Skip to content
OpenAdvisories

Archive

2 December 2022

Vulnerabilities first published on this day (UTC), newest first.

← November 2022 2022 / December /2 January 2023 →
  1. 147
  2. 294
  3. 311
  4. 412
  5. 5107
  6. 695
  7. 779
  8. 8101
  9. 935
  10. 106
  11. 119
  12. 1288
  13. 13222
  14. 1488
  15. 15109
  16. 16189
  17. 1723
  18. 1836
  19. 19104
  20. 2085
  21. 2189
  22. 22218
  23. 23106
  24. 2414
  25. 2545
  26. 2688
  27. 2781
  28. 2855
  29. 2920
  30. 30102
  31. 3113
All Critical High Medium Low Exploited only Public exploit

40 results · Clear filters · Feed

  • Medium —
    GHSA-q7qq-9gx2-ggxv

    phpxmlrpc vulnerable to argument injection

    phpxmlrpc vulnerable to argument injection via local file access in `Client:send` via manipulation of `$protocol` argument.

    phpxmlrpc/phpxmlrpc Packagist
  • Medium —
    GHSA-47xh-qxqv-mgvg

    kube-httpcache is vulnerable to Cross-Site Request Forgery (CSRF)

    ### Impact > A request forgery attack can be performed on Varnish Cache servers that have the HTTP/2 protocol turned on. An attacker may introduce characters through the HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing …

    github.com/mittwald/kube-httpcache Go
  • Medium 5.5
    CVE-2022-4216

    Chained Quiz <= 1.3.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Facebook App ID

    The Chained Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'facebook_appid' parameter in versions up to, and including, 1.3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticate…

    prasunsen Chained Quiz Web / CMS
  • Medium 5.5
    CVE-2022-4217

    Chained Quiz <= 1.3.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Mailchimp API Key

    The Chained Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'api_key' parameter in versions up to, and including, 1.3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attac…

    prasunsen Chained Quiz Web / CMS
  • Medium 6.1
    CVE-2022-4212

    Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via ipf

    The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ipf' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it poss…

    prasunsen Chained Quiz Web / CMS
  • Medium 6.1
    CVE-2022-4211

    Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via emailf

    The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'emailf' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it p…

    prasunsen Chained Quiz Web / CMS
  • Medium 6.1
    CVE-2022-4210

    Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via dnf

    The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dnf' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it poss…

    prasunsen Chained Quiz Web / CMS
  • Medium 6.1
    CVE-2022-4209

    Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via pointsf

    The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'pointsf' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it …

    prasunsen Chained Quiz Web / CMS
  • Medium 6.1
    CVE-2022-4208

    Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via datef

    The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'datef' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it po…

    prasunsen Chained Quiz Web / CMS
  • Medium 6.1
    CVE-2022-4213

    Chained Quiz <= 1.3.2.2 - Reflected Cross-Site Scripting via dn

    The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dn' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2.2 due to insufficient input sanitization and output escaping. This makes it pos…

    prasunsen Chained Quiz Web / CMS
  • Medium 6.1
    CVE-2022-4214

    Chained Quiz <= 1.3.2.3 - Reflected Cross-Site Scripting via ip

    The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ip' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2.3 due to insufficient input sanitization and output escaping. This makes it pos…

    prasunsen Chained Quiz Web / CMS
  • Medium 6.1
    CVE-2022-4215

    Chained Quiz <= 1.3.2.3 - Reflected Cross-Site Scripting via date

    The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'date' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2.3 due to insufficient input sanitization and output escaping. This makes it p…

    prasunsen Chained Quiz Web / CMS
  • Medium 5.4
    CVE-2022-4220

    Chained Quiz <= 1.3.2.4 - Cross-Site Request Forgery to Question Deletion

    The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce validation on the list_questions() function. This makes it possible for unauthenticated attackers to dele…

    prasunsen Chained Quiz Web / CMS
  • Medium 5.4
    CVE-2022-4219

    Chained Quiz <= 1.3.2.4 - Cross-Site Request Forgery to Submitted Response Deletion

    The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce validation on the manage() function. This makes it possible for unauthenticated attackers to delete submi…

    prasunsen Chained Quiz Web / CMS
  • Medium 5.4
    CVE-2022-4218

    Chained Quiz <= 1.3.2.4 - Cross-Site Request Forgery to Arbitrary Quiz Deletion and Copying

    The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce validation on the list_quizzes() function. This makes it possible for unauthenticated attackers to delete…

    prasunsen Chained Quiz Web / CMS
  • Medium 4.3
    CVE-2022-46159

    Any authenticated Discourse user can create an unlisted topic

    Discourse is an open-source discussion platform. In version 2.8.13 and prior on the `stable` branch and version 2.9.0.beta14 and prior on the `beta` and `tests-passed` branches, any authenticated user can create an unlisted topic. These topics, which are not …

    Discourse Discourse
  • Medium 6.5
    CVE-2022-45667

    Tenda i22 V1.0.0.3(4687) is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolRestoreSet.

  • Medium 5.9
    CVE-2022-45483

    Lazy Mouse allows an attacker (in a man in the middle position between the server and a connected device) to see all da…

    thisAAY Lazy Mouse
  • Medium 6.5
    CVE-2022-45673

    Tenda AC6V1.0 V15.03.05.19 is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolRestoreSet.

  • Medium 6.5
    CVE-2022-45674

    Tenda AC6V1.0 V15.03.05.19 is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolReboot.

  • Medium 5.9
    CVE-2022-45480

    PC Keyboard WiFi & Bluetooth allows an attacker (in a man-in-the-middle position between the server and a connected dev…

    Telepad PC Keyboard WiFi & Bluetooth
  • Medium 5.4
    CVE-2022-45215

    A cross-site scripting (XSS) vulnerability in Book Store Management System v1.0.0 allows attackers to execute arbitrary…

  • Medium 6.5
    CVE-2022-45668

    Tenda i22 V1.0.0.3(4687) is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolReboot.

  • Medium 5.4
    CVE-2022-44954

    webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /contacts/listcon…

  • Medium 5.4
    CVE-2022-44950 Scanner template

    Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field fun…

  • Medium 5.4
    CVE-2022-44959

    webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /meetings/listmee…

  • Medium 5.4
    CVE-2022-44960

    webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /general/search.p…

  • Medium 5.4
    CVE-2022-44946 Scanner template

    Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Page function…

  • Medium 5.4
    CVE-2022-44949 Scanner template

    Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field fun…

  • Medium 5.4
    CVE-2022-44961

    webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /forums/editforum…

  • Medium 5.4
    CVE-2022-44951 Scanner template

    Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Form tab …

  • Medium 5.4
    CVE-2022-44962

    webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /calendar/viewcal…

  • Medium 5.4
    CVE-2022-44956

    webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /projects/listpro…

  • Medium 5.4
    CVE-2022-44952 Scanner template

    Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in /index.php?module=con…

  • Medium 5.4
    CVE-2022-44957 Scanner template

    webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /clients/listclie…

  • Medium 5.4
    CVE-2022-44947 Scanner template

    Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Highlight Row fea…

  • Medium 5.4
    CVE-2022-44948 Scanner template

    Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Entities Group fe…

  • Medium 5.4
    CVE-2022-44953

    webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /linkedcontent/li…

  • Medium 5.4
    CVE-2022-44955

    webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the Chat function. This vulnera…

  • Medium 5.4
    CVE-2022-44944 Scanner template

    Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Announcement …