Skip to content
OpenAdvisories

Archive

December 2022

Vulnerabilities first published in this month (UTC), newest first.

← November 2022 2022 / December January 2023 →
  1. 147
  2. 294
  3. 311
  4. 412
  5. 5107
  6. 695
  7. 779
  8. 8101
  9. 935
  10. 106
  11. 119
  12. 1288
  13. 13222
  14. 1488
  15. 15109
  16. 16189
  17. 1723
  18. 1836
  19. 19104
  20. 2085
  21. 2189
  22. 22218
  23. 23106
  24. 2414
  25. 2545
  26. 2688
  27. 2781
  28. 2855
  29. 2920
  30. 30102
  31. 3113
All Critical High Medium Low Exploited only Public exploit

17 results · Clear filters · Feed

  • Medium 5.5
    CVE-2022-34683 Public exploit

    NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for Dxgk…

    NVIDIA vGPU software (guest driver) - Windows, NVIDIA Cloud Gaming (guest driver) Windows
  • Medium 6.1
    CVE-2022-30519 Public exploit

    XSS in signing form in Reprise Software RLM License Administration v14.2BL4 allows remote attacker to inject arbitrary …

  • Medium 4.6
    CVE-2021-4281 Public exploit

    Brave UX for-the-badge combine-prs.yml os command injection

    A vulnerability was found in Brave UX for-the-badge and classified as critical. Affected by this issue is some unknown functionality of the file .github/workflows/combine-prs.yml. The manipulation leads to os command injection. The name of the patch is 55b5a2…

    Brave UX for-the-badge
  • Medium 6.1
    CVE-2022-36664 Public exploit

    Password Manager for IIS 2.0 has a cross-site scripting (XSS) vulnerability via the /isapi/PasswordManager.dll ResultUR…

  • Medium 5.3
    CVE-2019-19030 Public exploit

    Unauthenticated users can exploit an enumeration vulnerability in Harbor (CVE-2019-19030)

    Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows resource enumeration because unauthenticated API calls reveal (via the HTTP status code) whether a resource exists.

    github.com/goharbor/harbor Go
  • Medium 5.3
    CVE-2022-23513 Public exploit EPSS 42%

    Pi-Hole/AdminLTE vulnerable due to improper access control in queryads endpoint

    Pi-Hole is a network-wide ad blocking via your own Linux hardware, AdminLTE is a Pi-hole Dashboard for stats and more. In case of an attack, the threat actor will obtain the ability to perform an unauthorized query for blocked domains on `queryads` endpoint. …

    pi-hole AdminLTE
  • Medium 5.4
    CVE-2022-43271 Public exploit

    Inhabit Systems Pty Ltd Move CRM version 4, build 260 was discovered to contain a cross-site scripting (XSS) vulnerabil…

  • Medium 5.4
    CVE-2021-43657 Public exploit

    A Stored Cross-site scripting (XSS) vulnerability via MAster.php in Sourcecodetester Simple Client Management System (S…

  • Medium 4.3
    CVE-2022-4611 Public exploit

    Click Studios Passwordstate hard-coded credentials

    A vulnerability, which was classified as problematic, was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This affects an unknown part. The manipulation leads to hard-coded credentials. It is possible to initiate the attack re…

    Click Studios Passwordstate Passwordstate Browser Extension Chrome Browsers
  • Medium 5.9
    CVE-2022-3590 Public exploit Scanner template

    WP <= 6.1.1 - Unauthenticated Blind SSRF via DNS Rebinding

    WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.

    WordPress WordPress wordpress wordpress Web / CMS Debian Ubuntu
  • Medium 6.1
    CVE-2022-46381 Public exploit Scanner template

    Certain Linear eMerge E3-Series devices are vulnerable to XSS via the type parameter (e.g., to the badging/badge_templa…

  • Medium 5.4
    CVE-2022-25630 Public exploit

    An authenticated user can embed malicious content with XSS into the admin group policy page.

  • Medium 5.3
    CVE-2022-41717 Public exploit

    Excessive memory growth in net/http and golang.org/x/net/http2

    An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large…

    Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 6.5
    CVE-2022-38599 Public exploit

    Teleport v3.2.2, Teleport v3.5.6-rc6, and Teleport v3.6.3-b2 was discovered to contain an information leak via the /use…

  • Medium 5.4
    CVE-2022-45217 Public exploit

    A cross-site scripting (XSS) vulnerability in Book Store Management System v1.0.0 allows attackers to execute arbitrary…

  • Medium 6.1
    CVE-2022-43369 Public exploit

    AutoTaxi Stand Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the comp…

  • Medium 5.4
    CVE-2022-43097 Public exploit

    Phpgurukul User Registration & User Management System v3.0 was discovered to contain multiple stored cross-site scripti…