Skip to content
OpenAdvisories

Archive

9 December 2022

Vulnerabilities first published on this day (UTC), newest first.

← November 2022 2022 / December /9 January 2023 →
  1. 147
  2. 294
  3. 311
  4. 412
  5. 5107
  6. 695
  7. 779
  8. 8101
  9. 935
  10. 106
  11. 119
  12. 1288
  13. 13222
  14. 1488
  15. 15109
  16. 16189
  17. 1723
  18. 1836
  19. 19104
  20. 2085
  21. 2189
  22. 22218
  23. 23106
  24. 2414
  25. 2545
  26. 2688
  27. 2781
  28. 2855
  29. 2920
  30. 30102
  31. 3113
All Critical High Medium Low Exploited only Public exploit

16 results · Clear filters · Feed

  • Medium 6.5
    CVE-2022-23497

    Insecure file access in FreshRSS

    FreshRSS is a free, self-hostable RSS aggregator. User configuration files can be accessed by a remote user. In addition to user preferences, such configurations contain hashed passwords (brypt with cost 9, salted) of FreshRSS Web interface. If the API is use…

    FreshRSS FreshRSS
  • Medium 4.4
    CVE-2022-41299

    IBM Cloud Transformation Advisor cross-site scripting

    IBM Cloud Transformation Advisor 2.0.1 through 3.3.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure…

    IBM Cloud Transformation Advisor
  • Medium 6.5
    CVE-2022-23468

    Buffer Overflow in xrdp

    xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in xrdp_login_wnd_create() function. There are no known workarounds for this issue. Use…

    neutrinolabs xrdp xrdp xrdp Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2022-4264

    Incorrect privilege assignment in M-Files Web Server

    Incorrect Privilege Assignment in M-Files Web (Classic) in M-Files before 22.8.11691.0 allows low privilege user to change some configuration.

    M-Files M-Files Web
  • Medium 5.5
    CVE-2022-2752

    Potential vulnerabilities in GM login process

    A vulnerability in the web server of Secomea GateManager allows a local user to impersonate as the previous user under some failed login conditions. This issue affects: Secomea GateManager versions from 9.4 through 9.7.

    Secomea GateManager
  • Medium 5.5
    CVE-2022-33187

    Brocade SANnav before v2.2.1 logs usernames and encoded passwords in debug-enabled logs

    Brocade SANnav before v2.2.1 logs usernames and encoded passwords in debug-enabled logs. The vulnerability could allow an attacker with admin privilege to read sensitive information.

    Brocade Brocade SANnav
  • Medium 5.4
    CVE-2022-34297

    Yii2 Gii Cross-site Scripting vulnerability

    Yii Yii2 Gii through 2.2.4 allows stored XSS by injecting a payload into any field.

    yiisoft/yii2-gii Packagist
  • Medium 5.4
    CVE-2022-4336

    In BAOTA linux panel there exists a stored xss vulnerability attackers can use to obtain sensitive information via the …

  • Medium 6.3
    CVE-2022-4375 Scanner template

    Mingsoft MCMS list sql injection

    A vulnerability was found in Mingsoft MCMS up to 5.2.9. It has been classified as critical. Affected is an unknown function of the file /cms/category/list. The manipulation of the argument sqlWhere leads to sql injection. It is possible to launch the attack r…

    MingSoft MCMS net.mingsoft:ms-mcms Maven
  • Medium 4.1
    CVE-2022-29839

    Remote Backups Application Discloses Stored Credentials

    Insufficiently Protected Credentials vulnerability in the remote backups application on Western Digital My Cloud devices that could allow an attacker who has gained access to a relevant endpoint to use that information to access protected data. This issue aff…

    Western Digital My Cloud
  • Medium 4.3
    CVE-2022-29838

    Authentication issue with the encrypted volumes and auto mount feature in My Cloud devices

    Improper Authentication vulnerability in the encrypted volumes and auto mount features of Western Digital My Cloud devices allows insecure direct access to the drive information in the case of a device reset. This issue affects: Western Digital My Cloud My Cl…

    Western Digital My Cloud
  • Medium 6.3
    CVE-2022-3724

    Crash in the USB HID protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial of service via packet injection or cr…

    Wireshark Foundation Wireshark wireshark Ubuntu
  • Medium 5.3
    CVE-2022-45292

    User invites for Funkwhale v1.2.8 do not permanently expire after being used for signup and can be used again after an …

  • Medium 4.8
    CVE-2022-44213

    ZKTeco Xiamen Information Technology ZKBio ECO ADMS <=3.1-164 is vulnerable to Cross Site Scripting (XSS).

  • Medium 5.4
    CVE-2022-25630 Public exploit

    An authenticated user can embed malicious content with XSS into the admin group policy page.

  • Medium 5.4
    CVE-2022-25629

    An authenticated user who has the privilege to add/edit annotations on the Content tab, can craft a malicious annotatio…