CVEs published in December 2022
2,895 vulnerabilities, 265 critical, 5 exploited.
- add comments project comments, unknown add comments +1 moreAdd Comments <= 1.0.1 - Admin+ Stored XSS4.8 Medium
- syncee - global dropshipping, unknown syncee +1 moreSyncee - Global Dropshipping < 1.0.10 - Authentication Token Disclosure7.5 High
- inksplat comic book management systemComic Book Management System < 2.2.0 - Admin+ SQLi7.2 High
ca-certificatesUbuntuca-certificates updateNo scorec-blosc2OSS-FuzzHeap-buffer-overflow in ZSTD_createDDictNo score- advanced booking calendar booking calendar, elbtide advanced booking calendar +1 moreWordPress Advanced Booking Calendar Plugin <= 1.7.1 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- advanced booking calendar booking calendar, elbtide advanced booking calendar +1 moreWordPress Advanced Booking Calendar Plugin <= 1.7.1 is vulnerable to SQL Injection10.0 Critical
- ecommerce-website project ecommerce-websiteA cross-site scripting (XSS) vulnerability in the component /signup_script.php of Ecommerce...6.1 Medium
- zimbra collaborationAn issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. Remote code execution can...7.2 High
- pwndoc project pwndocAn issue in the /api/audits component of Pwndoc v0.5.3 allows attackers to escalate privileges...8.8 High
- clicshopping v3A cross-site scripting (XSS) vulnerability in ClicShopping_V3 v3.402 allows attackers to execute...6.1 Medium
- lzmouse lazy mouseThe default configuration of Lazy Mouse does not require a password, allowing remote...9.8 Critical
- beappsmobile pc keyboard wifi & bluetooth, pc keyboard wifi\&bluetooth +1 morePC Keyboard allows remote unauthenticated users to send instructions to the server to execute...9.8 Critical
- telepadTelepad allows an attacker (in a man-in-the-middle position between the server and a connected...5.9 Medium
- telepadTelepad allows remote unauthenticated users to send instructions to the server to execute...9.8 Critical
- microtik routerosMikrotik RouterOs before stable v7.6 was discovered to contain an out-of-bounds read in the snmp...6.4 Medium
- mikrotik routerosMikrotik RouterOs before stable v7.5 was discovered to contain an out-of-bounds read in the...8.8 High
- gpacGPAC MP4box v2.0.0 was discovered to contain a stack overflow in the smil_parse_time_list...7.8 High
- rukovoditelRukovoditel v3.2.1 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability...8.8 High
- slims senayan library management systemSLiMS 9 Bulian v9.5.0 was discovered to contain a SQL injection vulnerability via the keywords...7.5 High
- franklinfueling colibri firmwareFranklin Fueling System FFS Colibri 1.9.22.8925 is affected by: File system overwrite. The impact...9.8 Critical
- stackstormImproper access control in Key-Value RBAC in StackStorm version 3.7.0 didn't check the permissions in Jinja filters, allowing attackers to access K/V pairs of other users, potentially leading to the e…7.5 High
- stackstormCross-site scripting (XSS) vulnerability in the Web UI of StackStorm versions prior to 3.8.0 allowed logged in users with write access to pack rules to inject arbitrary script or HTML that may be exec…5.4 Medium
- becton, dickinson and company (bd) bodyguard™ pump, bd bodyguard 121 twins firmware, bodyguard 323 colorvision firmware +5 more +7 moreBD BodyGuard™ Pumps – RS-232 Interface Vulnerability5.3 Medium
- concretecms concrete cmsConcrete CMS vulnerable to cross-site scripting in the text input field6.1 Medium
- ui edgemax edgerouter firmwareA remote code execution vulnerability in EdgeRouters (Version 2.0.9-hotfix.4 and earlier) allows...8.8 High
- veeam backup for google cloudImproper authentication in Veeam Backup for Google Cloud v1.0 and v3.0 allows attackers to bypass...9.8 Critical
- shirasagi project shirasagiStored cross-site scripting vulnerability in SHIRASAGI versions prior to v1.16.2 allows a remote...5.4 Medium
- dimitri grassi salon booking system, salon booking system booking system +1 moreCross-site scripting vulnerability in Salon booking system versions prior to 7.9 allows a remote...6.1 Medium
- nttdata terasoluna global framework, ntt data corporation terasoluna global framework and terasoluna server framework for java (rich), nttdata terasoluna server framework for java \(rich\) +2 moreTERASOLUNA Server Framework vulnerable to ClassLoader manipulation7.8 High
- shirasagi project shirasagiOpen redirect vulnerability in SHIRASAGI v1.14.4 to v1.15.0 allows a remote unauthenticated...6.1 Medium
- fsi fs020w firmware, fs030w firmware, fs040u firmware +2 more +4 moreCross-site request forgery (CSRF) vulnerability in +F FS040U software versions v2.3.4 and earlier...7.3 High
- fuji soft incorporated +f fs040u software, fsi fs040u firmware +1 morePlaintext storage of a password vulnerability exists in +F FS040U software versions v2.3.4 and...4.6 Medium
- user registration \& user management system project registration \& user management systemPhpgurukul User Registration & User Management System v3.0 was discovered to contain multiple...5.4 Medium
- vim, vim vim/vim +1 moreFloating Point Comparison with Incorrect Operator in vim/vim6.8 Medium
- vim, vim vim/vim, netapp ontap select deploy administration utility +2 moreUse After Free in vim/vim7.8 High
- heyewei springbootcmsSpringBootCMS Template Management injection4.7 Medium
- facepay project facepayFacepay camera.php authorization6.3 Medium
- sangoma asterisk, certified asterisk +1 moreAn issue was discovered in Sangoma Asterisk through 16.28, 17 and 18 through 18.14, 19 through 19...4.9 Medium
- sangoma asterisk, certified asterisk +1 moreA use-after-free in res_pjsip_pubsub.c in Sangoma Asterisk 16.28, 18.14, 19.6, and certified/18.9...6.5 Medium
- linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +1 moreA flaw was found in the Linux kernel Traffic Control (TC) subsystem. Using a specific networking...5.5 Medium
- kujirahand nadesiko3, nako3edit, editor component of nadesiko3 (pc version) +1 morenadesiko3 vulnerable to OS Command Injection9.8 Critical
- kyocera document solutions inc. document solutions mfps and printers, kyocera ecosys m2535dn firmware, ecosys m6526cdn firmware +38 more +40 moreStored cross-site scripting vulnerability in Kyocera Document Solutions MFPs and printers allows...4.8 Medium
- kyocera document solutions inc. document solutions mfps and printers, kyocera ecosys m2535dn firmware, ecosys m6526cdn firmware +38 more +40 moreMissing authorization vulnerability exists in Kyocera Document Solutions MFPs and printers, which...6.5 Medium
- kyocera document solutions inc. document solutions mfps and printers, kyocera ecosys m2535dn firmware, ecosys m6526cdn firmware +38 more +40 moreSession information easily guessable vulnerability exists in Kyocera Document Solutions MFPs and...6.5 Medium
- kujirahand nadesiko3, nako3edit, editor component of nadesiko3 (pc version) +1 morenadesiko3 allows remote attacker to inject invalid value to decodeURIComponent of nako3edit7.5 High
- kujirahand nadesiko3, nadesiko3 (pc version) +1 moreNadesiko3 OS Command Injection vulnerability9.8 Critical
- force1rc discovery wifi u818a hd\+ fpv firmwareBuffer overflow in firmware lewei_cam binary version 2.0.10 in Force 1 Discovery Wifi U818A HD+...9.8 Critical
- mobatek mobaxtermWhen aborting a SFTP connection, MobaXterm before v22.1 sends a hardcoded password to the server....9.1 Critical
- mobatek mobaxtermAn access control issue in MobaXterm before v22.1 allows attackers to make connections to the...8.1 High
- Show moreLoading…