CVEs published December 28, 2022
55 CVEs were published on December 28, 2022: 4 critical, 21 high.
- Published
- 55
- Critical
- 4
- High
- 21
- Medium
- 15
- Low
- 15
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 45
Most affected products
- usememos/memos · github.com/usememos/memos
- 19
- FlatPress
- 3
- Huawei Aslan-AL10
- 3
- elvexys StreamX
- 2
- goauthentik authentik
- 2
- stevespringett alpine · us.springett:alpine
- 2
- aws efs-utils · github.com/kubernetes-sigs/aws-efs-csi-driv…
- 1
- Broken Link Checker
- 1
- Catalyst-Plugin-Session
- 1
- centic9 jgit-cookbook
- 1
Critical 4
- CVE-2022-46179LiuOS vulnerable to Authorization Bypass through User-Controlled KeyLiuWoodsCode LiuOS
- CVE-2022-23555authentik vulnerable to Improper Authentication via invitation URL token reusegoauthentik authentik
- CVE-2022-4797Improper Restriction of Excessive Authentication Attempts in usememos/memosusememos/memos · github.com/usememos/memos
- CVE-2022-4802Authorization Bypass Through User-Controlled Key in usememos/memosusememos/memos · github.com/usememos/memos
High 21
- CVE-2022-23553URL access filters bypass in Alpinestevespringett alpine · us.springett:alpine
- CVE-2022-4779authentication bypass in elvexys StreamX using StreamView HTML component with public web server featureelvexys StreamX
- CVE-2022-46173Elrond go Processing: fallback search of SCRs when not found in the main cacheElrondNetwork elrond-go · github.com/ElrondNetwork/elrond-go
- CVE-2022-38202BUG-000152121 - Directory traversal vulnerability in ArcGIS Server.Esri ArcGIS Server
- CVE-2022-39012Huawei Aslan Children's Watch has an improper input validation vulnerability.Huawei Aslan-AL10
- CVE-2022-44564Huawei Aslan Children's Watch has a path traversal vulnerability.Huawei Aslan-AL10
- CVE-2022-4796Incorrect Use of Privileged APIs in usememos/memosusememos/memos · github.com/usememos/memos
- CVE-2022-4798Authorization Bypass Through User-Controlled Key in usememos/memosusememos/memos · github.com/usememos/memos
- CVE-2022-4799Authorization Bypass Through User-Controlled Key in usememos/memosusememos/memos · github.com/usememos/memos
- CVE-2022-4800Improper Verification of Source of a Communication Channel in usememos/memosusememos/memos · github.com/usememos/memos
- CVE-2022-4801Insufficient Granularity of Access Control in usememos/memosusememos/memos · github.com/usememos/memos
- CVE-2022-4803Authorization Bypass Through User-Controlled Key in usememos/memosusememos/memos · github.com/usememos/memos
- CVE-2022-4804Improper Authorization in usememos/memosusememos/memos · github.com/usememos/memos
- CVE-2022-4805Incorrect Use of Privileged APIs in usememos/memosusememos/memos · github.com/usememos/memos
- CVE-2022-4806Authorization Bypass Through User-Controlled Key in usememos/memosusememos/memos · github.com/usememos/memos
- CVE-2022-4807Improper Access Control in usememos/memosusememos/memos · github.com/usememos/memos
- CVE-2022-4809Improper Access Control in usememos/memosusememos/memos · github.com/usememos/memos
- CVE-2022-4811Authorization Bypass Through User-Controlled Key in usememos/memosusememos/memos · github.com/usememos/memos
- CVE-2022-4812Authorization Bypass Through User-Controlled Key in usememos/memosusememos/memos · github.com/usememos/memos
- CVE-2022-4813Insufficient Granularity of Access Control in usememos/memosusememos/memos · github.com/usememos/memos
- CVE-2022-4814Improper Access Control in usememos/memosusememos/memos · github.com/usememos/memos
Medium, low and unrated 30
- CVE-2022-4823InSTEDD Nuntium geopoll_controller.rb timing discrepancyInSTEDD Nuntium
- CVE-2022-4822FlatPress Setup main.lib.php cross site scriptingFlatPress
- CVE-2022-4821FlatPress XML File Handler/MD File admin.uploader.php onupload cross site scriptingFlatPress
- CVE-2022-4820FlatPress Admin Area admin.entry.list.php cross site scriptingFlatPress
- CVE-2022-4819HotCRP cross site scriptingHotCRP
- CVE-2022-4818Talend Open Studio for MDM SystemStorageWrapper.java xml external entity referenceTalend Open Studio for MDM
- CVE-2018-25057simple_php_link_shortener index.php sql injectionsimple_php_link_shortener
- CVE-2017-20150challenge website sql injectionchallenge website
- CVE-2022-4817centic9 jgit-cookbook temp filecentic9 jgit-cookbook
- CVE-2022-23554Authentication bypass in Alpinestevespringett alpine · us.springett:alpine
- CVE-2021-4294OpenShift OSIN CheckClientSecret timing discrepancyOpenShift OSIN · github.com/openshift/osin
- CVE-2022-4780hard coded credentials in elvexys ISOS firmwareselvexys ISOS
- CVE-2022-4778path traversal in elvexys StreamX using StreamView HTML component with public web server featureelvexys StreamX
- CVE-2018-25056yolapi metadata.py render_description cross site scriptingyolapi
- CVE-2018-25055FarCry Solr Pro Plugin Search solrProSearch.cfc cross site scriptingFarCry Solr Pro Plugin
- CVE-2018-25054shred cilla Search search.jsp cross site scriptingshred cilla
- CVE-2018-25053moappi Json2html json2html.js cross site scriptingmoappi Json2html · node-json2html
- CVE-2018-25052Catalyst-Plugin-Session Session ID Session.pm _load_sessionid cross site scriptingCatalyst-Plugin-Session
- CVE-2018-25051JmPotato Pomash editor.html cross site scriptingJmPotato Pomash
- CVE-2022-3922Broken Link Checker < 1.11.20 - Admin+ Cross-Site ScriptingBroken Link Checker
- CVE-2018-25050Harvest Chosen abstract-chosen.coffee AbstractChosen cross site scriptingHarvest Chosen · harvesthq/chosen
- CVE-2019-25092Nakiami Mellivora Admin Panel user.inc.php print_user_ip_log cross site scriptingNakiami Mellivora
- CVE-2021-4293gnuboard youngcart5 menu_list_update.php cross site scriptinggnuboard youngcart5
- CVE-2022-46174Race condition during concurrent TLS mounts in efs-utilsaws efs-utils · github.com/kubernetes-sigs/aws-efs-csi-driv…
- CVE-2022-46172authentik allows existing authenticated users to create arbitrary accountsgoauthentik authentik
- CVE-2022-41579There is an insufficient authentication vulnerability in some Huawei band products.Huawei HOTA-Fara-B19
- CVE-2022-45874Huawei Aslan Children's Watch has an improper authorization vulnerability.Huawei Aslan-AL10
- CVE-2022-46740There is a denial of service vulnerability in the Wi-Fi module of the HUAWEI WS7100-20 Smart WiFi Router.Successful exploit could cause a deHuawei WS7100-20
- CVE-2022-4808Improper Privilege Management in usememos/memosusememos/memos · github.com/usememos/memos
- CVE-2022-4810Improper Access Control in usememos/memosusememos/memos · github.com/usememos/memos