CVEs published December 7, 2022
79 CVEs were published on December 7, 2022: 9 critical, 31 high.
- Published
- 79
- Critical
- 9
- High
- 31
- Medium
- 35
- Low
- 1
- Unrated
- 3
- Now in CISA KEV
- 0
- Fix available
- 19
Most affected products
- Cisco Analog Telephone Adaptor (ATA) Software
- 6
- GE CIMPLICITY
- 5
- Buffalo network devices
- 3
- Linux
- 3
- OMRON CX-Programmer
- 3
- Six Apart Movable Type
- 3
- UNIMO Technology Co. UDR-JA1604/UDR-JA1608/UDR-JA1616
- 3
- baserCMS Users Community baserCMS · baserproject/basercms
- 2
- PaddlePaddle
- 2
- Apache Software Foundation Apache ManifoldCF
- 1
Critical 9
- CVE-2022-46742Code injection in paddle.audio.functional.get_window in PaddlePaddle 2.4.0-rc0 allows arbitrary code execution.PaddlePaddle
- CVE-2022-42458Authentication bypass using an alternate path or channel vulnerability in bingo!CMS version1.7.4.1 and earlier allows a remote unauthenticatShift Tech bingo!CMS
- CVE-2022-44351Skycaiji v2.5.1 was discovered to contain a deserialization vulnerability via /SkycaijiApp/admin/controller/Mystore.php.
- CVE-2022-44371hope-boot 1.0.0 has a deserialization vulnerability that can cause Remote Code Execution (RCE).
- CVE-2022-45010Simple Phone Book/Directory Web App v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter at /PhoneBook/edit
- CVE-2022-45025Markdown Preview Enhanced v0.6.5 and v0.19.6 for VSCode and Atom was discovered to contain a command injection vulnerability via the PDF fil
- CVE-2022-45026An issue in Markdown Preview Enhanced v0.6.5 and v0.19.6 for VSCode and Atom allows attackers to execute arbitrary commands during the GFM e
- CVE-2022-45550AyaCMS 3.1.2 is vulnerable to Remote Code Execution (RCE).
- CVE-2022-46682Jenkins Plot Plugin 2.1.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins Project Jenkins Plot Plugin · org.jenkins-ci.plugin…
High 31
- CVE-2022-4291Aswjsflt.dll in Avast Antivirus windows caused a crash of the Mozilla Firefox browser due to heap corruptionNortonLifelock Avast Antivirus
- CVE-2022-3092GE CIMPLICITY Out-of-bounds WriteGE CIMPLICITY
- CVE-2022-3084GE CIMPLICITY Access of Uninitialized PointerGE CIMPLICITY
- CVE-2022-2952GE CIMPLICITY Access of Uninitialized PointerGE CIMPLICITY
- CVE-2022-2948GE CIMPLICITY Heap-based Buffer OverflowGE CIMPLICITY
- CVE-2022-2002GE CIMPLICITY Untrusted Pointer DereferenceGE CIMPLICITY
- CVE-2022-23487libp2p denial of service vulnerability from lack of resource managementjs-libp2p · libp2p
- CVE-2022-23486libp2p-rust denial of service vulnerability from lack of resource managementrust-libp2p · libp2p
- CVE-2022-43581IBM Content Navigator code executionIBM Content Navigator
- CVE-2022-41720Restricted file access on Windows in os and net/httpGo standard library os · Go standard library net/http +1
- CVE-2022-3641Elevation of privilege in the Azure SQL Data Source in Devolutions Remote Desktop Manager 2022.3.13 to 2022.3.24 allows an authenticated useDevolutions Remote Desktop Manager
- CVE-2022-46741Out-of-bounds read in gather_tree in PaddlePaddle before 2.4.PaddlePaddle
- CVE-2022-41800Appliance mode iControl REST vulnerabilityF5 BIG-IP
- CVE-2022-41622iControl SOAP vulnerabilityF5 BIG-IP · F5 BIG-IQ Centralized Management
- CVE-2022-40966Authentication bypass vulnerability in multiple Buffalo network devices allows a network-adjacent attacker to bypass authentication and acceBuffalo network devices
- CVE-2022-43464Hidden functionality vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote authUNIMO Technology Co. UDR-JA1604/UDR-JA1608/UDR-JA1616
- CVE-2022-43468External initialization of trusted variables or data stores vulnerability exists in WordPress Popular Posts 6.0.5 and earlier, therefore theHector Cabrera WordPress Popular Posts
- CVE-2022-43508Use-after free vulnerability exists in CX-Programmer v.9.77 and earlier, which may lead to information disclosure and/or arbitrary code execOMRON CX-Programmer
- CVE-2022-43509Out-of-bounds write vulnerability exists in CX-Programmer v.9.77 and earlier, which may lead to information disclosure and/or arbitrary codeOMRON CX-Programmer
- CVE-2022-43660Improper neutralization of Server-Side Includes (SSW) within a web page in Movable Type series allows a remote authenticated attacker with PSix Apart Movable Type
- CVE-2022-43667Stack-based buffer overflow vulnerability exists in CX-Programmer v.9.77 and earlier, which may lead to information disclosure and/or arbitrOMRON CX-Programmer
- CVE-2022-44373A stack overflow vulnerability exists in TrendNet Wireless AC Easy-Upgrader TEW-820AP (Version v1.0R, firmware version 1.01.B01) which may r
- CVE-2022-44393Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=services/view_service&id=.
- CVE-2022-44606OS command injection vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote authUNIMO Technology Co. UDR-JA1604/UDR-JA1608/UDR-JA1616
- CVE-2022-44608Uncontrolled resource consumption vulnerability in Cybozu Remote Service 4.0.0 to 4.0.3 allows a remote authenticated attacker to consume huCybozu Remote Service
- CVE-2022-44620Improper authentication vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote aUNIMO Technology Co. UDR-JA1604/UDR-JA1608/UDR-JA1616
- CVE-2022-44849A Cross-Site Request Forgery (CSRF) in the Administrator List of MetInfo v7.7 allows attackers to arbitrarily add Super Administrator accoun
- CVE-2022-44942Casdoor before v1.126.1 was discovered to contain an arbitrary file deletion vulnerability via the uploadFile function.github.com/casdoor/casdoor
- CVE-2022-45009Online Leave Management System v1.0 was discovered to contain an arbitrary file upload vulnerability at /leave_system/classes/SystemSettings
- CVE-2022-45915ILIAS before 7.16 allows OS Command Injection.
- CVE-2022-46770qubes-mirage-firewall (aka Mirage firewall for QubesOS) 0.8.x through 0.8.3 allows guest OS users to cause a denial of service (CPU consumpt
Medium, low and unrated 39
- CVE-2022-23471containerd CRI stream server: Host memory exhaustion through terminal resize goroutine leakcontainerd · github.com/containerd/containerd
- CVE-2022-23491Removal of TrustCor root certificatepython-certifi · certifi
- CVE-2022-20691A vulnerability in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Adaptive Telephone Adapter firmware could allow an unaCisco Analog Telephone Adaptor (ATA) Software
- CVE-2022-20690Multiple vulnerabilities in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allowCisco Analog Telephone Adaptor (ATA) Software
- CVE-2022-20689Multiple vulnerabilities in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allowCisco Analog Telephone Adaptor (ATA) Software
- CVE-2022-20688A vulnerability in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unautCisco Analog Telephone Adaptor (ATA) Software
- CVE-2022-20687Multiple vulnerabilities in the Link Layer Discovery Protocol (LLDP) functionality of Cisco ATA 190 Series Analog Telephone Adapter firmwareCisco Analog Telephone Adaptor (ATA) Software
- CVE-2022-20686Multiple vulnerabilities in the Link Layer Discovery Protocol (LLDP) functionality of Cisco ATA 190 Series Analog Telephone Adapter firmwareCisco Analog Telephone Adaptor (ATA) Software
- CVE-2022-41735IBM Business Process Manager cross-site scriptingIBM Business Process Manager
- CVE-2020-36565Directory traversal on Windows in github.com/labstack/echo/v4github.com/labstack/echo/v4
- CVE-2022-45910Apache ManifoldCF: LDAP Injection Vulnerability - ActiveDirectory AuthoritiesApache Software Foundation Apache ManifoldCF
- CVE-2022-34840Use of hard-coded credentials vulnerability in multiple Buffalo network devices allows a network-adjacent attacker to alter?configuration seBuffalo network devices
- CVE-2022-3643Guests can trigger NIC interface reset/abort/crash via netback It is possible for a guest to trigger a NIC interface reset/abort/crash in a Linux
- CVE-2022-37406Cross-site scripting vulnerability in Aficio SP 4210N firmware versions prior to Web Support 1.05 allows a remote authenticated attacker witRICOH COMPANY Aficio SP
- CVE-2022-39044Hidden functionality vulnerability in multiple Buffalo network devices allows a network-adjacent attacker with an administrative privilege tBuffalo network devices
- CVE-2022-41783tdpServer of TP-Link RE300 V1 improperly processes its input, which may allow an attacker to cause a denial-of-service (DoS) condition of thTP-Link RE300
- CVE-2022-41994Stored cross-site scripting vulnerability in Permission Settings of baserCMS versions prior to 4.7.2 allows a remote authenticated attacker baserCMS Users Community baserCMS · baserproject/basercms
- CVE-2022-42328Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vLinux
- CVE-2022-42329Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vLinux
- CVE-2022-42486Stored cross-site scripting vulnerability in User group management of baserCMS versions prior to 4.7.2 allows a remote authenticated attackebaserCMS Users Community baserCMS · baserproject/basercms
- CVE-2022-4261Rapid7 Nexpose Update Validation IssueRapid7 Nexpose · Rapid7 InsightVM
- CVE-2022-4322maku-boot Scheduled Task AbstractScheduleJob.java doExecute injectionmaku-boot
- CVE-2022-4341csliuwy coder-chain_gdut cross site scriptingcsliuwy coder-chain_gdut
- CVE-2022-43668Typora versions prior to 1.4.4 fails to properly neutralize JavaScript code, which may result in executing JavaScript code contained in the Typora
- CVE-2022-44153Rapid Software LLC Rapid SCADA 5.8.4 is vulnerable to Cross Site Scripting (XSS).
- CVE-2022-44361An issue was discovered in ZZCMS 2022.
- CVE-2022-45008Online Leave Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /leave_syst
- CVE-2022-45113Improper validation of syntactic correctness of input vulnerability exist in Movable Type series.Six Apart Movable Type
- CVE-2022-45122Cross-site scripting vulnerability in Movable Type Movable Type 7 r.5301 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.5301Six Apart Movable Type
- CVE-2022-45217A cross-site scripting (XSS) vulnerability in Book Store Management System v1.0.0 allows attackers to execute arbitrary web scripts or HTML
- CVE-2022-45916ILIAS before 7.16 allows XSS.
- CVE-2022-45917ILIAS before 7.16 has an Open Redirect.
- CVE-2022-45918ILIAS before 7.16 allows External Control of File Name or Path.
- CVE-2022-46683Jenkins Google Login Plugin 1.4 through 1.6 (both inclusive) improperly determines that a redirect URL after login is legitimately pointing Jenkins Project Jenkins Google Login Plugin · org.jenkins-c…
- CVE-2022-46684Jenkins Checkmarx Plugin 2022.3.3 and earlier does not escape values returned from the Checkmarx service API before inserting them into HTMLJenkins Project Jenkins Checkmarx Plugin · com.checkmarx.je…
- CVE-2022-46685In Jenkins Gitea Plugin 1.4.4 and earlier, the implementation of Gitea personal access tokens did not support credentials masking, potentialJenkins Project Jenkins Gitea Plugin · org.jenkins-ci.plugi…
- CVE-2022-46686Jenkins Custom Build Properties Plugin 2.79.vc095ccc85094 and earlier does not escape property values and build display names on the Custom Jenkins Project Jenkins Custom Build Properties Plugin · io…
- CVE-2022-46687Jenkins Spring Config Plugin 2.0.0 and earlier does not escape build display names shown on the Spring Config view, resulting in a stored crJenkins Project Jenkins Spring Config Plugin · io.jenkins.p…
- CVE-2022-46688A cross-site request forgery (CSRF) vulnerability in Jenkins Sonar Gerrit Plugin 377.v8f3808963dc5 and earlier allows attackers to have JenkJenkins Project Jenkins Sonar Gerrit Plugin · org.jenkins-c…