# CVEs published 2022-12-13 222 CVEs were published on December 13, 2022: 15 critical, 121 high. 2 are now in CISA KEV. Days are UTC. - [CVE-2022-40264](https://cve.now/CVE-2022-40264.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ICONICS/Mitsubishi Electric GENESIS64 versio (CVSS 6.3, ICONICS and Mitsubishi Electric GENESIS64) - [CVE-2022-2660](https://cve.now/CVE-2022-2660.md): Delta Industrial Automation DIALink versions 1.4.0.0 and prior are vulnerable to the use of a hard-coded cryptographic key which could allow (CVSS 9.8, Delta Electronics Industrial Automation DIALink) - [CVE-2022-2757](https://cve.now/CVE-2022-2757.md): Due to the lack of adequately implemented access-control rules, all versions Kingspan TMS300 CS are vulnerable to an attacker viewing and (CVSS 9.8, Kingspan TMS300 CS) - [CVE-2022-38355](https://cve.now/CVE-2022-38355.md): Daikin SVMPC1 version 2.1.22 and prior and SVMPC2 version 1.2.3 and prior are vulnerable to attackers with access to the local area networ (CVSS 7.5, Daikin SVMPC1 · Daikin SVMPC2) - [CVE-2022-41653](https://cve.now/CVE-2022-41653.md): Daikin SVMPC1 version 2.1.22 and prior and SVMPC2 version 1.2.3 and prior are vulnerable to an attacker obtaining user login credentials and (CVSS 9.8, Daikin SVMPC1 · Daikin SVMPC2) - [CVE-2022-2947](https://cve.now/CVE-2022-2947.md): Altair HyperView Player versions 2021.1.0.27 and prior perform operations on a memory buffer but can read from or write to a memory locat (CVSS 7.8, Altair HyperView Player) - [CVE-2022-2949](https://cve.now/CVE-2022-2949.md): Altair HyperView Player versions 2021.1.0.27 and prior are vulnerable to the use of uninitialized memory vulnerability during parsing of (CVSS 7.8, Altair HyperView Player) - [CVE-2022-23499](https://cve.now/CVE-2022-23499.md): Cross-Site Scripting Protection bypass in HTML Sanitizer (CVSS 6.1, TYPO3 html-sanitizer · typo3/html-sanitizer +1) - [CVE-2022-2950](https://cve.now/CVE-2022-2950.md): Altair HyperView Player versions 2021.1.0.27 and prior are vulnerable to the use of uninitialized memory vulnerability during parsing of (CVSS 7.8, Altair HyperView Player) - [CVE-2022-2951](https://cve.now/CVE-2022-2951.md): Altair HyperView Player versions 2021.1.0.27 and prior are vulnerable to improper validation of array index vulnerability during processi (CVSS 7.8, Altair HyperView Player) - [CVE-2022-4207](https://cve.now/CVE-2022-4207.md): The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several values that can be added to a (CVSS 5.5, biplob018 Image Hover Effects Ultimate) - [CVE-2022-4171](https://cve.now/CVE-2022-4171.md): demon image annotation \<= 5.0 - Improper Input Restriction Validation (CVSS 6.5, demonisblack demon image annotation) - [CVE-2022-46364](https://cve.now/CVE-2022-46364.md): Apache CXF SSRF Vulnerability (CVSS 9.8, Apache Software Foundation Apache CXF · org.apache.cxf:cxf-…) - [CVE-2022-3996](https://cve.now/CVE-2022-3996.md): X.509 Policy Constraints Double Locking (CVSS 7.5, OpenSSL · openssl-src) - [CVE-2022-46363](https://cve.now/CVE-2022-46363.md): Apache CXF directory listing / code exfiltration (CVSS 7.5, Apache Software Foundation Apache CXF · org.apache.cxf:cxf-…) - [CVE-2022-29580](https://cve.now/CVE-2022-29580.md): Path Traversal in Android Google Search App (CVSS 8.9, Android Google Search App) - [CVE-2022-38124](https://cve.now/CVE-2022-38124.md): Unwanted debug tool (CVSS 5.7, Secomea SiteManager) - [CVE-2022-23523](https://cve.now/CVE-2022-23523.md): rust-vmm linux-loader vulnerable to Out-of-bounds Read (CVSS 4.0, rust-vmm linux-loader · linux-loader) - [CVE-2022-4098](https://cve.now/CVE-2022-4098.md): Wiesemann & Theis: Multiple products prone to missing authentication through spoofing (CVSS 8.0, Wiesemann & Theis Com-Server ++ · Wiesemann & Theis Com… +14) - [CVE-2022-23505](https://cve.now/CVE-2022-23505.md): Passport-wsfed-saml2 vulnerable to Authentication Bypass for WSFed authentication (CVSS 5.3, auth0 passport-wsfed-saml2 · passport-wsfed-saml2) - [CVE-2022-23473](https://cve.now/CVE-2022-23473.md): Tuleap MediaWiki standalone "readers" can also edit pages (CVSS 4.3, Enalean tuleap) - [CVE-2022-46160](https://cve.now/CVE-2022-46160.md): Tuleap dashboards vulnerable to Incorrect Authorization (CVSS 4.3, Enalean tuleap) - [CVE-2022-41275](https://cve.now/CVE-2022-41275.md): In SAP Solution Manager (Enterprise Search) - versions 740, and 750, an unauthenticated attacker can generate a link that, if clicked by a l (CVSS 6.1, SAP Solution Manager) - [CVE-2022-41274](https://cve.now/CVE-2022-41274.md): SAP Disclosure Management - version 10.1, allows an authenticated attacker to exploit certain misconfigured application endpoints to read se (CVSS 6.5, SAP Disclosure Management) - [CVE-2022-41273](https://cve.now/CVE-2022-41273.md): Due to improper input sanitization in SAP Sourcing and SAP Contract Lifecycle Management - version 1100, an attacker can redirect a user to (CVSS 4.3, Sourcing and SAP Contract Lifecycle Management) - [CVE-2022-41272](https://cve.now/CVE-2022-41272.md): An unauthenticated attacker over the network can attach to an open interface exposed through JNDI by the User Defined Search (UDS) of SAP Ne (CVSS 9.9, SAP NetWeaver Process Integration) - [CVE-2022-41271](https://cve.now/CVE-2022-41271.md): An unauthenticated user can attach to an open interface exposed through JNDI by the Messaging System of SAP NetWeaver Process Integration (P (CVSS 9.4, SAP NetWeaver Process Integration) - [CVE-2022-41268](https://cve.now/CVE-2022-41268.md): In some SAP standard roles in SAP Business Planning and Consolidation - versions - SAP\_BW 750, 751, 752, 753, 754, 755, 756, 757, DWCORE 200 (CVSS 8.5, SAP Business Planning and Consolidation) - [CVE-2022-41267](https://cve.now/CVE-2022-41267.md): SAP Business Objects Platform - versions 420, and 430, allows an attacker with normal BI user privileges to upload/replace any file on Busin (CVSS 9.9, SAP BusinessObjects Business Intelligence Platform) - [CVE-2022-41266](https://cve.now/CVE-2022-41266.md): Due to a lack of proper input validation, SAP Commerce Webservices 2.0 (Swagger UI) - versions 1905, 2005, 2105, 2011, 2205, allows maliciou (CVSS 8.0, SAP Commerce Webservices) - [CVE-2022-41264](https://cve.now/CVE-2022-41264.md): Due to the unrestricted scope of the RFC function module, SAP BASIS - versions 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, 7 (CVSS 8.8, SAP BASIS) - [CVE-2019-25078](https://cve.now/CVE-2019-25078.md): pacparser pacparser.c pacparser\_find\_proxy buffer overflow (CVSS 5.3, pacparser) - [CVE-2021-0934](https://cve.now/CVE-2021-0934.md): In findAllDeAccounts of AccountsDb.java, there is a possible denial of service due to resource exhaustion. (CVSS 5.5, Android) - [CVE-2021-32415](https://cve.now/CVE-2021-32415.md): EXEMSI MSI Wrapper Versions prior to 10.0.50 and at least since version 6.0.91 will introduce a local privilege escalation vulnerability in (CVSS 7.8) - [CVE-2021-39660](https://cve.now/CVE-2021-39660.md): In TBD of TBD, there is a possible way to archive arbitrary code execution in kernel due to a race condition. (CVSS 7.0, Android) - [CVE-2021-40365](https://cve.now/CVE-2021-40365.md): Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a deni (CVSS 7.5, Siemens SIMATIC Drive Controller CPU 1504D TF · Siemens… +60) - [CVE-2021-44693](https://cve.now/CVE-2021-44693.md): Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a deni (CVSS 4.9, Siemens SIMATIC Drive Controller CPU 1504D TF · Siemens… +60) - [CVE-2021-44694](https://cve.now/CVE-2021-44694.md): Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a deni (CVSS 5.5, Siemens SIMATIC Drive Controller CPU 1504D TF · Siemens… +60) - [CVE-2021-44695](https://cve.now/CVE-2021-44695.md): Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a deni (CVSS 4.9, Siemens SIMATIC Drive Controller CPU 1504D TF · Siemens… +60) - [CVE-2022-20240](https://cve.now/CVE-2022-20240.md): In sOpAllowSystemRestrictionBypass of AppOpsManager.java, there is a possible leak of location information due to a missing permission check (CVSS 2.3, Android) - [CVE-2022-20411](https://cve.now/CVE-2022-20411.md): In avdt\_msg\_asmbl of avdt\_msg.cc, there is a possible out of bounds write due to a missing bounds check. (CVSS 8.8, Android) - [CVE-2022-20442](https://cve.now/CVE-2022-20442.md): In onCreate of ReviewPermissionsActivity.java, there is a possible way to grant permissions for a separate app with API level \< 23 due to a (CVSS 7.3, Android) - [CVE-2022-20449](https://cve.now/CVE-2022-20449.md): In writeApplicationRestrictionsLAr of UserManagerService.java, there is a possible overwrite of system files due to a path traversal error. (CVSS 4.4, Android) - [CVE-2022-20466](https://cve.now/CVE-2022-20466.md): In applyKeyguardFlags of NotificationShadeWindowControllerImpl.java, there is a possible way to observe the user's password on a secondary d (CVSS 5.5, Android) - [CVE-2022-20468](https://cve.now/CVE-2022-20468.md): In BNEP\_ConnectResp of bnep\_api.cc, there is a possible out of bounds read due to an incorrect bounds check. (CVSS 6.5, Android) - [CVE-2022-20469](https://cve.now/CVE-2022-20469.md): In avct\_lcb\_msg\_asmbl of avct\_lcb\_act.cc, there is a possible out of bounds write due to a missing bounds check. (CVSS 8.8, Android) - [CVE-2022-20470](https://cve.now/CVE-2022-20470.md): In bindRemoteViewsService of AppWidgetServiceImpl.java, there is a possible way to bypass background activity launch due to improper input v (CVSS 7.8, Android) - [CVE-2022-20471](https://cve.now/CVE-2022-20471.md): In SendIncDecRestoreCmdPart2 of NxpMfcReader.cc, there is a possible out of bounds read due to a missing bounds check. (CVSS 5.5, Android) - [CVE-2022-20472](https://cve.now/CVE-2022-20472.md): In toLanguageTag of LocaleListCache.cpp, there is a possible out of bounds read due to an incorrect bounds check. (CVSS 9.8, Android) - [CVE-2022-20473](https://cve.now/CVE-2022-20473.md): In toLanguageTag of LocaleListCache.cpp, there is a possible out of bounds read due to an incorrect bounds check. (CVSS 9.8, Android) - [CVE-2022-20474](https://cve.now/CVE-2022-20474.md): In readLazyValue of Parcel.java, there is a possible loading of arbitrary code into the System Settings app due to a confused deputy. (CVSS 7.8, Android) - [CVE-2022-20475](https://cve.now/CVE-2022-20475.md): In test of ResetTargetTaskHelper.java, there is a possible hijacking of any app which sets allowTaskReparenting="true" due to a confused dep (CVSS 7.8, Android) - [CVE-2022-20476](https://cve.now/CVE-2022-20476.md): In setEnabledSetting of PackageManager.java, there is a possible way to get the device into an infinite reboot loop due to resource exhausti (CVSS 5.5, Android) - [CVE-2022-20477](https://cve.now/CVE-2022-20477.md): In shouldHideNotification of KeyguardNotificationVisibilityProvider.kt, there is a possible way to show hidden notifications due to a logic (CVSS 7.8, Android) - [CVE-2022-20478](https://cve.now/CVE-2022-20478.md): In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. (CVSS 7.8, Android) - [CVE-2022-20479](https://cve.now/CVE-2022-20479.md): In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. (CVSS 7.8, Android) - [CVE-2022-20480](https://cve.now/CVE-2022-20480.md): In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. (CVSS 7.8, Android) - [CVE-2022-20482](https://cve.now/CVE-2022-20482.md): In createNotificationChannel of NotificationManager.java, there is a possible way to make the device unusable and require factory reset due (CVSS 5.5, Android) - [CVE-2022-20483](https://cve.now/CVE-2022-20483.md): In several functions that parse avrc response in avrc\_pars\_ct.cc and related files, there are possible out of bounds reads due to integer ov (CVSS 7.5, Android) - [CVE-2022-20484](https://cve.now/CVE-2022-20484.md): In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. (CVSS 7.8, Android) - [CVE-2022-20485](https://cve.now/CVE-2022-20485.md): In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. (CVSS 7.8, Android) - [CVE-2022-20486](https://cve.now/CVE-2022-20486.md): In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. (CVSS 7.8, Android) - [CVE-2022-20487](https://cve.now/CVE-2022-20487.md): In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. (CVSS 7.8, Android) - [CVE-2022-20488](https://cve.now/CVE-2022-20488.md): In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. (CVSS 7.8, Android) - [CVE-2022-20491](https://cve.now/CVE-2022-20491.md): In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. (CVSS 7.8, Android) - [CVE-2022-20495](https://cve.now/CVE-2022-20495.md): In getEnabledAccessibilityServiceList of AccessibilityManager.java, there is a possible way to hide an accessibility service due to a logic (CVSS 7.8, Android) - [CVE-2022-20496](https://cve.now/CVE-2022-20496.md): In setDataSource of initMediaExtractor.cpp, there is a possibility of arbitrary code execution due to a use after free. (CVSS 5.5, Android) - [CVE-2022-20497](https://cve.now/CVE-2022-20497.md): In updatePublicMode of NotificationLockscreenUserManagerImpl.java, there is a possible way to reveal sensitive notifications on the lockscre (CVSS 4.6, Android) - [CVE-2022-20498](https://cve.now/CVE-2022-20498.md): In fdt\_path\_offset\_namelen of fdt\_ro.c, there is a possible out of bounds read due to an incorrect bounds check. (CVSS 4.4, Android) - [CVE-2022-20500](https://cve.now/CVE-2022-20500.md): In loadFromXml of ShortcutPackage.java, there is a possible crash on boot due to an uncaught exception. (CVSS 5.5, Android) - [CVE-2022-20501](https://cve.now/CVE-2022-20501.md): In onCreate of EnableAccountPreferenceActivity.java, there is a possible way to mislead the user into enabling a malicious phone account due (CVSS 7.3, Android) - [CVE-2022-20502](https://cve.now/CVE-2022-20502.md): In GetResolvedMethod of entrypoint\_utils-inl.h, there is a possible use after free due to a stale cache. (CVSS 5.5, Android) - [CVE-2022-20611](https://cve.now/CVE-2022-20611.md): In deletePackageVersionedInternal of DeletePackageHelper.java, there is a possible way to bypass carrier restrictions due to a permissions b (CVSS 7.8, Android) - [CVE-2022-24480](https://cve.now/CVE-2022-24480.md): Outlook for Android Elevation of Privilege Vulnerability (CVSS 6.3, Microsoft Outlook for Android) - [CVE-2022-25672](https://cve.now/CVE-2022-25672.md): Denial of service in MODEM due to reachable assertion while processing SIB1 with invalid Bandwidth in Snapdragon Mobile (CVSS 7.5, Qualcomm Snapdragon Mobile) - [CVE-2022-25673](https://cve.now/CVE-2022-25673.md): Denial of service in MODEM due to reachable assertion while processing configuration from network in Snapdragon Mobile (CVSS 7.5, Qualcomm Snapdragon Mobile) - [CVE-2022-25675](https://cve.now/CVE-2022-25675.md): Denial of service due to reachable assertion in modem while processing filter rule from application client in Snapdragon Compute, Snapdragon (CVSS 5.5, Qualcomm Snapdragon Compute, Snapdragon Industrial IOT, Sna…) - [CVE-2022-25677](https://cve.now/CVE-2022-25677.md): Memory corruption in diag due to use after free while processing dci packet in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, (CVSS 6.7, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…) - [CVE-2022-25681](https://cve.now/CVE-2022-25681.md): Possible memory corruption in kernel while performing memory access due to hypervisor not correctly invalidated the processor translation ca (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…) - [CVE-2022-25682](https://cve.now/CVE-2022-25682.md): Memory corruption in MODEM UIM due to usage of out of range pointer offset while decoding command from card in Snapdragon Auto, Snapdragon C (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…) - [CVE-2022-25685](https://cve.now/CVE-2022-25685.md): Denial of service in Modem module due to improper authorization while error handling in Snapdragon Auto, Snapdragon Compute, Snapdragon Cons (CVSS 7.5, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…) - [CVE-2022-25689](https://cve.now/CVE-2022-25689.md): Denial of service in Modem due to reachable assertion in Snapdragon Mobile (CVSS 7.5, Qualcomm Snapdragon Mobile) - [CVE-2022-25691](https://cve.now/CVE-2022-25691.md): Denial of service in Modem due to reachable assertion while processing SIB1 with invalid SCS and bandwidth settings in Snapdragon Mobile (CVSS 7.5, Qualcomm Snapdragon Mobile) - [CVE-2022-25692](https://cve.now/CVE-2022-25692.md): Denial of service in Modem due to reachable assertion while processing the common config procedure in Snapdragon Auto, Snapdragon Compute, S (CVSS 7.5, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon In…) - [CVE-2022-25695](https://cve.now/CVE-2022-25695.md): Memory corruption in MODEM due to Improper Validation of Array Index while processing GSTK Proactive commands in Snapdragon Auto, Snapdragon (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…) - [CVE-2022-25697](https://cve.now/CVE-2022-25697.md): Memory corruption in i2c buses due to improper input validation while reading address configuration from i2c driver in Snapdragon Mobile, Sn (CVSS 8.4, Qualcomm Snapdragon Mobile, Snapdragon Wearables) - [CVE-2022-25698](https://cve.now/CVE-2022-25698.md): Memory corruption in SPI buses due to improper input validation while reading address configuration from spi buses in Snapdragon Mobile, Sna (CVSS 8.4, Qualcomm Snapdragon Mobile, Snapdragon Wearables) - [CVE-2022-25702](https://cve.now/CVE-2022-25702.md): Denial of service in modem due to reachable assertion while processing reconfiguration message in Snapdragon Auto, Snapdragon Compute, Snapd (CVSS 7.5, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon In…) - [CVE-2022-25711](https://cve.now/CVE-2022-25711.md): Memory corruption in camera due to improper validation of array index in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapd (CVSS 6.7, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…) - [CVE-2022-25712](https://cve.now/CVE-2022-25712.md): Memory corruption in camera due to buffer copy without checking size of input in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IO (CVSS 6.7, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…) - [CVE-2022-26804](https://cve.now/CVE-2022-26804.md): Microsoft Office Graphics Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise) - [CVE-2022-26805](https://cve.now/CVE-2022-26805.md): Microsoft Office Graphics Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise) - [CVE-2022-26806](https://cve.now/CVE-2022-26806.md): Microsoft Office Graphics Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise) - [CVE-2022-27518](https://cve.now/CVE-2022-27518.md): Unauthenticated remote arbitrary code execution (CVSS 9.8, KEV, Citrix Gateway, Citrix ADC) - [CVE-2022-27581](https://cve.now/CVE-2022-27581.md): Use of a Broken or Risky Cryptographic Algorithm in SICK RFU61x firmware version \= 7.0 \< V8.06). (CVSS 7.5, Siemens SICAM PAS/PQS) - [CVE-2022-43724](https://cve.now/CVE-2022-43724.md): A vulnerability has been identified in SICAM PAS/PQS (All versions \< V7.0). (CVSS 9.8, Siemens SICAM PAS/PQS) - [CVE-2022-43996](https://cve.now/CVE-2022-43996.md): The csaf\_provider package before 0.8.2 allows XSS via a crafted CSAF document uploaded as text/html. (CVSS 5.4, github.com/csaf-poc/csaf\_distribution) - [CVE-2022-44303](https://cve.now/CVE-2022-44303.md): Resque Scheduler version 1.27.4 is vulnerable to Cross-site scripting (XSS). (CVSS 6.1, resque-scheduler) - [CVE-2022-4444](https://cve.now/CVE-2022-4444.md): ipti br.tag cross site scripting (CVSS 3.5, ipti br.tag) - [CVE-2022-4446](https://cve.now/CVE-2022-4446.md): PHP Remote File Inclusion in tsolucio/corebos (CVSS 9.8, tsolucio/corebos) - [CVE-2022-4454](https://cve.now/CVE-2022-4454.md): m0ver bible-online Search search.java query sql injection (CVSS 5.5, m0ver bible-online) - [CVE-2022-4455](https://cve.now/CVE-2022-4455.md): sproctor php-calendar index.php cross site scripting (CVSS 5.1, sproctor php-calendar) - [CVE-2022-4456](https://cve.now/CVE-2022-4456.md): falling-fruit cross site scripting (CVSS 3.5, falling-fruit) - [CVE-2022-44575](https://cve.now/CVE-2022-44575.md): A vulnerability has been identified in PLM Help Server V4.2 (All versions). (CVSS 6.1, Siemens PLM Help Server) - [CVE-2022-44636](https://cve.now/CVE-2022-44636.md): The Samsung TV (2021 and 2022 model) smart remote control allows attackers to enable microphone access via Bluetooth spoofing when a user is (CVSS 4.6) - [CVE-2022-44666](https://cve.now/CVE-2022-44666.md): Windows Contacts Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2022-44667](https://cve.now/CVE-2022-44667.md): Windows Media Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2022-44668](https://cve.now/CVE-2022-44668.md): Windows Media Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2022-44669](https://cve.now/CVE-2022-44669.md): Windows Error Reporting Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2022-44670](https://cve.now/CVE-2022-44670.md): Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows) - [CVE-2022-44671](https://cve.now/CVE-2022-44671.md): Windows Graphics Component Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2022-44673](https://cve.now/CVE-2022-44673.md): Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2022-44674](https://cve.now/CVE-2022-44674.md): Windows Bluetooth Driver Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2022-44675](https://cve.now/CVE-2022-44675.md): Windows Bluetooth Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2022-44676](https://cve.now/CVE-2022-44676.md): Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows) - [CVE-2022-44677](https://cve.now/CVE-2022-44677.md): Windows Projected File System Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2022-44678](https://cve.now/CVE-2022-44678.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2022-44679](https://cve.now/CVE-2022-44679.md): Windows Graphics Component Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows) - [CVE-2022-44680](https://cve.now/CVE-2022-44680.md): Windows Graphics Component Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2022-44681](https://cve.now/CVE-2022-44681.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2022-44682](https://cve.now/CVE-2022-44682.md): Windows Hyper-V Denial of Service Vulnerability (CVSS 6.8, Microsoft Windows) - [CVE-2022-44683](https://cve.now/CVE-2022-44683.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2022-44687](https://cve.now/CVE-2022-44687.md): Raw Image Extension Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Raw Image Extension) - [CVE-2022-44688](https://cve.now/CVE-2022-44688.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 4.3, Microsoft Edge) - [CVE-2022-44689](https://cve.now/CVE-2022-44689.md): Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2022-44690](https://cve.now/CVE-2022-44690.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft Share… +1) - [CVE-2022-44691](https://cve.now/CVE-2022-44691.md): Microsoft Office OneNote Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office LTSC · Microsoft 365 Apps for Enterprise +1) - [CVE-2022-44692](https://cve.now/CVE-2022-44692.md): Microsoft Office Graphics Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office 2019 for Mac · Microsoft 365 Apps for E… +2) - [CVE-2022-44693](https://cve.now/CVE-2022-44693.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft Share… +1) - [CVE-2022-44694](https://cve.now/CVE-2022-44694.md): Microsoft Office Visio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise) - [CVE-2022-44695](https://cve.now/CVE-2022-44695.md): Microsoft Office Visio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise +2) - [CVE-2022-44696](https://cve.now/CVE-2022-44696.md): Microsoft Office Visio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise) - [CVE-2022-44697](https://cve.now/CVE-2022-44697.md): Windows Graphics Component Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2022-44698](https://cve.now/CVE-2022-44698.md): Windows SmartScreen Security Feature Bypass Vulnerability (CVSS 5.4, KEV, Microsoft Windows) - [CVE-2022-44699](https://cve.now/CVE-2022-44699.md): Azure Network Watcher Agent Security Feature Bypass Vulnerability (CVSS 5.5, Microsoft Azure Network Watcher VM Extension) - [CVE-2022-44702](https://cve.now/CVE-2022-44702.md): Windows Terminal Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows Terminal for Windows) - [CVE-2022-44704](https://cve.now/CVE-2022-44704.md): Microsoft Windows System Monitor (Sysmon) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Sysmon) - [CVE-2022-44707](https://cve.now/CVE-2022-44707.md): Windows Kernel Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows) - [CVE-2022-44708](https://cve.now/CVE-2022-44708.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 8.3, Microsoft Edge for iOS · Microsoft Edge) - [CVE-2022-44710](https://cve.now/CVE-2022-44710.md): DirectX Graphics Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2022-44713](https://cve.now/CVE-2022-44713.md): Microsoft Outlook for Mac Spoofing Vulnerability (CVSS 7.5, Microsoft Office LTSC for Mac · Microsoft Office 2019 for M…) - [CVE-2022-44731](https://cve.now/CVE-2022-44731.md): A vulnerability has been identified in SIMATIC WinCC OA V3.15 (All versions \< V3.15 P038), SIMATIC WinCC OA V3.16 (All versions \< V3.16 P035 (CVSS 5.4, Siemens SIMATIC WinCC OA) - [CVE-2022-44874](https://cve.now/CVE-2022-44874.md): wasm3 commit 7890a2097569fde845881e0b352d813573e371f9 was discovered to contain a segmentation fault via the component op\_CallIndirect at /m (CVSS 5.5) - [CVE-2022-45005](https://cve.now/CVE-2022-45005.md): IP-COM EW9 V15.11.0.14(9732) was discovered to contain a command injection vulnerability in the cmd\_get\_ping\_output function. (CVSS 9.8) - [CVE-2022-45028](https://cve.now/CVE-2022-45028.md): A cross-site scripting (XSS) vulnerability in Arris NVG443B 9.3.0h3d36 allows attackers to execute arbitrary web scripts or HTML via a craft (CVSS 6.1) - [CVE-2022-45044](https://cve.now/CVE-2022-45044.md): A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions \< V9.50), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 (CVSS 5.3, Siemens SIPROTEC 5 6MD84 · Siemens SIPROTEC 5 6MD85 +38) - [CVE-2022-45484](https://cve.now/CVE-2022-45484.md): A vulnerability has been identified in JT2Go (All versions \< V14.1.0.6), Teamcenter Visualization V13.2 (All versions \< V13.2.0.12), Teamcen (CVSS 3.3, Siemens JT2Go · Siemens Teamcenter Visualization) - [CVE-2022-45685](https://cve.now/CVE-2022-45685.md): A stack overflow in Jettison before v1.5.2 allows attackers to cause a Denial of Service (DoS) via crafted JSON data. (CVSS 7.5, org.codehaus.jettison:jettison) - [CVE-2022-45688](https://cve.now/CVE-2022-45688.md): A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JS (CVSS 7.5, cn.hutool:hutool-json · org.json:json) - [CVE-2022-45689](https://cve.now/CVE-2022-45689.md): hutool-json v5.8.10 was discovered to contain an out of memory error. (CVSS 7.5, cn.hutool:hutool-json) - [CVE-2022-45690](https://cve.now/CVE-2022-45690.md): A stack overflow in the org.json.JSONTokener.nextValue::JSONTokener.java component of hutool-json v5.8.10 allows attackers to cause a Denial (CVSS 7.5, cn.hutool:hutool-json) - [CVE-2022-45693](https://cve.now/CVE-2022-45693.md): Jettison before v1.5.2 was discovered to contain a stack overflow via the map parameter. (CVSS 7.5, org.codehaus.jettison:jettison) - [CVE-2022-45871](https://cve.now/CVE-2022-45871.md): Denial-of-Service (DoS) Vulnerability (CVSS 4.3) - [CVE-2022-45936](https://cve.now/CVE-2022-45936.md): A vulnerability has been identified in Mendix Email Connector (All versions \< V2.0.0). (CVSS 8.1, Siemens Mendix Email Connector) - [CVE-2022-45937](https://cve.now/CVE-2022-45937.md): A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions \< V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions \< (CVSS 8.8, Siemens APOGEE PXC Compact · Siemens APOGEE PXC Modular +2) - [CVE-2022-46047](https://cve.now/CVE-2022-46047.md): AeroCMS v0.0.1 is vulnerable to SQL Injection via the delete parameter. (CVSS 4.9) - [CVE-2022-46051](https://cve.now/CVE-2022-46051.md): The approve parameter from the AeroCMS-v0.0.1 CMS system is vulnerable to SQL injection attacks. (CVSS 7.2) - [CVE-2022-46058](https://cve.now/CVE-2022-46058.md): AeroCMS v0.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via add\_post.php. (CVSS 4.8) - [CVE-2022-46059](https://cve.now/CVE-2022-46059.md): AeroCMS v0.0.1 is vulnerable to Cross Site Request Forgery (CSRF). (CVSS 6.5) - [CVE-2022-46061](https://cve.now/CVE-2022-46061.md): AeroCMS v0.0.1 is vulnerable to ClickJacking. (CVSS 6.1) - [CVE-2022-46062](https://cve.now/CVE-2022-46062.md): Gym Management System v0.0.1 is vulnerable to Cross Site Request Forgery (CSRF). (CVSS 4.5) - [CVE-2022-46140](https://cve.now/CVE-2022-46140.md): Affected devices use a weak encryption scheme to encrypt the debug zip file. (CVSS 6.5, Siemens RUGGEDCOM RM1224 LTE(4G) EU · Siemens RUGGEDCOM… +87) - [CVE-2022-46142](https://cve.now/CVE-2022-46142.md): Affected devices store the CLI user passwords encrypted in flash memory. (CVSS 5.7, Siemens RUGGEDCOM RM1224 LTE(4G) EU · Siemens RUGGEDCOM… +87) - [CVE-2022-46143](https://cve.now/CVE-2022-46143.md): Affected devices do not check the TFTP blocksize correctly. (CVSS 2.7, Siemens RUGGEDCOM RM1224 LTE(4G) EU · Siemens RUGGEDCOM… +89) - [CVE-2022-46144](https://cve.now/CVE-2022-46144.md): A vulnerability has been identified in SCALANCE SC622-2C (6GK5622-2GS00-2AC2) (All versions \< V2.3), SCALANCE SC622-2C (6GK5622-2GS00-2AC2) (CVSS 6.5, Siemens SCALANCE SC622-2C · Siemens SCALANCE SC626-2C +8) - [CVE-2022-46265](https://cve.now/CVE-2022-46265.md): A vulnerability has been identified in Polarion ALM (All versions \< V2304.0). (CVSS 5.4, Siemens Polarion ALM) - [CVE-2022-46345](https://cve.now/CVE-2022-46345.md): A vulnerability has been identified in Parasolid V33.1 (All versions \< V33.1.264), Parasolid V34.0 (All versions \< V34.0.252), Parasolid V34 (CVSS 7.8, Siemens Parasolid · Siemens Solid Edge SE2022 +1) - [CVE-2022-46346](https://cve.now/CVE-2022-46346.md): A vulnerability has been identified in Parasolid V33.1 (All versions \< V33.1.264), Parasolid V34.0 (All versions \< V34.0.252), Parasolid V34 (CVSS 7.8, Siemens Parasolid · Siemens Solid Edge SE2022 +1) - [CVE-2022-46347](https://cve.now/CVE-2022-46347.md): A vulnerability has been identified in Parasolid V33.1 (All versions \< V33.1.264), Parasolid V34.0 (All versions \< V34.0.252), Parasolid V34 (CVSS 7.8, Siemens Parasolid · Siemens Solid Edge SE2022 +1) - [CVE-2022-46348](https://cve.now/CVE-2022-46348.md): A vulnerability has been identified in Parasolid V33.1 (All versions \< V33.1.264), Parasolid V34.0 (All versions \< V34.0.252), Parasolid V34 (CVSS 7.8, Siemens Parasolid · Siemens Solid Edge SE2022 +1) - [CVE-2022-46349](https://cve.now/CVE-2022-46349.md): A vulnerability has been identified in Parasolid V33.1 (All versions \< V33.1.264), Parasolid V34.0 (All versions \< V34.0.252), Parasolid V34 (CVSS 7.8, Siemens Parasolid · Siemens Solid Edge SE2022 +1) - [CVE-2022-46350](https://cve.now/CVE-2022-46350.md): A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions \< V3.2.7), SCALANCE X204RNA (PRP) (All versions \< V3.2.7), SCALA (CVSS 6.1, Siemens SCALANCE X204RNA) - [CVE-2022-46351](https://cve.now/CVE-2022-46351.md): A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions \< V3.2.7), SCALANCE X204RNA (PRP) (All versions \< V3.2.7), SCALA (CVSS 5.5, Siemens SCALANCE X204RNA) - [CVE-2022-46352](https://cve.now/CVE-2022-46352.md): A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions \< V3.2.7), SCALANCE X204RNA (PRP) (All versions \< V3.2.7), SCALA (CVSS 7.5, Siemens SCALANCE X204RNA) - [CVE-2022-46353](https://cve.now/CVE-2022-46353.md): A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions \< V3.2.7), SCALANCE X204RNA (PRP) (All versions \< V3.2.7), SCALA (CVSS 9.8, Siemens SCALANCE X204RNA) - [CVE-2022-46354](https://cve.now/CVE-2022-46354.md): A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions \< V3.2.7), SCALANCE X204RNA (PRP) (All versions \< V3.2.7), SCALA (CVSS 5.3, Siemens SCALANCE X204RNA) - [CVE-2022-46355](https://cve.now/CVE-2022-46355.md): A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions \< V3.2.7), SCALANCE X204RNA (PRP) (All versions \< V3.2.7), SCALA (CVSS 7.5, Siemens SCALANCE X204RNA) - [CVE-2022-46381](https://cve.now/CVE-2022-46381.md): Certain Linear eMerge E3-Series devices are vulnerable to XSS via the type parameter (e.g., to the badging/badge\_template\_v0.php component). (CVSS 6.1) - [CVE-2022-46404](https://cve.now/CVE-2022-46404.md): A command injection vulnerability has been identified in Atos Unify OpenScape 4000 Assistant and Unify OpenScape 4000 Manager (8 before R2.2 (CVSS 9.8) - [CVE-2022-46664](https://cve.now/CVE-2022-46664.md): A vulnerability has been identified in Mendix Workflow Commons (All versions \< V2.4.0), Mendix Workflow Commons V2.1 (All versions \< V2.1.4) (CVSS 8.1, Siemens Mendix Workflow Commons) - [CVE-2022-46832](https://cve.now/CVE-2022-46832.md): Use of a Broken or Risky Cryptographic Algorithm in SICK RFU62x firmware version \< 2.21 allows a low-privileged remote attacker to decrypt t (CVSS 6.5, SICK RFU62x Firmware) - [CVE-2022-46833](https://cve.now/CVE-2022-46833.md): Use of a Broken or Risky Cryptographic Algorithm in SICK RFU63x firmware version \< v2.21 allows a low-privileged remote attacker to decrypt (CVSS 6.5, SICK RFU63x Firmware) - [CVE-2022-46834](https://cve.now/CVE-2022-46834.md): Use of a Broken or Risky Cryptographic Algorithm in SICK RFU65x firmware version \< v2.21 allows a low-privileged remote attacker to decrypt (CVSS 6.5, SICK RFU65x Firmware) - [CVE-2022-47211](https://cve.now/CVE-2022-47211.md): Microsoft Office Graphics Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise) - [CVE-2022-47212](https://cve.now/CVE-2022-47212.md): Microsoft Office Graphics Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise) - [CVE-2022-47213](https://cve.now/CVE-2022-47213.md): Microsoft Office Graphics Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2022-12-13 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.