# CVEs published 2022-12-19

104 CVEs were published on December 19, 2022: 13 critical, 18 high. Days are UTC.

- [CVE-2022-3752](https://cve.now/CVE-2022-3752.md): Rockwell Automation GuardLogix and ControlLogix controllers Vulnerable to Denial-Of-Service Attack (CVSS 8.6, Rockwell Automation CompactLogix · Rockwell Automation C… +2)
- [CVE-2022-23543](https://cve.now/CVE-2022-23543.md): HTML attributes when attaching a YouTube link to the post (CVSS 6.3, mesosoi silverwaregames-io-issue-tracker)
- [CVE-2022-44756](https://cve.now/CVE-2022-44756.md): HCL BigFix Insights for Vulnerability Remediation (IVR) is vulnerable to improper input validation (CVSS 6.4, HCL Software BigFix Insights for Vulnerability Remediation)
- [CVE-2022-23536](https://cve.now/CVE-2022-23536.md): Alertmanager can expose local files content via specially crafted config (CVSS 6.5, cortexproject cortex · github.com/cortexproject/cortex)
- [CVE-2022-42454](https://cve.now/CVE-2022-42454.md): HCL BigFix Insights for Vulnerability Remediation (IVR) is vulnerable to improper certificate validation (CVSS 6.4, HCL Software BigFix Insights for Vulnerability Remediation)
- [CVE-2022-39160](https://cve.now/CVE-2022-39160.md): IBM Cognos Analytics cross-site scripting (CVSS 6.1, IBM Cognos Analytics)
- [CVE-2022-43883](https://cve.now/CVE-2022-43883.md): IBM Cognos Analytics data manipulation (CVSS 6.5, IBM Cognos Analytics)
- [CVE-2022-43887](https://cve.now/CVE-2022-43887.md): IBM Cognos Analytics information disclosure (CVSS 5.3, IBM Cognos Analytics)
- [CVE-2022-38708](https://cve.now/CVE-2022-38708.md): IBM Cognos Analytics server-side request forgery (CVSS 6.5, IBM Cognos Analytics)
- [CVE-2022-40607](https://cve.now/CVE-2022-40607.md): IBM Spectrum Scale directory traversal (CVSS 6.8, IBM Spectrum Scale)
- [CVE-2022-4050](https://cve.now/CVE-2022-4050.md): JoomSport \< 5.2.8 - Unauthenticated SQLi (CVSS 9.8, JoomSport)
- [CVE-2022-4106](https://cve.now/CVE-2022-4106.md): Wholesale Market for WooCommerce \< 1.0.7 - Unauthenticated Arbitrary File Download (CVSS 7.5, Wholesale Market for WooCommerce)
- [CVE-2022-4125](https://cve.now/CVE-2022-4125.md): Popup Manager \<= 1.6.6 - Unauthenticated Stored XSS (no CVSS, Popup Manager)
- [CVE-2022-4107](https://cve.now/CVE-2022-4107.md): SMSA Shipping for WooCommerce \< 1.0.5 - Subscriber+ Arbitrary File Download (CVSS 6.5, SMSA Shipping for WooCommerce)
- [CVE-2022-4124](https://cve.now/CVE-2022-4124.md): Popup Manager \<= 1.6.6 - Unauthenticated Arbitrary Popup Deletion (CVSS 4.3, Popup Manager)
- [CVE-2022-3987](https://cve.now/CVE-2022-3987.md): Responsive Lightbox2 \< 1.0.4 - Contributor+ Stored XSS (CVSS 5.4, Responsive Lightbox2)
- [CVE-2022-3984](https://cve.now/CVE-2022-3984.md): Flowplayer Video Player \< 1.0.5 - Contributor+ Stored XSS (CVSS 5.4, Flowplayer Video Player)
- [CVE-2022-4112](https://cve.now/CVE-2022-4112.md): Quizlord \<= 2.0 - Admin+ Stored XSS (CVSS 4.8, Quizlord)
- [CVE-2022-3961](https://cve.now/CVE-2022-3961.md): Directorist \< 7.4.4 - Subscriber+ Sensitive Information Disclosure (CVSS 6.5, Directorist)
- [CVE-2022-4108](https://cve.now/CVE-2022-4108.md): Wholesale Market for WooCommerce \< 1.0.8 - Admin+ Arbitrary File Download (CVSS 4.9, Wholesale Market for WooCommerce)
- [CVE-2022-4058](https://cve.now/CVE-2022-4058.md): Photo Gallery \< 1.8.3 - Stored XSS via CSRF (no CVSS, Photo Gallery by 10Web)
- [CVE-2022-3983](https://cve.now/CVE-2022-3983.md): Checkout for PayPal \< 1.0.14 - Contributor+ Stored XSS (CVSS 5.4, Checkout for PayPal)
- [CVE-2022-4061](https://cve.now/CVE-2022-4061.md): JobBoardWP \< 1.2.2 - Unauthenticated Arbitrary File Upload (CVSS 7.5, JobBoardWP)
- [CVE-2022-3937](https://cve.now/CVE-2022-3937.md): Easy Video Player \< 1.2.2.3 - Contributor+ Stored XSS (CVSS 5.4, Easy Video Player)
- [CVE-2022-3985](https://cve.now/CVE-2022-3985.md): Videojs HTML5 Player \< 1.1.9 - Contributor+ Stored XSS (CVSS 5.4, Videojs HTML5 Player)
- [CVE-2022-4024](https://cve.now/CVE-2022-4024.md): Pie Register \< 3.8.1.3 - Unauthenticated Arbitrary User Deletion (CVSS 6.5, Registration Forms)
- [CVE-2022-3832](https://cve.now/CVE-2022-3832.md): External Media \< 1.0.36 - Admin+ Stored XSS (CVSS 4.8, External Media)
- [CVE-2022-3986](https://cve.now/CVE-2022-3986.md): WP Stripe Checkout \< 1.2.2.21 - Contributor+ Stored XSS (CVSS 5.4, WP Stripe Checkout)
- [CVE-2022-4063](https://cve.now/CVE-2022-4063.md): InPost Gallery \< 2.1.4.1 - Unauthenticated LFI to RCE (CVSS 9.8, InPost Gallery)
- [CVE-2022-40743](https://cve.now/CVE-2022-40743.md): Apache Traffic Server: Security issues with the xdebug plugin (CVSS 6.1, Apache Software Foundation Apache Traffic Server)
- [CVE-2022-37392](https://cve.now/CVE-2022-37392.md): Apache Traffic Server: Improperly reading the client requests (CVSS 5.3, Apache Software Foundation Apache Traffic Server)
- [CVE-2022-32749](https://cve.now/CVE-2022-32749.md): Apache Traffic Server: Improperly handled requests can cause crashes in specific plugins (CVSS 7.5, Apache Software Foundation Apache Traffic Server)
- [CVE-2022-47500](https://cve.now/CVE-2022-47500.md): Apache Helix: Open redirect (CVSS 6.1, Apache Software Foundation Apache Helix · org.apache.helix:…)
- [CVE-2022-41992](https://cve.now/CVE-2022-41992.md): A memory corruption vulnerability exists in the VHD File Format parsing CXSPARSE record functionality of PowerISO PowerISO 8.3. (CVSS 7.8, PowerISO)
- [CVE-2022-42366](https://cve.now/CVE-2022-42366.md): AEM Reflected XSS Arbitrary code execution (CVSS 5.4, Adobe Experience Manager)
- [CVE-2022-42367](https://cve.now/CVE-2022-42367.md): AEM Reflected XSS Arbitrary code execution (CVSS 5.4, Adobe Experience Manager)
- [CVE-2022-44468](https://cve.now/CVE-2022-44468.md): AEM Reflected XSS Arbitrary code execution (CVSS 5.4, Adobe Experience Manager)
- [CVE-2022-44469](https://cve.now/CVE-2022-44469.md): AEM Reflected XSS Arbitrary code execution (CVSS 5.4, Adobe Experience Manager)
- [CVE-2022-44473](https://cve.now/CVE-2022-44473.md): AEM Reflected XSS Arbitrary code execution (CVSS 5.4, Adobe Experience Manager)
- [CVE-2022-27498](https://cve.now/CVE-2022-27498.md): A directory traversal vulnerability exists in the TicketTemplateActions.aspx GetTemplateAttachment functionality of Lansweeper lansweeper 10 (CVSS 9.1, lansweeper)
- [CVE-2022-28703](https://cve.now/CVE-2022-28703.md): A stored cross-site scripting vulnerability exists in the HdConfigActions.aspx altertextlanguages functionality of Lansweeper lansweeper 10. (CVSS 9.1, lansweeper)
- [CVE-2022-29511](https://cve.now/CVE-2022-29511.md): A directory traversal vulnerability exists in the KnowledgebasePageActions.aspx ImportArticles functionality of Lansweeper lansweeper 10.1.1 (CVSS 9.1, lansweeper)
- [CVE-2022-29517](https://cve.now/CVE-2022-29517.md): A directory traversal vulnerability exists in the HelpdeskActions.aspx edittemplate functionality of Lansweeper lansweeper 10.1.1.0. (CVSS 9.9, lansweeper)
- [CVE-2022-32573](https://cve.now/CVE-2022-32573.md): A directory traversal vulnerability exists in the AssetActions.aspx addDoc functionality of Lansweeper lansweeper 10.1.1.0. (CVSS 9.9, lansweeper)
- [CVE-2022-32763](https://cve.now/CVE-2022-32763.md): A cross-site scripting (xss) sanitization vulnerability bypass exists in the SanitizeHtml functionality of Lansweeper lansweeper 10.1.1.0. (CVSS 9.1, lansweeper)
- [CVE-2022-35694](https://cve.now/CVE-2022-35694.md): AEM Reflected XSS Arbitrary code execution (CVSS 5.4, Adobe Experience Manager)
- [CVE-2022-35696](https://cve.now/CVE-2022-35696.md): AEM Reflected XSS Arbitrary code execution (CVSS 5.4, Adobe Experience Manager)
- [CVE-2022-42343](https://cve.now/CVE-2022-42343.md): Adobe Campaign Classic Server-Side Request Forgery Arbitrary file system read (CVSS 6.5, Adobe Campaign Classic)
- [CVE-2022-42351](https://cve.now/CVE-2022-42351.md): AEM Incorrect Authorization Security feature bypass (CVSS 4.3, Adobe Experience Manager)
- [CVE-2022-42360](https://cve.now/CVE-2022-42360.md): AEM Reflected XSS Arbitrary code execution (CVSS 5.4, Adobe Experience Manager)
- [CVE-2022-44462](https://cve.now/CVE-2022-44462.md): AEM Reflected XSS Arbitrary code execution (CVSS 5.4, Adobe Experience Manager)
- [CVE-2022-44498](https://cve.now/CVE-2022-44498.md): Adobe Illustrator Out-of-Bound Read Memory leak (CVSS 5.5, Adobe Illustrator)
- [CVE-2022-44499](https://cve.now/CVE-2022-44499.md): Adobe Illustrator Out-of-Bound Read Memory leak (CVSS 5.5, Adobe Illustrator)
- [CVE-2022-44500](https://cve.now/CVE-2022-44500.md): Adobe Illustrator Out-of-Bound Read Memory leak (CVSS 5.5, Adobe Illustrator)
- [CVE-2022-44502](https://cve.now/CVE-2022-44502.md): Adobe Illustrator Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Illustrator)
- [CVE-2022-46768](https://cve.now/CVE-2022-46768.md): File name information disclosure vulnerability in Zabbix Web Service Report Generation (CVSS 5.9, Zabbix Web Service Report Generation · Zabbix agent)
- [CVE-2022-4427](https://cve.now/CVE-2022-4427.md): SQL Injection via OTRS Search API (CVSS 6.5, OTRS AG OTRS · OTRS AG ((OTRS)) Community Edition)
- [CVE-2016-20018](https://cve.now/CVE-2016-20018.md): Knex Knex.js through 2.3.0 has a limited SQL injection vulnerability that can be exploited to ignore the WHERE clause of a SQL query. (no CVSS, knex)
- [CVE-2020-36618](https://cve.now/CVE-2020-36618.md): Furqan node-whois index.coffee prototype pollution (CVSS 6.3, Furqan node-whois · whois)
- [CVE-2020-36619](https://cve.now/CVE-2020-36619.md): multimon-ng demod\_flex.c add\_ch format string (CVSS 5.5, multimon-ng)
- [CVE-2021-33640](https://cve.now/CVE-2021-33640.md): After tar\_close(), libtar.c releases the memory pointed to by pointer t. (CVSS 6.2, openEuler 22.03 LTS · openEuler 20.03 LTS SP1 +1)
- [CVE-2021-4258](https://cve.now/CVE-2021-4258.md): whohas Package Information cleartext transmission (CVSS 3.7, whohas)
- [CVE-2021-4259](https://cve.now/CVE-2021-4259.md): phpRedisAdmin login.inc.php authHttpDigest wrong operator in string comparison (CVSS 5.0, phpRedisAdmin)
- [CVE-2021-4260](https://cve.now/CVE-2021-4260.md): oils-js Web.js redirect (CVSS 6.3, oils-js · oils)
- [CVE-2021-4261](https://cve.now/CVE-2021-4261.md): pacman-canvas db-handler.php addHighscore sql injection (CVSS 6.3, pacman-canvas)
- [CVE-2021-4262](https://cve.now/CVE-2021-4262.md): laravel-jqgrid EloquentRepositoryAbstract.php getRows sql injection (CVSS 5.5, laravel-jqgrid · mgallegos/laravel-jqgrid)
- [CVE-2022-31683](https://cve.now/CVE-2022-31683.md): Concourse (7.x.y prior to 7.8.3 and 6.x.y prior to 6.7.9) contains an authorization bypass issue. (CVSS 5.4, Concourse · github.com/concourse/concourse)
- [CVE-2022-3775](https://cve.now/CVE-2022-3775.md): When rendering certain unicode sequences, grub2's font code doesn't proper validate if the informed glyph's width and height is constrained (CVSS 7.1, grub2)
- [CVE-2022-3875](https://cve.now/CVE-2022-3875.md): Click Studios Passwordstate API authentication bypass by assumed-immutable data (CVSS 7.3, Click Studios Passwordstate)
- [CVE-2022-3876](https://cve.now/CVE-2022-3876.md): Click Studios Passwordstate API authorization (CVSS 4.3, Click Studios Passwordstate)
- [CVE-2022-3877](https://cve.now/CVE-2022-3877.md): Click Studios Passwordstate URL Field cross site scripting (CVSS 3.5, Click Studios Passwordstate)
- [CVE-2022-40434](https://cve.now/CVE-2022-40434.md): Softr v2.0 was discovered to be vulnerable to HTML injection via the Name field of the Account page. (CVSS 9.8)
- [CVE-2022-40435](https://cve.now/CVE-2022-40435.md): Employee Performance Evaluation System v1.0 was discovered to contain a persistent cross-site scripting (XSS) vulnerability via adding new e (CVSS 4.8)
- [CVE-2022-41418](https://cve.now/CVE-2022-41418.md): An issue in the component BlogEngine/BlogEngine.NET/AppCode/Api/UploadController.cs of BlogEngine.NET v3.3.8.0 allows attackers to execute a (CVSS 7.2)
- [CVE-2022-41993](https://cve.now/CVE-2022-41993.md): Cross-site scripting vulnerability in DENSHI NYUSATSU CORE SYSTEM v6 R4 and earlier allows a remote unauthenticated attacker to inject an ar (CVSS 6.1, Japan Construction Information Center DENSHI NYUSATSU CORE…)
- [CVE-2022-42945](https://cve.now/CVE-2022-42945.md): DWG TrueViewTM 2023 version has a DLL Search Order Hijacking vulnerability. (CVSS 7.8, DWG TrueView)
- [CVE-2022-42946](https://cve.now/CVE-2022-42946.md): Parsing a maliciously crafted X\_B and PRT file can force Autodesk Maya 2023 and 2022 to read beyond allocated buffer. (CVSS 7.1, Autodesk Maya)
- [CVE-2022-42947](https://cve.now/CVE-2022-42947.md): A maliciously crafted X\_B file when parsed through Autodesk Maya 2023 and 2022 can be used to write beyond the allocated buffer. (CVSS 7.8, Autodesk Maya)
- [CVE-2022-43289](https://cve.now/CVE-2022-43289.md): Deark v.1.6.2 was discovered to contain a stack overflow via the do\_prism\_read\_palette() function at /modules/atari-img.c. (CVSS 7.8)
- [CVE-2022-43443](https://cve.now/CVE-2022-43443.md): OS command injection vulnerability in Buffalo network devices allows an network-adjacent attacker to execute an arbitrary OS command if a sp (CVSS 8.0, BUFFALO WXR-11000XE12 · BUFFALO WXR-5700AX7S +15)
- [CVE-2022-43466](https://cve.now/CVE-2022-43466.md): OS command injection vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to execute (CVSS 6.8, BUFFALO WXR-5700AX7S · BUFFALO WXR-5700AX7B +11)
- [CVE-2022-43486](https://cve.now/CVE-2022-43486.md): Hidden functionality vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to enable (CVSS 6.8, BUFFALO WXR-5700AX7S · BUFFALO WXR-5700AX7B +14)
- [CVE-2022-44108](https://cve.now/CVE-2022-44108.md): pdftojson commit 94204bb was discovered to contain a stack overflow via the component Object::copy(Object\*):Object.cc. (CVSS 9.8)
- [CVE-2022-44109](https://cve.now/CVE-2022-44109.md): pdftojson commit 94204bb was discovered to contain a stack overflow via the component Stream::makeFilter(char\*, Stream\*, Object\*, int). (CVSS 9.8)
- [CVE-2022-44456](https://cve.now/CVE-2022-44456.md): CONPROSYS HMI System (CHS) Ver.3.4.4?and earlier allows a remote unauthenticated attacker to execute an arbitrary OS command on the server w (CVSS 9.8, Contec Co. CONPROSYS HMI System)
- [CVE-2022-44940](https://cve.now/CVE-2022-44940.md): Patchelf v0.9 was discovered to contain an out-of-bounds read via the function modifyRPath at src/patchelf.cc. (CVSS 9.1, patchelf · pypatchelf)
- [CVE-2022-45041](https://cve.now/CVE-2022-45041.md): SQL Injection exits in xinhu \< 2.5.0 (CVSS 7.5)
- [CVE-2022-4609](https://cve.now/CVE-2022-4609.md): Cross-site Scripting (XSS) - Stored in usememos/memos (CVSS 7.6, usememos/memos · github.com/usememos/memos)
- [CVE-2022-4610](https://cve.now/CVE-2022-4610.md): Click Studios Passwordstate risky encryption (CVSS 1.9, Click Studios Passwordstate)
- [CVE-2022-4611](https://cve.now/CVE-2022-4611.md): Click Studios Passwordstate hard-coded credentials (CVSS 4.3, Click Studios Passwordstate)
- [CVE-2022-4612](https://cve.now/CVE-2022-4612.md): Click Studios Passwordstate insufficiently protected credentials (CVSS 4.3, Click Studios Passwordstate)
- [CVE-2022-4613](https://cve.now/CVE-2022-4613.md): Click Studios Passwordstate Browser Extension Provisioning improper authorization (CVSS 5.0, Click Studios Passwordstate)
- [CVE-2022-4614](https://cve.now/CVE-2022-4614.md): Cross-site Scripting (XSS) - Stored in alagrede/znote-app (CVSS 2.3, alagrede/znote-app)
- [CVE-2022-4615](https://cve.now/CVE-2022-4615.md): Cross-site Scripting (XSS) - Reflected in openemr/openemr (CVSS 8.3, openemr/openemr)
- [CVE-2022-46287](https://cve.now/CVE-2022-46287.md): Cross-site scripting vulnerability in DENSHI NYUSATSU CORE SYSTEM v6 R4 and earlier allows a remote unauthenticated attacker to inject an ar (CVSS 6.1, Japan Construction Information Center DENSHI NYUSATSU CORE…)
- [CVE-2022-46288](https://cve.now/CVE-2022-46288.md): Open redirect vulnerability in DENSHI NYUSATSU CORE SYSTEM v6 R4 and earlier allows a remote unauthenticated attacker to redirect a user to (CVSS 6.1, Japan Construction Information Center DENSHI NYUSATSU CORE…)
- [CVE-2022-46399](https://cve.now/CVE-2022-46399.md): The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) is unresponsive with ConReqTimeoutZer (CVSS 7.5)
- [CVE-2022-46400](https://cve.now/CVE-2022-46400.md): The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) allows attackers to bypass passkey en (CVSS 5.4)
- [CVE-2022-46401](https://cve.now/CVE-2022-46401.md): The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) accepts PauseEncReqPlainText before p (CVSS 5.4)
- [CVE-2022-46402](https://cve.now/CVE-2022-46402.md): The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) accepts PairCon\_rmSend with incorrect (CVSS 6.5)
- [CVE-2022-46403](https://cve.now/CVE-2022-46403.md): The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) mishandles reject messages. (CVSS 8.6)
- [CVE-2022-47547](https://cve.now/CVE-2022-47547.md): GossipSub 1.1, as used for Ethereum 2.0, allows a peer to maintain a positive score (and thus not be pruned from the network) even though it (CVSS 5.3)
- [CVE-2022-47549](https://cve.now/CVE-2022-47549.md): An unprotected memory-access operation in optee\_os in TrustedFirmware Open Portable Trusted Execution Environment (OP-TEE) before 3.20 allow (CVSS 6.4)
- [CVE-2022-47551](https://cve.now/CVE-2022-47551.md): Apiman 1.5.7 through 2.2.3.Final has insufficient checks for read permissions within the Apiman Manager REST API. (CVSS 6.5, io.apiman:apiman-manager-api-rest-impl)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-12-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.