# CVEs published 2022-12-29

19 CVEs were published on December 29, 2022: 2 critical, 7 high. Days are UTC.

- [CVE-2022-46181](https://cve.now/CVE-2022-46181.md): Gotify server XSS vulnerability in the application image file upload (CVSS 6.1, gotify server · github.com/gotify/server +1)
- [CVE-2022-46178](https://cve.now/CVE-2022-46178.md): Path Traversal In MeterSpere allows file upload to any path (CVSS 7.4, metersphere · io.metersphere:metersphere)
- [CVE-2021-4296](https://cve.now/CVE-2021-4296.md): w3c Unicorn ValidatorNuMessage.java ValidatorNuMessage cross site scripting (CVSS 3.5, w3c Unicorn)
- [CVE-2021-4295](https://cve.now/CVE-2021-4295.md): ONC code-validator-api XML CodeValidatorApiConfiguration.java vocabularyValidationConfigurations xml external entity reference (CVSS 5.5, ONC code-validator-api)
- [CVE-2018-25058](https://cve.now/CVE-2018-25058.md): Twitter-Post-Fetcher Link Target twitterFetcher.js reverse tabnabbing (CVSS 4.2, Twitter-Post-Fetcher · twitter-fetcher-js)
- [CVE-2022-30519](https://cve.now/CVE-2022-30519.md): XSS in signing form in Reprise Software RLM License Administration v14.2BL4 allows remote attacker to inject arbitrary code via password fie (CVSS 6.1)
- [CVE-2022-36437](https://cve.now/CVE-2022-36437.md): The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster (CVSS 9.1, com.hazelcast:hazelcast · com.hazelcast.jet:hazelcast-jet +2)
- [CVE-2022-4839](https://cve.now/CVE-2022-4839.md): Cross-site Scripting (XSS) - Stored in usememos/memos (CVSS 8.0, usememos/memos · github.com/usememos/memos)
- [CVE-2022-4840](https://cve.now/CVE-2022-4840.md): Cross-site Scripting (XSS) - Stored in usememos/memos (CVSS 7.6, usememos/memos · github.com/usememos/memos)
- [CVE-2022-4841](https://cve.now/CVE-2022-4841.md): Cross-site Scripting (XSS) - Stored in usememos/memos (CVSS 8.6, usememos/memos · github.com/usememos/memos)
- [CVE-2022-4843](https://cve.now/CVE-2022-4843.md): NULL Pointer Dereference in radareorg/radare2 (CVSS 4.4, radareorg/radare2)
- [CVE-2022-4844](https://cve.now/CVE-2022-4844.md): Cross-Site Request Forgery (CSRF) in usememos/memos (CVSS 6.5, usememos/memos · github.com/usememos/memos)
- [CVE-2022-4845](https://cve.now/CVE-2022-4845.md): Cross-Site Request Forgery (CSRF) in usememos/memos (CVSS 6.7, usememos/memos · github.com/usememos/memos)
- [CVE-2022-4846](https://cve.now/CVE-2022-4846.md): Cross-Site Request Forgery (CSRF) in usememos/memos (CVSS 6.3, usememos/memos · github.com/usememos/memos)
- [CVE-2022-4847](https://cve.now/CVE-2022-4847.md): Incorrectly Specified Destination in a Communication Channel in usememos/memos (CVSS 8.3, usememos/memos · github.com/usememos/memos)
- [CVE-2022-4848](https://cve.now/CVE-2022-4848.md): Improper Verification of Source of a Communication Channel in usememos/memos (CVSS 8.6, usememos/memos · github.com/usememos/memos)
- [CVE-2022-4849](https://cve.now/CVE-2022-4849.md): Cross-Site Request Forgery (CSRF) in usememos/memos (CVSS 8.3, usememos/memos · github.com/usememos/memos)
- [CVE-2022-4850](https://cve.now/CVE-2022-4850.md): Cross-Site Request Forgery (CSRF) in usememos/memos (CVSS 6.5, usememos/memos · github.com/usememos/memos)
- [CVE-2022-4851](https://cve.now/CVE-2022-4851.md): Improper Handling of Values in usememos/memos (CVSS 9.8, usememos/memos · github.com/usememos/memos)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-12-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.