Skip to content
OpenAdvisories

Archive

December 2022

Vulnerabilities first published in this month (UTC), newest first.

← November 2022 2022 / December January 2023 →
  1. 147
  2. 294
  3. 311
  4. 412
  5. 5107
  6. 695
  7. 779
  8. 8101
  9. 935
  10. 106
  11. 119
  12. 1288
  13. 13222
  14. 1488
  15. 15109
  16. 16189
  17. 1723
  18. 1836
  19. 19104
  20. 2085
  21. 2189
  22. 22218
  23. 23106
  24. 2414
  25. 2545
  26. 2688
  27. 2781
  28. 2855
  29. 2920
  30. 30102
  31. 3113
All Critical High Medium Low Exploited only Public exploit

63 results · Clear filters · Feed

  • Critical 9.8
    CVE-2022-4407 Public exploit

    Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq

    Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.9.

    thorsten thorsten/phpmyfaq thorsten/phpmyfaq Packagist
  • High 8.1
    CVE-2022-46166 Public exploit

    Spring Boot Admins integrated notifier support allows arbitrary code execution

    Spring boot admins is an open source administrative user interface for management of spring boot applications. All users who run Spring Boot Admin Server, having enabled Notifiers (e.g. Teams-Notifier) and write access to environment variables via UI are affe…

    codecentric spring-boot-admin de.codecentric:spring-boot-admin Maven
  • Medium 5.4
    CVE-2022-25630 Public exploit

    An authenticated user can embed malicious content with XSS into the admin group policy page.

  • Medium 5.3
    CVE-2022-41717 Public exploit

    Excessive memory growth in net/http and golang.org/x/net/http2

    An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large…

    Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 6.5
    CVE-2022-38599 Public exploit

    Teleport v3.2.2, Teleport v3.5.6-rc6, and Teleport v3.6.3-b2 was discovered to contain an information leak via the /use…

  • High 8.7
    CVE-2022-41800 Public exploit Scanner template EPSS 77%

    Appliance mode iControl REST vulnerability

    In all versions of BIG-IP, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to…

    F5 BIG-IP Network devices
  • High 8.8
    CVE-2022-41622 Public exploit EPSS 92%

    iControl SOAP vulnerability

    In all versions,  BIG-IP and BIG-IQ are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    F5 BIG-IP BIG-IQ Centralized Management Network devices
  • High 7.5
    CVE-2022-46770 Public exploit EPSS 22%

    qubes-mirage-firewall (aka Mirage firewall for QubesOS) 0.8.x through 0.8.3 allows guest OS users to cause a denial of …

  • Medium 5.4
    CVE-2022-45217 Public exploit

    A cross-site scripting (XSS) vulnerability in Book Store Management System v1.0.0 allows attackers to execute arbitrary…

  • Critical 9.8
    CVE-2022-45025 Public exploit EPSS 35%

    Markdown Preview Enhanced v0.6.5 and v0.19.6 for VSCode and Atom was discovered to contain a command injection vulnerab…

  • Critical 9.8
    CVE-2020-6627 Public exploit EPSS 13%

    The web-management application on Seagate Central NAS STCG2000300, STCG3000300, and STCG4000300 devices allows OS comma…

  • Critical 9.1
    CVE-2022-44900 Public exploit

    py7zr directory traversal vulnerability

    A directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr v0.20.0 and earlier allows attackers to write arbitrary files via extracting a crafted 7z file.

    py7zr py7zr py7zr Debian Ubuntu PyPI
  • Medium 6.1
    CVE-2022-43369 Public exploit

    AutoTaxi Stand Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the comp…

  • Critical 9.4
    CVE-2022-46164 Public exploit EPSS 47%

    Account takeover via prototype vulnerability

    NodeBB is an open source Node.js based forum software. Due to a plain object with a prototype being used in socket.io message handling a specially crafted payload can be used to impersonate other users and takeover accounts. This vulnerability has been patche…

    NodeBB NodeBB nodebb npm
  • Critical 9.8
    CVE-2022-46169 Exploited Public exploit Scanner template EPSS 100%

    Unauthenticated Command Injection

    Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a command injection vulnerability allows an unauthenticated user to execute arbitrary code on a serve…

    Cacti cacti cacti cacti Debian Ubuntu
    KEV Feb 16, 2023
  • Critical 9.8
    CVE-2022-32224 Public exploit

    Active Record RCE bug with Serialized Columns

    A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2.8.1 which could allow an attacker, that can manipulate data in the database (via means like SQL injection), the abilit…

    rails rails activerecord Debian Ubuntu RubyGems
  • Critical 9.8
    CVE-2022-45477 Public exploit

    Telepad allows remote unauthenticated users to send instructions to the server to execute arbitrary code without any pr…

    Telepad Telepad
  • High 8.8
    CVE-2022-45771 Public exploit

    An issue in the /api/audits component of Pwndoc v0.5.3 allows attackers to escalate privileges and execute arbitrary co…

  • Medium 5.4
    CVE-2022-43097 Public exploit

    Phpgurukul User Registration & User Management System v3.0 was discovered to contain multiple stored cross-site scripti…

  • High 8.8
    CVE-2022-4262 Exploited Public exploit EPSS 24%

    Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap corr…

    Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine
    KEV Dec 5, 2022
  • High 8.3
    CVE-2022-1471 Public exploit EPSS 100%

    Remote Code execution in SnakeYAML

    SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrust…

    SnakeYaml SnakeYaml management-api-for-apache-cassandra-5.0 cassandra-reaper Debian Ubuntu Wolfi Maven
  • Critical 9.8
    CVE-2022-44262 Public exploit

    ff4j is vulnerable to Remote Code Execution (RCE)

    ff4j 1.8.1 is vulnerable to Remote Code Execution (RCE).

    org.ff4j:ff4j-core Maven
  • High 7.5
    CVE-2022-37017 Public exploit

    Symantec Endpoint Protection (Windows) agent, prior to 14.3 RU6/14.3 RU5 Patch 1, may be susceptible to a Security Cont…