# CVEs published 2022-12-06

94 CVEs were published on December 6, 2022: 8 critical, 32 high. Days are UTC.

- [CVE-2022-42699](https://cve.now/CVE-2022-42699.md): WordPress Easy WP SMTP Plugin \<= 1.5.1 is vulnerable to Remote Code Execution (RCE) (CVSS 9.1, WPecommerce, Alexanderfoxc Easy WP SMTP)
- [CVE-2022-45829](https://cve.now/CVE-2022-45829.md): WordPress Easy WP SMTP Plugin \<= 1.5.1 is vulnerable to Arbitrary File Deletion (CVSS 8.7, WPecommerce, Alexanderfoxc Easy WP SMTP)
- [CVE-2022-45833](https://cve.now/CVE-2022-45833.md): WordPress Easy WP SMTP Plugin \<= 1.5.1 is vulnerable to Directory Traversal (CVSS 6.8, WPecommerce, Alexanderfoxc Easy WP SMTP)
- [CVE-2022-45816](https://cve.now/CVE-2022-45816.md): WordPress GD bbPress Attachments Plugin \<= 4.3.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 4.8, Milan Petrovic GD bbPress Attachments)
- [CVE-2022-45848](https://cve.now/CVE-2022-45848.md): WordPress Contest Gallery Plugin \<= 13.1.0.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.1, Contest Gallery)
- [CVE-2022-42888](https://cve.now/CVE-2022-42888.md): WordPress ARMember Plugin \<= 5.5.1 is vulnerable to Privilege Escalation (CVSS 9.8, Reputeinfosystems ARMember)
- [CVE-2022-45359](https://cve.now/CVE-2022-45359.md): WordPress YITH WooCommerce Gift Cards Premium Plugin \<= 3.19.0 is vulnerable to Arbitrary File Upload (CVSS 9.8, YITH WooCommerce Gift Cards)
- [CVE-2022-46333](https://cve.now/CVE-2022-46333.md): Proofpoint Enterprise Protection perl eval() arbitrary command execution (CVSS 7.2, proofpoint enterprise\_protection)
- [CVE-2022-46332](https://cve.now/CVE-2022-46332.md): Proofpoint Enterprise Protection (PPS/PoD) XSS in "Attachment Names" (CVSS 9.6, proofpoint enterprise\_protection)
- [CVE-2022-23475](https://cve.now/CVE-2022-23475.md): dalorRadius full account take over (CVSS 8.8, lirantal daloradius)
- [CVE-2022-46161](https://cve.now/CVE-2022-46161.md): Code injection in pdfmake (CVSS 10.0, bpampuch pdfmake)
- [CVE-2022-43867](https://cve.now/CVE-2022-43867.md): IBM Spectrum Scale command execution (CVSS 7.8, IBM Spectrum Scale)
- [CVE-2022-46154](https://cve.now/CVE-2022-46154.md): Arbitrary file access in KodExplorer (CVSS 8.6, kalcaddle KodExplorer)
- [CVE-2022-23466](https://cve.now/CVE-2022-23466.md): DOM-based cross-site scripting (XSS) in teler dashboard (CVSS 5.4, kitabisa teler · teler.app)
- [CVE-2022-34361](https://cve.now/CVE-2022-34361.md): IBM Sterling Secure Proxy information disclosure (CVSS 5.9, IBM Sterling Secure Proxy)
- [CVE-2022-23470](https://cve.now/CVE-2022-23470.md): Arbitrary file access in the Galaxy data analysis platform (CVSS 8.6, galaxyproject galaxy)
- [CVE-2022-23472](https://cve.now/CVE-2022-23472.md): Use of insecure random number generator in Passeo (CVSS 5.9, ArjunSharda Passeo · passeo)
- [CVE-2022-33875](https://cve.now/CVE-2022-33875.md): An improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability in Fortinet FortiADC version 7.1.0, ve (CVSS 5.1, Fortinet FortiADC)
- [CVE-2022-33876](https://cve.now/CVE-2022-33876.md): Multiple instances of improper input validation vulnerability in Fortinet FortiADC version 7.1.0, version 7.0.0 through 7.0.2 and version 6. (CVSS 5.1, Fortinet FortiADC)
- [CVE-2022-38379](https://cve.now/CVE-2022-38379.md): Improper neutralization of input during web page generation \[CWE-79\] in FortiSOAR 7.0.0 through 7.0.3 and 7.2.0 may allow an authenticated a (CVSS 3.4, Fortinet FortiSOAR)
- [CVE-2022-30305](https://cve.now/CVE-2022-30305.md): An insufficient logging \[CWE-778\] vulnerability in FortiSandbox versions 4.0.0 to 4.0.2, 3.2.0 to 3.2.3 and 3.1.0 to 3.1.5 and FortiDeceptor (CVSS 3.6, Fortinet FortiSandbox · Fortinet FortiDeceptor)
- [CVE-2022-40680](https://cve.now/CVE-2022-40680.md): A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiOS 6.0.7 - 6.0.15, 6.2.2 - 6.2.12, 6 (CVSS 3.8, Fortinet FortiProxy · Fortinet FortiOS)
- [CVE-2022-35843](https://cve.now/CVE-2022-35843.md): An authentication bypass by assumed-immutable data vulnerability \[CWE-302\] in the FortiOS SSH login component 7.2.0, 7.0.0 through 7.0.7, (CVSS 7.7, Fortinet FortiOS · Fortinet FortiProxy)
- [CVE-2022-38123](https://cve.now/CVE-2022-38123.md): Insufficient validation of plugin files (CVSS 8.7, Secomea GateManager)
- [CVE-2022-40209](https://cve.now/CVE-2022-40209.md): WP Smart Import plugin \<= 1.0.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.1, Xylus Themes WP Smart Import)
- [CVE-2022-34881](https://cve.now/CVE-2022-34881.md): Information Exposure Vulnerability in JP1/Automatic Operation (CVSS 3.3, Hitachi JP1/Automatic Operation)
- [CVE-2022-46151](https://cve.now/CVE-2022-46151.md): Reflected XSS (CVSS 6.3, pinterest querybook)
- [CVE-2020-6627](https://cve.now/CVE-2020-6627.md): The web-management application on Seagate Central NAS STCG2000300, STCG3000300, and STCG4000300 devices allows OS command injection via mv\_b (CVSS 9.8)
- [CVE-2022-39090](https://cve.now/CVE-2022-39090.md): In power management service, there is a missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39091](https://cve.now/CVE-2022-39091.md): In power management service, there is a missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39092](https://cve.now/CVE-2022-39092.md): In power management service, there is a missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39093](https://cve.now/CVE-2022-39093.md): In power management service, there is a missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39094](https://cve.now/CVE-2022-39094.md): In power management service, there is a missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39095](https://cve.now/CVE-2022-39095.md): In power management service, there is a missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39096](https://cve.now/CVE-2022-39096.md): In power management service, there is a missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39097](https://cve.now/CVE-2022-39097.md): In power management service, there is a missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39098](https://cve.now/CVE-2022-39098.md): In power management service, there is a missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39099](https://cve.now/CVE-2022-39099.md): In power management service, there is a missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39100](https://cve.now/CVE-2022-39100.md): In power management service, there is a missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39101](https://cve.now/CVE-2022-39101.md): In power management service, there is a missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39102](https://cve.now/CVE-2022-39102.md): In power management service, there is a missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39106](https://cve.now/CVE-2022-39106.md): In sensor driver, there is a possible out of bounds write due to a missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39129](https://cve.now/CVE-2022-39129.md): In face detect driver, there is a possible out of bounds write due to a missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39130](https://cve.now/CVE-2022-39130.md): In face detect driver, there is a possible out of bounds write due to a missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39131](https://cve.now/CVE-2022-39131.md): In camera driver, there is a possible memory corruption due to improper locking. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39132](https://cve.now/CVE-2022-39132.md): In camera driver, there is a possible out of bounds write due to a missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39133](https://cve.now/CVE-2022-39133.md): In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39134](https://cve.now/CVE-2022-39134.md): In audio driver, there is a use after free due to a race condition. (CVSS 4.7, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-40603](https://cve.now/CVE-2022-40603.md): A cross-site scripting (XSS) vulnerability in the CGI program of Zyxel ZyWALL/USG series firmware versions 4.30 through 4.72, VPN series fir (CVSS 4.7, Zyxel ZyWALL/USG series firmware · Zyxel VPN series firm… +2)
- [CVE-2022-41325](https://cve.now/CVE-2022-41325.md): An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4 allows attackers, by tricking a user into opening a craf (CVSS 7.8)
- [CVE-2022-4147](https://cve.now/CVE-2022-4147.md): Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. (CVSS 7.5, quarkus-2 · io.quarkus:quarkus-vertx-http)
- [CVE-2022-41902](https://cve.now/CVE-2022-41902.md): Out of bounds write in grappler in Tensorflow (CVSS 7.1, tensorflow · tensorflow-cpu +1)
- [CVE-2022-41910](https://cve.now/CVE-2022-41910.md): Heap out of bounds read in \`QuantizeAndDequantizeV2\` in Tensorflow (CVSS 4.8, tensorflow · tensorflow-cpu +1)
- [CVE-2022-42754](https://cve.now/CVE-2022-42754.md): In npu driver, there is a memory corruption due to a use after free. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-42755](https://cve.now/CVE-2022-42755.md): In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-42756](https://cve.now/CVE-2022-42756.md): In sensor driver, there is a possible buffer overflow due to a missing bounds check. (CVSS 7.7, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-42757](https://cve.now/CVE-2022-42757.md): In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. (CVSS 3.3, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-42758](https://cve.now/CVE-2022-42758.md): In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. (CVSS 3.3, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-42759](https://cve.now/CVE-2022-42759.md): In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-42760](https://cve.now/CVE-2022-42760.md): In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-42761](https://cve.now/CVE-2022-42761.md): In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-42762](https://cve.now/CVE-2022-42762.md): In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-42763](https://cve.now/CVE-2022-42763.md): In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-42764](https://cve.now/CVE-2022-42764.md): In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-42765](https://cve.now/CVE-2022-42765.md): In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. (CVSS 6.6, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-42766](https://cve.now/CVE-2022-42766.md): In wlan driver, there is a possible missing permission check, This could lead to local information disclosure. (CVSS 6.6, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-42767](https://cve.now/CVE-2022-42767.md): In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. (CVSS 6.6, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-42768](https://cve.now/CVE-2022-42768.md): In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. (CVSS 4.3, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-42769](https://cve.now/CVE-2022-42769.md): In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. (CVSS 3.3, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-42770](https://cve.now/CVE-2022-42770.md): In wlan driver, there is a race condition, This could lead to local denial of service in wlan services. (CVSS 4.7, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-42771](https://cve.now/CVE-2022-42771.md): In wlan driver, there is a race condition, This could lead to local denial of service in wlan services. (CVSS 4.7, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-42772](https://cve.now/CVE-2022-42772.md): In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-42773](https://cve.now/CVE-2022-42773.md): In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-42774](https://cve.now/CVE-2022-42774.md): In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-42775](https://cve.now/CVE-2022-42775.md): In camera driver, there is a possible memory corruption due to improper locking. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-42776](https://cve.now/CVE-2022-42776.md): In UscAIEngine service, there is a missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-42777](https://cve.now/CVE-2022-42777.md): In power management service, there is a missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-42778](https://cve.now/CVE-2022-42778.md): In windows manager service, there is a missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-42779](https://cve.now/CVE-2022-42779.md): In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-42780](https://cve.now/CVE-2022-42780.md): In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-42781](https://cve.now/CVE-2022-42781.md): In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-42782](https://cve.now/CVE-2022-42782.md): In wlan driver, there is a possible missing permission check, This could lead to local information disclosure. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-4296](https://cve.now/CVE-2022-4296.md): TP-Link TL-WR740N ARP resource consumption (CVSS 6.5, TP-Link TL-WR740N)
- [CVE-2022-4300](https://cve.now/CVE-2022-4300.md): FastCMS Template edit injection (CVSS 6.3, FastCMS)
- [CVE-2022-4314](https://cve.now/CVE-2022-4314.md): Improper Privilege Management in ikus060/rdiffweb (CVSS 6.0, ikus060/rdiffweb · rdiffweb)
- [CVE-2022-43363](https://cve.now/CVE-2022-43363.md): Telegram Web 15.3.1 allows XSS via a certain payload derived from a Target Corporation website. (no CVSS)
- [CVE-2022-43369](https://cve.now/CVE-2022-43369.md): AutoTaxi Stand Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component search.php. (CVSS 6.1)
- [CVE-2022-44030](https://cve.now/CVE-2022-44030.md): Redmine 5.x before 5.0.4 allows downloading of file attachments of any Issue or any Wiki page due to insufficient permission checks. (CVSS 7.5)
- [CVE-2022-44289](https://cve.now/CVE-2022-44289.md): Thinkphp 5.1.41 and 5.0.24 has a code logic error which causes file upload getshell. (CVSS 8.8, topthink/framework)
- [CVE-2022-44900](https://cve.now/CVE-2022-44900.md): A directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr v0.20.0 and earlier allows attacke (CVSS 9.1, py7zr)
- [CVE-2022-45326](https://cve.now/CVE-2022-45326.md): An XML external entity (XXE) injection vulnerability in Kwoksys Kwok Information Server before v2.9.5.SP31 allows remote authenticated users (CVSS 4.9)
- [CVE-2022-45548](https://cve.now/CVE-2022-45548.md): AyaCMS v3.1.2 has an Arbitrary File Upload vulnerability. (CVSS 8.8)
- [CVE-2022-46382](https://cve.now/CVE-2022-46382.md): RackN Digital Rebar through 4.6.14, 4.7 through 4.7.22, 4.8 through 4.8.5, 4.9 through 4.9.12, and 4.10 through 4.10.8 has Insecure Permissi (CVSS 8.8)
- [CVE-2022-46383](https://cve.now/CVE-2022-46383.md): RackN Digital Rebar through 4.6.14, 4.7 through 4.7.22, 4.8 through 4.8.5, 4.9 through 4.9.12, and 4.10 through 4.10.8 has exposed a privile (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-12-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.