CVEs published December 14, 2022
88 CVEs were published on December 14, 2022: 14 critical, 35 high.
- Published
- 88
- Critical
- 14
- High
- 35
- Medium
- 32
- Low
- 1
- Unrated
- 6
- Now in CISA KEV
- 0
- Fix available
- 32
Most affected products
- Kernel
- 11
- xorg-x11-server
- 6
- Google Chrome
- 5
- typo3 · typo3/cms-core +1
- 5
- rails-html-sanitizer
- 4
- fixpunkt/fp-newsletter
- 3
- flavorjones loofah · loofah
- 3
- GitHub Enterprise Server
- 3
- VMware Workspace ONE Access (Access), VMware Identity Manag…
- 2
- Apache Software Foundation Apache Atlas · org.apache.atlas:…
- 1
Critical 14
- CVE-2022-31358A reflected cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment prior to v7.2-3 allows remote attackers to execute arbit
- CVE-2022-31702vRealize Network Insight (vRNI) contains a command injection vulnerability present in the vRNI REST API.VMware vRealize Network Insight
- CVE-2022-38488logrocket-oauth2-example through 2020-05-27 allows SQL injection via the /auth/register username parameter.
- CVE-2022-44832D-Link DIR-3040 device with firmware 120B03 was discovered to contain a command injection vulnerability via the SetTriggerLEDBlink function.
- CVE-2022-46071There is SQL Injection vulnerability at Helmet Store Showroom v1.0 Login Page.
- CVE-2022-46072Helmet Store Showroom v1.0 vulnerable to unauthenticated SQL Injection.
- CVE-2022-46255Improper Limitation of a Pathname to a Restricted Directory in GitHub Enterprise Server leading to RCEGitHub Enterprise Server
- CVE-2022-46609Python3-RESTfulAPI commit d9907f14e9e25dcdb54f5b22252b0e9452e3970e and e772e0beee284c50946e94c54a1d43071ca78b74 was discovered to contain a
- CVE-2022-46996vSphere_selfuse commit 2a9fe074a64f6a0dd8ac02f21e2f10d66cac5749 was discovered to contain a code execution backdoor via the request package.
- CVE-2022-46997Passhunt commit 54eb987d30ead2b8ebbf1f0b880aa14249323867 was discovered to contain a code execution backdoor via the request package.
- CVE-2022-47408An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 tfixpunkt/fp-newsletter
- CVE-2022-47409An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 t
- CVE-2022-47410An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 tfixpunkt/fp-newsletter
- CVE-2022-47411An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 tfixpunkt/fp-newsletter
High 35
- CVE-2022-4501Mega Addons For WPBakery Page Builder <= 4.3.0 - Authenticated (Subscriber+) Settings Updatenasir179125 Mega Addons For WPBakery Page Builder
- CVE-2022-23519Possible XSS vulnerability with certain configurations of rails-html-sanitizerrails-html-sanitizer
- CVE-2022-23517Inefficient Regular Expression Complexity in rails-html-sanitizerrails-html-sanitizer
- CVE-2022-23516Uncontrolled Recursion in Loofahflavorjones loofah · loofah
- CVE-2022-23514Inefficient Regular Expression Complexity in Loofahflavorjones loofah · loofah
- CVE-2022-23512Metersphere is vulnerable to Path Injection.metersphere
- CVE-2022-34271Apache Atlas: zip path traversal in import functionalityApache Software Foundation Apache Atlas · org.apache.atlas:…
- CVE-2022-23503TYPO3 vulnerable to Arbitrary Code Execution via Form Frameworktypo3 · typo3/cms-core +1
- CVE-2022-22063Memory corruption in CoreQualcomm Snapdragon
- CVE-2022-23741Incorrect authorization in GitHub Enterprise Server token generation leading to full admin accessGitHub Enterprise Server
- CVE-2022-2601A buffer overflow was found in grub_font_construct_glyph().grub2
- CVE-2022-31700VMware Workspace ONE Access and Identity Manager contain an authenticated remote code execution vulnerability.VMware Workspace ONE Access (Access), VMware Identity Manag…
- CVE-2022-31703The vRealize Log Insight contains a Directory Traversal Vulnerability.vRealize Log Insight
- CVE-2022-31705VMware ESXi, Workstation, and Fusion contain a heap out-of-bounds write vulnerability in the USB 2.0 controller (EHCI).VMware ESXi, VMware Workstation Pro / Player, VMware Fusion…
- CVE-2022-4283A vulnerability was found in X.Org.xorg-x11-server
- CVE-2022-44898The MsIo64.sys component in Asus Aura Sync through v1.07.79 does not properly validate input to IOCTL 0x80102040, 0x80102044, 0x80102050, an
- CVE-2022-44910Binbloom 2.0 was discovered to contain a heap buffer overflow via the read_pointer function at /binbloom-master/src/helpers.c.
- CVE-2022-46074Helmet Store Showroom 1.0 is vulnerable to Cross Site Request Forgery (CSRF).
- CVE-2022-46117Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/?page=view_product&id=.
- CVE-2022-46118Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/?page=product_per_brand&bid=.
- CVE-2022-46119Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/?page=categories&c=.
- CVE-2022-46120Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/?page=products/view_product&id=.
- CVE-2022-46121Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/?page=products/manage_product&id=.
- CVE-2022-46122Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/categories/view_category.php?id=.
- CVE-2022-46123Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/categories/manage_category.php?id=.
- CVE-2022-46124Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/?page=user/manage_user&id=.
- CVE-2022-46125Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/?page=client/manage_client&id=.
- CVE-2022-46126Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/brands/manage_brand.php?id=.
- CVE-2022-46127Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/classes/Master.php?f=delete_product.
- CVE-2022-46256Path traversal in GitHub Enterprise Server leading to remote code execution in GitHub PagesGitHub Enterprise Server
- CVE-2022-46340A vulnerability was found in X.Org.xorg-x11-server
- CVE-2022-46341A vulnerability was found in X.Org.xorg-x11-server
- CVE-2022-46342A vulnerability was found in X.Org.xorg-x11-server
- CVE-2022-46343A vulnerability was found in X.Org.xorg-x11-server
- CVE-2022-46443mesinkasir Bangresto 1.0 is vulnberable to SQL Injection via the itemqty%5B%5D parameter.
Medium, low and unrated 39
- CVE-2020-4497IBM Spectrum Protect Plus information disclosureIBM Spectrum Protect Plus
- CVE-2022-4410Permalink Manager Lite <= 2.2.20.3 - Authenticated Stored Cross-Site Scriptingmbis Permalink Manager Lite
- CVE-2022-3917Improper access control of bootloader function was discovered in Motorola Mobility Motorola e20 prior to version RONS31.267-38-8 allows attaMotorola Moto e20
- CVE-2022-23527Open Redirect in oidc_validate_redirect_url()zmartzone mod_auth_openidc
- CVE-2022-23520rails-html-sanitizer contains an incomplete fix for an XSS vulnerabilityrails-html-sanitizer
- CVE-2022-23518Improper neutralization of data URIs allows XSS in rails-html-sanitizerrails-html-sanitizer
- CVE-2022-23515Improper neutralization of data URIs may allow XSS in Loofahflavorjones loofah · loofah
- CVE-2022-3590WP <= 6.1.1 - Unauthenticated Blind SSRF via DNS RebindingWordPress
- CVE-2022-3073Quaonos Schema ST4 example templates prone to XSSQuanos Schema ST4 example web templates
- CVE-2022-23504TYPO3 contains Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configurationtypo3 · typo3/cms-core +1
- CVE-2022-23502TYPO3 contains Insufficient Session Expiration after Password Resettypo3 · typo3/cms-core +1
- CVE-2022-23501TYPO3 vulnerable to Improper Authentication in Frontend Logintypo3 · typo3/cms-core +1
- CVE-2022-23500TYPO3 subject to Uncontrolled Recursion resulting in Denial of Servicetypo3 · typo3/cms-core +1
- CVE-2020-9419Multiple stored cross-site scripting (XSS) vulnerabilities in Arcadyan Wifi routers VRV9506JAC23 allow remote attackers to inject arbitrary
- CVE-2020-9420The login password of the web administrative dashboard in Arcadyan Wifi routers VRV9506JAC23 is sent in cleartext, allowing an attacker to s
- CVE-2022-3104An issue was discovered in the Linux kernel through 5.16-rc6.Kernel
- CVE-2022-3105An issue was discovered in the Linux kernel through 5.16-rc6.Kernel
- CVE-2022-3106An issue was discovered in the Linux kernel through 5.16-rc6.Kernel
- CVE-2022-3107An issue was discovered in the Linux kernel through 5.16-rc6.Kernel
- CVE-2022-3108An issue was discovered in the Linux kernel through 5.16-rc6.Kernel
- CVE-2022-3110An issue was discovered in the Linux kernel through 5.16-rc6.Kernel
- CVE-2022-3111An issue was discovered in the Linux kernel through 5.16-rc6.Kernel
- CVE-2022-3112An issue was discovered in the Linux kernel through 5.16-rc6.Kernel
- CVE-2022-3113An issue was discovered in the Linux kernel through 5.16-rc6.Kernel
- CVE-2022-3114An issue was discovered in the Linux kernel through 5.16-rc6.Kernel
- CVE-2022-3115An issue was discovered in the Linux kernel through 5.16-rc6.Kernel
- CVE-2022-31701VMware Workspace ONE Access and Identity Manager contain a broken authentication vulnerability.VMware Workspace ONE Access (Access), VMware Identity Manag…
- CVE-2022-4436Use after free in Blink Media in Google Chrome prior to 108.0.5359.124 allowed a remote attacker to potentially exploit heap corruption via Google Chrome
- CVE-2022-4437Use after free in Mojo IPC in Google Chrome prior to 108.0.5359.124 allowed a remote attacker to potentially exploit heap corruption via a cGoogle Chrome
- CVE-2022-4438Use after free in Blink Frames in Google Chrome prior to 108.0.5359.124 allowed a remote attacker who convinced the user to engage in specifGoogle Chrome
- CVE-2022-4439Use after free in Aura in Google Chrome on Windows prior to 108.0.5359.124 allowed a remote attacker who convinced the user to engage in speGoogle Chrome
- CVE-2022-4440Use after free in Profiles in Google Chrome prior to 108.0.5359.124 allowed a remote attacker to potentially exploit heap corruption via a cGoogle Chrome
- CVE-2022-4493scifio ZIP File DefaultSampleFilesService.java downloadAndUnpackResource path traversalscifio · io.scif:scifio
- CVE-2022-4494bspkrs MCPMappingViewer ZIP File RemoteZipHandler.java extractZip path traversalbspkrs MCPMappingViewer
- CVE-2022-4495collective.dms.basecontent column.py renderCell cross site scriptingcollective.dms.basecontent · collective-dms-basecontent
- CVE-2022-46073Helmet Store Showroom 1.0 is vulnerable to Cross Site Scripting (XSS).
- CVE-2022-46344A vulnerability was found in X.Org.xorg-x11-server
- CVE-2022-47406An issue was discovered in the fe_change_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for TYPOtypo3/cms · derhansen/fe_change_pwd
- CVE-2022-47407An issue was discovered in the fp_masterquiz (aka Master-Quiz) extension before 2.2.1, and 3.x before 3.5.1, for TYPO3.fixpunkt/fp-masterquiz