): Heap-based Buffer Overflow in vim/vim (CVSS 7.8, vim/vim)
- [CVE-2022-3591](https://cve.now/CVE-2022-3591.md): Use After Free in vim/vim (CVSS 7.8, vim/vim)
- [CVE-2022-4262](https://cve.now/CVE-2022-4262.md): Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, KEV, Google Chrome)
- [CVE-2022-4271](https://cve.now/CVE-2022-4271.md): Cross-site Scripting (XSS) - Reflected in osticket/osticket (CVSS 8.0, osticket/osticket)
- [CVE-2022-43272](https://cve.now/CVE-2022-43272.md): DCMTK v3.6.7 was discovered to contain a memory leak via the T\_ASC\_Association object. (CVSS 7.5)
- [CVE-2022-43325](https://cve.now/CVE-2022-43325.md): An unauthenticated command injection vulnerability in the product license validation function of Telos Alliance Omnia MPX Node 1.3.\* - 1.4.\* (CVSS 9.8)
- [CVE-2022-44277](https://cve.now/CVE-2022-44277.md): Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/classes/Master.php?f=delete\_product. (CVSS 7.2)
- [CVE-2022-44290](https://cve.now/CVE-2022-44290.md): webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in deleteapprovalstages.php. (CVSS 9.8)
- [CVE-2022-44291](https://cve.now/CVE-2022-44291.md): webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in phasesets.php. (CVSS 9.8)
- [CVE-2022-44345](https://cve.now/CVE-2022-44345.md): Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=quotes/view\_quote&id=. (CVSS 7.2)
- [CVE-2022-44347](https://cve.now/CVE-2022-44347.md): Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=inquiries/view\_inquiry&id=. (CVSS 7.2)
- [CVE-2022-44348](https://cve.now/CVE-2022-44348.md): Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/orders/update\_status.php?id=. (CVSS 7.2)
- [CVE-2022-44362](https://cve.now/CVE-2022-44362.md): Tenda i21 V1.0.0.14(4656) is vulnerable to Buffer Overflow via /goform/AddSysLogRule. (CVSS 9.8)
- [CVE-2022-44363](https://cve.now/CVE-2022-44363.md): Tenda i21 V1.0.0.14(4656) is vulnerable to Buffer Overflow via /goform/setSnmpInfo. (CVSS 9.8)
- [CVE-2022-44365](https://cve.now/CVE-2022-44365.md): Tenda i21 V1.0.0.14(4656) has a stack overflow vulnerability via /goform/setSysPwd. (CVSS 9.8)
- [CVE-2022-44366](https://cve.now/CVE-2022-44366.md): Tenda i21 V1.0.0.14(4656) is vulnerable to Buffer Overflow via /goform/setDiagnoseInfo. (CVSS 9.8)
- [CVE-2022-44367](https://cve.now/CVE-2022-44367.md): Tenda i21 V1.0.0.14(4656) is vulnerable to Buffer Overflow via /goform/setUplinkInfo. (CVSS 9.8)
- [CVE-2022-44928](https://cve.now/CVE-2022-44928.md): D-Link DVG-G5402SP GE\_1.03 was discovered to contain a command injection vulnerability via the Maintenance function. (CVSS 9.8)
- [CVE-2022-44929](https://cve.now/CVE-2022-44929.md): An access control issue in D-Link DVG-G5402SP GE\_1.03 allows unauthenticated attackers to escalate privileges via arbitrarily editing VoIP S (CVSS 9.8)
- [CVE-2022-44930](https://cve.now/CVE-2022-44930.md): D-Link DHP-W310AV 3.10EU was discovered to contain a command injection vulnerability via the System Checks function. (CVSS 9.8)
- [CVE-2022-44944](https://cve.now/CVE-2022-44944.md): Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Announcement function at /index.ph (CVSS 5.4)
- [CVE-2022-44945](https://cve.now/CVE-2022-44945.md): Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the heading\_field\_id parameter. (CVSS 9.8)
- [CVE-2022-44946](https://cve.now/CVE-2022-44946.md): Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Page function at /index.php?module (CVSS 5.4)
- [CVE-2022-44947](https://cve.now/CVE-2022-44947.md): Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Highlight Row feature at /index.php?mo (CVSS 5.4)
- [CVE-2022-44948](https://cve.now/CVE-2022-44948.md): Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Entities Group feature at/index.php?mo (CVSS 5.4)
- [CVE-2022-44949](https://cve.now/CVE-2022-44949.md): Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?m (CVSS 5.4)
- [CVE-2022-44950](https://cve.now/CVE-2022-44950.md): Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?m (CVSS 5.4)
- [CVE-2022-44951](https://cve.now/CVE-2022-44951.md): Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Form tab function at /index.ph (CVSS 5.4)
- [CVE-2022-44952](https://cve.now/CVE-2022-44952.md): Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in /index.php?module=configuration/applicatio (CVSS 5.4)
- [CVE-2022-44953](https://cve.now/CVE-2022-44953.md): webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /linkedcontent/listfiles.php. (CVSS 5.4)
- [CVE-2022-44954](https://cve.now/CVE-2022-44954.md): webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /contacts/listcontacts.php. (CVSS 5.4)
- [CVE-2022-44955](https://cve.now/CVE-2022-44955.md): webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the Chat function. (CVSS 5.4)
- [CVE-2022-44956](https://cve.now/CVE-2022-44956.md): webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /projects/listprojects.php. (CVSS 5.4)
- [CVE-2022-44957](https://cve.now/CVE-2022-44957.md): webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /clients/listclients.php. (CVSS 5.4)
- [CVE-2022-44959](https://cve.now/CVE-2022-44959.md): webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /meetings/listmeetings.php. (CVSS 5.4)
- [CVE-2022-44960](https://cve.now/CVE-2022-44960.md): webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /general/search.php?searchtype=simple. (CVSS 5.4)
- [CVE-2022-44961](https://cve.now/CVE-2022-44961.md): webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /forums/editforum.php. (CVSS 5.4)
- [CVE-2022-44962](https://cve.now/CVE-2022-44962.md): webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /calendar/viewcalendar.php. (CVSS 5.4)
- [CVE-2022-45215](https://cve.now/CVE-2022-45215.md): A cross-site scripting (XSS) vulnerability in Book Store Management System v1.0.0 allows attackers to execute arbitrary web scripts or HTML (CVSS 5.4)
- [CVE-2022-45480](https://cve.now/CVE-2022-45480.md): PC Keyboard WiFi & Bluetooth allows an attacker (in a man-in-the-middle position between the server and a connected device) to see all data (CVSS 5.9, Telepad PC Keyboard WiFi & Bluetooth)
- [CVE-2022-45482](https://cve.now/CVE-2022-45482.md): Lazy Mouse server enforces weak password requirements and doesn't implement rate limiting, allowing remote unauthenticated users to easily a (CVSS 9.8, thisAAY Lazy Mouse)
- [CVE-2022-45483](https://cve.now/CVE-2022-45483.md): Lazy Mouse allows an attacker (in a man in the middle position between the server and a connected device) to see all data (including keypres (CVSS 5.9, thisAAY Lazy Mouse)
- [CVE-2022-45562](https://cve.now/CVE-2022-45562.md): Insecure permissions in Telos Alliance Omnia MPX Node v1.0.0 to v1.4.9 allow attackers to manipulate and access system settings with backdoo (CVSS 8.8)
- [CVE-2022-45641](https://cve.now/CVE-2022-45641.md): Tenda AC6V1.0 V15.03.05.19 is vulnerable to Buffer Overflow via formSetMacFilterCfg. (CVSS 7.5)
- [CVE-2022-45643](https://cve.now/CVE-2022-45643.md): Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the deviceId parameter in the addWifiMacFilter function. (CVSS 7.5)
- [CVE-2022-45644](https://cve.now/CVE-2022-45644.md): Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the deviceId parameter in the formSetClientState function. (CVSS 7.5)
- [CVE-2022-45645](https://cve.now/CVE-2022-45645.md): Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the deviceMac parameter in the addWifiMacFilter function. (CVSS 7.5)
- [CVE-2022-45646](https://cve.now/CVE-2022-45646.md): Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the limitSpeedUp parameter in the formSetClientState function. (CVSS 7.5)
- [CVE-2022-45647](https://cve.now/CVE-2022-45647.md): Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the limitSpeed parameter in the formSetClientState function. (CVSS 7.5)
- [CVE-2022-45648](https://cve.now/CVE-2022-45648.md): Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the devName parameter in the formSetDeviceName function. (CVSS 7.5)
- [CVE-2022-45649](https://cve.now/CVE-2022-45649.md): Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the endIp parameter in the formSetPPTPServer function. (CVSS 7.5)
- [CVE-2022-45650](https://cve.now/CVE-2022-45650.md): Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the firewallEn parameter in the formSetFirewallCfg function. (CVSS 7.5)
- [CVE-2022-45651](https://cve.now/CVE-2022-45651.md): Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the list parameter in the formSetVirtualSer function. (CVSS 9.1)
- [CVE-2022-45652](https://cve.now/CVE-2022-45652.md): Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the startIp parameter in the formSetPPTPServer function. (CVSS 9.1)
- [CVE-2022-45653](https://cve.now/CVE-2022-45653.md): Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the page parameter in the fromNatStaticSetting function. (CVSS 7.5)
- [CVE-2022-45654](https://cve.now/CVE-2022-45654.md): Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the ssid parameter in the form\_fast\_setting\_wifi\_set function. (CVSS 7.5)
- [CVE-2022-45655](https://cve.now/CVE-2022-45655.md): Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the timeZone parameter in the form\_fast\_setting\_wifi\_set function (CVSS 7.5)
- [CVE-2022-45656](https://cve.now/CVE-2022-45656.md): Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the time parameter in the fromSetSysTime function. (CVSS 7.5)
- [CVE-2022-45657](https://cve.now/CVE-2022-45657.md): Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the list parameter in the fromSetIpMacBind function. (CVSS 7.5)
- [CVE-2022-45658](https://cve.now/CVE-2022-45658.md): Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the schedEndTime parameter in the setSchedWifi function. (CVSS 7.5)
- [CVE-2022-45659](https://cve.now/CVE-2022-45659.md): Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the wpapsk\_crypto parameter in the fromSetWirelessRepeat function (CVSS 7.5)
- [CVE-2022-45660](https://cve.now/CVE-2022-45660.md): Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the schedStartTime parameter in the setSchedWifi function. (CVSS 7.5)
- [CVE-2022-45661](https://cve.now/CVE-2022-45661.md): Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the time parameter in the setSmartPowerManagement function. (CVSS 7.5)
- [CVE-2022-45663](https://cve.now/CVE-2022-45663.md): Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the index parameter in the formWifiMacFilterSet function. (CVSS 7.5)
- [CVE-2022-45664](https://cve.now/CVE-2022-45664.md): Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the list parameter in the formwrlSSIDget function. (CVSS 7.5)
- [CVE-2022-45667](https://cve.now/CVE-2022-45667.md): Tenda i22 V1.0.0.3(4687) is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolRestoreSet. (CVSS 6.5)
- [CVE-2022-45668](https://cve.now/CVE-2022-45668.md): Tenda i22 V1.0.0.3(4687) is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolReboot. (CVSS 6.5)
- [CVE-2022-45669](https://cve.now/CVE-2022-45669.md): Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the index parameter in the formWifiMacFilterGet function. (CVSS 7.5)
- [CVE-2022-45670](https://cve.now/CVE-2022-45670.md): Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the ping1 parameter in the formSetAutoPing function. (CVSS 7.5)
- [CVE-2022-45671](https://cve.now/CVE-2022-45671.md): Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the appData parameter in the formSetAppFilterRule function. (CVSS 7.5)
- [CVE-2022-45672](https://cve.now/CVE-2022-45672.md): Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the formWx3AuthorizeSet function. (CVSS 7.5)
- [CVE-2022-45673](https://cve.now/CVE-2022-45673.md): Tenda AC6V1.0 V15.03.05.19 is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolRestoreSet. (CVSS 6.5)
- [CVE-2022-45674](https://cve.now/CVE-2022-45674.md): Tenda AC6V1.0 V15.03.05.19 is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolReboot. (CVSS 6.5)
- [CVE-2022-46366](https://cve.now/CVE-2022-46366.md): Apache Tapestry prior to version 4 (EOL) allows RCE though deserialization of untrusted input (CVSS 9.8, Apache Software Foundation Apache Tapestry · org.apache.tap…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-12-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.