# CVEs published 2022-12-14

88 CVEs were published on December 14, 2022: 14 critical, 35 high. Days are UTC.

- [CVE-2020-4497](https://cve.now/CVE-2020-4497.md): IBM Spectrum Protect Plus information disclosure (CVSS 6.8, IBM Spectrum Protect Plus)
- [CVE-2022-4410](https://cve.now/CVE-2022-4410.md): Permalink Manager Lite \<= 2.2.20.3 - Authenticated Stored Cross-Site Scripting (CVSS 6.4, mbis Permalink Manager Lite)
- [CVE-2022-3917](https://cve.now/CVE-2022-3917.md): Improper access control of bootloader function was discovered in Motorola Mobility Motorola e20 prior to version RONS31.267-38-8 allows atta (CVSS 4.6, Motorola Moto e20)
- [CVE-2022-4501](https://cve.now/CVE-2022-4501.md): Mega Addons For WPBakery Page Builder \<= 4.3.0 - Authenticated (Subscriber+) Settings Update (CVSS 7.1, nasir179125 Mega Addons For WPBakery Page Builder)
- [CVE-2022-23527](https://cve.now/CVE-2022-23527.md): Open Redirect in oidc\_validate\_redirect\_url() (CVSS 4.7, zmartzone mod\_auth\_openidc)
- [CVE-2022-23520](https://cve.now/CVE-2022-23520.md): rails-html-sanitizer contains an incomplete fix for an XSS vulnerability (CVSS 6.1, rails-html-sanitizer)
- [CVE-2022-23519](https://cve.now/CVE-2022-23519.md): Possible XSS vulnerability with certain configurations of rails-html-sanitizer (CVSS 7.2, rails-html-sanitizer)
- [CVE-2022-23518](https://cve.now/CVE-2022-23518.md): Improper neutralization of data URIs allows XSS in rails-html-sanitizer (CVSS 6.1, rails-html-sanitizer)
- [CVE-2022-23517](https://cve.now/CVE-2022-23517.md): Inefficient Regular Expression Complexity in rails-html-sanitizer (CVSS 7.5, rails-html-sanitizer)
- [CVE-2022-23516](https://cve.now/CVE-2022-23516.md): Uncontrolled Recursion in Loofah (CVSS 7.5, flavorjones loofah · loofah)
- [CVE-2022-23515](https://cve.now/CVE-2022-23515.md): Improper neutralization of data URIs may allow XSS in Loofah (CVSS 6.1, flavorjones loofah · loofah)
- [CVE-2022-23514](https://cve.now/CVE-2022-23514.md): Inefficient Regular Expression Complexity in Loofah (CVSS 7.5, flavorjones loofah · loofah)
- [CVE-2022-23512](https://cve.now/CVE-2022-23512.md): Metersphere is vulnerable to Path Injection. (CVSS 7.7, metersphere)
- [CVE-2022-34271](https://cve.now/CVE-2022-34271.md): Apache Atlas: zip path traversal in import functionality (CVSS 8.8, Apache Software Foundation Apache Atlas · org.apache.atlas:…)
- [CVE-2022-3590](https://cve.now/CVE-2022-3590.md): WP \<= 6.1.1 - Unauthenticated Blind SSRF via DNS Rebinding (CVSS 5.9, WordPress)
- [CVE-2022-3073](https://cve.now/CVE-2022-3073.md): Quaonos Schema ST4 example templates prone to XSS (CVSS 6.1, Quanos Schema ST4 example web templates)
- [CVE-2022-23504](https://cve.now/CVE-2022-23504.md): TYPO3 contains Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration (CVSS 5.7, typo3 · typo3/cms-core +1)
- [CVE-2022-23503](https://cve.now/CVE-2022-23503.md): TYPO3 vulnerable to Arbitrary Code Execution via Form Framework (CVSS 7.5, typo3 · typo3/cms-core +1)
- [CVE-2022-23502](https://cve.now/CVE-2022-23502.md): TYPO3 contains Insufficient Session Expiration after Password Reset (CVSS 5.4, typo3 · typo3/cms-core +1)
- [CVE-2022-23501](https://cve.now/CVE-2022-23501.md): TYPO3 vulnerable to Improper Authentication in Frontend Login (CVSS 5.9, typo3 · typo3/cms-core +1)
- [CVE-2022-23500](https://cve.now/CVE-2022-23500.md): TYPO3 subject to Uncontrolled Recursion resulting in Denial of Service (CVSS 5.9, typo3 · typo3/cms-core +1)
- [CVE-2022-22063](https://cve.now/CVE-2022-22063.md): Memory corruption in Core (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2020-9419](https://cve.now/CVE-2020-9419.md): Multiple stored cross-site scripting (XSS) vulnerabilities in Arcadyan Wifi routers VRV9506JAC23 allow remote attackers to inject arbitrary (CVSS 5.4)
- [CVE-2020-9420](https://cve.now/CVE-2020-9420.md): The login password of the web administrative dashboard in Arcadyan Wifi routers VRV9506JAC23 is sent in cleartext, allowing an attacker to s (CVSS 6.5)
- [CVE-2022-23741](https://cve.now/CVE-2022-23741.md): Incorrect authorization in GitHub Enterprise Server token generation leading to full admin access (CVSS 7.2, GitHub Enterprise Server)
- [CVE-2022-2601](https://cve.now/CVE-2022-2601.md): A buffer overflow was found in grub\_font\_construct\_glyph(). (CVSS 8.6, grub2)
- [CVE-2022-3104](https://cve.now/CVE-2022-3104.md): An issue was discovered in the Linux kernel through 5.16-rc6. (CVSS 5.5, Kernel)
- [CVE-2022-3105](https://cve.now/CVE-2022-3105.md): An issue was discovered in the Linux kernel through 5.16-rc6. (CVSS 5.5, Kernel)
- [CVE-2022-3106](https://cve.now/CVE-2022-3106.md): An issue was discovered in the Linux kernel through 5.16-rc6. (CVSS 5.5, Kernel)
- [CVE-2022-3107](https://cve.now/CVE-2022-3107.md): An issue was discovered in the Linux kernel through 5.16-rc6. (CVSS 5.5, Kernel)
- [CVE-2022-3108](https://cve.now/CVE-2022-3108.md): An issue was discovered in the Linux kernel through 5.16-rc6. (CVSS 5.5, Kernel)
- [CVE-2022-3110](https://cve.now/CVE-2022-3110.md): An issue was discovered in the Linux kernel through 5.16-rc6. (CVSS 5.5, Kernel)
- [CVE-2022-3111](https://cve.now/CVE-2022-3111.md): An issue was discovered in the Linux kernel through 5.16-rc6. (CVSS 5.5, Kernel)
- [CVE-2022-3112](https://cve.now/CVE-2022-3112.md): An issue was discovered in the Linux kernel through 5.16-rc6. (CVSS 5.5, Kernel)
- [CVE-2022-3113](https://cve.now/CVE-2022-3113.md): An issue was discovered in the Linux kernel through 5.16-rc6. (CVSS 5.5, Kernel)
- [CVE-2022-3114](https://cve.now/CVE-2022-3114.md): An issue was discovered in the Linux kernel through 5.16-rc6. (CVSS 5.5, Kernel)
- [CVE-2022-3115](https://cve.now/CVE-2022-3115.md): An issue was discovered in the Linux kernel through 5.16-rc6. (CVSS 5.5, Kernel)
- [CVE-2022-31358](https://cve.now/CVE-2022-31358.md): A reflected cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment prior to v7.2-3 allows remote attackers to execute arbit (CVSS 9.0)
- [CVE-2022-31700](https://cve.now/CVE-2022-31700.md): VMware Workspace ONE Access and Identity Manager contain an authenticated remote code execution vulnerability. (CVSS 7.2, VMware Workspace ONE Access (Access), VMware Identity Manag…)
- [CVE-2022-31701](https://cve.now/CVE-2022-31701.md): VMware Workspace ONE Access and Identity Manager contain a broken authentication vulnerability. (CVSS 5.3, VMware Workspace ONE Access (Access), VMware Identity Manag…)
- [CVE-2022-31702](https://cve.now/CVE-2022-31702.md): vRealize Network Insight (vRNI) contains a command injection vulnerability present in the vRNI REST API. (CVSS 9.8, VMware vRealize Network Insight)
- [CVE-2022-31703](https://cve.now/CVE-2022-31703.md): The vRealize Log Insight contains a Directory Traversal Vulnerability. (CVSS 7.5, vRealize Log Insight)
- [CVE-2022-31705](https://cve.now/CVE-2022-31705.md): VMware ESXi, Workstation, and Fusion contain a heap out-of-bounds write vulnerability in the USB 2.0 controller (EHCI). (CVSS 8.2, VMware ESXi, VMware Workstation Pro / Player, VMware Fusion…)
- [CVE-2022-38488](https://cve.now/CVE-2022-38488.md): logrocket-oauth2-example through 2020-05-27 allows SQL injection via the /auth/register username parameter. (CVSS 9.8)
- [CVE-2022-4283](https://cve.now/CVE-2022-4283.md): A vulnerability was found in X.Org. (CVSS 7.8, xorg-x11-server)
- [CVE-2022-4436](https://cve.now/CVE-2022-4436.md): Use after free in Blink Media in Google Chrome prior to 108.0.5359.124 allowed a remote attacker to potentially exploit heap corruption via (no CVSS, Google Chrome)
- [CVE-2022-4437](https://cve.now/CVE-2022-4437.md): Use after free in Mojo IPC in Google Chrome prior to 108.0.5359.124 allowed a remote attacker to potentially exploit heap corruption via a c (no CVSS, Google Chrome)
- [CVE-2022-4438](https://cve.now/CVE-2022-4438.md): Use after free in Blink Frames in Google Chrome prior to 108.0.5359.124 allowed a remote attacker who convinced the user to engage in specif (no CVSS, Google Chrome)
- [CVE-2022-4439](https://cve.now/CVE-2022-4439.md): Use after free in Aura in Google Chrome on Windows prior to 108.0.5359.124 allowed a remote attacker who convinced the user to engage in spe (no CVSS, Google Chrome)
- [CVE-2022-4440](https://cve.now/CVE-2022-4440.md): Use after free in Profiles in Google Chrome prior to 108.0.5359.124 allowed a remote attacker to potentially exploit heap corruption via a c (no CVSS, Google Chrome)
- [CVE-2022-44832](https://cve.now/CVE-2022-44832.md): D-Link DIR-3040 device with firmware 120B03 was discovered to contain a command injection vulnerability via the SetTriggerLEDBlink function. (CVSS 9.8)
- [CVE-2022-44898](https://cve.now/CVE-2022-44898.md): The MsIo64.sys component in Asus Aura Sync through v1.07.79 does not properly validate input to IOCTL 0x80102040, 0x80102044, 0x80102050, an (CVSS 7.8)
- [CVE-2022-44910](https://cve.now/CVE-2022-44910.md): Binbloom 2.0 was discovered to contain a heap buffer overflow via the read\_pointer function at /binbloom-master/src/helpers.c. (CVSS 7.8)
- [CVE-2022-4493](https://cve.now/CVE-2022-4493.md): scifio ZIP File DefaultSampleFilesService.java downloadAndUnpackResource path traversal (CVSS 6.3, scifio · io.scif:scifio)
- [CVE-2022-4494](https://cve.now/CVE-2022-4494.md): bspkrs MCPMappingViewer ZIP File RemoteZipHandler.java extractZip path traversal (CVSS 6.3, bspkrs MCPMappingViewer)
- [CVE-2022-4495](https://cve.now/CVE-2022-4495.md): collective.dms.basecontent column.py renderCell cross site scripting (CVSS 3.5, collective.dms.basecontent · collective-dms-basecontent)
- [CVE-2022-46071](https://cve.now/CVE-2022-46071.md): There is SQL Injection vulnerability at Helmet Store Showroom v1.0 Login Page. (CVSS 9.8)
- [CVE-2022-46072](https://cve.now/CVE-2022-46072.md): Helmet Store Showroom v1.0 vulnerable to unauthenticated SQL Injection. (CVSS 9.8)
- [CVE-2022-46073](https://cve.now/CVE-2022-46073.md): Helmet Store Showroom 1.0 is vulnerable to Cross Site Scripting (XSS). (CVSS 6.1)
- [CVE-2022-46074](https://cve.now/CVE-2022-46074.md): Helmet Store Showroom 1.0 is vulnerable to Cross Site Request Forgery (CSRF). (CVSS 8.8)
- [CVE-2022-46117](https://cve.now/CVE-2022-46117.md): Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/?page=view\_product&id=. (CVSS 7.2)
- [CVE-2022-46118](https://cve.now/CVE-2022-46118.md): Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/?page=product\_per\_brand&bid=. (CVSS 7.2)
- [CVE-2022-46119](https://cve.now/CVE-2022-46119.md): Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/?page=categories&c=. (CVSS 7.2)
- [CVE-2022-46120](https://cve.now/CVE-2022-46120.md): Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/?page=products/view\_product&id=. (CVSS 7.2)
- [CVE-2022-46121](https://cve.now/CVE-2022-46121.md): Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/?page=products/manage\_product&id=. (CVSS 7.2)
- [CVE-2022-46122](https://cve.now/CVE-2022-46122.md): Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/categories/view\_category.php?id=. (CVSS 7.2)
- [CVE-2022-46123](https://cve.now/CVE-2022-46123.md): Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/categories/manage\_category.php?id=. (CVSS 7.2)
- [CVE-2022-46124](https://cve.now/CVE-2022-46124.md): Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/?page=user/manage\_user&id=. (CVSS 7.2)
- [CVE-2022-46125](https://cve.now/CVE-2022-46125.md): Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/?page=client/manage\_client&id=. (CVSS 7.2)
- [CVE-2022-46126](https://cve.now/CVE-2022-46126.md): Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/brands/manage\_brand.php?id=. (CVSS 7.2)
- [CVE-2022-46127](https://cve.now/CVE-2022-46127.md): Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/classes/Master.php?f=delete\_product. (CVSS 7.2)
- [CVE-2022-46255](https://cve.now/CVE-2022-46255.md): Improper Limitation of a Pathname to a Restricted Directory in GitHub Enterprise Server leading to RCE (CVSS 9.8, GitHub Enterprise Server)
- [CVE-2022-46256](https://cve.now/CVE-2022-46256.md): Path traversal in GitHub Enterprise Server leading to remote code execution in GitHub Pages (CVSS 8.8, GitHub Enterprise Server)
- [CVE-2022-46340](https://cve.now/CVE-2022-46340.md): A vulnerability was found in X.Org. (CVSS 8.8, xorg-x11-server)
- [CVE-2022-46341](https://cve.now/CVE-2022-46341.md): A vulnerability was found in X.Org. (CVSS 8.8, xorg-x11-server)
- [CVE-2022-46342](https://cve.now/CVE-2022-46342.md): A vulnerability was found in X.Org. (CVSS 8.8, xorg-x11-server)
- [CVE-2022-46343](https://cve.now/CVE-2022-46343.md): A vulnerability was found in X.Org. (CVSS 8.8, xorg-x11-server)
- [CVE-2022-46344](https://cve.now/CVE-2022-46344.md): A vulnerability was found in X.Org. (no CVSS, xorg-x11-server)
- [CVE-2022-46443](https://cve.now/CVE-2022-46443.md): mesinkasir Bangresto 1.0 is vulnberable to SQL Injection via the itemqty%5B%5D parameter. (CVSS 8.8)
- [CVE-2022-46609](https://cve.now/CVE-2022-46609.md): Python3-RESTfulAPI commit d9907f14e9e25dcdb54f5b22252b0e9452e3970e and e772e0beee284c50946e94c54a1d43071ca78b74 was discovered to contain a (CVSS 9.8)
- [CVE-2022-46996](https://cve.now/CVE-2022-46996.md): vSphere\_selfuse commit 2a9fe074a64f6a0dd8ac02f21e2f10d66cac5749 was discovered to contain a code execution backdoor via the request package. (CVSS 9.8)
- [CVE-2022-46997](https://cve.now/CVE-2022-46997.md): Passhunt commit 54eb987d30ead2b8ebbf1f0b880aa14249323867 was discovered to contain a code execution backdoor via the request package. (CVSS 9.8)
- [CVE-2022-47406](https://cve.now/CVE-2022-47406.md): An issue was discovered in the fe\_change\_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for TYPO (CVSS 5.4, typo3/cms · derhansen/fe\_change\_pwd)
- [CVE-2022-47407](https://cve.now/CVE-2022-47407.md): An issue was discovered in the fp\_masterquiz (aka Master-Quiz) extension before 2.2.1, and 3.x before 3.5.1, for TYPO3. (CVSS 6.5, fixpunkt/fp-masterquiz)
- [CVE-2022-47408](https://cve.now/CVE-2022-47408.md): An issue was discovered in the fp\_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 t (CVSS 9.1, fixpunkt/fp-newsletter)
- [CVE-2022-47409](https://cve.now/CVE-2022-47409.md): An issue was discovered in the fp\_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 t (CVSS 9.1)
- [CVE-2022-47410](https://cve.now/CVE-2022-47410.md): An issue was discovered in the fp\_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 t (CVSS 9.1, fixpunkt/fp-newsletter)
- [CVE-2022-47411](https://cve.now/CVE-2022-47411.md): An issue was discovered in the fp\_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 t (CVSS 9.1, fixpunkt/fp-newsletter)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-12-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.