# CVEs published 2022-12-27

80 CVEs were published on December 27, 2022: 13 critical, 25 high. Days are UTC.

- [CVE-2022-23544](https://cve.now/CVE-2022-23544.md): Server-Side Request Forgery in Metersphere leads to Cross-Site Scripting (CVSS 7.2, metersphere)
- [CVE-2022-41967](https://cve.now/CVE-2022-41967.md): Improper Restriction of XML External Entity Reference in Dragonfly (CVSS 7.0, HyperaDev Dragonfly)
- [CVE-2022-41966](https://cve.now/CVE-2022-41966.md): XStream Denial of Service via stack overflow (CVSS 8.2, x-stream xstream · com.thoughtworks.xstream:xstream)
- [CVE-2022-4773](https://cve.now/CVE-2022-4773.md): cloudsync LocalFilesystemConnector.java getItem path traversal (CVSS 2.5, cloudsync)
- [CVE-2020-36636](https://cve.now/CVE-2020-36636.md): OpenMRS Admin UI Module Account Setup AccountPageController.java sendErrorMessage cross site scripting (CVSS 3.5, OpenMRS Admin UI Module)
- [CVE-2021-4292](https://cve.now/CVE-2021-4292.md): OpenMRS Admin UI Module Manage Privilege Page privilege.gsp cross site scripting (CVSS 3.5, OpenMRS Admin UI Module)
- [CVE-2021-4291](https://cve.now/CVE-2021-4291.md): OpenMRS Admin UI Module location.gsp cross site scripting (CVSS 3.5, OpenMRS Admin UI Module)
- [CVE-2020-36635](https://cve.now/CVE-2020-36635.md): OpenMRS Appointment Scheduling Module AppointmentTypeValidator.java validateFieldName cross site scripting (CVSS 3.5, OpenMRS Appointment Scheduling Module)
- [CVE-2022-4772](https://cve.now/CVE-2022-4772.md): Widoco WidocoUtils.java unZipIt path traversal (CVSS 4.5, Widoco · com.github.dgarijo:Widoco)
- [CVE-2019-25091](https://cve.now/CVE-2019-25091.md): nsupdate.info CSRF Cookie base.py cookie httponly flag (CVSS 3.7, nsupdate.info · nsupdate)
- [CVE-2021-4290](https://cve.now/CVE-2021-4290.md): DHBW Fallstudie Login passport.js sql injection (CVSS 5.5, DHBW Fallstudie)
- [CVE-2022-4768](https://cve.now/CVE-2022-4768.md): Dropbox merou SSH Public Key public\_key.py add\_public\_key injection (CVSS 6.3, Dropbox merou)
- [CVE-2022-3347](https://cve.now/CVE-2022-3347.md): Incorrect validation of root DNSSEC public keys in github.com/peterzen/goresolver (CVSS 7.5, github.com/peterzen/goresolver)
- [CVE-2022-3346](https://cve.now/CVE-2022-3346.md): Incorrect DNSSEC validation due to unchecked owner names in github.com/peterzen/goresolver (CVSS 6.5, github.com/peterzen/goresolver)
- [CVE-2022-3064](https://cve.now/CVE-2022-3064.md): Excessive resource consumption in gopkg.in/yaml.v2 (CVSS 7.5, gopkg.in/yaml.v2)
- [CVE-2021-4239](https://cve.now/CVE-2021-4239.md): Weak encryption and denial of service in github.com/flynn/noise (CVSS 7.5, github.com/flynn/noise)
- [CVE-2022-2584](https://cve.now/CVE-2022-2584.md): Panic when decoding invalid blocks in github.com/ipld/go-codec-dagpb (CVSS 7.5, github.com/ipld/go-codec-dagpb)
- [CVE-2021-4238](https://cve.now/CVE-2021-4238.md): Insufficient randomness in github.com/Masterminds/goutils (CVSS 9.1, github.com/Masterminds/goutils)
- [CVE-2022-2583](https://cve.now/CVE-2022-2583.md): Race condition in github.com/ntbosscher/gobase (CVSS 3.7, github.com/ntbosscher/gobase/auth/httpauth · github.com/ntb…)
- [CVE-2022-2582](https://cve.now/CVE-2022-2582.md): Exposure of unencrypted plaintext hash in github.com/aws/aws-sdk-go (CVSS 4.3, github.com/aws/aws-sdk-go/service/s3/s3crypto · github.com/…)
- [CVE-2021-4236](https://cve.now/CVE-2021-4236.md): Panic or authentication bypass in github.com/ecnepsnai/web (CVSS 9.8, github.com/ecnepsnai/web)
- [CVE-2020-36566](https://cve.now/CVE-2020-36566.md): Path traversal in github.com/whyrusleeping/tar-utils (CVSS 9.1, github.com/whyrusleeping/tar-utils)
- [CVE-2021-4235](https://cve.now/CVE-2021-4235.md): Denial of service in gopkg.in/yaml.v2 (CVSS 5.5, gopkg.in/yaml.v2 · github.com/go-yaml/yaml)
- [CVE-2020-36564](https://cve.now/CVE-2020-36564.md): Improper input validation in github.com/justinas/nosurf (CVSS 7.5, github.com/justinas/nosurf)
- [CVE-2020-36563](https://cve.now/CVE-2020-36563.md): Weak hash (SHA-1) in github.com/RobotsAndPencils/go-saml (CVSS 5.3, github.com/RobotsAndPencils/go-saml)
- [CVE-2016-15005](https://cve.now/CVE-2016-15005.md): Cryptographically weak random number generation in github.com/dinever/golf (CVSS 8.8, github.com/dinever/golf)
- [CVE-2020-36562](https://cve.now/CVE-2020-36562.md): Uncontrolled Resource Consumption in github.com/shiyanhui/dht (CVSS 7.5, github.com/shiyanhui/dht)
- [CVE-2019-25072](https://cve.now/CVE-2019-25072.md): Uncontrolled resource consumption in github.com/tendermint/tendermint (CVSS 7.5, github.com/tendermint/tendermint/rpc/lib/client · github.co…)
- [CVE-2020-36561](https://cve.now/CVE-2020-36561.md): Path traversal in github.com/yi-ge/unzip (CVSS 9.1, github.com/yi-ge/unzip)
- [CVE-2020-36560](https://cve.now/CVE-2020-36560.md): Path traversal in github.com/artdarek/go-unzip (CVSS 9.1, github.com/artdarek/go-unzip)
- [CVE-2020-36559](https://cve.now/CVE-2020-36559.md): Path Traversal in aahframe.work (CVSS 7.5, aahframe.work · github.com/go-aah/aah)
- [CVE-2019-25073](https://cve.now/CVE-2019-25073.md): Path traversal in github.com/goadesign/goa (CVSS 7.5, github.com/goadesign/goa · goa.design/goa +1)
- [CVE-2018-25046](https://cve.now/CVE-2018-25046.md): Path traversal in code.cloudfoundry.org/archiver (CVSS 9.1, code.cloudfoundry.org/archiver/extractor · code.cloudfou… +1)
- [CVE-2013-10005](https://cve.now/CVE-2013-10005.md): Infinite loop in github.com/btcsuite/go-socks (CVSS 7.5, github.com/btcsuite/go-socks · github.com/btcsuitereleases/…)
- [CVE-2015-10004](https://cve.now/CVE-2015-10004.md): Timing side-channel in github.com/robbert229/jwt (CVSS 7.5, github.com/robbert229/jwt)
- [CVE-2014-125026](https://cve.now/CVE-2014-125026.md): Out-of-bounds write in github.com/cloudflare/golz4 (CVSS 9.8, github.com/cloudflare/golz4)
- [CVE-2017-20146](https://cve.now/CVE-2017-20146.md): Improper access control in github.com/gorilla/handlers (CVSS 9.8, github.com/gorilla/handlers)
- [CVE-2020-36569](https://cve.now/CVE-2020-36569.md): Authentication bypass in github.com/nanobox-io/golang-nanoauth (CVSS 9.1, github.com/nanobox-io/golang-nanoauth)
- [CVE-2020-36568](https://cve.now/CVE-2020-36568.md): Resource exhaustion in github.com/revel/revel (CVSS 7.5, github.com/revel/revel)
- [CVE-2020-36567](https://cve.now/CVE-2020-36567.md): Arbitrary log line injection in github.com/gin-gonic/gin (CVSS 7.5, github.com/gin-gonic/gin)
- [CVE-2022-3156](https://cve.now/CVE-2022-3156.md): Rockwell Automation Studio 5000 Logix Emulate Vulnerable to a Remote Code Execution Vulnerability (CVSS 7.8, Rockwell Automation Studio 5000 Logix Emulate)
- [CVE-2021-4289](https://cve.now/CVE-2021-4289.md): OpenMRS openmrs-module-referenceapplication User App Page UserAppPageController.java post cross site scripting (CVSS 3.5, openmrs-module-referenceapplication)
- [CVE-2020-36634](https://cve.now/CVE-2020-36634.md): Indeed Engineering util ViewExportedVariablesServlet.java appendTo cross site scripting (CVSS 2.6, Indeed Engineering util)
- [CVE-2021-4288](https://cve.now/CVE-2021-4288.md): OpenMRS openmrs-module-referenceapplication userApp.gsp cross site scripting (CVSS 3.5, openmrs-module-referenceapplication)
- [CVE-2022-4766](https://cve.now/CVE-2022-4766.md): dolibarr\_project\_timesheet Form cross-site request forgery (CVSS 4.3, dolibarr\_project\_timesheet)
- [CVE-2020-36633](https://cve.now/CVE-2020-36633.md): moodle-block\_sitenews block\_sitenews.php get\_content cross-site request forgery (CVSS 4.3, moodle-block\_sitenews)
- [CVE-2019-25090](https://cve.now/CVE-2019-25090.md): FreePBX arimanager Views cross site scripting (CVSS 3.5, FreePBX arimanager)
- [CVE-2019-25089](https://cve.now/CVE-2019-25089.md): Morgawr Muon handler.clj random values (CVSS 3.1, Morgawr Muon)
- [CVE-2021-4287](https://cve.now/CVE-2021-4287.md): ReFirm Labs binwalk Archive Extraction extractor.py symlink (CVSS 5.0, ReFirm Labs binwalk · binwalk)
- [CVE-2021-4286](https://cve.now/CVE-2021-4286.md): cocagne pysrp \_ctsrp.py calculate\_x information exposure (CVSS 2.6, cocagne pysrp · srp)
- [CVE-2021-4285](https://cve.now/CVE-2021-4285.md): Nagios NCPA tail.html cross site scripting (CVSS 3.5, Nagios NCPA)
- [CVE-2021-4284](https://cve.now/CVE-2021-4284.md): OpenMRS HTML Form Entry UI Framework Integration Module cross site scripting (CVSS 3.5, OpenMRS HTML Form Entry UI Framework Integration Module)
- [CVE-2021-4283](https://cve.now/CVE-2021-4283.md): FreeBPX voicemail Settings ssettings.php cross site scripting (CVSS 2.4, FreeBPX voicemail)
- [CVE-2021-4282](https://cve.now/CVE-2021-4282.md): FreePBX voicemail page.voicemail.php cross site scripting (CVSS 3.5, FreePBX voicemail)
- [CVE-2019-25088](https://cve.now/CVE-2019-25088.md): ytti Oxidized Web conf\_search.haml cross site scripting (CVSS 3.5, ytti Oxidized Web · oxidized-web)
- [CVE-2022-4755](https://cve.now/CVE-2022-4755.md): FlatPress Media Manager Plugin panel.mediamanager.file.php main cross site scripting (CVSS 3.5, FlatPress)
- [CVE-2019-25087](https://cve.now/CVE-2019-25087.md): RamseyK httpserver URI ResourceHost.cpp getResource path traversal (CVSS 5.3, RamseyK httpserver)
- [CVE-2019-25086](https://cve.now/CVE-2019-25086.md): IET-OU Open Media Player timedtext.php webvtt cross site scripting (CVSS 3.5, IET-OU Open Media Player)
- [CVE-2022-4748](https://cve.now/CVE-2022-4748.md): FlatPress File Delete panel.mediamanager.file.php doItemActions path traversal (CVSS 5.5, FlatPress)
- [CVE-2018-25049](https://cve.now/CVE-2018-25049.md): email-existence index.js redos (CVSS 3.0, email-existence)
- [CVE-2015-10005](https://cve.now/CVE-2015-10005.md): markdown-it html\_re.js redos (CVSS 3.5, markdown-it)
- [CVE-2022-45423](https://cve.now/CVE-2022-45423.md): Some Dahua software products have a vulnerability of unauthenticated request of MQTT credentials. (CVSS 7.5, DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016D…)
- [CVE-2022-45424](https://cve.now/CVE-2022-45424.md): Some Dahua software products have a vulnerability of unauthenticated request of AES crypto key. (CVSS 5.3, DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016D…)
- [CVE-2022-45425](https://cve.now/CVE-2022-45425.md): Some Dahua software products have a vulnerability of using of hard-coded cryptographic key. (CVSS 7.5, DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016D…)
- [CVE-2022-45426](https://cve.now/CVE-2022-45426.md): Some Dahua software products have a vulnerability of unrestricted download of file. (CVSS 6.5, DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016D…)
- [CVE-2022-45427](https://cve.now/CVE-2022-45427.md): Some Dahua software products have a vulnerability of unrestricted upload of file. (CVSS 7.2, DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016D…)
- [CVE-2022-45428](https://cve.now/CVE-2022-45428.md): Some Dahua software products have a vulnerability of sensitive information leakage. (CVSS 2.7, DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016…)
- [CVE-2022-45429](https://cve.now/CVE-2022-45429.md): Some Dahua software products have a vulnerability of server-side request forgery (SSRF). (CVSS 7.5, DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016D…)
- [CVE-2022-45430](https://cve.now/CVE-2022-45430.md): Some Dahua software products have a vulnerability of unauthenticated enable or disable SSHD service. (CVSS 3.7, DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016D…)
- [CVE-2022-45431](https://cve.now/CVE-2022-45431.md): Some Dahua software products have a vulnerability of unauthenticated restart of remote DSS Server. (CVSS 7.5, DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016D…)
- [CVE-2022-45432](https://cve.now/CVE-2022-45432.md): Some Dahua software products have a vulnerability of unauthenticated search for devices. (CVSS 5.3, DSS Professional、DSS Express、DHI-DSS7016D-S2/DHI-DSS7016DR-…)
- [CVE-2022-45433](https://cve.now/CVE-2022-45433.md): Some Dahua software products have a vulnerability of unauthenticated traceroute host from remote DSS Server. (CVSS 3.7, DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016D…)
- [CVE-2022-45434](https://cve.now/CVE-2022-45434.md): Some Dahua software products have a vulnerability of unauthenticated un-throttled ICMP requests on remote DSS Server. (CVSS 5.9, DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016D…)
- [CVE-2022-45778](https://cve.now/CVE-2022-45778.md): https://www.hillstonenet.com.cn/ Hillstone Firewall SG-6000 \<= 5.0.4.0 is vulnerable to Incorrect Access Control. (CVSS 9.8)
- [CVE-2022-45963](https://cve.now/CVE-2022-45963.md): h3c firewall \<= 3.10 ESS6703 has a privilege bypass vulnerability. (CVSS 9.8)
- [CVE-2022-46442](https://cve.now/CVE-2022-46442.md): dedecms \<=V5.7.102 is vulnerable to SQL Injection. (CVSS 9.8)
- [CVE-2022-46763](https://cve.now/CVE-2022-46763.md): A SQL injection issue in a database stored function in TrueConf Server 5.2.0.10225 (fixed in 5.2.6.10025) allows a low-privileged database u (CVSS 8.8, TrueConf Server)
- [CVE-2022-46764](https://cve.now/CVE-2022-46764.md): A SQL injection issue in the web API in TrueConf Server 5.2.0.10225 (fixed in 5.2.6.10025) allows remote unauthenticated attackers to execut (CVSS 9.8, TrueConf Server)
- [CVE-2022-4767](https://cve.now/CVE-2022-4767.md): Denial of Service in usememos/memos (CVSS 7.6, usememos/memos · github.com/usememos/memos)
- [CVE-2022-47968](https://cve.now/CVE-2022-47968.md): Heimdall Application Dashboard through 2.5.4 allows reflected and stored XSS via "Application name" to the "Add application" page. (CVSS 5.4)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-12-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.