# CVEs published 2022-12-25

45 CVEs were published on December 25, 2022: 5 critical, 13 high. Days are UTC.

- [CVE-2021-4280](https://cve.now/CVE-2021-4280.md): styler\_praat\_scripts Slash file\_segmenter.praat denial of service (CVSS 4.3, styler\_praat\_scripts)
- [CVE-2022-4741](https://cve.now/CVE-2022-4741.md): docconv XMLToText memory allocation (CVSS 4.3, docconv · github.com/sajari/docconv +1)
- [CVE-2021-4279](https://cve.now/CVE-2021-4279.md): Starcounter-Jack JSON-Patch prototype pollution (CVSS 6.3, Starcounter-Jack JSON-Patch · fast-json-patch)
- [CVE-2020-36632](https://cve.now/CVE-2020-36632.md): hughsk flat index.js unflatten prototype pollution (CVSS 6.3, hughsk flat · flat)
- [CVE-2022-4740](https://cve.now/CVE-2022-4740.md): kkFileView picturesPreview setWatermarkAttribute cross site scripting (CVSS 3.5, kkFileView)
- [CVE-2022-4739](https://cve.now/CVE-2022-4739.md): SourceCodester School Dormitory Management System Admin Login sql injection (CVSS 7.3, SourceCodester School Dormitory Management System)
- [CVE-2022-4738](https://cve.now/CVE-2022-4738.md): SourceCodester Blood Bank Management System User Registration cross site scripting (CVSS 4.3, SourceCodester Blood Bank Management System)
- [CVE-2022-4737](https://cve.now/CVE-2022-4737.md): SourceCodester Blood Bank Management System login.php sql injection (CVSS 7.3, SourceCodester Blood Bank Management System)
- [CVE-2020-36631](https://cve.now/CVE-2020-36631.md): barronwaffles dwc\_network\_server\_emulator gs\_database.py update\_profile sql injection (CVSS 6.3, barronwaffles dwc\_network\_server\_emulator)
- [CVE-2020-36630](https://cve.now/CVE-2020-36630.md): FreePBX cdr Cdr.class.php ajaxHandler sql injection (CVSS 5.5, FreePBX cdr)
- [CVE-2022-4736](https://cve.now/CVE-2022-4736.md): Venganzas del Pasado cross site scripting (CVSS 3.5, Venganzas del Pasado)
- [CVE-2019-25084](https://cve.now/CVE-2019-25084.md): Hide Files on GitHub options.js addEventListener cross site scripting (CVSS 3.5, Hide Files on GitHub)
- [CVE-2022-4735](https://cve.now/CVE-2022-4735.md): asrashley dash-live DOM Node media.js ready cross site scripting (CVSS 3.5, asrashley dash-live)
- [CVE-2021-4278](https://cve.now/CVE-2021-4278.md): cronvel tree-kit prototype pollution (CVSS 5.5, cronvel tree-kit · tree-kit)
- [CVE-2022-4731](https://cve.now/CVE-2022-4731.md): myapnea Title cross site scripting (CVSS 2.4, myapnea)
- [CVE-2021-4277](https://cve.now/CVE-2021-4277.md): fredsmith utils Filename screenshot\_sync predictable state (CVSS 2.6, fredsmith utils)
- [CVE-2020-36629](https://cve.now/CVE-2020-36629.md): SimbCo httpster server.coffee fs.realpathSync path traversal (CVSS 5.5, SimbCo httpster · httpster)
- [CVE-2020-36628](https://cve.now/CVE-2020-36628.md): Calsign APDE ZIP File CopyBuildTask.java handleExtract path traversal (CVSS 5.5, Calsign APDE)
- [CVE-2020-36627](https://cve.now/CVE-2020-36627.md): Macaron i18n i18n.go redirect (CVSS 5.5, Macaron i18n · github.com/go-macaron/i18n)
- [CVE-2021-4276](https://cve.now/CVE-2021-4276.md): \*\* UNSUPPORTED WHEN ASSIGNED \*\* A vulnerability was found in dns-stats hedgehog. (CVSS 4.1, dns-stats hedgehog)
- [CVE-2022-37706](https://cve.now/CVE-2022-37706.md): enlightenment\_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and the system library fun (CVSS 7.8)
- [CVE-2022-40005](https://cve.now/CVE-2022-40005.md): Intelbras WiFiber 120AC inMesh before 1-1-220826 allows command injection by authenticated users, as demonstrated by the /boaform/formPing6 (CVSS 8.8)
- [CVE-2022-41317](https://cve.now/CVE-2022-41317.md): An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. (CVSS 6.5)
- [CVE-2022-41318](https://cve.now/CVE-2022-41318.md): A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. (CVSS 8.6)
- [CVE-2022-42898](https://cve.now/CVE-2022-42898.md): PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (CVSS 8.8)
- [CVE-2022-42953](https://cve.now/CVE-2022-42953.md): Certain ZKTeco products (ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM) allow access to sensitive information via direct requests for the form (CVSS 7.5)
- [CVE-2022-44012](https://cve.now/CVE-2022-44012.md): An issue was discovered in /DS/LM\_API/api/SelectionService/InsertQueryWithActiveRelationsReturnId in Simmeth Lieferantenmanager before 5.6. (CVSS 5.4)
- [CVE-2022-44013](https://cve.now/CVE-2022-44013.md): An issue was discovered in Simmeth Lieferantenmanager before 5.6. (CVSS 9.1)
- [CVE-2022-44014](https://cve.now/CVE-2022-44014.md): An issue was discovered in Simmeth Lieferantenmanager before 5.6. (CVSS 6.5)
- [CVE-2022-44015](https://cve.now/CVE-2022-44015.md): An issue was discovered in Simmeth Lieferantenmanager before 5.6. (CVSS 9.8)
- [CVE-2022-44016](https://cve.now/CVE-2022-44016.md): An issue was discovered in Simmeth Lieferantenmanager before 5.6. (CVSS 7.5)
- [CVE-2022-44017](https://cve.now/CVE-2022-44017.md): An issue was discovered in Simmeth Lieferantenmanager before 5.6. (CVSS 7.5)
- [CVE-2022-44380](https://cve.now/CVE-2022-44380.md): Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting (XSS) for View Assigned Assets. (CVSS 5.4, snipe/snipe-it)
- [CVE-2022-44381](https://cve.now/CVE-2022-44381.md): Snipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response variations in a /password/reset request. (CVSS 5.3, snipe/snipe-it)
- [CVE-2022-44640](https://cve.now/CVE-2022-44640.md): Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1 codec used by the Key Distrib (CVSS 9.8)
- [CVE-2022-45197](https://cve.now/CVE-2022-45197.md): Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixm (CVSS 7.5, slixmpp)
- [CVE-2022-45889](https://cve.now/CVE-2022-45889.md): Planet eStream before 6.72.10.07 allows a remote attacker (who is a publisher or admin) to obtain access to all records stored in the databa (CVSS 7.2)
- [CVE-2022-45890](https://cve.now/CVE-2022-45890.md): In Planet eStream before 6.72.10.07, a Reflected Cross-Site Scripting (XSS) vulnerability exists via any metadata filter field (e.g., search (CVSS 6.1)
- [CVE-2022-45891](https://cve.now/CVE-2022-45891.md): Planet eStream before 6.72.10.07 allows attackers to call restricted functions, and perform unauthenticated uploads (Upload2.ashx) or access (CVSS 9.1)
- [CVE-2022-45892](https://cve.now/CVE-2022-45892.md): In Planet eStream before 6.72.10.07, multiple Stored Cross-Site Scripting (XSS) vulnerabilities exist: Disclaimer, Search Function, Comments (CVSS 5.4)
- [CVE-2022-45893](https://cve.now/CVE-2022-45893.md): Planet eStream before 6.72.10.07 allows a low-privileged user to gain access to administrative and high-privileged user accounts by changing (CVSS 8.8)
- [CVE-2022-45894](https://cve.now/CVE-2022-45894.md): GetFile.aspx in Planet eStream before 6.72.10.07 allows ..\\ directory traversal to read arbitrary local files. (CVSS 6.5)
- [CVE-2022-45895](https://cve.now/CVE-2022-45895.md): Planet eStream before 6.72.10.07 discloses sensitive information, related to the ON cookie (findable in HTML source code for Default.aspx in (CVSS 6.5)
- [CVE-2022-45896](https://cve.now/CVE-2022-45896.md): Planet eStream before 6.72.10.07 allows unauthenticated upload of arbitrary files: Choose a Video / Related Media or Upload Document. (CVSS 9.8)
- [CVE-2022-4734](https://cve.now/CVE-2022-4734.md): Improper Removal of Sensitive Information Before Storage or Transfer in usememos/memos (CVSS 8.1, usememos/memos · github.com/usememos/memos)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-12-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.