# CVEs published 2022-12-09 35 CVEs were published on December 9, 2022: 9 critical, 7 high. Days are UTC. - [CVE-2022-23497](https://cve.now/CVE-2022-23497.md): Insecure file access in FreshRSS (CVSS 6.5, FreshRSS) - [CVE-2022-23510](https://cve.now/CVE-2022-23510.md): SQl injection in cube-js (CVSS 9.6, cube-js cube.js · @cubejs-backend/api-gateway) - [CVE-2022-46157](https://cve.now/CVE-2022-46157.md): Remote php code execution in Akeneo PIM (CVSS 8.8, akeneo pim-community-dev · akeneo/pim-community-dev) - [CVE-2022-46166](https://cve.now/CVE-2022-46166.md): Spring Boot Admins integrated notifier support allows arbitrary code execution (CVSS 8.1, codecentric spring-boot-admin · de.codecentric:spring-boot-…) - [CVE-2022-41299](https://cve.now/CVE-2022-41299.md): IBM Cloud Transformation Advisor cross-site scripting (CVSS 4.4, IBM Cloud Transformation Advisor) - [CVE-2022-23477](https://cve.now/CVE-2022-23477.md): Buffer Overflow in xrdp (CVSS 9.1, neutrinolabs xrdp) - [CVE-2022-23484](https://cve.now/CVE-2022-23484.md): Integer Overflow in xrdp (CVSS 8.2, neutrinolabs xrdp) - [CVE-2022-23483](https://cve.now/CVE-2022-23483.md): Out-of-Bound Read in libxrdp (CVSS 7.5, neutrinolabs xrdp) - [CVE-2022-23482](https://cve.now/CVE-2022-23482.md): Out-of-Bound Read in xrdp (CVSS 0.0, neutrinolabs xrdp) - [CVE-2022-23481](https://cve.now/CVE-2022-23481.md): Out-of-Bound Read in xrdp (CVSS 0.0, neutrinolabs xrdp) - [CVE-2022-23480](https://cve.now/CVE-2022-23480.md): Buffer Overflow in xrdp (CVSS 9.1, neutrinolabs xrdp) - [CVE-2022-23479](https://cve.now/CVE-2022-23479.md): Buffer Overflow occurs in xrdp (CVSS 9.1, neutrinolabs xrdp) - [CVE-2022-23478](https://cve.now/CVE-2022-23478.md): Out of Bound Write in xrdp (CVSS 9.1, neutrinolabs xrdp) - [CVE-2022-23468](https://cve.now/CVE-2022-23468.md): Buffer Overflow in xrdp (CVSS 6.5, neutrinolabs xrdp) - [CVE-2022-23493](https://cve.now/CVE-2022-23493.md): Out of Bound Read in xrdp (CVSS 9.1, neutrinolabs xrdp) - [CVE-2022-4264](https://cve.now/CVE-2022-4264.md): Incorrect privilege assignment in M-Files Web Server (CVSS 6.5, M-Files Web) - [CVE-2022-2752](https://cve.now/CVE-2022-2752.md): Potential vulnerabilities in GM login process (CVSS 5.5, Secomea GateManager) - [CVE-2022-33187](https://cve.now/CVE-2022-33187.md): Brocade SANnav before v2.2.1 logs usernames and encoded passwords in debug-enabled logs (CVSS 5.5, Brocade SANnav) - [CVE-2022-25629](https://cve.now/CVE-2022-25629.md): An authenticated user who has the privilege to add/edit annotations on the Content tab, can craft a malicious annotation that can be execute (CVSS 5.4, Symantec Messaging Gateway) - [CVE-2022-25630](https://cve.now/CVE-2022-25630.md): An authenticated user can embed malicious content with XSS into the admin group policy page. (CVSS 5.4, Symantec Messaging Gateway) - [CVE-2022-29838](https://cve.now/CVE-2022-29838.md): Authentication issue with the encrypted volumes and auto mount feature in My Cloud devices (CVSS 4.3, Western Digital My Cloud) - [CVE-2022-29839](https://cve.now/CVE-2022-29839.md): Remote Backups Application Discloses Stored Credentials (CVSS 4.1, Western Digital My Cloud) - [CVE-2022-3259](https://cve.now/CVE-2022-3259.md): Openshift 4.9 does not use HTTP Strict Transport Security (HSTS) which may allow man-in-the-middle (MITM) attacks. (CVSS 7.4, OpenShift) - [CVE-2022-34297](https://cve.now/CVE-2022-34297.md): Yii Yii2 Gii through 2.2.4 allows stored XSS by injecting a payload into any field. (CVSS 5.4, yiisoft/yii2-gii) - [CVE-2022-3724](https://cve.now/CVE-2022-3724.md): Crash in the USB HID protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial of service via packet injection or crafted capture file on (CVSS 6.3, Wireshark Foundation Wireshark) - [CVE-2022-4170](https://cve.now/CVE-2022-4170.md): The rxvt-unicode package is vulnerable to a remote code execution, in the Perl background extension, when an attacker can control the data w (CVSS 9.8, rxvt-unicode) - [CVE-2022-4336](https://cve.now/CVE-2022-4336.md): In BAOTA linux panel there exists a stored xss vulnerability attackers can use to obtain sensitive information via the log analysis feature. (CVSS 5.4, Baota) - [CVE-2022-4375](https://cve.now/CVE-2022-4375.md): Mingsoft MCMS list sql injection (CVSS 6.3, Mingsoft MCMS · net.mingsoft:ms-mcms) - [CVE-2022-4377](https://cve.now/CVE-2022-4377.md): S-CMS Contact Information Page cross site scripting (CVSS 3.5, S-CMS) - [CVE-2022-4390](https://cve.now/CVE-2022-4390.md): A network misconfiguration is present in versions prior to 1.0.9.90 of the NETGEAR RAX30 AX2400 series of routers. (CVSS 10.0, NETGEAR Nighthawk RAX30) - [CVE-2022-44213](https://cve.now/CVE-2022-44213.md): ZKTeco Xiamen Information Technology ZKBio ECO ADMS \<=3.1-164 is vulnerable to Cross Site Scripting (XSS). (CVSS 4.8) - [CVE-2022-44790](https://cve.now/CVE-2022-44790.md): Interspire Email Marketer through 6.5.1 allows SQL Injection via the surveys module. (CVSS 7.5) - [CVE-2022-44838](https://cve.now/CVE-2022-44838.md): Automotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /services/view\_servic (CVSS 7.2) - [CVE-2022-45290](https://cve.now/CVE-2022-45290.md): Kbase Doc v1.0 was discovered to contain an arbitrary file deletion vulnerability via the component /web/IndexController.java. (CVSS 9.1) - [CVE-2022-45292](https://cve.now/CVE-2022-45292.md): User invites for Funkwhale v1.2.8 do not permanently expire after being used for signup and can be used again after an account has been dele (CVSS 5.3) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2022-12-09 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.