CVEs published December 12, 2022
86 CVEs were published on December 12, 2022: 8 critical, 31 high.
- Published
- 86
- Critical
- 8
- High
- 31
- Medium
- 44
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 37
Most affected products
- Horner Automation Remote Compact Controller (RCC)
- 3
- Algan Software Prens Student Information System
- 2
- ARC Informatique PcVue
- 2
- Donation Button
- 2
- TIBCO Software TIBCO Nimbus
- 2
- Welcart e-Commerce
- 2
- All-In-One Security
- 1
- aws amazon-cloudwatch-agent · github.com/aws/amazon-cloudwa…
- 1
- Block Bad Bots and Stop Bad Bots Crawlers and Spiders and A…
- 1
- Booking calendar, Appointment Booking System
- 1
Critical 8
- CVE-2022-3921Listingo < 3.2.7 - Unauthenticated Arbitrary File UploadListingo
- CVE-2022-3900Cooked Pro < 1.7.5.7 - Unauthenticated PHP Object InjectionCooked Pro
- CVE-2022-3982Booking Calendar < 3.2.2 - Unauthenticated Arbitrary File UploadBooking calendar, Appointment Booking System
- CVE-2022-3915Dokan < 3.7.6 - Unauthenticated SQLiDokan
- CVE-2022-3485Weak Password Recovery in ifm moneo applianceifm moneo appliance
- CVE-2022-2807SQL Injection in Prens Student Information SystemAlgan Software Prens Student Information System
- CVE-2022-2641Horner Automation’s RCC 972 with firmware version 15.40 has a static encryption key on the device.Horner Automation Remote Compact Controller (RCC)
- CVE-2022-41559TIBCO Nimbus Open Redirect VulnerabilityTIBCO Software TIBCO Nimbus
High 31
- CVE-2022-3989Motors - Car Dealer, Classifieds & Listing < 1.4.4 - Arbitrary File UploadMotors
- CVE-2022-3999WooCommerce Shipping - DPD baltic < 1.2.57 - Subscriber+ Arbitrary Options DeletionDPD Baltic Shipping
- CVE-2022-3605WP CSV Exporter < 1.3.7 - CSV InjectionWP CSV Exporter
- CVE-2022-3981Icegram Express < 5.5.1 - Subscriber+ SQLiIcegram Express
- CVE-2022-3925Buddybadges <= 1.0.0 - Admin+ SQLibuddybadges
- CVE-2022-3912User Registration < 2.2.4.1 - Subscriber+ Arbitrary File UploadUser Registration
- CVE-2022-3359Shortcodes and extra features for Phlox theme < 2.10.7 - PHP Objection InjectionShortcodes and extra features for Phlox theme
- CVE-2022-2640The Config-files of Horner Automation’s RCC 972 with firmware version 15.40 are encrypted with weak XOR encryption vulnerable to reverse engHorner Automation Remote Compact Controller (RCC)
- CVE-2022-2642Horner Automation’s RCC 972 firmware version 15.40 contains global variables.Horner Automation Remote Compact Controller (RCC)
- CVE-2022-2993bt: host: Wrong key validation checkzephyrproject-rtos zephyr
- CVE-2022-24439Remote Code Execution (RCE)GitPython
- CVE-2022-25912Remote Code Execution (RCE)simple-git
- CVE-2022-2808IDOR in Prens Student Information SystemAlgan Software Prens Student Information System
- CVE-2022-23511A privilege escalation issue exists within the Amazon CloudWatch Agent for Windows, software for collecting metrics and logs from Amazon EC2aws amazon-cloudwatch-agent · github.com/aws/amazon-cloudwa…
- CVE-2022-25836Bluetooth® Low Energy Pairing in Bluetooth Core Specification v4.0 through v5.3 may permit an unauthenticated MITM to acquire credentials wi
- CVE-2022-25837Bluetooth® Pairing in Bluetooth Core Specification v1.0B through v5.3 may permit an unauthenticated MITM to acquire credentials with two pai
- CVE-2022-42716An issue was discovered in the Arm Mali GPU Kernel Driver.
- CVE-2022-45043Tenda AX12 V22.03.01.16_cn is vulnerable to command injection via goform/fast_setting_internet_set.
- CVE-2022-45227The web portal of Dragino Lora LG01 18ed40 IoT v4.3.4 has the directory listing at the URL https://10.10.20.74/lib/.
- CVE-2022-45269A directory traversal vulnerability in the component SCS.Web.Server.SPI/1.0 of Linx Sphere LINX 7.35.ST15 allows attackers to read arbitrary
- CVE-2022-45275An arbitrary file upload vulnerability in /queuing/admin/ajax.php?action=save_settings of Dynamic Transaction Queuing System v1.0 allows att
- CVE-2022-45759SENS v1.0 has a file upload vulnerability.
- CVE-2022-45760SENS v1.0 is vulnerable to Incorrect Access Control vulnerability.
- CVE-2022-45957ZTE ZXHN-H108NS router with firmware version H108NSV1.0.7u_ZRD_GR2_A68 is vulnerable to remote stack buffer overflow.
- CVE-2022-45968Alist v3.4.0 is vulnerable to File Upload.github.com/alist-org/alist · github.com/alist-org/alist/v3
- CVE-2022-45977Tenda AX12 V22.03.01.21_CN was found to have a command injection vulnerability via /goform/setMacFilterCfg function.
- CVE-2022-45979Tenda AX12 v22.03.01.21_CN was discovered to contain a stack overflow via the ssid parameter at /goform/fast_setting_wifi_set .
- CVE-2022-45980Tenda AX12 V22.03.01.21_CN was discovered to contain a Cross-Site Request Forgery (CSRF) via /goform/SysToolRestoreSet .
- CVE-2022-45996Tenda W20E V16.01.0.6(3392) is vulnerable to Command injection via cmd_get_ping_output.
- CVE-2022-45997Tenda W20E V16.01.0.6(3392) is vulnerable to Buffer Overflow.
- CVE-2022-46908SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctionsqlite
Medium, low and unrated 47
- CVE-2022-41263Due to a missing authentication check, SAP Business Objects Business Intelligence Platform (Web Intelligence) - versions 420, 430, allows anSAP Business Objects Business Intelligence Platform
- CVE-2022-41262Due to insufficient input validation, SAP NetWeaver AS Java (HTTP Provider Service) - version 7.50, allows an unauthenticated attacker to inSAP NetWeaver AS for Java
- CVE-2022-41261SAP Solution Manager (Diagnostic Agent) - version 7.20, allows an authenticated attacker on Windows system to access a file containing sensiSAP Solution Manager
- CVE-2022-4016Booster for WooCommerce - Custom Role Creation/Deletion via CSRFBooster for WooCommerce · Booster Plus for WooCommerce +1
- CVE-2022-3862Livemesh Addons for Elementor < 7.2.4 - Admin+ Stored XSSLivemesh Addons for Elementor
- CVE-2022-4000WooCommerce Shipping - DPD baltic < 1.2.11 - Admin+ Stored XSSWooCommerce Shipping
- CVE-2022-3946Welcart e-Commerce < 2.8.4 - Subscriber+ Arbitrary Shipping Method Creation/Update/DeletionWelcart e-Commerce
- CVE-2022-3881WPTools < 3.43 - Subscriber+ Arbitrary Plugin InstallationWP Tools Increase Maximum Limits, Repair, Server PHP Info,…
- CVE-2022-3880AntiHacker < 4.20 - Subscriber+ Arbitrary Plugin InstallationDisable Json API, Login Lockdown, XMLRPC, Pingback, Stop Us…
- CVE-2022-3879Car Dealer < 3.05 - Subscriber+ Arbitrary Plugin InstallationCar Dealer (Dealership) and Vehicle sales WordPress Plugin
- CVE-2022-3906Easy Form Builder < 3.4.0 - Admin+ Stored XSSEasy Form Builder
- CVE-2022-3930Directorist < 7.4.2.2 - Subscriber+ Arbitrary User Password Update via IDORDirectorist
- CVE-2022-4010Image Hover Effects < 5.5 - Admin+ Stored XSSImage Hover Effects
- CVE-2022-3609GetYourGuide Ticketing < 1.0.4 - Admin+ Stored XSSGetYourGuide Ticketing
- CVE-2022-3853Supra CSV <= 4.0.3 - Stored Cross-Site Scripting via CSRFSupra CSV
- CVE-2022-4004Donation Button <= 4.0.0 - Subscriber+ Broken Access Control leading to SMS SpamDonation Button
- CVE-2022-3935Welcart e-Commerce < 2.8.4 - Multiple Subscriber+ Stored Cross-Site ScriptingWelcart e-Commerce
- CVE-2022-3919Jetpack CRM < 5.4.3 - Admin+ Cross-Site ScriptingJetpack CRM
- CVE-2022-3934Flat PM < 3.0.13 - Reflected Cross-Site ScriptingFlatPM
- CVE-2022-4005Donation Button <= 4.0.0 - Contributor+ Stored XSSDonation Button
- CVE-2022-3933Essential Real Estate < 3.9.6 - Reflected Cross-Site-ScriptingEssential Real Estate
- CVE-2022-3883StopBadBots < 7.24 - Subscriber+ Arbitrary Plugin InstallationBlock Bad Bots and Stop Bad Bots Crawlers and Spiders and A…
- CVE-2022-4097All In One WP Security & Firewall < 5.0.8 - IP SpoofingAll-In-One Security
- CVE-2022-3882WP Memory < 2.46 - Subscriber+ Arbitrary Plugin InstallationMemory Usage, Memory Limit, PHP and Server Memory Health Ch…
- CVE-2022-3908Helloprint < 1.4.7 - Reflected Cross-Site ScriptingPlug your WooCommerce into the largest catalog of customize…
- CVE-2022-4312 A cleartext storage of sensitive information vulnerability exists in PcVue versions 8.10 through 15.2.3.ARC Informatique PcVue
- CVE-2022-4311 An insertion of sensitive information into log file vulnerability exists in PcVue versions 15 through 15.2.2.ARC Informatique PcVue
- CVE-2022-31596Under certain conditions, an attacker authenticated as a CMS administrator and with high privileges access to the Network in SAP BusinessObjSAP Business Objects Platform
- CVE-2022-41560TIBCO Nimbus Denial of Service VulnerabilityTIBCO Software TIBCO Nimbus
- CVE-2022-43515X-Forwarded-For header is active by default causes access to Zabbix sites in maintenance modeZabbix Frontend
- CVE-2022-43516Zabbix Agent installer adds “allow all TCP any any” firewall ruleZabbix agent
- CVE-2021-41943Logrhythm Web Console 7.4.9 allows for HTML tag injection through Contextualize Action -> Create a new Contextualize Action -> Inject your H
- CVE-2021-4244yikes-inc-easy-mailchimp-extender Plugin add_field_to_form.php cross site scriptingyikes-inc-easy-mailchimp-extender Plugin · yikesinc/yikes-i…
- CVE-2022-41881Netty project is an event-driven asynchronous network application framework.netty · io.netty:netty-codec-haproxy
- CVE-2022-44031Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization of the blockquote sy
- CVE-2022-4416RainyGao DocSys getReposAllUsers.do getReposAllUsers sql injectionRainyGao DocSys
- CVE-2022-4421rAthena FluxCP Service Desk Image URL view.php cross site scriptingrAthena FluxCP
- CVE-2022-44637Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization in Redcloth3 Textile
- CVE-2022-45228Dragino Lora LG01 18ed40 IoT v4.3.4 was discovered to contain a Cross-Site Request Forgery in the logout page.
- CVE-2022-45756SENS v1.0 is vulnerable to Cross Site Scripting (XSS).
- CVE-2022-45758SENS v1.0 is vulnerable to Cross Site Scripting (XSS) via com.liuyanzhao.sens.web.controller.admin, getRegister.
- CVE-2022-45956Boa Web Server versions 0.94.13 through 0.94.14 fail to validate the correct security constraint on the HEAD HTTP method allowing everyone t
- CVE-2022-45970Alist v3.5.1 is vulnerable to Cross Site Scripting (XSS) via the bulletin board.github.com/alist-org/alist/v3
- CVE-2022-46903Insufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an authenticated attacker to inject arbitrary HTML tags into the pa
- CVE-2022-46904Insufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an authenticated attacker to inject arbitrary HTML tags into the pa
- CVE-2022-46905Insufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an unauthenticated attacker to inject arbitrary HTML tags into the
- CVE-2022-46906Insufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an authenticated attacker to inject arbitrary HTML tags into the pa