# CVEs published 2022-12-21

88 CVEs were published on December 21, 2022: 6 critical, 14 high. Days are UTC.

- [CVE-2022-24431](https://cve.now/CVE-2022-24431.md): Command Injection (CVSS 7.4, abacus-ext-cmdline)
- [CVE-2022-25893](https://cve.now/CVE-2022-25893.md): Arbitrary Code Execution (CVSS 9.8, vm2)
- [CVE-2022-25895](https://cve.now/CVE-2022-25895.md): Directory Traversal (CVSS 7.5, lite-dev-server)
- [CVE-2022-25929](https://cve.now/CVE-2022-25929.md): Cross-site Scripting (XSS) (CVSS 5.4, smoothie)
- [CVE-2022-38060](https://cve.now/CVE-2022-38060.md): A privilege escalation vulnerability exists in the sudo functionality of OpenStack Kolla git master 05194e7618. (CVSS 8.8, OpenStack · kolla)
- [CVE-2022-38065](https://cve.now/CVE-2022-38065.md): A privilege escalation vulnerability exists in the oslo.privsep functionality of OpenStack git master 05194e7618 and prior. (CVSS 8.8, OpenStack)
- [CVE-2022-3189](https://cve.now/CVE-2022-3189.md): Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where a specially crafted PHP script could use parameters fro (CVSS 5.3, Dataprobe iBoot-PDU FW)
- [CVE-2022-3188](https://cve.now/CVE-2022-3188.md): Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where unauthenticated users could open PHP index pages withou (CVSS 5.3, Dataprobe iBoot-PDU FW)
- [CVE-2022-3187](https://cve.now/CVE-2022-3187.md): Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where certain PHP pages only validate when a valid connection (CVSS 5.3, Dataprobe iBoot-PDU FW)
- [CVE-2022-3186](https://cve.now/CVE-2022-3186.md): Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the affected product allows an attacker to access the d (CVSS 8.6, Dataprobe iBoot-PDU FW)
- [CVE-2022-3185](https://cve.now/CVE-2022-3185.md): Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the affected product exposes sensitive data concerning (CVSS 5.3, Dataprobe iBoot-PDU FW)
- [CVE-2022-3184](https://cve.now/CVE-2022-3184.md): Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the device’s existing firmware allows unauthenticated u (CVSS 9.8, Dataprobe iBoot-PDU FW)
- [CVE-2022-3183](https://cve.now/CVE-2022-3183.md): Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where a specific function does not sanitize the input provide (CVSS 9.8, Dataprobe iBoot-PDU FW)
- [CVE-2022-46334](https://cve.now/CVE-2022-46334.md): Proofpoint Enterprise Protection Local Privilege Escalation (CVSS 7.8, Proofpoint enterprise\_protection)
- [CVE-2022-23551](https://cve.now/CVE-2022-23551.md): AAD Pod Identity obtaining token with backslash (CVSS 5.3, Azure aad-pod-identity · github.com/Azure/aad-pod-identity)
- [CVE-2022-40145](https://cve.now/CVE-2022-40145.md): Apache Karaf: JDBC JAAS LDAP injection (CVSS 9.8, Apache Software Foundation Apache Karaf · org.apache.karaf:…)
- [CVE-2022-25171](https://cve.now/CVE-2022-25171.md): Command Injection (CVSS 7.4, p4)
- [CVE-2022-25904](https://cve.now/CVE-2022-25904.md): Prototype Pollution (CVSS 7.5, safe-eval)
- [CVE-2022-25931](https://cve.now/CVE-2022-25931.md): Directory Traversal (CVSS 7.5, easy-static-server)
- [CVE-2022-25940](https://cve.now/CVE-2022-25940.md): Denial of Service (DoS) (CVSS 7.5, lite-server · org.webjars.npm:lite-server)
- [CVE-2022-28173](https://cve.now/CVE-2022-28173.md): The web server of some Hikvision wireless bridge products have an access control vulnerability which can be used to obtain the admin permiss (CVSS 9.1, hikvision DS-3WF0AC-2NT · hikvision DS-3WF01C-2N/O)
- [CVE-2022-30679](https://cve.now/CVE-2022-30679.md): AEM Reflected XSS Arbitrary code execution (CVSS 5.4, Adobe Experience Manager)
- [CVE-2022-35693](https://cve.now/CVE-2022-35693.md): AEM Reflected XSS Arbitrary code execution (CVSS 5.4, Adobe Experience Manager)
- [CVE-2022-35695](https://cve.now/CVE-2022-35695.md): AEM Reflected XSS Arbitrary code execution (CVSS 5.4, Adobe Experience Manager)
- [CVE-2022-42345](https://cve.now/CVE-2022-42345.md): AEM Reflected XSS Arbitrary code execution (CVSS 5.4, Adobe Experience Manager)
- [CVE-2022-42346](https://cve.now/CVE-2022-42346.md): AEM Reflected XSS Arbitrary code execution (CVSS 5.4, Adobe Experience Manager)
- [CVE-2022-42348](https://cve.now/CVE-2022-42348.md): AEM Reflected XSS Arbitrary code execution (CVSS 5.4, Adobe Experience Manager)
- [CVE-2022-42349](https://cve.now/CVE-2022-42349.md): AEM Reflected XSS Arbitrary code execution (CVSS 5.4, Adobe Experience Manager)
- [CVE-2022-42350](https://cve.now/CVE-2022-42350.md): AEM Reflected XSS Arbitrary code execution (CVSS 5.4, Adobe Experience Manager)
- [CVE-2022-42352](https://cve.now/CVE-2022-42352.md): AEM Reflected XSS Arbitrary code execution (CVSS 5.4, Adobe Experience Manager)
- [CVE-2022-42354](https://cve.now/CVE-2022-42354.md): AEM Reflected XSS Arbitrary code execution (CVSS 5.4, Adobe Experience Manager)
- [CVE-2022-42356](https://cve.now/CVE-2022-42356.md): AEM Reflected XSS Arbitrary code execution (CVSS 5.4, Adobe Experience Manager)
- [CVE-2022-42357](https://cve.now/CVE-2022-42357.md): AEM Reflected XSS Arbitrary code execution (CVSS 5.4, Adobe Experience Manager)
- [CVE-2022-42362](https://cve.now/CVE-2022-42362.md): AEM Reflected XSS Arbitrary code execution (CVSS 5.4, Adobe Experience Manager)
- [CVE-2022-42364](https://cve.now/CVE-2022-42364.md): AEM Reflected XSS Arbitrary code execution (CVSS 5.4, Adobe Experience Manager)
- [CVE-2022-42365](https://cve.now/CVE-2022-42365.md): AEM Reflected XSS Arbitrary code execution (CVSS 5.4, Adobe Experience Manager)
- [CVE-2022-44463](https://cve.now/CVE-2022-44463.md): AEM Reflected XSS Arbitrary code execution (CVSS 5.4, Adobe Experience Manager)
- [CVE-2022-44465](https://cve.now/CVE-2022-44465.md): AEM Reflected XSS Arbitrary code execution (CVSS 5.4, Adobe Experience Manager)
- [CVE-2022-44466](https://cve.now/CVE-2022-44466.md): AEM Reflected XSS Arbitrary code execution (CVSS 5.4, Adobe Experience Manager)
- [CVE-2022-44467](https://cve.now/CVE-2022-44467.md): AEM Reflected XSS Arbitrary code execution (CVSS 5.4, Adobe Experience Manager)
- [CVE-2022-44470](https://cve.now/CVE-2022-44470.md): AEM Reflected XSS Arbitrary code execution (CVSS 5.4, Adobe Experience Manager)
- [CVE-2022-44471](https://cve.now/CVE-2022-44471.md): AEM Reflected XSS Arbitrary code execution (CVSS 5.4, Adobe Experience Manager)
- [CVE-2022-44474](https://cve.now/CVE-2022-44474.md): AEM Reflected XSS Arbitrary code execution (CVSS 5.4, Adobe Experience Manager)
- [CVE-2022-44488](https://cve.now/CVE-2022-44488.md): AEM URL Redirection to Untrusted Site Security feature bypass (CVSS 3.5, Adobe Experience Manager)
- [CVE-2022-44643](https://cve.now/CVE-2022-44643.md): Access policy with access to all tenants and using label selectors has more access (CVSS 5.7)
- [CVE-2022-47512](https://cve.now/CVE-2022-47512.md): Sensitive Data Disclosure Vulnerability (CVSS 5.5, Hybrid Cloud Observability (HCO)/ SolarWinds Platform)
- [CVE-2020-36620](https://cve.now/CVE-2020-36620.md): Brondahl EnumStringValues EnumExtensions.cs GetStringValuesWithPreferences\_Uncache resource consumption (CVSS 3.5, Brondahl EnumStringValues · EnumStringValues)
- [CVE-2020-36621](https://cve.now/CVE-2020-36621.md): chedabob whatismyudid mobileconfig.js exports.enrollment cross site scripting (CVSS 3.5, chedabob whatismyudid)
- [CVE-2020-36622](https://cve.now/CVE-2020-36622.md): sah-comp bienlein cross-site request forgery (CVSS 4.3, sah-comp bienlein)
- [CVE-2020-36623](https://cve.now/CVE-2020-36623.md): Pengu index.js runApp cross-site request forgery (CVSS 4.3, Pengu)
- [CVE-2021-4263](https://cve.now/CVE-2021-4263.md): leanote history.js define cross site scripting (CVSS 3.5, leanote · github.com/leanote/leanote)
- [CVE-2021-4264](https://cve.now/CVE-2021-4264.md): LinkedIn dustjs prototype pollution (CVSS 6.3, LinkedIn dustjs · dustjs-linkedin)
- [CVE-2021-4265](https://cve.now/CVE-2021-4265.md): siwapp-ror cross site scripting (CVSS 3.5, siwapp-ror)
- [CVE-2021-4266](https://cve.now/CVE-2021-4266.md): Webdetails cpf DependenciesPackage.java cross site scripting (CVSS 3.5, Webdetails cpf)
- [CVE-2021-4267](https://cve.now/CVE-2021-4267.md): tad\_discuss cross site scripting (CVSS 3.5, tad\_discuss)
- [CVE-2021-4268](https://cve.now/CVE-2021-4268.md): phpRedisAdmin cross-site request forgery (CVSS 4.3, phpRedisAdmin)
- [CVE-2021-4269](https://cve.now/CVE-2021-4269.md): SimpleRisk common.js checkAndSetValidation cross site scripting (CVSS 3.5, SimpleRisk)
- [CVE-2021-4270](https://cve.now/CVE-2021-4270.md): Imprint CMS ViewHelpers.cs SearchForm cross site scripting (CVSS 3.5, Imprint CMS)
- [CVE-2021-4271](https://cve.now/CVE-2021-4271.md): panicsteve w2wiki Markdown index.php toHTML cross site scripting (CVSS 3.5, panicsteve w2wiki)
- [CVE-2021-4272](https://cve.now/CVE-2021-4272.md): studygolang topics.js cross site scripting (CVSS 3.5, studygolang · github.com/studygolang/studygolang)
- [CVE-2021-4273](https://cve.now/CVE-2021-4273.md): studygolang search.go Search cross site scripting (CVSS 4.3, studygolang)
- [CVE-2021-4274](https://cve.now/CVE-2021-4274.md): sileht bird-lg layout.html cross site scripting (CVSS 3.5, sileht bird-lg)
- [CVE-2021-4275](https://cve.now/CVE-2021-4275.md): katlings pyambic-pentameter cross-site request forgery (CVSS 4.3, katlings pyambic-pentameter)
- [CVE-2022-36221](https://cve.now/CVE-2022-36221.md): Nokia Fastmile 3tg00118abad52 is affected by an authenticated path traversal vulnerability which allows attackers to read any named pipe fil (CVSS 6.5)
- [CVE-2022-36222](https://cve.now/CVE-2022-36222.md): Nokia Fastmile 3tg00118abad52 devices shipped by Optus are shipped with a default hardcoded admin account of admin:Nq+L5st7o This account ca (CVSS 8.4)
- [CVE-2022-38546](https://cve.now/CVE-2022-38546.md): A DNS misconfiguration was found in Zyxel NBG7510 firmware versions prior to V1.00(ABZY.3)C0, which could allow an unauthenticated attacker (CVSS 5.3, Zyxel NBG7510 firmware)
- [CVE-2022-40841](https://cve.now/CVE-2022-40841.md): A cross-site scripting (XSS) vulnerability in NdkAdvancedCustomizationFields v3.5.0 allows attackers to execute arbitrary web scripts or HTM (CVSS 6.1)
- [CVE-2022-43543](https://cve.now/CVE-2022-43543.md): KDDI +Message App, NTT DOCOMO +Message App, and SoftBank +Message App contain a vulnerability caused by improper handling of Unicode control (CVSS 5.4, KDDI CORPORATION, NTT DOCOMO, INC., and SoftBank KDDI +Mess…)
- [CVE-2022-44449](https://cve.now/CVE-2022-44449.md): Stored cross-site scripting vulnerability in Zenphoto versions prior to 1.6 allows remote a remote authenticated attacker with an administra (CVSS 6.1, Zenphoto)
- [CVE-2022-46095](https://cve.now/CVE-2022-46095.md): Sourcecodester Covid-19 Directory on Vaccination System 1.0 was discovered to contain a Cross-Site Scripting (XSS) vulnerability via verific (CVSS 6.1)
- [CVE-2022-46096](https://cve.now/CVE-2022-46096.md): A Cross site scripting (XSS) vulnerability in Sourcecodester Online Covid-19 Directory on Vaccination System v1.0 allows attackers to execut (CVSS 6.1)
- [CVE-2022-4617](https://cve.now/CVE-2022-4617.md): Cross-site Scripting (XSS) - Reflected in microweber/microweber (CVSS 2.7, microweber/microweber)
- [CVE-2022-46282](https://cve.now/CVE-2022-46282.md): Use after free vulnerability in CX-Drive V3.00 and earlier allows a local attacker to execute arbitrary code by having a user to open a spec (CVSS 7.8, OMRON CX-Drive)
- [CVE-2022-4630](https://cve.now/CVE-2022-4630.md): Sensitive Cookie Without 'HttpOnly' Flag in lirantal/daloradius (CVSS 5.3, lirantal/daloradius)
- [CVE-2022-4631](https://cve.now/CVE-2022-4631.md): WP-Ban ban-options.php cross site scripting (CVSS 3.5, WP-Ban)
- [CVE-2022-4632](https://cve.now/CVE-2022-4632.md): Auto Upload Images cross site scripting (CVSS 3.5, Auto Upload Images)
- [CVE-2022-4633](https://cve.now/CVE-2022-4633.md): Auto Upload Images Settings setting-page.php cross-site request forgery (CVSS 4.3, Auto Upload Images)
- [CVE-2022-46330](https://cve.now/CVE-2022-46330.md): Squirrel.Windows is both a toolset and a library that provides installation and update functionality for Windows desktop applications. (CVSS 7.8, Installers generated by Squirrel.Windows)
- [CVE-2022-4637](https://cve.now/CVE-2022-4637.md): ep3-bs cross site scripting (CVSS 3.5, ep3-bs)
- [CVE-2022-4638](https://cve.now/CVE-2022-4638.md): collective.contact.widget widgets.py title cross site scripting (CVSS 3.5, collective.contact.widget · collective-contact-widget)
- [CVE-2022-4639](https://cve.now/CVE-2022-4639.md): sslh Packet Dumping probe.c hexdump format string (CVSS 5.6, sslh)
- [CVE-2022-4640](https://cve.now/CVE-2022-4640.md): Mingsoft MCMS Article save cross site scripting (CVSS 3.5, Mingsoft MCMS · net.mingsoft:ms-mcms)
- [CVE-2022-4641](https://cve.now/CVE-2022-4641.md): pig-vector LogisticRegression.java LogisticRegression temp file (CVSS 2.5, pig-vector)
- [CVE-2022-4642](https://cve.now/CVE-2022-4642.md): tatoeba2 Profile Name cross site scripting (CVSS 3.5, tatoeba2)
- [CVE-2022-4643](https://cve.now/CVE-2022-4643.md): docconv pdf\_ocr.go ConvertPDFImages os command injection (CVSS 6.3, docconv · code.sajari.com/docconv +1)
- [CVE-2022-46662](https://cve.now/CVE-2022-46662.md): Roxio Creator LJB starts another program with an unquoted file path. (CVSS 6.7, Corel Roxio Creator LJB)
- [CVE-2022-47581](https://cve.now/CVE-2022-47581.md): Isode M-Vault 16.0v0 through 17.x before 17.0v24 can crash upon an LDAP v1 bind request. (CVSS 7.5)
- [CVE-2022-47635](https://cve.now/CVE-2022-47635.md): Wildix WMS 6 before 6.02.20221216, WMS 5 before 5.04.20221214, and WMS4 before 4.04.45396.23 allows Server-side request forgery (SSRF) via Z (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-12-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.