CVEs published November 4, 2022
37 CVEs were published on November 4, 2022: 3 critical, 21 high.
- Published
- 37
- Critical
- 3
- High
- 21
- Medium
- 12
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 21
Most affected products
- Splunk Enterprise
- 10
- Schneider Electric EcoStruxure Operator Terminal Expert · S…
- 6
- HCL Software HCL Domino
- 2
- Apache Software Foundation Apache Pulsar · pulsar-client
- 1
- azure-rtos usbx
- 1
- Becton Dickson (BD) BD Totalys MultiProcessor
- 1
- diplib
- 1
- froxlor/froxlor
- 1
- HCL Software HCL Commerce
- 1
- HCL Software HCL Workload Automation
- 1
Critical 3
- CVE-2022-31691Spring Tools 4 for Eclipse version 4.16.0 and below as well as VSCode extensions such as Spring Boot Tools, Concourse CI Pipeline Editor, BoSpring by VMware
- CVE-2022-39344Azure RTOS USBX vulnerable to buffer overflow azure-rtos usbx
- CVE-2022-39387XWiki OIDC Authenticator vulnerable to OpenID login bypass due to improper authentication xwiki-contrib oidc · org.xwiki.contrib.oidc:oidc-authentica…
High 21
- CVE-2022-43572Indexing blockage via malformed data sent through S2S or HEC protocols in Splunk EnterpriseSplunk Enterprise
- CVE-2022-43570XML External Entity Injection through a custom View in Splunk EnterpriseSplunk Enterprise
- CVE-2022-43569Persistent Cross-Site Scripting via a Data Model object name in Splunk EnterpriseSplunk Enterprise
- CVE-2022-43568Reflected Cross-Site Scripting via the radio template in Splunk EnterpriseSplunk Enterprise
- CVE-2022-43567Remote Code Execution via the Splunk Secure Gateway application Mobile Alerts featureSplunk Enterprise
- CVE-2022-43566Risky command safeguards bypass via Search ID query in Analytics Workspace in Splunk EnterpriseSplunk Enterprise
- CVE-2022-43565Risky command safeguards bypass via ‘tstats command JSON in Splunk EnterpriseSplunk Enterprise
- CVE-2022-43563Risky command safeguards bypass via rex search command field names in Splunk EnterpriseSplunk Enterprise
- CVE-2022-38656HCL Commerce, when using Elasticsearch, could be affected by a denial of service vulnerabilityHCL Software HCL Commerce
- CVE-2022-38660HCL XPages applications are susceptible to Cross Site Request Forgery (CSRF) vulnerabilityHCL Software HCL Domino
- CVE-2021-34055jhead 3.06 is vulnerable to Buffer Overflow via exif.c in function Put16u.
- CVE-2022-33684Apache Pulsar C++/Python OAuth Clients prior to 3.0.0 were vulnerable to an MITM attack due to Disabled Certificate ValidationApache Software Foundation Apache Pulsar · pulsar-client
- CVE-2022-3721 Code Injection in froxlor/froxlorfroxlor/froxlor
- CVE-2022-41666A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that allows adversaries with local user privileges to load Schneider Electric EcoStruxure Operator Terminal Expert · S…
- CVE-2022-41667A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that allows adversaries with lSchneider Electric EcoStruxure Operator Terminal Expert · S…
- CVE-2022-41668A CWE-704: Incorrect Project Conversion vulnerability exists that allows adversaries with local user privileges to load a project file from Schneider Electric EcoStruxure Operator Terminal Expert · S…
- CVE-2022-41669A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists in the SGIUtility component that allows adversaries with loSchneider Electric EcoStruxure Operator Terminal Expert · S…
- CVE-2022-41670A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in the SGIUtility component thSchneider Electric EcoStruxure Operator Terminal Expert · S…
- CVE-2022-41671A CWE-89: Improper Neutralization of Special Elements used in SQL Command (‘SQL Injection’) vulnerability exists that allows adversaries witSchneider Electric EcoStruxure Operator Terminal Expert · S…
- CVE-2022-43945The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer overflow.linux_kernel
- CVE-2022-44724The Handy Tip macro in Stiltsoft Handy Macros for Confluence Server/Data Center 3.x before 3.5.5 allows remote attackers to inject arbitrary
Medium, low and unrated 13
- CVE-2022-43564Denial of Service in Splunk Enterprise through search macrosSplunk Enterprise
- CVE-2022-43562Host Header Injection in Splunk EnterpriseSplunk Enterprise
- CVE-2022-38661HCL Workload Automation is affected by a vulnerability in Jlog component of the Master Domain ManagerHCL Software HCL Workload Automation
- CVE-2022-38654HCL Domino is susceptible to an information disclosure vulnerabilityHCL Software HCL Domino
- CVE-2022-40263BD Totalys MultiProcessor - Hardcoded CredentialsBecton Dickson (BD) BD Totalys MultiProcessor
- CVE-2022-27894The Foundry Blobster service was found to have a cross-site scripting (XSS) vulnerability.Palantir Foundry Blobster Service
- CVE-2022-27893The Foundry Magritte plugin osisoft-pi-web-connector was found to be logging in a manner that captured authentication requests.Palantir Foundry Magritte plugin osisoft-pi-web-connector
- CVE-2021-39432diplib v3.0.0 is vulnerable to Double Free.diplib
- CVE-2021-39473Saibamen HotelManager v1.2 is vulnerable to Cross Site Scripting (XSS) due to improper sanitization of comment and contact fields.
- CVE-2022-3023Use of Externally-Controlled Format String in pingcap/tidbpingcap/tidb · github.com/pingcap/tidb
- CVE-2022-3340Trellix IPS Manager vulnerable to XXETrellix IPS Manager
- CVE-2022-38582Incorrect access control in the anti-virus driver wsdkd.sys of Watchdog Antivirus v1.4.158 allows attackers to write arbitrary files.
- CVE-2022-39384OpenZeppelin Contracts initializer reentrancy may lead to double initializationopenzeppelin-contracts · @openzeppelin/contracts +1