# CVEs published 2022-11-09

179 CVEs were published on November 9, 2022: 16 critical, 89 high. 6 are now in CISA KEV. Days are UTC.

- [CVE-2022-44590](https://cve.now/CVE-2022-44590.md): WordPress Simple Video Embedder plugin \<= 2.2 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (CVSS 5.4, James Lao Simple Video Embedder)
- [CVE-2022-23824](https://cve.now/CVE-2022-23824.md): IBPB may not prevent return branch predictions from being specified by pre-IBPB branch targets leading to a potential information disclosure (no CVSS, AMD Processors)
- [CVE-2022-27673](https://cve.now/CVE-2022-27673.md): Insufficient access controls in the AMD Link Android app may potentially result in information disclosure. (CVSS 7.5, AMD Link Android)
- [CVE-2022-23831](https://cve.now/CVE-2022-23831.md): Insufficient validation of the IOCTL input buffer in AMD μProf may allow an attacker to send an arbitrary buffer leading to a potential Wind (CVSS 7.5, AMD μProf)
- [CVE-2022-27674](https://cve.now/CVE-2022-27674.md): Insufficient validation in the IOCTL input/output buffer in AMD μProf may allow an attacker to bypass bounds checks potentially leading to a (CVSS 7.5, AMD μProf)
- [CVE-2021-26392](https://cve.now/CVE-2021-26392.md): Insufficient verification of missing size check in 'LoadModule' may lead to an out-of-bounds write potentially allowing an attacker with pri (no CVSS, AMD Radeon RX 5000 Series & PRO W5000 Series · AMD Radeo… +4)
- [CVE-2021-26360](https://cve.now/CVE-2021-26360.md): An attacker with local access to the system can make unauthorized modifications of the security configuration of the SOC registers. (CVSS 7.8, AMD Radeon RX 6000 Series & PRO W6000 Series)
- [CVE-2020-12930](https://cve.now/CVE-2020-12930.md): Improper parameters handling in AMD Secure Processor (ASP) drivers may allow a privileged attacker to elevate their privileges potentially l (no CVSS, AMD Radeon RX 5000 Series & PRO W5000 Series · AMD Ryzen… +2)
- [CVE-2021-26393](https://cve.now/CVE-2021-26393.md): Insufficient memory cleanup in the AMD Secure Processor (ASP) Trusted Execution Environment (TEE) may allow an authenticated attacker with p (no CVSS, AMD Radeon RX 5000 Series & PRO W5000 Series · AMD Radeo… +3)
- [CVE-2021-26391](https://cve.now/CVE-2021-26391.md): Insufficient verification of multiple header signatures while loading a Trusted Application (TA) may allow an attacker with privileges to ga (CVSS 7.8, AMD Radeon RX 5000 Series & PRO W5000 Series · AMD Radeon R…)
- [CVE-2020-12931](https://cve.now/CVE-2020-12931.md): Improper parameters handling in the AMD Secure Processor (ASP) kernel may allow a privileged attacker to elevate their privileges potentiall (no CVSS, AMD Radeon RX 5000 Series & PRO W5000 Series · AMD Ryzen… +2)
- [CVE-2022-32588](https://cve.now/CVE-2022-32588.md): An out-of-bounds write vulnerability exists in the PICT parsing pctwread\_14841 functionality of Accusoft ImageGear 20.0. (CVSS 9.8, Accusoft ImageGear)
- [CVE-2022-30543](https://cve.now/CVE-2022-30543.md): A leftover debug code vulnerability exists in the console infct functionality of InHand Networks InRouter302 V3.5.45. (CVSS 4.3, InHand Networks InRouter302)
- [CVE-2022-29888](https://cve.now/CVE-2022-29888.md): A leftover debug code vulnerability exists in the httpd port 4444 upload.cgi functionality of InHand Networks InRouter302 V3.5.45. (CVSS 6.5, InHand Networks InRouter302)
- [CVE-2022-29481](https://cve.now/CVE-2022-29481.md): A leftover debug code vulnerability exists in the console nvram functionality of InHand Networks InRouter302 V3.5.45. (CVSS 4.9, InHand Networks InRouter302)
- [CVE-2022-28689](https://cve.now/CVE-2022-28689.md): A leftover debug code vulnerability exists in the console support functionality of InHand Networks InRouter302 V3.5.45. (CVSS 6.5, InHand Networks InRouter302)
- [CVE-2022-26023](https://cve.now/CVE-2022-26023.md): A leftover debug code vulnerability exists in the console verify functionality of InHand Networks InRouter302 V3.5.45. (CVSS 6.5, InHand Networks InRouter302)
- [CVE-2022-25932](https://cve.now/CVE-2022-25932.md): The firmware of InHand Networks InRouter302 V3.5.45 introduces fixes for TALOS-2022-1472 and TALOS-2022-1474. (CVSS 7.4, InHand Networks InRouter302)
- [CVE-2022-0031](https://cve.now/CVE-2022-0031.md): Cortex XSOAR: Local Privilege Escalation (PE) Vulnerability in Cortex XSOAR Engine (CVSS 6.7, Palo Alto Networks Cortex XSOAR)
- [CVE-2021-34579](https://cve.now/CVE-2021-34579.md): PHOENIX CONTACT: FL MGUARD DM version 1.12.0 and 1.13.0 Improper Privilege Management (CVSS 7.5, PHOENIX CONTACT FL MGUARD DM)
- [CVE-2021-34577](https://cve.now/CVE-2021-34577.md): Hardcoded credentials in Kaden PICOFLUX AiR (CVSS 6.5, Kaden PICOFLUX AiR)
- [CVE-2022-41978](https://cve.now/CVE-2022-41978.md): WordPress Zoho CRM Lead Magnet plugin \<= 1.7.5.8 - Auth. Arbitrary Options Update vulnerability (CVSS 8.8, Zoho CRM Lead Magnet)
- [CVE-2022-43488](https://cve.now/CVE-2022-43488.md): WordPress Advanced Dynamic Pricing for WooCommerce plugin \<= 4.1.5 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 5.4, AlgolPlus Advanced Dynamic Pricing for WooCommerce)
- [CVE-2021-34569](https://cve.now/CVE-2021-34569.md): WAGO I/O-Check Service prone to Out-of-bounds Write (CVSS 9.8, WAGO 750-81xx/xxx-xxxFW · WAGO 750-82xx/xxx-xxx +4)
- [CVE-2021-34568](https://cve.now/CVE-2021-34568.md): WAGO I/O-Check Service prone to Allocation of Resources Without Limits or Throttling (CVSS 7.5, WAGO 750-81xx/xxx-xxxFW · WAGO 750-82xx/xxx-xxx +4)
- [CVE-2021-34567](https://cve.now/CVE-2021-34567.md): WAGO I/O-Check Service prone to Out-of-bounds Read (CVSS 8.2, WAGO 750-81xx/xxx-xxxFW · WAGO 750-82xx/xxx-xxx +4)
- [CVE-2021-34566](https://cve.now/CVE-2021-34566.md): WAGO I/O-Check Service prone to Memory Overflow (CVSS 9.1, WAGO 750-81xx/xxx-xxxFW · WAGO 750-82xx/xxx-xxx +4)
- [CVE-2022-31253](https://cve.now/CVE-2022-31253.md): openldap2: /usr/lib/openldap/start allows ldap user/group to recursively chown arbitrary directory trees to itself (CVSS 7.1, openSUSE Factory)
- [CVE-2021-46851](https://cve.now/CVE-2021-46851.md): The DRM module has a vulnerability in verifying the secure memory attributes. (CVSS 9.8, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2021-46852](https://cve.now/CVE-2021-46852.md): The memory management module has the logic bypass vulnerability. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-2761](https://cve.now/CVE-2022-2761.md): An information disclosure issue in GitLab CE/EE affecting all versions from 14.4 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15 (CVSS 4.3, GitLab)
- [CVE-2022-29836](https://cve.now/CVE-2022-29836.md): Post-Auth Path Traversal Vulnerability Allows to Custom Package Installation via HTTP API (CVSS 1.9, Western Digital My Cloud Home · SanDisk ibi)
- [CVE-2022-31685](https://cve.now/CVE-2022-31685.md): VMware Workspace ONE Assist prior to 22.10 contains an Authentication Bypass vulnerability. (CVSS 9.8, VMware Workspace ONE Assist)
- [CVE-2022-31686](https://cve.now/CVE-2022-31686.md): VMware Workspace ONE Assist prior to 22.10 contains a Broken Authentication Method vulnerability. (CVSS 9.8, VMware Workspace ONE Assist)
- [CVE-2022-31687](https://cve.now/CVE-2022-31687.md): VMware Workspace ONE Assist prior to 22.10 contains a Broken Access Control vulnerability. (CVSS 9.8, VMware Workspace ONE Assist)
- [CVE-2022-31688](https://cve.now/CVE-2022-31688.md): VMware Workspace ONE Assist prior to 22.10 contains a Reflected cross-site scripting (XSS) vulnerability. (CVSS 6.1, VMware Workspace ONE Assist)
- [CVE-2022-31689](https://cve.now/CVE-2022-31689.md): VMware Workspace ONE Assist prior to 22.10 contains a Session fixation vulnerability. (CVSS 9.8, VMware Workspace ONE Assist)
- [CVE-2022-3265](https://cve.now/CVE-2022-3265.md): A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prio (CVSS 7.3, GitLab)
- [CVE-2022-3280](https://cve.now/CVE-2022-3280.md): An open redirect in GitLab CE/EE affecting all versions from 10.1 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an (CVSS 3.5, GitLab)
- [CVE-2022-3285](https://cve.now/CVE-2022-3285.md): Bypass of healthcheck endpoint allow list affecting all versions from 12.0 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 a (CVSS 5.3, GitLab)
- [CVE-2022-3413](https://cve.now/CVE-2022-3413.md): Incorrect authorization during display of Audit Events in GitLab EE affecting all versions from 14.5 prior to 15.3.5, 15.4 prior to 15.4.4, (CVSS 4.3, GitLab)
- [CVE-2022-3445](https://cve.now/CVE-2022-3445.md): Use after free in Skia in Google Chrome prior to 106.0.5249.119 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome)
- [CVE-2022-3446](https://cve.now/CVE-2022-3446.md): Heap buffer overflow in WebSQL in Google Chrome prior to 106.0.5249.119 allowed a remote attacker to potentially exploit heap corruption via (CVSS 8.8, Google Chrome)
- [CVE-2022-3447](https://cve.now/CVE-2022-3447.md): Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 106.0.5249.119 allowed a remote attacker to spoof the conte (CVSS 4.3, Google Chrome)
- [CVE-2022-3448](https://cve.now/CVE-2022-3448.md): Use after free in Permissions API in Google Chrome prior to 106.0.5249.119 allowed a remote attacker who convinced a user to engage in speci (CVSS 8.8, Google Chrome)
- [CVE-2022-3449](https://cve.now/CVE-2022-3449.md): Use after free in Safe Browsing in Google Chrome prior to 106.0.5249.119 allowed an attacker who convinced a user to install a malicious ext (CVSS 8.8, Google Chrome)
- [CVE-2022-3450](https://cve.now/CVE-2022-3450.md): Use after free in Peer Connection in Google Chrome prior to 106.0.5249.119 allowed a remote attacker to potentially exploit heap corruption (CVSS 8.8, Google Chrome)
- [CVE-2022-3483](https://cve.now/CVE-2022-3483.md): An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.1 before 15.3.5, all versions starting from 15.4 before (CVSS 5.5, GitLab)
- [CVE-2022-3486](https://cve.now/CVE-2022-3486.md): An open redirect vulnerability in GitLab EE/CE affecting all versions from 9.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5 (CVSS 4.7, GitLab)
- [CVE-2022-3706](https://cve.now/CVE-2022-3706.md): Improper authorization in GitLab CE/EE affecting all versions from 7.14 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allo (CVSS 3.1, GitLab)
- [CVE-2022-3726](https://cve.now/CVE-2022-3726.md): Lack of sand-boxing of OpenAPI documents in GitLab CE/EE affecting all versions from 12.6 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 pr (CVSS 4.8, GitLab)
- [CVE-2022-3793](https://cve.now/CVE-2022-3793.md): An improper authorization issue in GitLab CE/EE affecting all versions from 14.4 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15 (CVSS 4.3, GitLab)
- [CVE-2022-37966](https://cve.now/CVE-2022-37966.md): Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability (CVSS 8.1, Microsoft Windows Server 2008 Service Pack · Microsoft… +2)
- [CVE-2022-37967](https://cve.now/CVE-2022-37967.md): Windows Kerberos Elevation of Privilege Vulnerability (CVSS 7.2, Microsoft Windows Server 2008 Service Pack · Microsoft… +2)
- [CVE-2022-37992](https://cve.now/CVE-2022-37992.md): Windows Group Policy Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-38014](https://cve.now/CVE-2022-38014.md): Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Azure EFLOW · Microsoft Windows Subsystem for Lin…)
- [CVE-2022-38015](https://cve.now/CVE-2022-38015.md): Windows Hyper-V Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2022-38023](https://cve.now/CVE-2022-38023.md): Netlogon RPC Elevation of Privilege Vulnerability (CVSS 8.1, Microsoft Windows Server 2008 Service Pack · Microsoft… +2)
- [CVE-2022-3818](https://cve.now/CVE-2022-3818.md): An uncontrolled resource consumption issue when parsing URLs in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, a (CVSS 5.3, GitLab)
- [CVE-2022-3819](https://cve.now/CVE-2022-3819.md): An improper authorization issue in GitLab CE/EE affecting all versions from 15.0 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15 (CVSS 3.5, GitLab)
- [CVE-2022-3885](https://cve.now/CVE-2022-3885.md): Use after free in V8 in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2022-3886](https://cve.now/CVE-2022-3886.md): Use after free in Speech Recognition in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corrupti (CVSS 8.8, Google Chrome)
- [CVE-2022-3887](https://cve.now/CVE-2022-3887.md): Use after free in Web Workers in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via (CVSS 8.8, Google Chrome)
- [CVE-2022-3888](https://cve.now/CVE-2022-3888.md): Use after free in WebCodecs in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a (CVSS 8.8, Google Chrome)
- [CVE-2022-3889](https://cve.now/CVE-2022-3889.md): Type confusion in V8 in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2022-3890](https://cve.now/CVE-2022-3890.md): Heap buffer overflow in Crashpad in Google Chrome on Android prior to 107.0.5304.106 allowed a remote attacker who had compromised the rende (CVSS 9.6, Google Chrome)
- [CVE-2022-39306](https://cve.now/CVE-2022-39306.md): Grafana contains Improper Input Validation (CVSS 6.4, grafana · github.com/grafana/grafana)
- [CVE-2022-39307](https://cve.now/CVE-2022-39307.md): Grafana subject to Exposure of Sensitive Information resulting in User enumeration via forget password (CVSS 6.7, grafana · github.com/grafana/grafana)
- [CVE-2022-39368](https://cve.now/CVE-2022-39368.md): Californium Failing DTLS handshakes causes Data Loss due to throttling blocking processing of records (CVSS 8.2, eclipse-californium californium · org.eclipse.californium:s…)
- [CVE-2022-39879](https://cve.now/CVE-2022-39879.md): Improper authorization vulnerability in?CallBGProvider prior to SMR Nov-2022 Release 1 allows local attacker to grant permission for accessi (CVSS 5.9, Samsung Mobile Devices)
- [CVE-2022-39880](https://cve.now/CVE-2022-39880.md): Improper input validation vulnerability in DualOutFocusViewer prior to SMR Nov-2022 Release 1 allows local attacker to perform an arbitrary (CVSS 7.1, Samsung Mobile Devices)
- [CVE-2022-39881](https://cve.now/CVE-2022-39881.md): Improper input validation vulnerability for processing SIB12 PDU in Exynos modems prior to SMR Sep-2022 Release allows remote attacker to re (CVSS 5.3, Samsung Mobile Devices)
- [CVE-2022-39882](https://cve.now/CVE-2022-39882.md): Heap overflow vulnerability in sflacf\_fal\_bytes\_peek function in libsmat.so library prior to SMR Nov-2022 Release 1 allows local attacker to (CVSS 8.0, Samsung Mobile Devices)
- [CVE-2022-39883](https://cve.now/CVE-2022-39883.md): Improper authorization vulnerability in StorageManagerService prior to SMR Nov-2022 Release 1 allows local attacker to call privileged API. (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2022-39884](https://cve.now/CVE-2022-39884.md): Improper access control vulnerability in IImsService prior to SMR Nov-2022 Release 1 allows local attacker to access to Call information. (CVSS 4.3, Samsung Mobile Devices)
- [CVE-2022-39885](https://cve.now/CVE-2022-39885.md): Improper access control vulnerability in BootCompletedReceiver\_CMCC in DeviceManagement prior to SMR Nov-2022 Release 1 allows local attacke (CVSS 5.9, Samsung Mobile Devices)
- [CVE-2022-39886](https://cve.now/CVE-2022-39886.md): Improper access control vulnerability in IpcRxServiceModeBigDataInfo in RIL prior to SMR Nov-2022 Release 1 allows local attacker to access (CVSS 5.9, Samsung Mobile Devices)
- [CVE-2022-39887](https://cve.now/CVE-2022-39887.md): Improper access control vulnerability in clearAllGlobalProxy in MiscPolicy prior to SMR Nov-2022 Release 1 allows local attacker to configur (CVSS 4.3, Samsung Mobile Devices)
- [CVE-2022-39889](https://cve.now/CVE-2022-39889.md): Improper access control vulnerability in GalaxyWatch4Plugin prior to versions 2.2.11.22101351 and 2.2.12.22101351 allows attackers to access (CVSS 4.0, Samsung Mobile GalaxyWatch4Plugin)
- [CVE-2022-39890](https://cve.now/CVE-2022-39890.md): Improper Authorization in Samsung Billing prior to version 5.0.56.0 allows attacker to get sensitive information. (CVSS 6.2, Samsung Mobile Samsung Billing)
- [CVE-2022-39891](https://cve.now/CVE-2022-39891.md): Heap overflow vulnerability in parse\_pce function in libsavsaudio.so in Editor Lite prior to version 4.0.41.3 allows attacker to get informa (CVSS 4.3, Samsung Mobile Editor Lite)
- [CVE-2022-39892](https://cve.now/CVE-2022-39892.md): Improper access control in Samsung Pass prior to version 4.0.05.1 allows attackers to unauthenticated access via keep open feature. (CVSS 3.6, Samsung Mobile Samsung Pass)
- [CVE-2022-39893](https://cve.now/CVE-2022-39893.md): Sensitive information exposure vulnerability in FmmBaseModel in Galaxy Buds Pro Manage prior to version 4.1.22092751 allows local attackers (CVSS 3.3, Samsung Mobile Galaxy Buds Pro Manager)
- [CVE-2022-40797](https://cve.now/CVE-2022-40797.md): Roxy Fileman 1.4.6 allows Remote Code Execution via a .phar upload, because the default FORBIDDEN\_UPLOADS value in conf.json only blocks .ph (CVSS 9.8)
- [CVE-2022-41039](https://cve.now/CVE-2022-41039.md): Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2022-41044](https://cve.now/CVE-2022-41044.md): Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2022-41045](https://cve.now/CVE-2022-41045.md): Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-41047](https://cve.now/CVE-2022-41047.md): Microsoft ODBC Driver Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-41048](https://cve.now/CVE-2022-41048.md): Microsoft ODBC Driver Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-41049](https://cve.now/CVE-2022-41049.md): Windows Mark of the Web Security Feature Bypass Vulnerability (CVSS 5.4, KEV, Microsoft Windows)
- [CVE-2022-41050](https://cve.now/CVE-2022-41050.md): Windows Extensible File Allocation Table Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-41051](https://cve.now/CVE-2022-41051.md): Azure RTOS GUIX Studio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Azure RTOS GUIX Studio)
- [CVE-2022-41052](https://cve.now/CVE-2022-41052.md): Windows Graphics Component Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-41053](https://cve.now/CVE-2022-41053.md): Windows Kerberos Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2022-41054](https://cve.now/CVE-2022-41054.md): Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-41055](https://cve.now/CVE-2022-41055.md): Windows Human Interface Device Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2022-41056](https://cve.now/CVE-2022-41056.md): Network Policy Server (NPS) RADIUS Protocol Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2022-41057](https://cve.now/CVE-2022-41057.md): Windows HTTP.sys Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-41058](https://cve.now/CVE-2022-41058.md): Windows Network Address Translation (NAT) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2022-41060](https://cve.now/CVE-2022-41060.md): Microsoft Word Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office +5)
- [CVE-2022-41061](https://cve.now/CVE-2022-41061.md): Microsoft Word Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office 201… +8)
- [CVE-2022-41062](https://cve.now/CVE-2022-41062.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server 2013 Service Pack… +2)
- [CVE-2022-41063](https://cve.now/CVE-2022-41063.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel 2013… +2)
- [CVE-2022-41064](https://cve.now/CVE-2022-41064.md): .NET Framework Information Disclosure Vulnerability (CVSS 5.8, Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 ·… +3)
- [CVE-2022-41066](https://cve.now/CVE-2022-41066.md): Microsoft Dynamics Business Central Information Disclosure Vulnerability (CVSS 4.4, Microsoft Dynamics 365 Business Central Spring 2019 Upda… +2)
- [CVE-2022-41073](https://cve.now/CVE-2022-41073.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2022-41078](https://cve.now/CVE-2022-41078.md): Microsoft Exchange Server Spoofing Vulnerability (CVSS 8.0, Microsoft Exchange Server 2013 Cumulative Update · Micro… +1)
- [CVE-2022-41079](https://cve.now/CVE-2022-41079.md): Microsoft Exchange Server Spoofing Vulnerability (CVSS 8.0, Microsoft Exchange Server 2013 Cumulative Update · Micro… +1)
- [CVE-2022-41080](https://cve.now/CVE-2022-41080.md): Microsoft Exchange Server Elevation of Privilege Vulnerability (CVSS 8.8, KEV, Microsoft Exchange Server 2013 Cumulative Update · Micro… +1)
- [CVE-2022-41085](https://cve.now/CVE-2022-41085.md): Azure CycleCloud Elevation of Privilege Vulnerability (CVSS 7.5, Microsoft Azure CycleCloud)
- [CVE-2022-41086](https://cve.now/CVE-2022-41086.md): Windows Group Policy Elevation of Privilege Vulnerability (CVSS 6.4, Microsoft Windows)
- [CVE-2022-41088](https://cve.now/CVE-2022-41088.md): Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2022-41090](https://cve.now/CVE-2022-41090.md): Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerability (CVSS 5.9, Microsoft Windows)
- [CVE-2022-41091](https://cve.now/CVE-2022-41091.md): Windows Mark of the Web Security Feature Bypass Vulnerability (CVSS 5.4, KEV, Microsoft Windows)
- [CVE-2022-41092](https://cve.now/CVE-2022-41092.md): Windows Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-41093](https://cve.now/CVE-2022-41093.md): Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-41095](https://cve.now/CVE-2022-41095.md): Windows Digital Media Receiver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-41096](https://cve.now/CVE-2022-41096.md): Microsoft DWM Core Library Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-41097](https://cve.now/CVE-2022-41097.md): Network Policy Server (NPS) RADIUS Protocol Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2022-41098](https://cve.now/CVE-2022-41098.md): Windows GDI+ Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2022-41099](https://cve.now/CVE-2022-41099.md): BitLocker Security Feature Bypass Vulnerability (CVSS 4.6, Microsoft Windows)
- [CVE-2022-41100](https://cve.now/CVE-2022-41100.md): Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-41101](https://cve.now/CVE-2022-41101.md): Windows Overlay Filter Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-41102](https://cve.now/CVE-2022-41102.md): Windows Overlay Filter Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-41103](https://cve.now/CVE-2022-41103.md): Microsoft Word Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office +5)
- [CVE-2022-41104](https://cve.now/CVE-2022-41104.md): Microsoft Excel Security Feature Bypass Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Excel 2013… +2)
- [CVE-2022-41105](https://cve.now/CVE-2022-41105.md): Microsoft Excel Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2022-41106](https://cve.now/CVE-2022-41106.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 8.8, Microsoft 365 Apps for Enterprise · Microsoft Excel 2013… +2)
- [CVE-2022-41107](https://cve.now/CVE-2022-41107.md): Microsoft Office Graphics Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2022-41109](https://cve.now/CVE-2022-41109.md): Windows Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-41113](https://cve.now/CVE-2022-41113.md): Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-41114](https://cve.now/CVE-2022-41114.md): Windows Bind Filter Driver Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2022-41116](https://cve.now/CVE-2022-41116.md): Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerability (CVSS 5.9, Microsoft Windows)
- [CVE-2022-41118](https://cve.now/CVE-2022-41118.md): Windows Scripting Languages Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2022-41119](https://cve.now/CVE-2022-41119.md): Visual Studio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio)
- [CVE-2022-41120](https://cve.now/CVE-2022-41120.md): Microsoft Windows System Monitor (Sysmon) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Sysmon)
- [CVE-2022-41122](https://cve.now/CVE-2022-41122.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 6.5, Microsoft SharePoint Enterprise Server 2013 Service Pack… +2)
- [CVE-2022-41123](https://cve.now/CVE-2022-41123.md): Microsoft Exchange Server Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Exchange Server 2016 Cumulative Update · Microsof…)
- [CVE-2022-41125](https://cve.now/CVE-2022-41125.md): Windows CNG Key Isolation Service Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2022-41128](https://cve.now/CVE-2022-41128.md): Windows Scripting Languages Remote Code Execution Vulnerability (CVSS 8.8, KEV, Microsoft Windows)
- [CVE-2022-42964](https://cve.now/CVE-2022-42964.md): Exponential ReDoS in pymatgen leads to denial of service (CVSS 5.9, pymatgen)
- [CVE-2022-42965](https://cve.now/CVE-2022-42965.md): Exponential ReDoS in snowflake-connector-python leads to denial of service (CVSS 3.7, snowflake-connector-python)
- [CVE-2022-42966](https://cve.now/CVE-2022-42966.md): Exponential ReDoS in cleo leads to denial of service (CVSS 5.9, cleo)
- [CVE-2022-43031](https://cve.now/CVE-2022-43031.md): DedeCMS v6.1.9 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add Administrator account (CVSS 8.8)
- [CVE-2022-43058](https://cve.now/CVE-2022-43058.md): Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms//classes (CVSS 9.8)
- [CVE-2022-43118](https://cve.now/CVE-2022-43118.md): A cross-site scripting (XSS) vulnerability in flatCore-CMS v2.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted pa (CVSS 6.1)
- [CVE-2022-43119](https://cve.now/CVE-2022-43119.md): A cross-site scripting (XSS) vulnerability in Clansphere CMS v2011.4 allows attackers to execute arbitrary web scripts or HTML via a crafted (CVSS 6.1)
- [CVE-2022-43120](https://cve.now/CVE-2022-43120.md): A cross-site scripting (XSS) vulnerability in the /panel/fields/add component of Intelliants Subrion CMS v4.2.1 allows attackers to execute (CVSS 6.1, intelliants/subrion)
- [CVE-2022-43121](https://cve.now/CVE-2022-43121.md): A cross-site scripting (XSS) vulnerability in the CMS Field Add page of Intelliants Subrion CMS v4.2.1 allows attackers to execute arbitrary (CVSS 6.1, intelliants/subrion)
- [CVE-2022-43277](https://cve.now/CVE-2022-43277.md): Canteen Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via ip/youthappam/php\_action/editFile.php. (CVSS 7.2)
- [CVE-2022-43278](https://cve.now/CVE-2022-43278.md): Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the categoriesId parameter at /php\_action/fetchSe (CVSS 7.2)
- [CVE-2022-43290](https://cve.now/CVE-2022-43290.md): Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /youthappam/editcategory.php. (CVSS 7.2)
- [CVE-2022-43291](https://cve.now/CVE-2022-43291.md): Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /youthappam/editclient.php. (CVSS 7.2)
- [CVE-2022-43292](https://cve.now/CVE-2022-43292.md): Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /youthappam/editfood.php. (CVSS 7.2)
- [CVE-2022-43310](https://cve.now/CVE-2022-43310.md): An Uncontrolled Search Path Element in Foxit Software released Foxit Reader v11.2.118.51569 allows attackers to escalate privileges when sea (CVSS 7.8)
- [CVE-2022-43320](https://cve.now/CVE-2022-43320.md): FeehiCMS v2.1.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the id parameter at /web/admin/index.php? (CVSS 6.1, feehi/cms)
- [CVE-2022-43321](https://cve.now/CVE-2022-43321.md): Shopwind v3.4.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the component /common/library/Page.php. (CVSS 6.1)
- [CVE-2022-44244](https://cve.now/CVE-2022-44244.md): An authentication bypass in Lin-CMS v0.2.1 allows attackers to escalate privileges to Super Administrator. (CVSS 6.6, lin-cms · io.github.talelin:lin-cms-core)
- [CVE-2022-44546](https://cve.now/CVE-2022-44546.md): The kernel module has the vulnerability that the mapping is not cleared after the memory is automatically released. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-44547](https://cve.now/CVE-2022-44547.md): The Display Service module has a UAF vulnerability. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-44548](https://cve.now/CVE-2022-44548.md): There is a vulnerability in permission verification during the Bluetooth pairing process. (CVSS 4.3, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-44549](https://cve.now/CVE-2022-44549.md): The LBS module has a vulnerability in geofencing API access. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-44550](https://cve.now/CVE-2022-44550.md): The graphics display module has a UAF vulnerability when traversing graphic layers. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-44551](https://cve.now/CVE-2022-44551.md): The iaware module has a vulnerability in thread security. (CVSS 9.8, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-44552](https://cve.now/CVE-2022-44552.md): The lock screen module has defects introduced in the design process. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-44553](https://cve.now/CVE-2022-44553.md): The HiView module has a vulnerability of not filtering third-party apps out when the HiView module traverses to invoke the system provider. (CVSS 5.3, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-44554](https://cve.now/CVE-2022-44554.md): The power module has a vulnerability in permission verification. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-44555](https://cve.now/CVE-2022-44555.md): The DDMP/ODMF module has a service hijacking vulnerability. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-44557](https://cve.now/CVE-2022-44557.md): The SmartTrimProcessEvent module has a vulnerability of obtaining the read and write permissions on arbitrary system files. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-44558](https://cve.now/CVE-2022-44558.md): The AMS module has a vulnerability of serialization/deserialization mismatch. (CVSS 9.8, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-44559](https://cve.now/CVE-2022-44559.md): The AMS module has a vulnerability of serialization/deserialization mismatch. (CVSS 9.8, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-44560](https://cve.now/CVE-2022-44560.md): The launcher module has an Intent redirection vulnerability. (CVSS 5.3, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-44561](https://cve.now/CVE-2022-44561.md): The preset launcher module has a permission verification vulnerability. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-44562](https://cve.now/CVE-2022-44562.md): The system framework layer has a vulnerability of serialization/deserialization mismatch. (CVSS 9.8, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-44563](https://cve.now/CVE-2022-44563.md): There is a race condition vulnerability in SD upgrade mode. (CVSS 5.9, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-45059](https://cve.now/CVE-2022-45059.md): An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. (CVSS 7.5)
- [CVE-2022-45060](https://cve.now/CVE-2022-45060.md): An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. (CVSS 7.5)
- [CVE-2022-45061](https://cve.now/CVE-2022-45061.md): An issue was discovered in Python before 3.11.1. (CVSS 7.5, libpython · python +1)
- [CVE-2022-45062](https://cve.now/CVE-2022-45062.md): In Xfce xfce4-settings before 4.16.4 and 4.17.x before 4.17.1, there is an argument injection vulnerability in xfce4-mime-helper. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-11-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.