CVEs published November 7, 2022
63 CVEs were published on November 7, 2022: 15 critical, 27 high.
- Published
- 63
- Critical
- 15
- High
- 27
- Medium
- 14
- Low
- 4
- Unrated
- 3
- Now in CISA KEV
- 0
- Fix available
- 25
Most affected products
- Acronis Cyber Protect Home Office
- 6
- Apache Software Foundation Apache Ivy · org.apache.ivy:ivy
- 2
- Import any XML or CSV File to WordPress
- 2
- Role Based Pricing for WooCommerce
- 2
- s::can moni::tools
- 2
- Apache Software Foundation Apache Commons BCEL · org.apache…
- 1
- Complianz – GDPR/CCPA Cookie Consent · Complianz Premium
- 1
- Contact Form Plugin – Fastest Contact Form Builder Plugin f…
- 1
- Easy Digital Downloads – Simple eCommerce for Selling Digit…
- 1
- github.com/btcsuite/btcd · github.com/lightningnetwork/lnd
- 1
Critical 15
- CVE-2022-3463FluentForm < 4.3.13 - CSV InjectionContact Form Plugin – Fastest Contact Form Builder Plugin f…
- CVE-2022-3481WooCommerce Dropshipping < 4.4 - Unauthenticated SQLiWooCommerce Dropshipping
- CVE-2022-37865Apache Ivy allows creating/overwriting any file on the systemApache Software Foundation Apache Ivy · org.apache.ivy:ivy
- CVE-2022-43303The d8s-strings for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.
- CVE-2022-43304The d8s-timer for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.
- CVE-2022-43305The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.
- CVE-2022-44048The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.
- CVE-2022-44049The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.
- CVE-2022-44050The d8s-networking for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.
- CVE-2022-44051The d8s-stats for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.
- CVE-2022-44052The d8s-dates for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.
- CVE-2022-44053The d8s-networking for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.
- CVE-2022-44054The d8s-xml for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.
- CVE-2022-44796An issue was discovered in Object First Ootbi BETA build 1.0.7.712.
- CVE-2022-44797btcd before 0.23.2, as used in Lightning Labs lnd before 0.15.2-beta and other Bitcoin-related products, mishandles witness size checking.github.com/btcsuite/btcd · github.com/lightningnetwork/lnd
High 27
- CVE-2022-44733Local privilege escalation due to insecure folder permissions.Acronis Cyber Protect Home Office
- CVE-2022-44732Local privilege escalation due to insecure folder permissions.Acronis Cyber Protect Home Office
- CVE-2020-12509s::can moni::tools prone to path traversal in camera-file modules::can moni::tools
- CVE-2020-12508s::can moni::tools prone to path traversal in image-relocator modules::can moni::tools
- CVE-2020-12507s::can moni::tools autheticated SQL injection s::can moni:tools
- CVE-2022-2711WP All Import < 3.6.9 - Admin+ Directory traversal via file uploadImport any XML or CSV File to WordPress
- CVE-2022-3418WP All Import < 3.6.9 - Admin+ Arbitrary File Upload to RCEImport any XML or CSV File to WordPress
- CVE-2022-3494Complianz (Free < 6.3.4, Premium < 6.3.6) - Translator SQLiComplianz – GDPR/CCPA Cookie Consent · Complianz Premium
- CVE-2022-3536Role Based Pricing for WooCommerce < 1.6.3 - Subscriber+ PHAR DeserializationRole Based Pricing for WooCommerce
- CVE-2022-3537Role Based Pricing for WooCommerce < 1.6.2 - Subscriber+ Arbitrary File UploadRole Based Pricing for WooCommerce
- CVE-2022-3558Import and export users and customers < 1.20.5 - Subscriber+ CSV InjectionImport and export users and customers
- CVE-2022-37866Apache Ivy allows path traversal in the presence of a malicious repositoryApache Software Foundation Apache Ivy · org.apache.ivy:ivy
- CVE-2022-3872An off-by-one read/write issue was found in the SDHCI device of QEMU.QEMU
- CVE-2022-3878Maxon ERP browse_data sql injectionMaxon ERP
- CVE-2022-42955The PassWork extension 5.0.9 for Chrome and other browsers allows an attacker to obtain cleartext cached credentials.
- CVE-2022-42956The PassWork extension 5.0.9 for Chrome and other browsers allows an attacker to obtain the cleartext master password.
- CVE-2022-42990Food Ordering Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /foms/all-orders.php?status=C
- CVE-2022-43049Canteen Management System Project v1.0 was discovered to contain a SQL injection vulnerability via the component /youthappam/add-food.php.
- CVE-2022-43050Online Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload vulnerability in the component update_profi
- CVE-2022-43051Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/classes/
- CVE-2022-43052Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/classes/
- CVE-2022-43306The d8s-timer for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.
- CVE-2022-43319An information disclosure vulnerability in the component vcs/downloadFiles.php?download=./search.php of Simple E-Learning System v1.0 allows
- CVE-2022-43350Sanitization Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php-sms/classes/Master.
- CVE-2022-43352Sanitization Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php-sms/classes/Master.
- CVE-2022-43359Gifdec commit 1dcbae19363597314f6623010cc80abad4e47f7c was discovered to contain an out-of-bounds read in the function read_image_data.
- CVE-2022-44794An issue was discovered in Object First Ootbi BETA build 1.0.7.712.
Medium, low and unrated 21
- CVE-2022-44746Sensitive information disclosure due to insecure folder permissions.Acronis Cyber Protect Home Office
- CVE-2022-44745Sensitive information leak through log files.Acronis Cyber Protect Home Office
- CVE-2022-44744Local privilege escalation due to DLL hijacking vulnerability.Acronis Cyber Protect Home Office
- CVE-2022-44747Local privilege escalation due to improper soft link handling.Acronis Cyber Protect Home Office
- CVE-2022-2188DXL Broker privilege escalation vulnerabilityTrellix DXL Broker
- CVE-2021-42205ELAN Miniport touchpad Windows driver before 24.21.51.2, as used in PC hardware from multiple manufacturers, allows local users to cause a s
- CVE-2022-2387Easy Digital Downloads < 3.0 - Arbitrary Post Deletion via CSRFEasy Digital Downloads – Simple eCommerce for Selling Digit…
- CVE-2022-3451Product Stock Manager < 1.0.5 - Subscriber+ Unauthorised AJAX CallsProduct Stock Manager
- CVE-2022-3462Highlight Focus <= 1.1 - Admin+ Stored Cross Site ScriptingHighlight Focus
- CVE-2022-3489WP Hide <= 0.0.2 - Unauthenticated Settings UpdateWp-Hide
- CVE-2022-38163A Drag and Drop spoof vulnerability was discovered in F-Secure SAFE Browser for Android and iOS version 19.0 and below.
- CVE-2022-38164A vulnerability affecting F-Secure SAFE browser for Android and iOS was discovered.
- CVE-2022-3873Cross-site Scripting (XSS) - DOM in jgraph/drawiojgraph/drawio
- CVE-2022-42920Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writingApache Software Foundation Apache Commons BCEL · org.apache…
- CVE-2022-43046Food Ordering Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /foms/place-order
- CVE-2022-43317A cross-site scripting (XSS) vulnerability in /hrm/index.php?msg of Human Resource Management System v1.0 allows attackers to execute arbitr
- CVE-2022-43318Human Resource Management System v1.0 was discovered to contain a SQL injection vulnerability via the stateedit parameter at /hrm/state.php.
- CVE-2022-43351Sanitization Management System v1.0 was discovered to contain an arbitrary file deletion vulnerability via the component /classes/Master.php
- CVE-2022-44792handle_ipDefaultTTL in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.8 through 5.9.3 has a NULL Pointer Exception bug that can be used by
- CVE-2022-44793handle_ipv6IpForwarding in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.4.3 through 5.9.3 has a NULL Pointer Exception bug that can be u
- CVE-2022-44795An issue was discovered in Object First Ootbi BETA build 1.0.7.712.