# CVEs published 2022-12-04

11 CVEs were published on December 4, 2022: 2 critical, 5 high. Days are UTC.

- [CVE-2022-35730](https://cve.now/CVE-2022-35730.md): WordPress Oceanwp sticky header plugin \<= 1.0.8 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Oren Hahiashvili Oceanwp sticky header)
- [CVE-2022-40968](https://cve.now/CVE-2022-40968.md): WordPress 2kb Amazon Affiliates Store Plugin \<= 2.1.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 4.8, 2kblater 2kb Amazon Affiliates Store)
- [CVE-2022-35507](https://cve.now/CVE-2022-35507.md): A response-header CRLF injection vulnerability in the Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) web interface allows (CVSS 4.3)
- [CVE-2022-35508](https://cve.now/CVE-2022-35508.md): Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) are vulnerable to SSRF when proxying HTTP requests between pve(pmg)proxy an (CVSS 9.8)
- [CVE-2022-46391](https://cve.now/CVE-2022-46391.md): AWStats 7.x through 7.8 allows XSS in the hostinfo plugin due to printing a response from Net::XWhois without proper checks. (CVSS 6.1)
- [CVE-2022-46405](https://cve.now/CVE-2022-46405.md): Mastodon through 4.0.2 allows attackers to cause a denial of service (large Sidekiq pull queue) by creating bot accounts that follow attacke (CVSS 7.5)
- [CVE-2022-46410](https://cve.now/CVE-2022-46410.md): An issue was discovered in Veritas NetBackup Flex Scale through 3.0. (CVSS 8.8)
- [CVE-2022-46411](https://cve.now/CVE-2022-46411.md): An issue was discovered in Veritas NetBackup Flex Scale through 3.0 and Access Appliance through 8.0.100. (CVSS 8.8)
- [CVE-2022-46412](https://cve.now/CVE-2022-46412.md): An issue was discovered in Veritas NetBackup Flex Scale through 3.0. (CVSS 8.8)
- [CVE-2022-46413](https://cve.now/CVE-2022-46413.md): An issue was discovered in Veritas NetBackup Flex Scale through 3.0 and Access Appliance through 8.0.100. (CVSS 8.8)
- [CVE-2022-46414](https://cve.now/CVE-2022-46414.md): An issue was discovered in Veritas NetBackup Flex Scale through 3.0 and Access Appliance through 8.0.100. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-12-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.