CVEs published December 25, 2022
45 CVEs were published on December 25, 2022: 5 critical, 13 high.
- Published
- 45
- Critical
- 5
- High
- 13
- Medium
- 21
- Low
- 6
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 17
Most affected products
- snipe/snipe-it
- 2
- SourceCodester Blood Bank Management System
- 2
- asrashley dash-live
- 1
- barronwaffles dwc_network_server_emulator
- 1
- Calsign APDE
- 1
- cronvel tree-kit · tree-kit
- 1
- dns-stats hedgehog
- 1
- docconv · github.com/sajari/docconv +1
- 1
- fredsmith utils
- 1
- FreePBX cdr
- 1
Critical 5
- CVE-2022-44013An issue was discovered in Simmeth Lieferantenmanager before 5.6.
- CVE-2022-44015An issue was discovered in Simmeth Lieferantenmanager before 5.6.
- CVE-2022-44640Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1 codec used by the Key Distrib
- CVE-2022-45891Planet eStream before 6.72.10.07 allows attackers to call restricted functions, and perform unauthenticated uploads (Upload2.ashx) or access
- CVE-2022-45896Planet eStream before 6.72.10.07 allows unauthenticated upload of arbitrary files: Choose a Video / Related Media or Upload Document.
High 13
- CVE-2022-4739SourceCodester School Dormitory Management System Admin Login sql injectionSourceCodester School Dormitory Management System
- CVE-2022-4737SourceCodester Blood Bank Management System login.php sql injectionSourceCodester Blood Bank Management System
- CVE-2022-37706enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and the system library fun
- CVE-2022-40005Intelbras WiFiber 120AC inMesh before 1-1-220826 allows command injection by authenticated users, as demonstrated by the /boaform/formPing6
- CVE-2022-41318A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6.
- CVE-2022-42898PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution
- CVE-2022-42953Certain ZKTeco products (ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM) allow access to sensitive information via direct requests for the form
- CVE-2022-44016An issue was discovered in Simmeth Lieferantenmanager before 5.6.
- CVE-2022-44017An issue was discovered in Simmeth Lieferantenmanager before 5.6.
- CVE-2022-45197Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixmslixmpp
- CVE-2022-45889Planet eStream before 6.72.10.07 allows a remote attacker (who is a publisher or admin) to obtain access to all records stored in the databa
- CVE-2022-45893Planet eStream before 6.72.10.07 allows a low-privileged user to gain access to administrative and high-privileged user accounts by changing
- CVE-2022-4734Improper Removal of Sensitive Information Before Storage or Transfer in usememos/memosusememos/memos · github.com/usememos/memos
Medium, low and unrated 27
- CVE-2021-4280styler_praat_scripts Slash file_segmenter.praat denial of servicestyler_praat_scripts
- CVE-2022-4741docconv XMLToText memory allocationdocconv · github.com/sajari/docconv +1
- CVE-2021-4279Starcounter-Jack JSON-Patch prototype pollutionStarcounter-Jack JSON-Patch · fast-json-patch
- CVE-2020-36632hughsk flat index.js unflatten prototype pollutionhughsk flat · flat
- CVE-2022-4740kkFileView picturesPreview setWatermarkAttribute cross site scriptingkkFileView
- CVE-2022-4738SourceCodester Blood Bank Management System User Registration cross site scriptingSourceCodester Blood Bank Management System
- CVE-2020-36631barronwaffles dwc_network_server_emulator gs_database.py update_profile sql injectionbarronwaffles dwc_network_server_emulator
- CVE-2020-36630FreePBX cdr Cdr.class.php ajaxHandler sql injectionFreePBX cdr
- CVE-2022-4736Venganzas del Pasado cross site scriptingVenganzas del Pasado
- CVE-2019-25084Hide Files on GitHub options.js addEventListener cross site scriptingHide Files on GitHub
- CVE-2022-4735asrashley dash-live DOM Node media.js ready cross site scriptingasrashley dash-live
- CVE-2021-4278cronvel tree-kit prototype pollutioncronvel tree-kit · tree-kit
- CVE-2022-4731myapnea Title cross site scriptingmyapnea
- CVE-2021-4277fredsmith utils Filename screenshot_sync predictable statefredsmith utils
- CVE-2020-36629SimbCo httpster server.coffee fs.realpathSync path traversalSimbCo httpster · httpster
- CVE-2020-36628Calsign APDE ZIP File CopyBuildTask.java handleExtract path traversalCalsign APDE
- CVE-2020-36627Macaron i18n i18n.go redirectMacaron i18n · github.com/go-macaron/i18n
- CVE-2021-4276** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in dns-stats hedgehog.dns-stats hedgehog
- CVE-2022-41317An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6.
- CVE-2022-44012An issue was discovered in /DS/LM_API/api/SelectionService/InsertQueryWithActiveRelationsReturnId in Simmeth Lieferantenmanager before 5.6.
- CVE-2022-44014An issue was discovered in Simmeth Lieferantenmanager before 5.6.
- CVE-2022-44380Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting (XSS) for View Assigned Assets.snipe/snipe-it
- CVE-2022-44381Snipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response variations in a /password/reset request.snipe/snipe-it
- CVE-2022-45890In Planet eStream before 6.72.10.07, a Reflected Cross-Site Scripting (XSS) vulnerability exists via any metadata filter field (e.g., search
- CVE-2022-45892In Planet eStream before 6.72.10.07, multiple Stored Cross-Site Scripting (XSS) vulnerabilities exist: Disclaimer, Search Function, Comments
- CVE-2022-45894GetFile.aspx in Planet eStream before 6.72.10.07 allows ..\ directory traversal to read arbitrary local files.
- CVE-2022-45895Planet eStream before 6.72.10.07 discloses sensitive information, related to the ON cookie (findable in HTML source code for Default.aspx in