# CVEs published 2022-12-28

55 CVEs were published on December 28, 2022: 4 critical, 21 high. Days are UTC.

- [CVE-2022-4823](https://cve.now/CVE-2022-4823.md): InSTEDD Nuntium geopoll\_controller.rb timing discrepancy (CVSS 3.1, InSTEDD Nuntium)
- [CVE-2022-4822](https://cve.now/CVE-2022-4822.md): FlatPress Setup main.lib.php cross site scripting (CVSS 2.4, FlatPress)
- [CVE-2022-4821](https://cve.now/CVE-2022-4821.md): FlatPress XML File Handler/MD File admin.uploader.php onupload cross site scripting (CVSS 2.4, FlatPress)
- [CVE-2022-4820](https://cve.now/CVE-2022-4820.md): FlatPress Admin Area admin.entry.list.php cross site scripting (CVSS 3.5, FlatPress)
- [CVE-2022-4819](https://cve.now/CVE-2022-4819.md): HotCRP cross site scripting (CVSS 2.4, HotCRP)
- [CVE-2022-4818](https://cve.now/CVE-2022-4818.md): Talend Open Studio for MDM SystemStorageWrapper.java xml external entity reference (CVSS 5.5, Talend Open Studio for MDM)
- [CVE-2018-25057](https://cve.now/CVE-2018-25057.md): simple\_php\_link\_shortener index.php sql injection (CVSS 5.5, simple\_php\_link\_shortener)
- [CVE-2017-20150](https://cve.now/CVE-2017-20150.md): challenge website sql injection (CVSS 5.5, challenge website)
- [CVE-2022-4817](https://cve.now/CVE-2022-4817.md): centic9 jgit-cookbook temp file (CVSS 3.1, centic9 jgit-cookbook)
- [CVE-2022-23554](https://cve.now/CVE-2022-23554.md): Authentication bypass in Alpine (CVSS 6.5, stevespringett alpine · us.springett:alpine)
- [CVE-2022-23553](https://cve.now/CVE-2022-23553.md): URL access filters bypass in Alpine (CVSS 7.5, stevespringett alpine · us.springett:alpine)
- [CVE-2021-4294](https://cve.now/CVE-2021-4294.md): OpenShift OSIN CheckClientSecret timing discrepancy (CVSS 2.6, OpenShift OSIN · github.com/openshift/osin)
- [CVE-2022-4780](https://cve.now/CVE-2022-4780.md): hard coded credentials in elvexys ISOS firmwares (CVSS 4.5, elvexys ISOS)
- [CVE-2022-4779](https://cve.now/CVE-2022-4779.md): authentication bypass in elvexys StreamX using StreamView HTML component with public web server feature (CVSS 7.5, elvexys StreamX)
- [CVE-2022-4778](https://cve.now/CVE-2022-4778.md): path traversal in elvexys StreamX using StreamView HTML component with public web server feature (CVSS 6.5, elvexys StreamX)
- [CVE-2018-25056](https://cve.now/CVE-2018-25056.md): yolapi metadata.py render\_description cross site scripting (CVSS 3.5, yolapi)
- [CVE-2018-25055](https://cve.now/CVE-2018-25055.md): FarCry Solr Pro Plugin Search solrProSearch.cfc cross site scripting (CVSS 3.5, FarCry Solr Pro Plugin)
- [CVE-2018-25054](https://cve.now/CVE-2018-25054.md): shred cilla Search search.jsp cross site scripting (CVSS 3.5, shred cilla)
- [CVE-2018-25053](https://cve.now/CVE-2018-25053.md): moappi Json2html json2html.js cross site scripting (CVSS 4.3, moappi Json2html · node-json2html)
- [CVE-2018-25052](https://cve.now/CVE-2018-25052.md): Catalyst-Plugin-Session Session ID Session.pm \_load\_sessionid cross site scripting (CVSS 3.5, Catalyst-Plugin-Session)
- [CVE-2018-25051](https://cve.now/CVE-2018-25051.md): JmPotato Pomash editor.html cross site scripting (CVSS 2.4, JmPotato Pomash)
- [CVE-2022-3922](https://cve.now/CVE-2022-3922.md): Broken Link Checker \< 1.11.20 - Admin+ Cross-Site Scripting (CVSS 4.8, Broken Link Checker)
- [CVE-2018-25050](https://cve.now/CVE-2018-25050.md): Harvest Chosen abstract-chosen.coffee AbstractChosen cross site scripting (CVSS 3.5, Harvest Chosen · harvesthq/chosen)
- [CVE-2019-25092](https://cve.now/CVE-2019-25092.md): Nakiami Mellivora Admin Panel user.inc.php print\_user\_ip\_log cross site scripting (CVSS 2.4, Nakiami Mellivora)
- [CVE-2021-4293](https://cve.now/CVE-2021-4293.md): gnuboard youngcart5 menu\_list\_update.php cross site scripting (CVSS 3.5, gnuboard youngcart5)
- [CVE-2022-46179](https://cve.now/CVE-2022-46179.md): LiuOS vulnerable to Authorization Bypass through User-Controlled Key (CVSS 9.2, LiuWoodsCode LiuOS)
- [CVE-2022-46174](https://cve.now/CVE-2022-46174.md): Race condition during concurrent TLS mounts in efs-utils (CVSS 4.2, aws efs-utils · github.com/kubernetes-sigs/aws-efs-csi-driv…)
- [CVE-2022-46173](https://cve.now/CVE-2022-46173.md): Elrond go Processing: fallback search of SCRs when not found in the main cache (CVSS 7.2, ElrondNetwork elrond-go · github.com/ElrondNetwork/elrond-go)
- [CVE-2022-46172](https://cve.now/CVE-2022-46172.md): authentik allows existing authenticated users to create arbitrary accounts (CVSS 6.4, goauthentik authentik)
- [CVE-2022-23555](https://cve.now/CVE-2022-23555.md): authentik vulnerable to Improper Authentication via invitation URL token reuse (CVSS 9.4, goauthentik authentik)
- [CVE-2022-38202](https://cve.now/CVE-2022-38202.md): BUG-000152121 - Directory traversal vulnerability in ArcGIS Server. (CVSS 7.5, Esri ArcGIS Server)
- [CVE-2022-39012](https://cve.now/CVE-2022-39012.md): Huawei Aslan Children's Watch has an improper input validation vulnerability. (CVSS 7.5, Huawei Aslan-AL10)
- [CVE-2022-41579](https://cve.now/CVE-2022-41579.md): There is an insufficient authentication vulnerability in some Huawei band products. (CVSS 6.5, Huawei HOTA-Fara-B19)
- [CVE-2022-44564](https://cve.now/CVE-2022-44564.md): Huawei Aslan Children's Watch has a path traversal vulnerability. (CVSS 7.8, Huawei Aslan-AL10)
- [CVE-2022-45874](https://cve.now/CVE-2022-45874.md): Huawei Aslan Children's Watch has an improper authorization vulnerability. (CVSS 5.5, Huawei Aslan-AL10)
- [CVE-2022-46740](https://cve.now/CVE-2022-46740.md): There is a denial of service vulnerability in the Wi-Fi module of the HUAWEI WS7100-20 Smart WiFi Router.Successful exploit could cause a de (CVSS 6.5, Huawei WS7100-20)
- [CVE-2022-4796](https://cve.now/CVE-2022-4796.md): Incorrect Use of Privileged APIs in usememos/memos (CVSS 8.1, usememos/memos · github.com/usememos/memos)
- [CVE-2022-4797](https://cve.now/CVE-2022-4797.md): Improper Restriction of Excessive Authentication Attempts in usememos/memos (CVSS 9.8, usememos/memos · github.com/usememos/memos)
- [CVE-2022-4798](https://cve.now/CVE-2022-4798.md): Authorization Bypass Through User-Controlled Key in usememos/memos (CVSS 8.6, usememos/memos · github.com/usememos/memos)
- [CVE-2022-4799](https://cve.now/CVE-2022-4799.md): Authorization Bypass Through User-Controlled Key in usememos/memos (CVSS 8.6, usememos/memos · github.com/usememos/memos)
- [CVE-2022-4800](https://cve.now/CVE-2022-4800.md): Improper Verification of Source of a Communication Channel in usememos/memos (CVSS 8.6, usememos/memos · github.com/usememos/memos)
- [CVE-2022-4801](https://cve.now/CVE-2022-4801.md): Insufficient Granularity of Access Control in usememos/memos (CVSS 8.2, usememos/memos · github.com/usememos/memos)
- [CVE-2022-4802](https://cve.now/CVE-2022-4802.md): Authorization Bypass Through User-Controlled Key in usememos/memos (CVSS 9.1, usememos/memos · github.com/usememos/memos)
- [CVE-2022-4803](https://cve.now/CVE-2022-4803.md): Authorization Bypass Through User-Controlled Key in usememos/memos (CVSS 8.1, usememos/memos · github.com/usememos/memos)
- [CVE-2022-4804](https://cve.now/CVE-2022-4804.md): Improper Authorization in usememos/memos (CVSS 8.2, usememos/memos · github.com/usememos/memos)
- [CVE-2022-4805](https://cve.now/CVE-2022-4805.md): Incorrect Use of Privileged APIs in usememos/memos (CVSS 7.3, usememos/memos · github.com/usememos/memos)
- [CVE-2022-4806](https://cve.now/CVE-2022-4806.md): Authorization Bypass Through User-Controlled Key in usememos/memos (CVSS 8.2, usememos/memos · github.com/usememos/memos)
- [CVE-2022-4807](https://cve.now/CVE-2022-4807.md): Improper Access Control in usememos/memos (CVSS 8.2, usememos/memos · github.com/usememos/memos)
- [CVE-2022-4808](https://cve.now/CVE-2022-4808.md): Improper Privilege Management in usememos/memos (CVSS 4.2, usememos/memos · github.com/usememos/memos)
- [CVE-2022-4809](https://cve.now/CVE-2022-4809.md): Improper Access Control in usememos/memos (CVSS 8.3, usememos/memos · github.com/usememos/memos)
- [CVE-2022-4810](https://cve.now/CVE-2022-4810.md): Improper Access Control in usememos/memos (CVSS 6.3, usememos/memos · github.com/usememos/memos)
- [CVE-2022-4811](https://cve.now/CVE-2022-4811.md): Authorization Bypass Through User-Controlled Key in usememos/memos (CVSS 8.3, usememos/memos · github.com/usememos/memos)
- [CVE-2022-4812](https://cve.now/CVE-2022-4812.md): Authorization Bypass Through User-Controlled Key in usememos/memos (CVSS 8.6, usememos/memos · github.com/usememos/memos)
- [CVE-2022-4813](https://cve.now/CVE-2022-4813.md): Insufficient Granularity of Access Control in usememos/memos (CVSS 8.6, usememos/memos · github.com/usememos/memos)
- [CVE-2022-4814](https://cve.now/CVE-2022-4814.md): Improper Access Control in usememos/memos (CVSS 8.6, usememos/memos · github.com/usememos/memos)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-12-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.