CVEs published November 8, 2022
119 CVEs were published on November 8, 2022: 14 critical, 31 high. 1 is now in CISA KEV.
- Published
- 119
- Critical
- 14
- High
- 31
- Medium
- 71
- Low
- 2
- Unrated
- 1
- Now in CISA KEV
- 1
- Fix available
- 7
Most affected products
- Android
- 17
- Siemens JT2Go · Siemens Teamcenter Visualization
- 6
- NEC CLUSTERPRO X
- 4
- Citrix Gateway, Citrix ADC
- 3
- gVectors Team wpForo Forum
- 3
- MediaTek MT6762, MT6768, MT6769, MT6779, MT6781, MT6785, MT…
- 3
- SAP SE SAP Financial Consolidation
- 3
- MediaTek MT6879, MT6895, MT6983
- 2
- MediaTek MT6983, MT8871, MT8891
- 2
- SAP SE SAP NetWeaver Application Server ABAP and ABAP Platf…
- 2
Critical 14
- CVE-2022-27510Unauthorized access to Gateway user capabilities Citrix Gateway, Citrix ADC
- CVE-2022-31199Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting both the Netwrix Audito
- CVE-2022-33321Cleartext Transmission of Sensitive Information vulnerability due to the use of Basic Authentication for HTTP connections in Mitsubishi ElecMitsubishi Electric PHOTOVOLTAIC COLOR MONITOR ECO-GUI… +275
- CVE-2022-34822Path traversal vulnerability in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 SinNEC CLUSTERPRO X
- CVE-2022-34823Buffer overflow vulnerability in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 SiNEC CLUSTERPRO X
- CVE-2022-34824Weak File and Folder Permissions vulnerability in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLNEC CLUSTERPRO X
- CVE-2022-34825Uncontrolled Search Path Element in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0NEC CLUSTERPRO X
- CVE-2022-37015Symantec Endpoint Detection and Response (SEDR) Appliance, prior to 4.7.0, may be susceptible to a privilege escalation vulnerability, whichSymantec Endpoint Detection and Response
- CVE-2022-39328Grafana vulnerable to race condition allowing privilege escalationgrafana · github.com/grafana/grafana
- CVE-2022-41203In some workflow of SAP BusinessObjects BI Platform (Central Management Console and BI LaunchPad), an authenticated attacker with low privilSAP SE SAP BusinessObjects Business Intelligence Platform
- CVE-2022-43439A vulnerability has been identified in POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) (All versions < V2.50), POWER METER SICAM Q100 (7KG9501-0Siemens POWER METER SICAM Q100 · Siemens SICAM P850 +2
- CVE-2022-43545A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER MSiemens POWER METER SICAM Q100 · Siemens SICAM P850 +1
- CVE-2022-43546A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER MSiemens POWER METER SICAM Q100 · Siemens SICAM P850 +1
- CVE-2022-44457A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions < V1.17.0), Mendix SAML (Mendix 7 compatible) (All veSiemens Mendix SAML
High 31
- CVE-2022-27513Remote desktop takeover via phishingCitrix Gateway, Citrix ADC
- CVE-2022-27858WordPress Activity Log plugin <= 2.8.3 - CSV Injection vulnerabilityActivity Log Team Activity Log
- CVE-2021-1050In MMU_UnmapPages of the PowerVR kernel driver, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-39661In _PMRLogicalOffsetToPhysicalOffset of the PowerVR kernel driver, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2022-20441In navigateUpTo of Task.java, there is a possible way to launch an unexported intent handler due to a logic error in the code.Android
- CVE-2022-20445In process_service_search_rsp of sdp_discovery.cc, there is a possible out of bounds read due to improper input validation.Android
- CVE-2022-20450In restorePermissionState of PermissionManagerServiceImpl.java, there is a possible way to bypass user consent due to a missing permission cAndroid
- CVE-2022-20451In onCallRedirectionComplete of CallsManager.java, there is a possible permissions bypass due to a missing permission check.Android
- CVE-2022-20452In initializeFromParcelLocked of BaseBundle.java, there is a possible method arbitrary code execution due to a confused deputy.Android
- CVE-2022-20462In phNxpNciHal_write_unlocked of phNxpNciHal.cc, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2022-26446In Modem 4G RRC, there is a possible system crash due to improper input validation.MediaTek MT2731, MT2735, MT6297, MT6725, MT6739, MT6761, MT…
- CVE-2022-32601In telephony, there is a possible permission bypass due to a parcel format mismatch.MediaTek MT6739, MT6761, MT6762, MT6763, MT6765, MT6768, MT…
- CVE-2022-36077Electron subject to Exfiltration of hashed SMB credentials on Windows via file:// redirectelectron
- CVE-2022-39136A vulnerability has been identified in JT2Go (All versions < V14.1.0.4), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), TeamceSiemens JT2Go · Siemens Teamcenter Visualization
- CVE-2022-39157A vulnerability has been identified in Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.0 (All versions >= V34.0.252 < V34.0.254), Siemens Parasolid · Siemens Simcenter Femap
- CVE-2022-39377sysstat Incorrect Buffer Size calculation on 32-bit systems results in RCE via buffer overflowsysstat
- CVE-2022-39386fastify-websocket vulnerable to uncaught exception via crash on malformed packetfastify-websocket · @fastify/websocket
- CVE-2022-41211Due to lack of proper memory management, when a victim opens manipulated file received from untrusted sources in SAP 3D Visual Enterprise AuSAP SE SAP 3D Visual Enterprise Author · SAP SE SAP 3D Visu…
- CVE-2022-41214Due to insufficient input validation, SAP NetWeaver Application Server ABAP and ABAP Platform allows an attacker with high level privileges SAP SE SAP NetWeaver Application Server ABAP and ABAP Platf…
- CVE-2022-41660A vulnerability has been identified in JT2Go (All versions < V14.1.0.4), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), TeamceSiemens JT2Go · Siemens Teamcenter Visualization
- CVE-2022-41661A vulnerability has been identified in JT2Go (All versions < V14.1.0.4), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), TeamceSiemens JT2Go · Siemens Teamcenter Visualization
- CVE-2022-41662A vulnerability has been identified in JT2Go (All versions < V14.1.0.4), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), TeamceSiemens JT2Go · Siemens Teamcenter Visualization
- CVE-2022-41663A vulnerability has been identified in JT2Go (All versions < V14.1.0.4), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), TeamceSiemens JT2Go · Siemens Teamcenter Visualization
- CVE-2022-41664A vulnerability has been identified in JT2Go (All versions < V14.1.0.4), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), TeamceSiemens JT2Go · Siemens Teamcenter Visualization
- CVE-2022-41757An issue was discovered in the Arm Mali GPU Kernel Driver.
- CVE-2022-43343N-Prolog v1.91 was discovered to contain a global buffer overflow vulnerability in the function gettoken() at Main.c.
- CVE-2022-43397A vulnerability has been identified in Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35Siemens Parasolid · Siemens Simcenter Femap
- CVE-2022-43398A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER MSiemens POWER METER SICAM Q100
- CVE-2022-43958A vulnerability has been identified in QMS Automotive (All versions < V12.39), QMS Automotive (All versions < V12.39).Siemens QMS Automotive
- CVE-2022-44311html2xhtml v1.3 was discovered to contain an Out-Of-Bounds read in the function static void elm_close(tree_node_t *nodo) at procesador.c.
- CVE-2022-44556Missing parameter type validation in the DRM module.EMUI · HarmonyOS
Medium, low and unrated 74
- CVE-2022-27516User login brute force protection functionality bypass Citrix Gateway, Citrix ADC
- CVE-2022-27914[20221101] - Core - RXSS through reflection of user input in com_mediaJoomla! Project Joomla! CMS
- CVE-2022-32587WordPress WP Page Widget plugin <= 3.9 - Cross-Site Request Forgery (CSRF) vulnerabilityCodeAndMore WP Page Widget
- CVE-2022-44741WordPress Testimonial Slider plugin <= 1.3.1 - Cross-Site Request Forgery (CSRF) vulnerabilityDavid Anderson Testimonial Slider
- CVE-2022-32776WordPress Advanced Ads – Ad Manager & AdSense plugin <= 1.31.1 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityAdvanced Ads – Ad Manager & AdSense
- CVE-2022-41980WordPress Mantenimiento web plugin <= 0.13 - Auth. Cross-Site Scripting (XSS) vulnerabilityCarlos Doral Mantenimiento web
- CVE-2022-42494WordPress All in One SEO Pro plugin <= 4.2.5.1 - Server Side Request Forgery (SSRF) vulnerabilitySemper Plugins All in One SEO Pro
- CVE-2022-38137WordPress Analytify plugin <= 4.2.2 - Cross-Site Request Forgery (CSRF) vulnerabilityAnalytify
- CVE-2022-40206WordPress wpForo Forum plugin <= 2.0.5 - Insecure direct object references (IDOR) vulnerabilitygVectors Team wpForo Forum
- CVE-2022-27855WordPress Analytics Cat plugin <= 1.0.9 - Plugin Settings change via Cross-Site Request Forgery (CSRF) vulnerabilityFatcat Apps Analytics Cat
- CVE-2022-41136WordPress Shortcodes Ultimate plugin <= 5.12.0 - CSRF vulnerability leading to Stored XSSVladimir Anokhin Shortcodes Ultimate
- CVE-2022-40205WordPress wpForo Forum plugin <= 2.0.5 - Insecure direct object references (IDOR) vulnerabilitygVectors Team wpForo Forum
- CVE-2022-40632WordPress wpForo Forum plugin <= 2.0.5 - Cross-Site Request Forgery (CSRF) vulnerabilitygVectors Team wpForo Forum
- CVE-2022-40223WordPress SearchWP premium plugin <= 4.2.5 - Broken Authentication vulnerabilitySearchWP
- CVE-2022-30545WordPress 5 Anker Connect plugin <= 1.2.6 - Reflected Cross-Site Scripting (XSS) vulnerability5 Anker Connect
- CVE-2022-40128WordPress Advanced Order Export For WooCommerce plugin <= 3.3.2 - Cross-Site Request Forgery (CSRF) vulnerabilityAlgolPlus Advanced Order Export For WooCommerce
- CVE-2022-43481WordPress Advanced Coupons for WooCommerce Coupons plugin <= 4.5 - Cross-Site Request Forgery (CSRF) vulnerabilityRymera Web Advanced Coupons
- CVE-2022-43491WordPress Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 - Cross-Site Request Forgery (CSRF) vulnerabilityAlgolPlus Advanced Dynamic Pricing for WooCommerce
- CVE-2020-35473An information leakage vulnerability in the Bluetooth Low Energy advertisement scan response in Bluetooth Core Specifications 4.0 through 5.
- CVE-2021-40303perfex crm 1.10 is vulnerable to Cross Site Scripting (XSS) via /clients/profile.
- CVE-2022-20414In setImpl of AlarmManagerService.java, there is a possible way to put a device into a boot loop due to an uncaught exception.Android
- CVE-2022-20426In multiple functions of many files, there is a possible obstruction of the user's ability to select a phone account due to resource exhaustAndroid
- CVE-2022-20446In AlwaysOnHotwordDetector of AlwaysOnHotwordDetector.java, there is a possible way to access the microphone from the background due to a miAndroid
- CVE-2022-20447In PAN_WriteBuf of pan_api.cc, there is a possible out of bounds read due to a use after free.Android
- CVE-2022-20448In buzzBeepBlinkLocked of NotificationManagerService.java, there is a possible way to share data across users due to a permissions bypass.Android
- CVE-2022-20453In update of MmsProvider.java, there is a possible constriction of directory permissions due to a path traversal error.Android
- CVE-2022-20454In fdt_next_tag of fdt.c, there is a possible out of bounds write due to an integer overflow.Android
- CVE-2022-20457In getMountModeInternal of StorageManagerService.java, there is a possible prevention of package installation due to improper input validatiAndroid
- CVE-2022-20465In dismiss and related functions of KeyguardHostViewController.java and related files, there is a possible lockscreen bypass due to a logic Android
- CVE-2022-21778In vpu, there is a possible information disclosure due to an incorrect bounds check.MediaTek MT6771, MT6779, MT6785, MT6853, MT6853T, MT6873, M…
- CVE-2022-30515ZKTeco BioTime 8.5.4 is missing authentication on folders containing employee photos, allowing an attacker to view them through filename enu
- CVE-2022-30694The login endpoint /FormLogin in affected web services does not apply proper origin checking.Siemens SIMATIC Drive Controller CPU 1504D TF · Siemens… +85
- CVE-2022-32602In keyinstall, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6833, MT6883, MT6983, MT8183, MT8185, MT8321, MT…
- CVE-2022-32603In gpu drm, there is a possible out of bounds write due to improper input validation.MediaTek MT6879, MT6893, MT6895, MT6985, MT8795T, MT8798
- CVE-2022-32605In isp, there is a possible out of bounds write due to an incorrect bounds check.MediaTek MT6879, MT6895, MT6983
- CVE-2022-32607In aee, there is a possible use after free due to a missing bounds check.MediaTek MT6580, MT6739, MT6761, MT6762, MT6765, MT6768, MT…
- CVE-2022-32608In jpeg, there is a possible use after free due to a race condition.MediaTek MT6893, MT6895
- CVE-2022-32609In vcu, there is a possible use after free due to a race condition.MediaTek MT6762, MT6768, MT6779, MT6781, MT6785, MT6789, MT…
- CVE-2022-32610In vcu, there is a possible use after free due to a race condition.MediaTek MT6762, MT6768, MT6769, MT6779, MT6781, MT6785, MT…
- CVE-2022-32611In isp, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6879, MT6895, MT6983
- CVE-2022-32612In vcu, there is a possible use after free due to a race condition.MediaTek MT6762, MT6768, MT6769, MT6779, MT6781, MT6785, MT…
- CVE-2022-32613In vcu, there is a possible memory corruption due to a race condition.MediaTek MT6762, MT6768, MT6769, MT6779, MT6781, MT6785, MT…
- CVE-2022-32614In audio, there is a possible memory corruption due to a logic error.MediaTek MT6789, MT6855, MT6879, MT6893, MT6983, MT8168, MT…
- CVE-2022-32615In ccd, there is a possible out of bounds write due to uninitialized data.MediaTek MT6983, MT8871, MT8891
- CVE-2022-32616In isp, there is a possible out of bounds write due to uninitialized data.MediaTek MT6983, MT8871, MT8891
- CVE-2022-32617In typec, there is a possible out of bounds write due to an incorrect calculation of buffer size.MediaTek MT6789, MT6855, MT6895, MT6983, MT8798
- CVE-2022-32618In typec, there is a possible out of bounds write due to an incorrect calculation of buffer size.MediaTek MT6833, MT6873, MT6893, MT8798
- CVE-2022-33322Cross-site scripting vulnerability in Mitsubishi Electric consumer electronics products (Air Conditioning, Wi-Fi Interface, Refrigerator, HEMitsubishi Electric Air Conditioning MSZ-FD40/56/63/71… +155
- CVE-2022-3821An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c.systemd
- CVE-2022-39069There is a SQL injection vulnerability in ZTE ZAIP-AIE.ZAIP-AIE
- CVE-2022-39343Azure RTOS FileX vulnerable to Buffer Offerflowazure-rtos filex
- CVE-2022-39352OpenFGA Authorization Bypassopenfga · github.com/openfga/openfga
- CVE-2022-41205SAP GUI allows an authenticated attacker to execute scripts in the local network.SAP SE SAP GUI for Windows
- CVE-2022-41207SAP Biller Direct allows an unauthenticated attacker to craft a legitimate looking URL.SAP SE SAP Biller Direct
- CVE-2022-41208Due to insufficient input validation, SAP Financial Consolidation - version 1010, allows an authenticated attacker with user privileges to aSAP SE SAP Financial Consolidation
- CVE-2022-41212Due to insufficient input validation, SAP NetWeaver Application Server ABAP and ABAP Platform allows an attacker with high level privileges SAP SE SAP NetWeaver Application Server ABAP and ABAP Platf…
- CVE-2022-41215SAP NetWeaver ABAP Server and ABAP Platform allows an unauthenticated attacker to redirect users to a malicious site due to insufficient URLSAP SE SAP NetWeaver ABAP Server and ABAP Platform
- CVE-2022-41258Due to insufficient input validation, SAP Financial Consolidation - version 1010, allows an authenticated attacker to inject malicious scripSAP SE SAP Financial Consolidation
- CVE-2022-41259SAP SQL Anywhere - version 17.0, allows an authenticated attacker to prevent legitimate users from accessing a SQL Anywhere database server SAP SE SAP SQL Anywhere
- CVE-2022-41260SAP Financial Consolidation - version 1010, does not sufficiently encode user-controlled input which may allow an unauthenticated attacker tSAP SE SAP Financial Consolidation
- CVE-2022-41432EyesOfNetwork Web Interface v5.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /module/re
- CVE-2022-41433EyesOfNetwork Web Interface v5.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /module/ad
- CVE-2022-41434EyesOfNetwork Web Interface v5.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /lilac/mai
- CVE-2022-43144A cross-site scripting (XSS) vulnerability in Canteen Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a
- CVE-2022-44312PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionCoerceInteger function in expression.c when called fro
- CVE-2022-44313PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionCoerceUnsignedInteger function in expression.c when ca
- CVE-2022-44314PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StringStrncpy function in cstdlib/string.c when called from Expr
- CVE-2022-44315PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionAssign function in expression.c when called from Expre
- CVE-2022-44316PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the LexGetStringConstant function in lex.c when called from LexScanG
- CVE-2022-44317PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StdioOutPutc function in cstdlib/stdio.c when called from Expres
- CVE-2022-44318PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StringStrcat function in cstdlib/string.c when called from Expre
- CVE-2022-44319PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StdioBasePrintf function in cstdlib/string.c when called from Ex
- CVE-2022-44320PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionCoerceFP function in expression.c when called from Exp
- CVE-2022-44321PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the LexSkipComment function in lex.c when called from LexScanGetToke