# CVEs published 2022-12-12

86 CVEs were published on December 12, 2022: 8 critical, 31 high. Days are UTC.

- [CVE-2022-41263](https://cve.now/CVE-2022-41263.md): Due to a missing authentication check, SAP Business Objects Business Intelligence Platform (Web Intelligence) - versions 420, 430, allows an (CVSS 4.3, SAP Business Objects Business Intelligence Platform)
- [CVE-2022-41262](https://cve.now/CVE-2022-41262.md): Due to insufficient input validation, SAP NetWeaver AS Java (HTTP Provider Service) - version 7.50, allows an unauthenticated attacker to in (CVSS 6.1, SAP NetWeaver AS for Java)
- [CVE-2022-41261](https://cve.now/CVE-2022-41261.md): SAP Solution Manager (Diagnostic Agent) - version 7.20, allows an authenticated attacker on Windows system to access a file containing sensi (CVSS 6.0, SAP Solution Manager)
- [CVE-2022-4016](https://cve.now/CVE-2022-4016.md): Booster for WooCommerce - Custom Role Creation/Deletion via CSRF (CVSS 6.5, Booster for WooCommerce · Booster Plus for WooCommerce +1)
- [CVE-2022-3921](https://cve.now/CVE-2022-3921.md): Listingo \< 3.2.7 - Unauthenticated Arbitrary File Upload (CVSS 9.8, Listingo)
- [CVE-2022-3900](https://cve.now/CVE-2022-3900.md): Cooked Pro \< 1.7.5.7 - Unauthenticated PHP Object Injection (CVSS 9.8, Cooked Pro)
- [CVE-2022-3989](https://cve.now/CVE-2022-3989.md): Motors - Car Dealer, Classifieds & Listing \< 1.4.4 - Arbitrary File Upload (CVSS 8.8, Motors)
- [CVE-2022-3862](https://cve.now/CVE-2022-3862.md): Livemesh Addons for Elementor \< 7.2.4 - Admin+ Stored XSS (CVSS 4.8, Livemesh Addons for Elementor)
- [CVE-2022-4000](https://cve.now/CVE-2022-4000.md): WooCommerce Shipping - DPD baltic \< 1.2.11 - Admin+ Stored XSS (CVSS 4.8, WooCommerce Shipping)
- [CVE-2022-3946](https://cve.now/CVE-2022-3946.md): Welcart e-Commerce \< 2.8.4 - Subscriber+ Arbitrary Shipping Method Creation/Update/Deletion (CVSS 6.5, Welcart e-Commerce)
- [CVE-2022-3881](https://cve.now/CVE-2022-3881.md): WPTools \< 3.43 - Subscriber+ Arbitrary Plugin Installation (CVSS 5.7, WP Tools Increase Maximum Limits, Repair, Server PHP Info,…)
- [CVE-2022-3880](https://cve.now/CVE-2022-3880.md): AntiHacker \< 4.20 - Subscriber+ Arbitrary Plugin Installation (CVSS 6.5, Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop Us…)
- [CVE-2022-3879](https://cve.now/CVE-2022-3879.md): Car Dealer \< 3.05 - Subscriber+ Arbitrary Plugin Installation (CVSS 6.5, Car Dealer (Dealership) and Vehicle sales WordPress Plugin)
- [CVE-2022-3906](https://cve.now/CVE-2022-3906.md): Easy Form Builder \< 3.4.0 - Admin+ Stored XSS (CVSS 4.8, Easy Form Builder)
- [CVE-2022-3930](https://cve.now/CVE-2022-3930.md): Directorist \< 7.4.2.2 - Subscriber+ Arbitrary User Password Update via IDOR (CVSS 6.5, Directorist)
- [CVE-2022-4010](https://cve.now/CVE-2022-4010.md): Image Hover Effects \< 5.5 - Admin+ Stored XSS (CVSS 4.8, Image Hover Effects)
- [CVE-2022-3999](https://cve.now/CVE-2022-3999.md): WooCommerce Shipping - DPD baltic \< 1.2.57 - Subscriber+ Arbitrary Options Deletion (CVSS 8.1, DPD Baltic Shipping)
- [CVE-2022-3609](https://cve.now/CVE-2022-3609.md): GetYourGuide Ticketing \< 1.0.4 - Admin+ Stored XSS (CVSS 4.8, GetYourGuide Ticketing)
- [CVE-2022-3982](https://cve.now/CVE-2022-3982.md): Booking Calendar \< 3.2.2 - Unauthenticated Arbitrary File Upload (CVSS 9.8, Booking calendar, Appointment Booking System)
- [CVE-2022-3605](https://cve.now/CVE-2022-3605.md): WP CSV Exporter \< 1.3.7 - CSV Injection (CVSS 7.8, WP CSV Exporter)
- [CVE-2022-3853](https://cve.now/CVE-2022-3853.md): Supra CSV \<= 4.0.3 - Stored Cross-Site Scripting via CSRF (CVSS 5.4, Supra CSV)
- [CVE-2022-3981](https://cve.now/CVE-2022-3981.md): Icegram Express \< 5.5.1 - Subscriber+ SQLi (CVSS 8.8, Icegram Express)
- [CVE-2022-3915](https://cve.now/CVE-2022-3915.md): Dokan \< 3.7.6 - Unauthenticated SQLi (CVSS 9.8, Dokan)
- [CVE-2022-4004](https://cve.now/CVE-2022-4004.md): Donation Button \<= 4.0.0 - Subscriber+ Broken Access Control leading to SMS Spam (CVSS 4.3, Donation Button)
- [CVE-2022-3935](https://cve.now/CVE-2022-3935.md): Welcart e-Commerce \< 2.8.4 - Multiple Subscriber+ Stored Cross-Site Scripting (CVSS 5.4, Welcart e-Commerce)
- [CVE-2022-3919](https://cve.now/CVE-2022-3919.md): Jetpack CRM \< 5.4.3 - Admin+ Cross-Site Scripting (CVSS 4.8, Jetpack CRM)
- [CVE-2022-3934](https://cve.now/CVE-2022-3934.md): Flat PM \< 3.0.13 - Reflected Cross-Site Scripting (CVSS 5.4, FlatPM)
- [CVE-2022-4005](https://cve.now/CVE-2022-4005.md): Donation Button \<= 4.0.0 - Contributor+ Stored XSS (CVSS 5.4, Donation Button)
- [CVE-2022-3925](https://cve.now/CVE-2022-3925.md): Buddybadges \<= 1.0.0 - Admin+ SQLi (CVSS 7.2, buddybadges)
- [CVE-2022-3933](https://cve.now/CVE-2022-3933.md): Essential Real Estate \< 3.9.6 - Reflected Cross-Site-Scripting (CVSS 5.4, Essential Real Estate)
- [CVE-2022-3883](https://cve.now/CVE-2022-3883.md): StopBadBots \< 7.24 - Subscriber+ Arbitrary Plugin Installation (CVSS 6.5, Block Bad Bots and Stop Bad Bots Crawlers and Spiders and A…)
- [CVE-2022-3912](https://cve.now/CVE-2022-3912.md): User Registration \< 2.2.4.1 - Subscriber+ Arbitrary File Upload (CVSS 7.5, User Registration)
- [CVE-2022-4097](https://cve.now/CVE-2022-4097.md): All In One WP Security & Firewall \< 5.0.8 - IP Spoofing (CVSS 5.3, All-In-One Security)
- [CVE-2022-3882](https://cve.now/CVE-2022-3882.md): WP Memory \< 2.46 - Subscriber+ Arbitrary Plugin Installation (CVSS 6.5, Memory Usage, Memory Limit, PHP and Server Memory Health Ch…)
- [CVE-2022-3908](https://cve.now/CVE-2022-3908.md): Helloprint \< 1.4.7 - Reflected Cross-Site Scripting (CVSS 6.1, Plug your WooCommerce into the largest catalog of customize…)
- [CVE-2022-3359](https://cve.now/CVE-2022-3359.md): Shortcodes and extra features for Phlox theme \< 2.10.7 - PHP Objection Injection (CVSS 8.8, Shortcodes and extra features for Phlox theme)
- [CVE-2022-4312](https://cve.now/CVE-2022-4312.md): A cleartext storage of sensitive information vulnerability exists in PcVue versions 8.10 through 15.2.3. (CVSS 5.5, ARC Informatique PcVue)
- [CVE-2022-4311](https://cve.now/CVE-2022-4311.md): An insertion of sensitive information into log file vulnerability exists in PcVue versions 15 through 15.2.2. (CVSS 4.7, ARC Informatique PcVue)
- [CVE-2022-3485](https://cve.now/CVE-2022-3485.md): Weak Password Recovery in ifm moneo appliance (CVSS 9.8, ifm moneo appliance)
- [CVE-2022-31596](https://cve.now/CVE-2022-31596.md): Under certain conditions, an attacker authenticated as a CMS administrator and with high privileges access to the Network in SAP BusinessObj (CVSS 6.0, SAP Business Objects Platform)
- [CVE-2022-2640](https://cve.now/CVE-2022-2640.md): The Config-files of Horner Automation’s RCC 972 with firmware version 15.40 are encrypted with weak XOR encryption vulnerable to reverse eng (CVSS 7.5, Horner Automation Remote Compact Controller (RCC))
- [CVE-2022-2642](https://cve.now/CVE-2022-2642.md): Horner Automation’s RCC 972 firmware version 15.40 contains global variables. (CVSS 7.5, Horner Automation Remote Compact Controller (RCC))
- [CVE-2022-2807](https://cve.now/CVE-2022-2807.md): SQL Injection in Prens Student Information System (CVSS 9.8, Algan Software Prens Student Information System)
- [CVE-2022-2993](https://cve.now/CVE-2022-2993.md): bt: host: Wrong key validation check (CVSS 8.6, zephyrproject-rtos zephyr)
- [CVE-2022-24439](https://cve.now/CVE-2022-24439.md): Remote Code Execution (RCE) (CVSS 8.1, GitPython)
- [CVE-2022-25912](https://cve.now/CVE-2022-25912.md): Remote Code Execution (RCE) (CVSS 8.1, simple-git)
- [CVE-2022-2641](https://cve.now/CVE-2022-2641.md): Horner Automation’s RCC 972 with firmware version 15.40 has a static encryption key on the device. (CVSS 9.8, Horner Automation Remote Compact Controller (RCC))
- [CVE-2022-2808](https://cve.now/CVE-2022-2808.md): IDOR in Prens Student Information System (CVSS 8.8, Algan Software Prens Student Information System)
- [CVE-2022-41559](https://cve.now/CVE-2022-41559.md): TIBCO Nimbus Open Redirect Vulnerability (CVSS 9.3, TIBCO Software TIBCO Nimbus)
- [CVE-2022-41560](https://cve.now/CVE-2022-41560.md): TIBCO Nimbus Denial of Service Vulnerability (CVSS 6.5, TIBCO Software TIBCO Nimbus)
- [CVE-2022-43515](https://cve.now/CVE-2022-43515.md): X-Forwarded-For header is active by default causes access to Zabbix sites in maintenance mode (CVSS 5.3, Zabbix Frontend)
- [CVE-2022-43516](https://cve.now/CVE-2022-43516.md): Zabbix Agent installer adds “allow all TCP any any” firewall rule (CVSS 6.5, Zabbix agent)
- [CVE-2021-41943](https://cve.now/CVE-2021-41943.md): Logrhythm Web Console 7.4.9 allows for HTML tag injection through Contextualize Action -\> Create a new Contextualize Action -\> Inject your H (CVSS 6.1)
- [CVE-2021-4244](https://cve.now/CVE-2021-4244.md): yikes-inc-easy-mailchimp-extender Plugin add\_field\_to\_form.php cross site scripting (CVSS 2.6, yikes-inc-easy-mailchimp-extender Plugin · yikesinc/yikes-i…)
- [CVE-2022-23511](https://cve.now/CVE-2022-23511.md): A privilege escalation issue exists within the Amazon CloudWatch Agent for Windows, software for collecting metrics and logs from Amazon EC2 (CVSS 7.1, aws amazon-cloudwatch-agent · github.com/aws/amazon-cloudwa…)
- [CVE-2022-25836](https://cve.now/CVE-2022-25836.md): Bluetooth® Low Energy Pairing in Bluetooth Core Specification v4.0 through v5.3 may permit an unauthenticated MITM to acquire credentials wi (CVSS 7.5)
- [CVE-2022-25837](https://cve.now/CVE-2022-25837.md): Bluetooth® Pairing in Bluetooth Core Specification v1.0B through v5.3 may permit an unauthenticated MITM to acquire credentials with two pai (CVSS 7.5)
- [CVE-2022-41881](https://cve.now/CVE-2022-41881.md): Netty project is an event-driven asynchronous network application framework. (CVSS 5.3, netty · io.netty:netty-codec-haproxy)
- [CVE-2022-42716](https://cve.now/CVE-2022-42716.md): An issue was discovered in the Arm Mali GPU Kernel Driver. (CVSS 8.8)
- [CVE-2022-44031](https://cve.now/CVE-2022-44031.md): Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization of the blockquote sy (CVSS 6.1)
- [CVE-2022-4416](https://cve.now/CVE-2022-4416.md): RainyGao DocSys getReposAllUsers.do getReposAllUsers sql injection (CVSS 6.3, RainyGao DocSys)
- [CVE-2022-4421](https://cve.now/CVE-2022-4421.md): rAthena FluxCP Service Desk Image URL view.php cross site scripting (CVSS 3.5, rAthena FluxCP)
- [CVE-2022-44637](https://cve.now/CVE-2022-44637.md): Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization in Redcloth3 Textile (CVSS 6.1)
- [CVE-2022-45043](https://cve.now/CVE-2022-45043.md): Tenda AX12 V22.03.01.16\_cn is vulnerable to command injection via goform/fast\_setting\_internet\_set. (CVSS 8.8)
- [CVE-2022-45227](https://cve.now/CVE-2022-45227.md): The web portal of Dragino Lora LG01 18ed40 IoT v4.3.4 has the directory listing at the URL https://10.10.20.74/lib/. (CVSS 7.5)
- [CVE-2022-45228](https://cve.now/CVE-2022-45228.md): Dragino Lora LG01 18ed40 IoT v4.3.4 was discovered to contain a Cross-Site Request Forgery in the logout page. (CVSS 3.5)
- [CVE-2022-45269](https://cve.now/CVE-2022-45269.md): A directory traversal vulnerability in the component SCS.Web.Server.SPI/1.0 of Linx Sphere LINX 7.35.ST15 allows attackers to read arbitrary (CVSS 7.5)
- [CVE-2022-45275](https://cve.now/CVE-2022-45275.md): An arbitrary file upload vulnerability in /queuing/admin/ajax.php?action=save\_settings of Dynamic Transaction Queuing System v1.0 allows att (CVSS 7.2)
- [CVE-2022-45756](https://cve.now/CVE-2022-45756.md): SENS v1.0 is vulnerable to Cross Site Scripting (XSS). (CVSS 6.1)
- [CVE-2022-45758](https://cve.now/CVE-2022-45758.md): SENS v1.0 is vulnerable to Cross Site Scripting (XSS) via com.liuyanzhao.sens.web.controller.admin, getRegister. (CVSS 5.4)
- [CVE-2022-45759](https://cve.now/CVE-2022-45759.md): SENS v1.0 has a file upload vulnerability. (CVSS 8.8)
- [CVE-2022-45760](https://cve.now/CVE-2022-45760.md): SENS v1.0 is vulnerable to Incorrect Access Control vulnerability. (CVSS 8.8)
- [CVE-2022-45956](https://cve.now/CVE-2022-45956.md): Boa Web Server versions 0.94.13 through 0.94.14 fail to validate the correct security constraint on the HEAD HTTP method allowing everyone t (CVSS 5.3)
- [CVE-2022-45957](https://cve.now/CVE-2022-45957.md): ZTE ZXHN-H108NS router with firmware version H108NSV1.0.7u\_ZRD\_GR2\_A68 is vulnerable to remote stack buffer overflow. (CVSS 7.5)
- [CVE-2022-45968](https://cve.now/CVE-2022-45968.md): Alist v3.4.0 is vulnerable to File Upload. (CVSS 8.8, github.com/alist-org/alist · github.com/alist-org/alist/v3)
- [CVE-2022-45970](https://cve.now/CVE-2022-45970.md): Alist v3.5.1 is vulnerable to Cross Site Scripting (XSS) via the bulletin board. (CVSS 5.4, github.com/alist-org/alist/v3)
- [CVE-2022-45977](https://cve.now/CVE-2022-45977.md): Tenda AX12 V22.03.01.21\_CN was found to have a command injection vulnerability via /goform/setMacFilterCfg function. (CVSS 8.8)
- [CVE-2022-45979](https://cve.now/CVE-2022-45979.md): Tenda AX12 v22.03.01.21\_CN was discovered to contain a stack overflow via the ssid parameter at /goform/fast\_setting\_wifi\_set . (CVSS 7.5)
- [CVE-2022-45980](https://cve.now/CVE-2022-45980.md): Tenda AX12 V22.03.01.21\_CN was discovered to contain a Cross-Site Request Forgery (CSRF) via /goform/SysToolRestoreSet . (CVSS 8.8)
- [CVE-2022-45996](https://cve.now/CVE-2022-45996.md): Tenda W20E V16.01.0.6(3392) is vulnerable to Command injection via cmd\_get\_ping\_output. (CVSS 7.2)
- [CVE-2022-45997](https://cve.now/CVE-2022-45997.md): Tenda W20E V16.01.0.6(3392) is vulnerable to Buffer Overflow. (CVSS 7.2)
- [CVE-2022-46903](https://cve.now/CVE-2022-46903.md): Insufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an authenticated attacker to inject arbitrary HTML tags into the pa (CVSS 5.4)
- [CVE-2022-46904](https://cve.now/CVE-2022-46904.md): Insufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an authenticated attacker to inject arbitrary HTML tags into the pa (CVSS 5.4)
- [CVE-2022-46905](https://cve.now/CVE-2022-46905.md): Insufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an unauthenticated attacker to inject arbitrary HTML tags into the (CVSS 6.1)
- [CVE-2022-46906](https://cve.now/CVE-2022-46906.md): Insufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an authenticated attacker to inject arbitrary HTML tags into the pa (CVSS 5.4)
- [CVE-2022-46908](https://cve.now/CVE-2022-46908.md): SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunction (CVSS 7.3, sqlite)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-12-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.