CVEs published December 19, 2022
104 CVEs were published on December 19, 2022: 13 critical, 18 high.
- Published
- 104
- Critical
- 13
- High
- 18
- Medium
- 66
- Low
- 4
- Unrated
- 3
- Now in CISA KEV
- 0
- Fix available
- 30
Most affected products
- Adobe Experience Manager
- 10
- Click Studios Passwordstate
- 7
- lansweeper
- 6
- Adobe Illustrator
- 4
- IBM Cognos Analytics
- 4
- Apache Software Foundation Apache Traffic Server
- 3
- Japan Construction Information Center DENSHI NYUSATSU CORE…
- 3
- Autodesk Maya
- 2
- HCL Software BigFix Insights for Vulnerability Remediation
- 2
- Popup Manager
- 2
Critical 13
- CVE-2022-4050JoomSport < 5.2.8 - Unauthenticated SQLiJoomSport
- CVE-2022-4063InPost Gallery < 2.1.4.1 - Unauthenticated LFI to RCEInPost Gallery
- CVE-2022-27498A directory traversal vulnerability exists in the TicketTemplateActions.aspx GetTemplateAttachment functionality of Lansweeper lansweeper 10lansweeper
- CVE-2022-28703A stored cross-site scripting vulnerability exists in the HdConfigActions.aspx altertextlanguages functionality of Lansweeper lansweeper 10.lansweeper
- CVE-2022-29511A directory traversal vulnerability exists in the KnowledgebasePageActions.aspx ImportArticles functionality of Lansweeper lansweeper 10.1.1lansweeper
- CVE-2022-29517A directory traversal vulnerability exists in the HelpdeskActions.aspx edittemplate functionality of Lansweeper lansweeper 10.1.1.0.lansweeper
- CVE-2022-32573A directory traversal vulnerability exists in the AssetActions.aspx addDoc functionality of Lansweeper lansweeper 10.1.1.0.lansweeper
- CVE-2022-32763A cross-site scripting (xss) sanitization vulnerability bypass exists in the SanitizeHtml functionality of Lansweeper lansweeper 10.1.1.0.lansweeper
- CVE-2022-40434Softr v2.0 was discovered to be vulnerable to HTML injection via the Name field of the Account page.
- CVE-2022-44108pdftojson commit 94204bb was discovered to contain a stack overflow via the component Object::copy(Object*):Object.cc.
- CVE-2022-44109pdftojson commit 94204bb was discovered to contain a stack overflow via the component Stream::makeFilter(char*, Stream*, Object*, int).
- CVE-2022-44456CONPROSYS HMI System (CHS) Ver.3.4.4?and earlier allows a remote unauthenticated attacker to execute an arbitrary OS command on the server wContec Co. CONPROSYS HMI System
- CVE-2022-44940Patchelf v0.9 was discovered to contain an out-of-bounds read via the function modifyRPath at src/patchelf.cc.patchelf · pypatchelf
High 18
- CVE-2022-3752Rockwell Automation GuardLogix and ControlLogix controllers Vulnerable to Denial-Of-Service AttackRockwell Automation CompactLogix · Rockwell Automation C… +2
- CVE-2022-4106Wholesale Market for WooCommerce < 1.0.7 - Unauthenticated Arbitrary File DownloadWholesale Market for WooCommerce
- CVE-2022-4061JobBoardWP < 1.2.2 - Unauthenticated Arbitrary File UploadJobBoardWP
- CVE-2022-32749Apache Traffic Server: Improperly handled requests can cause crashes in specific pluginsApache Software Foundation Apache Traffic Server
- CVE-2022-41992A memory corruption vulnerability exists in the VHD File Format parsing CXSPARSE record functionality of PowerISO PowerISO 8.3.PowerISO
- CVE-2022-3775When rendering certain unicode sequences, grub2's font code doesn't proper validate if the informed glyph's width and height is constrained grub2
- CVE-2022-3875Click Studios Passwordstate API authentication bypass by assumed-immutable dataClick Studios Passwordstate
- CVE-2022-41418An issue in the component BlogEngine/BlogEngine.NET/AppCode/Api/UploadController.cs of BlogEngine.NET v3.3.8.0 allows attackers to execute a
- CVE-2022-42945DWG TrueViewTM 2023 version has a DLL Search Order Hijacking vulnerability.DWG TrueView
- CVE-2022-42946Parsing a maliciously crafted X_B and PRT file can force Autodesk Maya 2023 and 2022 to read beyond allocated buffer.Autodesk Maya
- CVE-2022-42947A maliciously crafted X_B file when parsed through Autodesk Maya 2023 and 2022 can be used to write beyond the allocated buffer.Autodesk Maya
- CVE-2022-43289Deark v.1.6.2 was discovered to contain a stack overflow via the do_prism_read_palette() function at /modules/atari-img.c.
- CVE-2022-43443OS command injection vulnerability in Buffalo network devices allows an network-adjacent attacker to execute an arbitrary OS command if a spBUFFALO WXR-11000XE12 · BUFFALO WXR-5700AX7S +15
- CVE-2022-45041SQL Injection exits in xinhu < 2.5.0
- CVE-2022-4609Cross-site Scripting (XSS) - Stored in usememos/memosusememos/memos · github.com/usememos/memos
- CVE-2022-4615Cross-site Scripting (XSS) - Reflected in openemr/openemropenemr/openemr
- CVE-2022-46399The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) is unresponsive with ConReqTimeoutZer
- CVE-2022-46403The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) mishandles reject messages.
Medium, low and unrated 73
- CVE-2022-23543HTML attributes when attaching a YouTube link to the postmesosoi silverwaregames-io-issue-tracker
- CVE-2022-44756HCL BigFix Insights for Vulnerability Remediation (IVR) is vulnerable to improper input validationHCL Software BigFix Insights for Vulnerability Remediation
- CVE-2022-23536Alertmanager can expose local files content via specially crafted configcortexproject cortex · github.com/cortexproject/cortex
- CVE-2022-42454HCL BigFix Insights for Vulnerability Remediation (IVR) is vulnerable to improper certificate validationHCL Software BigFix Insights for Vulnerability Remediation
- CVE-2022-39160IBM Cognos Analytics cross-site scriptingIBM Cognos Analytics
- CVE-2022-43883IBM Cognos Analytics data manipulationIBM Cognos Analytics
- CVE-2022-43887IBM Cognos Analytics information disclosureIBM Cognos Analytics
- CVE-2022-38708IBM Cognos Analytics server-side request forgeryIBM Cognos Analytics
- CVE-2022-40607IBM Spectrum Scale directory traversalIBM Spectrum Scale
- CVE-2022-4125Popup Manager <= 1.6.6 - Unauthenticated Stored XSSPopup Manager
- CVE-2022-4107SMSA Shipping for WooCommerce < 1.0.5 - Subscriber+ Arbitrary File DownloadSMSA Shipping for WooCommerce
- CVE-2022-4124Popup Manager <= 1.6.6 - Unauthenticated Arbitrary Popup DeletionPopup Manager
- CVE-2022-3987Responsive Lightbox2 < 1.0.4 - Contributor+ Stored XSSResponsive Lightbox2
- CVE-2022-3984Flowplayer Video Player < 1.0.5 - Contributor+ Stored XSSFlowplayer Video Player
- CVE-2022-4112Quizlord <= 2.0 - Admin+ Stored XSSQuizlord
- CVE-2022-3961Directorist < 7.4.4 - Subscriber+ Sensitive Information DisclosureDirectorist
- CVE-2022-4108Wholesale Market for WooCommerce < 1.0.8 - Admin+ Arbitrary File DownloadWholesale Market for WooCommerce
- CVE-2022-4058Photo Gallery < 1.8.3 - Stored XSS via CSRFPhoto Gallery by 10Web
- CVE-2022-3983Checkout for PayPal < 1.0.14 - Contributor+ Stored XSSCheckout for PayPal
- CVE-2022-3937Easy Video Player < 1.2.2.3 - Contributor+ Stored XSSEasy Video Player
- CVE-2022-3985Videojs HTML5 Player < 1.1.9 - Contributor+ Stored XSSVideojs HTML5 Player
- CVE-2022-4024Pie Register < 3.8.1.3 - Unauthenticated Arbitrary User DeletionRegistration Forms
- CVE-2022-3832External Media < 1.0.36 - Admin+ Stored XSSExternal Media
- CVE-2022-3986WP Stripe Checkout < 1.2.2.21 - Contributor+ Stored XSSWP Stripe Checkout
- CVE-2022-40743Apache Traffic Server: Security issues with the xdebug pluginApache Software Foundation Apache Traffic Server
- CVE-2022-37392Apache Traffic Server: Improperly reading the client requestsApache Software Foundation Apache Traffic Server
- CVE-2022-47500Apache Helix: Open redirectApache Software Foundation Apache Helix · org.apache.helix:…
- CVE-2022-42366AEM Reflected XSS Arbitrary code executionAdobe Experience Manager
- CVE-2022-42367AEM Reflected XSS Arbitrary code executionAdobe Experience Manager
- CVE-2022-44468AEM Reflected XSS Arbitrary code executionAdobe Experience Manager
- CVE-2022-44469AEM Reflected XSS Arbitrary code executionAdobe Experience Manager
- CVE-2022-44473AEM Reflected XSS Arbitrary code executionAdobe Experience Manager
- CVE-2022-35694AEM Reflected XSS Arbitrary code executionAdobe Experience Manager
- CVE-2022-35696AEM Reflected XSS Arbitrary code executionAdobe Experience Manager
- CVE-2022-42343Adobe Campaign Classic Server-Side Request Forgery Arbitrary file system readAdobe Campaign Classic
- CVE-2022-42351AEM Incorrect Authorization Security feature bypassAdobe Experience Manager
- CVE-2022-42360AEM Reflected XSS Arbitrary code executionAdobe Experience Manager
- CVE-2022-44462AEM Reflected XSS Arbitrary code executionAdobe Experience Manager
- CVE-2022-44498Adobe Illustrator Out-of-Bound Read Memory leakAdobe Illustrator
- CVE-2022-44499Adobe Illustrator Out-of-Bound Read Memory leakAdobe Illustrator
- CVE-2022-44500Adobe Illustrator Out-of-Bound Read Memory leakAdobe Illustrator
- CVE-2022-44502Adobe Illustrator Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Illustrator
- CVE-2022-46768File name information disclosure vulnerability in Zabbix Web Service Report GenerationZabbix Web Service Report Generation · Zabbix agent
- CVE-2022-4427SQL Injection via OTRS Search APIOTRS AG OTRS · OTRS AG ((OTRS)) Community Edition
- CVE-2016-20018Knex Knex.js through 2.3.0 has a limited SQL injection vulnerability that can be exploited to ignore the WHERE clause of a SQL query.knex
- CVE-2020-36618Furqan node-whois index.coffee prototype pollutionFurqan node-whois · whois
- CVE-2020-36619multimon-ng demod_flex.c add_ch format stringmultimon-ng
- CVE-2021-33640After tar_close(), libtar.c releases the memory pointed to by pointer t.openEuler 22.03 LTS · openEuler 20.03 LTS SP1 +1
- CVE-2021-4258whohas Package Information cleartext transmissionwhohas
- CVE-2021-4259phpRedisAdmin login.inc.php authHttpDigest wrong operator in string comparisonphpRedisAdmin
- CVE-2021-4260oils-js Web.js redirectoils-js · oils
- CVE-2021-4261pacman-canvas db-handler.php addHighscore sql injectionpacman-canvas
- CVE-2021-4262laravel-jqgrid EloquentRepositoryAbstract.php getRows sql injectionlaravel-jqgrid · mgallegos/laravel-jqgrid
- CVE-2022-31683Concourse (7.x.y prior to 7.8.3 and 6.x.y prior to 6.7.9) contains an authorization bypass issue.Concourse · github.com/concourse/concourse
- CVE-2022-3876Click Studios Passwordstate API authorizationClick Studios Passwordstate
- CVE-2022-3877Click Studios Passwordstate URL Field cross site scriptingClick Studios Passwordstate
- CVE-2022-40435Employee Performance Evaluation System v1.0 was discovered to contain a persistent cross-site scripting (XSS) vulnerability via adding new e
- CVE-2022-41993Cross-site scripting vulnerability in DENSHI NYUSATSU CORE SYSTEM v6 R4 and earlier allows a remote unauthenticated attacker to inject an arJapan Construction Information Center DENSHI NYUSATSU CORE…
- CVE-2022-43466OS command injection vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to executeBUFFALO WXR-5700AX7S · BUFFALO WXR-5700AX7B +11
- CVE-2022-43486Hidden functionality vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to enable BUFFALO WXR-5700AX7S · BUFFALO WXR-5700AX7B +14
- CVE-2022-4610Click Studios Passwordstate risky encryptionClick Studios Passwordstate
- CVE-2022-4611Click Studios Passwordstate hard-coded credentialsClick Studios Passwordstate
- CVE-2022-4612Click Studios Passwordstate insufficiently protected credentialsClick Studios Passwordstate
- CVE-2022-4613Click Studios Passwordstate Browser Extension Provisioning improper authorizationClick Studios Passwordstate
- CVE-2022-4614Cross-site Scripting (XSS) - Stored in alagrede/znote-appalagrede/znote-app
- CVE-2022-46287Cross-site scripting vulnerability in DENSHI NYUSATSU CORE SYSTEM v6 R4 and earlier allows a remote unauthenticated attacker to inject an arJapan Construction Information Center DENSHI NYUSATSU CORE…
- CVE-2022-46288Open redirect vulnerability in DENSHI NYUSATSU CORE SYSTEM v6 R4 and earlier allows a remote unauthenticated attacker to redirect a user to Japan Construction Information Center DENSHI NYUSATSU CORE…
- CVE-2022-46400The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) allows attackers to bypass passkey en
- CVE-2022-46401The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) accepts PauseEncReqPlainText before p
- CVE-2022-46402The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) accepts PairCon_rmSend with incorrect
- CVE-2022-47547GossipSub 1.1, as used for Ethereum 2.0, allows a peer to maintain a positive score (and thus not be pruned from the network) even though it
- CVE-2022-47549An unprotected memory-access operation in optee_os in TrustedFirmware Open Portable Trusted Execution Environment (OP-TEE) before 3.20 allow
- CVE-2022-47551Apiman 1.5.7 through 2.2.3.Final has insufficient checks for read permissions within the Apiman Manager REST API.io.apiman:apiman-manager-api-rest-impl