CVEs published November 2, 2022
68 CVEs were published on November 2, 2022: 3 critical, 21 high.
- Published
- 68
- Critical
- 3
- High
- 21
- Medium
- 37
- Low
- 7
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 16
Most affected products
- discourse
- 3
- Fortinet FortiADC
- 3
- Fortinet FortiOS
- 3
- Hitachi Vantara Pentaho Business Analytics Server
- 3
- Apache Software Foundation Apache Airflow · apache-airflow
- 2
- Fortinet FortiTester
- 2
- Huaxia ERP
- 2
- AgentEasy Properties
- 1
- Apache Software Foundation Apache Sling App CMS · org.apach…
- 1
- Ayoub Media AM-HiLi
- 1
Critical 3
- CVE-2022-24942Heap-based buffer overflow in MicriumOS HTTP Server allows potential remote code executionsilabs.com Gecko Platform
- CVE-2022-3575Frauscher Sensortechnik Diagnostic System FDS102 for FAdC R2 and FAdCi R2 configuration upload vulnerabilityFrauscher Sensortechnik Diagnostic System FDS102
- CVE-2022-39353xmldom allows multiple root nodes in a DOMxmldom · @xmldom/xmldom
High 21
- CVE-2022-3181An Improper Input Validation vulnerability exists in Trihedral VTScada version 12.0.38 and prior.Trihedral VTScada
- CVE-2022-24936Gecko Standalone Bootloader vulnerability may allow bypassing application secure boot in some Series 2 devicessilabs.com Gecko Bootloader
- CVE-2021-45448Pentaho Business Analytics Server - Pentaho Analyzer plugin exposes a service endpoint for templates which allows a user supplied path to access resources that are out of bounds.Hitachi Vantara Pentaho Business Analytics Server
- CVE-2021-45447 Pentaho Business Analytics Server - With the Data Lineage feature enabled, the system transmits database passwords in clear textHitachi Vantara Pentaho Business Analytics Server
- CVE-2021-37789stb_image.h 2.27 has a heap-based buffer over in stbi__jpeg_load, leading to Information Disclosure or Denial of Service.
- CVE-2022-26119A improper authentication vulnerability in Fortinet FortiSIEM before 6.5.0 allows a local attacker with CLI access to perform operations on Fortinet FortiSIEM
- CVE-2022-2904A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions starting from 15.2 before 15.2.5, all versions startGitLab
- CVE-2022-33870An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the command line interpreter of FortiTester 3Fortinet FortiTester
- CVE-2022-35851An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiADC management interface 7.1.0 may allow a remFortinet FortiADC
- CVE-2022-38373An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiDeceptor management interface 4.2.0, 4.1.0 thrFortinet FortiDeceptor
- CVE-2022-38374A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiADC 7.0.0 - 7.0.2 and 6.2.0 - 6.2.4 Fortinet FortiADC
- CVE-2022-39241Possible Server-Side Request Forgery (SSRF) in webhooksdiscourse
- CVE-2022-39356Discourse user account takeover via email and invite linkdiscourse
- CVE-2022-39381Unchecked Return Value to NULL Pointer Dereference in PDFDocumentHandler.cppjulianhille MuhammaraJS · muhammara +1
- CVE-2022-39950An improper neutralization of input during web page generation vulnerability [CWE-79] exists in FortiManager and FortiAnalyzer 6.0.0 all verFortinet FortiAnalyzer, FortiManager
- CVE-2022-41551Garage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /garage/editorder.php.
- CVE-2022-43066Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/classes/
- CVE-2022-43068Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master
- CVE-2022-43226Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/?page=ap
- CVE-2022-43227Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/admin/?p
- CVE-2022-43995Sudo 1.8.0 through 1.9.12, with the crypt() password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that can re
Medium, low and unrated 44
- CVE-2022-44586WordPress AM-HiLi plugin <= 1.0 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityAyoub Media AM-HiLi
- CVE-2022-44576WordPress AgentEasy Properties plugin <= 1.0.4 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityAgentEasy Properties
- CVE-2022-41716Unsanitized NUL in environment variables on Windows in syscall and os/execGo standard library syscall · Go standard library os/exec +1
- CVE-2021-45446 Pentaho Business Analytics Server - Exposure of Information Through Directory ListingHitachi Vantara Pentaho Business Analytics Server
- CVE-2020-36608Tribal Systems Zenario CMS Error Log Module admin_organizer.js cross site scriptingTribal Systems Zenario CMS · tribalsystems/zenario
- CVE-2022-26122An insufficient verification of data authenticity vulnerability [CWE-345] in FortiClient, FortiMail and FortiOS AV engines version 6.2.168 aFortinet AV Engine, FortiMail, FortiOS, FortiClient
- CVE-2022-30307A key management error vulnerability [CWE-320] affecting the RSA SSH host key in FortiOS 7.2.0 and below, 7.0.6 and below, 6.4.9 and below mFortinet FortiOS
- CVE-2022-33878An exposure of sensitive information to an unauthorized actor vulnerabiltiy [CWE-200] in FortiClient for Mac versions 7.0.0 through 7.0.5 maFortinet FortiClientMac
- CVE-2022-35842An exposure of sensitive information to an unauthorized actor vulnerabiltiy [CWE-200] in FortiOS SSL-VPN versions 7.2.0, versions 7.0.0 throFortinet FortiOS
- CVE-2022-3825Huaxia ERP User Management sql injectionHuaxia ERP
- CVE-2022-3826Huaxia ERP Retail Management list information disclosureHuaxia ERP
- CVE-2022-3827centreon Contact Groups Form formContactGroup.php sql injectioncentreon · centreon/centreon
- CVE-2022-38372A hidden functionality vulnerability [CWE-1242] in FortiTester CLI 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow aFortinet FortiTester
- CVE-2022-38380An improper access control [CWE-284] vulnerability in FortiOS version 7.2.0 and versions 7.0.0 through 7.0.7 may allow a remote authenticateFortinet FortiOS
- CVE-2022-38381An improper handling of malformed request vulnerability [CWE-228] exists in FortiADC 5.0 all versions, 6.0.0 all versions, 6.1.0 all versionFortinet FortiADC
- CVE-2022-3844Webmin index.cgi cross site scriptingWebmin
- CVE-2022-3845phpipam Import Preview import-load-data.php cross site scriptingphpipam
- CVE-2022-39378Displaying user badges can leak topic titles to users that have no access to the topicdiscourse
- CVE-2022-39379Fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration)fluentd
- CVE-2022-39945An improper access control vulnerability [CWE-284] in FortiMail 7.2.0, 7.0.0 through 7.0.3, 6.4 all versions, 6.2 all versions, 6.0 all versFortinet FortiMail
- CVE-2022-39949An improper control of a resource through its lifetime vulnerability [CWE-664] in FortiEDR CollectorWindows 4.0.0 through 4.1, 5.0.0 throughFortinet FortiEDR
- CVE-2022-40840ndk design NdkAdvancedCustomizationFields 3.5.0 is vulnerable to Cross Site Scripting (XSS) via createPdf.php.
- CVE-2022-42473A missing authentication for a critical function vulnerability in Fortinet FortiSOAR 6.4.0 - 6.4.4 and 7.0.0 - 7.0.3 and 7.2.0 allows an attFortinet FortiSOAR
- CVE-2022-43235Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via ff_hevc_put_hevc_epel_pixels_8_sse in sse-motion.cc.
- CVE-2022-43236Libde265 v1.0.8 was discovered to contain a stack-buffer-overflow vulnerability via put_qpel_fallback<unsigned short> in fallback-motion.cc.
- CVE-2022-43237Libde265 v1.0.8 was discovered to contain a stack-buffer-overflow vulnerability via void put_epel_hv_fallback<unsigned short> in fallback-mo
- CVE-2022-43238Libde265 v1.0.8 was discovered to contain an unknown crash via ff_hevc_put_hevc_qpel_h_3_v_3_sse in sse-motion.cc.
- CVE-2022-43239Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via mc_chroma<unsigned short> in motion.cc.
- CVE-2022-43240Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via ff_hevc_put_hevc_qpel_h_2_v_1_sse in sse-motion.cc.
- CVE-2022-43241Libde265 v1.0.8 was discovered to contain an unknown crash via ff_hevc_put_hevc_qpel_v_3_8_sse in sse-motion.cc.
- CVE-2022-43242Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via mc_luma<unsigned char> in motion.cc.
- CVE-2022-43243Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via ff_hevc_put_weighted_pred_avg_8_sse in sse-motion.cc.
- CVE-2022-43244Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_qpel_fallback<unsigned short> in fallback-motion.cc.
- CVE-2022-43245Libde265 v1.0.8 was discovered to contain a segmentation violation via apply_sao_internal<unsigned short> in sao.cc.
- CVE-2022-43248Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_weighted_pred_avg_16_fallback in fallback-motion.cc.
- CVE-2022-43249Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_epel_hv_fallback<unsigned short> in fallback-motion.c
- CVE-2022-43250Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_qpel_0_0_fallback_16 in fallback-motion.cc.
- CVE-2022-43252Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_epel_16_fallback in fallback-motion.cc.
- CVE-2022-43253Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_unweighted_pred_16_fallback in fallback-motion.cc.
- CVE-2022-43254GPAC v2.1-DEV-rev368-gfd054169b-master was discovered to contain a memory leak via the component gf_list_new at utils/list.c.
- CVE-2022-43255GPAC v2.1-DEV-rev368-gfd054169b-master was discovered to contain a memory leak via the component gf_odf_new_iod at odf/odf_code.c.
- CVE-2022-43670XSS in Sling CMS Reference App Taxonomy PathApache Software Foundation Apache Sling App CMS · org.apach…
- CVE-2022-43982Apache Airflow prior to 2.4.2 allows reflected XSS via Origin Query Argument in URLApache Software Foundation Apache Airflow · apache-airflow
- CVE-2022-43985Apache Airflow prior to 2.4.2 has an open redirectApache Software Foundation Apache Airflow · apache-airflow