# CVEs published 2022-11-07

63 CVEs were published on November 7, 2022: 15 critical, 27 high. Days are UTC.

- [CVE-2022-44746](https://cve.now/CVE-2022-44746.md): Sensitive information disclosure due to insecure folder permissions. (CVSS 2.2, Acronis Cyber Protect Home Office)
- [CVE-2022-44745](https://cve.now/CVE-2022-44745.md): Sensitive information leak through log files. (CVSS 4.0, Acronis Cyber Protect Home Office)
- [CVE-2022-44744](https://cve.now/CVE-2022-44744.md): Local privilege escalation due to DLL hijacking vulnerability. (CVSS 2.2, Acronis Cyber Protect Home Office)
- [CVE-2022-44747](https://cve.now/CVE-2022-44747.md): Local privilege escalation due to improper soft link handling. (CVSS 2.2, Acronis Cyber Protect Home Office)
- [CVE-2022-44733](https://cve.now/CVE-2022-44733.md): Local privilege escalation due to insecure folder permissions. (CVSS 7.3, Acronis Cyber Protect Home Office)
- [CVE-2022-44732](https://cve.now/CVE-2022-44732.md): Local privilege escalation due to insecure folder permissions. (CVSS 7.3, Acronis Cyber Protect Home Office)
- [CVE-2022-2188](https://cve.now/CVE-2022-2188.md): DXL Broker privilege escalation vulnerability (CVSS 6.5, Trellix DXL Broker)
- [CVE-2020-12509](https://cve.now/CVE-2020-12509.md): s::can moni::tools prone to path traversal in camera-file module (CVSS 7.5, s::can moni::tools)
- [CVE-2020-12508](https://cve.now/CVE-2020-12508.md): s::can moni::tools prone to path traversal in image-relocator module (CVSS 7.5, s::can moni::tools)
- [CVE-2020-12507](https://cve.now/CVE-2020-12507.md): s::can moni::tools autheticated SQL injection (CVSS 8.8, s::can moni:tools)
- [CVE-2021-42205](https://cve.now/CVE-2021-42205.md): ELAN Miniport touchpad Windows driver before 24.21.51.2, as used in PC hardware from multiple manufacturers, allows local users to cause a s (CVSS 4.7)
- [CVE-2022-2387](https://cve.now/CVE-2022-2387.md): Easy Digital Downloads \< 3.0 - Arbitrary Post Deletion via CSRF (CVSS 4.3, Easy Digital Downloads – Simple eCommerce for Selling Digit…)
- [CVE-2022-2711](https://cve.now/CVE-2022-2711.md): WP All Import \< 3.6.9 - Admin+ Directory traversal via file upload (CVSS 7.2, Import any XML or CSV File to WordPress)
- [CVE-2022-3418](https://cve.now/CVE-2022-3418.md): WP All Import \< 3.6.9 - Admin+ Arbitrary File Upload to RCE (CVSS 7.2, Import any XML or CSV File to WordPress)
- [CVE-2022-3451](https://cve.now/CVE-2022-3451.md): Product Stock Manager \< 1.0.5 - Subscriber+ Unauthorised AJAX Calls (CVSS 4.3, Product Stock Manager)
- [CVE-2022-3462](https://cve.now/CVE-2022-3462.md): Highlight Focus \<= 1.1 - Admin+ Stored Cross Site Scripting (CVSS 4.8, Highlight Focus)
- [CVE-2022-3463](https://cve.now/CVE-2022-3463.md): FluentForm \< 4.3.13 - CSV Injection (CVSS 9.8, Contact Form Plugin – Fastest Contact Form Builder Plugin f…)
- [CVE-2022-3481](https://cve.now/CVE-2022-3481.md): WooCommerce Dropshipping \< 4.4 - Unauthenticated SQLi (CVSS 9.8, WooCommerce Dropshipping)
- [CVE-2022-3489](https://cve.now/CVE-2022-3489.md): WP Hide \<= 0.0.2 - Unauthenticated Settings Update (CVSS 5.3, Wp-Hide)
- [CVE-2022-3494](https://cve.now/CVE-2022-3494.md): Complianz (Free \< 6.3.4, Premium \< 6.3.6) - Translator SQLi (CVSS 8.8, Complianz – GDPR/CCPA Cookie Consent · Complianz Premium)
- [CVE-2022-3536](https://cve.now/CVE-2022-3536.md): Role Based Pricing for WooCommerce \< 1.6.3 - Subscriber+ PHAR Deserialization (CVSS 8.8, Role Based Pricing for WooCommerce)
- [CVE-2022-3537](https://cve.now/CVE-2022-3537.md): Role Based Pricing for WooCommerce \< 1.6.2 - Subscriber+ Arbitrary File Upload (CVSS 8.8, Role Based Pricing for WooCommerce)
- [CVE-2022-3558](https://cve.now/CVE-2022-3558.md): Import and export users and customers \< 1.20.5 - Subscriber+ CSV Injection (CVSS 8.0, Import and export users and customers)
- [CVE-2022-37865](https://cve.now/CVE-2022-37865.md): Apache Ivy allows creating/overwriting any file on the system (CVSS 9.1, Apache Software Foundation Apache Ivy · org.apache.ivy:ivy)
- [CVE-2022-37866](https://cve.now/CVE-2022-37866.md): Apache Ivy allows path traversal in the presence of a malicious repository (CVSS 7.5, Apache Software Foundation Apache Ivy · org.apache.ivy:ivy)
- [CVE-2022-38163](https://cve.now/CVE-2022-38163.md): A Drag and Drop spoof vulnerability was discovered in F-Secure SAFE Browser for Android and iOS version 19.0 and below. (CVSS 3.5)
- [CVE-2022-38164](https://cve.now/CVE-2022-38164.md): A vulnerability affecting F-Secure SAFE browser for Android and iOS was discovered. (CVSS 6.5)
- [CVE-2022-3872](https://cve.now/CVE-2022-3872.md): An off-by-one read/write issue was found in the SDHCI device of QEMU. (CVSS 8.6, QEMU)
- [CVE-2022-3873](https://cve.now/CVE-2022-3873.md): Cross-site Scripting (XSS) - DOM in jgraph/drawio (CVSS 6.5, jgraph/drawio)
- [CVE-2022-3878](https://cve.now/CVE-2022-3878.md): Maxon ERP browse\_data sql injection (CVSS 7.3, Maxon ERP)
- [CVE-2022-42920](https://cve.now/CVE-2022-42920.md): Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing (no CVSS, Apache Software Foundation Apache Commons BCEL · org.apache…)
- [CVE-2022-42955](https://cve.now/CVE-2022-42955.md): The PassWork extension 5.0.9 for Chrome and other browsers allows an attacker to obtain cleartext cached credentials. (CVSS 7.5)
- [CVE-2022-42956](https://cve.now/CVE-2022-42956.md): The PassWork extension 5.0.9 for Chrome and other browsers allows an attacker to obtain the cleartext master password. (CVSS 7.5)
- [CVE-2022-42990](https://cve.now/CVE-2022-42990.md): Food Ordering Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /foms/all-orders.php?status=C (CVSS 7.2)
- [CVE-2022-43046](https://cve.now/CVE-2022-43046.md): Food Ordering Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /foms/place-order (CVSS 4.8)
- [CVE-2022-43049](https://cve.now/CVE-2022-43049.md): Canteen Management System Project v1.0 was discovered to contain a SQL injection vulnerability via the component /youthappam/add-food.php. (CVSS 7.2)
- [CVE-2022-43050](https://cve.now/CVE-2022-43050.md): Online Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload vulnerability in the component update\_profi (CVSS 7.2)
- [CVE-2022-43051](https://cve.now/CVE-2022-43051.md): Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/classes/ (CVSS 7.2)
- [CVE-2022-43052](https://cve.now/CVE-2022-43052.md): Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/classes/ (CVSS 7.2)
- [CVE-2022-43303](https://cve.now/CVE-2022-43303.md): The d8s-strings for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (CVSS 9.8)
- [CVE-2022-43304](https://cve.now/CVE-2022-43304.md): The d8s-timer for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (CVSS 9.8)
- [CVE-2022-43305](https://cve.now/CVE-2022-43305.md): The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (CVSS 9.8)
- [CVE-2022-43306](https://cve.now/CVE-2022-43306.md): The d8s-timer for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (CVSS 8.8)
- [CVE-2022-43317](https://cve.now/CVE-2022-43317.md): A cross-site scripting (XSS) vulnerability in /hrm/index.php?msg of Human Resource Management System v1.0 allows attackers to execute arbitr (no CVSS)
- [CVE-2022-43318](https://cve.now/CVE-2022-43318.md): Human Resource Management System v1.0 was discovered to contain a SQL injection vulnerability via the stateedit parameter at /hrm/state.php. (no CVSS)
- [CVE-2022-43319](https://cve.now/CVE-2022-43319.md): An information disclosure vulnerability in the component vcs/downloadFiles.php?download=./search.php of Simple E-Learning System v1.0 allows (CVSS 7.5)
- [CVE-2022-43350](https://cve.now/CVE-2022-43350.md): Sanitization Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php-sms/classes/Master. (CVSS 7.2)
- [CVE-2022-43351](https://cve.now/CVE-2022-43351.md): Sanitization Management System v1.0 was discovered to contain an arbitrary file deletion vulnerability via the component /classes/Master.php (CVSS 6.5)
- [CVE-2022-43352](https://cve.now/CVE-2022-43352.md): Sanitization Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php-sms/classes/Master. (CVSS 7.2)
- [CVE-2022-43359](https://cve.now/CVE-2022-43359.md): Gifdec commit 1dcbae19363597314f6623010cc80abad4e47f7c was discovered to contain an out-of-bounds read in the function read\_image\_data. (CVSS 7.8)
- [CVE-2022-44048](https://cve.now/CVE-2022-44048.md): The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (CVSS 9.8)
- [CVE-2022-44049](https://cve.now/CVE-2022-44049.md): The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (CVSS 9.8)
- [CVE-2022-44050](https://cve.now/CVE-2022-44050.md): The d8s-networking for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (CVSS 9.8)
- [CVE-2022-44051](https://cve.now/CVE-2022-44051.md): The d8s-stats for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (CVSS 9.8)
- [CVE-2022-44052](https://cve.now/CVE-2022-44052.md): The d8s-dates for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (CVSS 9.8)
- [CVE-2022-44053](https://cve.now/CVE-2022-44053.md): The d8s-networking for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (CVSS 9.8)
- [CVE-2022-44054](https://cve.now/CVE-2022-44054.md): The d8s-xml for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (CVSS 9.8)
- [CVE-2022-44792](https://cve.now/CVE-2022-44792.md): handle\_ipDefaultTTL in agent/mibgroup/ip-mib/ip\_scalars.c in Net-SNMP 5.8 through 5.9.3 has a NULL Pointer Exception bug that can be used by (CVSS 6.5)
- [CVE-2022-44793](https://cve.now/CVE-2022-44793.md): handle\_ipv6IpForwarding in agent/mibgroup/ip-mib/ip\_scalars.c in Net-SNMP 5.4.3 through 5.9.3 has a NULL Pointer Exception bug that can be u (CVSS 6.5)
- [CVE-2022-44794](https://cve.now/CVE-2022-44794.md): An issue was discovered in Object First Ootbi BETA build 1.0.7.712. (CVSS 8.8)
- [CVE-2022-44795](https://cve.now/CVE-2022-44795.md): An issue was discovered in Object First Ootbi BETA build 1.0.7.712. (CVSS 6.5)
- [CVE-2022-44796](https://cve.now/CVE-2022-44796.md): An issue was discovered in Object First Ootbi BETA build 1.0.7.712. (CVSS 9.8)
- [CVE-2022-44797](https://cve.now/CVE-2022-44797.md): btcd before 0.23.2, as used in Lightning Labs lnd before 0.15.2-beta and other Bitcoin-related products, mishandles witness size checking. (CVSS 9.8, github.com/btcsuite/btcd · github.com/lightningnetwork/lnd)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-11-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.