# CVEs published 2022-12-08

100 CVEs were published on December 8, 2022: 4 critical, 42 high. Days are UTC.

- [CVE-2022-41947](https://cve.now/CVE-2022-41947.md): Cross-site Scripting with user-uploaded files in dhis2-core (CVSS 5.4, dhis2-core)
- [CVE-2022-41948](https://cve.now/CVE-2022-41948.md): Privilege Chaining with the user admin role in dhis2-core (CVSS 6.7, dhis2-core)
- [CVE-2022-41949](https://cve.now/CVE-2022-41949.md): Semi-blind Server-Side Request Forgery in dhis2-core (CVSS 5.0, dhis2-core)
- [CVE-2022-46158](https://cve.now/CVE-2022-46158.md): Potential Information exposure in the upload directory in PrestaShop (CVSS 5.3, PrestaShop · prestashop/prestashop)
- [CVE-2022-46153](https://cve.now/CVE-2022-46153.md): Routes exposed with an empty TLSOption in traefik (CVSS 8.1, traefik · github.com/traefik/traefik +1)
- [CVE-2022-23469](https://cve.now/CVE-2022-23469.md): Authorization header displayed in the debug logs (CVSS 3.5, traefik · github.com/traefik/traefik +1)
- [CVE-2022-23494](https://cve.now/CVE-2022-23494.md): Cross-site scripting vulnerability in TinyMCE alerts (CVSS 5.4, tinymce · tinymce/tinymce)
- [CVE-2022-23495](https://cve.now/CVE-2022-23495.md): ProtoNode may be modified such that common method calls may panic in ipfs/go-merkledag (CVSS 7.5, ipfs go-merkledag · github.com/ipfs/go-merkledag)
- [CVE-2022-23496](https://cve.now/CVE-2022-23496.md): A crafted list can trigger a ArrayIndexOutOfBoundsException in Yauaa (CVSS 7.5, nielsbasjes yauaa · nl.basjes.parse.useragent:yauaa +11)
- [CVE-2022-41717](https://cve.now/CVE-2022-41717.md): Excessive memory growth in net/http and golang.org/x/net/http2 (no CVSS, Go standard library net/http · golang.org/x/net/http2 +2)
- [CVE-2022-46831](https://cve.now/CVE-2022-46831.md): In JetBrains TeamCity between 2022.10 and 2022.10.1 connecting to AWS using the "Default Credential Provider Chain" allowed TeamCity project (CVSS 6.6, JetBrains TeamCity)
- [CVE-2022-46830](https://cve.now/CVE-2022-46830.md): In JetBrains TeamCity between 2022.10 and 2022.10.1 a custom STS endpoint allowed internal port scanning. (CVSS 4.1, JetBrains TeamCity)
- [CVE-2022-46829](https://cve.now/CVE-2022-46829.md): In JetBrains JetBrains Gateway before 2022.3 a client could connect without a valid token if the host consented. (CVSS 7.1, JetBrains Gateway)
- [CVE-2022-46828](https://cve.now/CVE-2022-46828.md): In JetBrains IntelliJ IDEA before 2022.3 a DYLIB injection on macOS was possible. (CVSS 5.2, JetBrains IntelliJ IDEA)
- [CVE-2022-46827](https://cve.now/CVE-2022-46827.md): In JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was possible. (CVSS 3.9, JetBrains IntelliJ IDEA)
- [CVE-2022-46826](https://cve.now/CVE-2022-46826.md): In JetBrains IntelliJ IDEA before 2022.3 the built-in web server allowed an arbitrary file to be read by exploiting a path traversal vulnera (CVSS 6.2, JetBrains IntelliJ IDEA)
- [CVE-2022-46825](https://cve.now/CVE-2022-46825.md): In JetBrains IntelliJ IDEA before 2022.3 the built-in web server leaked information about open projects. (CVSS 4.0, JetBrains IntelliJ IDEA)
- [CVE-2022-46824](https://cve.now/CVE-2022-46824.md): In JetBrains IntelliJ IDEA before 2022.2.4 a buffer overflow in the fsnotifier daemon on macOS was possible. (CVSS 5.6, JetBrains IntelliJ IDEA)
- [CVE-2022-20968](https://cve.now/CVE-2022-20968.md): A vulnerability in the Cisco Discovery Protocol processing feature of Cisco IP Phone 7800 and 8800 Series firmware could allow an unauthenti (CVSS 8.1, Cisco Session Initiation Protocol (SIP) Software)
- [CVE-2022-23476](https://cve.now/CVE-2022-23476.md): Unchecked return value from xmlTextReaderExpand in Nokogiri (CVSS 7.5, sparklemotion nokogiri · nokogiri)
- [CVE-2022-23492](https://cve.now/CVE-2022-23492.md): go-libp2p denial of service vulnerability from lack of resource management (CVSS 7.5, go-libp2p · github.com/libp2p/go-libp2p)
- [CVE-2020-36609](https://cve.now/CVE-2020-36609.md): annyshow DuxCMS Article edit cross site scripting (CVSS 2.4, annyshow DuxCMS)
- [CVE-2020-36610](https://cve.now/CVE-2020-36610.md): annyshow DuxCMS cross-site request forgery (CVSS 4.3, annyshow DuxCMS)
- [CVE-2022-3260](https://cve.now/CVE-2022-3260.md): The response header has not enabled X-FRAME-OPTIONS, Which helps prevents against Clickjacking attack.. (CVSS 4.8, Openshift)
- [CVE-2022-3262](https://cve.now/CVE-2022-3262.md): A flaw was found in Openshift. (CVSS 8.1, openshift)
- [CVE-2022-33186](https://cve.now/CVE-2022-33186.md): A vulnerability in Brocade Fabric OS software v9.1.1, v9.0.1e, v8.2.3c, v7.4.2j, and earlier versions could allow a remote unauthenticated a (CVSS 9.8, Brocade Fabric OS)
- [CVE-2022-37916](https://cve.now/CVE-2022-37916.md): Broken Access Control for some Web-based Management URLs in AirWave Management Platform (CVSS 8.1, Aruba AirWave Management Platform)
- [CVE-2022-37917](https://cve.now/CVE-2022-37917.md): Broken Access Control for some Web-based Management URLs in AirWave Management Platform (CVSS 8.1, Aruba AirWave Management Platform)
- [CVE-2022-37918](https://cve.now/CVE-2022-37918.md): Broken Access Control for some Web-based Management URLs in AirWave Management Platform (CVSS 8.1, Aruba AirWave Management Platform)
- [CVE-2022-38599](https://cve.now/CVE-2022-38599.md): Teleport v3.2.2, Teleport v3.5.6-rc6, and Teleport v3.6.3-b2 was discovered to contain an information leak via the /user/get-role-list web i (CVSS 6.5)
- [CVE-2022-38754](https://cve.now/CVE-2022-38754.md): CVE-2022-38754 - Micro Focus Operations Bridge Manager and OpsBridge Containerized - Cross Site Scripting (XSS) (CVSS 8.0, Micro Focus Operations Bridge Manager · Micro Focus Operati…)
- [CVE-2022-38765](https://cve.now/CVE-2022-38765.md): Canon Medical Informatics Vitrea Vision 7.7.76.1 does not adequately enforce access controls. (CVSS 6.5)
- [CVE-2022-39894](https://cve.now/CVE-2022-39894.md): Improper access control vulnerability in ContactListStartActivityHelper in Phone prior to SMR Dec-2022 Release 1 allows to access sensitive (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2022-39895](https://cve.now/CVE-2022-39895.md): Improper access control vulnerability in ContactListUtils in Phone prior to SMR Dec-2022 Release 1 allows to access contact group informatio (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2022-39896](https://cve.now/CVE-2022-39896.md): Improper access control vulnerabilities in Contacts prior to SMR Dec-2022 Release 1 allows to access sensitive information via implicit inte (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2022-39897](https://cve.now/CVE-2022-39897.md): Exposure of Sensitive Information vulnerability in kernel prior to SMR Dec-2022 Release 1 allows attackers to access the kernel address info (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2022-39898](https://cve.now/CVE-2022-39898.md): Improper access control vulnerability in IIccPhoneBook prior to SMR Dec-2022 Release 1 allows attackers to access some information of usim. (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2022-39899](https://cve.now/CVE-2022-39899.md): Improper authentication vulnerability in Samsung WindowManagerService prior to SMR Dec-2022 Release 1 allows attacker to send the input even (CVSS 5.7, Samsung Mobile Devices)
- [CVE-2022-39900](https://cve.now/CVE-2022-39900.md): Improper access control vulnerability in Nice Catch prior to SMR Dec-2022 Release 1 allows physical attackers to access contents of all toas (CVSS 4.6, Samsung Mobile Devices)
- [CVE-2022-39901](https://cve.now/CVE-2022-39901.md): Improper authentication in Exynos baseband prior to SMR DEC-2022 Release 1 allows remote attacker to disable the network traffic encryption (CVSS 6.5, Samsung Mobile Devices)
- [CVE-2022-39902](https://cve.now/CVE-2022-39902.md): Improper authorization in Exynos baseband prior to SMR DEC-2022 Release 1 allows remote attacker to get sensitive information including IMEI (CVSS 6.5, Samsung Mobile Devices)
- [CVE-2022-39903](https://cve.now/CVE-2022-39903.md): Improper access control vulnerability in RCS call prior to SMR Dec-2022 Release 1 allows local attackers to access RCS incoming call number. (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2022-39904](https://cve.now/CVE-2022-39904.md): Exposure of Sensitive Information vulnerability in Samsung Settings prior to SMR Dec-2022 Release 1 allows local attackers to access the Net (CVSS 3.3, Samsung Mobile Devices)
- [CVE-2022-39905](https://cve.now/CVE-2022-39905.md): Implicit intent hijacking vulnerability in Telecom application prior to SMR Dec-2022 Release 1 allows attacker to access sensitive informati (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2022-39906](https://cve.now/CVE-2022-39906.md): Improper access control vulnerability in SecTelephonyProvider prior to SMR Dec-2022 Release 1 allows attackers to access message information (CVSS 2.3, Samsung Mobile Devices)
- [CVE-2022-39907](https://cve.now/CVE-2022-39907.md): Integer overflow vulnerability in Samsung decoding library for video thumbnails prior to SMR Dec-2022 Release 1 allows local attacker to per (CVSS 6.9, Samsung Mobile Devices)
- [CVE-2022-39908](https://cve.now/CVE-2022-39908.md): TOCTOU vulnerability in Samsung decoding library for video thumbnails prior to SMR Dec-2022 Release 1 allows local attacker to perform Out-O (CVSS 6.9, Samsung Mobile Devices)
- [CVE-2022-39909](https://cve.now/CVE-2022-39909.md): Insufficient verification of data authenticity vulnerability in Samsung Gear IconX PC Manager prior to version 2.1.221019.51 allows local at (CVSS 7.1, Samsung Mobile Samsung Gear IconX PC Manager)
- [CVE-2022-39910](https://cve.now/CVE-2022-39910.md): Improper access control vulnerability in Samsung Pass prior to version 4.0.06.7 allow physical attackers to access data of Samsung Pass on a (CVSS 3.9, Samsung Mobile Samsung Pass)
- [CVE-2022-39911](https://cve.now/CVE-2022-39911.md): Improper check or handling of exceptional conditions vulnerability in Samsung Pass prior to version 4.0.06.1 allows attacker to access Samsu (CVSS 4.8, Samsung Mobile Samsung Pass)
- [CVE-2022-39912](https://cve.now/CVE-2022-39912.md): Improper handling of insufficient permissions vulnerability in setSecureFolderPolicy in PersonaManagerService prior to Android T(13) allows (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2022-39913](https://cve.now/CVE-2022-39913.md): Exposure of Sensitive Information to an Unauthorized Actor in Persona Manager prior to Android T(13) allows local attacker to access user pr (CVSS 6.8, Samsung Mobile Devices)
- [CVE-2022-39914](https://cve.now/CVE-2022-39914.md): Exposure of Sensitive Information from an Unauthorized Actor vulnerability in Samsung DisplayManagerService prior to Android T(13) allows lo (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2022-39915](https://cve.now/CVE-2022-39915.md): Improper access control vulnerability in Calendar prior to versions 11.6.08.0 in Android Q(10), 12.2.11.3000 in Android R(11), 12.3.07.2000 (CVSS 3.3, Samsung Mobile Samsung Calendar)
- [CVE-2022-40939](https://cve.now/CVE-2022-40939.md): In certain Secustation products the administrator account password can be read. (CVSS 4.9)
- [CVE-2022-4122](https://cve.now/CVE-2022-4122.md): A vulnerability was found in buildah. (CVSS 5.3, podman · github.com/containers/podman/v4 +3)
- [CVE-2022-4123](https://cve.now/CVE-2022-4123.md): A flaw was found in Buildah. (CVSS 3.3, podman · github.com/containers/podman/v4)
- [CVE-2022-41802](https://cve.now/CVE-2022-41802.md): Kernel subsystem in kernel\_liteos\_a has a kernel stack overflow vulnerability when call SysClockGetres. (CVSS 4.0, OpenHarmony)
- [CVE-2022-4347](https://cve.now/CVE-2022-4347.md): xiandafu beetl-bbs WebUtils.java cross site scripting (CVSS 3.5, xiandafu beetl-bbs)
- [CVE-2022-4348](https://cve.now/CVE-2022-4348.md): y\_project RuoYi-Cloud JSON cross site scripting (CVSS 3.5, y\_project RuoYi-Cloud · com.ruoyi:ruoyi-common)
- [CVE-2022-4349](https://cve.now/CVE-2022-4349.md): CTF-hacker pwn delete.html cross-site request forgery (CVSS 4.3, CTF-hacker pwn)
- [CVE-2022-4350](https://cve.now/CVE-2022-4350.md): Mingsoft MCMS search.do cross site scripting (CVSS 3.5, Mingsoft MCMS · net.mingsoft:ms-mcms)
- [CVE-2022-4353](https://cve.now/CVE-2022-4353.md): LinZhaoguan pb-cms IpUtil.getIpAddr cross site scripting (CVSS 3.5, LinZhaoguan pb-cms)
- [CVE-2022-4354](https://cve.now/CVE-2022-4354.md): LinZhaoguan pb-cms Message Board comment cross site scripting (CVSS 4.3, LinZhaoguan pb-cms)
- [CVE-2022-4364](https://cve.now/CVE-2022-4364.md): Teledyne FLIR AX8 Web Service palette.php command injection (CVSS 6.9, Teledyne FLIR AX8)
- [CVE-2022-4366](https://cve.now/CVE-2022-4366.md): Missing Authorization in lirantal/daloradius (CVSS 5.3, lirantal/daloradius)
- [CVE-2022-44455](https://cve.now/CVE-2022-44455.md): The appspawn and nwebspawn services were found to be vulnerable to buffer overflow vulnerability due to insufficient input validation. (CVSS 6.8, OpenHarmony)
- [CVE-2022-44931](https://cve.now/CVE-2022-44931.md): Tenda A18 v15.13.07.09 was discovered to contain a stack overflow via the security\_5g parameter at /goform/WifiBasicSet. (CVSS 7.5)
- [CVE-2022-44932](https://cve.now/CVE-2022-44932.md): An access control issue in Tenda A18 v15.13.07.09 allows unauthenticated attackers to access the Telnet service. (CVSS 7.5)
- [CVE-2022-44938](https://cve.now/CVE-2022-44938.md): Weak reset token generation in SeedDMS v6.0.20 and v5.1.7 allows attackers to execute a full account takeover via a brute force attack. (CVSS 9.8)
- [CVE-2022-45118](https://cve.now/CVE-2022-45118.md): Telephony in communication subsystem sends public events with personal data, but the permission is not set. (CVSS 6.2, OpenHarmony)
- [CVE-2022-45497](https://cve.now/CVE-2022-45497.md): Tenda W6-S v1.0.0.4(510) was discovered to contain a command injection vulnerability in the tpi\_get\_ping\_output function at /goform/exeComma (CVSS 9.8)
- [CVE-2022-45498](https://cve.now/CVE-2022-45498.md): An issue in the component tpi\_systool\_handle(0) (/goform/SysToolReboot) of Tenda W6-S v1.0.0.4(510) allows unauthenticated attackers to arbi (CVSS 7.5)
- [CVE-2022-45499](https://cve.now/CVE-2022-45499.md): Tenda W6-S v1.0.0.4(510) was discovered to contain a stack overflow via the wl\_radio parameter at /goform/WifiMacFilterGet. (CVSS 7.5)
- [CVE-2022-45501](https://cve.now/CVE-2022-45501.md): Tenda W6-S v1.0.0.4(510) was discovered to contain a stack overflow via the wl\_radio parameter at /goform/wifiSSIDset. (CVSS 7.5)
- [CVE-2022-45503](https://cve.now/CVE-2022-45503.md): Tenda W6-S v1.0.0.4(510) was discovered to contain a stack overflow via the linkEn parameter at /goform/setAutoPing. (CVSS 7.5)
- [CVE-2022-45504](https://cve.now/CVE-2022-45504.md): An issue in the component tpi\_systool\_handle(0) (/goform/SysToolRestoreSet) of Tenda W6-S v1.0.0.4(510) allows unauthenticated attackers to (CVSS 7.5)
- [CVE-2022-45505](https://cve.now/CVE-2022-45505.md): Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the cmdinput parameter at /goform/exeCommand. (CVSS 7.5)
- [CVE-2022-45506](https://cve.now/CVE-2022-45506.md): Tenda W30E v1.0.1.25(633) was discovered to contain a command injection vulnerability via the fileNameMit parameter at /goform/delFileName. (CVSS 9.8)
- [CVE-2022-45507](https://cve.now/CVE-2022-45507.md): Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the editNameMit parameter at /goform/editFileName. (CVSS 7.5)
- [CVE-2022-45508](https://cve.now/CVE-2022-45508.md): Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the new\_account parameter at /goform/editUserName. (CVSS 7.5)
- [CVE-2022-45509](https://cve.now/CVE-2022-45509.md): Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the account parameter at /goform/addUserName. (CVSS 7.5)
- [CVE-2022-45510](https://cve.now/CVE-2022-45510.md): Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the mit\_ssid\_index parameter at /goform/AdvSetWrlsafeset. (CVSS 7.5)
- [CVE-2022-45511](https://cve.now/CVE-2022-45511.md): Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the PPPOEPassword parameter at /goform/QuickIndex. (CVSS 7.5)
- [CVE-2022-45512](https://cve.now/CVE-2022-45512.md): Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/SafeEmailFilter. (CVSS 7.5)
- [CVE-2022-45513](https://cve.now/CVE-2022-45513.md): Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/P2pListFilter. (CVSS 7.5)
- [CVE-2022-45514](https://cve.now/CVE-2022-45514.md): Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/webExcptypemanFilter. (CVSS 7.5)
- [CVE-2022-45515](https://cve.now/CVE-2022-45515.md): Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the entries parameter at /goform/addressNat. (CVSS 7.5)
- [CVE-2022-45516](https://cve.now/CVE-2022-45516.md): Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/NatStaticSetting. (CVSS 7.5)
- [CVE-2022-45517](https://cve.now/CVE-2022-45517.md): Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/VirtualSer. (CVSS 7.5)
- [CVE-2022-45518](https://cve.now/CVE-2022-45518.md): Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/SetIpBind. (CVSS 7.5)
- [CVE-2022-45519](https://cve.now/CVE-2022-45519.md): Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the Go parameter at /goform/SafeMacFilter. (CVSS 7.5)
- [CVE-2022-45520](https://cve.now/CVE-2022-45520.md): Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/qossetting. (CVSS 7.5)
- [CVE-2022-45521](https://cve.now/CVE-2022-45521.md): Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/SafeUrlFilter. (CVSS 7.5)
- [CVE-2022-45522](https://cve.now/CVE-2022-45522.md): Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/SafeClientFilter. (CVSS 7.5)
- [CVE-2022-45523](https://cve.now/CVE-2022-45523.md): Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the page parameter at /goform/L7Im. (CVSS 7.5)
- [CVE-2022-45524](https://cve.now/CVE-2022-45524.md): Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the opttype parameter at /goform/IPSECsave. (CVSS 7.5)
- [CVE-2022-45525](https://cve.now/CVE-2022-45525.md): Tenda W30E V1.0.1.25(633) was discovered to contain a stack overflow via the downaction parameter at /goform/CertListInfo. (CVSS 7.5)
- [CVE-2022-45877](https://cve.now/CVE-2022-45877.md): PIN code is transmitted to the peer device in plain text during cross-device authentication, which reduces the difficulty of man-in-the-middle attacks. (CVSS 8.3, OpenHarmony)
- [CVE-2022-46792](https://cve.now/CVE-2022-46792.md): Hasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many API for Postgres backends. (CVSS 8.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-12-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.