# CVEs published 2022-12-05

105 CVEs were published on December 5, 2022: 16 critical, 29 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2022-4173](https://cve.now/CVE-2022-4173.md): Avast and AVG Antivirus for Windows vulnerable to Privilege Escalation (CVSS 7.3, NortonLifeLock Avast and AVG Antivirus)
- [CVE-2022-2827](https://cve.now/CVE-2022-2827.md): AMI MegaRAC User Enumeration Vulnerability (CVSS 7.5, AMI MegaRAC SPx12 · AMI MegaRAC SPx13)
- [CVE-2022-40259](https://cve.now/CVE-2022-40259.md): MegaRAC Default Credentials Vulnerability (CVSS 8.3, AMI MegaRAC SPx12 · AMI MegaRAC SPx13)
- [CVE-2022-40242](https://cve.now/CVE-2022-40242.md): MegaRAC Default Credentials Vulnerability (CVSS 7.5, AMI MegaRAC SPx12 · AMI MegaRAC SPx13)
- [CVE-2022-46164](https://cve.now/CVE-2022-46164.md): Account takeover via prototype vulnerability (CVSS 9.4, NodeBB)
- [CVE-2022-46169](https://cve.now/CVE-2022-46169.md): Unauthenticated Command Injection (CVSS 9.8, KEV, cacti)
- [CVE-2022-23467](https://cve.now/CVE-2022-23467.md): Out of Bounds Read in OpenRazer Driver (CVSS 4.4, openrazer)
- [CVE-2022-3846](https://cve.now/CVE-2022-3846.md): Workreap - Freelance Marketplace and Directory \< 2.6.3 - Subscriber+ Private Message Disclosure via IDOR (CVSS 7.5, Workreap)
- [CVE-2022-3858](https://cve.now/CVE-2022-3858.md): Chaty \< 3.0.3 - Admin+ SQLi (CVSS 7.2, Floating Chat Widget: Contact Chat Icons, Telegram Chat, Li…)
- [CVE-2022-3907](https://cve.now/CVE-2022-3907.md): Clerk \< 4.0.0 - Authentication Bypass and API Keys Disclosure (CVSS 7.5, Clerk)
- [CVE-2022-3838](https://cve.now/CVE-2022-3838.md): WPUpper Share Buttons \<= 3.42 - Admin+ Stored XSS (CVSS 4.8, WPUpper Share Buttons)
- [CVE-2022-1540](https://cve.now/CVE-2022-1540.md): PostmagThemes Demo \<= 1.0.7 - Admin+ Arbitrary File Upload (CVSS 7.2, PostmagThemes Demo Import)
- [CVE-2022-3249](https://cve.now/CVE-2022-3249.md): WP CSV Exporter \< 1.3.7 - Admin+ SQLi (CVSS 7.2, WP CSV Exporter)
- [CVE-2022-3926](https://cve.now/CVE-2022-3926.md): WP OAuth Server \< 3.4.2 - Client Secret Regeneration via CSRF (CVSS 6.5, WP OAuth Server)
- [CVE-2022-3426](https://cve.now/CVE-2022-3426.md): Advanced WP Columns \<= 2.0.6 - Admin+ Stored Cross-Site Scripting (CVSS 4.8, Advanced WP Columns)
- [CVE-2022-3830](https://cve.now/CVE-2022-3830.md): WP Page Builder \<= 1.2.8 - Admin+ Stored Cross-Site (CVSS 4.8, WP Page Builder)
- [CVE-2022-3892](https://cve.now/CVE-2022-3892.md): WP OAuth Server \< 4.2.2 - Admin+ Stored XSS (CVSS 4.8, WP OAuth Server)
- [CVE-2022-3837](https://cve.now/CVE-2022-3837.md): Uji Countdown \< 2.3.1 - Admin+ Stored XSS (CVSS 4.8, Uji Countdown)
- [CVE-2022-3677](https://cve.now/CVE-2022-3677.md): Advanced Import \< 1.3.8 - Arbitrary Plugin Installation & Activation via CSRF (CVSS 6.5, Advanced Import : One Click Import for WordPress or Theme D…)
- [CVE-2022-3909](https://cve.now/CVE-2022-3909.md): Add Comments \<= 1.0.1 - Admin+ Stored XSS (CVSS 4.8, Add Comments)
- [CVE-2022-3694](https://cve.now/CVE-2022-3694.md): Syncee - Global Dropshipping \< 1.0.10 - Authentication Token Disclosure (CVSS 7.5, Syncee)
- [CVE-2022-3856](https://cve.now/CVE-2022-3856.md): Comic Book Management System \< 2.2.0 - Admin+ SQLi (CVSS 7.2, Comic Book Management System)
- [CVE-2022-45824](https://cve.now/CVE-2022-45824.md): WordPress Advanced Booking Calendar Plugin \<= 1.7.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Advanced Booking Calendar)
- [CVE-2022-45822](https://cve.now/CVE-2022-45822.md): WordPress Advanced Booking Calendar Plugin \<= 1.7.1 is vulnerable to SQL Injection (CVSS 10.0, Advanced Booking Calendar)
- [CVE-2021-34181](https://cve.now/CVE-2021-34181.md): Cross Site Scripting (XSS) vulnerability in TomExam 3.0 via p\_name parameter to list.thtml. (CVSS 6.1)
- [CVE-2021-39434](https://cve.now/CVE-2021-39434.md): A default username and password for an administrator account was discovered in ZKTeco ZKTime 10.0 through 11.1.0, builds 20180901, 20190510. (CVSS 7.5)
- [CVE-2022-23143](https://cve.now/CVE-2022-23143.md): ZTE OTCP product is impacted by a permission and access control vulnerability. (CVSS 6.5, OTCP)
- [CVE-2022-27773](https://cve.now/CVE-2022-27773.md): A privilege escalation vulnerability is identified in Ivanti EPM (LANDesk Management Suite) that allows a user to execute commands with elev (CVSS 9.8, Ivanti Endpoint Manger)
- [CVE-2022-30122](https://cve.now/CVE-2022-30122.md): A possible denial of service vulnerability exists in Rack \<2.0.9.1, \<2.1.4.1 and \<2.2.3.1 in the multipart parsing component of Rack. (no CVSS, https://github.com/rack/rack · rack)
- [CVE-2022-30123](https://cve.now/CVE-2022-30123.md): A sequence injection vulnerability exists in Rack \<2.0.9.1, \<2.1.4.1 and \<2.2.3.1 which could allow is a possible shell escape in the Lint a (no CVSS, https://github.com/rack/rack · rack)
- [CVE-2022-32221](https://cve.now/CVE-2022-32221.md): When doing HTTP(S) transfers, libcurl might erroneously use the read callback (\`CURLOPT\_READFUNCTION\`) to ask for data to send, even when th (CVSS 9.8, https://github.com/curl/curl)
- [CVE-2022-32224](https://cve.now/CVE-2022-32224.md): A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record \< 7.0.3.1, \<6.1.6.1, \<6.0.5.1 and \<5.2 (CVSS 9.8, https://github.com/rails/rails · activerecord)
- [CVE-2022-32594](https://cve.now/CVE-2022-32594.md): In widevine, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 6.7, MediaTek MT6762, MT6765, MT6768, MT6769, MT6779, MT6781, MT…)
- [CVE-2022-32596](https://cve.now/CVE-2022-32596.md): In widevine, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 6.7, MediaTek MT6762, MT6765, MT6768, MT6769, MT6779, MT6781, MT…)
- [CVE-2022-32597](https://cve.now/CVE-2022-32597.md): In widevine, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 6.7, MediaTek MT6762, MT6765, MT6768, MT6769, MT6779, MT6781, MT…)
- [CVE-2022-32598](https://cve.now/CVE-2022-32598.md): In widevine, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 6.7, MediaTek MT6762, MT6765, MT6768, MT6769, MT6779, MT6781, MT…)
- [CVE-2022-32619](https://cve.now/CVE-2022-32619.md): In keyinstall, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 6.7, MediaTek MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT…)
- [CVE-2022-32620](https://cve.now/CVE-2022-32620.md): In mpu, there is a possible memory corruption due to a logic error. (CVSS 6.7, MediaTek MT6781, MT6789, MT6833, MT6853, MT6873, MT6877, MT…)
- [CVE-2022-32621](https://cve.now/CVE-2022-32621.md): In isp, there is a possible out of bounds write due to a race condition. (CVSS 6.4, MediaTek MT6895, MT6983)
- [CVE-2022-32622](https://cve.now/CVE-2022-32622.md): In gz, there is a possible memory corruption due to a missing bounds check. (CVSS 6.7, MediaTek MT6789, MT6855, MT6879, MT6895, MT6983, MT8781)
- [CVE-2022-32624](https://cve.now/CVE-2022-32624.md): In throttling, there is a possible out of bounds write due to an incorrect calculation of buffer size. (CVSS 6.7, MediaTek MT6789, MT6855, MT6895, MT6983, MT8168, MT8365, MT…)
- [CVE-2022-32625](https://cve.now/CVE-2022-32625.md): In display, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 6.7, MediaTek MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT…)
- [CVE-2022-32626](https://cve.now/CVE-2022-32626.md): In display, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 6.7, MediaTek MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT…)
- [CVE-2022-32628](https://cve.now/CVE-2022-32628.md): In isp, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6833, MT6853, MT6855, MT6873, MT6877, MT6893, MT…)
- [CVE-2022-32629](https://cve.now/CVE-2022-32629.md): In isp, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6833, MT6853, MT6855, MT6873, MT6877, MT6893, MT…)
- [CVE-2022-32630](https://cve.now/CVE-2022-32630.md): In throttling, there is a possible out of bounds write due to an incorrect calculation of buffer size. (CVSS 6.7, MediaTek MT6789, MT6855, MT6895, MT6983, MT8781)
- [CVE-2022-32631](https://cve.now/CVE-2022-32631.md): In Wi-Fi, there is a possible out of bounds write due to improper input validation. (CVSS 6.7, MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6771, MT…)
- [CVE-2022-32632](https://cve.now/CVE-2022-32632.md): In Wi-Fi, there is a possible out of bounds write due to improper input validation. (CVSS 6.7, MediaTek MT6580, MT6735, MT6765, MT6768, MT6771, MT6779, MT…)
- [CVE-2022-32633](https://cve.now/CVE-2022-32633.md): In Wi-Fi, there is a possible memory access violation due to a logic error. (CVSS 6.7, MediaTek MT6580, MT6739, MT6761, MT6762, MT6765, MT6768, MT…)
- [CVE-2022-32634](https://cve.now/CVE-2022-32634.md): In ccci, there is a possible out of bounds write due to improper input validation. (CVSS 6.7, MediaTek MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT…)
- [CVE-2022-35254](https://cve.now/CVE-2022-35254.md): An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14 (CVSS 7.5, Ivanti Connect Secure (ICS), Ivanti Policy Secure (IPS), an…)
- [CVE-2022-35255](https://cve.now/CVE-2022-35255.md): A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGe (CVSS 9.1, NodeJS Node)
- [CVE-2022-35256](https://cve.now/CVE-2022-35256.md): The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. (CVSS 6.5, NodeJS Node)
- [CVE-2022-35258](https://cve.now/CVE-2022-35258.md): An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14 (no CVSS, Ivanti Connect Secure (ICS), Ivanti Policy Secure (IPS), an…)
- [CVE-2022-35259](https://cve.now/CVE-2022-35259.md): XML Injection with Endpoint Manager 2022. (CVSS 7.8, Ivanti Endpoint Manager)
- [CVE-2022-35260](https://cve.now/CVE-2022-35260.md): curl can be told to parse a \`.netrc\` file for credentials. (no CVSS, https://github.com/curl/curl)
- [CVE-2022-37325](https://cve.now/CVE-2022-37325.md): In Sangoma Asterisk through 16.28.0, 17.x and 18.x through 18.14.0, and 19.x through 19.6.0, an incoming Setup message to addons/ooh323c/src (CVSS 7.5)
- [CVE-2022-37783](https://cve.now/CVE-2022-37783.md): All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in (no CVSS, craftcms/cms)
- [CVE-2022-38336](https://cve.now/CVE-2022-38336.md): An access control issue in MobaXterm before v22.1 allows attackers to make connections to the server via the SSH or SFTP protocols without a (CVSS 8.1)
- [CVE-2022-38337](https://cve.now/CVE-2022-38337.md): When aborting a SFTP connection, MobaXterm before v22.1 sends a hardcoded password to the server. (CVSS 9.1)
- [CVE-2022-40918](https://cve.now/CVE-2022-40918.md): Buffer overflow in firmware lewei\_cam binary version 2.0.10 in Force 1 Discovery Wifi U818A HD+ FPV Drone allows attacker to gain remote cod (CVSS 9.8)
- [CVE-2022-41642](https://cve.now/CVE-2022-41642.md): OS command injection vulnerability in Nadesiko3 (PC Version) v3.3.61 and earlier allows a remote attacker to execute an arbitrary OS command (CVSS 9.8, kujirahand Nadesiko3 · nadesiko3)
- [CVE-2022-41777](https://cve.now/CVE-2022-41777.md): Improper check or handling of exceptional conditions vulnerability in Nako3edit, editor component of nadesiko3 (PC Version) v3.3.74 and earl (CVSS 7.5, kujirahand Nako3edit, editor component of nadesiko3 · nades…)
- [CVE-2022-41798](https://cve.now/CVE-2022-41798.md): Session information easily guessable vulnerability exists in Kyocera Document Solutions MFPs and printers, which may allow a network-adjacen (CVSS 6.5, Kyocera Document Solutions MFPs and printers)
- [CVE-2022-41807](https://cve.now/CVE-2022-41807.md): Missing authorization vulnerability exists in Kyocera Document Solutions MFPs and printers, which may allow a network-adjacent attacker to a (CVSS 6.5, Kyocera Document Solutions MFPs and printers)
- [CVE-2022-41830](https://cve.now/CVE-2022-41830.md): Stored cross-site scripting vulnerability in Kyocera Document Solutions MFPs and printers allows a remote authenticated attacker with an adm (CVSS 4.8, Kyocera Document Solutions MFPs and printers)
- [CVE-2022-42496](https://cve.now/CVE-2022-42496.md): OS command injection vulnerability in Nako3edit, editor component of nadesiko3 (PC Version) v3.3.74 and earlier allows a remote attacker to (CVSS 9.8, kujirahand Nako3edit, editor component of nadesiko3 · nades…)
- [CVE-2022-4269](https://cve.now/CVE-2022-4269.md): A flaw was found in the Linux kernel Traffic Control (TC) subsystem. (CVSS 5.5, Linux kernel)
- [CVE-2022-42705](https://cve.now/CVE-2022-42705.md): A use-after-free in res\_pjsip\_pubsub.c in Sangoma Asterisk 16.28, 18.14, 19.6, and certified/18.9-cert2 may allow a remote authenticated att (CVSS 6.5)
- [CVE-2022-42706](https://cve.now/CVE-2022-42706.md): An issue was discovered in Sangoma Asterisk through 16.28, 17 and 18 through 18.14, 19 through 19.6, and certified through 18.9-cert1. (CVSS 4.9)
- [CVE-2022-4281](https://cve.now/CVE-2022-4281.md): Facepay camera.php authorization (CVSS 6.3, Facepay)
- [CVE-2022-4282](https://cve.now/CVE-2022-4282.md): SpringBootCMS Template Management injection (CVSS 4.7, SpringBootCMS)
- [CVE-2022-4292](https://cve.now/CVE-2022-4292.md): Use After Free in vim/vim (CVSS 7.8, vim/vim)
- [CVE-2022-4293](https://cve.now/CVE-2022-4293.md): Floating Point Comparison with Incorrect Operator in vim/vim (CVSS 6.8, vim/vim)
- [CVE-2022-43097](https://cve.now/CVE-2022-43097.md): Phpgurukul User Registration & User Management System v3.0 was discovered to contain multiple stored cross-site scripting (XSS) vulnerabilit (CVSS 5.4)
- [CVE-2022-43442](https://cve.now/CVE-2022-43442.md): Plaintext storage of a password vulnerability exists in +F FS040U software versions v2.3.4 and earlier, which may allow an attacker to obtai (CVSS 4.6, FUJI SOFT INCORPORATED +F FS040U software)
- [CVE-2022-43470](https://cve.now/CVE-2022-43470.md): Cross-site request forgery (CSRF) vulnerability in +F FS040U software versions v2.3.4 and earlier, +F FS020W software versions v4.0.0 and ea (CVSS 7.3, FUJI SOFT INCORPORATED +F FS040U, +F FS020W, +F FS030W, and…)
- [CVE-2022-43479](https://cve.now/CVE-2022-43479.md): Open redirect vulnerability in SHIRASAGI v1.14.4 to v1.15.0 allows a remote unauthenticated attacker to redirect users to an arbitrary web s (CVSS 6.1, SHIRASAGI Project SHIRASAGI)
- [CVE-2022-43484](https://cve.now/CVE-2022-43484.md): TERASOLUNA Global Framework 1.0.0 (Public review version) and TERASOLUNA Server Framework for Java (Rich) 2.0.0.2 to 2.0.5.1 are vulnerable (CVSS 7.8, NTT DATA TERASOLUNA Global Framework and TERASOLUNA Server…)
- [CVE-2022-43487](https://cve.now/CVE-2022-43487.md): Cross-site scripting vulnerability in Salon booking system versions prior to 7.9 allows a remote unauthenticated attacker to inject an arbit (CVSS 6.1, Salon booking system)
- [CVE-2022-43497](https://cve.now/CVE-2022-43497.md): Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary scri (CVSS 6.1, WordPress.org WordPress)
- [CVE-2022-43499](https://cve.now/CVE-2022-43499.md): Stored cross-site scripting vulnerability in SHIRASAGI versions prior to v1.16.2 allows a remote authenticated attacker with an administrati (CVSS 5.4, SHIRASAGI Project SHIRASAGI)
- [CVE-2022-43500](https://cve.now/CVE-2022-43500.md): Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary scri (CVSS 6.1, WordPress.org WordPress)
- [CVE-2022-43504](https://cve.now/CVE-2022-43504.md): Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email addr (CVSS 5.3, WordPress.org WordPress)
- [CVE-2022-43548](https://cve.now/CVE-2022-43548.md): A OS Command Injection vulnerability exists in Node.js versions \<14.21.1, \<16.18.1, \<18.12.1, \<19.0.1 due to an insufficient IsAllowedHost c (CVSS 8.1, NodeJS Node)
- [CVE-2022-43549](https://cve.now/CVE-2022-43549.md): Improper authentication in Veeam Backup for Google Cloud v1.0 and v3.0 allows attackers to bypass authentication mechanisms. (CVSS 9.8, Veeam Backup for Google Cloud)
- [CVE-2022-43553](https://cve.now/CVE-2022-43553.md): A remote code execution vulnerability in EdgeRouters (Version 2.0.9-hotfix.4 and earlier) allows a malicious actor with an operator account (CVSS 8.8, EdgeMAX EdgeRouter)
- [CVE-2022-43556](https://cve.now/CVE-2022-43556.md): Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XSS in the text input field since the result das (CVSS 6.1, https://github.com/concretecms/concretecms · concrete5/conc…)
- [CVE-2022-43557](https://cve.now/CVE-2022-43557.md): BD BodyGuard™ Pumps – RS-232 Interface Vulnerability (CVSS 5.3, Becton, Dickinson and Company (BD) BodyGuard™ Pump)
- [CVE-2022-43706](https://cve.now/CVE-2022-43706.md): Cross-site scripting (XSS) vulnerability in the Web UI of StackStorm versions prior to 3.8.0 allowed logged in users with write access to pa (CVSS 5.4)
- [CVE-2022-44009](https://cve.now/CVE-2022-44009.md): Improper access control in Key-Value RBAC in StackStorm version 3.7.0 didn't check the permissions in Jinja filters, allowing attackers to a (CVSS 7.5)
- [CVE-2022-44039](https://cve.now/CVE-2022-44039.md): Franklin Fueling System FFS Colibri 1.9.22.8925 is affected by: File system overwrite. (CVSS 9.8)
- [CVE-2022-45019](https://cve.now/CVE-2022-45019.md): SLiMS 9 Bulian v9.5.0 was discovered to contain a SQL injection vulnerability via the keywords parameter. (CVSS 7.5)
- [CVE-2022-45020](https://cve.now/CVE-2022-45020.md): Rukovoditel v3.2.1 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability in the component /rukovoditel/index.php?mo (CVSS 8.8)
- [CVE-2022-45283](https://cve.now/CVE-2022-45283.md): GPAC MP4box v2.0.0 was discovered to contain a stack overflow in the smil\_parse\_time\_list parameter at /scenegraph/svg\_attributes.c. (CVSS 7.8)
- [CVE-2022-45313](https://cve.now/CVE-2022-45313.md): Mikrotik RouterOs before stable v7.5 was discovered to contain an out-of-bounds read in the hotspot process. (CVSS 8.8)
- [CVE-2022-45315](https://cve.now/CVE-2022-45315.md): Mikrotik RouterOs before stable v7.6 was discovered to contain an out-of-bounds read in the snmp process. (CVSS 6.4, MicroTik RouterOS)
- [CVE-2022-45477](https://cve.now/CVE-2022-45477.md): Telepad allows remote unauthenticated users to send instructions to the server to execute arbitrary code without any previous authorization (CVSS 9.8, Telepad)
- [CVE-2022-45478](https://cve.now/CVE-2022-45478.md): Telepad allows an attacker (in a man-in-the-middle position between the server and a connected device) to see all data (including keypresses (CVSS 5.1, Telepad)
- [CVE-2022-45479](https://cve.now/CVE-2022-45479.md): PC Keyboard allows remote unauthenticated users to send instructions to the server to execute arbitrary code without any previous authorizat (CVSS 9.8, BEAppsMobile PC Keyboard WiFi & Bluetooth)
- [CVE-2022-45481](https://cve.now/CVE-2022-45481.md): The default configuration of Lazy Mouse does not require a password, allowing remote unauthenticated users to execute arbitrary code with no (CVSS 9.8, thisAAY Lazy Mouse)
- [CVE-2022-45769](https://cve.now/CVE-2022-45769.md): A cross-site scripting (XSS) vulnerability in ClicShopping\_V3 v3.402 allows attackers to execute arbitrary web scripts or HTML via a crafted (CVSS 6.1)
- [CVE-2022-45771](https://cve.now/CVE-2022-45771.md): An issue in the /api/audits component of Pwndoc v0.5.3 allows attackers to escalate privileges and execute arbitrary code via uploading a cr (CVSS 8.8)
- [CVE-2022-45912](https://cve.now/CVE-2022-45912.md): An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. (CVSS 7.2)
- [CVE-2022-45990](https://cve.now/CVE-2022-45990.md): A cross-site scripting (XSS) vulnerability in the component /signup\_script.php of Ecommerce-Website v1.0 allows attackers to execute arbitra (CVSS 6.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-12-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.