CVEs published December 9, 2022
35 CVEs were published on December 9, 2022: 9 critical, 7 high.
- Published
- 35
- Critical
- 9
- High
- 7
- Medium
- 16
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 20
Most affected products
- neutrinolabs xrdp
- 10
- Symantec Messaging Gateway
- 2
- Western Digital My Cloud
- 2
- akeneo pim-community-dev · akeneo/pim-community-dev
- 1
- Baota
- 1
- Brocade SANnav
- 1
- codecentric spring-boot-admin · de.codecentric:spring-boot-…
- 1
- cube-js cube.js · @cubejs-backend/api-gateway
- 1
- FreshRSS
- 1
- IBM Cloud Transformation Advisor
- 1
Critical 9
- CVE-2022-23510SQl injection in cube-jscube-js cube.js · @cubejs-backend/api-gateway
- CVE-2022-23477Buffer Overflow in xrdpneutrinolabs xrdp
- CVE-2022-23480Buffer Overflow in xrdpneutrinolabs xrdp
- CVE-2022-23479Buffer Overflow occurs in xrdpneutrinolabs xrdp
- CVE-2022-23478Out of Bound Write in xrdpneutrinolabs xrdp
- CVE-2022-23493Out of Bound Read in xrdpneutrinolabs xrdp
- CVE-2022-4170The rxvt-unicode package is vulnerable to a remote code execution, in the Perl background extension, when an attacker can control the data wrxvt-unicode
- CVE-2022-4390A network misconfiguration is present in versions prior to 1.0.9.90 of the NETGEAR RAX30 AX2400 series of routers.NETGEAR Nighthawk RAX30
- CVE-2022-45290Kbase Doc v1.0 was discovered to contain an arbitrary file deletion vulnerability via the component /web/IndexController.java.
High 7
- CVE-2022-46157Remote php code execution in Akeneo PIMakeneo pim-community-dev · akeneo/pim-community-dev
- CVE-2022-46166Spring Boot Admins integrated notifier support allows arbitrary code executioncodecentric spring-boot-admin · de.codecentric:spring-boot-…
- CVE-2022-23484Integer Overflow in xrdpneutrinolabs xrdp
- CVE-2022-23483Out-of-Bound Read in libxrdpneutrinolabs xrdp
- CVE-2022-3259Openshift 4.9 does not use HTTP Strict Transport Security (HSTS) which may allow man-in-the-middle (MITM) attacks.OpenShift
- CVE-2022-44790Interspire Email Marketer through 6.5.1 allows SQL Injection via the surveys module.
- CVE-2022-44838Automotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /services/view_servic
Medium, low and unrated 19
- CVE-2022-23497Insecure file access in FreshRSSFreshRSS
- CVE-2022-41299IBM Cloud Transformation Advisor cross-site scriptingIBM Cloud Transformation Advisor
- CVE-2022-23482Out-of-Bound Read in xrdpneutrinolabs xrdp
- CVE-2022-23481Out-of-Bound Read in xrdpneutrinolabs xrdp
- CVE-2022-23468Buffer Overflow in xrdpneutrinolabs xrdp
- CVE-2022-4264Incorrect privilege assignment in M-Files Web ServerM-Files Web
- CVE-2022-2752Potential vulnerabilities in GM login processSecomea GateManager
- CVE-2022-33187Brocade SANnav before v2.2.1 logs usernames and encoded passwords in debug-enabled logsBrocade SANnav
- CVE-2022-25629An authenticated user who has the privilege to add/edit annotations on the Content tab, can craft a malicious annotation that can be executeSymantec Messaging Gateway
- CVE-2022-25630An authenticated user can embed malicious content with XSS into the admin group policy page.Symantec Messaging Gateway
- CVE-2022-29838Authentication issue with the encrypted volumes and auto mount feature in My Cloud devicesWestern Digital My Cloud
- CVE-2022-29839Remote Backups Application Discloses Stored CredentialsWestern Digital My Cloud
- CVE-2022-34297Yii Yii2 Gii through 2.2.4 allows stored XSS by injecting a payload into any field.yiisoft/yii2-gii
- CVE-2022-3724Crash in the USB HID protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial of service via packet injection or crafted capture file onWireshark Foundation Wireshark
- CVE-2022-4336In BAOTA linux panel there exists a stored xss vulnerability attackers can use to obtain sensitive information via the log analysis feature.Baota
- CVE-2022-4375Mingsoft MCMS list sql injectionMingsoft MCMS · net.mingsoft:ms-mcms
- CVE-2022-4377S-CMS Contact Information Page cross site scriptingS-CMS
- CVE-2022-44213ZKTeco Xiamen Information Technology ZKBio ECO ADMS <=3.1-164 is vulnerable to Cross Site Scripting (XSS).
- CVE-2022-45292User invites for Funkwhale v1.2.8 do not permanently expire after being used for signup and can be used again after an account has been dele