Skip to content
OpenAdvisories

Archive

December 2022

Vulnerabilities first published in this month (UTC), newest first.

← November 2022 2022 / December January 2023 →
  1. 147
  2. 294
  3. 311
  4. 412
  5. 5107
  6. 695
  7. 779
  8. 8101
  9. 935
  10. 106
  11. 119
  12. 1288
  13. 13222
  14. 1488
  15. 15109
  16. 16189
  17. 1723
  18. 1836
  19. 19104
  20. 2085
  21. 2189
  22. 22218
  23. 23106
  24. 2414
  25. 2545
  26. 2688
  27. 2781
  28. 2855
  29. 2920
  30. 30102
  31. 3113
All Critical High Medium Low Exploited only Public exploit

16 results · Clear filters · Feed

  • Critical 9.8
    CVE-2022-4047 Public exploit

    Return Refund and Exchange For WooCommerce < 4.0.9 - Unauthenticated Arbitrary File Upload

    The Return Refund and Exchange For WooCommerce WordPress plugin before 4.0.9 does not validate attachment files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files such as PHP and lead to RCE

    Web / CMS
  • Critical 9.8
    CVE-2022-40624 Public exploit Scanner template EPSS 18%

    pfSense pfBlockerNG through 2.1.4_27 allows remote attackers to execute arbitrary OS commands as root via the HTTP Host…

  • Critical 9.8
    CVE-2022-4063 Public exploit Scanner template EPSS 10%

    InPost Gallery < 2.1.4.1 - Unauthenticated LFI to RCE

    The InPost Gallery WordPress plugin before 2.1.4.1 insecurely uses PHP's extract() function when rendering HTML views, allowing attackers to force the inclusion of malicious files & URLs, which may enable them to run code on servers.

    Web / CMS
  • Critical 9.8
    CVE-2022-46364 Public exploit

    Apache CXF SSRF Vulnerability

    A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. 

    Apache Software Foundation Apache CXF org.apache.cxf:cxf-core Maven
  • Critical 9.9
    CVE-2022-41272 Public exploit

    An unauthenticated attacker over the network can attach to an open interface exposed through JNDI by the User Defined S…

    SAP NetWeaver Process Integration
  • Critical 9.8
    CVE-2022-27518 Exploited Public exploit

    Unauthenticated remote arbitrary code execution

    Unauthenticated remote arbitrary code execution

    Citrix Citrix Gateway, Citrix ADC Network devices
    KEV Dec 13, 2022
  • Critical 9.8
    CVE-2022-20473 Public exploit

    In toLanguageTag of LocaleListCache.cpp, there is a possible out of bounds read due to an incorrect bounds check. This …

    Android
  • Critical 9.8
    CVE-2022-4407 Public exploit

    Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq

    Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.9.

    thorsten thorsten/phpmyfaq thorsten/phpmyfaq Packagist
  • Critical 9.8
    CVE-2022-45025 Public exploit EPSS 35%

    Markdown Preview Enhanced v0.6.5 and v0.19.6 for VSCode and Atom was discovered to contain a command injection vulnerab…

  • Critical 9.8
    CVE-2020-6627 Public exploit EPSS 13%

    The web-management application on Seagate Central NAS STCG2000300, STCG3000300, and STCG4000300 devices allows OS comma…

  • Critical 9.1
    CVE-2022-44900 Public exploit

    py7zr directory traversal vulnerability

    A directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr v0.20.0 and earlier allows attackers to write arbitrary files via extracting a crafted 7z file.

    py7zr py7zr py7zr Debian Ubuntu PyPI
  • Critical 9.4
    CVE-2022-46164 Public exploit EPSS 47%

    Account takeover via prototype vulnerability

    NodeBB is an open source Node.js based forum software. Due to a plain object with a prototype being used in socket.io message handling a specially crafted payload can be used to impersonate other users and takeover accounts. This vulnerability has been patche…

    NodeBB NodeBB nodebb npm
  • Critical 9.8
    CVE-2022-46169 Exploited Public exploit Scanner template EPSS 100%

    Unauthenticated Command Injection

    Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a command injection vulnerability allows an unauthenticated user to execute arbitrary code on a serve…

    Cacti cacti cacti cacti Debian Ubuntu
    KEV Feb 16, 2023
  • Critical 9.8
    CVE-2022-32224 Public exploit

    Active Record RCE bug with Serialized Columns

    A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2.8.1 which could allow an attacker, that can manipulate data in the database (via means like SQL injection), the abilit…

    rails rails activerecord Debian Ubuntu RubyGems
  • Critical 9.8
    CVE-2022-45477 Public exploit

    Telepad allows remote unauthenticated users to send instructions to the server to execute arbitrary code without any pr…

    Telepad Telepad
  • Critical 9.8
    CVE-2022-44262 Public exploit

    ff4j is vulnerable to Remote Code Execution (RCE)

    ff4j 1.8.1 is vulnerable to Remote Code Execution (RCE).

    org.ff4j:ff4j-core Maven