# CVEs published 2022-12-15

109 CVEs were published on December 15, 2022: 14 critical, 38 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2022-41960](https://cve.now/CVE-2022-41960.md): BigBlueButton contains DoS via failed authToken validation (CVSS 4.3, bigbluebutton)
- [CVE-2022-38653](https://cve.now/CVE-2022-38653.md): HCL Digital Experience is susceptible to cross-site scripting (XSS) (CVSS 2.0, HCL Software HCL Digital Experience)
- [CVE-2022-38662](https://cve.now/CVE-2022-38662.md): HCL Digital Experience is susceptible to open redirects (CVSS 6.1, HCL Software HCL Digital Experience)
- [CVE-2022-4519](https://cve.now/CVE-2022-4519.md): WP User \<= 7.0 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 5.5, walkeprashant WP User – Custom Registration Forms, Login an…)
- [CVE-2021-4226](https://cve.now/CVE-2021-4226.md): RSFirewall \< 1.1.25 - IP Block Bypass (CVSS 9.8, RSFirewall!)
- [CVE-2022-44588](https://cve.now/CVE-2022-44588.md): WordPress Cryptocurrency Widgets Pack Plugin \<=1.8.1 is vulnerable to SQL Injection (CVSS 9.9, Blocksera Cryptocurrency Widgets Pack)
- [CVE-2022-32531](https://cve.now/CVE-2022-32531.md): Apache BookKeeper: Java Client Uses Connection to Host that Failed Hostname Verification (CVSS 5.9, Apache Software Foundation Apache BookKeeper · apache-bo… +1)
- [CVE-2022-3427](https://cve.now/CVE-2022-3427.md): Corner Ad \<= 1.0.56 - Cross-Site Request Forgery (CVSS 8.8, codepeople Corner Ad)
- [CVE-2022-2536](https://cve.now/CVE-2022-2536.md): Transposh WordPress Translation \<= 1.0.9.6 - Authorization Bypass (CVSS 5.3, oferwald Transposh WordPress Translation)
- [CVE-2022-24377](https://cve.now/CVE-2022-24377.md): Command Injection (CVSS 7.4, cycle-import-check)
- [CVE-2022-41561](https://cve.now/CVE-2022-41561.md): TIBCO JasperReports Server RCE Vulnerability (CVSS 9.1, TIBCO Software TIBCO JasperReports Server)
- [CVE-2022-41562](https://cve.now/CVE-2022-41562.md): TIBCO JasperReports Server XSS Issue on Roles (CVSS 8.4, TIBCO Software TIBCO JasperReports Server)
- [CVE-2022-41563](https://cve.now/CVE-2022-41563.md): TIBCO JasperReports Server Stored XSS Vulnerability (CVSS 9.0, TIBCO Software TIBCO JasperReports Server)
- [CVE-2022-23474](https://cve.now/CVE-2022-23474.md): editor.js contains Code Injection (CVSS 6.1, codex-team editor.js · @editorjs/editorjs)
- [CVE-2022-23526](https://cve.now/CVE-2022-23526.md): Helm contains Denial of service through schema file (CVSS 5.3, helm · helm.sh/helm/v3)
- [CVE-2022-23525](https://cve.now/CVE-2022-23525.md): Helm vulnerable to Denial of service via NULL Pointer Dereference (CVSS 5.3, helm · helm.sh/helm/v3)
- [CVE-2022-23524](https://cve.now/CVE-2022-23524.md): Helm vulnerable to Denial of service through string value parsing (CVSS 5.3, helm · helm.sh/helm/v3)
- [CVE-2022-23507](https://cve.now/CVE-2022-23507.md): Light client verification not taking into account chain ID (CVSS 5.4, informalsystems tendermint-rs · tendermint-light-client-… +2)
- [CVE-2020-20588](https://cve.now/CVE-2020-20588.md): File upload vulnerability in function upload in action/Core.class.php in zhimengzhe iBarn 1.5 allows remote attackers to run arbitrary code (CVSS 8.8)
- [CVE-2020-20589](https://cve.now/CVE-2020-20589.md): Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html t (CVSS 6.1, feehi/feehicms)
- [CVE-2020-21219](https://cve.now/CVE-2020-21219.md): Cross Site Scripting (XSS) vulnerability in Netgate pf Sense 2.4.4-Release-p3 and Netgate ACME package 0.6.3 allows remote attackers to to r (CVSS 6.1)
- [CVE-2020-24855](https://cve.now/CVE-2020-24855.md): Directory Traversal vulnerability in easywebpack-cli before 4.5.2 allows attackers to obtain sensitive information via crafted GET request. (CVSS 5.3, @easy-team/easywebpack-cli)
- [CVE-2020-36607](https://cve.now/CVE-2020-36607.md): Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html t (CVSS 6.1, feehi/feehicms)
- [CVE-2021-33420](https://cve.now/CVE-2021-33420.md): A deserialization issue discovered in inikulin replicator before 1.0.4 allows remote attackers to run arbitrary code via the fromSerializabl (CVSS 9.8, replicator)
- [CVE-2021-36572](https://cve.now/CVE-2021-36572.md): Cross Site Scripting (XSS) vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via the user name field of the login (CVSS 6.1, feehi/feehicms)
- [CVE-2021-36573](https://cve.now/CVE-2021-36573.md): File Upload vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via crafted image upload. (CVSS 5.4, feehi/feehicms)
- [CVE-2021-39426](https://cve.now/CVE-2021-39426.md): An issue was discovered in /Upload/admin/admin\_notify.php in Seacms 11.4 allows attackers to execute arbitrary php code via the notify1 para (CVSS 9.8)
- [CVE-2021-39427](https://cve.now/CVE-2021-39427.md): Cross site scripting vulnerability in 188Jianzhan 2.10 allows attackers to execute arbitrary code via the username parameter to /admin/reg.p (CVSS 5.4)
- [CVE-2021-39428](https://cve.now/CVE-2021-39428.md): Cross Site Scripting (XSS) vulnerability in Users.php in eyoucms 1.5.4 allows remote attackers to run arbitrary code and gain escalated priv (CVSS 5.4)
- [CVE-2021-4245](https://cve.now/CVE-2021-4245.md): chbrown rfc6902 pointer.ts prototype pollution (CVSS 5.5, chbrown rfc6902 · rfc6902)
- [CVE-2022-32833](https://cve.now/CVE-2022-32833.md): An issue existed with the file paths used to store website data. (CVSS 5.3, Apple iOS)
- [CVE-2022-32860](https://cve.now/CVE-2022-32860.md): An out-of-bounds write was addressed with improved input validation. (CVSS 7.8, Apple macOS)
- [CVE-2022-32916](https://cve.now/CVE-2022-32916.md): An out-of-bounds read issue existed that led to the disclosure of kernel memory. (CVSS 5.5, Apple iOS)
- [CVE-2022-32942](https://cve.now/CVE-2022-32942.md): The issue was addressed with improved memory handling. (CVSS 7.8, Apple macOS)
- [CVE-2022-32943](https://cve.now/CVE-2022-32943.md): The issue was addressed with improved bounds checks. (CVSS 5.3, Apple macOS)
- [CVE-2022-32945](https://cve.now/CVE-2022-32945.md): An access issue was addressed with additional sandbox restrictions on third-party apps. (CVSS 5.4, Apple macOS)
- [CVE-2022-32948](https://cve.now/CVE-2022-32948.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 7.8, Apple macOS)
- [CVE-2022-40000](https://cve.now/CVE-2022-40000.md): Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the username field of the admin (CVSS 5.4, feehi/feehicms)
- [CVE-2022-40001](https://cve.now/CVE-2022-40001.md): Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the title field of the create a (CVSS 5.4, feehi/feehicms)
- [CVE-2022-40002](https://cve.now/CVE-2022-40002.md): Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbirtary code via the callback parameter to /cms/ (CVSS 5.4, feehi/feehicms)
- [CVE-2022-40004](https://cve.now/CVE-2022-40004.md): Cross Site Scripting (XSS) vulnerability in Things Board 3.4.1 allows remote attackers to escalate privilege via crafted URL to the Audit Lo (CVSS 9.6)
- [CVE-2022-40373](https://cve.now/CVE-2022-40373.md): Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 allows remote attackers to run arbitrary code via upload of crafted XML file. (CVSS 5.4, feehi/feehicms)
- [CVE-2022-42805](https://cve.now/CVE-2022-42805.md): An integer overflow was addressed with improved input validation. (CVSS 7.8, Apple macOS)
- [CVE-2022-42821](https://cve.now/CVE-2022-42821.md): A logic issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2022-42837](https://cve.now/CVE-2022-42837.md): An issue existed in the parsing of URLs. (CVSS 9.8, Apple macOS · Apple watchOS)
- [CVE-2022-42840](https://cve.now/CVE-2022-42840.md): The issue was addressed with improved memory handling. (CVSS 7.8, Apple macOS)
- [CVE-2022-42841](https://cve.now/CVE-2022-42841.md): A type confusion issue was addressed with improved checks. (CVSS 7.8, Apple macOS)
- [CVE-2022-42842](https://cve.now/CVE-2022-42842.md): The issue was addressed with improved memory handling. (CVSS 9.8, Apple macOS · Apple tvOS +1)
- [CVE-2022-42843](https://cve.now/CVE-2022-42843.md): This issue was addressed with improved data protection. (CVSS 8.6, Apple tvOS · Apple watchOS)
- [CVE-2022-42844](https://cve.now/CVE-2022-42844.md): The issue was addressed with improved memory handling. (CVSS 8.6, Apple iOS and iPadOS)
- [CVE-2022-42845](https://cve.now/CVE-2022-42845.md): The issue was addressed with improved memory handling. (CVSS 7.2, Apple macOS · Apple tvOS +1)
- [CVE-2022-42846](https://cve.now/CVE-2022-42846.md): The issue was addressed with improved memory handling. (CVSS 5.5, Apple iOS and iPadOS)
- [CVE-2022-42847](https://cve.now/CVE-2022-42847.md): An out-of-bounds write issue was addressed with improved input validation. (CVSS 7.8, Apple macOS)
- [CVE-2022-42848](https://cve.now/CVE-2022-42848.md): A logic issue was addressed with improved checks. (CVSS 7.8, Apple tvOS)
- [CVE-2022-42849](https://cve.now/CVE-2022-42849.md): An access issue existed with privileged API calls. (CVSS 7.8, Apple tvOS · Apple watchOS)
- [CVE-2022-42850](https://cve.now/CVE-2022-42850.md): The issue was addressed with improved memory handling. (CVSS 7.8, Apple iOS and iPadOS)
- [CVE-2022-42851](https://cve.now/CVE-2022-42851.md): The issue was addressed with improved memory handling. (CVSS 5.5, Apple tvOS)
- [CVE-2022-42852](https://cve.now/CVE-2022-42852.md): The issue was addressed with improved memory handling. (CVSS 6.5, Apple tvOS · Apple watchOS)
- [CVE-2022-42853](https://cve.now/CVE-2022-42853.md): An access issue was addressed with improved access restrictions. (CVSS 5.5, Apple macOS)
- [CVE-2022-42854](https://cve.now/CVE-2022-42854.md): The issue was addressed with improved memory handling. (CVSS 5.5, Apple macOS)
- [CVE-2022-42855](https://cve.now/CVE-2022-42855.md): A logic issue was addressed with improved state management. (CVSS 7.1, Apple tvOS)
- [CVE-2022-42856](https://cve.now/CVE-2022-42856.md): A type confusion issue was addressed with improved state handling. (CVSS 8.8, KEV, Apple tvOS)
- [CVE-2022-42859](https://cve.now/CVE-2022-42859.md): Multiple issues were addressed by removing the vulnerable code. (CVSS 5.5, Apple macOS · Apple watchOS)
- [CVE-2022-42861](https://cve.now/CVE-2022-42861.md): This issue was addressed with improved checks. (CVSS 8.8, Apple macOS)
- [CVE-2022-42862](https://cve.now/CVE-2022-42862.md): This issue was addressed by removing the vulnerable code. (CVSS 5.5, Apple macOS)
- [CVE-2022-42863](https://cve.now/CVE-2022-42863.md): A memory corruption issue was addressed with improved state management. (CVSS 8.8, Apple tvOS · Apple watchOS)
- [CVE-2022-42864](https://cve.now/CVE-2022-42864.md): A race condition was addressed with improved state handling. (CVSS 7.0, Apple macOS · Apple tvOS +1)
- [CVE-2022-42865](https://cve.now/CVE-2022-42865.md): This issue was addressed by enabling hardened runtime. (CVSS 5.5, Apple tvOS · Apple watchOS)
- [CVE-2022-42866](https://cve.now/CVE-2022-42866.md): The issue was addressed with improved handling of caches. (CVSS 5.5, Apple tvOS · Apple watchOS)
- [CVE-2022-42867](https://cve.now/CVE-2022-42867.md): A use after free issue was addressed with improved memory management. (CVSS 8.8, Apple tvOS · Apple watchOS)
- [CVE-2022-44235](https://cve.now/CVE-2022-44235.md): Beijing Zed-3 Technologies Co.,Ltd VoIP simpliclty ASG 8.5.0.17807 (20181130-16:12) is vulnerable to Cross Site Scripting (XSS). (CVSS 6.1)
- [CVE-2022-44236](https://cve.now/CVE-2022-44236.md): Beijing Zed-3 Technologies Co.,Ltd VoIP simpliclty ASG 8.5.0.17807 (20181130-16:12) has a Weak password vulnerability. (CVSS 9.8)
- [CVE-2022-4502](https://cve.now/CVE-2022-4502.md): Cross-site Scripting (XSS) - Reflected in openemr/openemr (CVSS 7.3, openemr/openemr)
- [CVE-2022-4503](https://cve.now/CVE-2022-4503.md): Cross-site Scripting (XSS) - Generic in openemr/openemr (CVSS 6.4, openemr/openemr)
- [CVE-2022-45033](https://cve.now/CVE-2022-45033.md): A cross-site scripting (XSS) vulnerability in Expense Tracker 1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted pa (CVSS 5.4)
- [CVE-2022-4504](https://cve.now/CVE-2022-4504.md): Improper Input Validation in openemr/openemr (CVSS 7.1, openemr/openemr)
- [CVE-2022-4505](https://cve.now/CVE-2022-4505.md): Authorization Bypass Through User-Controlled Key in openemr/openemr (CVSS 8.8, openemr/openemr)
- [CVE-2022-4506](https://cve.now/CVE-2022-4506.md): Unrestricted Upload of File with Dangerous Type in openemr/openemr (CVSS 7.6, openemr/openemr)
- [CVE-2022-4511](https://cve.now/CVE-2022-4511.md): RainyGao DocSys path traversal (CVSS 5.3, RainyGao DocSys)
- [CVE-2022-4513](https://cve.now/CVE-2022-4513.md): European Environment Agency eionet.contreg cross site scripting (CVSS 3.5, European Environment Agency eionet.contreg)
- [CVE-2022-4514](https://cve.now/CVE-2022-4514.md): Opencaching Deutschland oc-server3 varset.inc.php cross site scripting (CVSS 3.5, Opencaching Deutschland oc-server3)
- [CVE-2022-4520](https://cve.now/CVE-2022-4520.md): WSO2 carbon-registry Advanced Search advancedSearchForm-ajaxprocessor.jsp cross site scripting (CVSS 3.5, WSO2 carbon-registry · org.wso2.carbon.registry:carbon-regi…)
- [CVE-2022-4521](https://cve.now/CVE-2022-4521.md): WSO2 carbon-registry Request Parameter cross site scripting (CVSS 3.5, WSO2 carbon-registry · org.wso2.carbon.registry:carbon-regi…)
- [CVE-2022-4522](https://cve.now/CVE-2022-4522.md): CalendarXP cross site scripting (CVSS 3.5, CalendarXP)
- [CVE-2022-4523](https://cve.now/CVE-2022-4523.md): vexim2 cross site scripting (CVSS 3.5, vexim2)
- [CVE-2022-4524](https://cve.now/CVE-2022-4524.md): Roots soil Plugin CleanUpModule.php language\_attributes cross site scripting (CVSS 3.5, Roots soil Plugin · roots/soil)
- [CVE-2022-4525](https://cve.now/CVE-2022-4525.md): National Sleep Research Resource sleepdata.org cross site scripting (CVSS 3.5, National Sleep Research Resource sleepdata.org)
- [CVE-2022-4526](https://cve.now/CVE-2022-4526.md): django-photologue Default Template photo\_detail.html cross site scripting (CVSS 3.5, django-photologue)
- [CVE-2022-4527](https://cve.now/CVE-2022-4527.md): collective.task table.py AssignedGroupColumn cross site scripting (CVSS 3.5, collective.task · collective-task)
- [CVE-2022-45338](https://cve.now/CVE-2022-45338.md): An arbitrary file upload vulnerability in the profile picture upload function of Exact Synergy Enterprise 267 before 267SP13 and Exact Syner (CVSS 7.8)
- [CVE-2022-45969](https://cve.now/CVE-2022-45969.md): Alist v3.4.0 is vulnerable to Directory Traversal, (CVSS 9.8, github.com/alist-org/alist/v3 · github.com/alist-org/alist)
- [CVE-2022-46392](https://cve.now/CVE-2022-46392.md): An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. (CVSS 5.3)
- [CVE-2022-46393](https://cve.now/CVE-2022-46393.md): An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. (CVSS 9.8)
- [CVE-2022-46631](https://cve.now/CVE-2022-46631.md): TOTOlink A7100RU V7.4cu.2313\_B20191024 was discovered to contain a command injection vulnerability via the wscDisabled parameter in the sett (CVSS 9.8)
- [CVE-2022-46634](https://cve.now/CVE-2022-46634.md): TOTOlink A7100RU V7.4cu.2313\_B20191024 was discovered to contain a command injection vulnerability via the wscDisabled parameter in the sett (CVSS 9.8)
- [CVE-2022-46689](https://cve.now/CVE-2022-46689.md): A race condition was addressed with additional validation. (CVSS 7.0, Apple macOS · Apple tvOS +1)
- [CVE-2022-46690](https://cve.now/CVE-2022-46690.md): An out-of-bounds write issue was addressed with improved input validation. (CVSS 7.8, Apple tvOS · Apple watchOS)
- [CVE-2022-46691](https://cve.now/CVE-2022-46691.md): A memory consumption issue was addressed with improved memory handling. (CVSS 8.8, Apple tvOS · Apple watchOS)
- [CVE-2022-46692](https://cve.now/CVE-2022-46692.md): A logic issue was addressed with improved state management. (CVSS 5.5, Apple iCloud for Windows · Apple tvOS +1)
- [CVE-2022-46693](https://cve.now/CVE-2022-46693.md): An out-of-bounds write issue was addressed with improved input validation. (CVSS 7.8, Apple iCloud for Windows · Apple tvOS +1)
- [CVE-2022-46694](https://cve.now/CVE-2022-46694.md): An out-of-bounds write issue was addressed with improved input validation. (CVSS 7.8, Apple tvOS · Apple watchOS)
- [CVE-2022-46695](https://cve.now/CVE-2022-46695.md): A spoofing issue existed in the handling of URLs. (CVSS 6.5, Apple tvOS · Apple watchOS)
- [CVE-2022-46696](https://cve.now/CVE-2022-46696.md): A memory corruption issue was addressed with improved input validation. (CVSS 8.8, Apple tvOS · Apple watchOS)
- [CVE-2022-46697](https://cve.now/CVE-2022-46697.md): An out-of-bounds access issue was addressed with improved bounds checking. (CVSS 7.8, Apple macOS)
- [CVE-2022-46698](https://cve.now/CVE-2022-46698.md): A logic issue was addressed with improved checks. (CVSS 6.5, Apple iCloud for Windows · Apple tvOS +1)
- [CVE-2022-46699](https://cve.now/CVE-2022-46699.md): A memory corruption issue was addressed with improved state management. (CVSS 8.8, Apple tvOS · Apple watchOS)
- [CVE-2022-46700](https://cve.now/CVE-2022-46700.md): A memory corruption issue was addressed with improved input validation. (CVSS 8.8, Apple tvOS · Apple watchOS)
- [CVE-2022-46701](https://cve.now/CVE-2022-46701.md): The issue was addressed with improved bounds checks. (CVSS 7.8, Apple tvOS)
- [CVE-2022-46702](https://cve.now/CVE-2022-46702.md): The issue was addressed with improved memory handling. (CVSS 5.5, Apple iOS and iPadOS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-12-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.