CVEs published December 27, 2022
80 CVEs were published on December 27, 2022: 13 critical, 25 high.
- Published
- 80
- Critical
- 13
- High
- 25
- Medium
- 17
- Low
- 25
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 57
Most affected products
- DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016D…
- 10
- OpenMRS Admin UI Module
- 3
- FlatPress
- 2
- github.com/peterzen/goresolver
- 2
- openmrs-module-referenceapplication
- 2
- TrueConf Server
- 2
- aahframe.work · github.com/go-aah/aah
- 1
- cloudsync
- 1
- cocagne pysrp · srp
- 1
- code.cloudfoundry.org/archiver/extractor · code.cloudfou… +1
- 1
Critical 13
- CVE-2021-4238Insufficient randomness in github.com/Masterminds/goutilsgithub.com/Masterminds/goutils
- CVE-2021-4236Panic or authentication bypass in github.com/ecnepsnai/webgithub.com/ecnepsnai/web
- CVE-2020-36566Path traversal in github.com/whyrusleeping/tar-utilsgithub.com/whyrusleeping/tar-utils
- CVE-2020-36561Path traversal in github.com/yi-ge/unzipgithub.com/yi-ge/unzip
- CVE-2020-36560Path traversal in github.com/artdarek/go-unzipgithub.com/artdarek/go-unzip
- CVE-2018-25046Path traversal in code.cloudfoundry.org/archivercode.cloudfoundry.org/archiver/extractor · code.cloudfou… +1
- CVE-2014-125026Out-of-bounds write in github.com/cloudflare/golz4github.com/cloudflare/golz4
- CVE-2017-20146Improper access control in github.com/gorilla/handlersgithub.com/gorilla/handlers
- CVE-2020-36569Authentication bypass in github.com/nanobox-io/golang-nanoauthgithub.com/nanobox-io/golang-nanoauth
- CVE-2022-45778https://www.hillstonenet.com.cn/ Hillstone Firewall SG-6000 <= 5.0.4.0 is vulnerable to Incorrect Access Control.
- CVE-2022-45963h3c firewall <= 3.10 ESS6703 has a privilege bypass vulnerability.
- CVE-2022-46442dedecms <=V5.7.102 is vulnerable to SQL Injection.
- CVE-2022-46764A SQL injection issue in the web API in TrueConf Server 5.2.0.10225 (fixed in 5.2.6.10025) allows remote unauthenticated attackers to executTrueConf Server
High 25
- CVE-2022-23544Server-Side Request Forgery in Metersphere leads to Cross-Site Scriptingmetersphere
- CVE-2022-41967Improper Restriction of XML External Entity Reference in DragonflyHyperaDev Dragonfly
- CVE-2022-41966XStream Denial of Service via stack overflow x-stream xstream · com.thoughtworks.xstream:xstream
- CVE-2022-3347Incorrect validation of root DNSSEC public keys in github.com/peterzen/goresolvergithub.com/peterzen/goresolver
- CVE-2022-3064Excessive resource consumption in gopkg.in/yaml.v2gopkg.in/yaml.v2
- CVE-2021-4239Weak encryption and denial of service in github.com/flynn/noisegithub.com/flynn/noise
- CVE-2022-2584Panic when decoding invalid blocks in github.com/ipld/go-codec-dagpbgithub.com/ipld/go-codec-dagpb
- CVE-2020-36564Improper input validation in github.com/justinas/nosurfgithub.com/justinas/nosurf
- CVE-2016-15005Cryptographically weak random number generation in github.com/dinever/golfgithub.com/dinever/golf
- CVE-2020-36562Uncontrolled Resource Consumption in github.com/shiyanhui/dhtgithub.com/shiyanhui/dht
- CVE-2019-25072Uncontrolled resource consumption in github.com/tendermint/tendermintgithub.com/tendermint/tendermint/rpc/lib/client · github.co…
- CVE-2020-36559Path Traversal in aahframe.workaahframe.work · github.com/go-aah/aah
- CVE-2019-25073Path traversal in github.com/goadesign/goagithub.com/goadesign/goa · goa.design/goa +1
- CVE-2013-10005Infinite loop in github.com/btcsuite/go-socksgithub.com/btcsuite/go-socks · github.com/btcsuitereleases/…
- CVE-2015-10004Timing side-channel in github.com/robbert229/jwtgithub.com/robbert229/jwt
- CVE-2020-36568Resource exhaustion in github.com/revel/revelgithub.com/revel/revel
- CVE-2020-36567Arbitrary log line injection in github.com/gin-gonic/gingithub.com/gin-gonic/gin
- CVE-2022-3156Rockwell Automation Studio 5000 Logix Emulate Vulnerable to a Remote Code Execution VulnerabilityRockwell Automation Studio 5000 Logix Emulate
- CVE-2022-45423Some Dahua software products have a vulnerability of unauthenticated request of MQTT credentials.DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016D…
- CVE-2022-45425Some Dahua software products have a vulnerability of using of hard-coded cryptographic key.DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016D…
- CVE-2022-45427Some Dahua software products have a vulnerability of unrestricted upload of file.DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016D…
- CVE-2022-45429Some Dahua software products have a vulnerability of server-side request forgery (SSRF).DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016D…
- CVE-2022-45431Some Dahua software products have a vulnerability of unauthenticated restart of remote DSS Server.DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016D…
- CVE-2022-46763A SQL injection issue in a database stored function in TrueConf Server 5.2.0.10225 (fixed in 5.2.6.10025) allows a low-privileged database uTrueConf Server
- CVE-2022-4767Denial of Service in usememos/memosusememos/memos · github.com/usememos/memos
Medium, low and unrated 42
- CVE-2022-4773cloudsync LocalFilesystemConnector.java getItem path traversalcloudsync
- CVE-2020-36636OpenMRS Admin UI Module Account Setup AccountPageController.java sendErrorMessage cross site scriptingOpenMRS Admin UI Module
- CVE-2021-4292OpenMRS Admin UI Module Manage Privilege Page privilege.gsp cross site scriptingOpenMRS Admin UI Module
- CVE-2021-4291OpenMRS Admin UI Module location.gsp cross site scriptingOpenMRS Admin UI Module
- CVE-2020-36635OpenMRS Appointment Scheduling Module AppointmentTypeValidator.java validateFieldName cross site scriptingOpenMRS Appointment Scheduling Module
- CVE-2022-4772Widoco WidocoUtils.java unZipIt path traversalWidoco · com.github.dgarijo:Widoco
- CVE-2019-25091nsupdate.info CSRF Cookie base.py cookie httponly flagnsupdate.info · nsupdate
- CVE-2021-4290DHBW Fallstudie Login passport.js sql injectionDHBW Fallstudie
- CVE-2022-4768Dropbox merou SSH Public Key public_key.py add_public_key injectionDropbox merou
- CVE-2022-3346Incorrect DNSSEC validation due to unchecked owner names in github.com/peterzen/goresolvergithub.com/peterzen/goresolver
- CVE-2022-2583Race condition in github.com/ntbosscher/gobasegithub.com/ntbosscher/gobase/auth/httpauth · github.com/ntb…
- CVE-2022-2582Exposure of unencrypted plaintext hash in github.com/aws/aws-sdk-gogithub.com/aws/aws-sdk-go/service/s3/s3crypto · github.com/…
- CVE-2021-4235Denial of service in gopkg.in/yaml.v2gopkg.in/yaml.v2 · github.com/go-yaml/yaml
- CVE-2020-36563Weak hash (SHA-1) in github.com/RobotsAndPencils/go-samlgithub.com/RobotsAndPencils/go-saml
- CVE-2021-4289OpenMRS openmrs-module-referenceapplication User App Page UserAppPageController.java post cross site scriptingopenmrs-module-referenceapplication
- CVE-2020-36634Indeed Engineering util ViewExportedVariablesServlet.java appendTo cross site scriptingIndeed Engineering util
- CVE-2021-4288OpenMRS openmrs-module-referenceapplication userApp.gsp cross site scriptingopenmrs-module-referenceapplication
- CVE-2022-4766dolibarr_project_timesheet Form cross-site request forgerydolibarr_project_timesheet
- CVE-2020-36633moodle-block_sitenews block_sitenews.php get_content cross-site request forgerymoodle-block_sitenews
- CVE-2019-25090FreePBX arimanager Views cross site scriptingFreePBX arimanager
- CVE-2019-25089Morgawr Muon handler.clj random valuesMorgawr Muon
- CVE-2021-4287ReFirm Labs binwalk Archive Extraction extractor.py symlinkReFirm Labs binwalk · binwalk
- CVE-2021-4286cocagne pysrp _ctsrp.py calculate_x information exposurecocagne pysrp · srp
- CVE-2021-4285Nagios NCPA tail.html cross site scriptingNagios NCPA
- CVE-2021-4284OpenMRS HTML Form Entry UI Framework Integration Module cross site scriptingOpenMRS HTML Form Entry UI Framework Integration Module
- CVE-2021-4283FreeBPX voicemail Settings ssettings.php cross site scriptingFreeBPX voicemail
- CVE-2021-4282FreePBX voicemail page.voicemail.php cross site scriptingFreePBX voicemail
- CVE-2019-25088ytti Oxidized Web conf_search.haml cross site scriptingytti Oxidized Web · oxidized-web
- CVE-2022-4755FlatPress Media Manager Plugin panel.mediamanager.file.php main cross site scriptingFlatPress
- CVE-2019-25087RamseyK httpserver URI ResourceHost.cpp getResource path traversalRamseyK httpserver
- CVE-2019-25086IET-OU Open Media Player timedtext.php webvtt cross site scriptingIET-OU Open Media Player
- CVE-2022-4748FlatPress File Delete panel.mediamanager.file.php doItemActions path traversalFlatPress
- CVE-2018-25049email-existence index.js redosemail-existence
- CVE-2015-10005markdown-it html_re.js redosmarkdown-it
- CVE-2022-45424Some Dahua software products have a vulnerability of unauthenticated request of AES crypto key.DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016D…
- CVE-2022-45426Some Dahua software products have a vulnerability of unrestricted download of file.DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016D…
- CVE-2022-45428Some Dahua software products have a vulnerability of sensitive information leakage.DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016…
- CVE-2022-45430Some Dahua software products have a vulnerability of unauthenticated enable or disable SSHD service.DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016D…
- CVE-2022-45432Some Dahua software products have a vulnerability of unauthenticated search for devices.DSS Professional、DSS Express、DHI-DSS7016D-S2/DHI-DSS7016DR-…
- CVE-2022-45433Some Dahua software products have a vulnerability of unauthenticated traceroute host from remote DSS Server.DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016D…
- CVE-2022-45434Some Dahua software products have a vulnerability of unauthenticated un-throttled ICMP requests on remote DSS Server.DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016D…
- CVE-2022-47968Heimdall Application Dashboard through 2.5.4 allows reflected and stored XSS via "Application name" to the "Add application" page.