NVD disclosure day

Published threat advisories for December 5, 2022

CVE advisoryCRITICAL

CVE-2022-32221

Curl Handle Reuse Vulnerability Leads to Data Corruption or Memory Issues.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

A flaw in the libcurl library may cause applications to send incorrect data or encounter memory issues when reusing a connection handle under specific conditions involving PUT and POST requests. This vulnerability could lead to application misbehavior, but its direct impact on publicly accessible services is unlikely d

NVD modified: NVD date unavailable
CVE advisoryKnown Exploit

CVE-2022-46169

Cacti Command Injection Vulnerability Exposes Servers To Code Execution.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A critical vulnerability in the Cacti platform allows unauthenticated users to execute arbitrary code on affected servers. This presents a significant business risk, as attackers can gain system control, leading to data compromise or further network infiltration. Organizations using vulnerable Cacti versions should app

NVD modified: NVD date unavailable • CISA KEV
CVE advisoryHIGH

CVE-2022-3907

Clerk WordPress Plugin Time-Based API Key Validation Vulnerability

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

The Clerk WordPress plugin is vulnerable to time-based attacks in its API request validation function. Attackers can exploit this by sending crafted requests to infer sensitive API key information, potentially leading to unauthorized access. This is a concern for any WordPress site using the Clerk plugin for API calls.

NVD modified: NVD date unavailable