# CVEs published 2022-11-08

119 CVEs were published on November 8, 2022: 14 critical, 31 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2022-27516](https://cve.now/CVE-2022-27516.md): User login brute force protection functionality bypass (CVSS 5.3, Citrix Gateway, Citrix ADC)
- [CVE-2022-27510](https://cve.now/CVE-2022-27510.md): Unauthorized access to Gateway user capabilities (CVSS 9.8, Citrix Gateway, Citrix ADC)
- [CVE-2022-27513](https://cve.now/CVE-2022-27513.md): Remote desktop takeover via phishing (CVSS 8.3, Citrix Gateway, Citrix ADC)
- [CVE-2022-27914](https://cve.now/CVE-2022-27914.md): \[20221101\] - Core - RXSS through reflection of user input in com\_media (no CVSS, Joomla! Project Joomla! CMS)
- [CVE-2022-32587](https://cve.now/CVE-2022-32587.md): WordPress WP Page Widget plugin \<= 3.9 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 5.4, CodeAndMore WP Page Widget)
- [CVE-2022-44741](https://cve.now/CVE-2022-44741.md): WordPress Testimonial Slider plugin \<= 1.3.1 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 6.1, David Anderson Testimonial Slider)
- [CVE-2022-32776](https://cve.now/CVE-2022-32776.md): WordPress Advanced Ads – Ad Manager & AdSense plugin \<= 1.31.1 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, Advanced Ads – Ad Manager & AdSense)
- [CVE-2022-41980](https://cve.now/CVE-2022-41980.md): WordPress Mantenimiento web plugin \<= 0.13 - Auth. Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, Carlos Doral Mantenimiento web)
- [CVE-2022-42494](https://cve.now/CVE-2022-42494.md): WordPress All in One SEO Pro plugin \<= 4.2.5.1 - Server Side Request Forgery (SSRF) vulnerability (CVSS 3.0, Semper Plugins All in One SEO Pro)
- [CVE-2022-38137](https://cve.now/CVE-2022-38137.md): WordPress Analytify plugin \<= 4.2.2 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Analytify)
- [CVE-2022-40206](https://cve.now/CVE-2022-40206.md): WordPress wpForo Forum plugin \<= 2.0.5 - Insecure direct object references (IDOR) vulnerability (CVSS 6.3, gVectors Team wpForo Forum)
- [CVE-2022-27855](https://cve.now/CVE-2022-27855.md): WordPress Analytics Cat plugin \<= 1.0.9 - Plugin Settings change via Cross-Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Fatcat Apps Analytics Cat)
- [CVE-2022-27858](https://cve.now/CVE-2022-27858.md): WordPress Activity Log plugin \<= 2.8.3 - CSV Injection vulnerability (CVSS 7.4, Activity Log Team Activity Log)
- [CVE-2022-41136](https://cve.now/CVE-2022-41136.md): WordPress Shortcodes Ultimate plugin \<= 5.12.0 - CSRF vulnerability leading to Stored XSS (CVSS 6.1, Vladimir Anokhin Shortcodes Ultimate)
- [CVE-2022-40205](https://cve.now/CVE-2022-40205.md): WordPress wpForo Forum plugin \<= 2.0.5 - Insecure direct object references (IDOR) vulnerability (CVSS 5.4, gVectors Team wpForo Forum)
- [CVE-2022-40632](https://cve.now/CVE-2022-40632.md): WordPress wpForo Forum plugin \<= 2.0.5 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 5.4, gVectors Team wpForo Forum)
- [CVE-2022-40223](https://cve.now/CVE-2022-40223.md): WordPress SearchWP premium plugin \<= 4.2.5 - Broken Authentication vulnerability (CVSS 5.4, SearchWP)
- [CVE-2022-30545](https://cve.now/CVE-2022-30545.md): WordPress 5 Anker Connect plugin \<= 1.2.6 - Reflected Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, 5 Anker Connect)
- [CVE-2022-40128](https://cve.now/CVE-2022-40128.md): WordPress Advanced Order Export For WooCommerce plugin \<= 3.3.2 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 4.3, AlgolPlus Advanced Order Export For WooCommerce)
- [CVE-2022-43481](https://cve.now/CVE-2022-43481.md): WordPress Advanced Coupons for WooCommerce Coupons plugin \<= 4.5 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Rymera Web Advanced Coupons)
- [CVE-2022-43491](https://cve.now/CVE-2022-43491.md): WordPress Advanced Dynamic Pricing for WooCommerce plugin \<= 4.1.5 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 5.4, AlgolPlus Advanced Dynamic Pricing for WooCommerce)
- [CVE-2020-35473](https://cve.now/CVE-2020-35473.md): An information leakage vulnerability in the Bluetooth Low Energy advertisement scan response in Bluetooth Core Specifications 4.0 through 5. (CVSS 4.3)
- [CVE-2021-1050](https://cve.now/CVE-2021-1050.md): In MMU\_UnmapPages of the PowerVR kernel driver, there is a possible out of bounds write due to a missing bounds check. (CVSS 7.8, Android)
- [CVE-2021-39661](https://cve.now/CVE-2021-39661.md): In \_PMRLogicalOffsetToPhysicalOffset of the PowerVR kernel driver, there is a possible out of bounds write due to a missing bounds check. (CVSS 7.8, Android)
- [CVE-2021-40303](https://cve.now/CVE-2021-40303.md): perfex crm 1.10 is vulnerable to Cross Site Scripting (XSS) via /clients/profile. (CVSS 5.4)
- [CVE-2022-20414](https://cve.now/CVE-2022-20414.md): In setImpl of AlarmManagerService.java, there is a possible way to put a device into a boot loop due to an uncaught exception. (CVSS 5.5, Android)
- [CVE-2022-20426](https://cve.now/CVE-2022-20426.md): In multiple functions of many files, there is a possible obstruction of the user's ability to select a phone account due to resource exhaust (CVSS 5.5, Android)
- [CVE-2022-20441](https://cve.now/CVE-2022-20441.md): In navigateUpTo of Task.java, there is a possible way to launch an unexported intent handler due to a logic error in the code. (CVSS 7.8, Android)
- [CVE-2022-20445](https://cve.now/CVE-2022-20445.md): In process\_service\_search\_rsp of sdp\_discovery.cc, there is a possible out of bounds read due to improper input validation. (CVSS 7.5, Android)
- [CVE-2022-20446](https://cve.now/CVE-2022-20446.md): In AlwaysOnHotwordDetector of AlwaysOnHotwordDetector.java, there is a possible way to access the microphone from the background due to a mi (CVSS 3.3, Android)
- [CVE-2022-20447](https://cve.now/CVE-2022-20447.md): In PAN\_WriteBuf of pan\_api.cc, there is a possible out of bounds read due to a use after free. (CVSS 6.5, Android)
- [CVE-2022-20448](https://cve.now/CVE-2022-20448.md): In buzzBeepBlinkLocked of NotificationManagerService.java, there is a possible way to share data across users due to a permissions bypass. (CVSS 5.5, Android)
- [CVE-2022-20450](https://cve.now/CVE-2022-20450.md): In restorePermissionState of PermissionManagerServiceImpl.java, there is a possible way to bypass user consent due to a missing permission c (CVSS 7.8, Android)
- [CVE-2022-20451](https://cve.now/CVE-2022-20451.md): In onCallRedirectionComplete of CallsManager.java, there is a possible permissions bypass due to a missing permission check. (CVSS 7.8, Android)
- [CVE-2022-20452](https://cve.now/CVE-2022-20452.md): In initializeFromParcelLocked of BaseBundle.java, there is a possible method arbitrary code execution due to a confused deputy. (CVSS 7.8, Android)
- [CVE-2022-20453](https://cve.now/CVE-2022-20453.md): In update of MmsProvider.java, there is a possible constriction of directory permissions due to a path traversal error. (CVSS 5.5, Android)
- [CVE-2022-20454](https://cve.now/CVE-2022-20454.md): In fdt\_next\_tag of fdt.c, there is a possible out of bounds write due to an integer overflow. (CVSS 6.7, Android)
- [CVE-2022-20457](https://cve.now/CVE-2022-20457.md): In getMountModeInternal of StorageManagerService.java, there is a possible prevention of package installation due to improper input validati (CVSS 5.5, Android)
- [CVE-2022-20462](https://cve.now/CVE-2022-20462.md): In phNxpNciHal\_write\_unlocked of phNxpNciHal.cc, there is a possible out of bounds write due to a missing bounds check. (CVSS 7.8, Android)
- [CVE-2022-20465](https://cve.now/CVE-2022-20465.md): In dismiss and related functions of KeyguardHostViewController.java and related files, there is a possible lockscreen bypass due to a logic (CVSS 4.6, Android)
- [CVE-2022-21778](https://cve.now/CVE-2022-21778.md): In vpu, there is a possible information disclosure due to an incorrect bounds check. (CVSS 6.7, MediaTek MT6771, MT6779, MT6785, MT6853, MT6853T, MT6873, M…)
- [CVE-2022-26446](https://cve.now/CVE-2022-26446.md): In Modem 4G RRC, there is a possible system crash due to improper input validation. (CVSS 7.5, MediaTek MT2731, MT2735, MT6297, MT6725, MT6739, MT6761, MT…)
- [CVE-2022-30515](https://cve.now/CVE-2022-30515.md): ZKTeco BioTime 8.5.4 is missing authentication on folders containing employee photos, allowing an attacker to view them through filename enu (CVSS 5.3)
- [CVE-2022-30694](https://cve.now/CVE-2022-30694.md): The login endpoint /FormLogin in affected web services does not apply proper origin checking. (CVSS 6.5, Siemens SIMATIC Drive Controller CPU 1504D TF · Siemens… +85)
- [CVE-2022-31199](https://cve.now/CVE-2022-31199.md): Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting both the Netwrix Audito (CVSS 9.8, KEV)
- [CVE-2022-32601](https://cve.now/CVE-2022-32601.md): In telephony, there is a possible permission bypass due to a parcel format mismatch. (CVSS 7.8, MediaTek MT6739, MT6761, MT6762, MT6763, MT6765, MT6768, MT…)
- [CVE-2022-32602](https://cve.now/CVE-2022-32602.md): In keyinstall, there is a possible out of bounds read due to a missing bounds check. (CVSS 5.5, MediaTek MT6833, MT6883, MT6983, MT8183, MT8185, MT8321, MT…)
- [CVE-2022-32603](https://cve.now/CVE-2022-32603.md): In gpu drm, there is a possible out of bounds write due to improper input validation. (CVSS 6.7, MediaTek MT6879, MT6893, MT6895, MT6985, MT8795T, MT8798)
- [CVE-2022-32605](https://cve.now/CVE-2022-32605.md): In isp, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 6.7, MediaTek MT6879, MT6895, MT6983)
- [CVE-2022-32607](https://cve.now/CVE-2022-32607.md): In aee, there is a possible use after free due to a missing bounds check. (CVSS 6.7, MediaTek MT6580, MT6739, MT6761, MT6762, MT6765, MT6768, MT…)
- [CVE-2022-32608](https://cve.now/CVE-2022-32608.md): In jpeg, there is a possible use after free due to a race condition. (CVSS 6.4, MediaTek MT6893, MT6895)
- [CVE-2022-32609](https://cve.now/CVE-2022-32609.md): In vcu, there is a possible use after free due to a race condition. (CVSS 6.4, MediaTek MT6762, MT6768, MT6779, MT6781, MT6785, MT6789, MT…)
- [CVE-2022-32610](https://cve.now/CVE-2022-32610.md): In vcu, there is a possible use after free due to a race condition. (CVSS 6.4, MediaTek MT6762, MT6768, MT6769, MT6779, MT6781, MT6785, MT…)
- [CVE-2022-32611](https://cve.now/CVE-2022-32611.md): In isp, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6879, MT6895, MT6983)
- [CVE-2022-32612](https://cve.now/CVE-2022-32612.md): In vcu, there is a possible use after free due to a race condition. (CVSS 6.4, MediaTek MT6762, MT6768, MT6769, MT6779, MT6781, MT6785, MT…)
- [CVE-2022-32613](https://cve.now/CVE-2022-32613.md): In vcu, there is a possible memory corruption due to a race condition. (CVSS 6.4, MediaTek MT6762, MT6768, MT6769, MT6779, MT6781, MT6785, MT…)
- [CVE-2022-32614](https://cve.now/CVE-2022-32614.md): In audio, there is a possible memory corruption due to a logic error. (CVSS 6.7, MediaTek MT6789, MT6855, MT6879, MT6893, MT6983, MT8168, MT…)
- [CVE-2022-32615](https://cve.now/CVE-2022-32615.md): In ccd, there is a possible out of bounds write due to uninitialized data. (CVSS 6.7, MediaTek MT6983, MT8871, MT8891)
- [CVE-2022-32616](https://cve.now/CVE-2022-32616.md): In isp, there is a possible out of bounds write due to uninitialized data. (CVSS 6.7, MediaTek MT6983, MT8871, MT8891)
- [CVE-2022-32617](https://cve.now/CVE-2022-32617.md): In typec, there is a possible out of bounds write due to an incorrect calculation of buffer size. (CVSS 6.8, MediaTek MT6789, MT6855, MT6895, MT6983, MT8798)
- [CVE-2022-32618](https://cve.now/CVE-2022-32618.md): In typec, there is a possible out of bounds write due to an incorrect calculation of buffer size. (CVSS 6.8, MediaTek MT6833, MT6873, MT6893, MT8798)
- [CVE-2022-33321](https://cve.now/CVE-2022-33321.md): Cleartext Transmission of Sensitive Information vulnerability due to the use of Basic Authentication for HTTP connections in Mitsubishi Elec (CVSS 9.8, Mitsubishi Electric PHOTOVOLTAIC COLOR MONITOR ECO-GUI… +275)
- [CVE-2022-33322](https://cve.now/CVE-2022-33322.md): Cross-site scripting vulnerability in Mitsubishi Electric consumer electronics products (Air Conditioning, Wi-Fi Interface, Refrigerator, HE (CVSS 6.1, Mitsubishi Electric Air Conditioning MSZ-FD40/56/63/71… +155)
- [CVE-2022-34822](https://cve.now/CVE-2022-34822.md): Path traversal vulnerability in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 Sin (CVSS 9.8, NEC CLUSTERPRO X)
- [CVE-2022-34823](https://cve.now/CVE-2022-34823.md): Buffer overflow vulnerability in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 Si (CVSS 9.8, NEC CLUSTERPRO X)
- [CVE-2022-34824](https://cve.now/CVE-2022-34824.md): Weak File and Folder Permissions vulnerability in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CL (CVSS 9.8, NEC CLUSTERPRO X)
- [CVE-2022-34825](https://cve.now/CVE-2022-34825.md): Uncontrolled Search Path Element in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 (CVSS 9.8, NEC CLUSTERPRO X)
- [CVE-2022-36077](https://cve.now/CVE-2022-36077.md): Electron subject to Exfiltration of hashed SMB credentials on Windows via file:// redirect (CVSS 7.2, electron)
- [CVE-2022-37015](https://cve.now/CVE-2022-37015.md): Symantec Endpoint Detection and Response (SEDR) Appliance, prior to 4.7.0, may be susceptible to a privilege escalation vulnerability, which (CVSS 9.8, Symantec Endpoint Detection and Response)
- [CVE-2022-3821](https://cve.now/CVE-2022-3821.md): An off-by-one Error issue was discovered in Systemd in format\_timespan() function of time-util.c. (CVSS 5.5, systemd)
- [CVE-2022-39069](https://cve.now/CVE-2022-39069.md): There is a SQL injection vulnerability in ZTE ZAIP-AIE. (CVSS 5.3, ZAIP-AIE)
- [CVE-2022-39136](https://cve.now/CVE-2022-39136.md): A vulnerability has been identified in JT2Go (All versions \< V14.1.0.4), Teamcenter Visualization V13.2 (All versions \< V13.2.0.12), Teamce (CVSS 7.8, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2022-39157](https://cve.now/CVE-2022-39157.md): A vulnerability has been identified in Parasolid V34.0 (All versions \< V34.0.252), Parasolid V34.0 (All versions \>= V34.0.252 \< V34.0.254), (CVSS 7.8, Siemens Parasolid · Siemens Simcenter Femap)
- [CVE-2022-39328](https://cve.now/CVE-2022-39328.md): Grafana vulnerable to race condition allowing privilege escalation (CVSS 9.8, grafana · github.com/grafana/grafana)
- [CVE-2022-39343](https://cve.now/CVE-2022-39343.md): Azure RTOS FileX vulnerable to Buffer Offerflow (CVSS 5.6, azure-rtos filex)
- [CVE-2022-39352](https://cve.now/CVE-2022-39352.md): OpenFGA Authorization Bypass (CVSS 4.8, openfga · github.com/openfga/openfga)
- [CVE-2022-39377](https://cve.now/CVE-2022-39377.md): sysstat Incorrect Buffer Size calculation on 32-bit systems results in RCE via buffer overflow (CVSS 7.0, sysstat)
- [CVE-2022-39386](https://cve.now/CVE-2022-39386.md): fastify-websocket vulnerable to uncaught exception via crash on malformed packet (CVSS 7.5, fastify-websocket · @fastify/websocket)
- [CVE-2022-41203](https://cve.now/CVE-2022-41203.md): In some workflow of SAP BusinessObjects BI Platform (Central Management Console and BI LaunchPad), an authenticated attacker with low privil (CVSS 9.9, SAP SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2022-41205](https://cve.now/CVE-2022-41205.md): SAP GUI allows an authenticated attacker to execute scripts in the local network. (CVSS 5.5, SAP SE SAP GUI for Windows)
- [CVE-2022-41207](https://cve.now/CVE-2022-41207.md): SAP Biller Direct allows an unauthenticated attacker to craft a legitimate looking URL. (CVSS 6.1, SAP SE SAP Biller Direct)
- [CVE-2022-41208](https://cve.now/CVE-2022-41208.md): Due to insufficient input validation, SAP Financial Consolidation - version 1010, allows an authenticated attacker with user privileges to a (CVSS 5.4, SAP SE SAP Financial Consolidation)
- [CVE-2022-41211](https://cve.now/CVE-2022-41211.md): Due to lack of proper memory management, when a victim opens manipulated file received from untrusted sources in SAP 3D Visual Enterprise Au (CVSS 7.0, SAP SE SAP 3D Visual Enterprise Author · SAP SE SAP 3D Visu…)
- [CVE-2022-41212](https://cve.now/CVE-2022-41212.md): Due to insufficient input validation, SAP NetWeaver Application Server ABAP and ABAP Platform allows an attacker with high level privileges (CVSS 4.9, SAP SE SAP NetWeaver Application Server ABAP and ABAP Platf…)
- [CVE-2022-41214](https://cve.now/CVE-2022-41214.md): Due to insufficient input validation, SAP NetWeaver Application Server ABAP and ABAP Platform allows an attacker with high level privileges (CVSS 8.7, SAP SE SAP NetWeaver Application Server ABAP and ABAP Platf…)
- [CVE-2022-41215](https://cve.now/CVE-2022-41215.md): SAP NetWeaver ABAP Server and ABAP Platform allows an unauthenticated attacker to redirect users to a malicious site due to insufficient URL (CVSS 4.7, SAP SE SAP NetWeaver ABAP Server and ABAP Platform)
- [CVE-2022-41258](https://cve.now/CVE-2022-41258.md): Due to insufficient input validation, SAP Financial Consolidation - version 1010, allows an authenticated attacker to inject malicious scrip (CVSS 6.5, SAP SE SAP Financial Consolidation)
- [CVE-2022-41259](https://cve.now/CVE-2022-41259.md): SAP SQL Anywhere - version 17.0, allows an authenticated attacker to prevent legitimate users from accessing a SQL Anywhere database server (CVSS 6.5, SAP SE SAP SQL Anywhere)
- [CVE-2022-41260](https://cve.now/CVE-2022-41260.md): SAP Financial Consolidation - version 1010, does not sufficiently encode user-controlled input which may allow an unauthenticated attacker t (CVSS 6.1, SAP SE SAP Financial Consolidation)
- [CVE-2022-41432](https://cve.now/CVE-2022-41432.md): EyesOfNetwork Web Interface v5.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /module/re (CVSS 4.8)
- [CVE-2022-41433](https://cve.now/CVE-2022-41433.md): EyesOfNetwork Web Interface v5.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /module/ad (CVSS 4.8)
- [CVE-2022-41434](https://cve.now/CVE-2022-41434.md): EyesOfNetwork Web Interface v5.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /lilac/mai (CVSS 6.1)
- [CVE-2022-41660](https://cve.now/CVE-2022-41660.md): A vulnerability has been identified in JT2Go (All versions \< V14.1.0.4), Teamcenter Visualization V13.2 (All versions \< V13.2.0.12), Teamce (CVSS 7.8, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2022-41661](https://cve.now/CVE-2022-41661.md): A vulnerability has been identified in JT2Go (All versions \< V14.1.0.4), Teamcenter Visualization V13.2 (All versions \< V13.2.0.12), Teamce (CVSS 7.8, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2022-41662](https://cve.now/CVE-2022-41662.md): A vulnerability has been identified in JT2Go (All versions \< V14.1.0.4), Teamcenter Visualization V13.2 (All versions \< V13.2.0.12), Teamce (CVSS 7.8, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2022-41663](https://cve.now/CVE-2022-41663.md): A vulnerability has been identified in JT2Go (All versions \< V14.1.0.4), Teamcenter Visualization V13.2 (All versions \< V13.2.0.12), Teamce (CVSS 7.8, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2022-41664](https://cve.now/CVE-2022-41664.md): A vulnerability has been identified in JT2Go (All versions \< V14.1.0.4), Teamcenter Visualization V13.2 (All versions \< V13.2.0.12), Teamce (CVSS 7.8, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2022-41757](https://cve.now/CVE-2022-41757.md): An issue was discovered in the Arm Mali GPU Kernel Driver. (CVSS 8.8)
- [CVE-2022-43144](https://cve.now/CVE-2022-43144.md): A cross-site scripting (XSS) vulnerability in Canteen Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a (CVSS 5.4)
- [CVE-2022-43343](https://cve.now/CVE-2022-43343.md): N-Prolog v1.91 was discovered to contain a global buffer overflow vulnerability in the function gettoken() at Main.c. (CVSS 7.5)
- [CVE-2022-43397](https://cve.now/CVE-2022-43397.md): A vulnerability has been identified in Parasolid V34.0 (All versions \< V34.0.252), Parasolid V34.1 (All versions \< V34.1.242), Parasolid V35 (CVSS 7.8, Siemens Parasolid · Siemens Simcenter Femap)
- [CVE-2022-43398](https://cve.now/CVE-2022-43398.md): A vulnerability has been identified in POWER METER SICAM Q100 (All versions \< V2.50), POWER METER SICAM Q100 (All versions \< V2.50), POWER M (CVSS 7.5, Siemens POWER METER SICAM Q100)
- [CVE-2022-43439](https://cve.now/CVE-2022-43439.md): A vulnerability has been identified in POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) (All versions \< V2.50), POWER METER SICAM Q100 (7KG9501-0 (CVSS 9.9, Siemens POWER METER SICAM Q100 · Siemens SICAM P850 +2)
- [CVE-2022-43545](https://cve.now/CVE-2022-43545.md): A vulnerability has been identified in POWER METER SICAM Q100 (All versions \< V2.50), POWER METER SICAM Q100 (All versions \< V2.50), POWER M (CVSS 9.9, Siemens POWER METER SICAM Q100 · Siemens SICAM P850 +1)
- [CVE-2022-43546](https://cve.now/CVE-2022-43546.md): A vulnerability has been identified in POWER METER SICAM Q100 (All versions \< V2.50), POWER METER SICAM Q100 (All versions \< V2.50), POWER M (CVSS 9.9, Siemens POWER METER SICAM Q100 · Siemens SICAM P850 +1)
- [CVE-2022-43958](https://cve.now/CVE-2022-43958.md): A vulnerability has been identified in QMS Automotive (All versions \< V12.39), QMS Automotive (All versions \< V12.39). (CVSS 7.6, Siemens QMS Automotive)
- [CVE-2022-44311](https://cve.now/CVE-2022-44311.md): html2xhtml v1.3 was discovered to contain an Out-Of-Bounds read in the function static void elm\_close(tree\_node\_t \*nodo) at procesador.c. (CVSS 8.1)
- [CVE-2022-44312](https://cve.now/CVE-2022-44312.md): PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionCoerceInteger function in expression.c when called fro (CVSS 5.5)
- [CVE-2022-44313](https://cve.now/CVE-2022-44313.md): PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionCoerceUnsignedInteger function in expression.c when ca (CVSS 5.5)
- [CVE-2022-44314](https://cve.now/CVE-2022-44314.md): PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StringStrncpy function in cstdlib/string.c when called from Expr (CVSS 5.5)
- [CVE-2022-44315](https://cve.now/CVE-2022-44315.md): PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionAssign function in expression.c when called from Expre (CVSS 5.5)
- [CVE-2022-44316](https://cve.now/CVE-2022-44316.md): PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the LexGetStringConstant function in lex.c when called from LexScanG (CVSS 5.5)
- [CVE-2022-44317](https://cve.now/CVE-2022-44317.md): PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StdioOutPutc function in cstdlib/stdio.c when called from Expres (CVSS 5.5)
- [CVE-2022-44318](https://cve.now/CVE-2022-44318.md): PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StringStrcat function in cstdlib/string.c when called from Expre (CVSS 5.5)
- [CVE-2022-44319](https://cve.now/CVE-2022-44319.md): PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StdioBasePrintf function in cstdlib/string.c when called from Ex (CVSS 5.5)
- [CVE-2022-44320](https://cve.now/CVE-2022-44320.md): PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionCoerceFP function in expression.c when called from Exp (CVSS 5.5)
- [CVE-2022-44321](https://cve.now/CVE-2022-44321.md): PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the LexSkipComment function in lex.c when called from LexScanGetToke (CVSS 5.5)
- [CVE-2022-44457](https://cve.now/CVE-2022-44457.md): A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions \< V1.17.0), Mendix SAML (Mendix 7 compatible) (All ve (CVSS 9.8, Siemens Mendix SAML)
- [CVE-2022-44556](https://cve.now/CVE-2022-44556.md): Missing parameter type validation in the DRM module. (CVSS 7.5, EMUI · HarmonyOS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-11-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.