CVEs published December 8, 2022
100 CVEs were published on December 8, 2022: 4 critical, 42 high.
- Published
- 100
- Critical
- 4
- High
- 42
- Medium
- 41
- Low
- 12
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 43
Most affected products
- Samsung Mobile Devices
- 18
- JetBrains IntelliJ IDEA
- 5
- OpenHarmony
- 4
- Aruba AirWave Management Platform
- 3
- dhis2-core
- 3
- annyshow DuxCMS
- 2
- JetBrains TeamCity
- 2
- LinZhaoguan pb-cms
- 2
- Samsung Mobile Samsung Pass
- 2
- traefik · github.com/traefik/traefik +1
- 2
Critical 4
- CVE-2022-33186A vulnerability in Brocade Fabric OS software v9.1.1, v9.0.1e, v8.2.3c, v7.4.2j, and earlier versions could allow a remote unauthenticated aBrocade Fabric OS
- CVE-2022-44938Weak reset token generation in SeedDMS v6.0.20 and v5.1.7 allows attackers to execute a full account takeover via a brute force attack.
- CVE-2022-45497Tenda W6-S v1.0.0.4(510) was discovered to contain a command injection vulnerability in the tpi_get_ping_output function at /goform/exeComma
- CVE-2022-45506Tenda W30E v1.0.1.25(633) was discovered to contain a command injection vulnerability via the fileNameMit parameter at /goform/delFileName.
High 42
- CVE-2022-46153Routes exposed with an empty TLSOption in traefiktraefik · github.com/traefik/traefik +1
- CVE-2022-23495ProtoNode may be modified such that common method calls may panic in ipfs/go-merkledagipfs go-merkledag · github.com/ipfs/go-merkledag
- CVE-2022-23496A crafted list can trigger a ArrayIndexOutOfBoundsException in Yauaa nielsbasjes yauaa · nl.basjes.parse.useragent:yauaa +11
- CVE-2022-46829In JetBrains JetBrains Gateway before 2022.3 a client could connect without a valid token if the host consented.JetBrains Gateway
- CVE-2022-20968A vulnerability in the Cisco Discovery Protocol processing feature of Cisco IP Phone 7800 and 8800 Series firmware could allow an unauthentiCisco Session Initiation Protocol (SIP) Software
- CVE-2022-23476Unchecked return value from xmlTextReaderExpand in Nokogirisparklemotion nokogiri · nokogiri
- CVE-2022-23492go-libp2p denial of service vulnerability from lack of resource managementgo-libp2p · github.com/libp2p/go-libp2p
- CVE-2022-3262A flaw was found in Openshift.openshift
- CVE-2022-37916Broken Access Control for some Web-based Management URLs in AirWave Management PlatformAruba AirWave Management Platform
- CVE-2022-37917Broken Access Control for some Web-based Management URLs in AirWave Management PlatformAruba AirWave Management Platform
- CVE-2022-37918Broken Access Control for some Web-based Management URLs in AirWave Management PlatformAruba AirWave Management Platform
- CVE-2022-38754CVE-2022-38754 - Micro Focus Operations Bridge Manager and OpsBridge Containerized - Cross Site Scripting (XSS)Micro Focus Operations Bridge Manager · Micro Focus Operati…
- CVE-2022-39909Insufficient verification of data authenticity vulnerability in Samsung Gear IconX PC Manager prior to version 2.1.221019.51 allows local atSamsung Mobile Samsung Gear IconX PC Manager
- CVE-2022-44931Tenda A18 v15.13.07.09 was discovered to contain a stack overflow via the security_5g parameter at /goform/WifiBasicSet.
- CVE-2022-44932An access control issue in Tenda A18 v15.13.07.09 allows unauthenticated attackers to access the Telnet service.
- CVE-2022-45498An issue in the component tpi_systool_handle(0) (/goform/SysToolReboot) of Tenda W6-S v1.0.0.4(510) allows unauthenticated attackers to arbi
- CVE-2022-45499Tenda W6-S v1.0.0.4(510) was discovered to contain a stack overflow via the wl_radio parameter at /goform/WifiMacFilterGet.
- CVE-2022-45501Tenda W6-S v1.0.0.4(510) was discovered to contain a stack overflow via the wl_radio parameter at /goform/wifiSSIDset.
- CVE-2022-45503Tenda W6-S v1.0.0.4(510) was discovered to contain a stack overflow via the linkEn parameter at /goform/setAutoPing.
- CVE-2022-45504An issue in the component tpi_systool_handle(0) (/goform/SysToolRestoreSet) of Tenda W6-S v1.0.0.4(510) allows unauthenticated attackers to
- CVE-2022-45505Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the cmdinput parameter at /goform/exeCommand.
- CVE-2022-45507Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the editNameMit parameter at /goform/editFileName.
- CVE-2022-45508Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the new_account parameter at /goform/editUserName.
- CVE-2022-45509Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the account parameter at /goform/addUserName.
- CVE-2022-45510Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the mit_ssid_index parameter at /goform/AdvSetWrlsafeset.
- CVE-2022-45511Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the PPPOEPassword parameter at /goform/QuickIndex.
- CVE-2022-45512Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/SafeEmailFilter.
- CVE-2022-45513Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/P2pListFilter.
- CVE-2022-45514Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/webExcptypemanFilter.
- CVE-2022-45515Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the entries parameter at /goform/addressNat.
- CVE-2022-45516Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/NatStaticSetting.
- CVE-2022-45517Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/VirtualSer.
- CVE-2022-45518Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/SetIpBind.
- CVE-2022-45519Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the Go parameter at /goform/SafeMacFilter.
- CVE-2022-45520Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/qossetting.
- CVE-2022-45521Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/SafeUrlFilter.
- CVE-2022-45522Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/SafeClientFilter.
- CVE-2022-45523Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/L7Im.
- CVE-2022-45524Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the opttype parameter at /goform/IPSECsave.
- CVE-2022-45525Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the downaction parameter at /goform/CertListInfo.
- CVE-2022-45877PIN code is transmitted to the peer device in plain text during cross-device authentication, which reduces the difficulty of man-in-the-middle attacks.OpenHarmony
- CVE-2022-46792Hasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many API for Postgres backends.
Medium, low and unrated 54
- CVE-2022-41947Cross-site Scripting with user-uploaded files in dhis2-core dhis2-core
- CVE-2022-41948Privilege Chaining with the user admin role in dhis2-coredhis2-core
- CVE-2022-41949Semi-blind Server-Side Request Forgery in dhis2-coredhis2-core
- CVE-2022-46158Potential Information exposure in the upload directory in PrestaShopPrestaShop · prestashop/prestashop
- CVE-2022-23469Authorization header displayed in the debug logstraefik · github.com/traefik/traefik +1
- CVE-2022-23494Cross-site scripting vulnerability in TinyMCE alertstinymce · tinymce/tinymce
- CVE-2022-41717Excessive memory growth in net/http and golang.org/x/net/http2Go standard library net/http · golang.org/x/net/http2 +2
- CVE-2022-46831In JetBrains TeamCity between 2022.10 and 2022.10.1 connecting to AWS using the "Default Credential Provider Chain" allowed TeamCity projectJetBrains TeamCity
- CVE-2022-46830In JetBrains TeamCity between 2022.10 and 2022.10.1 a custom STS endpoint allowed internal port scanning.JetBrains TeamCity
- CVE-2022-46828In JetBrains IntelliJ IDEA before 2022.3 a DYLIB injection on macOS was possible.JetBrains IntelliJ IDEA
- CVE-2022-46827In JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was possible.JetBrains IntelliJ IDEA
- CVE-2022-46826In JetBrains IntelliJ IDEA before 2022.3 the built-in web server allowed an arbitrary file to be read by exploiting a path traversal vulneraJetBrains IntelliJ IDEA
- CVE-2022-46825In JetBrains IntelliJ IDEA before 2022.3 the built-in web server leaked information about open projects.JetBrains IntelliJ IDEA
- CVE-2022-46824In JetBrains IntelliJ IDEA before 2022.2.4 a buffer overflow in the fsnotifier daemon on macOS was possible.JetBrains IntelliJ IDEA
- CVE-2020-36609annyshow DuxCMS Article edit cross site scriptingannyshow DuxCMS
- CVE-2020-36610annyshow DuxCMS cross-site request forgeryannyshow DuxCMS
- CVE-2022-3260The response header has not enabled X-FRAME-OPTIONS, Which helps prevents against Clickjacking attack..Openshift
- CVE-2022-38599Teleport v3.2.2, Teleport v3.5.6-rc6, and Teleport v3.6.3-b2 was discovered to contain an information leak via the /user/get-role-list web i
- CVE-2022-38765Canon Medical Informatics Vitrea Vision 7.7.76.1 does not adequately enforce access controls.
- CVE-2022-39894Improper access control vulnerability in ContactListStartActivityHelper in Phone prior to SMR Dec-2022 Release 1 allows to access sensitive Samsung Mobile Devices
- CVE-2022-39895Improper access control vulnerability in ContactListUtils in Phone prior to SMR Dec-2022 Release 1 allows to access contact group informatioSamsung Mobile Devices
- CVE-2022-39896Improper access control vulnerabilities in Contacts prior to SMR Dec-2022 Release 1 allows to access sensitive information via implicit inteSamsung Mobile Devices
- CVE-2022-39897Exposure of Sensitive Information vulnerability in kernel prior to SMR Dec-2022 Release 1 allows attackers to access the kernel address infoSamsung Mobile Devices
- CVE-2022-39898Improper access control vulnerability in IIccPhoneBook prior to SMR Dec-2022 Release 1 allows attackers to access some information of usim.Samsung Mobile Devices
- CVE-2022-39899Improper authentication vulnerability in Samsung WindowManagerService prior to SMR Dec-2022 Release 1 allows attacker to send the input evenSamsung Mobile Devices
- CVE-2022-39900Improper access control vulnerability in Nice Catch prior to SMR Dec-2022 Release 1 allows physical attackers to access contents of all toasSamsung Mobile Devices
- CVE-2022-39901Improper authentication in Exynos baseband prior to SMR DEC-2022 Release 1 allows remote attacker to disable the network traffic encryption Samsung Mobile Devices
- CVE-2022-39902Improper authorization in Exynos baseband prior to SMR DEC-2022 Release 1 allows remote attacker to get sensitive information including IMEISamsung Mobile Devices
- CVE-2022-39903Improper access control vulnerability in RCS call prior to SMR Dec-2022 Release 1 allows local attackers to access RCS incoming call number.Samsung Mobile Devices
- CVE-2022-39904Exposure of Sensitive Information vulnerability in Samsung Settings prior to SMR Dec-2022 Release 1 allows local attackers to access the NetSamsung Mobile Devices
- CVE-2022-39905Implicit intent hijacking vulnerability in Telecom application prior to SMR Dec-2022 Release 1 allows attacker to access sensitive informatiSamsung Mobile Devices
- CVE-2022-39906Improper access control vulnerability in SecTelephonyProvider prior to SMR Dec-2022 Release 1 allows attackers to access message informationSamsung Mobile Devices
- CVE-2022-39907Integer overflow vulnerability in Samsung decoding library for video thumbnails prior to SMR Dec-2022 Release 1 allows local attacker to perSamsung Mobile Devices
- CVE-2022-39908TOCTOU vulnerability in Samsung decoding library for video thumbnails prior to SMR Dec-2022 Release 1 allows local attacker to perform Out-OSamsung Mobile Devices
- CVE-2022-39910Improper access control vulnerability in Samsung Pass prior to version 4.0.06.7 allow physical attackers to access data of Samsung Pass on aSamsung Mobile Samsung Pass
- CVE-2022-39911Improper check or handling of exceptional conditions vulnerability in Samsung Pass prior to version 4.0.06.1 allows attacker to access SamsuSamsung Mobile Samsung Pass
- CVE-2022-39912Improper handling of insufficient permissions vulnerability in setSecureFolderPolicy in PersonaManagerService prior to Android T(13) allows Samsung Mobile Devices
- CVE-2022-39913Exposure of Sensitive Information to an Unauthorized Actor in Persona Manager prior to Android T(13) allows local attacker to access user prSamsung Mobile Devices
- CVE-2022-39914Exposure of Sensitive Information from an Unauthorized Actor vulnerability in Samsung DisplayManagerService prior to Android T(13) allows loSamsung Mobile Devices
- CVE-2022-39915Improper access control vulnerability in Calendar prior to versions 11.6.08.0 in Android Q(10), 12.2.11.3000 in Android R(11), 12.3.07.2000 Samsung Mobile Samsung Calendar
- CVE-2022-40939In certain Secustation products the administrator account password can be read.
- CVE-2022-4122A vulnerability was found in buildah.podman · github.com/containers/podman/v4 +3
- CVE-2022-4123A flaw was found in Buildah.podman · github.com/containers/podman/v4
- CVE-2022-41802Kernel subsystem in kernel_liteos_a has a kernel stack overflow vulnerability when call SysClockGetres.OpenHarmony
- CVE-2022-4347xiandafu beetl-bbs WebUtils.java cross site scriptingxiandafu beetl-bbs
- CVE-2022-4348y_project RuoYi-Cloud JSON cross site scriptingy_project RuoYi-Cloud · com.ruoyi:ruoyi-common
- CVE-2022-4349CTF-hacker pwn delete.html cross-site request forgeryCTF-hacker pwn
- CVE-2022-4350Mingsoft MCMS search.do cross site scriptingMingsoft MCMS · net.mingsoft:ms-mcms
- CVE-2022-4353LinZhaoguan pb-cms IpUtil.getIpAddr cross site scriptingLinZhaoguan pb-cms
- CVE-2022-4354LinZhaoguan pb-cms Message Board comment cross site scriptingLinZhaoguan pb-cms
- CVE-2022-4364Teledyne FLIR AX8 Web Service palette.php command injectionTeledyne FLIR AX8
- CVE-2022-4366Missing Authorization in lirantal/daloradiuslirantal/daloradius
- CVE-2022-44455The appspawn and nwebspawn services were found to be vulnerable to buffer overflow vulnerability due to insufficient input validation.OpenHarmony
- CVE-2022-45118Telephony in communication subsystem sends public events with personal data, but the permission is not set.OpenHarmony