# CVEs published 2022-11-10

81 CVEs were published on November 10, 2022: 11 critical, 21 high. Days are UTC.

- [CVE-2021-0185](https://cve.now/CVE-2021-0185.md): Improper input validation in the firmware for some Intel(R) Server Board M10JNP Family before version 7.216 may allow a privileged user to p (CVSS 7.5, Intel(R) Server Board M10JNP Family)
- [CVE-2022-42460](https://cve.now/CVE-2022-42460.md): WordPress Traffic Manager plugin \<= 1.4.5 - Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS) (CVSS 6.5, SedLex Traffic Manager)
- [CVE-2022-3703](https://cve.now/CVE-2022-3703.md): ETIC Telecom Remote Access Server Insufficient Verification of Data Authenticity (CVSS 7.6, ETIC Telecom Remote Access Server)
- [CVE-2022-40981](https://cve.now/CVE-2022-40981.md): ETIC Telecom Remote Access Server Unrestricted Upload of File with Dangerous Type (CVSS 5.9, ETIC Telecom Remote Access Server)
- [CVE-2022-41607](https://cve.now/CVE-2022-41607.md): ETIC Telecom Remote Access Server Path Traversal (CVSS 6.2, ETIC Telecom Remote Access Server)
- [CVE-2022-41719](https://cve.now/CVE-2022-41719.md): Panic in github.com/shamaton/msgpack/v2 (CVSS 7.5, github.com/shamaton/msgpack/v2)
- [CVE-2022-20938](https://cve.now/CVE-2022-20938.md): A vulnerability in the module import function of the administrative interface of Cisco Firepower Management Center (FMC) Software could allo (CVSS 4.3, Cisco Firepower Management Center)
- [CVE-2022-20936](https://cve.now/CVE-2022-20936.md): Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authentica (CVSS 4.8, Cisco Firepower Management Center)
- [CVE-2022-20935](https://cve.now/CVE-2022-20935.md): Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authentica (CVSS 4.8, Cisco Firepower Management Center)
- [CVE-2022-20932](https://cve.now/CVE-2022-20932.md): Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authentica (CVSS 4.8, Cisco Firepower Management Center)
- [CVE-2022-20905](https://cve.now/CVE-2022-20905.md): Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authentica (CVSS 4.8, Cisco Firepower Management Center)
- [CVE-2022-20872](https://cve.now/CVE-2022-20872.md): Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authentica (CVSS 4.8, Cisco Firepower Management Center)
- [CVE-2022-20843](https://cve.now/CVE-2022-20843.md): Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authentica (CVSS 4.8, Cisco Firepower Management Center)
- [CVE-2022-20840](https://cve.now/CVE-2022-20840.md): Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authentica (CVSS 4.8, Cisco Firepower Management Center)
- [CVE-2022-20839](https://cve.now/CVE-2022-20839.md): Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authentica (CVSS 4.8, Cisco Firepower Management Center)
- [CVE-2022-20838](https://cve.now/CVE-2022-20838.md): Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authentica (CVSS 4.8, Cisco Firepower Management Center)
- [CVE-2022-20836](https://cve.now/CVE-2022-20836.md): Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authentica (CVSS 4.8, Cisco Firepower Management Center)
- [CVE-2022-20835](https://cve.now/CVE-2022-20835.md): Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authentica (CVSS 4.8, Cisco Firepower Management Center)
- [CVE-2022-20834](https://cve.now/CVE-2022-20834.md): Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authentica (CVSS 4.8, Cisco Firepower Management Center)
- [CVE-2022-20833](https://cve.now/CVE-2022-20833.md): Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authentica (CVSS 4.8, Cisco Firepower Management Center)
- [CVE-2022-20832](https://cve.now/CVE-2022-20832.md): Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authentica (CVSS 4.8, Cisco Firepower Management Center)
- [CVE-2022-20831](https://cve.now/CVE-2022-20831.md): Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authentica (CVSS 4.8, Cisco Firepower Management Center)
- [CVE-2022-20940](https://cve.now/CVE-2022-20940.md): A vulnerability in the TLS handler of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to gain (CVSS 5.3, Cisco Firepower Threat Defense Software)
- [CVE-2022-20941](https://cve.now/CVE-2022-20941.md): A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, re (CVSS 5.3, Cisco Firepower Management Center)
- [CVE-2022-20943](https://cve.now/CVE-2022-20943.md): Multiple vulnerabilities in the Server Message Block Version 2 (SMB2) processor of the Snort detection engine on multiple Cisco products cou (CVSS 5.8, Cisco Firepower Threat Defense Software · Cisco Cyber Vision)
- [CVE-2022-20922](https://cve.now/CVE-2022-20922.md): Multiple vulnerabilities in the Server Message Block Version 2 (SMB2) processor of the Snort detection engine on multiple Cisco products cou (CVSS 5.8, Cisco Firepower Threat Defense Software · Cisco Umbrella… +1)
- [CVE-2022-20928](https://cve.now/CVE-2022-20928.md): A vulnerability in the authentication and authorization flows for VPN connections in Cisco Adaptive Security Appliance (ASA) Software and Fi (CVSS 5.8, Cisco Adaptive Security Appliance (ASA) Software · Cisco… +1)
- [CVE-2022-20926](https://cve.now/CVE-2022-20926.md): A vulnerability in the web management interface of the Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote (CVSS 6.3, Cisco Firepower Management Center)
- [CVE-2022-20925](https://cve.now/CVE-2022-20925.md): A vulnerability in the web management interface of the Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote (CVSS 6.3, Cisco Firepower Management Center)
- [CVE-2022-20934](https://cve.now/CVE-2022-20934.md): A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software and Cisco FXOS Software could allow an authenticated, local atta (CVSS 6.0, Cisco Firepower Threat Defense Software · Cisco Firepower E…)
- [CVE-2022-20950](https://cve.now/CVE-2022-20950.md): A vulnerability in the interaction of SIP and Snort 3 for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remo (CVSS 5.8, Cisco Firepower Threat Defense Software)
- [CVE-2022-20949](https://cve.now/CVE-2022-20949.md): A vulnerability in the management web server of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker (CVSS 6.5, Cisco Firepower Threat Defense Software)
- [CVE-2022-20826](https://cve.now/CVE-2022-20826.md): A vulnerability in the secure boot implementation of Cisco Secure Firewalls 3100 Series that are running Cisco Adaptive Security Appliance ( (CVSS 6.4, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2022-20854](https://cve.now/CVE-2022-20854.md): A vulnerability in the processing of SSH connections of Cisco Firepower Management Center (FMC) and Cisco Firepower Threat Defense (FTD) Sof (CVSS 7.5, Cisco Firepower Management Center · Cisco Firepower Threat…)
- [CVE-2022-20924](https://cve.now/CVE-2022-20924.md): A vulnerability in the Simple Network Management Protocol (SNMP) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firep (CVSS 7.7, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2022-20927](https://cve.now/CVE-2022-20927.md): A vulnerability in the SSL/TLS client of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software (CVSS 7.7, Cisco Adaptive Security Appliance (ASA) Software · Cisco… +1)
- [CVE-2022-20918](https://cve.now/CVE-2022-20918.md): A vulnerability in the Simple Network Management Protocol (SNMP) access controls for Cisco FirePOWER Software for Adaptive Security Applianc (CVSS 7.5, Cisco Firepower Management Center · Cisco FirePOWER Service…)
- [CVE-2022-20947](https://cve.now/CVE-2022-20947.md): A vulnerability in dynamic access policies (DAP) functionality of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defe (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2022-20946](https://cve.now/CVE-2022-20946.md): A vulnerability in the generic routing encapsulation (GRE) tunnel decapsulation feature of Cisco Firepower Threat Defense (FTD) Software cou (CVSS 8.6, Cisco Firepower Threat Defense Software)
- [CVE-2022-42787](https://cve.now/CVE-2022-42787.md): Wiesemann & Theis: Small number space for allocating session id in Com-Server family (CVSS 8.8, Wiesemann & Theis Com-Server LC · Wiesemann & Theis Com… +15)
- [CVE-2022-42786](https://cve.now/CVE-2022-42786.md): Wiesemann & Theis: XSS vulnerability in web interface of the Com-Server family (CVSS 5.4, Wiesemann & Theis Com-Server LC · Wiesemann & Theis Com… +15)
- [CVE-2022-42785](https://cve.now/CVE-2022-42785.md): Wiesemann & Theis: Authentication bypass in Com-Server family (CVSS 9.8, Wiesemann & Theis Com-Server LC · Wiesemann & Theis Com… +15)
- [CVE-2022-43754](https://cve.now/CVE-2022-43754.md): SUMA/UYUNI reflected cross site scripting in /rhn/audit/scap/Search.do (CVSS 2.6, SUSE Linux Enterprise Module for SUSE Manager Server · SUSE…)
- [CVE-2022-43753](https://cve.now/CVE-2022-43753.md): SUMA/UYUNI arbitrary file disclosure vulnerability in ScapResultDownload (CVSS 4.3, SUSE Linux Enterprise Module for SUSE Manager Server · SUSE…)
- [CVE-2022-31255](https://cve.now/CVE-2022-31255.md): SUMA/UYUNI directory path traversal vulnerability in CobblerSnipperViewAction (CVSS 4.3, SUSE Linux Enterprise Module for SUSE Manager Server · SUSE…)
- [CVE-2022-3867](https://cve.now/CVE-2022-3867.md): Nomad Event Stream Subscriber Using a Token with TTL Receives Updates Until Garbage Collected (CVSS 2.7, HashiCorp Nomad · github.com/hashicorp/nomad)
- [CVE-2022-3866](https://cve.now/CVE-2022-3866.md): Nomad Workload Identity Token Can List Non-sensitive Metadata for Paths Under nomad/ (CVSS 5.0, HashiCorp Nomad · github.com/hashicorp/nomad)
- [CVE-2022-39038](https://cve.now/CVE-2022-39038.md): FLOWRING Agentflow BPM - Broken Access Control (CVSS 8.8, FLOWRING Agentflow BPM)
- [CVE-2022-39037](https://cve.now/CVE-2022-39037.md): FLOWRING Agentflow BPM - Path Traversal (CVSS 7.5, FLOWRING Agentflow BPM)
- [CVE-2022-39036](https://cve.now/CVE-2022-39036.md): FLOWRING Agentflow BPM - Arbitrary File Upload (CVSS 9.8, FLOWRING Agentflow BPM)
- [CVE-2022-38122](https://cve.now/CVE-2022-38122.md): POWERCOM CO., LTD. UPSMON PRO - Cleartext Transmission of Sensitive Information (CVSS 7.5, POWERCOM CO. UPSMON PRO)
- [CVE-2022-38121](https://cve.now/CVE-2022-38121.md): POWERCOM CO., LTD. UPSMON PRO - Insufficiently Protected Credentials (CVSS 6.5, POWERCOM CO. UPSMON PRO)
- [CVE-2022-38120](https://cve.now/CVE-2022-38120.md): POWERCOM CO., LTD. UPSMON PRO - Path Traversal (CVSS 6.5, POWERCOM CO. UPSMON PRO)
- [CVE-2022-38119](https://cve.now/CVE-2022-38119.md): POWERCOM CO., LTD. UPSMON PRO - Broken Authentication (CVSS 9.8, POWERCOM CO. UPSMON PRO)
- [CVE-2021-40226](https://cve.now/CVE-2021-40226.md): xpdfreader 4.03 is vulnerable to Buffer Overflow. (CVSS 7.5)
- [CVE-2021-40289](https://cve.now/CVE-2021-40289.md): mm-wki v0.2.1 is vulnerable to Cross Site Scripting (XSS). (CVSS 6.1, github.com/phachon/mm-wiki)
- [CVE-2022-26088](https://cve.now/CVE-2022-26088.md): An issue was discovered in BMC Remedy before 22.1. (CVSS 5.4)
- [CVE-2022-34666](https://cve.now/CVE-2022-34666.md): NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a local user with basic capabilitie (CVSS 6.5, NVIDIA Cloud Gaming (guest driver), NVIDIA Cloud Gaming)
- [CVE-2022-35740](https://cve.now/CVE-2022-35740.md): dotCMS before 22.06 allows remote attackers to bypass intended access control and obtain sensitive information by using a semicolon in a URL (CVSS 6.1)
- [CVE-2022-36022](https://cve.now/CVE-2022-36022.md): Some Deeplearning4J packages use unclaimed s3 bucket in tests and examples (CVSS 5.3, eclipse deeplearning4j · org.deeplearning4j:platform-tes… +1)
- [CVE-2022-36938](https://cve.now/CVE-2022-36938.md): DexLoader function get\_stringidx\_fromdex() in Redex prior to commit 3b44c64 can load an out of bound address when loading the string index t (CVSS 9.8, Facebook Redex)
- [CVE-2022-39388](https://cve.now/CVE-2022-39388.md): Istio may allow identity impersonation if user has localhost access (CVSS 7.6, istio · github.com/istio/istio)
- [CVE-2022-39392](https://cve.now/CVE-2022-39392.md): Wasmtime vulnerable to out of bounds read/write with zero-memory-pages configuration (CVSS 5.9, bytecodealliance wasmtime · wasmtime)
- [CVE-2022-39393](https://cve.now/CVE-2022-39393.md): Wasmtime vulnerable to data leakage between instances in the pooling allocator (CVSS 8.6, bytecodealliance wasmtime · wasmtime)
- [CVE-2022-39394](https://cve.now/CVE-2022-39394.md): wasmtime\_trap\_code C API function has out of bounds write vulnerability (CVSS 3.8, bytecodealliance wasmtime · wasmtime)
- [CVE-2022-39395](https://cve.now/CVE-2022-39395.md): Vela Insecure Defaults (CVSS 9.6, go-vela server · github.com/go-vela/server +1)
- [CVE-2022-39396](https://cve.now/CVE-2022-39396.md): Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser (CVSS 9.8, parse-community parse-server · parse-server)
- [CVE-2022-39398](https://cve.now/CVE-2022-39398.md): InfotelGLPI vulnerable to Cross-site Scripting (CVSS 8.8, InfotelGLPI tasklists)
- [CVE-2022-41874](https://cve.now/CVE-2022-41874.md): Tauri Filesystem Scope can be Partially Bypassed (CVSS 2.6, tauri-apps tauri · Tauri)
- [CVE-2022-41876](https://cve.now/CVE-2022-41876.md): ezplatform-graphql GraphQL queries can expose password hashes (CVSS 7.5, ezsystems ezplatform-graphql · ezsystems/ezplatform-graphql)
- [CVE-2022-41878](https://cve.now/CVE-2022-41878.md): Parse Server Prototype pollution and Injection via Cloud Code Webhooks or Cloud Code Triggers (CVSS 7.2, parse-community parse-server · parse-server)
- [CVE-2022-41879](https://cve.now/CVE-2022-41879.md): Parse Server subject to Prototype pollution via Cloud Code Webhooks (CVSS 7.2, parse-community parse-server · parse-server)
- [CVE-2022-43074](https://cve.now/CVE-2022-43074.md): AyaCMS v3.1.2 was discovered to contain an arbitrary file upload vulnerability via the component /admin/fst\_upload.inc.php. (CVSS 9.8)
- [CVE-2022-43679](https://cve.now/CVE-2022-43679.md): The Docker image of ownCloud Server through 10.11 contains a misconfiguration that renders the trusted\_domains config useless. (CVSS 4.2)
- [CVE-2022-44087](https://cve.now/CVE-2022-44087.md): ESPCMS P8.21120101 was discovered to contain a remote code execution (RCE) vulnerability in the component UPFILE\_PIC\_ZOOM\_HIGHT. (CVSS 9.8)
- [CVE-2022-44088](https://cve.now/CVE-2022-44088.md): ESPCMS P8.21120101 was discovered to contain a remote code execution (RCE) vulnerability in the component INPUT\_ISDESCRIPTION. (CVSS 9.8)
- [CVE-2022-44089](https://cve.now/CVE-2022-44089.md): ESPCMS P8.21120101 was discovered to contain a remote code execution (RCE) vulnerability in the component IS\_GETCACHE. (CVSS 9.8)
- [CVE-2022-44727](https://cve.now/CVE-2022-44727.md): The EU Cookie Law GDPR (Banner + Blocker) module before 2.1.3 for PrestaShop allows SQL Injection via a cookie ( lgcookieslaw or \_\_lglaw ). (CVSS 9.1)
- [CVE-2022-45063](https://cve.now/CVE-2022-45063.md): xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command executio (no CVSS)
- [CVE-2022-45129](https://cve.now/CVE-2022-45129.md): Payara before 2022-11-04, when deployed to the root context, allows attackers to visit META-INF and WEB-INF, a different vulnerability than (CVSS 7.5, fish.payara.distributions:payara)
- [CVE-2022-45130](https://cve.now/CVE-2022-45130.md): Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password. (CVSS 6.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-11-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.