# CVEs published 2022-11-03

120 CVEs were published on November 3, 2022: 18 critical, 30 high. Days are UTC.

- [CVE-2022-43571](https://cve.now/CVE-2022-43571.md): Remote Code Execution through dashboard PDF generation component in Splunk Enterprise (CVSS 8.8, Splunk Enterprise)
- [CVE-2022-43561](https://cve.now/CVE-2022-43561.md): Persistent Cross-Site Scripting in “Save Table” Dialog in Splunk Enterprise (CVSS 6.4, Splunk Enterprise)
- [CVE-2022-20962](https://cve.now/CVE-2022-20962.md): A vulnerability in the Localdisk Management feature of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to (CVSS 3.8, Cisco Identity Services Engine Software)
- [CVE-2022-37911](https://cve.now/CVE-2022-37911.md): Due to improper restrictions on XML entities multiple vulnerabilities exist in the command line interface of ArubaOS. (CVSS 3.8, Hewlett Packard Enterprise Aruba Mobility Conductor (former…)
- [CVE-2022-25952](https://cve.now/CVE-2022-25952.md): WordPress Content Egg plugin \<= 5.4.0 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Keywordrush Content Egg)
- [CVE-2022-37910](https://cve.now/CVE-2022-37910.md): A buffer overflow vulnerability exists in the ArubaOS command line interface. (CVSS 4.4, Hewlett Packard Enterprise Aruba Mobility Conductor (former…)
- [CVE-2021-36906](https://cve.now/CVE-2021-36906.md): WordPress Quiz And Survey Master plugin \<= 7.3.6 - Multiple Insecure direct object references (IDOR) vulnerabilities (CVSS 2.7, ExpressTech Quiz And Survey Master)
- [CVE-2022-44628](https://cve.now/CVE-2022-44628.md): WordPress 4ECPS Web Forms plugin \<= 0.2.17 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (CVSS 5.9, JumpDEMAND 4ECPS Web Forms)
- [CVE-2022-20772](https://cve.now/CVE-2022-20772.md): A vulnerability in Cisco Email Security Appliance (ESA) and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attack (CVSS 4.7, Cisco Secure Email)
- [CVE-2022-20963](https://cve.now/CVE-2022-20963.md): A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker (CVSS 5.4, Cisco Identity Services Engine Software)
- [CVE-2022-37909](https://cve.now/CVE-2022-37909.md): Aruba has identified certain configurations of ArubaOS that can lead to sensitive information disclosure from the configured ESSIDs. (CVSS 5.3, Hewlett Packard Enterprise Aruba Mobility Conductor (former…)
- [CVE-2022-20937](https://cve.now/CVE-2022-20937.md): A vulnerability in a feature that monitors RADIUS requests on Cisco Identity Services Engine (ISE) Software could allow an unauthenticated, (CVSS 5.3, Cisco Identity Services Engine Software)
- [CVE-2022-20969](https://cve.now/CVE-2022-20969.md): A vulnerability in multiple management dashboard pages of Cisco Umbrella could allow an authenticated, remote attacker to conduct a cross-si (CVSS 4.8, Cisco Umbrella Dashboard)
- [CVE-2022-44627](https://cve.now/CVE-2022-44627.md): WordPress Simple SEO plugin \<= 1.8.12 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 5.4, David Cole Simple SEO)
- [CVE-2022-20942](https://cve.now/CVE-2022-20942.md): A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA), Cisco Secure Email and Web Manager, and Cisco (CVSS 6.5, Cisco Secure Web Appliance · Cisco Secure Email)
- [CVE-2022-20960](https://cve.now/CVE-2022-20960.md): A vulnerability in Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated remote attacker to cause a (CVSS 7.5, Cisco Secure Email)
- [CVE-2022-37908](https://cve.now/CVE-2022-37908.md): An authenticated attacker can impact the integrity of the ArubaOS bootloader on 7xxx series controllers. (CVSS 5.8, Hewlett Packard Enterprise Aruba Mobility Conductor (former…)
- [CVE-2022-20868](https://cve.now/CVE-2022-20868.md): A vulnerability in the web-based management interface of Cisco Email Security Appliance, Cisco Secure Email and Web Manager and Cisco Secure (CVSS 4.7, Cisco Secure Web Appliance · Cisco Secure Email)
- [CVE-2022-20867](https://cve.now/CVE-2022-20867.md): A vulnerability in web-based management interface of the of Cisco Email Security Appliance and Cisco Secure Email and Web Manager could allo (CVSS 5.4, Cisco Secure Email)
- [CVE-2022-20956](https://cve.now/CVE-2022-20956.md): A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker (CVSS 7.1, Cisco Identity Services Engine Software)
- [CVE-2022-36404](https://cve.now/CVE-2022-36404.md): WordPress Simple SEO plugin \<= 1.8.12 - Broken Access Control vulnerability (CVSS 5.4, David Cole Simple SEO)
- [CVE-2022-20958](https://cve.now/CVE-2022-20958.md): A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot application could allow an unauthenticated, remote attac (CVSS 8.3, Cisco BroadWorks)
- [CVE-2022-20951](https://cve.now/CVE-2022-20951.md): A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot application could allow an authenticated, remote attacke (CVSS 7.7, Cisco BroadWorks)
- [CVE-2022-40131](https://cve.now/CVE-2022-40131.md): WordPress Page View Count plugin \<= 2.5.5 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 5.4, a3rev Software Page View Count)
- [CVE-2022-37907](https://cve.now/CVE-2022-37907.md): A vulnerability exists in the ArubaOS bootloader on 7xxx series controllers which can result in a denial of service (DoS) condition on an im (CVSS 5.8, Hewlett Packard Enterprise Aruba Mobility Conductor (former…)
- [CVE-2022-36428](https://cve.now/CVE-2022-36428.md): WordPress Rock Convert plugin \<= 2.11.0 - Auth. Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, Stage Rock Convert)
- [CVE-2021-44862](https://cve.now/CVE-2021-44862.md): Sensitive Information store in NSClient logs (CVSS 8.4, Netskope NSClient)
- [CVE-2022-37906](https://cve.now/CVE-2022-37906.md): An authenticated path traversal vulnerability exists in the ArubaOS command line interface. (CVSS 6.5, Hewlett Packard Enterprise Aruba Mobility Conductor (former…)
- [CVE-2022-37905](https://cve.now/CVE-2022-37905.md): Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequen (CVSS 6.6, Hewlett Packard Enterprise Aruba Mobility Conductor (former…)
- [CVE-2022-43495](https://cve.now/CVE-2022-43495.md): An abnormal packet recieved when distributedhardware\_device\_manager joining a network could cause a device reboot. (CVSS 6.5, OpenHarmony)
- [CVE-2022-43449](https://cve.now/CVE-2022-43449.md): Arbitrary file read via download\_server. (CVSS 6.2, OpenHarmony)
- [CVE-2022-43451](https://cve.now/CVE-2022-43451.md): Multiple path traversal in appspawn and nwebspawn services. (CVSS 8.4, OpenHarmony)
- [CVE-2022-37904](https://cve.now/CVE-2022-37904.md): Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequen (CVSS 6.6, Hewlett Packard Enterprise Aruba Mobility Conductor (former…)
- [CVE-2022-37903](https://cve.now/CVE-2022-37903.md): A vulnerability exists that allows an authenticated attacker to overwrite an arbitrary file with attacker-controlled content via the web int (CVSS 7.2, Hewlett Packard Enterprise Aruba Mobility Conductor (former…)
- [CVE-2022-37912](https://cve.now/CVE-2022-37912.md): Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. (CVSS 7.2, Hewlett Packard Enterprise Aruba Mobility Conductor (former…)
- [CVE-2022-37902](https://cve.now/CVE-2022-37902.md): Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. (CVSS 7.2, Hewlett Packard Enterprise Aruba Mobility Conductor (former…)
- [CVE-2022-37901](https://cve.now/CVE-2022-37901.md): Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. (CVSS 7.2, Hewlett Packard Enterprise Aruba Mobility Conductor (former…)
- [CVE-2022-37900](https://cve.now/CVE-2022-37900.md): Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. (CVSS 7.2, Hewlett Packard Enterprise Aruba Mobility Conductor (former…)
- [CVE-2022-20961](https://cve.now/CVE-2022-20961.md): A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacke (CVSS 8.8, Cisco Identity Services Engine Software)
- [CVE-2022-37899](https://cve.now/CVE-2022-37899.md): Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. (CVSS 7.2, Hewlett Packard Enterprise Aruba Mobility Conductor (former…)
- [CVE-2022-37898](https://cve.now/CVE-2022-37898.md): Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. (CVSS 7.2, Hewlett Packard Enterprise Aruba Mobility Conductor (former…)
- [CVE-2022-37897](https://cve.now/CVE-2022-37897.md): There is a command injection vulnerability that could lead to unauthenticated remote code execution by sending specially crafted packets des (CVSS 9.8, Hewlett Packard Enterprise Aruba Mobility Conductor (former…)
- [CVE-2022-3258](https://cve.now/CVE-2022-3258.md): Incorrect Permission Assignment for Critical Resource vulnerability in HYPR Workforce Access on Windows allows Authentication Abuse. (CVSS 3.7, HYPR Workforce Access)
- [CVE-2022-3675](https://cve.now/CVE-2022-3675.md): Fedora CoreOS supports setting a GRUB bootloader password using a Butane config. (CVSS 2.6, Fedora Project CoreOS)
- [CVE-2022-3852](https://cve.now/CVE-2022-3852.md): VR Calendar \<= 2.3.3 - Cross-Site Request Forgery (CVSS 8.8, innate-images-llc VR Calendar)
- [CVE-2022-3776](https://cve.now/CVE-2022-3776.md): Restaurant Menu – Food Ordering System – Table Reservation \<= 2.3.1 - Cross-Site Request Forgery (CVSS 8.8, gloriafood Restaurant Menu – Food Ordering System – Table R…)
- [CVE-2022-2696](https://cve.now/CVE-2022-2696.md): Restaurant Menu – Food Ordering System – Table Reservation \<= 2.3.0 - Missing Authorization on AJAX Actions (CVSS 6.3, gloriafood Restaurant Menu – Food Ordering System – Table R…)
- [CVE-2021-46846](https://cve.now/CVE-2021-46846.md): Cross Site Scripting vulnerability in Hewlett Packard Enterprise Integrated Lights-Out 5. (CVSS 6.4, Hewlett Packard Enterprise (HPE) HPE Integrated Lights-Out)
- [CVE-2022-37928](https://cve.now/CVE-2022-37928.md): Insufficient Verification of Data Authenticity vulnerability in Hewlett Packard Enterprise HPE Nimble Storage Hybrid Flash Arrays and Nimble (CVSS 8.0, Hewlett Packard Enterprise (HPE) HPE Nimble Storage Hybrid…)
- [CVE-2022-37930](https://cve.now/CVE-2022-37930.md): A security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays and HPE Nimble Storage Secondary Flash Arrays which c (CVSS 6.7, Hewlett Packard Enterprise (HPE) HPE Nimble Storage Hybrid…)
- [CVE-2022-37929](https://cve.now/CVE-2022-37929.md): Improper Privilege Management vulnerability in Hewlett Packard Enterprise Nimble Storage Hybrid Flash Arrays and Nimble Storage Secondary Fl (CVSS 6.7, Hewlett Packard Enterprise (HPE) HPE Nimble Storage Hybrid…)
- [CVE-2022-37927](https://cve.now/CVE-2022-37927.md): URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Hewlett Packard Enterprise HPE OneView Global Dashboard (OVGD). (CVSS 6.1, Hewlett Packard Enterprise (HPE) HPE OneView Global Dashboa…)
- [CVE-2020-22818](https://cve.now/CVE-2020-22818.md): MKCMS V6.2 has SQL injection via /ucenter/reg.php name parameter. (CVSS 9.8)
- [CVE-2020-22819](https://cve.now/CVE-2020-22819.md): MKCMS V6.2 has SQL injection via the /ucenter/active.php verify parameter. (CVSS 9.8)
- [CVE-2020-22820](https://cve.now/CVE-2020-22820.md): MKCMS V6.2 has SQL injection via the /ucenter/repass.php name parameter. (CVSS 9.8)
- [CVE-2021-37823](https://cve.now/CVE-2021-37823.md): OpenCart 3.0.3.7 allows users to obtain database information or read server files through SQL injection in the background. (CVSS 4.9, opencart/opencart)
- [CVE-2021-39077](https://cve.now/CVE-2021-39077.md): IBM Security Guardium information disclosure (CVSS 4.4, IBM Security Guardium)
- [CVE-2021-46853](https://cve.now/CVE-2021-46853.md): Alpine before 2.25 allows remote attackers to cause a denial of service (application crash) when LIST or LSUB is sent before STARTTLS. (CVSS 5.9)
- [CVE-2022-22425](https://cve.now/CVE-2022-22425.md): "IBM InfoSphere Information Server 11.7 is potentially vulnerable to CSV Injection. (CVSS 9.8, IBM InfoSphere Information Server)
- [CVE-2022-22442](https://cve.now/CVE-2022-22442.md): "IBM InfoSphere Information Server 11.7 could allow an authenticated user to access information restricted to users with elevated privileges (CVSS 6.5, IBM InfoSphere Information Server)
- [CVE-2022-30608](https://cve.now/CVE-2022-30608.md): "IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and u (CVSS 8.8, IBM InfoSphere Information Server)
- [CVE-2022-30615](https://cve.now/CVE-2022-30615.md): "IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. (CVSS 5.4, IBM InfoSphere Information Server)
- [CVE-2022-32287](https://cve.now/CVE-2022-32287.md): Apache UIMA prior to 3.3.1 has a path traversal vulnerability when extracting (PEAR) archives (CVSS 7.5, Apache Software Foundation Apache UIMA · org.apache.uima:ui…)
- [CVE-2022-34339](https://cve.now/CVE-2022-34339.md): "IBM Cognos Analytics 11.2.1, 11.2.0, 11.1.7 stores user credentials in plain clear text which can be read by an authenticated user. (CVSS 6.5, IBM Cognos Analytics)
- [CVE-2022-35279](https://cve.now/CVE-2022-35279.md): "IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.2, 21.0.3, and 22.0.1 (CVSS 4.3, IBM Business Automation Workflow)
- [CVE-2022-35642](https://cve.now/CVE-2022-35642.md): "IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. (CVSS 5.4, IBM InfoSphere Information Server)
- [CVE-2022-35717](https://cve.now/CVE-2022-35717.md): "IBM InfoSphere Information Server 11.7 could allow a locally authenticated attacker to execute arbitrary commands on the system by sending (CVSS 7.8, IBM InfoSphere Information Server)
- [CVE-2022-38168](https://cve.now/CVE-2022-38168.md): Broken Access Control in User Authentication in Avaya Scopia Pathfinder 10 and 20 PTS version 8.3.7.0.4 allows remote unauthenticated attack (CVSS 9.1)
- [CVE-2022-38710](https://cve.now/CVE-2022-38710.md): IBM Robotic Process Automation information disclosure (CVSS 5.3, IBM Robotic Process Automation)
- [CVE-2022-38712](https://cve.now/CVE-2022-38712.md): "IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Web services could allow a man-in-the-middle attacker to conduct SOAPAction spoofin (CVSS 5.9, IBM WebSphere Application Server)
- [CVE-2022-39234](https://cve.now/CVE-2022-39234.md): user session persists even after permanently deleting account in GLPI (CVSS 4.7, glpi-project glpi)
- [CVE-2022-39262](https://cve.now/CVE-2022-39262.md): Stored Cross-Site Scripting (XSS) on login page in GLPI (CVSS 5.2, glpi-project glpi)
- [CVE-2022-39276](https://cve.now/CVE-2022-39276.md): Blind Server-Side Request Forgery (SSRF) in RSS feeds and planning (CVSS 3.5, glpi-project glpi)
- [CVE-2022-39277](https://cve.now/CVE-2022-39277.md): Cross-Site Scripting (XSS) in external links in GLPI (CVSS 4.5, glpi-project glpi)
- [CVE-2022-39323](https://cve.now/CVE-2022-39323.md): SQL Injection on REST API in GLPI (CVSS 7.4, glpi-project glpi)
- [CVE-2022-39370](https://cve.now/CVE-2022-39370.md): Improper access to debug panel in GLPI (CVSS 4.3, glpi-project glpi)
- [CVE-2022-39371](https://cve.now/CVE-2022-39371.md): Stored Cross-Site Scripting (XSS) through asset inventory in GLPI (CVSS 7.5, glpi-project glpi)
- [CVE-2022-39372](https://cve.now/CVE-2022-39372.md): Stored Cross-Site Scripting (XSS) in user information in GLPI (CVSS 3.5, glpi-project glpi)
- [CVE-2022-39373](https://cve.now/CVE-2022-39373.md): Stored Cross-Site Scripting (XSS) in entity name in GLPI (CVSS 4.9, glpi-project glpi)
- [CVE-2022-39375](https://cve.now/CVE-2022-39375.md): Cross-Site Scripting (XSS) through public RSS feed in GLPI (CVSS 4.5, glpi-project glpi)
- [CVE-2022-39376](https://cve.now/CVE-2022-39376.md): Improper input validation on emails links in GLPI (CVSS 2.6, glpi-project glpi)
- [CVE-2022-39382](https://cve.now/CVE-2022-39382.md): NODE\_ENV in Keystone defaults to development with esbuild (CVSS 9.8, keystonejs keystone · @keystone-6/core)
- [CVE-2022-40230](https://cve.now/CVE-2022-40230.md): "IBM MQ Appliance 9.2 CD, 9.2 LTS, 9.3 CD, and LTS 9.3 does not invalidate session after logout which could allow an authenticated user to i (CVSS 6.5, IBM MQ Appliance)
- [CVE-2022-40235](https://cve.now/CVE-2022-40235.md): "IBM InfoSphere Information Server 11.7 could allow a user to cause a denial of service by removing the ability to run jobs due to improper (CVSS 6.5, IBM InfoSphere Information Server)
- [CVE-2022-40276](https://cve.now/CVE-2022-40276.md): Zettlr version 2.3.0 allows an external attacker to remotely obtain arbitrary local files on any client that attempts to view a malicious ma (CVSS 5.5, Zettlr)
- [CVE-2022-40747](https://cve.now/CVE-2022-40747.md): "IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. (CVSS 9.1, IBM InfoSphere Information Server)
- [CVE-2022-41435](https://cve.now/CVE-2022-41435.md): OpenWRT LuCI version git-22.140.66206-02913be was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component / (CVSS 5.4)
- [CVE-2022-41710](https://cve.now/CVE-2022-41710.md): Markdownify version 1.4.1 allows an external attacker to remotely obtain arbitrary local files on any client that attempts to view a malicio (CVSS 5.5, Markdownify · electron-markdownify)
- [CVE-2022-41713](https://cve.now/CVE-2022-41713.md): deep-object-diff 1.1.0 - Prototype Pollution (CVSS 5.3, deep-object-diff)
- [CVE-2022-41714](https://cve.now/CVE-2022-41714.md): fastest-json-copy 1.0.1 - Prototype Pollution (CVSS 5.3, fastest-json-copy)
- [CVE-2022-42442](https://cve.now/CVE-2022-42442.md): IBM Robotic Process Automation for Cloud Pak information disclosure (CVSS 3.3, IBM Robotic Process Automation for Cloud Pak)
- [CVE-2022-42743](https://cve.now/CVE-2022-42743.md): deep-parse-json 1.0.2 - Prototype Pollution (CVSS 5.3, deep-parse-json)
- [CVE-2022-42744](https://cve.now/CVE-2022-42744.md): CandidATS version 3.0.0 allows an external attacker to perform CRUD operations on the application databases. (CVSS 9.8, CandidATS)
- [CVE-2022-42745](https://cve.now/CVE-2022-42745.md): CandidATS version 3.0.0 allows an external attacker to read arbitrary files from the server. (no CVSS, CandidATS)
- [CVE-2022-42746](https://cve.now/CVE-2022-42746.md): CandidATS version 3.0.0 on 'indexFile' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. (CVSS 6.1, CandidATS)
- [CVE-2022-42747](https://cve.now/CVE-2022-42747.md): CandidATS version 3.0.0 on 'sortBy' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. (CVSS 6.1, CandidATS)
- [CVE-2022-42748](https://cve.now/CVE-2022-42748.md): CandidATS version 3.0.0 on 'sortDirection' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. (CVSS 6.1, CandidATS)
- [CVE-2022-42749](https://cve.now/CVE-2022-42749.md): CandidATS version 3.0.0 on 'page' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. (CVSS 6.1, CandidATS)
- [CVE-2022-42750](https://cve.now/CVE-2022-42750.md): CandidATS version 3.0.0 allows an external attacker to steal the cookie of arbitrary users. (CVSS 8.8, CandidATS)
- [CVE-2022-42751](https://cve.now/CVE-2022-42751.md): CandidATS version 3.0.0 allows an external attacker to elevate privileges in the application. (CVSS 8.8, CandidATS)
- [CVE-2022-42753](https://cve.now/CVE-2022-42753.md): SalonERP version 3.0.2 allows an external attacker to steal the cookie of arbitrary users. (CVSS 6.1, SalonERP)
- [CVE-2022-43061](https://cve.now/CVE-2022-43061.md): Online Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload vulnerability in the component /operations/ (CVSS 7.2)
- [CVE-2022-43062](https://cve.now/CVE-2022-43062.md): Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master (CVSS 7.2)
- [CVE-2022-43063](https://cve.now/CVE-2022-43063.md): Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Users. (CVSS 7.2)
- [CVE-2022-43101](https://cve.now/CVE-2022-43101.md): Tenda AC23 V16.03.07.45\_cn was discovered to contain a stack overflow via the devName parameter in the formSetDeviceName function. (CVSS 9.8)
- [CVE-2022-43102](https://cve.now/CVE-2022-43102.md): Tenda AC23 V16.03.07.45\_cn was discovered to contain a stack overflow via the timeZone parameter in the fromSetSysTime function. (CVSS 9.8)
- [CVE-2022-43103](https://cve.now/CVE-2022-43103.md): Tenda AC23 V16.03.07.45\_cn was discovered to contain a stack overflow via the list parameter in the formSetQosBand function. (CVSS 9.8)
- [CVE-2022-43104](https://cve.now/CVE-2022-43104.md): Tenda AC23 V16.03.07.45\_cn was discovered to contain a stack overflow via the wpapsk\_crypto parameter in the fromSetWirelessRepeat function. (CVSS 9.8)
- [CVE-2022-43105](https://cve.now/CVE-2022-43105.md): Tenda AC23 V16.03.07.45\_cn was discovered to contain a stack overflow via the shareSpeed parameter in the fromSetWifiGusetBasic function. (CVSS 9.8)
- [CVE-2022-43106](https://cve.now/CVE-2022-43106.md): Tenda AC23 V16.03.07.45\_cn was discovered to contain a stack overflow via the schedStartTime parameter in the setSchedWifi function. (CVSS 9.8)
- [CVE-2022-43107](https://cve.now/CVE-2022-43107.md): Tenda AC23 V16.03.07.45\_cn was discovered to contain a stack overflow via the time parameter in the setSmartPowerManagement function. (CVSS 9.8)
- [CVE-2022-43108](https://cve.now/CVE-2022-43108.md): Tenda AC23 V16.03.07.45\_cn was discovered to contain a stack overflow via the firewallEn parameter in the formSetFirewallCfg function. (CVSS 9.8)
- [CVE-2022-43109](https://cve.now/CVE-2022-43109.md): D-Link DIR-823G v1.0.2 was found to contain a command injection vulnerability in the function SetNetworkTomographySettings. (CVSS 9.8)
- [CVE-2022-43372](https://cve.now/CVE-2022-43372.md): Emlog Pro v1.7.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability at /admin/store.php. (CVSS 4.8)
- [CVE-2022-43574](https://cve.now/CVE-2022-43574.md): "IBM Robotic Process Automation 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to incorrect permission assignment which could allo (CVSS 7.5, IBM Robotic Process Automation)
- [CVE-2022-44622](https://cve.now/CVE-2022-44622.md): In JetBrains TeamCity version between 2021.2 and 2022.10 access permissions for secure token health items were excessive (CVSS 2.7, JetBrains TeamCity)
- [CVE-2022-44623](https://cve.now/CVE-2022-44623.md): In JetBrains TeamCity version before 2022.10, Project Viewer could see scrambled secure values in the MetaRunner settings (CVSS 6.5, JetBrains TeamCity)
- [CVE-2022-44624](https://cve.now/CVE-2022-44624.md): In JetBrains TeamCity version before 2022.10, Password parameters could be exposed in the build log if they contained special characters (CVSS 6.5, JetBrains TeamCity)
- [CVE-2022-44638](https://cve.now/CVE-2022-44638.md): In libpixman in Pixman before 0.42.2, there is an out-of-bounds write (aka heap-based buffer overflow) in rasterize\_edges\_8 due to an intege (CVSS 8.8)
- [CVE-2022-44646](https://cve.now/CVE-2022-44646.md): In JetBrains TeamCity version before 2022.10, no audit items were added upon editing a user's settings (CVSS 2.2, JetBrains TeamCity)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-11-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.