# CVEs published 2022-11-04

37 CVEs were published on November 4, 2022: 3 critical, 21 high. Days are UTC.

- [CVE-2022-43572](https://cve.now/CVE-2022-43572.md): Indexing blockage via malformed data sent through S2S or HEC protocols in Splunk Enterprise (CVSS 7.5, Splunk Enterprise)
- [CVE-2022-43570](https://cve.now/CVE-2022-43570.md): XML External Entity Injection through a custom View in Splunk Enterprise (CVSS 8.8, Splunk Enterprise)
- [CVE-2022-43569](https://cve.now/CVE-2022-43569.md): Persistent Cross-Site Scripting via a Data Model object name in Splunk Enterprise (CVSS 8.0, Splunk Enterprise)
- [CVE-2022-43568](https://cve.now/CVE-2022-43568.md): Reflected Cross-Site Scripting via the radio template in Splunk Enterprise (CVSS 8.8, Splunk Enterprise)
- [CVE-2022-43567](https://cve.now/CVE-2022-43567.md): Remote Code Execution via the Splunk Secure Gateway application Mobile Alerts feature (CVSS 8.8, Splunk Enterprise)
- [CVE-2022-43566](https://cve.now/CVE-2022-43566.md): Risky command safeguards bypass via Search ID query in Analytics Workspace in Splunk Enterprise (CVSS 7.3, Splunk Enterprise)
- [CVE-2022-43565](https://cve.now/CVE-2022-43565.md): Risky command safeguards bypass via ‘tstats command JSON in Splunk Enterprise (CVSS 8.1, Splunk Enterprise)
- [CVE-2022-43564](https://cve.now/CVE-2022-43564.md): Denial of Service in Splunk Enterprise through search macros (CVSS 4.9, Splunk Enterprise)
- [CVE-2022-43563](https://cve.now/CVE-2022-43563.md): Risky command safeguards bypass via rex search command field names in Splunk Enterprise (CVSS 8.1, Splunk Enterprise)
- [CVE-2022-43562](https://cve.now/CVE-2022-43562.md): Host Header Injection in Splunk Enterprise (CVSS 3.0, Splunk Enterprise)
- [CVE-2022-38656](https://cve.now/CVE-2022-38656.md): HCL Commerce, when using Elasticsearch, could be affected by a denial of service vulnerability (CVSS 8.6, HCL Software HCL Commerce)
- [CVE-2022-38661](https://cve.now/CVE-2022-38661.md): HCL Workload Automation is affected by a vulnerability in Jlog component of the Master Domain Manager (CVSS 6.2, HCL Software HCL Workload Automation)
- [CVE-2022-38654](https://cve.now/CVE-2022-38654.md): HCL Domino is susceptible to an information disclosure vulnerability (CVSS 5.5, HCL Software HCL Domino)
- [CVE-2022-38660](https://cve.now/CVE-2022-38660.md): HCL XPages applications are susceptible to Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.3, HCL Software HCL Domino)
- [CVE-2022-40263](https://cve.now/CVE-2022-40263.md): BD Totalys MultiProcessor - Hardcoded Credentials (CVSS 6.6, Becton Dickson (BD) BD Totalys MultiProcessor)
- [CVE-2022-27894](https://cve.now/CVE-2022-27894.md): The Foundry Blobster service was found to have a cross-site scripting (XSS) vulnerability. (CVSS 4.8, Palantir Foundry Blobster Service)
- [CVE-2022-27893](https://cve.now/CVE-2022-27893.md): The Foundry Magritte plugin osisoft-pi-web-connector was found to be logging in a manner that captured authentication requests. (CVSS 4.2, Palantir Foundry Magritte plugin osisoft-pi-web-connector)
- [CVE-2021-34055](https://cve.now/CVE-2021-34055.md): jhead 3.06 is vulnerable to Buffer Overflow via exif.c in function Put16u. (CVSS 7.8)
- [CVE-2021-39432](https://cve.now/CVE-2021-39432.md): diplib v3.0.0 is vulnerable to Double Free. (CVSS 6.5, diplib)
- [CVE-2021-39473](https://cve.now/CVE-2021-39473.md): Saibamen HotelManager v1.2 is vulnerable to Cross Site Scripting (XSS) due to improper sanitization of comment and contact fields. (CVSS 5.4)
- [CVE-2022-3023](https://cve.now/CVE-2022-3023.md): Use of Externally-Controlled Format String in pingcap/tidb (CVSS 4.2, pingcap/tidb · github.com/pingcap/tidb)
- [CVE-2022-31691](https://cve.now/CVE-2022-31691.md): Spring Tools 4 for Eclipse version 4.16.0 and below as well as VSCode extensions such as Spring Boot Tools, Concourse CI Pipeline Editor, Bo (CVSS 9.8, Spring by VMware)
- [CVE-2022-3340](https://cve.now/CVE-2022-3340.md): Trellix IPS Manager vulnerable to XXE (CVSS 5.9, Trellix IPS Manager)
- [CVE-2022-33684](https://cve.now/CVE-2022-33684.md): Apache Pulsar C++/Python OAuth Clients prior to 3.0.0 were vulnerable to an MITM attack due to Disabled Certificate Validation (CVSS 8.1, Apache Software Foundation Apache Pulsar · pulsar-client)
- [CVE-2022-3721](https://cve.now/CVE-2022-3721.md): Code Injection in froxlor/froxlor (CVSS 7.6, froxlor/froxlor)
- [CVE-2022-38582](https://cve.now/CVE-2022-38582.md): Incorrect access control in the anti-virus driver wsdkd.sys of Watchdog Antivirus v1.4.158 allows attackers to write arbitrary files. (CVSS 6.5)
- [CVE-2022-39344](https://cve.now/CVE-2022-39344.md): Azure RTOS USBX vulnerable to buffer overflow (CVSS 9.8, azure-rtos usbx)
- [CVE-2022-39384](https://cve.now/CVE-2022-39384.md): OpenZeppelin Contracts initializer reentrancy may lead to double initialization (CVSS 5.6, openzeppelin-contracts · @openzeppelin/contracts +1)
- [CVE-2022-39387](https://cve.now/CVE-2022-39387.md): XWiki OIDC Authenticator vulnerable to OpenID login bypass due to improper authentication (CVSS 9.1, xwiki-contrib oidc · org.xwiki.contrib.oidc:oidc-authentica…)
- [CVE-2022-41666](https://cve.now/CVE-2022-41666.md): A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that allows adversaries with local user privileges to load (CVSS 7.0, Schneider Electric EcoStruxure Operator Terminal Expert · S…)
- [CVE-2022-41667](https://cve.now/CVE-2022-41667.md): A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that allows adversaries with l (CVSS 7.0, Schneider Electric EcoStruxure Operator Terminal Expert · S…)
- [CVE-2022-41668](https://cve.now/CVE-2022-41668.md): A CWE-704: Incorrect Project Conversion vulnerability exists that allows adversaries with local user privileges to load a project file from (CVSS 7.0, Schneider Electric EcoStruxure Operator Terminal Expert · S…)
- [CVE-2022-41669](https://cve.now/CVE-2022-41669.md): A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists in the SGIUtility component that allows adversaries with lo (CVSS 7.0, Schneider Electric EcoStruxure Operator Terminal Expert · S…)
- [CVE-2022-41670](https://cve.now/CVE-2022-41670.md): A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in the SGIUtility component th (CVSS 7.0, Schneider Electric EcoStruxure Operator Terminal Expert · S…)
- [CVE-2022-41671](https://cve.now/CVE-2022-41671.md): A CWE-89: Improper Neutralization of Special Elements used in SQL Command (‘SQL Injection’) vulnerability exists that allows adversaries wit (CVSS 7.0, Schneider Electric EcoStruxure Operator Terminal Expert · S…)
- [CVE-2022-43945](https://cve.now/CVE-2022-43945.md): The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer overflow. (CVSS 7.5, linux\_kernel)
- [CVE-2022-44724](https://cve.now/CVE-2022-44724.md): The Handy Tip macro in Stiltsoft Handy Macros for Confluence Server/Data Center 3.x before 3.5.5 allows remote attackers to inject arbitrary (CVSS 8.9)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-11-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.