CVEs published December 21, 2022
88 CVEs were published on December 21, 2022: 6 critical, 14 high.
- Published
- 88
- Critical
- 6
- High
- 14
- Medium
- 48
- Low
- 20
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 19
Most affected products
- Adobe Experience Manager
- 23
- Dataprobe iBoot-PDU FW
- 7
- Auto Upload Images
- 2
- abacus-ext-cmdline
- 1
- Apache Software Foundation Apache Karaf · org.apache.karaf:…
- 1
- Azure aad-pod-identity · github.com/Azure/aad-pod-identity
- 1
- Brondahl EnumStringValues · EnumStringValues
- 1
- chedabob whatismyudid
- 1
- collective.contact.widget · collective-contact-widget
- 1
- Corel Roxio Creator LJB
- 1
Critical 6
- CVE-2022-25893Arbitrary Code Executionvm2
- CVE-2022-3184Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the device’s existing firmware allows unauthenticated uDataprobe iBoot-PDU FW
- CVE-2022-3183Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where a specific function does not sanitize the input provideDataprobe iBoot-PDU FW
- CVE-2022-40145Apache Karaf: JDBC JAAS LDAP injectionApache Software Foundation Apache Karaf · org.apache.karaf:…
- CVE-2022-28173The web server of some Hikvision wireless bridge products have an access control vulnerability which can be used to obtain the admin permisshikvision DS-3WF0AC-2NT · hikvision DS-3WF01C-2N/O
- CVE-2022-47635Wildix WMS 6 before 6.02.20221216, WMS 5 before 5.04.20221214, and WMS4 before 4.04.45396.23 allows Server-side request forgery (SSRF) via Z
High 14
- CVE-2022-24431Command Injectionabacus-ext-cmdline
- CVE-2022-25895Directory Traversallite-dev-server
- CVE-2022-38060A privilege escalation vulnerability exists in the sudo functionality of OpenStack Kolla git master 05194e7618.OpenStack · kolla
- CVE-2022-38065A privilege escalation vulnerability exists in the oslo.privsep functionality of OpenStack git master 05194e7618 and prior.OpenStack
- CVE-2022-3186Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the affected product allows an attacker to access the dDataprobe iBoot-PDU FW
- CVE-2022-46334Proofpoint Enterprise Protection Local Privilege EscalationProofpoint enterprise_protection
- CVE-2022-25171Command Injectionp4
- CVE-2022-25904Prototype Pollutionsafe-eval
- CVE-2022-25931Directory Traversaleasy-static-server
- CVE-2022-25940Denial of Service (DoS)lite-server · org.webjars.npm:lite-server
- CVE-2022-36222Nokia Fastmile 3tg00118abad52 devices shipped by Optus are shipped with a default hardcoded admin account of admin:Nq+L5st7o This account ca
- CVE-2022-46282Use after free vulnerability in CX-Drive V3.00 and earlier allows a local attacker to execute arbitrary code by having a user to open a specOMRON CX-Drive
- CVE-2022-46330Squirrel.Windows is both a toolset and a library that provides installation and update functionality for Windows desktop applications.Installers generated by Squirrel.Windows
- CVE-2022-47581Isode M-Vault 16.0v0 through 17.x before 17.0v24 can crash upon an LDAP v1 bind request.
Medium, low and unrated 68
- CVE-2022-25929Cross-site Scripting (XSS)smoothie
- CVE-2022-3189Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where a specially crafted PHP script could use parameters froDataprobe iBoot-PDU FW
- CVE-2022-3188Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where unauthenticated users could open PHP index pages withouDataprobe iBoot-PDU FW
- CVE-2022-3187Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where certain PHP pages only validate when a valid connectionDataprobe iBoot-PDU FW
- CVE-2022-3185Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the affected product exposes sensitive data concerning Dataprobe iBoot-PDU FW
- CVE-2022-23551AAD Pod Identity obtaining token with backslashAzure aad-pod-identity · github.com/Azure/aad-pod-identity
- CVE-2022-30679AEM Reflected XSS Arbitrary code executionAdobe Experience Manager
- CVE-2022-35693AEM Reflected XSS Arbitrary code executionAdobe Experience Manager
- CVE-2022-35695AEM Reflected XSS Arbitrary code executionAdobe Experience Manager
- CVE-2022-42345AEM Reflected XSS Arbitrary code executionAdobe Experience Manager
- CVE-2022-42346AEM Reflected XSS Arbitrary code executionAdobe Experience Manager
- CVE-2022-42348AEM Reflected XSS Arbitrary code executionAdobe Experience Manager
- CVE-2022-42349AEM Reflected XSS Arbitrary code executionAdobe Experience Manager
- CVE-2022-42350AEM Reflected XSS Arbitrary code executionAdobe Experience Manager
- CVE-2022-42352AEM Reflected XSS Arbitrary code executionAdobe Experience Manager
- CVE-2022-42354AEM Reflected XSS Arbitrary code executionAdobe Experience Manager
- CVE-2022-42356AEM Reflected XSS Arbitrary code executionAdobe Experience Manager
- CVE-2022-42357AEM Reflected XSS Arbitrary code executionAdobe Experience Manager
- CVE-2022-42362AEM Reflected XSS Arbitrary code executionAdobe Experience Manager
- CVE-2022-42364AEM Reflected XSS Arbitrary code executionAdobe Experience Manager
- CVE-2022-42365AEM Reflected XSS Arbitrary code executionAdobe Experience Manager
- CVE-2022-44463AEM Reflected XSS Arbitrary code executionAdobe Experience Manager
- CVE-2022-44465AEM Reflected XSS Arbitrary code executionAdobe Experience Manager
- CVE-2022-44466AEM Reflected XSS Arbitrary code executionAdobe Experience Manager
- CVE-2022-44467AEM Reflected XSS Arbitrary code executionAdobe Experience Manager
- CVE-2022-44470AEM Reflected XSS Arbitrary code executionAdobe Experience Manager
- CVE-2022-44471AEM Reflected XSS Arbitrary code executionAdobe Experience Manager
- CVE-2022-44474AEM Reflected XSS Arbitrary code executionAdobe Experience Manager
- CVE-2022-44488AEM URL Redirection to Untrusted Site Security feature bypassAdobe Experience Manager
- CVE-2022-44643Access policy with access to all tenants and using label selectors has more access
- CVE-2022-47512Sensitive Data Disclosure VulnerabilityHybrid Cloud Observability (HCO)/ SolarWinds Platform
- CVE-2020-36620Brondahl EnumStringValues EnumExtensions.cs GetStringValuesWithPreferences_Uncache resource consumptionBrondahl EnumStringValues · EnumStringValues
- CVE-2020-36621chedabob whatismyudid mobileconfig.js exports.enrollment cross site scriptingchedabob whatismyudid
- CVE-2020-36622sah-comp bienlein cross-site request forgerysah-comp bienlein
- CVE-2020-36623Pengu index.js runApp cross-site request forgeryPengu
- CVE-2021-4263leanote history.js define cross site scriptingleanote · github.com/leanote/leanote
- CVE-2021-4264LinkedIn dustjs prototype pollutionLinkedIn dustjs · dustjs-linkedin
- CVE-2021-4265siwapp-ror cross site scriptingsiwapp-ror
- CVE-2021-4266Webdetails cpf DependenciesPackage.java cross site scriptingWebdetails cpf
- CVE-2021-4267tad_discuss cross site scriptingtad_discuss
- CVE-2021-4268phpRedisAdmin cross-site request forgeryphpRedisAdmin
- CVE-2021-4269SimpleRisk common.js checkAndSetValidation cross site scriptingSimpleRisk
- CVE-2021-4270Imprint CMS ViewHelpers.cs SearchForm cross site scriptingImprint CMS
- CVE-2021-4271panicsteve w2wiki Markdown index.php toHTML cross site scriptingpanicsteve w2wiki
- CVE-2021-4272studygolang topics.js cross site scriptingstudygolang · github.com/studygolang/studygolang
- CVE-2021-4273studygolang search.go Search cross site scriptingstudygolang
- CVE-2021-4274sileht bird-lg layout.html cross site scriptingsileht bird-lg
- CVE-2021-4275katlings pyambic-pentameter cross-site request forgerykatlings pyambic-pentameter
- CVE-2022-36221Nokia Fastmile 3tg00118abad52 is affected by an authenticated path traversal vulnerability which allows attackers to read any named pipe fil
- CVE-2022-38546A DNS misconfiguration was found in Zyxel NBG7510 firmware versions prior to V1.00(ABZY.3)C0, which could allow an unauthenticated attacker Zyxel NBG7510 firmware
- CVE-2022-40841A cross-site scripting (XSS) vulnerability in NdkAdvancedCustomizationFields v3.5.0 allows attackers to execute arbitrary web scripts or HTM
- CVE-2022-43543KDDI +Message App, NTT DOCOMO +Message App, and SoftBank +Message App contain a vulnerability caused by improper handling of Unicode controlKDDI CORPORATION, NTT DOCOMO, INC., and SoftBank KDDI +Mess…
- CVE-2022-44449Stored cross-site scripting vulnerability in Zenphoto versions prior to 1.6 allows remote a remote authenticated attacker with an administraZenphoto
- CVE-2022-46095Sourcecodester Covid-19 Directory on Vaccination System 1.0 was discovered to contain a Cross-Site Scripting (XSS) vulnerability via verific
- CVE-2022-46096A Cross site scripting (XSS) vulnerability in Sourcecodester Online Covid-19 Directory on Vaccination System v1.0 allows attackers to execut
- CVE-2022-4617Cross-site Scripting (XSS) - Reflected in microweber/microwebermicroweber/microweber
- CVE-2022-4630Sensitive Cookie Without 'HttpOnly' Flag in lirantal/daloradiuslirantal/daloradius
- CVE-2022-4631WP-Ban ban-options.php cross site scriptingWP-Ban
- CVE-2022-4632Auto Upload Images cross site scriptingAuto Upload Images
- CVE-2022-4633Auto Upload Images Settings setting-page.php cross-site request forgeryAuto Upload Images
- CVE-2022-4637ep3-bs cross site scriptingep3-bs
- CVE-2022-4638collective.contact.widget widgets.py title cross site scriptingcollective.contact.widget · collective-contact-widget
- CVE-2022-4639sslh Packet Dumping probe.c hexdump format stringsslh
- CVE-2022-4640Mingsoft MCMS Article save cross site scriptingMingsoft MCMS · net.mingsoft:ms-mcms
- CVE-2022-4641pig-vector LogisticRegression.java LogisticRegression temp filepig-vector
- CVE-2022-4642tatoeba2 Profile Name cross site scriptingtatoeba2
- CVE-2022-4643docconv pdf_ocr.go ConvertPDFImages os command injectiondocconv · code.sajari.com/docconv +1
- CVE-2022-46662Roxio Creator LJB starts another program with an unquoted file path.Corel Roxio Creator LJB