CVEs published December 5, 2022
105 CVEs were published on December 5, 2022: 16 critical, 29 high. 1 is now in CISA KEV.
- Published
- 105
- Critical
- 16
- High
- 29
- Medium
- 55
- Low
- 0
- Unrated
- 5
- Now in CISA KEV
- 1
- Fix available
- 28
Most affected products
- MediaTek MT6762, MT6765, MT6768, MT6769, MT6779, MT6781, MT…
- 4
- AMI MegaRAC SPx12 · AMI MegaRAC SPx13
- 3
- Kyocera Document Solutions MFPs and printers
- 3
- MediaTek MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT…
- 3
- NodeJS Node
- 3
- WordPress.org WordPress
- 3
- Advanced Booking Calendar
- 2
- https://github.com/curl/curl
- 2
- https://github.com/rack/rack · rack
- 2
- Ivanti Connect Secure (ICS), Ivanti Policy Secure (IPS), an…
- 2
Critical 16
- CVE-2022-46164Account takeover via prototype vulnerabilityNodeBB
- CVE-2022-46169Unauthenticated Command Injectioncacti
- CVE-2022-45822WordPress Advanced Booking Calendar Plugin <= 1.7.1 is vulnerable to SQL InjectionAdvanced Booking Calendar
- CVE-2022-27773A privilege escalation vulnerability is identified in Ivanti EPM (LANDesk Management Suite) that allows a user to execute commands with elevIvanti Endpoint Manger
- CVE-2022-32221When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when thhttps://github.com/curl/curl
- CVE-2022-32224A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2https://github.com/rails/rails · activerecord
- CVE-2022-35255A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGeNodeJS Node
- CVE-2022-38337When aborting a SFTP connection, MobaXterm before v22.1 sends a hardcoded password to the server.
- CVE-2022-40918Buffer overflow in firmware lewei_cam binary version 2.0.10 in Force 1 Discovery Wifi U818A HD+ FPV Drone allows attacker to gain remote cod
- CVE-2022-41642OS command injection vulnerability in Nadesiko3 (PC Version) v3.3.61 and earlier allows a remote attacker to execute an arbitrary OS commandkujirahand Nadesiko3 · nadesiko3
- CVE-2022-42496OS command injection vulnerability in Nako3edit, editor component of nadesiko3 (PC Version) v3.3.74 and earlier allows a remote attacker to kujirahand Nako3edit, editor component of nadesiko3 · nades…
- CVE-2022-43549Improper authentication in Veeam Backup for Google Cloud v1.0 and v3.0 allows attackers to bypass authentication mechanisms.Veeam Backup for Google Cloud
- CVE-2022-44039Franklin Fueling System FFS Colibri 1.9.22.8925 is affected by: File system overwrite.
- CVE-2022-45477Telepad allows remote unauthenticated users to send instructions to the server to execute arbitrary code without any previous authorization Telepad
- CVE-2022-45479PC Keyboard allows remote unauthenticated users to send instructions to the server to execute arbitrary code without any previous authorizatBEAppsMobile PC Keyboard WiFi & Bluetooth
- CVE-2022-45481The default configuration of Lazy Mouse does not require a password, allowing remote unauthenticated users to execute arbitrary code with nothisAAY Lazy Mouse
High 29
- CVE-2022-4173Avast and AVG Antivirus for Windows vulnerable to Privilege EscalationNortonLifeLock Avast and AVG Antivirus
- CVE-2022-2827AMI MegaRAC User Enumeration VulnerabilityAMI MegaRAC SPx12 · AMI MegaRAC SPx13
- CVE-2022-40259MegaRAC Default Credentials VulnerabilityAMI MegaRAC SPx12 · AMI MegaRAC SPx13
- CVE-2022-40242MegaRAC Default Credentials VulnerabilityAMI MegaRAC SPx12 · AMI MegaRAC SPx13
- CVE-2022-3846Workreap - Freelance Marketplace and Directory < 2.6.3 - Subscriber+ Private Message Disclosure via IDORWorkreap
- CVE-2022-3858Chaty < 3.0.3 - Admin+ SQLiFloating Chat Widget: Contact Chat Icons, Telegram Chat, Li…
- CVE-2022-3907Clerk < 4.0.0 - Authentication Bypass and API Keys DisclosureClerk
- CVE-2022-1540PostmagThemes Demo <= 1.0.7 - Admin+ Arbitrary File UploadPostmagThemes Demo Import
- CVE-2022-3249WP CSV Exporter < 1.3.7 - Admin+ SQLiWP CSV Exporter
- CVE-2022-3694Syncee - Global Dropshipping < 1.0.10 - Authentication Token DisclosureSyncee
- CVE-2022-3856Comic Book Management System < 2.2.0 - Admin+ SQLiComic Book Management System
- CVE-2021-39434A default username and password for an administrator account was discovered in ZKTeco ZKTime 10.0 through 11.1.0, builds 20180901, 20190510.
- CVE-2022-35254An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14Ivanti Connect Secure (ICS), Ivanti Policy Secure (IPS), an…
- CVE-2022-35259XML Injection with Endpoint Manager 2022.Ivanti Endpoint Manager
- CVE-2022-37325In Sangoma Asterisk through 16.28.0, 17.x and 18.x through 18.14.0, and 19.x through 19.6.0, an incoming Setup message to addons/ooh323c/src
- CVE-2022-38336An access control issue in MobaXterm before v22.1 allows attackers to make connections to the server via the SSH or SFTP protocols without a
- CVE-2022-41777Improper check or handling of exceptional conditions vulnerability in Nako3edit, editor component of nadesiko3 (PC Version) v3.3.74 and earlkujirahand Nako3edit, editor component of nadesiko3 · nades…
- CVE-2022-4292Use After Free in vim/vimvim/vim
- CVE-2022-43470Cross-site request forgery (CSRF) vulnerability in +F FS040U software versions v2.3.4 and earlier, +F FS020W software versions v4.0.0 and eaFUJI SOFT INCORPORATED +F FS040U, +F FS020W, +F FS030W, and…
- CVE-2022-43484TERASOLUNA Global Framework 1.0.0 (Public review version) and TERASOLUNA Server Framework for Java (Rich) 2.0.0.2 to 2.0.5.1 are vulnerable NTT DATA TERASOLUNA Global Framework and TERASOLUNA Server…
- CVE-2022-43548A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost cNodeJS Node
- CVE-2022-43553A remote code execution vulnerability in EdgeRouters (Version 2.0.9-hotfix.4 and earlier) allows a malicious actor with an operator account EdgeMAX EdgeRouter
- CVE-2022-44009Improper access control in Key-Value RBAC in StackStorm version 3.7.0 didn't check the permissions in Jinja filters, allowing attackers to a
- CVE-2022-45019SLiMS 9 Bulian v9.5.0 was discovered to contain a SQL injection vulnerability via the keywords parameter.
- CVE-2022-45020Rukovoditel v3.2.1 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability in the component /rukovoditel/index.php?mo
- CVE-2022-45283GPAC MP4box v2.0.0 was discovered to contain a stack overflow in the smil_parse_time_list parameter at /scenegraph/svg_attributes.c.
- CVE-2022-45313Mikrotik RouterOs before stable v7.5 was discovered to contain an out-of-bounds read in the hotspot process.
- CVE-2022-45771An issue in the /api/audits component of Pwndoc v0.5.3 allows attackers to escalate privileges and execute arbitrary code via uploading a cr
- CVE-2022-45912An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0.
Medium, low and unrated 60
- CVE-2022-23467Out of Bounds Read in OpenRazer Driveropenrazer
- CVE-2022-3838WPUpper Share Buttons <= 3.42 - Admin+ Stored XSSWPUpper Share Buttons
- CVE-2022-3926WP OAuth Server < 3.4.2 - Client Secret Regeneration via CSRFWP OAuth Server
- CVE-2022-3426Advanced WP Columns <= 2.0.6 - Admin+ Stored Cross-Site ScriptingAdvanced WP Columns
- CVE-2022-3830WP Page Builder <= 1.2.8 - Admin+ Stored Cross-SiteWP Page Builder
- CVE-2022-3892WP OAuth Server < 4.2.2 - Admin+ Stored XSSWP OAuth Server
- CVE-2022-3837Uji Countdown < 2.3.1 - Admin+ Stored XSSUji Countdown
- CVE-2022-3677Advanced Import < 1.3.8 - Arbitrary Plugin Installation & Activation via CSRFAdvanced Import : One Click Import for WordPress or Theme D…
- CVE-2022-3909Add Comments <= 1.0.1 - Admin+ Stored XSSAdd Comments
- CVE-2022-45824WordPress Advanced Booking Calendar Plugin <= 1.7.1 is vulnerable to Cross Site Request Forgery (CSRF)Advanced Booking Calendar
- CVE-2021-34181Cross Site Scripting (XSS) vulnerability in TomExam 3.0 via p_name parameter to list.thtml.
- CVE-2022-23143ZTE OTCP product is impacted by a permission and access control vulnerability.OTCP
- CVE-2022-30122A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack.https://github.com/rack/rack · rack
- CVE-2022-30123A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell escape in the Lint ahttps://github.com/rack/rack · rack
- CVE-2022-32594In widevine, there is a possible out of bounds write due to an incorrect bounds check.MediaTek MT6762, MT6765, MT6768, MT6769, MT6779, MT6781, MT…
- CVE-2022-32596In widevine, there is a possible out of bounds write due to an incorrect bounds check.MediaTek MT6762, MT6765, MT6768, MT6769, MT6779, MT6781, MT…
- CVE-2022-32597In widevine, there is a possible out of bounds write due to an incorrect bounds check.MediaTek MT6762, MT6765, MT6768, MT6769, MT6779, MT6781, MT…
- CVE-2022-32598In widevine, there is a possible out of bounds write due to an incorrect bounds check.MediaTek MT6762, MT6765, MT6768, MT6769, MT6779, MT6781, MT…
- CVE-2022-32619In keyinstall, there is a possible out of bounds write due to an incorrect bounds check.MediaTek MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT…
- CVE-2022-32620In mpu, there is a possible memory corruption due to a logic error.MediaTek MT6781, MT6789, MT6833, MT6853, MT6873, MT6877, MT…
- CVE-2022-32621In isp, there is a possible out of bounds write due to a race condition.MediaTek MT6895, MT6983
- CVE-2022-32622In gz, there is a possible memory corruption due to a missing bounds check.MediaTek MT6789, MT6855, MT6879, MT6895, MT6983, MT8781
- CVE-2022-32624In throttling, there is a possible out of bounds write due to an incorrect calculation of buffer size.MediaTek MT6789, MT6855, MT6895, MT6983, MT8168, MT8365, MT…
- CVE-2022-32625In display, there is a possible out of bounds write due to an incorrect bounds check.MediaTek MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT…
- CVE-2022-32626In display, there is a possible out of bounds write due to an incorrect bounds check.MediaTek MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT…
- CVE-2022-32628In isp, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6833, MT6853, MT6855, MT6873, MT6877, MT6893, MT…
- CVE-2022-32629In isp, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6833, MT6853, MT6855, MT6873, MT6877, MT6893, MT…
- CVE-2022-32630In throttling, there is a possible out of bounds write due to an incorrect calculation of buffer size.MediaTek MT6789, MT6855, MT6895, MT6983, MT8781
- CVE-2022-32631In Wi-Fi, there is a possible out of bounds write due to improper input validation.MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6771, MT…
- CVE-2022-32632In Wi-Fi, there is a possible out of bounds write due to improper input validation.MediaTek MT6580, MT6735, MT6765, MT6768, MT6771, MT6779, MT…
- CVE-2022-32633In Wi-Fi, there is a possible memory access violation due to a logic error.MediaTek MT6580, MT6739, MT6761, MT6762, MT6765, MT6768, MT…
- CVE-2022-32634In ccci, there is a possible out of bounds write due to improper input validation.MediaTek MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT…
- CVE-2022-35256The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF.NodeJS Node
- CVE-2022-35258An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14Ivanti Connect Secure (ICS), Ivanti Policy Secure (IPS), an…
- CVE-2022-35260curl can be told to parse a `.netrc` file for credentials.https://github.com/curl/curl
- CVE-2022-37783All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username incraftcms/cms
- CVE-2022-41798Session information easily guessable vulnerability exists in Kyocera Document Solutions MFPs and printers, which may allow a network-adjacenKyocera Document Solutions MFPs and printers
- CVE-2022-41807Missing authorization vulnerability exists in Kyocera Document Solutions MFPs and printers, which may allow a network-adjacent attacker to aKyocera Document Solutions MFPs and printers
- CVE-2022-41830Stored cross-site scripting vulnerability in Kyocera Document Solutions MFPs and printers allows a remote authenticated attacker with an admKyocera Document Solutions MFPs and printers
- CVE-2022-4269A flaw was found in the Linux kernel Traffic Control (TC) subsystem.Linux kernel
- CVE-2022-42705A use-after-free in res_pjsip_pubsub.c in Sangoma Asterisk 16.28, 18.14, 19.6, and certified/18.9-cert2 may allow a remote authenticated att
- CVE-2022-42706An issue was discovered in Sangoma Asterisk through 16.28, 17 and 18 through 18.14, 19 through 19.6, and certified through 18.9-cert1.
- CVE-2022-4281Facepay camera.php authorizationFacepay
- CVE-2022-4282SpringBootCMS Template Management injectionSpringBootCMS
- CVE-2022-4293Floating Point Comparison with Incorrect Operator in vim/vimvim/vim
- CVE-2022-43097Phpgurukul User Registration & User Management System v3.0 was discovered to contain multiple stored cross-site scripting (XSS) vulnerabilit
- CVE-2022-43442Plaintext storage of a password vulnerability exists in +F FS040U software versions v2.3.4 and earlier, which may allow an attacker to obtaiFUJI SOFT INCORPORATED +F FS040U software
- CVE-2022-43479Open redirect vulnerability in SHIRASAGI v1.14.4 to v1.15.0 allows a remote unauthenticated attacker to redirect users to an arbitrary web sSHIRASAGI Project SHIRASAGI
- CVE-2022-43487Cross-site scripting vulnerability in Salon booking system versions prior to 7.9 allows a remote unauthenticated attacker to inject an arbitSalon booking system
- CVE-2022-43497Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary scriWordPress.org WordPress
- CVE-2022-43499Stored cross-site scripting vulnerability in SHIRASAGI versions prior to v1.16.2 allows a remote authenticated attacker with an administratiSHIRASAGI Project SHIRASAGI
- CVE-2022-43500Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary scriWordPress.org WordPress
- CVE-2022-43504Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email addrWordPress.org WordPress
- CVE-2022-43556Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XSS in the text input field since the result dashttps://github.com/concretecms/concretecms · concrete5/conc…
- CVE-2022-43557BD BodyGuard™ Pumps – RS-232 Interface VulnerabilityBecton, Dickinson and Company (BD) BodyGuard™ Pump
- CVE-2022-43706Cross-site scripting (XSS) vulnerability in the Web UI of StackStorm versions prior to 3.8.0 allowed logged in users with write access to pa
- CVE-2022-45315Mikrotik RouterOs before stable v7.6 was discovered to contain an out-of-bounds read in the snmp process.MicroTik RouterOS
- CVE-2022-45478Telepad allows an attacker (in a man-in-the-middle position between the server and a connected device) to see all data (including keypressesTelepad
- CVE-2022-45769A cross-site scripting (XSS) vulnerability in ClicShopping_V3 v3.402 allows attackers to execute arbitrary web scripts or HTML via a crafted
- CVE-2022-45990A cross-site scripting (XSS) vulnerability in the component /signup_script.php of Ecommerce-Website v1.0 allows attackers to execute arbitra