# CVEs published 2022-11-22

83 CVEs were published on November 22, 2022: 36 critical, 20 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2021-3942](https://cve.now/CVE-2021-3942.md): Certain HP Print products and Digital Sending products may be vulnerable to potential remote code execution and buffer overflow with use… (CVSS 9.8, HP Print products and Digital Sending products)
- [CVE-2022-2791](https://cve.now/CVE-2022-2791.md): Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulnerable to CWE-434 Unrestricted Upload of File with Dangerous… (CVSS 5.9, Emerson Electric Proficy Machine Edition)
- [CVE-2022-40228](https://cve.now/CVE-2022-40228.md): IBM DataPower Gateway session fixation (CVSS 3.7, IBM DataPower Gateway)
- [CVE-2022-44737](https://cve.now/CVE-2022-44737.md): WordPress All In One WP Security plugin \<= 5.1.0 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities (CVSS 6.5, All In One WP Security & Firewall Team All-In-One Security…)
- [CVE-2022-3910](https://cve.now/CVE-2022-3910.md): Use after free in IO\_uring in the Linux Kernel (CVSS 7.8, Linux Kernel)
- [CVE-2022-2513](https://cve.now/CVE-2022-2513.md): Cleartext Credentials Vulnerability on Hitachi Energy’s Multiple IED Connectivity Packages (IED ConnPacks) and PCM600 Products (CVSS 7.1, Hitachi Energy PCM600 · Hitachi Energy 670 Connectivity… +4)
- [CVE-2022-45363](https://cve.now/CVE-2022-45363.md): WordPress Betheme premium theme \<= 26.6.1 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (CVSS 5.4, Muffingroup Betheme)
- [CVE-2022-37931](https://cve.now/CVE-2022-37931.md): A vulnerability in NetBatch-Plus software allows unauthorized access to the application (CVSS 7.3, HPE NetBatch-Plus software)
- [CVE-2022-0222](https://cve.now/CVE-2022-0222.md): A CWE-269: Improper Privilege Management vulnerability exists that could cause a denial of service of the Ethernet communication of the… (CVSS 7.5, Schneider Electric Modicon M340 CPUs · Schneider Electric M…)
- [CVE-2022-30529](https://cve.now/CVE-2022-30529.md): File upload vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to upload… (CVSS 7.2)
- [CVE-2022-3088](https://cve.now/CVE-2022-3088.md): UC-8100A-ME-T System Image: Versions v1.0 to v1.6, UC-2100 System Image: Versions v1.0 to v1.12, UC-2100-W System Image: Versions v1.0 to… (CVSS 7.8, Moxa UC-8100A-ME-T System Imaage · Moxa UC-2100 System… +11)
- [CVE-2022-33012](https://cve.now/CVE-2022-33012.md): Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack. (CVSS 8.8, microweber/microweber)
- [CVE-2022-3500](https://cve.now/CVE-2022-3500.md): A vulnerability was found in keylime. (CVSS 5.1, keylime)
- [CVE-2022-35407](https://cve.now/CVE-2022-35407.md): An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. (CVSS 7.8)
- [CVE-2022-36179](https://cve.now/CVE-2022-36179.md): Fusiondirectory 1.3 suffers from Improper Session Handling. (CVSS 9.8)
- [CVE-2022-36180](https://cve.now/CVE-2022-36180.md): Fusiondirectory 1.3 is vulnerable to Cross Site Scripting (XSS) via /fusiondirectory/index.php?message=\[injection\]… (CVSS 9.6)
- [CVE-2022-36227](https://cve.now/CVE-2022-36227.md): In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if th (no CVSS)
- [CVE-2022-37301](https://cve.now/CVE-2022-37301.md): A CWE-191: Integer Underflow (Wrap or Wraparound) vulnerability exists that could cause a denial of service of the controller due to… (CVSS 7.5, Schneider Electric Modicon M340 CPU · Schneider Electric… +3)
- [CVE-2022-37773](https://cve.now/CVE-2022-37773.md): An authenticated SQL Injection vulnerability in the statistics page (/statistics/retrieve) of Maarch RM 2.8, via the filter parameter… (CVSS 6.5)
- [CVE-2022-37774](https://cve.now/CVE-2022-37774.md): There is a broken access control vulnerability in the Maarch RM 2.8.3 solution. (CVSS 5.3)
- [CVE-2022-38462](https://cve.now/CVE-2022-38462.md): Silverstripe silverstripe/framework through 4.11 is vulnerable to XSS by carefully crafting a return URL on a /dev/build or… (CVSS 6.1, silverstripe/framework)
- [CVE-2022-38649](https://cve.now/CVE-2022-38649.md): Apache Airflow Pinot provider allowed Command Injection (CVSS 9.8, Apache Software Foundation Apache Airflow Pinot Provider… +1)
- [CVE-2022-38724](https://cve.now/CVE-2022-38724.md): Silverstripe silverstripe/framework through 4.11.0, silverstripe/assets through 1.11.0, and silverstripe/asset-admin through 1.11.0 allow… (CVSS 5.4, silverstripe/assets · silverstripe/framework)
- [CVE-2022-39066](https://cve.now/CVE-2022-39066.md): There is a SQL injection vulnerability in ZTE MF286R. (CVSS 8.8, MF286R)
- [CVE-2022-39067](https://cve.now/CVE-2022-39067.md): There is a buffer overflow vulnerability in ZTE MF286R. (CVSS 6.5, MF286R)
- [CVE-2022-39070](https://cve.now/CVE-2022-39070.md): There is an access control vulnerability in some ZTE PON OLT products. (CVSS 9.8, ZXA10 C3XX)
- [CVE-2022-39199](https://cve.now/CVE-2022-39199.md): Lack of proper validation in immudb (CVSS 5.8, codenotary immudb · github.com/codenotary/immudb)
- [CVE-2022-39397](https://cve.now/CVE-2022-39397.md): Exposure of sensitive information in aliyun-oss-client (CVSS 5.6, tu6ge oss-rs · aliyun-oss-client)
- [CVE-2022-40189](https://cve.now/CVE-2022-40189.md): Apache Airlfow Pig Provider RCE (CVSS 9.8, Apache Software Foundation Apache Airlfow Pig Provider ·… +1)
- [CVE-2022-40303](https://cve.now/CVE-2022-40303.md): An issue was discovered in libxml2 before 2.10.3. (CVSS 7.5, platform/external/libxml2)
- [CVE-2022-40602](https://cve.now/CVE-2022-40602.md): A flaw in the Zyxel LTE3301-M209 firmware verisons prior to V1.00(ABLG.6)C0 could allow a remote attacker to access the device using an… (CVSS 9.8, Zyxel LTE3301-M209)
- [CVE-2022-40765](https://cve.now/CVE-2022-40765.md): A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker wit (CVSS 6.8, KEV)
- [CVE-2022-40842](https://cve.now/CVE-2022-40842.md): ndk design NdkAdvancedCustomizationFields 3.5.0 is vulnerable to Server-side request forgery (SSRF) via rotateimg.php. (CVSS 9.1)
- [CVE-2022-40870](https://cve.now/CVE-2022-40870.md): The Web Client of Parallels Remote Application Server v18.0 is vulnerable to Host Header Injection attacks. (CVSS 8.1)
- [CVE-2022-40954](https://cve.now/CVE-2022-40954.md): Apache Airflow Spark Provider RCE that bypass restrictions to read arbitrary files (CVSS 5.5, Apache Software Foundation Apache Airflow Spark Provider… +1)
- [CVE-2022-4111](https://cve.now/CVE-2022-4111.md): Improper Validation of Specified Quantity in Input in tooljet/tooljet (CVSS 6.5, tooljet/tooljet · tooljet)
- [CVE-2022-41131](https://cve.now/CVE-2022-41131.md): Apache Airflow Hive Provider vulnerability (command injection via hive\_cli connection) (CVSS 7.8, Apache Software Foundation Apache Airflow Hive Provider… +1)
- [CVE-2022-4116](https://cve.now/CVE-2022-4116.md): A vulnerability was found in quarkus. (CVSS 9.8, quarkus · io.quarkus:quarkus-vertx-http-deployment)
- [CVE-2022-41223](https://cve.now/CVE-2022-41223.md): The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injec (CVSS 6.8, KEV)
- [CVE-2022-41326](https://cve.now/CVE-2022-41326.md): The web conferencing component of Mitel MiCollab through 9.6.0.13 could allow an unauthenticated attacker to upload arbitrary scripts due… (CVSS 9.8)
- [CVE-2022-41445](https://cve.now/CVE-2022-41445.md): A cross-site scripting (XSS) vulnerability in Record Management System using CodeIgniter 1.0 allows attackers to execute arbitrary web… (CVSS 4.8)
- [CVE-2022-41919](https://cve.now/CVE-2022-41919.md): Fastify vulnerable to Cross-Site Request Forgery (CSRF) attack via incorrect content type (CVSS 4.2, fastify)
- [CVE-2022-41936](https://cve.now/CVE-2022-41936.md): Exposure of Private Personal Information to an Unauthorized Actor in xwiki-platform-rest-server (CVSS 5.3, xwiki-platform · org.xwiki.platform:xwiki-platform-rest-ser…)
- [CVE-2022-41937](https://cve.now/CVE-2022-41937.md): Missing Authorization in XWiki Platform (CVSS 9.6, xwiki-platform · org.xwiki.platform:xwiki-platform-filter-ui)
- [CVE-2022-41940](https://cve.now/CVE-2022-41940.md): Uncaught exception in engine.io (CVSS 7.1, socketio engine.io · engine.io)
- [CVE-2022-41942](https://cve.now/CVE-2022-41942.md): Sourcegraph vulnerable to Comand Injection via gitserver (CVSS 7.9, sourcegraph)
- [CVE-2022-41943](https://cve.now/CVE-2022-41943.md): Incorrect default permissions found in Sourcegraph (CVSS 9.0, sourcegraph)
- [CVE-2022-41950](https://cve.now/CVE-2022-41950.md): Privilege Escalation Vulnerability by wrong chmod param (CVSS 6.4, 4ra1n super-xray)
- [CVE-2022-41952](https://cve.now/CVE-2022-41952.md): Uncontrolled Resource Consumption in Matrix Synapse (CVSS 6.5, matrix-org synapse · matrix-synapse)
- [CVE-2022-42094](https://cve.now/CVE-2022-42094.md): Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the 'Card' content. (CVSS 4.8, backdrop/backdrop)
- [CVE-2022-42097](https://cve.now/CVE-2022-42097.md): Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via 'Comment.' . (CVSS 4.8, backdrop/backdrop)
- [CVE-2022-42098](https://cve.now/CVE-2022-42098.md): KLiK SocialMediaWebsite version v1.0.1 is vulnerable to SQL Injection via the profile.php. (CVSS 8.8)
- [CVE-2022-42989](https://cve.now/CVE-2022-42989.md): ERP Sankhya before v4.11b81 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Caixa de Entrada. (CVSS 9.0)
- [CVE-2022-43212](https://cve.now/CVE-2022-43212.md): Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the orderId parameter at fetchOrderData.php. (CVSS 9.8)
- [CVE-2022-43214](https://cve.now/CVE-2022-43214.md): Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the orderId parameter at printOrder.php. (CVSS 9.8)
- [CVE-2022-43215](https://cve.now/CVE-2022-43215.md): Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the endDate parameter at getOrderReport.php. (CVSS 9.8)
- [CVE-2022-43685](https://cve.now/CVE-2022-43685.md): CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request. (CVSS 8.8, ckan)
- [CVE-2022-43751](https://cve.now/CVE-2022-43751.md): McAfee Total Protection prior to version 16.0.49 contains an uncontrolled search path element vulnerability due to the use of a variable… (CVSS 7.8)
- [CVE-2022-44184](https://cve.now/CVE-2022-44184.md): Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow in /usr/sbin/httpd via parameter wan\_dns1\_sec. (CVSS 9.8)
- [CVE-2022-44186](https://cve.now/CVE-2022-44186.md): Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow in /usr/sbin/httpd via parameter wan\_dns1\_pri. (CVSS 9.8)
- [CVE-2022-44187](https://cve.now/CVE-2022-44187.md): Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow via wan\_dns1\_pri. (CVSS 9.8)
- [CVE-2022-44188](https://cve.now/CVE-2022-44188.md): Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow in /usr/sbin/httpd via parameter enable\_band\_steering. (CVSS 9.8)
- [CVE-2022-44190](https://cve.now/CVE-2022-44190.md): Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow via parameter enable\_band\_steering. (CVSS 9.8)
- [CVE-2022-44191](https://cve.now/CVE-2022-44191.md): Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow via parameters KEY1 and KEY2. (CVSS 9.8)
- [CVE-2022-44193](https://cve.now/CVE-2022-44193.md): Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow in /usr/sbin/httpd via parameters: starthour, startminute , endhour, and… (CVSS 9.8)
- [CVE-2022-44194](https://cve.now/CVE-2022-44194.md): Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow via parameters apmode\_dns1\_pri and apmode\_dns1\_sec. (CVSS 9.8)
- [CVE-2022-44196](https://cve.now/CVE-2022-44196.md): Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow via parameter openvpn\_push1. (CVSS 9.8)
- [CVE-2022-44197](https://cve.now/CVE-2022-44197.md): Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow via parameter openvpn\_server\_ip. (CVSS 9.8)
- [CVE-2022-44198](https://cve.now/CVE-2022-44198.md): Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow via parameter openvpn\_push1. (CVSS 9.8)
- [CVE-2022-44199](https://cve.now/CVE-2022-44199.md): Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow via parameter openvpn\_server\_ip. (CVSS 9.8)
- [CVE-2022-44200](https://cve.now/CVE-2022-44200.md): Netgear R7000P V1.3.0.8, V1.3.1.64 is vulnerable to Buffer Overflow via parameters: stamode\_dns1\_pri and stamode\_dns1\_sec. (CVSS 9.8)
- [CVE-2022-44201](https://cve.now/CVE-2022-44201.md): D-Link DIR823G 1.02B05 is vulnerable to Commad Injection. (CVSS 9.8)
- [CVE-2022-44202](https://cve.now/CVE-2022-44202.md): D-Link DIR878 1.02B04 and 1.02B05 are vulnerable to Buffer Overflow. (CVSS 9.8)
- [CVE-2022-44801](https://cve.now/CVE-2022-44801.md): D-Link DIR-878 1.02B05 is vulnerable to Incorrect Access Control. (CVSS 9.8)
- [CVE-2022-44804](https://cve.now/CVE-2022-44804.md): D-Link DIR-882 1.10B02 and1.20B06 is vulnerable to Buffer Overflow via the websRedirect function. (CVSS 9.8)
- [CVE-2022-44806](https://cve.now/CVE-2022-44806.md): D-Link DIR-882 1.10B02 and 1.20B06 is vulnerable to Buffer Overflow. (CVSS 9.8)
- [CVE-2022-44807](https://cve.now/CVE-2022-44807.md): D-Link DIR-882 1.10B02 and 1.20B06 is vulnerable to Buffer Overflow via webGetVarString. (CVSS 9.8)
- [CVE-2022-44808](https://cve.now/CVE-2022-44808.md): A command injection vulnerability has been found on D-Link DIR-823G devices with firmware version 1.02B03 that allows an attacker to… (CVSS 9.8)
- [CVE-2022-45330](https://cve.now/CVE-2022-45330.md): AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the Category parameter at \\category.php. (CVSS 7.5)
- [CVE-2022-45331](https://cve.now/CVE-2022-45331.md): AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the p\_id parameter at \\post.php. (CVSS 7.5)
- [CVE-2022-45529](https://cve.now/CVE-2022-45529.md): AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the post\_category\_id parameter at \\admin\\includes\\edit\_post.php. (CVSS 4.9)
- [CVE-2022-45535](https://cve.now/CVE-2022-45535.md): AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the edit parameter at \\admin\\categories.php. (CVSS 4.9)
- [CVE-2022-45536](https://cve.now/CVE-2022-45536.md): AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the id parameter at \\admin\\post\_comments.php. (CVSS 4.9)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2022-11-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.