CVEs published December 20, 2022
85 CVEs were published on December 20, 2022: 14 critical, 53 high.
- Published
- 85
- Critical
- 14
- High
- 53
- Medium
- 17
- Low
- 0
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- Huawei HarmonyOS · Huawei EMUI
- 18
- Huawei HarmonyOS
- 6
- Apache Software Foundation Apache Airflow Hive Provider · a…
- 1
- bradleyfalzon ghinstallation · github.com/bradleyfalzon/ghi…
- 1
- Devolutions Remote Desktop Manager
- 1
- Exuberant Ctags
- 1
- HCL Software BigFix WebUI
- 1
- IBM AIX
- 1
- IBM Financial Transaction Manager
- 1
- IBM Financial Transaction Manager for SWIFT Services for Mu…
- 1
Critical 14
- CVE-2022-46421Apache Airflow Hive Provider: Hive Provider RCE vulnerability with hive_cli_paramsApache Software Foundation Apache Airflow Hive Provider · a…
- CVE-2022-40624pfSense pfBlockerNG through 2.1.4_27 allows remote attackers to execute arbitrary OS commands as root via the HTTP Host header, a different
- CVE-2022-46020WBCE CMS v1.5.4 can implement getshell by modifying the upload file type.
- CVE-2022-46316A thread security vulnerability exists in the authentication process.Huawei HarmonyOS
- CVE-2022-46319Fingerprint calibration has a vulnerability of lacking boundary judgment.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-46320The kernel module has an out-of-bounds read vulnerability.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-46323Some smartphones have the out-of-bounds write vulnerability.Successful exploitation of this vulnerability may cause system service exceptionHuawei HarmonyOS · Huawei EMUI
- CVE-2022-46324Some smartphones have the out-of-bounds write vulnerability.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-46325Some smartphones have the out-of-bounds write vulnerability.Successful exploitation of this vulnerability may cause system service exceptionHuawei HarmonyOS · Huawei EMUI
- CVE-2022-46326Some smartphones have the out-of-bounds write vulnerability.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-46327Some smartphones have configuration issues.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-46538Tenda F1203 V2.0.1.6 was discovered to contain a command injection vulnerability via the mac parameter at /goform/WriteFacMac.
- CVE-2022-46547Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the page parameter at /goform/VirtualSer.
- CVE-2022-47629Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser.
High 53
- CVE-2022-23542OpenFGA Authorization Bypassopenfga · github.com/openfga/openfga
- CVE-2022-4287Authentication bypass in local application lock feature in Devolutions Remote Desktop Manager 2022.3.26 and earlier on Windows allows malicDevolutions Remote Desktop Manager
- CVE-2021-46856The multi-screen collaboration module has a path traversal vulnerability.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-38733OnCommand Insight versions 7.3.1 through 7.3.14 are susceptible to an authentication bypass vulnerability in the Data Warehouse component.OnCommand Insight
- CVE-2022-38873D-Link devices DAP-2310 v2.10rc036 and earlier, DAP-2330 v1.06rc020 and earlier, DAP-2360 v2.10rc050 and earlier, DAP-2553 v3.10rc031 and ea
- CVE-2022-41591The backup module has a path traversal vulnerability.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-41596The system tool has inconsistent serialization and deserialization.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-41599The system service has a vulnerability that causes incorrect return values.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-42046wfshbr64.sys and wfshbr32.sys specially crafted IOCTL allows arbitrary user to perform local privilege escalation
- CVE-2022-42949Silverstripe silverstripe/subsites through 2.6.0 has Insecure Permissions.silverstripe/subsites
- CVE-2022-4515A flaw was found in Exuberant Ctags in the way it handles the "-o" option.Exuberant Ctags
- CVE-2022-45665Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the funcpara1 parameter in the formSetCfm function.
- CVE-2022-45666Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the list parameter in the formwrlSSIDset function.
- CVE-2022-45942A Remote Code Execution (RCE) vulnerability was found in includes/baijiacms/common.inc.php in baijiacms v4.
- CVE-2022-46076D-Link DIR-869 DIR869Ax_FW102B15 is vulnerable to Authentication Bypass via phpcgi.
- CVE-2022-46310The TelephonyProvider module has a vulnerability in obtaining values.Successful exploitation of this vulnerability may affect data confidentHuawei HarmonyOS
- CVE-2022-46311The contacts component has a free (undefined) provider vulnerability.Huawei HarmonyOS
- CVE-2022-46314The IPC module has defects introduced in the design process.Huawei HarmonyOS
- CVE-2022-46315The ProfileSDK has defects introduced in the design process.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-46317The power consumption module has an out-of-bounds read vulnerability.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-46321The Wi-Fi module has a vulnerability in permission verification.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-46322Some smartphones have the out-of-bounds write vulnerability.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-46328Some smartphones have the input validation vulnerability.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-46423An exploitable firmware modification vulnerability was discovered on the Netgear WNR2000v1 router.
- CVE-2022-46424An exploitable firmware modification vulnerability was discovered on the Netgear XWN5001 Powerline 500 WiFi Access Point.
- CVE-2022-46432An exploitable firmware modification vulnerability was discovered on TP-Link TL-WR743ND V1.
- CVE-2022-46434An issue in the firmware update process of TP-Link TL-WA7510N v1 v3.12.6 and earlier allows attackers to execute arbitrary code or cause a D
- CVE-2022-46435An issue in the firmware update process of TP-Link TL-WR941ND V2/V3 up to 3.13.9 and TL-WR941ND V4 up to 3.12.8 allows attackers to execute
- CVE-2022-46530Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the mac parameter at /goform/GetParentControlInfo.
- CVE-2022-46531Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the deviceId parameter at /goform/addWifiMacFilter.
- CVE-2022-46532Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the deviceMac parameter at /goform/addWifiMacFilter.
- CVE-2022-46533Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the limitSpeed parameter at /goform/SetClientState.
- CVE-2022-46534Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the speed_dir parameter at /goform/SetSpeedWan.
- CVE-2022-46535Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the deviceId parameter at /goform/SetClientState.
- CVE-2022-46536Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the limitSpeedUp parameter at /goform/SetClientState.
- CVE-2022-46537Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the security parameter at /goform/WifiBasicSet.
- CVE-2022-46539Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the security_5g parameter at /goform/WifiBasicSet.
- CVE-2022-46540Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the entrys parameter at /goform/addressNat.
- CVE-2022-46541Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the ssid parameter at /goform/fast_setting_wifi_set.
- CVE-2022-46542Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the page parameter at /goform/addressNat.
- CVE-2022-46543Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the mitInterface parameter at /goform/addressNat.
- CVE-2022-46544Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the cmdinput parameter at /goform/exeCommand.
- CVE-2022-46545Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the page parameter at /goform/NatStaticSetting.
- CVE-2022-46546Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the entrys parameter at /goform/RouteStatic.
- CVE-2022-46548Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the page parameter at /goform/DhcpListClient.
- CVE-2022-46549Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the deviceId parameter at /goform/saveParentControlInfo.
- CVE-2022-46550Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the urls parameter at /goform/saveParentControlInfo.
- CVE-2022-46551Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the time parameter at /goform/saveParentControlInfo.
- CVE-2022-46910An issue in the firmware update process of TP-Link TL-WA901ND V1 up to v3.11.2 and TL-WA901N V2 up to v3.12.16 allows attackers to execute a
- CVE-2022-46912An issue in the firmware update process of TP-Link TL-WR841N / TL-WA841ND V7 3.13.9 and earlier allows attackers to execute arbitrary code o
- CVE-2022-46914An issue in the firmware update process of TP-LINK TL-WA801N / TL-WA801ND V1 v3.12.16 and earlier allows attackers to execute arbitrary code
- CVE-2022-47577An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15.
- CVE-2022-47578An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15.
Medium, low and unrated 18
- CVE-2022-38391IBM Spectrum Control information disclosureIBM Spectrum Control
- CVE-2022-39166IBM Security Guardium information disclosureIBM Security Guardium
- CVE-2022-43382IBM AIX denial of serviceIBM AIX
- CVE-2022-39304ghinstallation returns app JWT in error responsesbradleyfalzon ghinstallation · github.com/bradleyfalzon/ghi…
- CVE-2022-46771IBM UrbanCode Deploy (UCD) cross-site scriptingIBM UrbanCode Deploy
- CVE-2022-23537PJSIP vulnerable to heap buffer overflow when decoding STUN messagepjsip pjproject
- CVE-2022-43875IBM Financial Transaction Manager for SWIFT Services for Multiplatforms denial of serviceIBM Financial Transaction Manager for SWIFT Services for Mu…
- CVE-2022-43872IBM Financial Transaction Manager information disclosureIBM Financial Transaction Manager
- CVE-2022-4619Sidebar Widgets by CodeLights <= 1.4 - Authenticated (Administrator+) Stored Cross-Site Scriptingrsukhar Sidebar Widgets by CodeLights
- CVE-2022-38655HCL BigFix WebUI is affected by a missing-permission-check vulnerabilityHCL Software BigFix WebUI
- CVE-2022-41590Some smartphones have authentication-related (including session management) vulnerabilities as the setup wizard is bypassed.Huawei HarmonyOS
- CVE-2022-46139TP-Link TL-WR940N V4 3.16.9 and earlier allows authenticated attackers to cause a Denial of Service (DoS) via uploading a crafted firmware i
- CVE-2022-46312The application management module has a vulnerability in permission verification.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-46313The sensor privacy module has an authentication vulnerability.Huawei HarmonyOS
- CVE-2022-46318The HAware module has a function logic error.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-46422An issue in Netgear WNR2000 v1 1.2.3.7 and earlier allows authenticated attackers to cause a Denial of Service (DoS) via uploading a crafted
- CVE-2022-46428TP-Link TL-WR1043ND V1 3.13.15 and earlier allows authenticated attackers to execute arbitrary code or cause a Denial of Service (DoS) via u
- CVE-2022-46430TP-Link TL-WR740N V1 and V2 v3.12.4 and earlier allows authenticated attackers to execute arbitrary code or cause a Denial of Service (DoS)