| 2022-12-19 | CVE-2022-40607 | | IBM Spectrum Scale 5.1 could allow users with permissions to create pod, persistent volume and persistent volume claim to access files and directories outside of the volume, including on the host filesystem. | 6.8 |
| 2022-12-19 | CVE-2022-43466 | Buffalo | OS Command Injection vulnerability in Buffalo Wsr-3200Ax4B Firmware 1.25 Buffalo network devices WSR-3200AX4S firmware Ver. | 6.8 |
| 2022-12-19 | CVE-2022-43486 | Buffalo | Unspecified vulnerability in Buffalo Wsr-3200Ax4B Firmware 1.25 Hidden functionality vulnerability in Buffalo network devices WSR-3200AX4S firmware Ver. | 6.8 |
| 2022-12-22 | CVE-2021-36631 | | Untrusted search path vulnerability in Baidunetdisk Version 7.4.3 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. | 6.7 |
| 2022-12-21 | CVE-2022-46662 | Corel | Unquoted Search Path or Element vulnerability in Corel Roxio Creator LJB 12.2 Roxio Creator LJB starts another program with an unquoted file path. | 6.7 |
| 2022-12-25 | CVE-2021-4280 | | A vulnerability was found in styler_praat_scripts. | 6.5 |
| 2022-12-25 | CVE-2022-4741 | | A vulnerability was found in docconv up to 1.2.0 and classified as problematic. | 6.5 |
| 2022-12-25 | CVE-2022-41317 | | An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. | 6.5 |
| 2022-12-25 | CVE-2022-44014 | | An issue was discovered in Simmeth Lieferantenmanager before 5.6. | 6.5 |
| 2022-12-25 | CVE-2022-45894 | | GetFile.aspx in Planet eStream before 6.72.10.07 allows ..\ directory traversal to read arbitrary local files. | 6.5 |
| 2022-12-25 | CVE-2022-45895 | | Planet eStream before 6.72.10.07 discloses sensitive information, related to the ON cookie (findable in HTML source code for Default.aspx in some situations) and the WhoAmI endpoint (e.g., path disclosure). | 6.5 |
| 2022-12-24 | CVE-2022-47932 | | Brave Browser before 1.43.34 allowed a remote attacker to cause a denial of service via a crafted HTML file that mentions an ipfs:// or ipns:// URL. | 6.5 |
| 2022-12-24 | CVE-2022-47933 | | Brave Browser before 1.42.51 allowed a remote attacker to cause a denial of service via a crafted HTML file that references the IPFS scheme. | 6.5 |
| 2022-12-24 | CVE-2022-47934 | | Brave Browser before 1.43.88 allowed a remote attacker to cause a denial of service in private and guest windows via a crafted HTML file that mentions an ipfs:// or ipns:// URL. | 6.5 |
| 2022-12-23 | CVE-2022-47938 | Linux | Out-of-bounds Read vulnerability in Linux Kernel An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. | 6.5 |
| 2022-12-23 | CVE-2022-4683 | | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository usememos/memos prior to 0.9.0. | 6.5 |
| 2022-12-23 | CVE-2022-46492 | Nbnbk Project | Path Traversal vulnerability in Nbnbk Project Nbnbk nbnbk commit 879858451d53261d10f77d4709aee2d01c72c301 was discovered to contain an arbitrary file read vulnerability via the component /api/Index/getFileBinary. | 6.5 |
| 2022-12-22 | CVE-2022-46491 | Nbnbk Project | Cross-Site Request Forgery (CSRF) vulnerability in Nbnbk Project Nbnbk A Cross-Site Request Forgery (CSRF) vulnerability in the Add Administrator function of the default version of nbnbk allows attackers to arbitrarily add Administrator accounts. | 6.5 |
| 2022-12-22 | CVE-2022-22458 | IBM | Insufficiently Protected Credentials vulnerability in IBM Security Verify Governance 10.0.1 IBM Security Verify Governance, Identity Manager 10.0.1 stores user credentials in plain clear text which can be read by a remote authenticated user. | 6.5 |
| 2022-12-22 | CVE-2021-4126 | | When receiving an OpenPGP/MIME signed email message that contains an additional outer MIME message layer, for example a message footer added by a mailing list gateway, Thunderbird only considered the inner signed message for the signature validity. | 6.5 |
| 2022-12-22 | CVE-2021-4128 | Mozilla | Use After Free vulnerability in Mozilla Firefox When transitioning in and out of fullscreen mode, a graphics object was not correctly protected; resulting in memory corruption and a potentially exploitable crash.<br>*This bug only affects Firefox on MacOS. | 6.5 |
| 2022-12-22 | CVE-2022-1097 | | <code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe way on different threads, leading to a use-after-free and potentially exploitable crash. | 6.5 |
| 2022-12-22 | CVE-2022-1196 | | After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-after-free and potentially exploitable crash. | 6.5 |
| 2022-12-22 | CVE-2022-1834 | | When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird would have displayed all the spaces. | 6.5 |
| 2022-12-22 | CVE-2022-22739 | | Malicious websites could have tricked users into accepting launching a program to handle an external URL protocol. | 6.5 |
| 2022-12-22 | CVE-2022-22742 | | When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access causing a potentially exploitable crash. | 6.5 |
| 2022-12-22 | CVE-2022-22745 | | Securitypolicyviolation events could have leaked cross-origin information for frame-ancestors violations. | 6.5 |
| 2022-12-22 | CVE-2022-22747 | | After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have lead to a crash. | 6.5 |
| 2022-12-22 | CVE-2022-22748 | | Malicious websites could have confused Firefox into showing the wrong origin when asking to launch a program and handling an external URL protocol. | 6.5 |
| 2022-12-22 | CVE-2022-22750 | | By generally accepting and passing resource handles across processes, a compromised content process might have confused higher privileged processes to interact with handles that the unprivileged process should not have access to.<br>*This bug only affects Firefox for Windows and MacOS. | 6.5 |
| 2022-12-22 | CVE-2022-22754 | Mozilla | Incorrect Authorization vulnerability in Mozilla Firefox If a user installed an extension of a particular type, the extension could have auto-updated itself and while doing so, bypass the prompt which grants the new version the new requested permissions. | 6.5 |
| 2022-12-22 | CVE-2022-22757 | Mozilla | Improper Input Validation vulnerability in Mozilla Firefox Remote Agent, used in WebDriver, did not validate the Host or Origin headers. | 6.5 |
| 2022-12-22 | CVE-2022-22760 | Mozilla | Information Exposure Through an Error Message vulnerability in Mozilla Firefox When importing resources using Web Workers, error messages would distinguish the difference between <code>application/javascript</code> responses and non-script responses. | 6.5 |
| 2022-12-22 | CVE-2022-26385 | | In unusual circumstances, an individual thread may outlive the thread's manager during shutdown. | 6.5 |
| 2022-12-22 | CVE-2022-26386 | Mozilla | Unspecified vulnerability in Mozilla Firefox ESR Previously Firefox for macOS and Linux would download temporary files to a user-specific directory in <code>/tmp</code>, but this behavior was changed to download them to <code>/tmp</code> where they could be affected by other local users. | 6.5 |
| 2022-12-22 | CVE-2022-28282 | | By using a link with <code>rel="localization"</code> a use-after-free could have been triggered by destroying an object during JavaScript execution and then referencing the object through a freed pointer, leading to a potential exploitable crash. | 6.5 |
| 2022-12-22 | CVE-2022-28283 | | The sourceMapURL feature in devtools was missing security checks that would have allowed a webpage to attempt to include local files or other files that should have been inaccessible. | 6.5 |
| 2022-12-22 | CVE-2022-28285 | | When generating the assembly code for <code>MLoadTypedArrayElementHole</code>, an incorrect AliasSet was used. | 6.5 |
| 2022-12-22 | CVE-2022-28287 | | In unusual circumstances, selecting text could cause text selection caching to behave incorrectly, leading to a crash. | 6.5 |
| 2022-12-22 | CVE-2022-29913 | | The parent process would not properly check whether the Speech Synthesis feature is enabled, when receiving instructions from a child process. | 6.5 |
| 2022-12-22 | CVE-2022-29914 | | When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have enabled browser spoofing attacks. | 6.5 |
| 2022-12-22 | CVE-2022-29916 | | Firefox behaved slightly differently for already known resources when loading CSS resources involving CSS variables. | 6.5 |
| 2022-12-22 | CVE-2022-2226 | Mozilla | Authentication Bypass by Capture-replay vulnerability in Mozilla Thunderbird 101.0 An OpenPGP digital signature includes information about the date when the signature was created. | 6.5 |
| 2022-12-22 | CVE-2022-31738 | | When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting in potential user confusion or spoofing attacks. | 6.5 |
| 2022-12-22 | CVE-2022-31742 | | An attacker could have exploited a timing attack by sending a large number of allowCredential entries and detecting the difference between invalid key handles and cross-origin key handles. | 6.5 |
| 2022-12-22 | CVE-2022-31743 | | Firefox's HTML parser did not correctly interpret HTML comment tags, resulting in an incongruity with other browsers. | 6.5 |
| 2022-12-22 | CVE-2022-31744 | | An attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and in doing so bypass a page's Content Security Policy. | 6.5 |
| 2022-12-22 | CVE-2022-31746 | | Internal URLs are protected by a secret UUID key, which could have been leaked to web page through the Referrer header. | 6.5 |
| 2022-12-22 | CVE-2022-34471 | | When downloading an update for an addon, the downloaded addon update's version was not verified to match the version selected from the manifest. | 6.5 |
| 2022-12-22 | CVE-2022-34478 | | The <code>ms-msdt</code>, <code>search</code>, and <code>search-ms</code> protocols deliver content to Microsoft applications, bypassing the browser, when a user accepts a prompt. | 6.5 |
| 2022-12-22 | CVE-2022-34479 | | A malicious website that could create a popup could have resized the popup to overlay the address bar with its own content, resulting in potential user confusion or spoofing attacks. | 6.5 |
| 2022-12-22 | CVE-2022-36317 | | When visiting a website with an overly long URL, the user interface would start to hang. | 6.5 |
| 2022-12-22 | CVE-2022-38472 | | An attacker could have abused XSLT error handling to associate attacker-controlled content with another origin which was displayed in the address bar. | 6.5 |
| 2022-12-22 | CVE-2022-38475 | | An attacker could have written a value to the first element in a zero-length JavaScript array. | 6.5 |
| 2022-12-22 | CVE-2022-3032 | | When receiving an HTML email that contained an <code>iframe</code> element, which used a <code>srcdoc</code> attribute to define the inner HTML document, remote objects specified in the nested document, for example images or videos, were not blocked. | 6.5 |
| 2022-12-22 | CVE-2022-40957 | | Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially exploitable crash.<br>*This bug only affects Firefox on ARM64 platforms.*. | 6.5 |
| 2022-12-22 | CVE-2022-40958 | | By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a secure context could set and thus overwrite cookies from a secure context, leading to session fixation and other attacks. | 6.5 |
| 2022-12-22 | CVE-2022-40959 | | During iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a bypass that leaked device permissions into untrusted subdocuments. | 6.5 |
| 2022-12-22 | CVE-2022-40960 | | Concurrent use of the URL parser with non-UTF-8 data was not thread-safe. | 6.5 |
| 2022-12-22 | CVE-2022-40961 | | During startup, a graphics driver with an unexpected name could lead to a stack-buffer overflow causing a potentially exploitable crash.<br>*This issue only affects Firefox for Android. | 6.5 |
| 2022-12-22 | CVE-2022-42929 | | If a website called <code>window.print()</code> in a particular way, it could cause a denial of service of the browser, which may persist beyond browser restart depending on the user's session restore settings. | 6.5 |
| 2022-12-22 | CVE-2022-45403 | | Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for cross-origin media combined with Range requests might have allowed them to determine the presence or length of a media file. | 6.5 |
| 2022-12-22 | CVE-2022-45404 | | Through a series of popup and <code>window.print()</code> calls, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in potential user confusion or spoofing attacks. | 6.5 |
| 2022-12-22 | CVE-2022-45405 | | Freeing arbitrary <code>nsIInputStream</code>'s on a different thread than creation could have led to a use-after-free and potentially exploitable crash. | 6.5 |
| 2022-12-22 | CVE-2022-45408 | | Through a series of popups that reuse windowName, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in potential user confusion or spoofing attacks. | 6.5 |
| 2022-12-22 | CVE-2022-45410 | | When a ServiceWorker intercepted a request with <code>FetchEvent</code>, the origin of the request was lost after the ServiceWorker took ownership of it. | 6.5 |
| 2022-12-22 | CVE-2022-45416 | | Keyboard events reference strings like "KeyA" that were at fixed, known, and widely-spread addresses. | 6.5 |
| 2022-12-22 | CVE-2022-45419 | | If the user added a security exception for an invalid TLS certificate, opened an ongoing TLS connection with a server that used that certificate, and then deleted the exception, Firefox would have kept the connection alive, making it seem like the certificate was still trusted. | 6.5 |
| 2022-12-22 | CVE-2022-45420 | | Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of the iframe, resulting in potential user confusion or spoofing attacks. | 6.5 |
| 2022-12-22 | CVE-2022-46875 | | The executable file warning was not presented when downloading .atloc and .ftploc files, which can run commands on a user's computer. | 6.5 |
| 2022-12-22 | CVE-2022-46880 | | A missing check related to tex units could have led to a use-after-free and potentially exploitable crash.<br />*Note*: This advisory was added on December 13th, 2022 after we better understood the impact of the issue. | 6.5 |
| 2022-12-22 | CVE-2022-4646 | | Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.5.4. | 6.5 |
| 2022-12-21 | CVE-2020-36622 | | A vulnerability was found in sah-comp bienlein and classified as problematic. | 6.5 |
| 2022-12-21 | CVE-2020-36623 | | A vulnerability was found in Pengu. | 6.5 |
| 2022-12-21 | CVE-2022-36221 | Nokia | Path Traversal vulnerability in Nokia Fastmile Firmware 3Tg00118Abad52 Nokia Fastmile 3tg00118abad52 is affected by an authenticated path traversal vulnerability which allows attackers to read any named pipe file on the system. | 6.5 |
| 2022-12-21 | CVE-2022-44756 | | Insights for Vulnerability Remediation (IVR) is vulnerable to improper input validation. | 6.5 |
| 2022-12-20 | CVE-2022-46139 | | TP-Link TL-WR940N V4 3.16.9 and earlier allows authenticated attackers to cause a Denial of Service (DoS) via uploading a crafted firmware image during the firmware update process. | 6.5 |
| 2022-12-20 | CVE-2022-47551 | | Apiman 1.5.7 through 2.2.3.Final has insufficient checks for read permissions within the Apiman Manager REST API. | 6.5 |
| 2022-12-19 | CVE-2022-46402 | Microchip | Improper Validation of Integrity Check Value vulnerability in Microchip products The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) accepts PairCon_rmSend with incorrect values. | 6.5 |
| 2022-12-19 | CVE-2022-23536 | Linuxfoundation | Unspecified vulnerability in Linuxfoundation Cortex 1.13.0/1.13.1/1.14.0 Cortex provides multi-tenant, long term storage for Prometheus. | 6.5 |
| 2022-12-19 | CVE-2022-4612 | Clickstudios | Insufficiently Protected Credentials vulnerability in Clickstudios Passwordstate 9.5/9.5.8.4 A vulnerability has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome and classified as problematic. | 6.5 |
| 2022-12-19 | CVE-2022-4613 | Clickstudios | Incorrect Authorization vulnerability in Clickstudios Passwordstate 9.5/9.5.8.4 A vulnerability was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome and classified as critical. | 6.5 |
| 2022-12-19 | CVE-2022-3961 | | The Directorist WordPress plugin before 7.4.4 does not prevent users with low privileges (like subscribers) from accessing sensitive system information. | 6.5 |
| 2022-12-19 | CVE-2022-4024 | | The Registration Forms WordPress plugin before 3.8.1.3 does not have authorisation and CSRF when deleting users via an init action handler, allowing unauthenticated attackers to delete arbitrary users (along with their posts) | 6.5 |
| 2022-12-19 | CVE-2022-4107 | | The SMSA Shipping for WooCommerce WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks, as well as does not validate the file to be downloaded, allowing any authenticated users, such as subscriber to download arbitrary file from the server | 6.5 |
| 2022-12-19 | CVE-2022-3876 | Clickstudios | Authorization Bypass Through User-Controlled Key vulnerability in Clickstudios Passwordstate A vulnerability, which was classified as problematic, has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. | 6.5 |
| 2022-12-19 | CVE-2022-42453 | | There are insufficient warnings when a Fixlet is imported by a user. | 6.5 |
| 2022-12-19 | CVE-2022-47549 | | An unprotected memory-access operation in optee_os in TrustedFirmware Open Portable Trusted Execution Environment (OP-TEE) before 3.20 allows a physically proximate adversary to bypass signature verification and install malicious trusted applications via electromagnetic fault injections. | 6.4 |
| 2022-12-23 | CVE-2022-39164 | IBM | Unspecified vulnerability in IBM AIX and Vios IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of service. | 6.2 |
| 2022-12-23 | CVE-2022-43848 | IBM | Unspecified vulnerability in IBM AIX and Vios IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX perfstat kernel extension to cause a denial of service. | 6.2 |
| 2022-12-23 | CVE-2022-43849 | IBM | Unspecified vulnerability in IBM AIX and Vios IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a non-privileged local user to exploit a vulnerability in the AIX pfcdd kernel extension to cause a denial of service. | 6.2 |
| 2022-12-23 | CVE-2022-39165 | IBM | Unspecified vulnerability in IBM AIX and Vios IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a non-privileged local user to exploit a vulnerability in CAA to cause a denial of service. | 6.2 |
| 2022-12-23 | CVE-2022-40233 | IBM | Unspecified vulnerability in IBM AIX and Vios IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX TCP/IP kernel extension to cause a denial of service. | 6.2 |
| 2022-12-23 | CVE-2022-43380 | IBM | Unspecified vulnerability in IBM AIX and Vios IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX NFS kernel extension to cause a denial of service. | 6.2 |
| 2022-12-23 | CVE-2022-43381 | IBM | Unspecified vulnerability in IBM AIX and Vios IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a non-privileged local user to exploit a vulnerability in the AIX SMB client to cause a denial of service. | 6.2 |
| 2022-12-25 | CVE-2022-4736 | Venganzasdelpasado | Cross-site Scripting vulnerability in Venganzasdelpasado Venganzas DEL Pasado A vulnerability was found in Venganzas del Pasado and classified as problematic. | 6.1 |
| 2022-12-25 | CVE-2022-4738 | Blood Bank Management System Project | Cross-site Scripting vulnerability in Blood Bank Management System Project Blood Bank Management System 1.0 A vulnerability classified as problematic has been found in SourceCodester Blood Bank Management System 1.0. | 6.1 |
| 2022-12-25 | CVE-2022-4740 | Keking | Cross-site Scripting vulnerability in Keking Kkfileview A vulnerability, which was classified as problematic, has been found in kkFileView. | 6.1 |
| 2022-12-25 | CVE-2019-25084 | | A vulnerability, which was classified as problematic, has been found in Hide Files on GitHub up to 2.x. | 6.1 |
| 2022-12-25 | CVE-2022-4735 | | A vulnerability classified as problematic was found in asrashley dash-live. | 6.1 |
| 2022-12-25 | CVE-2020-36627 | | A vulnerability was found in Macaron i18n. | 6.1 |
| 2022-12-25 | CVE-2022-45890 | | In Planet eStream before 6.72.10.07, a Reflected Cross-Site Scripting (XSS) vulnerability exists via any metadata filter field (e.g., search within Default.aspx with the r or fo parameter). | 6.1 |
| 2022-12-23 | CVE-2022-40011 | | Cross Site Scripting (XSS) vulnerability in typora through 1.38 allows remote attackers to run arbitrary code via export from editor. | 6.1 |
| 2022-12-22 | CVE-2022-47928 | | In MISP before 2.4.167, there is XSS in the template file uploads in app/View/Templates/upload_file.ctp. | 6.1 |
| 2022-12-22 | CVE-2022-22456 | IBM | Cross-site Scripting vulnerability in IBM Security Verify Governance 10.0.1 IBM Security Verify Governance, Identity Manager 10.0.1 is vulnerable to cross-site scripting. | 6.1 |
| 2022-12-22 | CVE-2022-29910 | | When closed or sent to the background, Firefox for Android would not properly record and persist HSTS settings.<br>*Note: This issue only affected Firefox for Android. | 6.1 |
| 2022-12-22 | CVE-2022-29911 | | An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could lead to script execution without <code>allow-scripts</code> being present. | 6.1 |
| 2022-12-22 | CVE-2022-29912 | | Requests initiated through reader mode did not properly omit cookies with a SameSite attribute. | 6.1 |
| 2022-12-22 | CVE-2022-34473 | | The HTML Sanitizer should have sanitized the <code>href</code> attribute of SVG <code><use></code> tags; however it incorrectly did not sanitize <code>xlink:href</code> attributes. | 6.1 |
| 2022-12-22 | CVE-2022-34474 | | Even when an iframe was sandboxed with <code>allow-top-navigation-by-user-activation</code>, if it received a redirect header to an external protocol the browser would process the redirect and prompt the user as appropriate. | 6.1 |
| 2022-12-22 | CVE-2022-34475 | | SVG <code><use></code> tags that referenced a same-origin document could have resulted in script execution if attacker input was sanitized via the HTML Sanitizer API. | 6.1 |
| 2022-12-22 | CVE-2022-36316 | | When using the Performance API, an attacker was able to notice subtle differences between PerformanceEntries and thus learn whether the target URL had been subject to a redirect. | 6.1 |
| 2022-12-22 | CVE-2022-40956 | | When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead. | 6.1 |
| 2022-12-22 | CVE-2022-45411 | | Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access to authorization headers and cookies inaccessible to JavaScript (such as cookies protected by HTTPOnly). | 6.1 |
| 2022-12-22 | CVE-2022-45413 | | Using the <code>S.browser_fallback_url parameter</code> parameter, an attacker could redirect a user to a URL and cause SameSite=Strict cookies to be sent.<br>*This issue only affects Firefox for Android. | 6.1 |
| 2022-12-22 | CVE-2022-45418 | | If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the browser UI, resulting in potential user confusion or spoofing attacks. | 6.1 |
| 2022-12-22 | CVE-2020-36624 | | A vulnerability was found in ahorner text-helpers up to 1.0.x. | 6.1 |
| 2022-12-22 | CVE-2022-4647 | | Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.2. | 6.1 |
| 2022-12-22 | CVE-2022-4644 | | Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.4. | 6.1 |
| 2022-12-21 | CVE-2022-4637 | | A vulnerability classified as problematic has been found in ep3-bs up to 1.7.x. | 6.1 |
| 2022-12-21 | CVE-2022-4638 | | A vulnerability classified as problematic was found in collective.contact.widget up to 1.12. | 6.1 |
| 2022-12-21 | CVE-2020-36621 | | A vulnerability, which was classified as problematic, has been found in chedabob whatismyudid. | 6.1 |
| 2022-12-21 | CVE-2021-4263 | | A vulnerability, which was classified as problematic, has been found in leanote. | 6.1 |
| 2022-12-21 | CVE-2021-4265 | | A vulnerability was found in siwapp-ror. | 6.1 |
| 2022-12-21 | CVE-2021-4266 | | A vulnerability classified as problematic has been found in Webdetails cpf up to 9.5.0.0-80. | 6.1 |
| 2022-12-21 | CVE-2021-4267 | | A vulnerability classified as problematic was found in tad_discuss. | 6.1 |
| 2022-12-21 | CVE-2021-4269 | | A vulnerability has been found in SimpleRisk and classified as problematic. | 6.1 |
| 2022-12-21 | CVE-2021-4270 | | A vulnerability was found in Imprint CMS. | 6.1 |
| 2022-12-21 | CVE-2021-4271 | W2Wiki Project | Cross-site Scripting vulnerability in W2Wiki Project W2Wiki A vulnerability was found in panicsteve w2wiki. | 6.1 |
| 2022-12-21 | CVE-2021-4272 | Studygolang | Cross-site Scripting vulnerability in Studygolang A vulnerability classified as problematic has been found in studygolang. | 6.1 |
| 2022-12-21 | CVE-2021-4273 | Studygolang | Cross-site Scripting vulnerability in Studygolang A vulnerability classified as problematic was found in studygolang. | 6.1 |
| 2022-12-21 | CVE-2021-4274 | Bird LG Project | Cross-site Scripting vulnerability in Bird-Lg Project Bird-Lg A vulnerability, which was classified as problematic, has been found in sileht bird-lg. | 6.1 |
| 2022-12-21 | CVE-2022-46095 | Covid 19 Directory ON Vaccination System Project | Cross-site Scripting vulnerability in Covid-19 Directory on Vaccination System Project Covid-19 Directory on Vaccination System 1.0 Sourcecodester Covid-19 Directory on Vaccination System 1.0 was discovered to contain a Cross-Site Scripting (XSS) vulnerability via verification.php because the program does not verify the txtvaccinationID parameter. | 6.1 |
| 2022-12-21 | CVE-2022-46096 | Covid 19 Directory ON Vaccination System Project | Cross-site Scripting vulnerability in Covid-19 Directory on Vaccination System Project Covid-19 Directory on Vaccination System 1.0 A Cross site scripting (XSS) vulnerability in Sourcecodester Online Covid-19 Directory on Vaccination System v1.0 allows attackers to execute arbitrary code via the txtfullname parameter or txtphone parameter to register.php without logging in. | 6.1 |
| 2022-12-21 | CVE-2022-4631 | WP BAN Project | Cross-site Scripting vulnerability in Wp-Ban Project Wp-Ban A vulnerability, which was classified as problematic, was found in WP-Ban. | 6.1 |
| 2022-12-21 | CVE-2022-4632 | | A vulnerability has been found in Auto Upload Images up to 3.3.0 and classified as problematic. | 6.1 |
| 2022-12-21 | CVE-2022-40841 | NDK Design | Cross-site Scripting vulnerability in Ndk-Design Ndkadvancedcustomizationfields 3.5.0 A cross-site scripting (XSS) vulnerability in NdkAdvancedCustomizationFields v3.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payloads injected into the "htmlNodes" parameter. | 6.1 |
| 2022-12-21 | CVE-2022-4617 | | Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.3.2. | 6.1 |
| 2022-12-19 | CVE-2022-39160 | IBM | Cross-site Scripting vulnerability in IBM Cognos Analytics IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting. | 6.1 |
| 2022-12-19 | CVE-2022-4615 | | Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.2. | 6.1 |
| 2022-12-19 | CVE-2021-4260 | | A vulnerability was found in oils-js. | 6.1 |
| 2022-12-19 | CVE-2022-40743 | | Improper Input Validation vulnerability for the xdebug plugin in Apache Software Foundation Apache Traffic Server can lead to cross site scripting and cache poisoning attacks.This issue affects Apache Traffic Server: 9.0.0 to 9.1.3. | 6.1 |
| 2022-12-19 | CVE-2022-38662 | Hcltech | Open Redirect vulnerability in Hcltech HCL Digital Experience 8.5/9.0/9.5 In HCL Digital Experience, URLs can be constructed to redirect users to untrusted sites. | 6.1 |
| 2022-12-19 | CVE-2022-47500 | | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Software Foundation Apache Helix UI component.This issue affects Apache Helix all releases from 0.8.0 to 1.0.4. | 6.1 |
| 2022-12-19 | CVE-2022-41993 | Jacic | Cross-site Scripting vulnerability in Jacic Electronic Bidding Core System 6 Cross-site scripting vulnerability in DENSHI NYUSATSU CORE SYSTEM v6 R4 and earlier allows a remote unauthenticated attacker to inject an arbitrary script. | 6.1 |
| 2022-12-19 | CVE-2022-46287 | Jacic | Cross-site Scripting vulnerability in Jacic Electronic Bidding Core System 6 Cross-site scripting vulnerability in DENSHI NYUSATSU CORE SYSTEM v6 R4 and earlier allows a remote unauthenticated attacker to inject an arbitrary script. | 6.1 |
| 2022-12-19 | CVE-2022-46288 | Jacic | Open Redirect vulnerability in Jacic Electronic Bidding Core System 6 Open redirect vulnerability in DENSHI NYUSATSU CORE SYSTEM v6 R4 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having a user to access a specially crafted URL. | 6.1 |
| 2022-12-23 | CVE-2022-40897 | Python | Unspecified vulnerability in Python Setuptools Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. | 5.9 |
| 2022-12-22 | CVE-2022-43592 | Openimageio Project | Out-of-bounds Read vulnerability in Openimageio Project Openimageio 2.4.4.2 An information disclosure vulnerability exists in the DPXOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. | 5.9 |
| 2022-12-22 | CVE-2022-43593 | Openimageio Project | NULL Pointer Dereference vulnerability in Openimageio Project Openimageio 2.4.4.2 A denial of service vulnerability exists in the DPXOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. | 5.9 |
| 2022-12-22 | CVE-2022-43594 | Openimageio Project | NULL Pointer Dereference vulnerability in Openimageio Project Openimageio 2.4.4.2 Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. | 5.9 |
| 2022-12-22 | CVE-2022-43595 | Openimageio Project | NULL Pointer Dereference vulnerability in Openimageio Project Openimageio 2.4.4.2 Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. | 5.9 |
| 2022-12-22 | CVE-2022-43596 | Openimageio Project | Out-of-bounds Read vulnerability in Openimageio Project Openimageio 2.4.4.2 An information disclosure vulnerability exists in the IFFOutput channel interleaving functionality of OpenImageIO Project OpenImageIO v2.4.4.2. | 5.9 |
| 2022-12-22 | CVE-2022-43603 | Openimageio Project
Fedoraproject | NULL Pointer Dereference vulnerability in multiple products A denial of service vulnerability exists in the ZfileOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. | 5.9 |
| 2022-12-22 | CVE-2022-22746 | | A race condition could have allowed bypassing the fullscreen notification which could have lead to a fullscreen window spoof being unnoticed.<br>*This bug only affects Firefox for Windows. | 5.9 |
| 2022-12-21 | CVE-2022-38655 | Hcltech | Unspecified vulnerability in Hcltech Bigfix Webui 20 BigFix WebUI non-master operators are missing controls that prevent them from being able to modify the relevance of fixlets or to deploy fixlets from the BES Support external site. | 5.8 |
| 2022-12-23 | CVE-2022-47946 | | An issue was discovered in the Linux kernel 5.10.x before 5.10.155. | 5.5 |
| 2022-12-22 | CVE-2022-41684 | Openimageio
Fedoraproject | Out-of-bounds Read vulnerability in multiple products A heap out of bounds read vulnerability exists in the OpenImageIO master-branch-9aeece7a when parsing the image file directory part of a PSD image file. | 5.5 |
| 2022-12-22 | CVE-2022-4662 | Linux | Non-exit on Failed Initialization vulnerability in Linux Kernel A flaw incorrect access control in the Linux kernel USB core subsystem was found in the way user attaches usb device. | 5.5 |
| 2022-12-22 | CVE-2022-36314 | | When opening a Windows shortcut from the local filesystem, an attacker could supply a remote path that would lead to unexpected network requests from the operating system.<br>This bug only affects Firefox for Windows. | 5.5 |
| 2022-12-22 | CVE-2022-3266 | | An out-of-bounds read can occur when decoding H264 video. | 5.5 |
| 2022-12-21 | CVE-2022-4641 | PIG Vector Project | Insecure Temporary File vulnerability in Pig-Vector Project Pig-Vector A vulnerability was found in pig-vector and classified as problematic. | 5.5 |
| 2022-12-20 | CVE-2022-41590 | Huawei | Improper Authentication vulnerability in Huawei Harmonyos 3.0.0 Some smartphones have authentication-related (including session management) vulnerabilities as the setup wizard is bypassed. | 5.5 |
| 2022-12-20 | CVE-2022-43875 | IBM | Improper Input Validation vulnerability in IBM Financial Transaction Manager 3.2.4 IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 could allow an authenticated user to lock additional RM authorizations, resulting in a denial of service on displaying or managing these authorizations. | 5.5 |
| 2022-12-19 | CVE-2022-47512 | Solarwinds | Cleartext Storage of Sensitive Information vulnerability in Solarwinds Platform 2022.4.0 Sensitive information was stored in plain text in a file that is accessible by a user with a local account in Hybrid Cloud Observability (HCO)/ SolarWinds Platform 2022.4. | 5.5 |
| 2022-12-19 | CVE-2022-4610 | Clickstudios | Use of a Broken or Risky Cryptographic Algorithm vulnerability in Clickstudios Passwordstate 9.5/9.5.8.4 A vulnerability, which was classified as problematic, has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. | 5.5 |
| 2022-12-25 | CVE-2022-4731 | | A vulnerability, which was classified as problematic, was found in myapnea up to 29.0.x. | 5.4 |
| 2022-12-25 | CVE-2022-44012 | | An issue was discovered in /DS/LM_API/api/SelectionService/InsertQueryWithActiveRelationsReturnId in Simmeth Lieferantenmanager before 5.6. | 5.4 |
| 2022-12-25 | CVE-2022-44380 | | Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting (XSS) for View Assigned Assets. | 5.4 |
| 2022-12-25 | CVE-2022-45892 | | In Planet eStream before 6.72.10.07, multiple Stored Cross-Site Scripting (XSS) vulnerabilities exist: Disclaimer, Search Function, Comments, Batch editing tool, Content Creation, Related Media, Create new user, and Change Username. | 5.4 |
| 2022-12-23 | CVE-2022-4692 | | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0. | 5.4 |
| 2022-12-23 | CVE-2022-47524 | | F-Secure SAFE Browser 19.1 before 19.2 for Android allows an IDN homograph attack. | 5.4 |
| 2022-12-23 | CVE-2022-4690 | | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0. | 5.4 |
| 2022-12-22 | CVE-2022-1197 | | When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the existing copy of the key that was not yet revoked, and the existing key was kept as non-revoked. | 5.4 |
| 2022-12-22 | CVE-2022-28286 | | Due to a layout change, iframe contents could have been rendered outside of its border. | 5.4 |
| 2022-12-22 | CVE-2022-44510 | Adobe | Cross-site Scripting vulnerability in Adobe Experience Manager Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. | 5.4 |
| 2022-12-22 | CVE-2021-43657 | Simple Client Management System Project | Cross-site Scripting vulnerability in Simple Client Management System Project Simple Client Management System 1.0 A Stored Cross-site scripting (XSS) vulnerability via MAster.php in Sourcecodetester Simple Client Management System (SCMS) 1.0 allows remote attackers to inject arbitrary web script or HTML via the vulnerable input fields. | 5.4 |
| 2022-12-22 | CVE-2022-43271 | Inhabit | Cross-site Scripting vulnerability in Inhabit Move CRM 4 Inhabit Systems Pty Ltd Move CRM version 4, build 260 was discovered to contain a cross-site scripting (XSS) vulnerability via the User profile component. | 5.4 |
| 2022-12-21 | CVE-2022-4640 | Mingsoft | Improper Enforcement of Message or Data Structure vulnerability in Mingsoft Mcms 5.2.9 A vulnerability has been found in Mingsoft MCMS 5.2.9 and classified as problematic. | 5.4 |
| 2022-12-21 | CVE-2022-4642 | | A vulnerability was found in tatoeba2. | 5.4 |
| 2022-12-21 | CVE-2022-43543 | | KDDI +Message App, NTT DOCOMO +Message App, and SoftBank +Message App contain a vulnerability caused by improper handling of Unicode control characters. | 5.4 |
| 2022-12-21 | CVE-2022-25929 | | The package smoothie from 1.31.0 and before 1.36.1 are vulnerable to Cross-site Scripting (XSS) due to improper user input sanitization in strokeStyle and tooltipLabel properties. | 5.4 |
| 2022-12-19 | CVE-2022-46400 | Microchip | Incorrect Authorization vulnerability in Microchip products The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) allows attackers to bypass passkey entry in legacy pairing. | 5.4 |
| 2022-12-19 | CVE-2022-46401 | Microchip | Unspecified vulnerability in Microchip products The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) accepts PauseEncReqPlainText before pairing is complete. | 5.4 |
| 2022-12-19 | CVE-2022-23543 | | Silverware Games is a social network where people can play games online. | 5.4 |
| 2022-12-19 | CVE-2022-30679 | Adobe | Cross-site Scripting vulnerability in Adobe Experience Manager Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. | 5.4 |
| 2022-12-19 | CVE-2022-35693 | Adobe | Cross-site Scripting vulnerability in Adobe Experience Manager Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. | 5.4 |
| 2022-12-19 | CVE-2022-35695 | Adobe | Cross-site Scripting vulnerability in Adobe Experience Manager Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. | 5.4 |
| 2022-12-19 | CVE-2022-42345 | Adobe | Cross-site Scripting vulnerability in Adobe Experience Manager Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. | 5.4 |
| 2022-12-19 | CVE-2022-42346 | Adobe | Cross-site Scripting vulnerability in Adobe Experience Manager Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. | 5.4 |
| 2022-12-19 | CVE-2022-42348 | Adobe | Cross-site Scripting vulnerability in Adobe Experience Manager Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. | 5.4 |
| 2022-12-19 | CVE-2022-42349 | Adobe | Cross-site Scripting vulnerability in Adobe Experience Manager Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. | 5.4 |
| 2022-12-19 | CVE-2022-42350 | Adobe | Cross-site Scripting vulnerability in Adobe Experience Manager Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. | 5.4 |
| 2022-12-19 | CVE-2022-42352 | Adobe | Cross-site Scripting vulnerability in Adobe Experience Manager Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. | 5.4 |
| 2022-12-19 | CVE-2022-42354 | Adobe | Cross-site Scripting vulnerability in Adobe Experience Manager Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. | 5.4 |
| 2022-12-19 | CVE-2022-42356 | Adobe | Cross-site Scripting vulnerability in Adobe Experience Manager Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. | 5.4 |
| 2022-12-19 | CVE-2022-42357 | Adobe | Cross-site Scripting vulnerability in Adobe Experience Manager Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. | 5.4 |
| 2022-12-19 | CVE-2022-42362 | Adobe | Cross-site Scripting vulnerability in Adobe Experience Manager Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. | 5.4 |
| 2022-12-19 | CVE-2022-42364 | Adobe | Cross-site Scripting vulnerability in Adobe Experience Manager Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. | 5.4 |
| 2022-12-19 | CVE-2022-42365 | Adobe | Cross-site Scripting vulnerability in Adobe Experience Manager Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. | 5.4 |
| 2022-12-19 | CVE-2022-44463 | Adobe | Cross-site Scripting vulnerability in Adobe Experience Manager Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. | 5.4 |
| 2022-12-19 | CVE-2022-44465 | Adobe | Cross-site Scripting vulnerability in Adobe Experience Manager Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. | 5.4 |
| 2022-12-19 | CVE-2022-44466 | Adobe | Cross-site Scripting vulnerability in Adobe Experience Manager Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. | 5.4 |
| 2022-12-19 | CVE-2022-44467 | Adobe | Cross-site Scripting vulnerability in Adobe Experience Manager Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. | 5.4 |
| 2022-12-19 | CVE-2022-44470 | Adobe | Cross-site Scripting vulnerability in Adobe Experience Manager Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. | 5.4 |
| 2022-12-19 | CVE-2022-44471 | Adobe | Cross-site Scripting vulnerability in Adobe Experience Manager Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. | 5.4 |
| 2022-12-19 | CVE-2022-44474 | Adobe | Cross-site Scripting vulnerability in Adobe Experience Manager Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. | 5.4 |
| 2022-12-19 | CVE-2022-44488 | | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. | 5.4 |
| 2022-12-19 | CVE-2022-4614 | | Cross-site Scripting (XSS) - Stored in GitHub repository alagrede/znote-app prior to 1.7.11. | 5.4 |
| 2022-12-19 | CVE-2022-31683 | | Concourse (7.x.y prior to 7.8.3 and 6.x.y prior to 6.7.9) contains an authorization bypass issue. | 5.4 |
| 2022-12-19 | CVE-2022-3937 | | The Easy Video Player WordPress plugin before 1.2.2.3 does not sanitize and escapes some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks. | 5.4 |
| 2022-12-19 | CVE-2022-3983 | | The Checkout for PayPal WordPress plugin before 1.0.14 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks | 5.4 |
| 2022-12-19 | CVE-2022-3984 | | The Flowplayer Video Player WordPress plugin before 1.0.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks | 5.4 |
| 2022-12-19 | CVE-2022-3985 | | The Videojs HTML5 Player WordPress plugin before 1.1.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks | 5.4 |
| 2022-12-19 | CVE-2022-3986 | | The WP Stripe Checkout WordPress plugin before 1.2.2.21 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks | 5.4 |
| 2022-12-19 | CVE-2022-3987 | | The Responsive Lightbox2 WordPress plugin before 1.0.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks | 5.4 |
| 2022-12-19 | CVE-2022-4058 | | The Photo Gallery by 10Web WordPress plugin before 1.8.3 does not validate and escape some parameters before outputting them back in in JS code later on in another page, which could lead to Stored XSS issue when an attacker makes a logged in admin open a malicious URL or page under their control. | 5.4 |
| 2022-12-19 | CVE-2022-4609 | | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0. | 5.4 |
| 2022-12-19 | CVE-2022-38653 | Hcltech | Cross-site Scripting vulnerability in Hcltech Digital Experience 8.5/9.0/9.5 In HCL Digital Experience, customized XSS payload can be constructed such that it is served in the application unencoded. | 5.4 |
| 2022-12-19 | CVE-2022-3877 | Clickstudios | Cross-site Scripting vulnerability in Clickstudios Passwordstate A vulnerability, which was classified as problematic, was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. | 5.4 |
| 2022-12-25 | CVE-2021-4277 | | A vulnerability, which was classified as problematic, has been found in fredsmith utils. | 5.3 |
| 2022-12-25 | CVE-2022-44381 | | Snipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response variations in a /password/reset request. | 5.3 |
| 2022-12-24 | CVE-2022-22449 | IBM | Information Exposure Through an Error Message vulnerability in IBM Security Verify Governance 10.0.1 IBM Security Verify Governance, Identity Manager 10.01 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. | 5.3 |
| 2022-12-23 | CVE-2022-44565 | | An improper access validation vulnerability exists in airMAX AC <8.7.11, airFiber 60/LR <2.6.2, airFiber 60 XG/HD <v1.0.0 and airFiber GBE <1.4.1 that allows a malicious actor to retrieve status and usage data from the UISP device. | 5.3 |
| 2022-12-23 | CVE-2022-23513 | | Pi-Hole is a network-wide ad blocking via your own Linux hardware, AdminLTE is a Pi-hole Dashboard for stats and more. | 5.3 |
| 2022-12-22 | CVE-2022-36354 | Openimageio Project
Fedoraproject | Off-by-one Error vulnerability in multiple products A heap out-of-bounds read vulnerability exists in the RLA format parser of OpenImageIO master-branch-9aeece7a and v2.3.19.0. | 5.3 |
| 2022-12-22 | CVE-2022-35646 | IBM | Improper Authentication vulnerability in IBM Security Verify Governance 10.0.1 IBM Security Verify Governance, Identity Manager 10.0.1 software component could allow an authenticated user to modify or cancel any other user's access request using man-in-the-middle techniques. | 5.3 |
| 2022-12-22 | CVE-2022-36318 | | When visiting directory listings for `chrome://` URLs as source text, some parameters were reflected. | 5.3 |
| 2022-12-22 | CVE-2022-41697 | Ghost | Response Discrepancy Information Exposure vulnerability in Ghost 5.9.4 A user enumeration vulnerability exists in the login functionality of Ghost Foundation Ghost 5.9.4. | 5.3 |
| 2022-12-22 | CVE-2022-25948 | | The package liquidjs before 10.0.0 are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in leaking properties of a prototype. | 5.3 |
| 2022-12-21 | CVE-2022-3185 | | Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the affected product exposes sensitive data concerning the device. | 5.3 |
| 2022-12-21 | CVE-2022-3187 | | Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where certain PHP pages only validate when a valid connection is established with the database. | 5.3 |
| 2022-12-21 | CVE-2022-3188 | | Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where unauthenticated users could open PHP index pages without authentication and download the history file from the device; the history file includes the latest actions completed by specific users. | 5.3 |
| 2022-12-21 | CVE-2022-3189 | | Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where a specially crafted PHP script could use parameters from a HTTP request to create a URL capable of changing the host parameter. | 5.3 |
| 2022-12-21 | CVE-2022-23551 | | aad-pod-identity assigns Azure Active Directory identities to Kubernetes applications and has now been deprecated as of 24 October 2022. | 5.3 |
| 2022-12-21 | CVE-2022-4630 | Daloradius | Incorrect Permission Assignment for Critical Resource vulnerability in Daloradius Sensitive Cookie Without 'HttpOnly' Flag in GitHub repository lirantal/daloradius prior to master. | 5.3 |
| 2022-12-21 | CVE-2022-42454 | | Insights for Vulnerability Remediation (IVR) is vulnerable to man-in-the-middle attacks that may lead to information disclosure. | 5.3 |
| 2022-12-20 | CVE-2022-46313 | | The sensor privacy module has an authentication vulnerability. | 5.3 |
| 2022-12-20 | CVE-2022-46318 | Huawei | Unspecified vulnerability in Huawei Emui 11.0.1/12.0.0/12.0.1 The HAware module has a function logic error. | 5.3 |
| 2022-12-20 | CVE-2022-43872 | IBM | Incorrect Authorization vulnerability in IBM Financial Transaction Manager 3.2.4 IBM Financial Transaction Manager 3.2.4 authorization checks are done incorrectly for some HTTP requests which allows getting unauthorized technical information (e.g. | 5.3 |
| 2022-12-19 | CVE-2022-43887 | IBM | Information Exposure Through Log Files vulnerability in IBM Cognos Analytics IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could be vulnerable to sensitive information exposure by passing API keys to log files. | 5.3 |
| 2022-12-19 | CVE-2022-4611 | Clickstudios | Use of Hard-coded Credentials vulnerability in Clickstudios Passwordstate A vulnerability, which was classified as problematic, was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. | 5.3 |
| 2022-12-19 | CVE-2022-37392 | | Improper Check for Unusual or Exceptional Conditions vulnerability in handling the requests to Apache Traffic Server. | 5.3 |
| 2022-12-19 | CVE-2022-47547 | Protocol | Improper Preservation of Permissions vulnerability in Protocol Gossipsub 1.1 GossipSub 1.1, as used for Ethereum 2.0, allows a peer to maintain a positive score (and thus not be pruned from the network) even though it continuously misbehaves by never forwarding topic messages. | 5.3 |
| 2022-12-20 | CVE-2022-39166 | IBM | Unspecified vulnerability in IBM Security Guardium 11.4 IBM Security Guardium 11.4 could allow a privileged user to obtain sensitive information inside of an HTTP response. | 4.9 |
| 2022-12-19 | CVE-2022-4108 | | The Wholesale Market for WooCommerce WordPress plugin before 1.0.8 does not validate user input used to generate system path, allowing high privilege users such as admin to download arbitrary file from the server even when they should not be able to (for example in multisite) | 4.9 |
| 2022-12-23 | CVE-2022-4697 | | The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wp_user_cover_default_image_url’ parameter in versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping. | 4.8 |
| 2022-12-23 | CVE-2022-4698 | | The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several form fields in versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping. | 4.8 |
| 2022-12-21 | CVE-2022-44449 | | Stored cross-site scripting vulnerability in Zenphoto versions prior to 1.6 allows remote a remote authenticated attacker with an administrative privilege to inject an arbitrary script. | 4.8 |
| 2022-12-20 | CVE-2022-46422 | | An issue in Netgear WNR2000 v1 1.2.3.7 and earlier allows authenticated attackers to cause a Denial of Service (DoS) via uploading a crafted firmware image during the firmware update process. | 4.8 |
| 2022-12-20 | CVE-2022-46428 | | TP-Link TL-WR1043ND V1 3.13.15 and earlier allows authenticated attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a crafted firmware image during the firmware update process. | 4.8 |
| 2022-12-20 | CVE-2022-46430 | | TP-Link TL-WR740N V1 and V2 v3.12.4 and earlier allows authenticated attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a crafted firmware image during the firmware update process. | 4.8 |
| 2022-12-20 | CVE-2022-4619 | | The Sidebar Widgets by CodeLights plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Extra CSS class’ parameter in versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. | 4.8 |
| 2022-12-19 | CVE-2022-40435 | Employee Performance Evaluation System Project | Cross-site Scripting vulnerability in Employee Performance Evaluation System Project Employee Performance Evaluation System 1.0 Employee Performance Evaluation System v1.0 was discovered to contain a persistent cross-site scripting (XSS) vulnerability via adding new entries under the Departments and Designations module. | 4.8 |
| 2022-12-19 | CVE-2022-3832 | | The External Media WordPress plugin before 1.0.36 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | 4.8 |
| 2022-12-19 | CVE-2022-4112 | VMS Studio | Cross-site Scripting vulnerability in Vms-Studio Quizlord 1.0.1/2.0 The Quizlord WordPress plugin through 2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | 4.8 |
| 2022-12-20 | CVE-2022-39304 | | ghinstallation provides transport, which implements http.RoundTripper to provide authentication as an installation for GitHub Apps. | 4.7 |
| 2022-12-20 | CVE-2022-46771 | IBM | Cross-site Scripting vulnerability in IBM Urbancode Deploy 7.3.0.0 IBM UrbanCode Deploy (UCD) 6.2.0.0 through 6.2.7.18, 7.0.5.0 through 7.0.5.13, 7.1.0.0 through 7.1.2.9, 7.2.0.0 through 7.2.3.2 and 7.3.0.0 is vulnerable to cross-site scripting. | 4.6 |
| 2022-12-22 | CVE-2022-22457 | IBM | Cleartext Storage of Sensitive Information vulnerability in IBM Security Verify Governance 10.0.1 IBM Security Verify Governance, Identity Manager 10.0.1 stores sensitive information including user credentials in plain clear text which can be read by a local privileged user. | 4.4 |
| 2022-12-20 | CVE-2022-43382 | IBM | Unspecified vulnerability in IBM AIX and Vios IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a local user with elevated privileges to exploit a vulnerability in the lpd daemon to cause a denial of service. | 4.4 |
| 2022-12-24 | CVE-2022-43860 | IBM | SQL Injection vulnerability in IBM I 7.3/7.4/7.5 IBM Navigator for i 7.3, 7.4, and 7.5 could allow an authenticated user to obtain sensitive information they are authorized to but not while using this interface. | 4.3 |
| 2022-12-22 | CVE-2022-3794 | | The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various AJAX actions in versions up to, and including, 2.5.6. | 4.3 |
| 2022-12-22 | CVE-2022-43857 | IBM | Path Traversal vulnerability in IBM I 7.3/7.4/7.5 IBM Navigator for i 7.3, 7.4 and 7.5 could allow an authenticated user to access IBM Navigator for i log files they are authorized to but not while using this interface. | 4.3 |
| 2022-12-22 | CVE-2022-43858 | IBM | Path Traversal vulnerability in IBM I 7.3/7.4/7.5 IBM Navigator for i 7.3, 7.4, and 7.5 could allow an authenticated user to access the file system and download files they are authorized to but not while using this interface. | 4.3 |
| 2022-12-22 | CVE-2022-43859 | IBM | SQL Injection vulnerability in IBM I 7.3/7.4/7.5 IBM Navigator for i 7.3, 7.4, and 7.5 could allow an authenticated user to obtain sensitive information for an object they are authorized to but not while using this interface. | 4.3 |
| 2022-12-22 | CVE-2021-4221 | Mozilla | Unspecified vulnerability in Mozilla Firefox If a domain name contained a RTL character, it would cause the domain to be rendered to the right of the path. | 4.3 |
| 2022-12-22 | CVE-2022-1520 | | When viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both, Thunderbird may show an incorrect encryption or signature status. | 4.3 |
| 2022-12-22 | CVE-2022-22743 | | When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could have made the browser unable to leave fullscreen mode. | 4.3 |
| 2022-12-22 | CVE-2022-22749 | | When scanning QR codes, Firefox for Android would have allowed navigation to some URLs that do not point to web content.<br>*This bug only affects Firefox for Android. | 4.3 |
| 2022-12-22 | CVE-2022-22762 | Mozilla | Unspecified vulnerability in Mozilla Firefox Under certain circumstances, a JavaScript alert (or prompt) could have been shown while another website was displayed underneath it. | 4.3 |
| 2022-12-22 | CVE-2022-26382 | | While the text displayed in Autofill tooltips cannot be directly read by JavaScript, the text was rendered using page fonts. | 4.3 |
| 2022-12-22 | CVE-2022-26383 | | When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification. | 4.3 |
| 2022-12-22 | CVE-2022-29915 | | The Performance API did not properly hide the fact whether a request cross-origin resource has observed redirects. | 4.3 |
| 2022-12-22 | CVE-2022-31745 | | If array shift operations are not used, the Garbage Collector may have become confused about valid objects. | 4.3 |
| 2022-12-22 | CVE-2022-34472 | | If there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests would have been blocked, resulting in incorrect error pages being shown. | 4.3 |
| 2022-12-22 | CVE-2022-36315 | | When loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of previously cached entries with incorrect, different integrity metadata. | 4.3 |
| 2022-12-22 | CVE-2022-38474 | | A website that had permission to access the microphone could record audio without the audio notification being shown. | 4.3 |
| 2022-12-22 | CVE-2022-3034 | | When receiving an HTML email that specified to load an <code>iframe</code> element from a remote location, a request to the remote document was sent. | 4.3 |
| 2022-12-22 | CVE-2022-45417 | | Service Workers did not detect Private Browsing Mode correctly in all cases, which could have led to Service Workers being written to disk for websites visited in Private Browsing Mode. | 4.3 |
| 2022-12-22 | CVE-2022-46877 | Mozilla
Debian | By confusing the browser, the fullscreen notification could have been delayed or suppressed, resulting in potential user confusion or spoofing attacks. | 4.3 |
| 2022-12-22 | CVE-2022-41654 | | An authentication bypass vulnerability exists in the newsletter subscription functionality of Ghost Foundation Ghost 5.9.4. | 4.3 |
| 2022-12-19 | CVE-2022-4124 | | The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF checks when deleting popups, which could allow unauthenticated users to delete them | 4.3 |
| 2022-12-19 | CVE-2022-4125 | | The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF check when creating/updating popups, and is missing sanitisation as well as escaping, which could allow unauthenticated attackers to create arbitrary popups and add Stored XSS payloads as well | 4.3 |