# CVEs published 2022-12-20

85 CVEs were published on December 20, 2022: 14 critical, 53 high. Days are UTC.

- [CVE-2022-38391](https://cve.now/CVE-2022-38391.md): IBM Spectrum Control information disclosure (CVSS 5.1, IBM Spectrum Control)
- [CVE-2022-39166](https://cve.now/CVE-2022-39166.md): IBM Security Guardium information disclosure (CVSS 4.4, IBM Security Guardium)
- [CVE-2022-23542](https://cve.now/CVE-2022-23542.md): OpenFGA Authorization Bypass (CVSS 7.7, openfga · github.com/openfga/openfga)
- [CVE-2022-43382](https://cve.now/CVE-2022-43382.md): IBM AIX denial of service (CVSS 6.2, IBM AIX)
- [CVE-2022-39304](https://cve.now/CVE-2022-39304.md): ghinstallation returns app JWT in error responses (CVSS 5.0, bradleyfalzon ghinstallation · github.com/bradleyfalzon/ghi…)
- [CVE-2022-46771](https://cve.now/CVE-2022-46771.md): IBM UrbanCode Deploy (UCD) cross-site scripting (CVSS 4.6, IBM UrbanCode Deploy)
- [CVE-2022-23537](https://cve.now/CVE-2022-23537.md): PJSIP vulnerable to heap buffer overflow when decoding STUN message (CVSS 6.5, pjsip pjproject)
- [CVE-2022-43875](https://cve.now/CVE-2022-43875.md): IBM Financial Transaction Manager for SWIFT Services for Multiplatforms denial of service (CVSS 6.2, IBM Financial Transaction Manager for SWIFT Services for Mu…)
- [CVE-2022-43872](https://cve.now/CVE-2022-43872.md): IBM Financial Transaction Manager information disclosure (CVSS 5.3, IBM Financial Transaction Manager)
- [CVE-2022-4619](https://cve.now/CVE-2022-4619.md): Sidebar Widgets by CodeLights \<= 1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 5.5, rsukhar Sidebar Widgets by CodeLights)
- [CVE-2022-4287](https://cve.now/CVE-2022-4287.md): Authentication bypass in local application lock feature in Devolutions Remote Desktop Manager 2022.3.26 and earlier on Windows allows malic (CVSS 8.8, Devolutions Remote Desktop Manager)
- [CVE-2022-46421](https://cve.now/CVE-2022-46421.md): Apache Airflow Hive Provider: Hive Provider RCE vulnerability with hive\_cli\_params (CVSS 9.8, Apache Software Foundation Apache Airflow Hive Provider · a…)
- [CVE-2022-38655](https://cve.now/CVE-2022-38655.md): HCL BigFix WebUI is affected by a missing-permission-check vulnerability (CVSS 6.4, HCL Software BigFix WebUI)
- [CVE-2021-46856](https://cve.now/CVE-2021-46856.md): The multi-screen collaboration module has a path traversal vulnerability. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-38733](https://cve.now/CVE-2022-38733.md): OnCommand Insight versions 7.3.1 through 7.3.14 are susceptible to an authentication bypass vulnerability in the Data Warehouse component. (CVSS 8.6, OnCommand Insight)
- [CVE-2022-38873](https://cve.now/CVE-2022-38873.md): D-Link devices DAP-2310 v2.10rc036 and earlier, DAP-2330 v1.06rc020 and earlier, DAP-2360 v2.10rc050 and earlier, DAP-2553 v3.10rc031 and ea (CVSS 7.5)
- [CVE-2022-40624](https://cve.now/CVE-2022-40624.md): pfSense pfBlockerNG through 2.1.4\_27 allows remote attackers to execute arbitrary OS commands as root via the HTTP Host header, a different (CVSS 9.8)
- [CVE-2022-41590](https://cve.now/CVE-2022-41590.md): Some smartphones have authentication-related (including session management) vulnerabilities as the setup wizard is bypassed. (CVSS 5.5, Huawei HarmonyOS)
- [CVE-2022-41591](https://cve.now/CVE-2022-41591.md): The backup module has a path traversal vulnerability. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-41596](https://cve.now/CVE-2022-41596.md): The system tool has inconsistent serialization and deserialization. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-41599](https://cve.now/CVE-2022-41599.md): The system service has a vulnerability that causes incorrect return values. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-42046](https://cve.now/CVE-2022-42046.md): wfshbr64.sys and wfshbr32.sys specially crafted IOCTL allows arbitrary user to perform local privilege escalation (CVSS 7.8)
- [CVE-2022-42949](https://cve.now/CVE-2022-42949.md): Silverstripe silverstripe/subsites through 2.6.0 has Insecure Permissions. (CVSS 7.5, silverstripe/subsites)
- [CVE-2022-4515](https://cve.now/CVE-2022-4515.md): A flaw was found in Exuberant Ctags in the way it handles the "-o" option. (CVSS 7.8, Exuberant Ctags)
- [CVE-2022-45665](https://cve.now/CVE-2022-45665.md): Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the funcpara1 parameter in the formSetCfm function. (CVSS 7.5)
- [CVE-2022-45666](https://cve.now/CVE-2022-45666.md): Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the list parameter in the formwrlSSIDset function. (CVSS 7.5)
- [CVE-2022-45942](https://cve.now/CVE-2022-45942.md): A Remote Code Execution (RCE) vulnerability was found in includes/baijiacms/common.inc.php in baijiacms v4. (CVSS 8.8)
- [CVE-2022-46020](https://cve.now/CVE-2022-46020.md): WBCE CMS v1.5.4 can implement getshell by modifying the upload file type. (CVSS 9.8)
- [CVE-2022-46076](https://cve.now/CVE-2022-46076.md): D-Link DIR-869 DIR869Ax\_FW102B15 is vulnerable to Authentication Bypass via phpcgi. (CVSS 7.5)
- [CVE-2022-46139](https://cve.now/CVE-2022-46139.md): TP-Link TL-WR940N V4 3.16.9 and earlier allows authenticated attackers to cause a Denial of Service (DoS) via uploading a crafted firmware i (CVSS 6.5)
- [CVE-2022-46310](https://cve.now/CVE-2022-46310.md): The TelephonyProvider module has a vulnerability in obtaining values.Successful exploitation of this vulnerability may affect data confident (CVSS 7.5, Huawei HarmonyOS)
- [CVE-2022-46311](https://cve.now/CVE-2022-46311.md): The contacts component has a free (undefined) provider vulnerability. (CVSS 7.5, Huawei HarmonyOS)
- [CVE-2022-46312](https://cve.now/CVE-2022-46312.md): The application management module has a vulnerability in permission verification. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-46313](https://cve.now/CVE-2022-46313.md): The sensor privacy module has an authentication vulnerability. (CVSS 5.3, Huawei HarmonyOS)
- [CVE-2022-46314](https://cve.now/CVE-2022-46314.md): The IPC module has defects introduced in the design process. (CVSS 7.5, Huawei HarmonyOS)
- [CVE-2022-46315](https://cve.now/CVE-2022-46315.md): The ProfileSDK has defects introduced in the design process. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-46316](https://cve.now/CVE-2022-46316.md): A thread security vulnerability exists in the authentication process. (CVSS 9.8, Huawei HarmonyOS)
- [CVE-2022-46317](https://cve.now/CVE-2022-46317.md): The power consumption module has an out-of-bounds read vulnerability. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-46318](https://cve.now/CVE-2022-46318.md): The HAware module has a function logic error. (CVSS 5.3, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-46319](https://cve.now/CVE-2022-46319.md): Fingerprint calibration has a vulnerability of lacking boundary judgment. (CVSS 9.8, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-46320](https://cve.now/CVE-2022-46320.md): The kernel module has an out-of-bounds read vulnerability. (CVSS 9.8, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-46321](https://cve.now/CVE-2022-46321.md): The Wi-Fi module has a vulnerability in permission verification. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-46322](https://cve.now/CVE-2022-46322.md): Some smartphones have the out-of-bounds write vulnerability. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-46323](https://cve.now/CVE-2022-46323.md): Some smartphones have the out-of-bounds write vulnerability.Successful exploitation of this vulnerability may cause system service exception (CVSS 9.8, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-46324](https://cve.now/CVE-2022-46324.md): Some smartphones have the out-of-bounds write vulnerability. (CVSS 9.8, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-46325](https://cve.now/CVE-2022-46325.md): Some smartphones have the out-of-bounds write vulnerability.Successful exploitation of this vulnerability may cause system service exception (CVSS 9.8, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-46326](https://cve.now/CVE-2022-46326.md): Some smartphones have the out-of-bounds write vulnerability. (CVSS 9.8, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-46327](https://cve.now/CVE-2022-46327.md): Some smartphones have configuration issues. (CVSS 9.8, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-46328](https://cve.now/CVE-2022-46328.md): Some smartphones have the input validation vulnerability. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-46422](https://cve.now/CVE-2022-46422.md): An issue in Netgear WNR2000 v1 1.2.3.7 and earlier allows authenticated attackers to cause a Denial of Service (DoS) via uploading a crafted (CVSS 4.8)
- [CVE-2022-46423](https://cve.now/CVE-2022-46423.md): An exploitable firmware modification vulnerability was discovered on the Netgear WNR2000v1 router. (CVSS 8.1)
- [CVE-2022-46424](https://cve.now/CVE-2022-46424.md): An exploitable firmware modification vulnerability was discovered on the Netgear XWN5001 Powerline 500 WiFi Access Point. (CVSS 8.1)
- [CVE-2022-46428](https://cve.now/CVE-2022-46428.md): TP-Link TL-WR1043ND V1 3.13.15 and earlier allows authenticated attackers to execute arbitrary code or cause a Denial of Service (DoS) via u (CVSS 4.8)
- [CVE-2022-46430](https://cve.now/CVE-2022-46430.md): TP-Link TL-WR740N V1 and V2 v3.12.4 and earlier allows authenticated attackers to execute arbitrary code or cause a Denial of Service (DoS) (CVSS 4.8)
- [CVE-2022-46432](https://cve.now/CVE-2022-46432.md): An exploitable firmware modification vulnerability was discovered on TP-Link TL-WR743ND V1. (CVSS 7.5)
- [CVE-2022-46434](https://cve.now/CVE-2022-46434.md): An issue in the firmware update process of TP-Link TL-WA7510N v1 v3.12.6 and earlier allows attackers to execute arbitrary code or cause a D (CVSS 7.5)
- [CVE-2022-46435](https://cve.now/CVE-2022-46435.md): An issue in the firmware update process of TP-Link TL-WR941ND V2/V3 up to 3.13.9 and TL-WR941ND V4 up to 3.12.8 allows attackers to execute (CVSS 8.8)
- [CVE-2022-46530](https://cve.now/CVE-2022-46530.md): Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the mac parameter at /goform/GetParentControlInfo. (CVSS 7.5)
- [CVE-2022-46531](https://cve.now/CVE-2022-46531.md): Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the deviceId parameter at /goform/addWifiMacFilter. (CVSS 7.5)
- [CVE-2022-46532](https://cve.now/CVE-2022-46532.md): Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the deviceMac parameter at /goform/addWifiMacFilter. (CVSS 7.5)
- [CVE-2022-46533](https://cve.now/CVE-2022-46533.md): Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the limitSpeed parameter at /goform/SetClientState. (CVSS 7.5)
- [CVE-2022-46534](https://cve.now/CVE-2022-46534.md): Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the speed\_dir parameter at /goform/SetSpeedWan. (CVSS 7.5)
- [CVE-2022-46535](https://cve.now/CVE-2022-46535.md): Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the deviceId parameter at /goform/SetClientState. (CVSS 7.5)
- [CVE-2022-46536](https://cve.now/CVE-2022-46536.md): Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the limitSpeedUp parameter at /goform/SetClientState. (CVSS 7.5)
- [CVE-2022-46537](https://cve.now/CVE-2022-46537.md): Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the security parameter at /goform/WifiBasicSet. (CVSS 7.5)
- [CVE-2022-46538](https://cve.now/CVE-2022-46538.md): Tenda F1203 V2.0.1.6 was discovered to contain a command injection vulnerability via the mac parameter at /goform/WriteFacMac. (CVSS 9.8)
- [CVE-2022-46539](https://cve.now/CVE-2022-46539.md): Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the security\_5g parameter at /goform/WifiBasicSet. (CVSS 7.5)
- [CVE-2022-46540](https://cve.now/CVE-2022-46540.md): Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the entrys parameter at /goform/addressNat. (CVSS 7.5)
- [CVE-2022-46541](https://cve.now/CVE-2022-46541.md): Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the ssid parameter at /goform/fast\_setting\_wifi\_set. (CVSS 7.5)
- [CVE-2022-46542](https://cve.now/CVE-2022-46542.md): Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the page parameter at /goform/addressNat. (CVSS 7.5)
- [CVE-2022-46543](https://cve.now/CVE-2022-46543.md): Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the mitInterface parameter at /goform/addressNat. (CVSS 7.5)
- [CVE-2022-46544](https://cve.now/CVE-2022-46544.md): Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the cmdinput parameter at /goform/exeCommand. (CVSS 7.5)
- [CVE-2022-46545](https://cve.now/CVE-2022-46545.md): Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the page parameter at /goform/NatStaticSetting. (CVSS 7.5)
- [CVE-2022-46546](https://cve.now/CVE-2022-46546.md): Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the entrys parameter at /goform/RouteStatic. (CVSS 7.5)
- [CVE-2022-46547](https://cve.now/CVE-2022-46547.md): Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the page parameter at /goform/VirtualSer. (CVSS 9.8)
- [CVE-2022-46548](https://cve.now/CVE-2022-46548.md): Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the page parameter at /goform/DhcpListClient. (CVSS 7.5)
- [CVE-2022-46549](https://cve.now/CVE-2022-46549.md): Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the deviceId parameter at /goform/saveParentControlInfo. (CVSS 7.5)
- [CVE-2022-46550](https://cve.now/CVE-2022-46550.md): Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the urls parameter at /goform/saveParentControlInfo. (CVSS 7.5)
- [CVE-2022-46551](https://cve.now/CVE-2022-46551.md): Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the time parameter at /goform/saveParentControlInfo. (CVSS 7.5)
- [CVE-2022-46910](https://cve.now/CVE-2022-46910.md): An issue in the firmware update process of TP-Link TL-WA901ND V1 up to v3.11.2 and TL-WA901N V2 up to v3.12.16 allows attackers to execute a (CVSS 8.8)
- [CVE-2022-46912](https://cve.now/CVE-2022-46912.md): An issue in the firmware update process of TP-Link TL-WR841N / TL-WA841ND V7 3.13.9 and earlier allows attackers to execute arbitrary code o (CVSS 8.8)
- [CVE-2022-46914](https://cve.now/CVE-2022-46914.md): An issue in the firmware update process of TP-LINK TL-WA801N / TL-WA801ND V1 v3.12.16 and earlier allows attackers to execute arbitrary code (CVSS 8.8)
- [CVE-2022-47577](https://cve.now/CVE-2022-47577.md): An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. (CVSS 7.1)
- [CVE-2022-47578](https://cve.now/CVE-2022-47578.md): An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. (CVSS 7.1)
- [CVE-2022-47629](https://cve.now/CVE-2022-47629.md): Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-12-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.