CVEs published November 3, 2022
120 CVEs were published on November 3, 2022: 18 critical, 30 high.
- Published
- 120
- Critical
- 18
- High
- 30
- Medium
- 60
- Low
- 11
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 25
Most affected products
- Hewlett Packard Enterprise Aruba Mobility Conductor (former…
- 16
- glpi-project glpi
- 11
- CandidATS
- 8
- IBM InfoSphere Information Server
- 8
- Cisco Identity Services Engine Software
- 5
- JetBrains TeamCity
- 4
- Cisco Secure Email
- 3
- Hewlett Packard Enterprise (HPE) HPE Nimble Storage Hybrid…
- 3
- OpenHarmony
- 3
- Cisco BroadWorks
- 2
Critical 18
- CVE-2022-37897There is a command injection vulnerability that could lead to unauthenticated remote code execution by sending specially crafted packets desHewlett Packard Enterprise Aruba Mobility Conductor (former…
- CVE-2020-22818MKCMS V6.2 has SQL injection via /ucenter/reg.php name parameter.
- CVE-2020-22819MKCMS V6.2 has SQL injection via the /ucenter/active.php verify parameter.
- CVE-2020-22820MKCMS V6.2 has SQL injection via the /ucenter/repass.php name parameter.
- CVE-2022-22425"IBM InfoSphere Information Server 11.7 is potentially vulnerable to CSV Injection.IBM InfoSphere Information Server
- CVE-2022-38168Broken Access Control in User Authentication in Avaya Scopia Pathfinder 10 and 20 PTS version 8.3.7.0.4 allows remote unauthenticated attack
- CVE-2022-39382NODE_ENV in Keystone defaults to development with esbuildkeystonejs keystone · @keystone-6/core
- CVE-2022-40747"IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.IBM InfoSphere Information Server
- CVE-2022-42744CandidATS version 3.0.0 allows an external attacker to perform CRUD operations on the application databases.CandidATS
- CVE-2022-43101Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the devName parameter in the formSetDeviceName function.
- CVE-2022-43102Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the timeZone parameter in the fromSetSysTime function.
- CVE-2022-43103Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the list parameter in the formSetQosBand function.
- CVE-2022-43104Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the wpapsk_crypto parameter in the fromSetWirelessRepeat function.
- CVE-2022-43105Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the shareSpeed parameter in the fromSetWifiGusetBasic function.
- CVE-2022-43106Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the schedStartTime parameter in the setSchedWifi function.
- CVE-2022-43107Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the time parameter in the setSmartPowerManagement function.
- CVE-2022-43108Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the firewallEn parameter in the formSetFirewallCfg function.
- CVE-2022-43109D-Link DIR-823G v1.0.2 was found to contain a command injection vulnerability in the function SetNetworkTomographySettings.
High 30
- CVE-2022-43571Remote Code Execution through dashboard PDF generation component in Splunk EnterpriseSplunk Enterprise
- CVE-2022-20960A vulnerability in Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated remote attacker to cause aCisco Secure Email
- CVE-2022-20956A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker Cisco Identity Services Engine Software
- CVE-2022-20958A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot application could allow an unauthenticated, remote attacCisco BroadWorks
- CVE-2022-20951A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot application could allow an authenticated, remote attackeCisco BroadWorks
- CVE-2021-44862Sensitive Information store in NSClient logsNetskope NSClient
- CVE-2022-43451Multiple path traversal in appspawn and nwebspawn services.OpenHarmony
- CVE-2022-37903A vulnerability exists that allows an authenticated attacker to overwrite an arbitrary file with attacker-controlled content via the web intHewlett Packard Enterprise Aruba Mobility Conductor (former…
- CVE-2022-37912Authenticated command injection vulnerabilities exist in the ArubaOS command line interface.Hewlett Packard Enterprise Aruba Mobility Conductor (former…
- CVE-2022-37902Authenticated command injection vulnerabilities exist in the ArubaOS command line interface.Hewlett Packard Enterprise Aruba Mobility Conductor (former…
- CVE-2022-37901Authenticated command injection vulnerabilities exist in the ArubaOS command line interface.Hewlett Packard Enterprise Aruba Mobility Conductor (former…
- CVE-2022-37900Authenticated command injection vulnerabilities exist in the ArubaOS command line interface.Hewlett Packard Enterprise Aruba Mobility Conductor (former…
- CVE-2022-20961A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attackeCisco Identity Services Engine Software
- CVE-2022-37899Authenticated command injection vulnerabilities exist in the ArubaOS command line interface.Hewlett Packard Enterprise Aruba Mobility Conductor (former…
- CVE-2022-37898Authenticated command injection vulnerabilities exist in the ArubaOS command line interface.Hewlett Packard Enterprise Aruba Mobility Conductor (former…
- CVE-2022-3852VR Calendar <= 2.3.3 - Cross-Site Request Forgeryinnate-images-llc VR Calendar
- CVE-2022-3776Restaurant Menu – Food Ordering System – Table Reservation <= 2.3.1 - Cross-Site Request Forgerygloriafood Restaurant Menu – Food Ordering System – Table R…
- CVE-2022-37928Insufficient Verification of Data Authenticity vulnerability in Hewlett Packard Enterprise HPE Nimble Storage Hybrid Flash Arrays and NimbleHewlett Packard Enterprise (HPE) HPE Nimble Storage Hybrid…
- CVE-2022-30608"IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and uIBM InfoSphere Information Server
- CVE-2022-32287Apache UIMA prior to 3.3.1 has a path traversal vulnerability when extracting (PEAR) archivesApache Software Foundation Apache UIMA · org.apache.uima:ui…
- CVE-2022-35717"IBM InfoSphere Information Server 11.7 could allow a locally authenticated attacker to execute arbitrary commands on the system by sending IBM InfoSphere Information Server
- CVE-2022-39323SQL Injection on REST API in GLPIglpi-project glpi
- CVE-2022-39371Stored Cross-Site Scripting (XSS) through asset inventory in GLPIglpi-project glpi
- CVE-2022-42750CandidATS version 3.0.0 allows an external attacker to steal the cookie of arbitrary users.CandidATS
- CVE-2022-42751CandidATS version 3.0.0 allows an external attacker to elevate privileges in the application.CandidATS
- CVE-2022-43061Online Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload vulnerability in the component /operations/
- CVE-2022-43062Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master
- CVE-2022-43063Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Users.
- CVE-2022-43574"IBM Robotic Process Automation 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to incorrect permission assignment which could alloIBM Robotic Process Automation
- CVE-2022-44638In libpixman in Pixman before 0.42.2, there is an out-of-bounds write (aka heap-based buffer overflow) in rasterize_edges_8 due to an intege
Medium, low and unrated 72
- CVE-2022-43561Persistent Cross-Site Scripting in “Save Table” Dialog in Splunk EnterpriseSplunk Enterprise
- CVE-2022-20962A vulnerability in the Localdisk Management feature of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker toCisco Identity Services Engine Software
- CVE-2022-37911Due to improper restrictions on XML entities multiple vulnerabilities exist in the command line interface of ArubaOS.Hewlett Packard Enterprise Aruba Mobility Conductor (former…
- CVE-2022-25952WordPress Content Egg plugin <= 5.4.0 - Cross-Site Request Forgery (CSRF) vulnerabilityKeywordrush Content Egg
- CVE-2022-37910A buffer overflow vulnerability exists in the ArubaOS command line interface.Hewlett Packard Enterprise Aruba Mobility Conductor (former…
- CVE-2021-36906WordPress Quiz And Survey Master plugin <= 7.3.6 - Multiple Insecure direct object references (IDOR) vulnerabilitiesExpressTech Quiz And Survey Master
- CVE-2022-44628WordPress 4ECPS Web Forms plugin <= 0.2.17 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityJumpDEMAND 4ECPS Web Forms
- CVE-2022-20772A vulnerability in Cisco Email Security Appliance (ESA) and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attackCisco Secure Email
- CVE-2022-20963A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker Cisco Identity Services Engine Software
- CVE-2022-37909Aruba has identified certain configurations of ArubaOS that can lead to sensitive information disclosure from the configured ESSIDs.Hewlett Packard Enterprise Aruba Mobility Conductor (former…
- CVE-2022-20937A vulnerability in a feature that monitors RADIUS requests on Cisco Identity Services Engine (ISE) Software could allow an unauthenticated, Cisco Identity Services Engine Software
- CVE-2022-20969A vulnerability in multiple management dashboard pages of Cisco Umbrella could allow an authenticated, remote attacker to conduct a cross-siCisco Umbrella Dashboard
- CVE-2022-44627WordPress Simple SEO plugin <= 1.8.12 - Cross-Site Request Forgery (CSRF) vulnerabilityDavid Cole Simple SEO
- CVE-2022-20942A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA), Cisco Secure Email and Web Manager, and CiscoCisco Secure Web Appliance · Cisco Secure Email
- CVE-2022-37908An authenticated attacker can impact the integrity of the ArubaOS bootloader on 7xxx series controllers.Hewlett Packard Enterprise Aruba Mobility Conductor (former…
- CVE-2022-20868A vulnerability in the web-based management interface of Cisco Email Security Appliance, Cisco Secure Email and Web Manager and Cisco SecureCisco Secure Web Appliance · Cisco Secure Email
- CVE-2022-20867A vulnerability in web-based management interface of the of Cisco Email Security Appliance and Cisco Secure Email and Web Manager could alloCisco Secure Email
- CVE-2022-36404WordPress Simple SEO plugin <= 1.8.12 - Broken Access Control vulnerabilityDavid Cole Simple SEO
- CVE-2022-40131WordPress Page View Count plugin <= 2.5.5 - Cross-Site Request Forgery (CSRF) vulnerabilitya3rev Software Page View Count
- CVE-2022-37907A vulnerability exists in the ArubaOS bootloader on 7xxx series controllers which can result in a denial of service (DoS) condition on an imHewlett Packard Enterprise Aruba Mobility Conductor (former…
- CVE-2022-36428WordPress Rock Convert plugin <= 2.11.0 - Auth. Cross-Site Scripting (XSS) vulnerabilityStage Rock Convert
- CVE-2022-37906An authenticated path traversal vulnerability exists in the ArubaOS command line interface.Hewlett Packard Enterprise Aruba Mobility Conductor (former…
- CVE-2022-37905Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequenHewlett Packard Enterprise Aruba Mobility Conductor (former…
- CVE-2022-43495An abnormal packet recieved when distributedhardware_device_manager joining a network could cause a device reboot.OpenHarmony
- CVE-2022-43449Arbitrary file read via download_server.OpenHarmony
- CVE-2022-37904Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequenHewlett Packard Enterprise Aruba Mobility Conductor (former…
- CVE-2022-3258Incorrect Permission Assignment for Critical Resource vulnerability in HYPR Workforce Access on Windows allows Authentication Abuse.HYPR Workforce Access
- CVE-2022-3675Fedora CoreOS supports setting a GRUB bootloader password using a Butane config.Fedora Project CoreOS
- CVE-2022-2696Restaurant Menu – Food Ordering System – Table Reservation <= 2.3.0 - Missing Authorization on AJAX Actionsgloriafood Restaurant Menu – Food Ordering System – Table R…
- CVE-2021-46846Cross Site Scripting vulnerability in Hewlett Packard Enterprise Integrated Lights-Out 5.Hewlett Packard Enterprise (HPE) HPE Integrated Lights-Out
- CVE-2022-37930A security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays and HPE Nimble Storage Secondary Flash Arrays which cHewlett Packard Enterprise (HPE) HPE Nimble Storage Hybrid…
- CVE-2022-37929Improper Privilege Management vulnerability in Hewlett Packard Enterprise Nimble Storage Hybrid Flash Arrays and Nimble Storage Secondary FlHewlett Packard Enterprise (HPE) HPE Nimble Storage Hybrid…
- CVE-2022-37927URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Hewlett Packard Enterprise HPE OneView Global Dashboard (OVGD).Hewlett Packard Enterprise (HPE) HPE OneView Global Dashboa…
- CVE-2021-37823OpenCart 3.0.3.7 allows users to obtain database information or read server files through SQL injection in the background.opencart/opencart
- CVE-2021-39077IBM Security Guardium information disclosureIBM Security Guardium
- CVE-2021-46853Alpine before 2.25 allows remote attackers to cause a denial of service (application crash) when LIST or LSUB is sent before STARTTLS.
- CVE-2022-22442"IBM InfoSphere Information Server 11.7 could allow an authenticated user to access information restricted to users with elevated privilegesIBM InfoSphere Information Server
- CVE-2022-30615"IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting.IBM InfoSphere Information Server
- CVE-2022-34339"IBM Cognos Analytics 11.2.1, 11.2.0, 11.1.7 stores user credentials in plain clear text which can be read by an authenticated user.IBM Cognos Analytics
- CVE-2022-35279"IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.2, 21.0.3, and 22.0.1IBM Business Automation Workflow
- CVE-2022-35642"IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting.IBM InfoSphere Information Server
- CVE-2022-38710IBM Robotic Process Automation information disclosureIBM Robotic Process Automation
- CVE-2022-38712"IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Web services could allow a man-in-the-middle attacker to conduct SOAPAction spoofinIBM WebSphere Application Server
- CVE-2022-39234user session persists even after permanently deleting account in GLPIglpi-project glpi
- CVE-2022-39262Stored Cross-Site Scripting (XSS) on login page in GLPIglpi-project glpi
- CVE-2022-39276Blind Server-Side Request Forgery (SSRF) in RSS feeds and planningglpi-project glpi
- CVE-2022-39277Cross-Site Scripting (XSS) in external links in GLPIglpi-project glpi
- CVE-2022-39370Improper access to debug panel in GLPIglpi-project glpi
- CVE-2022-39372Stored Cross-Site Scripting (XSS) in user information in GLPIglpi-project glpi
- CVE-2022-39373Stored Cross-Site Scripting (XSS) in entity name in GLPIglpi-project glpi
- CVE-2022-39375Cross-Site Scripting (XSS) through public RSS feed in GLPIglpi-project glpi
- CVE-2022-39376Improper input validation on emails links in GLPIglpi-project glpi
- CVE-2022-40230"IBM MQ Appliance 9.2 CD, 9.2 LTS, 9.3 CD, and LTS 9.3 does not invalidate session after logout which could allow an authenticated user to iIBM MQ Appliance
- CVE-2022-40235"IBM InfoSphere Information Server 11.7 could allow a user to cause a denial of service by removing the ability to run jobs due to improper IBM InfoSphere Information Server
- CVE-2022-40276Zettlr version 2.3.0 allows an external attacker to remotely obtain arbitrary local files on any client that attempts to view a malicious maZettlr
- CVE-2022-41435OpenWRT LuCI version git-22.140.66206-02913be was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /
- CVE-2022-41710Markdownify version 1.4.1 allows an external attacker to remotely obtain arbitrary local files on any client that attempts to view a malicioMarkdownify · electron-markdownify
- CVE-2022-41713deep-object-diff 1.1.0 - Prototype Pollutiondeep-object-diff
- CVE-2022-41714fastest-json-copy 1.0.1 - Prototype Pollutionfastest-json-copy
- CVE-2022-42442IBM Robotic Process Automation for Cloud Pak information disclosureIBM Robotic Process Automation for Cloud Pak
- CVE-2022-42743deep-parse-json 1.0.2 - Prototype Pollutiondeep-parse-json
- CVE-2022-42745CandidATS version 3.0.0 allows an external attacker to read arbitrary files from the server.CandidATS
- CVE-2022-42746CandidATS version 3.0.0 on 'indexFile' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users.CandidATS
- CVE-2022-42747CandidATS version 3.0.0 on 'sortBy' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users.CandidATS
- CVE-2022-42748CandidATS version 3.0.0 on 'sortDirection' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users.CandidATS
- CVE-2022-42749CandidATS version 3.0.0 on 'page' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users.CandidATS
- CVE-2022-42753SalonERP version 3.0.2 allows an external attacker to steal the cookie of arbitrary users.SalonERP
- CVE-2022-43372Emlog Pro v1.7.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability at /admin/store.php.
- CVE-2022-44622In JetBrains TeamCity version between 2021.2 and 2022.10 access permissions for secure token health items were excessiveJetBrains TeamCity
- CVE-2022-44623In JetBrains TeamCity version before 2022.10, Project Viewer could see scrambled secure values in the MetaRunner settingsJetBrains TeamCity
- CVE-2022-44624In JetBrains TeamCity version before 2022.10, Password parameters could be exposed in the build log if they contained special charactersJetBrains TeamCity
- CVE-2022-44646In JetBrains TeamCity version before 2022.10, no audit items were added upon editing a user's settingsJetBrains TeamCity