# CVEs published 2022-12-26

88 CVEs were published on December 26, 2022: 13 critical, 17 high. Days are UTC.

- [CVE-2021-4281](https://cve.now/CVE-2021-4281.md): Brave UX for-the-badge combine-prs.yml os command injection (CVSS 4.6, Brave UX for-the-badge)
- [CVE-2021-24942](https://cve.now/CVE-2021-24942.md): Menu Item Visibility Control \<= 0.5 - Admin+ Arbitrary PHP Code Execution (CVSS 7.2, Menu Item Visibility Control)
- [CVE-2022-4239](https://cve.now/CVE-2022-4239.md): Workreap \< 2.6.4 - Subscriber+ Arbitrary Posts Deletion via IDOR (CVSS 6.5, Workreap)
- [CVE-2022-4120](https://cve.now/CVE-2022-4120.md): Stop Spammers Security \< 2022.6 - Unauthenticated PHP Object Injection (CVSS 9.8, Stop Spammers Security | Block Spam Users, Comments, Forms)
- [CVE-2022-4242](https://cve.now/CVE-2022-4242.md): WP Google Review Slider \< 11.6 - Admin+ Stored XSS (CVSS 4.8, WP Google Review Slider)
- [CVE-2022-3835](https://cve.now/CVE-2022-3835.md): Kwayy HTML Sitemap \< 4.0 - Admin+ Stored XSS (CVSS 4.8, Kwayy HTML Sitemap)
- [CVE-2022-4160](https://cve.now/CVE-2022-4160.md): Contest Gallery \< 19.1.5 - Author+ SQL Injection (CVSS 6.5, Contest Gallery)
- [CVE-2022-4151](https://cve.now/CVE-2022-4151.md): Contest Gallery \< 19.1.5 - Admin+ SQL Injection (CVSS 6.5, Contest Gallery)
- [CVE-2022-4159](https://cve.now/CVE-2022-4159.md): Contest Gallery \< 19.1.5.1 - Author+ SQL Injection (CVSS 6.5, Contest Gallery)
- [CVE-2022-4152](https://cve.now/CVE-2022-4152.md): Contest Gallery \< 19.1.5 - Author+ SQL Injection (CVSS 6.5, Contest Gallery)
- [CVE-2022-4266](https://cve.now/CVE-2022-4266.md): Bulk Delete Users by Email \<= 1.2 - User Deletion via CSRF (CVSS 6.5, Bulk Delete Users by Email)
- [CVE-2022-4047](https://cve.now/CVE-2022-4047.md): Return Refund and Exchange For WooCommerce \< 4.0.9 - Unauthenticated Arbitrary File Upload (CVSS 9.8, Return Refund and Exchange For WooCommerce)
- [CVE-2022-4226](https://cve.now/CVE-2022-4226.md): Simple Basic Contact Form \< 20221201 - Admin+ Stored XSS (CVSS 4.8, Simple Basic Contact Form)
- [CVE-2022-4110](https://cve.now/CVE-2022-4110.md): Eventify \<= 2.1 - Admin+ Stored XSS (CVSS 4.8, Eventify™)
- [CVE-2022-4227](https://cve.now/CVE-2022-4227.md): Booster for WooCommerce - Reflected Cross-Site Scripting (CVSS 6.1, Booster for WooCommerce · Booster Plus for WooCommerce +1)
- [CVE-2022-4162](https://cve.now/CVE-2022-4162.md): Contest Gallery \< 19.1.5 - Author+ SQL Injection (CVSS 6.5, Contest Gallery)
- [CVE-2022-4164](https://cve.now/CVE-2022-4164.md): Contest Gallery \< 19.1.5 - Author+ SQL Injection (CVSS 6.5, Contest Gallery)
- [CVE-2022-3840](https://cve.now/CVE-2022-3840.md): Google Apps Login \< 3.4.5 - Admin+ Stored XSS (CVSS 4.8, Login for Google Apps)
- [CVE-2022-4117](https://cve.now/CVE-2022-4117.md): IWS - Geo Form Fields \<= 1.0 - Unauthenticated SQLi (CVSS 9.8, IWS)
- [CVE-2022-4156](https://cve.now/CVE-2022-4156.md): Contest Gallery \< 19.1.5.1 - Unauthenticated SQL Injection (CVSS 7.5, Contest Gallery)
- [CVE-2022-4267](https://cve.now/CVE-2022-4267.md): Bulk Delete Users by Email \<= 1.2 - Reflected Cross-Site Scripting (CVSS 6.1, Bulk Delete Users by Email)
- [CVE-2022-4154](https://cve.now/CVE-2022-4154.md): Contest Gallery Pro \< 19.1.5 - Admin+ SQL Injection (CVSS 4.9, Contest Gallery Pro)
- [CVE-2022-4163](https://cve.now/CVE-2022-4163.md): Contest Gallery \< 19.1.5 - Author+ SQL Injection (CVSS 6.5, Contest Gallery)
- [CVE-2022-4166](https://cve.now/CVE-2022-4166.md): Contest Gallery \< 19.1.5 - Author+ SQL Injection (CVSS 6.5, Contest Gallery)
- [CVE-2022-4150](https://cve.now/CVE-2022-4150.md): Contest Gallery \< 19.1.5 - Author+ SQL Injection (CVSS 6.5, Contest Gallery)
- [CVE-2022-4158](https://cve.now/CVE-2022-4158.md): Contest Gallery \< 19.1.5 - Unauthenticated SQL Injection (CVSS 7.5, Contest Gallery)
- [CVE-2022-4165](https://cve.now/CVE-2022-4165.md): Contest Gallery \< 19.1.5 - Author+ SQL Injection (CVSS 6.5, Contest Gallery)
- [CVE-2022-4197](https://cve.now/CVE-2022-4197.md): Sliderby10Web \< 1.2.53 - Admin+ Stored XSS (CVSS 4.8, Sliderby10Web)
- [CVE-2022-4243](https://cve.now/CVE-2022-4243.md): ImageInject \<= 1.17 - Admin+ Stored XSS (CVSS 4.8, ImageInject)
- [CVE-2022-4042](https://cve.now/CVE-2022-4042.md): Paytium \< 4.3.7 - Admin+ Stored XSS (CVSS 4.8, Paytium: Mollie payment forms & donations)
- [CVE-2022-4155](https://cve.now/CVE-2022-4155.md): Contest Gallery \< 19.1.5 - Admin+ SQL Injection (CVSS 4.9, Contest Gallery)
- [CVE-2022-4157](https://cve.now/CVE-2022-4157.md): Contest Gallery \< 19.1.5 - Admin+ SQL Injection (CVSS 4.9, Contest Gallery)
- [CVE-2022-4153](https://cve.now/CVE-2022-4153.md): Contest Gallery \< 19.1.5.1 - Author+ SQL Injection (CVSS 6.5, Contest Gallery)
- [CVE-2022-4268](https://cve.now/CVE-2022-4268.md): Plugin Logic \< 1.0.8 - Admin+ SQLi (CVSS 7.2, Plugin Logic)
- [CVE-2022-4161](https://cve.now/CVE-2022-4161.md): Contest Gallery \< 19.1.5 - Author+ SQL Injection (CVSS 6.5, Contest Gallery)
- [CVE-2022-4742](https://cve.now/CVE-2022-4742.md): json-pointer index.js set prototype pollution (CVSS 6.3, json-pointer)
- [CVE-2019-25085](https://cve.now/CVE-2019-25085.md): GNOME gvdb gvdb-builder.c gvdb\_table\_write\_contents\_async use after free (CVSS 6.3, GNOME gvdb)
- [CVE-2018-16135](https://cve.now/CVE-2018-16135.md): The Opera Mini application 47.1.2249.129326 for Android allows remote attackers to spoof the Location Permission dialog via a crafted web si (CVSS 6.5)
- [CVE-2019-11851](https://cve.now/CVE-2019-11851.md): The ACENet service in Sierra Wireless ALEOS before 4.4.9, 4.5.x through 4.9.x before 4.9.5, and 4.10.x through 4.13.x before 4.14.0 allows r (CVSS 9.8)
- [CVE-2019-13988](https://cve.now/CVE-2019-13988.md): Sierra Wireless MGOS before 3.15.2 and 4.x before 4.3 allows attackers to read log files via a Direct Request (aka Forced Browsing). (CVSS 6.5)
- [CVE-2019-14802](https://cve.now/CVE-2019-14802.md): HashiCorp Nomad 0.5.0 through 0.9.4 (fixed in 0.9.5) reveals unintended environment variables to the rendering task during template renderin (CVSS 5.3, github.com/hashicorp/nomad)
- [CVE-2019-18177](https://cve.now/CVE-2019-18177.md): In certain Citrix products, information disclosure can be achieved by an authenticated VPN user when there is a configured SSL VPN endpoint. (CVSS 6.5)
- [CVE-2019-19030](https://cve.now/CVE-2019-19030.md): Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows resource enumeration because unauthenticated API calls re (CVSS 5.3, github.com/goharbor/harbor)
- [CVE-2019-19705](https://cve.now/CVE-2019-19705.md): Realtek Audio Drivers for Windows, as used on the Lenovo ThinkPad X1 Carbon 20A7, 20A8, 20BS, and 20BT before 6.0.8882.1 and 20KH and 20KG b (CVSS 7.8)
- [CVE-2019-9011](https://cve.now/CVE-2019-9011.md): In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), an attacker can identify valid usernames. (CVSS 5.3)
- [CVE-2019-9579](https://cve.now/CVE-2019-9579.md): An issue was discovered in Illumos in Nexenta NexentaStor 4.0.5 and 5.1.2, and other products. (CVSS 8.1)
- [CVE-2020-10650](https://cve.now/CVE-2020-10650.md): A deserialization flaw was discovered in jackson-databind through 2.9.10.4. (CVSS 8.1, com.fasterxml.jackson.core:jackson-databind)
- [CVE-2020-11101](https://cve.now/CVE-2020-11101.md): Sierra Wireless AirLink Mobility Manager (AMM) before 2.17 mishandles sessions and thus an unauthenticated attacker can obtain a login sessi (CVSS 9.8)
- [CVE-2020-12067](https://cve.now/CVE-2020-12067.md): In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), a user's password may be changed by an attacker withou (CVSS 7.5)
- [CVE-2020-12069](https://cve.now/CVE-2020-12069.md): CODESYS V3 prone to Inadequate Password Hashing (CVSS 7.8, CODESYS V3 containing the CmpUserMgr)
- [CVE-2020-24600](https://cve.now/CVE-2020-24600.md): Shilpi CAPExWeb 1.1 allows SQL injection via a servlet/capexweb.cap\_sendMail GET request. (CVSS 9.8)
- [CVE-2020-28191](https://cve.now/CVE-2020-28191.md): The console in Togglz before 2.9.4 allows CSRF. (CVSS 8.8, org.togglz:togglz-console)
- [CVE-2021-30134](https://cve.now/CVE-2021-30134.md): php-mod/curl (a wrapper of the PHP cURL extension) before 2.3.2 allows XSS via the post\_file\_path\_upload.php key parameter and the POST data (CVSS 6.1, php-mod/curl)
- [CVE-2021-35065](https://cve.now/CVE-2021-35065.md): The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular e (CVSS 7.5, glob-parent)
- [CVE-2021-35951](https://cve.now/CVE-2021-35951.md): fastrack Reflex 2.0 W307S\_REFLEX\_v90.89 Activity Tracker allows an Unauthenticated Remote attacker to send a malicious firmware update via B (CVSS 7.5)
- [CVE-2021-35952](https://cve.now/CVE-2021-35952.md): fastrack Reflex 2.0 W307S\_REFLEX\_v90.89 Activity Tracker allows a Remote attacker to change the time, date, and month via Bluetooth LE Chara (CVSS 5.3)
- [CVE-2021-35953](https://cve.now/CVE-2021-35953.md): fastrack Reflex 2.0 W307S\_REFLEX\_v90.89 Activity Tracker allows a Remote attacker to cause a Denial of Service (device outage) via crafted c (CVSS 7.5)
- [CVE-2021-35954](https://cve.now/CVE-2021-35954.md): fastrack Reflex 2.0 W307S\_REFLEX\_v90.89 Activity Tracker allows physically proximate attackers to dump the firmware, flash custom malicious (CVSS 8.1)
- [CVE-2021-38561](https://cve.now/CVE-2021-38561.md): golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. (CVSS 7.5, golang.org/x/text)
- [CVE-2021-39369](https://cve.now/CVE-2021-39369.md): In Philips (formerly Carestream) Vue MyVue PACS through 12.2.x.x, the VideoStream function allows Path Traversal by authenticated users to a (CVSS 6.5)
- [CVE-2021-43395](https://cve.now/CVE-2021-43395.md): An issue was discovered in illumos before f859e7171bb5db34321e45585839c6c3200ebb90, OmniOS Community Edition r151038, OpenIndiana Hipster 20 (CVSS 5.5)
- [CVE-2021-44758](https://cve.now/CVE-2021-44758.md): Heimdal before 7.7.1 allows attackers to cause a NULL pointer dereference in a SPNEGO acceptor via a preferred\_mech\_type of GSS\_C\_NO\_OID and (CVSS 7.5)
- [CVE-2021-44854](https://cve.now/CVE-2021-44854.md): An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. (CVSS 5.3)
- [CVE-2021-44855](https://cve.now/CVE-2021-44855.md): An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. (CVSS 5.4)
- [CVE-2021-44856](https://cve.now/CVE-2021-44856.md): An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. (CVSS 5.3)
- [CVE-2021-45466](https://cve.now/CVE-2021-45466.md): In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, attackers can make a crafted request to api/?api=add\_server&DHCP= to a (CVSS 9.8)
- [CVE-2021-45467](https://cve.now/CVE-2021-45467.md): In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.ph (CVSS 9.8)
- [CVE-2022-24116](https://cve.now/CVE-2022-24116.md): Certain General Electric Renewable Energy products have inadequate encryption strength. (CVSS 9.8)
- [CVE-2022-24117](https://cve.now/CVE-2022-24117.md): Certain General Electric Renewable Energy products download firmware without an integrity check. (CVSS 9.8)
- [CVE-2022-24118](https://cve.now/CVE-2022-24118.md): Certain General Electric Renewable Energy products allow attackers to use a code to trigger a reboot into the factory default configuration. (CVSS 9.1)
- [CVE-2022-24119](https://cve.now/CVE-2022-24119.md): Certain General Electric Renewable Energy products have a hidden feature for unauthenticated remote access to the device configuration shell (CVSS 9.8)
- [CVE-2022-24120](https://cve.now/CVE-2022-24120.md): Certain General Electric Renewable Energy products store cleartext credentials in flash memory. (CVSS 4.6)
- [CVE-2022-26964](https://cve.now/CVE-2022-26964.md): Weak password derivation for export in Devolutions Remote Desktop Manager before 2022.1 allows information disclosure via a password brute-f (CVSS 7.4)
- [CVE-2022-26969](https://cve.now/CVE-2022-26969.md): In Directus before 9.7.0, the default settings of CORS\_ORIGIN and CORS\_ENABLED are true. (CVSS 9.8, directus)
- [CVE-2022-29852](https://cve.now/CVE-2022-29852.md): OX App Suite through 8.2 allows XSS because BMFreehand10 and image/x-freehand are not blocked. (CVSS 5.4)
- [CVE-2022-29853](https://cve.now/CVE-2022-29853.md): OX App Suite through 8.2 allows XSS via a certain complex hierarchy that forces use of Show Entire Message for a huge HTML e-mail message. (CVSS 5.4)
- [CVE-2022-30260](https://cve.now/CVE-2022-30260.md): Emerson DeltaV Distributed Control System (DCS) has insufficient verification of firmware integrity (an inadequate checksum approach, and no (no CVSS)
- [CVE-2022-31469](https://cve.now/CVE-2022-31469.md): OX App Suite through 7.10.6 allows XSS via a deep link, as demonstrated by class="deep-link-app" for a /#!!&app=%2e./ URI. (CVSS 6.1)
- [CVE-2022-36664](https://cve.now/CVE-2022-36664.md): Password Manager for IIS 2.0 has a cross-site scripting (XSS) vulnerability via the /isapi/PasswordManager.dll ResultURL parameter. (CVSS 6.1)
- [CVE-2022-37307](https://cve.now/CVE-2022-37307.md): OX App Suite through 7.10.6 allows XSS via XHTML CDATA for a snippet, as demonstrated by the onerror attribute of an IMG element within an e (CVSS 6.1)
- [CVE-2022-37308](https://cve.now/CVE-2022-37308.md): OX App Suite through 7.10.6 allows XSS via HTML in text/plain e-mail messages. (CVSS 6.1)
- [CVE-2022-37309](https://cve.now/CVE-2022-37309.md): OX App Suite through 7.10.6 allows XSS via script code within a contact that has an e-mail address but lacks a name. (CVSS 6.1)
- [CVE-2022-37310](https://cve.now/CVE-2022-37310.md): OX App Suite through 7.10.6 allows XSS via a malicious capability to the metrics or help module, as demonstrated by a /#!!&app=io.ox/files&c (CVSS 6.1)
- [CVE-2022-37311](https://cve.now/CVE-2022-37311.md): OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large location request parameter to the redirect servlet. (CVSS 5.3)
- [CVE-2022-37312](https://cve.now/CVE-2022-37312.md): OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large request body containing a redirect URL to the deferrer servlet (CVSS 5.3)
- [CVE-2022-37313](https://cve.now/CVE-2022-37313.md): OX App Suite through 7.10.6 allows SSRF because the anti-SSRF protection mechanism only checks the first DNS AA or AAAA record. (CVSS 5.3)
- [CVE-2022-41765](https://cve.now/CVE-2022-41765.md): An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3. (CVSS 5.3)
- [CVE-2022-41767](https://cve.now/CVE-2022-41767.md): An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3. (CVSS 5.3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-12-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.