CVEs published November 10, 2022
81 CVEs were published on November 10, 2022: 11 critical, 21 high.
- Published
- 81
- Critical
- 11
- High
- 21
- Medium
- 44
- Low
- 4
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 22
Most affected products
- Cisco Firepower Management Center
- 19
- Cisco Firepower Threat Defense Software
- 4
- POWERCOM CO. UPSMON PRO
- 4
- bytecodealliance wasmtime · wasmtime
- 3
- Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- 3
- ETIC Telecom Remote Access Server
- 3
- FLOWRING Agentflow BPM
- 3
- parse-community parse-server · parse-server
- 3
- SUSE Linux Enterprise Module for SUSE Manager Server · SUSE…
- 3
- Wiesemann & Theis Com-Server LC · Wiesemann & Theis Com… +15
- 3
Critical 11
- CVE-2022-42785Wiesemann & Theis: Authentication bypass in Com-Server familyWiesemann & Theis Com-Server LC · Wiesemann & Theis Com… +15
- CVE-2022-39036FLOWRING Agentflow BPM - Arbitrary File UploadFLOWRING Agentflow BPM
- CVE-2022-38119POWERCOM CO., LTD. UPSMON PRO - Broken AuthenticationPOWERCOM CO. UPSMON PRO
- CVE-2022-36938DexLoader function get_stringidx_fromdex() in Redex prior to commit 3b44c64 can load an out of bound address when loading the string index tFacebook Redex
- CVE-2022-39395Vela Insecure Defaultsgo-vela server · github.com/go-vela/server +1
- CVE-2022-39396Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parserparse-community parse-server · parse-server
- CVE-2022-43074AyaCMS v3.1.2 was discovered to contain an arbitrary file upload vulnerability via the component /admin/fst_upload.inc.php.
- CVE-2022-44087ESPCMS P8.21120101 was discovered to contain a remote code execution (RCE) vulnerability in the component UPFILE_PIC_ZOOM_HIGHT.
- CVE-2022-44088ESPCMS P8.21120101 was discovered to contain a remote code execution (RCE) vulnerability in the component INPUT_ISDESCRIPTION.
- CVE-2022-44089ESPCMS P8.21120101 was discovered to contain a remote code execution (RCE) vulnerability in the component IS_GETCACHE.
- CVE-2022-44727The EU Cookie Law GDPR (Banner + Blocker) module before 2.1.3 for PrestaShop allows SQL Injection via a cookie ( lgcookieslaw or __lglaw ).
High 21
- CVE-2021-0185Improper input validation in the firmware for some Intel(R) Server Board M10JNP Family before version 7.216 may allow a privileged user to pIntel(R) Server Board M10JNP Family
- CVE-2022-3703ETIC Telecom Remote Access Server Insufficient Verification of Data AuthenticityETIC Telecom Remote Access Server
- CVE-2022-41719Panic in github.com/shamaton/msgpack/v2github.com/shamaton/msgpack/v2
- CVE-2022-20854A vulnerability in the processing of SSH connections of Cisco Firepower Management Center (FMC) and Cisco Firepower Threat Defense (FTD) SofCisco Firepower Management Center · Cisco Firepower Threat…
- CVE-2022-20924A vulnerability in the Simple Network Management Protocol (SNMP) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco FirepCisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- CVE-2022-20927A vulnerability in the SSL/TLS client of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software Cisco Adaptive Security Appliance (ASA) Software · Cisco… +1
- CVE-2022-20918A vulnerability in the Simple Network Management Protocol (SNMP) access controls for Cisco FirePOWER Software for Adaptive Security AppliancCisco Firepower Management Center · Cisco FirePOWER Service…
- CVE-2022-20947A vulnerability in dynamic access policies (DAP) functionality of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat DefeCisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- CVE-2022-20946A vulnerability in the generic routing encapsulation (GRE) tunnel decapsulation feature of Cisco Firepower Threat Defense (FTD) Software couCisco Firepower Threat Defense Software
- CVE-2022-42787Wiesemann & Theis: Small number space for allocating session id in Com-Server familyWiesemann & Theis Com-Server LC · Wiesemann & Theis Com… +15
- CVE-2022-39038FLOWRING Agentflow BPM - Broken Access ControlFLOWRING Agentflow BPM
- CVE-2022-39037FLOWRING Agentflow BPM - Path TraversalFLOWRING Agentflow BPM
- CVE-2022-38122POWERCOM CO., LTD. UPSMON PRO - Cleartext Transmission of Sensitive InformationPOWERCOM CO. UPSMON PRO
- CVE-2021-40226xpdfreader 4.03 is vulnerable to Buffer Overflow.
- CVE-2022-39388Istio may allow identity impersonation if user has localhost accessistio · github.com/istio/istio
- CVE-2022-39393Wasmtime vulnerable to data leakage between instances in the pooling allocatorbytecodealliance wasmtime · wasmtime
- CVE-2022-39398InfotelGLPI vulnerable to Cross-site ScriptingInfotelGLPI tasklists
- CVE-2022-41876ezplatform-graphql GraphQL queries can expose password hashesezsystems ezplatform-graphql · ezsystems/ezplatform-graphql
- CVE-2022-41878Parse Server Prototype pollution and Injection via Cloud Code Webhooks or Cloud Code Triggersparse-community parse-server · parse-server
- CVE-2022-41879Parse Server subject to Prototype pollution via Cloud Code Webhooksparse-community parse-server · parse-server
- CVE-2022-45129Payara before 2022-11-04, when deployed to the root context, allows attackers to visit META-INF and WEB-INF, a different vulnerability than fish.payara.distributions:payara
Medium, low and unrated 49
- CVE-2022-42460WordPress Traffic Manager plugin <= 1.4.5 - Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS)SedLex Traffic Manager
- CVE-2022-40981ETIC Telecom Remote Access Server Unrestricted Upload of File with Dangerous TypeETIC Telecom Remote Access Server
- CVE-2022-41607ETIC Telecom Remote Access Server Path TraversalETIC Telecom Remote Access Server
- CVE-2022-20938A vulnerability in the module import function of the administrative interface of Cisco Firepower Management Center (FMC) Software could alloCisco Firepower Management Center
- CVE-2022-20936Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticaCisco Firepower Management Center
- CVE-2022-20935Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticaCisco Firepower Management Center
- CVE-2022-20932Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticaCisco Firepower Management Center
- CVE-2022-20905Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticaCisco Firepower Management Center
- CVE-2022-20872Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticaCisco Firepower Management Center
- CVE-2022-20843Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticaCisco Firepower Management Center
- CVE-2022-20840Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticaCisco Firepower Management Center
- CVE-2022-20839Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticaCisco Firepower Management Center
- CVE-2022-20838Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticaCisco Firepower Management Center
- CVE-2022-20836Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticaCisco Firepower Management Center
- CVE-2022-20835Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticaCisco Firepower Management Center
- CVE-2022-20834Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticaCisco Firepower Management Center
- CVE-2022-20833Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticaCisco Firepower Management Center
- CVE-2022-20832Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticaCisco Firepower Management Center
- CVE-2022-20831Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticaCisco Firepower Management Center
- CVE-2022-20940A vulnerability in the TLS handler of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to gain Cisco Firepower Threat Defense Software
- CVE-2022-20941A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, reCisco Firepower Management Center
- CVE-2022-20943Multiple vulnerabilities in the Server Message Block Version 2 (SMB2) processor of the Snort detection engine on multiple Cisco products couCisco Firepower Threat Defense Software · Cisco Cyber Vision
- CVE-2022-20922Multiple vulnerabilities in the Server Message Block Version 2 (SMB2) processor of the Snort detection engine on multiple Cisco products couCisco Firepower Threat Defense Software · Cisco Umbrella… +1
- CVE-2022-20928A vulnerability in the authentication and authorization flows for VPN connections in Cisco Adaptive Security Appliance (ASA) Software and FiCisco Adaptive Security Appliance (ASA) Software · Cisco… +1
- CVE-2022-20926A vulnerability in the web management interface of the Cisco Firepower Management Center (FMC) Software could allow an authenticated, remoteCisco Firepower Management Center
- CVE-2022-20925A vulnerability in the web management interface of the Cisco Firepower Management Center (FMC) Software could allow an authenticated, remoteCisco Firepower Management Center
- CVE-2022-20934A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software and Cisco FXOS Software could allow an authenticated, local attaCisco Firepower Threat Defense Software · Cisco Firepower E…
- CVE-2022-20950A vulnerability in the interaction of SIP and Snort 3 for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remoCisco Firepower Threat Defense Software
- CVE-2022-20949A vulnerability in the management web server of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker Cisco Firepower Threat Defense Software
- CVE-2022-20826A vulnerability in the secure boot implementation of Cisco Secure Firewalls 3100 Series that are running Cisco Adaptive Security Appliance (Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- CVE-2022-42786Wiesemann & Theis: XSS vulnerability in web interface of the Com-Server familyWiesemann & Theis Com-Server LC · Wiesemann & Theis Com… +15
- CVE-2022-43754SUMA/UYUNI reflected cross site scripting in /rhn/audit/scap/Search.doSUSE Linux Enterprise Module for SUSE Manager Server · SUSE…
- CVE-2022-43753SUMA/UYUNI arbitrary file disclosure vulnerability in ScapResultDownloadSUSE Linux Enterprise Module for SUSE Manager Server · SUSE…
- CVE-2022-31255SUMA/UYUNI directory path traversal vulnerability in CobblerSnipperViewActionSUSE Linux Enterprise Module for SUSE Manager Server · SUSE…
- CVE-2022-3867Nomad Event Stream Subscriber Using a Token with TTL Receives Updates Until Garbage CollectedHashiCorp Nomad · github.com/hashicorp/nomad
- CVE-2022-3866Nomad Workload Identity Token Can List Non-sensitive Metadata for Paths Under nomad/HashiCorp Nomad · github.com/hashicorp/nomad
- CVE-2022-38121POWERCOM CO., LTD. UPSMON PRO - Insufficiently Protected CredentialsPOWERCOM CO. UPSMON PRO
- CVE-2022-38120POWERCOM CO., LTD. UPSMON PRO - Path TraversalPOWERCOM CO. UPSMON PRO
- CVE-2021-40289mm-wki v0.2.1 is vulnerable to Cross Site Scripting (XSS).github.com/phachon/mm-wiki
- CVE-2022-26088An issue was discovered in BMC Remedy before 22.1.
- CVE-2022-34666NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a local user with basic capabilitieNVIDIA Cloud Gaming (guest driver), NVIDIA Cloud Gaming
- CVE-2022-35740dotCMS before 22.06 allows remote attackers to bypass intended access control and obtain sensitive information by using a semicolon in a URL
- CVE-2022-36022Some Deeplearning4J packages use unclaimed s3 bucket in tests and exampleseclipse deeplearning4j · org.deeplearning4j:platform-tes… +1
- CVE-2022-39392Wasmtime vulnerable to out of bounds read/write with zero-memory-pages configurationbytecodealliance wasmtime · wasmtime
- CVE-2022-39394wasmtime_trap_code C API function has out of bounds write vulnerabilitybytecodealliance wasmtime · wasmtime
- CVE-2022-41874Tauri Filesystem Scope can be Partially Bypassedtauri-apps tauri · Tauri
- CVE-2022-43679The Docker image of ownCloud Server through 10.11 contains a misconfiguration that renders the trusted_domains config useless.
- CVE-2022-45063xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command executio
- CVE-2022-45130Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password.