# CVEs published 2022-11-02 68 CVEs were published on November 2, 2022: 3 critical, 21 high. Days are UTC. - [CVE-2022-44586](https://cve.now/CVE-2022-44586.md): WordPress AM-HiLi plugin \<= 1.0 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, Ayoub Media AM-HiLi) - [CVE-2022-44576](https://cve.now/CVE-2022-44576.md): WordPress AgentEasy Properties plugin \<= 1.0.4 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, AgentEasy Properties) - [CVE-2022-24942](https://cve.now/CVE-2022-24942.md): Heap-based buffer overflow in MicriumOS HTTP Server allows potential remote code execution (CVSS 9.1, silabs.com Gecko Platform) - [CVE-2022-3181](https://cve.now/CVE-2022-3181.md): An Improper Input Validation vulnerability exists in Trihedral VTScada version 12.0.38 and prior. (CVSS 7.5, Trihedral VTScada) - [CVE-2022-24936](https://cve.now/CVE-2022-24936.md): Gecko Standalone Bootloader vulnerability may allow bypassing application secure boot in some Series 2 devices (CVSS 8.3, silabs.com Gecko Bootloader) - [CVE-2022-3575](https://cve.now/CVE-2022-3575.md): Frauscher Sensortechnik Diagnostic System FDS102 for FAdC R2 and FAdCi R2 configuration upload vulnerability (CVSS 9.8, Frauscher Sensortechnik Diagnostic System FDS102) - [CVE-2022-41716](https://cve.now/CVE-2022-41716.md): Unsanitized NUL in environment variables on Windows in syscall and os/exec (CVSS 6.3, Go standard library syscall · Go standard library os/exec +1) - [CVE-2021-45448](https://cve.now/CVE-2021-45448.md): Pentaho Business Analytics Server - Pentaho Analyzer plugin exposes a service endpoint for templates which allows a user supplied path to access resources that are out of bounds. (CVSS 7.1, Hitachi Vantara Pentaho Business Analytics Server) - [CVE-2021-45447](https://cve.now/CVE-2021-45447.md): Pentaho Business Analytics Server - With the Data Lineage feature enabled, the system transmits database passwords in clear text (CVSS 7.7, Hitachi Vantara Pentaho Business Analytics Server) - [CVE-2021-45446](https://cve.now/CVE-2021-45446.md): Pentaho Business Analytics Server - Exposure of Information Through Directory Listing (CVSS 5.0, Hitachi Vantara Pentaho Business Analytics Server) - [CVE-2020-36608](https://cve.now/CVE-2020-36608.md): Tribal Systems Zenario CMS Error Log Module admin\_organizer.js cross site scripting (CVSS 3.5, Tribal Systems Zenario CMS · tribalsystems/zenario) - [CVE-2021-37789](https://cve.now/CVE-2021-37789.md): stb\_image.h 2.27 has a heap-based buffer over in stbi\_\_jpeg\_load, leading to Information Disclosure or Denial of Service. (CVSS 8.1) - [CVE-2022-26119](https://cve.now/CVE-2022-26119.md): A improper authentication vulnerability in Fortinet FortiSIEM before 6.5.0 allows a local attacker with CLI access to perform operations on (CVSS 7.8, Fortinet FortiSIEM) - [CVE-2022-26122](https://cve.now/CVE-2022-26122.md): An insufficient verification of data authenticity vulnerability \[CWE-345\] in FortiClient, FortiMail and FortiOS AV engines version 6.2.168 a (CVSS 4.7, Fortinet AV Engine, FortiMail, FortiOS, FortiClient) - [CVE-2022-2904](https://cve.now/CVE-2022-2904.md): A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions starting from 15.2 before 15.2.5, all versions start (CVSS 7.3, GitLab) - [CVE-2022-30307](https://cve.now/CVE-2022-30307.md): A key management error vulnerability \[CWE-320\] affecting the RSA SSH host key in FortiOS 7.2.0 and below, 7.0.6 and below, 6.4.9 and below m (CVSS 3.9, Fortinet FortiOS) - [CVE-2022-33870](https://cve.now/CVE-2022-33870.md): An improper neutralization of special elements used in an OS command vulnerability \[CWE-78\] in the command line interpreter of FortiTester 3 (CVSS 7.8, Fortinet FortiTester) - [CVE-2022-33878](https://cve.now/CVE-2022-33878.md): An exposure of sensitive information to an unauthorized actor vulnerabiltiy \[CWE-200\] in FortiClient for Mac versions 7.0.0 through 7.0.5 ma (CVSS 2.2, Fortinet FortiClientMac) - [CVE-2022-35842](https://cve.now/CVE-2022-35842.md): An exposure of sensitive information to an unauthorized actor vulnerabiltiy \[CWE-200\] in FortiOS SSL-VPN versions 7.2.0, versions 7.0.0 thro (CVSS 3.7, Fortinet FortiOS) - [CVE-2022-35851](https://cve.now/CVE-2022-35851.md): An improper neutralization of input during web page generation vulnerability \[CWE-79\] in FortiADC management interface 7.1.0 may allow a rem (CVSS 8.0, Fortinet FortiADC) - [CVE-2022-3825](https://cve.now/CVE-2022-3825.md): Huaxia ERP User Management sql injection (CVSS 6.3, Huaxia ERP) - [CVE-2022-3826](https://cve.now/CVE-2022-3826.md): Huaxia ERP Retail Management list information disclosure (CVSS 4.3, Huaxia ERP) - [CVE-2022-3827](https://cve.now/CVE-2022-3827.md): centreon Contact Groups Form formContactGroup.php sql injection (CVSS 6.3, centreon · centreon/centreon) - [CVE-2022-38372](https://cve.now/CVE-2022-38372.md): A hidden functionality vulnerability \[CWE-1242\] in FortiTester CLI 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow a (CVSS 6.7, Fortinet FortiTester) - [CVE-2022-38373](https://cve.now/CVE-2022-38373.md): An improper neutralization of input during web page generation vulnerability \[CWE-79\] in FortiDeceptor management interface 4.2.0, 4.1.0 thr (CVSS 8.0, Fortinet FortiDeceptor) - [CVE-2022-38374](https://cve.now/CVE-2022-38374.md): A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiADC 7.0.0 - 7.0.2 and 6.2.0 - 6.2.4 (CVSS 8.8, Fortinet FortiADC) - [CVE-2022-38380](https://cve.now/CVE-2022-38380.md): An improper access control \[CWE-284\] vulnerability in FortiOS version 7.2.0 and versions 7.0.0 through 7.0.7 may allow a remote authenticate (CVSS 4.3, Fortinet FortiOS) - [CVE-2022-38381](https://cve.now/CVE-2022-38381.md): An improper handling of malformed request vulnerability \[CWE-228\] exists in FortiADC 5.0 all versions, 6.0.0 all versions, 6.1.0 all version (CVSS 5.3, Fortinet FortiADC) - [CVE-2022-3844](https://cve.now/CVE-2022-3844.md): Webmin index.cgi cross site scripting (CVSS 3.5, Webmin) - [CVE-2022-3845](https://cve.now/CVE-2022-3845.md): phpipam Import Preview import-load-data.php cross site scripting (CVSS 2.4, phpipam) - [CVE-2022-39241](https://cve.now/CVE-2022-39241.md): Possible Server-Side Request Forgery (SSRF) in webhooks (CVSS 7.6, discourse) - [CVE-2022-39353](https://cve.now/CVE-2022-39353.md): xmldom allows multiple root nodes in a DOM (CVSS 9.4, xmldom · @xmldom/xmldom) - [CVE-2022-39356](https://cve.now/CVE-2022-39356.md): Discourse user account takeover via email and invite link (CVSS 8.9, discourse) - [CVE-2022-39378](https://cve.now/CVE-2022-39378.md): Displaying user badges can leak topic titles to users that have no access to the topic (CVSS 5.3, discourse) - [CVE-2022-39379](https://cve.now/CVE-2022-39379.md): Fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration) (CVSS 3.1, fluentd) - [CVE-2022-39381](https://cve.now/CVE-2022-39381.md): Unchecked Return Value to NULL Pointer Dereference in PDFDocumentHandler.cpp (CVSS 7.5, julianhille MuhammaraJS · muhammara +1) - [CVE-2022-39945](https://cve.now/CVE-2022-39945.md): An improper access control vulnerability \[CWE-284\] in FortiMail 7.2.0, 7.0.0 through 7.0.3, 6.4 all versions, 6.2 all versions, 6.0 all vers (CVSS 5.4, Fortinet FortiMail) - [CVE-2022-39949](https://cve.now/CVE-2022-39949.md): An improper control of a resource through its lifetime vulnerability \[CWE-664\] in FortiEDR CollectorWindows 4.0.0 through 4.1, 5.0.0 through (CVSS 4.4, Fortinet FortiEDR) - [CVE-2022-39950](https://cve.now/CVE-2022-39950.md): An improper neutralization of input during web page generation vulnerability \[CWE-79\] exists in FortiManager and FortiAnalyzer 6.0.0 all ver (CVSS 8.0, Fortinet FortiAnalyzer, FortiManager) - [CVE-2022-40840](https://cve.now/CVE-2022-40840.md): ndk design NdkAdvancedCustomizationFields 3.5.0 is vulnerable to Cross Site Scripting (XSS) via createPdf.php. (CVSS 6.1) - [CVE-2022-41551](https://cve.now/CVE-2022-41551.md): Garage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /garage/editorder.php. (CVSS 7.2) - [CVE-2022-42473](https://cve.now/CVE-2022-42473.md): A missing authentication for a critical function vulnerability in Fortinet FortiSOAR 6.4.0 - 6.4.4 and 7.0.0 - 7.0.3 and 7.2.0 allows an att (CVSS 5.3, Fortinet FortiSOAR) - [CVE-2022-43066](https://cve.now/CVE-2022-43066.md): Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/classes/ (CVSS 7.2) - [CVE-2022-43068](https://cve.now/CVE-2022-43068.md): Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master (CVSS 7.2) - [CVE-2022-43226](https://cve.now/CVE-2022-43226.md): Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/?page=ap (CVSS 8.8) - [CVE-2022-43227](https://cve.now/CVE-2022-43227.md): Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/admin/?p (CVSS 7.2) - [CVE-2022-43235](https://cve.now/CVE-2022-43235.md): Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via ff\_hevc\_put\_hevc\_epel\_pixels\_8\_sse in sse-motion.cc. (CVSS 6.5) - [CVE-2022-43236](https://cve.now/CVE-2022-43236.md): Libde265 v1.0.8 was discovered to contain a stack-buffer-overflow vulnerability via put\_qpel\_fallback\ in fallback-motion.cc. (CVSS 6.5) - [CVE-2022-43237](https://cve.now/CVE-2022-43237.md): Libde265 v1.0.8 was discovered to contain a stack-buffer-overflow vulnerability via void put\_epel\_hv\_fallback\ in fallback-mo (CVSS 6.5) - [CVE-2022-43238](https://cve.now/CVE-2022-43238.md): Libde265 v1.0.8 was discovered to contain an unknown crash via ff\_hevc\_put\_hevc\_qpel\_h\_3\_v\_3\_sse in sse-motion.cc. (CVSS 6.5) - [CVE-2022-43239](https://cve.now/CVE-2022-43239.md): Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via mc\_chroma\ in motion.cc. (CVSS 6.5) - [CVE-2022-43240](https://cve.now/CVE-2022-43240.md): Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via ff\_hevc\_put\_hevc\_qpel\_h\_2\_v\_1\_sse in sse-motion.cc. (CVSS 6.5) - [CVE-2022-43241](https://cve.now/CVE-2022-43241.md): Libde265 v1.0.8 was discovered to contain an unknown crash via ff\_hevc\_put\_hevc\_qpel\_v\_3\_8\_sse in sse-motion.cc. (CVSS 6.5) - [CVE-2022-43242](https://cve.now/CVE-2022-43242.md): Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via mc\_luma\ in motion.cc. (CVSS 6.5) - [CVE-2022-43243](https://cve.now/CVE-2022-43243.md): Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via ff\_hevc\_put\_weighted\_pred\_avg\_8\_sse in sse-motion.cc. (CVSS 6.5) - [CVE-2022-43244](https://cve.now/CVE-2022-43244.md): Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put\_qpel\_fallback\ in fallback-motion.cc. (CVSS 6.5) - [CVE-2022-43245](https://cve.now/CVE-2022-43245.md): Libde265 v1.0.8 was discovered to contain a segmentation violation via apply\_sao\_internal\ in sao.cc. (CVSS 6.5) - [CVE-2022-43248](https://cve.now/CVE-2022-43248.md): Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put\_weighted\_pred\_avg\_16\_fallback in fallback-motion.cc. (CVSS 6.5) - [CVE-2022-43249](https://cve.now/CVE-2022-43249.md): Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put\_epel\_hv\_fallback\ in fallback-motion.c (CVSS 6.5) - [CVE-2022-43250](https://cve.now/CVE-2022-43250.md): Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put\_qpel\_0\_0\_fallback\_16 in fallback-motion.cc. (CVSS 6.5) - [CVE-2022-43252](https://cve.now/CVE-2022-43252.md): Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put\_epel\_16\_fallback in fallback-motion.cc. (CVSS 6.5) - [CVE-2022-43253](https://cve.now/CVE-2022-43253.md): Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put\_unweighted\_pred\_16\_fallback in fallback-motion.cc. (CVSS 6.5) - [CVE-2022-43254](https://cve.now/CVE-2022-43254.md): GPAC v2.1-DEV-rev368-gfd054169b-master was discovered to contain a memory leak via the component gf\_list\_new at utils/list.c. (CVSS 5.5) - [CVE-2022-43255](https://cve.now/CVE-2022-43255.md): GPAC v2.1-DEV-rev368-gfd054169b-master was discovered to contain a memory leak via the component gf\_odf\_new\_iod at odf/odf\_code.c. (CVSS 5.5) - [CVE-2022-43670](https://cve.now/CVE-2022-43670.md): XSS in Sling CMS Reference App Taxonomy Path (CVSS 5.4, Apache Software Foundation Apache Sling App CMS · org.apach…) - [CVE-2022-43982](https://cve.now/CVE-2022-43982.md): Apache Airflow prior to 2.4.2 allows reflected XSS via Origin Query Argument in URL (CVSS 6.1, Apache Software Foundation Apache Airflow · apache-airflow) - [CVE-2022-43985](https://cve.now/CVE-2022-43985.md): Apache Airflow prior to 2.4.2 has an open redirect (CVSS 6.1, Apache Software Foundation Apache Airflow · apache-airflow) - [CVE-2022-43995](https://cve.now/CVE-2022-43995.md): Sudo 1.8.0 through 1.9.12, with the crypt() password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that can re (CVSS 7.1) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2022-11-02 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.