CVEs published in December 2022
2,895 vulnerabilities, 265 critical, 5 exploited.
- external media project media, minnur external media +1 moreExternal Media < 1.0.36 - Admin+ Stored XSS4.8 Medium
- noorsplugin wp stripe checkoutWP Stripe Checkout < 1.2.2.21 - Contributor+ Stored XSS5.4 Medium
- pluginus inpost galleryInPost Gallery < 2.1.4.1 - Unauthenticated LFI to RCE9.8 Critical
- apache traffic serverApache Traffic Server: Security issues with the xdebug plugin6.1 Medium
- apache traffic serverApache Traffic Server: Improperly reading the client requests5.3 Medium
- apache traffic serverApache Traffic Server: Improperly handled requests can cause crashes in specific plugins7.5 High
- apache helixApache Helix: Open redirect6.1 Medium
- otrs, otrs ag ((otrs)) community edition +1 moreSQL Injection via OTRS Search API6.5 Medium
- apimanApiman has potential permissions bypass6.5 Medium
- trustedfirmware op-teeAn unprotected memory-access operation in optee_os in TrustedFirmware Open Portable Trusted...6.4 Medium
- protocol gossipsubGossipSub 1.1, as used for Ethereum 2.0, allows a peer to maintain a positive score (and thus not...5.3 Medium
- microchip bm70 firmware, bm71 firmware, bm78 firmware +6 more +8 moreThe Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2...8.6 High
- microchip bm70 firmware, bm71 firmware, bm78 firmware +6 more +8 moreThe Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2...6.5 Medium
- microchip bm64 firmware, bm70 firmware, bm71 firmware +9 more +11 moreThe Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2...5.4 Medium
- microchip bm70 firmware, bm71 firmware, bm78 firmware +6 more +8 moreThe Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2...5.4 Medium
- microchip bm64 firmware, bm70 firmware, bm71 firmware +11 more +13 moreThe Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2...7.5 High
- japan construction information center denshi nyusatsu core system, jacic electronic bidding core system +1 moreOpen redirect vulnerability in DENSHI NYUSATSU CORE SYSTEM v6 R4 and earlier allows a remote...6.1 Medium
- japan construction information center denshi nyusatsu core system, jacic electronic bidding core system +1 moreCross-site scripting vulnerability in DENSHI NYUSATSU CORE SYSTEM v6 R4 and earlier allows a...6.1 Medium
- open-emr openemr, openemr openemr/openemr +1 moreCross-site Scripting (XSS) - Reflected in openemr/openemr8.3 High
- alagrede alagrede/znote-app, znote +1 moreCross-site Scripting (XSS) - Stored in alagrede/znote-app2.3 Low
- click studios passwordstate, passwordstate browser extension chrome +1 moreClick Studios Passwordstate Browser Extension Provisioning improper authorization5.0 Medium
- click studios passwordstate, passwordstate browser extension chrome +1 moreClick Studios Passwordstate insufficiently protected credentials4.3 Medium
- click studios passwordstate, passwordstate browser extension chrome +1 moreClick Studios Passwordstate hard-coded credentials4.3 Medium
- click studios passwordstate, passwordstate browser extension chrome +1 moreClick Studios Passwordstate risky encryption1.9 Low
- usememos memos, usememos/memos +1 moreCross-site Scripting (XSS) - Stored in usememos/memos7.6 High
- rockoa xinhuSQL Injection exits in xinhu < 2.5.07.5 High
- patchelf project patchelfPatchelf out-of-bounds read9.1 Critical
- contec conprosys hmi system, contec co., ltd. conprosys hmi system (chs) +1 moreCONPROSYS HMI System (CHS) Ver.3.4.4?and earlier allows a remote unauthenticated attacker to...9.8 Critical
- pdftojson project pdftojsonpdftojson commit 94204bb was discovered to contain a stack overflow via the component Stream:...9.8 Critical
- pdftojson project pdftojsonpdftojson commit 94204bb was discovered to contain a stack overflow via the component Object:...9.8 Critical
- buffalo wsr-3200ax4s firmware, buffalo inc. wsr-3200ax4s, buffalo wcr-1166ds firmware +26 more +28 moreHidden functionality vulnerability in Buffalo network devices WSR-3200AX4S firmware Ver. 1.26 and...6.8 Medium
- buffalo wsr-3200ax4b firmware, wsr-3200ax4s firmware, buffalo inc. wsr-3200ax4b +20 more +22 moreBuffalo network devices WSR-3200AX4S firmware Ver. 1.26 and earlier, WSR-3200AX4B firmware Ver. 1...6.8 Medium
- buffalo wsr-3200ax4b firmware, wsr-3200ax4s firmware, buffalo inc. wsr-3200ax4b +25 more +27 moreBuffalo network devices WSR-3200AX4S firmware Ver. 1.26 and earlier, WSR-3200AX4B firmware Ver. 1...8.8 High
- entropymine dearkDeark v.1.6.2 was discovered to contain a stack overflow via the do_prism_read_palette() function...7.8 High
- autodesk mayaA maliciously crafted X_B file when parsed through Autodesk Maya 2023 can be used to write beyond...7.8 High
- autodesk mayaParsing a maliciously crafted X_B and PRT file can force Autodesk Maya 2023 to read beyond...7.1 High
- autodesk dwg trueviewDWG TrueViewTM 2023 version has a DLL Search Order Hijacking vulnerability. Successful...7.8 High
- japan construction information center denshi nyusatsu core system, jacic electronic bidding core system +1 moreCross-site scripting vulnerability in DENSHI NYUSATSU CORE SYSTEM v6 R4 and earlier allows a...6.1 Medium
- blogengine blogengine.netAn issue in the component BlogEngine/BlogEngine.NET/AppCode/Api/UploadController.cs of BlogEngine...7.2 High
- employee performance evaluation system project performance evaluation systemEmployee Performance Evaluation System v1.0 was discovered to contain a persistent cross-site...4.8 Medium
- softrSoftr v2.0 was discovered to be vulnerable to HTML injection via the Name field of the Account page.9.8 Critical
- click studios passwordstate, passwordstate browser extension chrome +1 moreClick Studios Passwordstate URL Field cross site scripting3.5 Low
- click studios passwordstate, passwordstate browser extension chrome +1 moreClick Studios Passwordstate API authorization4.3 Medium
- click studios passwordstate, passwordstate browser extension chrome +1 moreClick Studios Passwordstate API authentication bypass by assumed-immutable data7.3 High
- laravel jqgrid project jqgrid, unspecified laravel-jqgrid +1 morelaravel-jqgrid EloquentRepositoryAbstract.php getRows sql injection5.5 Medium
- pacman-canvas project pacman-canvaspacman-canvas db-handler.php addHighscore sql injection6.3 Medium
- oils-js project oils-jsoils-js Web.js redirect6.3 Medium
- phpredisadmin project phpredisadminphpRedisAdmin login.inc.php authHttpDigest wrong operator in string comparison5.0 Medium
- unspecified whohaswhohas Package Information cleartext transmission3.7 Low
- multimon-ng project multimon-ngmultimon-ng demod_flex.c add_ch format string5.5 Medium
- Show moreLoading…