# CVEs published 2022-12-18 36 CVEs were published on December 18, 2022: 0 critical, 8 high. Days are UTC. - [CVE-2020-36617](https://cve.now/CVE-2020-36617.md): ewxrjk sftpserver parse.c sftp\_parse\_path uninitialized pointer (CVSS 4.6, ewxrjk sftpserver) - [CVE-2021-4247](https://cve.now/CVE-2021-4247.md): OWASP NodeGoat Query Parameter research.js denial of service (CVSS 4.3, OWASP NodeGoat) - [CVE-2021-4248](https://cve.now/CVE-2021-4248.md): kapetan dns Request.cs entropy (CVSS 5.6, kapetan dns · DNS) - [CVE-2021-4249](https://cve.now/CVE-2021-4249.md): xml-conduit DOCTYPE Entity Expansion Parse.hs infinite loop (CVSS 4.3, xml-conduit) - [CVE-2021-4250](https://cve.now/CVE-2021-4250.md): cgriego active\_attr Regex boolean\_typecaster.rb call denial of service (CVSS 3.5, cgriego active\_attr · active\_attr) - [CVE-2021-4251](https://cve.now/CVE-2021-4251.md): as include.cdn.php getFullURL cross site scripting (CVSS 3.5, as) - [CVE-2021-4252](https://cve.now/CVE-2021-4252.md): WP-Ban ban-options.php toggle\_checkbox cross site scripting (CVSS 3.5, WP-Ban) - [CVE-2021-4253](https://cve.now/CVE-2021-4253.md): ctrlo lenio Ticket Lenio.pm cross site scripting (CVSS 3.5, ctrlo lenio) - [CVE-2021-4254](https://cve.now/CVE-2021-4254.md): ctrlo lenio Notice main.tt cross site scripting (CVSS 3.5, ctrlo lenio) - [CVE-2021-4255](https://cve.now/CVE-2021-4255.md): ctrlo lenio contractor.tt cross site scripting (CVSS 3.5, ctrlo lenio) - [CVE-2021-4256](https://cve.now/CVE-2021-4256.md): ctrlo lenio index.tt cross site scripting (CVSS 3.5, ctrlo lenio) - [CVE-2021-4257](https://cve.now/CVE-2021-4257.md): ctrlo lenio Task task.tt cross site scripting (CVSS 3.5, ctrlo lenio) - [CVE-2022-4592](https://cve.now/CVE-2022-4592.md): luckyshot CRMx index.php commentdelete sql injection (CVSS 6.3, luckyshot CRMx) - [CVE-2022-4593](https://cve.now/CVE-2022-4593.md): retra-system cross site scripting (CVSS 3.5, retra-system) - [CVE-2022-4594](https://cve.now/CVE-2022-4594.md): drogatkin TJWS2 WarRoller.java deployWar path traversal (CVSS 6.3, drogatkin TJWS2) - [CVE-2022-4595](https://cve.now/CVE-2022-4595.md): django-openipam exposed\_hosts.html cross site scripting (CVSS 3.5, django-openipam) - [CVE-2022-4596](https://cve.now/CVE-2022-4596.md): Shoplazza Add Blog Post cross site scripting (CVSS 3.5, Shoplazza) - [CVE-2022-4597](https://cve.now/CVE-2022-4597.md): Shoplazza LifeStyle Create Product v2\_products cross site scripting (CVSS 3.5, Shoplazza LifeStyle) - [CVE-2022-4598](https://cve.now/CVE-2022-4598.md): Shoplazza LifeStyle Announcement cross site scripting (CVSS 3.5, Shoplazza LifeStyle) - [CVE-2022-4599](https://cve.now/CVE-2022-4599.md): Shoplazza LifeStyle Product cross site scripting (CVSS 3.5, Shoplazza LifeStyle) - [CVE-2022-4600](https://cve.now/CVE-2022-4600.md): Shoplazza LifeStyle Product Carousel cross site scripting (CVSS 3.5, Shoplazza LifeStyle) - [CVE-2022-4601](https://cve.now/CVE-2022-4601.md): Shoplazza LifeStyle Shipping/Member Discount/Icon cross site scripting (CVSS 3.5, Shoplazza LifeStyle) - [CVE-2022-4602](https://cve.now/CVE-2022-4602.md): Shoplazza LifeStyle Review Flow cross site scripting (CVSS 3.5, Shoplazza LifeStyle) - [CVE-2022-4603](https://cve.now/CVE-2022-4603.md): ppp pppdump pppdump.c dumpppp array index (CVSS 4.3, ppp) - [CVE-2022-4604](https://cve.now/CVE-2022-4604.md): wp-english-wp-admin Plugin english-wp-admin.php register\_endpoints cross-site request forgery (CVSS 4.3, wp-english-wp-admin Plugin) - [CVE-2022-4605](https://cve.now/CVE-2022-4605.md): Cross-site Scripting (XSS) - Stored in flatpressblog/flatpress (CVSS 6.0, flatpressblog/flatpress) - [CVE-2022-4606](https://cve.now/CVE-2022-4606.md): PHP Remote File Inclusion in flatpressblog/flatpress (CVSS 8.8, flatpressblog/flatpress) - [CVE-2022-4607](https://cve.now/CVE-2022-4607.md): 3D City Database OGC Web Feature Service xml external entity reference (CVSS 5.5, 3D City Database OGC Web Feature Service) - [CVE-2022-47514](https://cve.now/CVE-2022-47514.md): An XML external entity (XXE) injection vulnerability in XML-RPC.NET before 2.5.0 allows remote authenticated users to conduct server-side re (no CVSS) - [CVE-2022-47515](https://cve.now/CVE-2022-47515.md): An issue was discovered in drachtio-server before 0.8.20. (CVSS 7.5) - [CVE-2022-47516](https://cve.now/CVE-2022-47516.md): An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.20. (CVSS 7.5) - [CVE-2022-47517](https://cve.now/CVE-2022-47517.md): An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.19. (CVSS 7.5) - [CVE-2022-47518](https://cve.now/CVE-2022-47518.md): An issue was discovered in the Linux kernel before 6.0.11. (CVSS 7.8) - [CVE-2022-47519](https://cve.now/CVE-2022-47519.md): An issue was discovered in the Linux kernel before 6.0.11. (CVSS 7.8) - [CVE-2022-47520](https://cve.now/CVE-2022-47520.md): An issue was discovered in the Linux kernel before 6.0.11. (CVSS 7.1) - [CVE-2022-47521](https://cve.now/CVE-2022-47521.md): An issue was discovered in the Linux kernel before 6.0.11. (CVSS 7.8) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2022-12-18 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.