# CVEs published 2022-12-31

13 CVEs were published on December 31, 2022: 2 critical, 1 high. Days are UTC.

- [CVE-2018-25061](https://cve.now/CVE-2018-25061.md): rgb2hex redos (CVSS 4.3, rgb2hex)
- [CVE-2017-20160](https://cve.now/CVE-2017-20160.md): flitto express-param fetchParams.js parameter pollution (CVSS 6.3, flitto express-param · express-param)
- [CVE-2014-125028](https://cve.now/CVE-2014-125028.md): valtech IDP Test Client main.py cross-site request forgery (CVSS 4.3, valtech IDP Test Client)
- [CVE-2014-125027](https://cve.now/CVE-2014-125027.md): Yuna Scatari TBDev usersearch.php get\_user\_icons cross site scripting (CVSS 3.5, Yuna Scatari TBDev)
- [CVE-2017-20159](https://cve.now/CVE-2017-20159.md): rf Keynote rumble.rb cross site scripting (CVSS 3.5, rf Keynote · keynote)
- [CVE-2017-20158](https://cve.now/CVE-2017-20158.md): vova07 Yii2 FileAPI Widget UploadAction.php run cross site scripting (CVSS 3.5, vova07 Yii2 FileAPI Widget · vova07/yii2-fileapi-widget)
- [CVE-2017-20157](https://cve.now/CVE-2017-20157.md): Ariadne Component Library Url.php server-side request forgery (CVSS 5.5, Ariadne Component Library · arc/web)
- [CVE-2017-20156](https://cve.now/CVE-2017-20156.md): Exciting Printer Argument prepare\_page.rb command injection (CVSS 5.5, Exciting Printer)
- [CVE-2022-48195](https://cve.now/CVE-2022-48195.md): An issue was discovered in Mellium mellium.im/sasl before 0.3.1. (CVSS 9.8, mellium.im/sasl)
- [CVE-2022-4865](https://cve.now/CVE-2022-4865.md): Cross-site Scripting (XSS) - Stored in usememos/memos (CVSS 8.3, usememos/memos · github.com/usememos/memos)
- [CVE-2022-4866](https://cve.now/CVE-2022-4866.md): Cross-site Scripting (XSS) - Stored in usememos/memos (CVSS 9.8, usememos/memos · github.com/usememos/memos)
- [CVE-2022-4867](https://cve.now/CVE-2022-4867.md): Cross-Site Request Forgery (CSRF) in froxlor/froxlor (CVSS 3.5, froxlor/froxlor)
- [CVE-2022-4868](https://cve.now/CVE-2022-4868.md): Improper Authorization in froxlor/froxlor (CVSS 6.5, froxlor/froxlor)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-12-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.