CVEs published December 15, 2022
109 CVEs were published on December 15, 2022: 14 critical, 38 high. 1 is now in CISA KEV.
- Published
- 109
- Critical
- 14
- High
- 38
- Medium
- 46
- Low
- 11
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 73
Most affected products
- Apple macOS
- 15
- Apple tvOS · Apple watchOS
- 14
- feehi/feehicms
- 8
- Apple tvOS
- 5
- openemr/openemr
- 5
- Apple iOS and iPadOS
- 4
- Apple macOS · Apple tvOS +1
- 4
- Apple iCloud for Windows · Apple tvOS +1
- 3
- helm · helm.sh/helm/v3
- 3
- TIBCO Software TIBCO JasperReports Server
- 3
Critical 14
- CVE-2021-4226RSFirewall < 1.1.25 - IP Block BypassRSFirewall!
- CVE-2022-44588WordPress Cryptocurrency Widgets Pack Plugin <=1.8.1 is vulnerable to SQL InjectionBlocksera Cryptocurrency Widgets Pack
- CVE-2022-41561TIBCO JasperReports Server RCE VulnerabilityTIBCO Software TIBCO JasperReports Server
- CVE-2022-41563TIBCO JasperReports Server Stored XSS VulnerabilityTIBCO Software TIBCO JasperReports Server
- CVE-2021-33420A deserialization issue discovered in inikulin replicator before 1.0.4 allows remote attackers to run arbitrary code via the fromSerializablreplicator
- CVE-2021-39426An issue was discovered in /Upload/admin/admin_notify.php in Seacms 11.4 allows attackers to execute arbitrary php code via the notify1 para
- CVE-2022-40004Cross Site Scripting (XSS) vulnerability in Things Board 3.4.1 allows remote attackers to escalate privilege via crafted URL to the Audit Lo
- CVE-2022-42837An issue existed in the parsing of URLs.Apple macOS · Apple watchOS
- CVE-2022-42842The issue was addressed with improved memory handling.Apple macOS · Apple tvOS +1
- CVE-2022-44236Beijing Zed-3 Technologies Co.,Ltd VoIP simpliclty ASG 8.5.0.17807 (20181130-16:12) has a Weak password vulnerability.
- CVE-2022-45969Alist v3.4.0 is vulnerable to Directory Traversal,github.com/alist-org/alist/v3 · github.com/alist-org/alist
- CVE-2022-46393An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0.
- CVE-2022-46631TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the wscDisabled parameter in the sett
- CVE-2022-46634TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the wscDisabled parameter in the sett
High 38
- CVE-2022-3427Corner Ad <= 1.0.56 - Cross-Site Request Forgerycodepeople Corner Ad
- CVE-2022-24377Command Injectioncycle-import-check
- CVE-2022-41562TIBCO JasperReports Server XSS Issue on RolesTIBCO Software TIBCO JasperReports Server
- CVE-2020-20588File upload vulnerability in function upload in action/Core.class.php in zhimengzhe iBarn 1.5 allows remote attackers to run arbitrary code
- CVE-2022-32860An out-of-bounds write was addressed with improved input validation.Apple macOS
- CVE-2022-32942The issue was addressed with improved memory handling.Apple macOS
- CVE-2022-32948An out-of-bounds read was addressed with improved bounds checking.Apple macOS
- CVE-2022-42805An integer overflow was addressed with improved input validation.Apple macOS
- CVE-2022-42840The issue was addressed with improved memory handling.Apple macOS
- CVE-2022-42841A type confusion issue was addressed with improved checks.Apple macOS
- CVE-2022-42843This issue was addressed with improved data protection.Apple tvOS · Apple watchOS
- CVE-2022-42844The issue was addressed with improved memory handling.Apple iOS and iPadOS
- CVE-2022-42845The issue was addressed with improved memory handling.Apple macOS · Apple tvOS +1
- CVE-2022-42847An out-of-bounds write issue was addressed with improved input validation.Apple macOS
- CVE-2022-42848A logic issue was addressed with improved checks.Apple tvOS
- CVE-2022-42849An access issue existed with privileged API calls.Apple tvOS · Apple watchOS
- CVE-2022-42850The issue was addressed with improved memory handling.Apple iOS and iPadOS
- CVE-2022-42855A logic issue was addressed with improved state management.Apple tvOS
- CVE-2022-42856A type confusion issue was addressed with improved state handling.Apple tvOS
- CVE-2022-42861This issue was addressed with improved checks.Apple macOS
- CVE-2022-42863A memory corruption issue was addressed with improved state management.Apple tvOS · Apple watchOS
- CVE-2022-42864A race condition was addressed with improved state handling.Apple macOS · Apple tvOS +1
- CVE-2022-42867A use after free issue was addressed with improved memory management.Apple tvOS · Apple watchOS
- CVE-2022-4502Cross-site Scripting (XSS) - Reflected in openemr/openemropenemr/openemr
- CVE-2022-4504Improper Input Validation in openemr/openemropenemr/openemr
- CVE-2022-4505Authorization Bypass Through User-Controlled Key in openemr/openemropenemr/openemr
- CVE-2022-4506Unrestricted Upload of File with Dangerous Type in openemr/openemropenemr/openemr
- CVE-2022-45338An arbitrary file upload vulnerability in the profile picture upload function of Exact Synergy Enterprise 267 before 267SP13 and Exact Syner
- CVE-2022-46689A race condition was addressed with additional validation.Apple macOS · Apple tvOS +1
- CVE-2022-46690An out-of-bounds write issue was addressed with improved input validation.Apple tvOS · Apple watchOS
- CVE-2022-46691A memory consumption issue was addressed with improved memory handling.Apple tvOS · Apple watchOS
- CVE-2022-46693An out-of-bounds write issue was addressed with improved input validation.Apple iCloud for Windows · Apple tvOS +1
- CVE-2022-46694An out-of-bounds write issue was addressed with improved input validation.Apple tvOS · Apple watchOS
- CVE-2022-46696A memory corruption issue was addressed with improved input validation.Apple tvOS · Apple watchOS
- CVE-2022-46697An out-of-bounds access issue was addressed with improved bounds checking.Apple macOS
- CVE-2022-46699A memory corruption issue was addressed with improved state management.Apple tvOS · Apple watchOS
- CVE-2022-46700A memory corruption issue was addressed with improved input validation.Apple tvOS · Apple watchOS
- CVE-2022-46701The issue was addressed with improved bounds checks.Apple tvOS
Medium, low and unrated 57
- CVE-2022-41960BigBlueButton contains DoS via failed authToken validationbigbluebutton
- CVE-2022-38653HCL Digital Experience is susceptible to cross-site scripting (XSS)HCL Software HCL Digital Experience
- CVE-2022-38662HCL Digital Experience is susceptible to open redirectsHCL Software HCL Digital Experience
- CVE-2022-4519WP User <= 7.0 - Authenticated (Administrator+) Stored Cross-Site Scriptingwalkeprashant WP User – Custom Registration Forms, Login an…
- CVE-2022-32531Apache BookKeeper: Java Client Uses Connection to Host that Failed Hostname VerificationApache Software Foundation Apache BookKeeper · apache-bo… +1
- CVE-2022-2536Transposh WordPress Translation <= 1.0.9.6 - Authorization Bypassoferwald Transposh WordPress Translation
- CVE-2022-23474editor.js contains Code Injectioncodex-team editor.js · @editorjs/editorjs
- CVE-2022-23526Helm contains Denial of service through schema filehelm · helm.sh/helm/v3
- CVE-2022-23525Helm vulnerable to Denial of service via NULL Pointer Dereferencehelm · helm.sh/helm/v3
- CVE-2022-23524Helm vulnerable to Denial of service through string value parsinghelm · helm.sh/helm/v3
- CVE-2022-23507Light client verification not taking into account chain IDinformalsystems tendermint-rs · tendermint-light-client-… +2
- CVE-2020-20589Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tfeehi/feehicms
- CVE-2020-21219Cross Site Scripting (XSS) vulnerability in Netgate pf Sense 2.4.4-Release-p3 and Netgate ACME package 0.6.3 allows remote attackers to to r
- CVE-2020-24855Directory Traversal vulnerability in easywebpack-cli before 4.5.2 allows attackers to obtain sensitive information via crafted GET request.@easy-team/easywebpack-cli
- CVE-2020-36607Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tfeehi/feehicms
- CVE-2021-36572Cross Site Scripting (XSS) vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via the user name field of the loginfeehi/feehicms
- CVE-2021-36573File Upload vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via crafted image upload.feehi/feehicms
- CVE-2021-39427Cross site scripting vulnerability in 188Jianzhan 2.10 allows attackers to execute arbitrary code via the username parameter to /admin/reg.p
- CVE-2021-39428Cross Site Scripting (XSS) vulnerability in Users.php in eyoucms 1.5.4 allows remote attackers to run arbitrary code and gain escalated priv
- CVE-2021-4245chbrown rfc6902 pointer.ts prototype pollutionchbrown rfc6902 · rfc6902
- CVE-2022-32833An issue existed with the file paths used to store website data.Apple iOS
- CVE-2022-32916An out-of-bounds read issue existed that led to the disclosure of kernel memory.Apple iOS
- CVE-2022-32943The issue was addressed with improved bounds checks.Apple macOS
- CVE-2022-32945An access issue was addressed with additional sandbox restrictions on third-party apps.Apple macOS
- CVE-2022-40000Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the username field of the adminfeehi/feehicms
- CVE-2022-40001Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the title field of the create afeehi/feehicms
- CVE-2022-40002Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbirtary code via the callback parameter to /cms/feehi/feehicms
- CVE-2022-40373Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 allows remote attackers to run arbitrary code via upload of crafted XML file.feehi/feehicms
- CVE-2022-42821A logic issue was addressed with improved checks.Apple macOS
- CVE-2022-42846The issue was addressed with improved memory handling.Apple iOS and iPadOS
- CVE-2022-42851The issue was addressed with improved memory handling.Apple tvOS
- CVE-2022-42852The issue was addressed with improved memory handling.Apple tvOS · Apple watchOS
- CVE-2022-42853An access issue was addressed with improved access restrictions.Apple macOS
- CVE-2022-42854The issue was addressed with improved memory handling.Apple macOS
- CVE-2022-42859Multiple issues were addressed by removing the vulnerable code.Apple macOS · Apple watchOS
- CVE-2022-42862This issue was addressed by removing the vulnerable code.Apple macOS
- CVE-2022-42865This issue was addressed by enabling hardened runtime.Apple tvOS · Apple watchOS
- CVE-2022-42866The issue was addressed with improved handling of caches.Apple tvOS · Apple watchOS
- CVE-2022-44235Beijing Zed-3 Technologies Co.,Ltd VoIP simpliclty ASG 8.5.0.17807 (20181130-16:12) is vulnerable to Cross Site Scripting (XSS).
- CVE-2022-4503Cross-site Scripting (XSS) - Generic in openemr/openemropenemr/openemr
- CVE-2022-45033A cross-site scripting (XSS) vulnerability in Expense Tracker 1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted pa
- CVE-2022-4511RainyGao DocSys path traversalRainyGao DocSys
- CVE-2022-4513European Environment Agency eionet.contreg cross site scriptingEuropean Environment Agency eionet.contreg
- CVE-2022-4514Opencaching Deutschland oc-server3 varset.inc.php cross site scriptingOpencaching Deutschland oc-server3
- CVE-2022-4520WSO2 carbon-registry Advanced Search advancedSearchForm-ajaxprocessor.jsp cross site scriptingWSO2 carbon-registry · org.wso2.carbon.registry:carbon-regi…
- CVE-2022-4521WSO2 carbon-registry Request Parameter cross site scriptingWSO2 carbon-registry · org.wso2.carbon.registry:carbon-regi…
- CVE-2022-4522CalendarXP cross site scriptingCalendarXP
- CVE-2022-4523vexim2 cross site scriptingvexim2
- CVE-2022-4524Roots soil Plugin CleanUpModule.php language_attributes cross site scriptingRoots soil Plugin · roots/soil
- CVE-2022-4525National Sleep Research Resource sleepdata.org cross site scriptingNational Sleep Research Resource sleepdata.org
- CVE-2022-4526django-photologue Default Template photo_detail.html cross site scriptingdjango-photologue
- CVE-2022-4527collective.task table.py AssignedGroupColumn cross site scriptingcollective.task · collective-task
- CVE-2022-46392An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0.
- CVE-2022-46692A logic issue was addressed with improved state management.Apple iCloud for Windows · Apple tvOS +1
- CVE-2022-46695A spoofing issue existed in the handling of URLs.Apple tvOS · Apple watchOS
- CVE-2022-46698A logic issue was addressed with improved checks.Apple iCloud for Windows · Apple tvOS +1
- CVE-2022-46702The issue was addressed with improved memory handling.Apple iOS and iPadOS