CVEs published December 23, 2022
106 CVEs were published on December 23, 2022: 28 critical, 42 high.
- Published
- 106
- Critical
- 28
- High
- 42
- Medium
- 35
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 25
Most affected products
- OpenImageIO Project OpenImageIO
- 24
- usememos/memos · github.com/usememos/memos
- 11
- IBM AIX
- 8
- ikus060/rdiffweb · rdiffweb
- 6
- properfraction Paid Membership Plugin, Ecommerce, User Regi…
- 2
- ActivityWatch Activity Watch
- 1
- Adobe Experience Manager
- 1
- ampache/ampache
- 1
- arasatasaygin is.js · is_js
- 1
- AVEVA InTouch Access Anywhere
- 1
Critical 28
- CVE-2022-38143A heap out-of-bounds write vulnerability exists in the way OpenImageIO v2.3.19.0 processes RLE encoded BMP images.OpenImageIO Project OpenImageIO
- CVE-2022-41639A heap based buffer overflow vulnerability exists in tile decoding code of TIFF image parser in OpenImageIO master-branch-9aeece7a and v2.3.OpenImageIO Project OpenImageIO
- CVE-2022-41654An authentication bypass vulnerability exists in the newsletter subscription functionality of Ghost Foundation Ghost 5.9.4.Ghost Foundation Ghost · ghost
- CVE-2022-41794A heap based buffer overflow vulnerability exists in the PSD thumbnail resource parsing code of OpenImageIO 2.3.19.0.OpenImageIO Project OpenImageIO
- CVE-2022-41837An out-of-bounds write vulnerability exists in the OpenImageIO::add_exif_item_to_spec functionality of OpenImageIO Project OpenImageIO v2.4.OpenImageIO Project OpenImageIO
- CVE-2022-41838A code execution vulnerability exists in the DDS scanline parsing functionality of OpenImageIO Project OpenImageIO v2.4.4.2.OpenImageIO Project OpenImageIO
- CVE-2021-32692Activity Watch vulnerable to command execution on macOS via printAppTitle.scptActivityWatch Activity Watch
- CVE-2022-28228Out-of-bounds read was discovered in YDB server.YDB
- CVE-2022-44567A command injection vulnerability exists in Rocket.Chat-Desktop <3.8.14 that could allow an attacker to pass a malicious url of openInternalRocket.chat - Electron Desktop
- CVE-2022-45706IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the hostname parameter in the formSetNetCheckTools function.
- CVE-2022-45707IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the rules parameter in the formAddDnsHijack function.
- CVE-2022-45708IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the sPortMapIndex parameter in the formDelPortMapping function
- CVE-2022-45709IP-COM M50 V15.11.0.33(10768) was discovered to contain multiple command injection vulnerabilities via the pEnable, pLevel, and pModule para
- CVE-2022-45710IP-COM M50 V15.11.0.33(10768) was discovered to contain multiple buffer overflows via the pEnable, pLevel, and pModule parameters in the for
- CVE-2022-45711IP-COM M50 V15.11.0.33(10768) was discovered to contain a command injection vulnerability via the hostname parameter in the formSetNetCheckT
- CVE-2022-45712IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the rules parameter in the formAddDnsForward function.
- CVE-2022-45714IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the indexSet parameter in the formQOSRuleDel function.
- CVE-2022-45715IP-COM M50 V15.11.0.33(10768) was discovered to contain multiple buffer overflows via the pLanPortRange and pWanPortRange parameters in the
- CVE-2022-45716IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the indexSet parameter in the formIPMacBindDel function.
- CVE-2022-45717IP-COM M50 V15.11.0.33(10768) was discovered to contain a command injection vulnerability via the usbPartitionName parameter in the formSetU
- CVE-2022-45718IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the rules parameter in the formIPMacBindAdd function.
- CVE-2022-45719IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the gotoUrl parameter in the formPortalAuth function.
- CVE-2022-45720IP-COM M50 V15.11.0.33(10768) was discovered to contain multiple buffer overflows via the ip, mac, and remark parameters in the formIPMacBin
- CVE-2022-45721IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the picName parameter in the formDelWewifiPic function.
- CVE-2022-46641D-Link DIR-846 A1_FW100A43 was discovered to contain a command injection vulnerability via the lan(0)_dhcps_staticlist parameter in the SetI
- CVE-2022-46642D-Link DIR-846 A1_FW100A43 was discovered to contain a command injection vulnerability via the auto_upgrade_hour parameter in the SetAutoUpg
- CVE-2022-47939An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2.
- CVE-2022-47945ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled (lang_switch_otopthink/framework
High 42
- CVE-2020-26302is.js is a general-purpose check library.arasatasaygin is.js · is_js
- CVE-2022-22184Junos OS and Junos OS Evolved: A BGP session will flap upon receipt of a specific, optional transitive attribute in version 22.3R1Juniper Networks Junos OS
- CVE-2022-41649A heap out of bounds read vulnerability exists in the handling of IPTC data while parsing TIFF images in OpenImageIO v2.3.19.0.OpenImageIO Project OpenImageIO
- CVE-2022-41684A heap out of bounds read vulnerability exists in the OpenImageIO master-branch-9aeece7a when parsing the image file directory part of a PSDOpenImageIO Project OpenImageIO
- CVE-2022-41981A stack-based buffer overflow vulnerability exists in the TGA file format parser of OpenImageIO v2.3.19.0.OpenImageIO Project OpenImageIO
- CVE-2022-41999A denial of service vulnerability exists in the DDS native tile reading functionality of OpenImageIO Project OpenImageIO v2.3.19.0 and v2.4.OpenImageIO Project OpenImageIO
- CVE-2022-43597Multiple memory corruption vulnerabilities exist in the IFFOutput alignment padding functionality of OpenImageIO Project OpenImageIO v2.4.4.OpenImageIO Project OpenImageIO
- CVE-2022-43598Multiple memory corruption vulnerabilities exist in the IFFOutput alignment padding functionality of OpenImageIO Project OpenImageIO v2.4.4.OpenImageIO Project OpenImageIO
- CVE-2022-43599Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2.OpenImageIO Project OpenImageIO
- CVE-2022-43600Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2.OpenImageIO Project OpenImageIO
- CVE-2022-43601Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2.OpenImageIO Project OpenImageIO
- CVE-2022-43602Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2.OpenImageIO Project OpenImageIO
- CVE-2022-23854AVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an unauthenticated userAVEVA InTouch Access Anywhere
- CVE-2022-41290IBM AIX privilege escalationIBM AIX
- CVE-2022-33324Denial-of-Service Vulnerability in Ethernet port of MELSEC iQ-R, iQ-L Series and MELIPC SeriesMitsubishi Electric MELSEC iQ-R Series R00CPU · Mitsubi… +25
- CVE-2022-28229The hash functionality in userver before 42059b6319661583b3080cab9b595d4f8ac48128 allows attackers to cause a denial of service via crafted userver
- CVE-2022-38757CVE-2022-38757 ZENworksMicro Focus ZENworks Configuration Management · Micro Fo… +2
- CVE-2022-43551A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP.https://github.com/curl/curl
- CVE-2022-46560D-Link DIR-882 DIR882A1_FW130B06, DIR-878 DIR_878_FW1.30B08 was discovered to contain a stack overflow via the Password parameter in the Set
- CVE-2022-46561D-Link DIR-882 DIR882A1_FW130B06, DIR-878 DIR_878_FW1.30B08 was discovered to contain a stack overflow via the Password parameter in the Set
- CVE-2022-46562D-Link DIR-882 DIR882A1_FW130B06, DIR-878 DIR_878_FW1.30B08 was discovered to contain a stack overflow via the PSK parameter in the SetQuick
- CVE-2022-46563D-Link DIR-882 DIR882A1_FW130B06, DIR-878 DIR_878_FW1.30B08 was discovered to contain a stack overflow via the Password parameter in the Set
- CVE-2022-46566D-Link DIR-882 DIR882A1_FW130B06, DIR-878 DIR_878_FW1.30B08 was discovered to contain a stack overflow via the Password parameter in the Set
- CVE-2022-46568D-Link DIR-882 DIR882A1_FW130B06, DIR-878 DIR_878_FW1.30B08 was discovered to contain a stack overflow via the AccountPassword parameter in
- CVE-2022-46569D-Link DIR-882 DIR882A1_FW130B06, DIR-878 DIR_878_FW1.30B08 was discovered to contain a stack overflow via the Key parameter in the SetWLanR
- CVE-2022-46570D-Link DIR-882 DIR882A1_FW130B06, DIR-878 DIR_878_FW1.30B08 was discovered to contain a stack overflow via the Password parameter in the Set
- CVE-2022-4684Improper Access Control in usememos/memosusememos/memos · github.com/usememos/memos
- CVE-2022-4686Authorization Bypass Through User-Controlled Key in usememos/memosusememos/memos · github.com/usememos/memos
- CVE-2022-4687Incorrect Use of Privileged APIs in usememos/memosusememos/memos · github.com/usememos/memos
- CVE-2022-4688Improper Authorization in usememos/memosusememos/memos · github.com/usememos/memos
- CVE-2022-4689Improper Access Control in usememos/memosusememos/memos · github.com/usememos/memos
- CVE-2022-4690Cross-site Scripting (XSS) - Stored in usememos/memosusememos/memos · github.com/usememos/memos
- CVE-2022-4691Cross-site Scripting (XSS) - Stored in usememos/memosusememos/memos · github.com/usememos/memos
- CVE-2022-4692Cross-site Scripting (XSS) - Stored in usememos/memosusememos/memos · github.com/usememos/memos
- CVE-2022-4695Cross-site Scripting (XSS) - Stored in usememos/memosusememos/memos · github.com/usememos/memos
- CVE-2022-4722Authentication Bypass by Primary Weakness in ikus060/rdiffwebikus060/rdiffweb · rdiffweb
- CVE-2022-4724Improper Access Control in ikus060/rdiffwebikus060/rdiffweb · rdiffweb
- CVE-2022-47633An image signature validation bypass vulnerability in Kyverno 1.8.3 and 1.8.4 allows a malicious image registry (or a man-in-the-middle attagithub.com/kyverno/kyverno
- CVE-2022-47940An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.18 before 5.18.18.
- CVE-2022-47941An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2.
- CVE-2022-47942An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2.
- CVE-2022-47943An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2.
Medium, low and unrated 36
- CVE-2022-25948Information Exposureliquidjs
- CVE-2022-36354A heap out-of-bounds read vulnerability exists in the RLA format parser of OpenImageIO master-branch-9aeece7a and v2.3.19.0.OpenImageIO Project OpenImageIO
- CVE-2022-41697A user enumeration vulnerability exists in the login functionality of Ghost Foundation Ghost 5.9.4.Ghost Foundation Ghost
- CVE-2022-41977An out of bounds read vulnerability exists in the way OpenImageIO version v2.3.19.0 processes string fields in TIFF image files.OpenImageIO Project OpenImageIO
- CVE-2022-41988An information disclosure vulnerability exists in the OpenImageIO::decode_iptc_iim() functionality of OpenImageIO Project OpenImageIO v2.3.1OpenImageIO Project OpenImageIO
- CVE-2022-43592An information disclosure vulnerability exists in the DPXOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2.OpenImageIO Project OpenImageIO
- CVE-2022-43593A denial of service vulnerability exists in the DPXOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2.OpenImageIO Project OpenImageIO
- CVE-2022-43594Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenImageIO v2.4.4.2.OpenImageIO Project OpenImageIO
- CVE-2022-43595Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenImageIO v2.4.4.2.OpenImageIO Project OpenImageIO
- CVE-2022-43596An information disclosure vulnerability exists in the IFFOutput channel interleaving functionality of OpenImageIO Project OpenImageIO v2.4.4OpenImageIO Project OpenImageIO
- CVE-2022-43603A denial of service vulnerability exists in the ZfileOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2.OpenImageIO Project OpenImageIO
- CVE-2022-44510AEM Reflected XSS Arbitrary code executionAdobe Experience Manager
- CVE-2022-39164IBM AIX denial of serviceIBM AIX
- CVE-2022-43849IBM AIX denial of serviceIBM AIX
- CVE-2022-43848IBM AIX denial of serviceIBM AIX
- CVE-2022-39165IBM AIX denial of serviceIBM AIX
- CVE-2022-40233IBM AIX denial of serviceIBM AIX
- CVE-2022-43380IBM AIX denial of serviceIBM AIX
- CVE-2022-43381IBM AIX denial of service IBM AIX
- CVE-2022-4697ProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scriptingproperfraction Paid Membership Plugin, Ecommerce, User Regi…
- CVE-2022-4698ProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Form Settingsproperfraction Paid Membership Plugin, Ecommerce, User Regi…
- CVE-2022-23547Heap buffer overflow in pjproject when decoding STUN messagepjsip pjproject
- CVE-2022-46171Tauri vulnerable to path traversaltauri-apps tauri · tauri
- CVE-2022-40011Typora through 1.3.8 allows XSS if a document containing an SVG element with an attacker-controlled onload attribute is exported and then us
- CVE-2022-44565An improper access validation vulnerability exists in airMAX AC <8.7.11, airFiber 60/LR <2.6.2, airFiber 60 XG/HD <v1.0.0 and airFiber GBE <UISP Wireless
- CVE-2022-46492nbnbk commit 879858451d53261d10f77d4709aee2d01c72c301 was discovered to contain an arbitrary file read vulnerability via the component /api/
- CVE-2022-4665Unrestricted Upload of File with Dangerous Type in ampache/ampacheampache/ampache
- CVE-2022-4683Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in usememos/memosusememos/memos · github.com/usememos/memos
- CVE-2022-4694Cross-site Scripting (XSS) - Stored in usememos/memosusememos/memos · github.com/usememos/memos
- CVE-2022-4719Business Logic Errors in ikus060/rdiffwebikus060/rdiffweb · rdiffweb
- CVE-2022-4720Open Redirect in ikus060/rdiffwebikus060/rdiffweb · rdiffweb
- CVE-2022-4721Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in ikus060/rdiffwebikus060/rdiffweb · rdiffweb
- CVE-2022-4723Allocation of Resources Without Limits or Throttling in ikus060/rdiffwebikus060/rdiffweb · rdiffweb
- CVE-2022-47524F-Secure SAFE Browser 19.1 before 19.2 for Android allows an IDN homograph attack.
- CVE-2022-47938An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2.
- CVE-2022-47946An issue was discovered in the Linux kernel 5.10.x before 5.10.155.