# CVEs published 2022-11-11

90 CVEs were published on November 11, 2022: 2 critical, 30 high. Days are UTC.

- [CVE-2022-31772](https://cve.now/CVE-2022-31772.md): IBM MQ denial of service (CVSS 5.3, IBM MQ)
- [CVE-2022-40753](https://cve.now/CVE-2022-40753.md): IBM InfoSphere Information Server cross-site scripting (CVSS 5.4, IBM InfoSphere Information Server)
- [CVE-2022-36776](https://cve.now/CVE-2022-36776.md): IBM Cloud Pak for Security (CP4S) 1.10.0.0 79and 1.10.2.0 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Cloud Pak for Security)
- [CVE-2022-40750](https://cve.now/CVE-2022-40750.md): IBM WebSphere Application Server cross-site scripting (CVSS 5.4, IBM WebSphere Application Server)
- [CVE-2022-38385](https://cve.now/CVE-2022-38385.md): IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.2.0 could allow an authenticated user to obtain highly sensitive information or per (CVSS 7.1, IBM Cloud Pak for Security)
- [CVE-2022-38387](https://cve.now/CVE-2022-38387.md): IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.2.0 could allow a remote authenticated attacker to execute arbitrary commands on the (CVSS 7.1, IBM Cloud Pak for Security)
- [CVE-2022-34331](https://cve.now/CVE-2022-34331.md): IBM Power FW security bypass (CVSS 5.5, IBM Power FW)
- [CVE-2022-3510](https://cve.now/CVE-2022-3510.md): Parsing issue in protobuf message-type extension (CVSS 7.5, Google ProtocolBuffers · com.google.protobuf:protobuf-ja… +1)
- [CVE-2022-26028](https://cve.now/CVE-2022-26028.md): Uncontrolled search path in the Intel(R) VTune(TM) Profiler software before version 2022.2.0 may allow an authenticated user to potentially (CVSS 6.7, Intel(R) VTune(TM) Profiler software)
- [CVE-2021-33064](https://cve.now/CVE-2021-33064.md): Uncontrolled search path in the software installer for Intel(R) System Studio for all versions, may allow an authenticated user to potential (CVSS 6.7, Intel(R) System Studio)
- [CVE-2022-28667](https://cve.now/CVE-2022-28667.md): Out-of-bounds write for some Intel(R) PROSet/Wireless WiFi software before version 22.140 may allow an unauthenticated user to potentially e (CVSS 6.5, Intel(R) PROSet/Wireless WiFi software)
- [CVE-2022-26024](https://cve.now/CVE-2022-26024.md): Improper access control in the Intel(R) NUC HDMI Firmware Update Tool for NUC7i3DN, NUC7i5DN and NUC7i7DN before version 1.78.2.0.7 may allo (CVSS 6.7, Intel(R) NUC HDMI Firmware Update Tool for NUC7i3DN, NUC7i5…)
- [CVE-2022-26047](https://cve.now/CVE-2022-26047.md): Improper input validation for some Intel(R) PROSet/Wireless WiFi, Intel vPro(R) CSME WiFi and Killer(TM) WiFi products may allow unauthentic (CVSS 4.3, Intel(R) PROSet/Wireless WiFi, Intel vPro(R) CSME WiFi and…)
- [CVE-2022-33973](https://cve.now/CVE-2022-33973.md): Improper access control in the Intel(R) WAPI Security software for Windows 10/11 before version 22.2150.0.1 may allow an authenticated user (CVSS 3.3, Intel(R) WAPI Security software for Windows 10/11)
- [CVE-2022-36377](https://cve.now/CVE-2022-36377.md): Insecure inherited permissions in some Intel(R) Wireless Adapter Driver installation software for Intel(R) NUC Kits & Mini PCs before versio (CVSS 6.7, Intel(R) Wireless Adapter Driver installation software for…)
- [CVE-2022-36380](https://cve.now/CVE-2022-36380.md): Uncontrolled search path in the installer software for some Intel(r) NUC Kit Wireless Adapter drivers for Windows 10 before version 22.40 ma (CVSS 6.7, Intel(r) NUC Kit Wireless Adapter drivers for Windows)
- [CVE-2022-36384](https://cve.now/CVE-2022-36384.md): Unquoted search path in the installer software for some Intel(r) NUC Kit Wireless Adapter drivers for Windows 10 before version 22.40 may al (CVSS 6.7, Intel(r) NUC Kit Wireless Adapter drivers for Windows)
- [CVE-2022-36400](https://cve.now/CVE-2022-36400.md): Path traversal in the installer software for some Intel(r) NUC Kit Wireless Adapter drivers for Windows 10 before version 22.40 may allow an (CVSS 6.7, Intel(r) NUC Kit Wireless Adapter drivers for Windows)
- [CVE-2022-21198](https://cve.now/CVE-2022-21198.md): Time-of-check time-of-use race condition in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable (CVSS 7.9, Intel(R) Processors)
- [CVE-2022-26006](https://cve.now/CVE-2022-26006.md): Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of (CVSS 8.2, Intel(R) Processors)
- [CVE-2022-25917](https://cve.now/CVE-2022-25917.md): Uncaught exception in the firmware for some Intel(R) Server Board M50CYP Family before version R01.01.0005 may allow a privileged user to po (CVSS 6.0, Intel(R) Server Board M50CYP Family)
- [CVE-2022-30542](https://cve.now/CVE-2022-30542.md): Improper input validation in the firmware for some Intel(R) Server Board S2600WF, Intel(R) Server System R1000WF and Intel(R) Server System (CVSS 8.2, Intel(R) Server Board S2600WF, Intel(R) Server System R1000…)
- [CVE-2022-36349](https://cve.now/CVE-2022-36349.md): Insecure default variable initialization in BIOS firmware for some Intel(R) NUC Boards and Intel(R) NUC Kits before version MYi30060 may all (CVSS 5.2, Intel(R) NUC Boards and Intel(R) NUC Kits)
- [CVE-2022-37334](https://cve.now/CVE-2022-37334.md): Improper initialization in BIOS firmware for some Intel(R) NUC 11 Pro Kits and Intel(R) NUC 11 Pro Boards before version TNTGL357.0064 may a (CVSS 7.0, Intel(R) NUC 11 Pro Kits and Intel(R) NUC 11 Pro Boards)
- [CVE-2022-36370](https://cve.now/CVE-2022-36370.md): Improper authentication in BIOS firmware for some Intel(R) NUC Boards and Intel(R) NUC Kits before version MYi30060 may allow a privileged u (CVSS 7.5, Intel(R) NUC Boards and Intel(R) NUC Kits)
- [CVE-2022-26124](https://cve.now/CVE-2022-26124.md): Improper buffer restrictions in BIOS firmware for some Intel(R) NUC Boards, Intel(R) NUC 8 Boards, Intel(R) NUC 8 Rugged Boards and Intel(R) (CVSS 7.5, Intel(R) NUC Boards, Intel(R) NUC 8 Boards, Intel(R) NUC 8…)
- [CVE-2022-38099](https://cve.now/CVE-2022-38099.md): Improper input validation in BIOS firmware for some Intel(R) NUC 11 Compute Elements before version EBTGL357.0065 may allow a privileged use (CVSS 7.5, Intel(R) NUC 11 Compute Elements)
- [CVE-2022-35276](https://cve.now/CVE-2022-35276.md): Improper access control in BIOS firmware for some Intel(R) NUC 8 Compute Elements before version CBWHL357.0096 may allow a privileged user t (CVSS 7.5, Intel(R) NUC 8 Compute Elements)
- [CVE-2022-36789](https://cve.now/CVE-2022-36789.md): Improper access control in BIOS firmware for some Intel(R) NUC 10 Performance Kits and Intel(R) NUC 10 Performance Mini PCs before version F (CVSS 7.5, Intel(R) NUC 10 Performance Kits and Intel(R) NUC 10 Perfor…)
- [CVE-2022-32569](https://cve.now/CVE-2022-32569.md): Improper buffer restrictions in BIOS firmware for some Intel(R) NUC M15 Laptop Kits before version BCTGL357.0074 may allow a privileged user (CVSS 7.5, Intel(R) NUC M15 Laptop Kits)
- [CVE-2022-34152](https://cve.now/CVE-2022-34152.md): Improper input validation in BIOS firmware for some Intel(R) NUC Boards, Intel(R) NUC Kits before version TY0070 may allow a privileged user (CVSS 7.7, Intel(R) NUC Boards, Intel(R) NUC Kits)
- [CVE-2022-21794](https://cve.now/CVE-2022-21794.md): Improper authentication in BIOS firmware for some Intel(R) NUC Boards, Intel(R) NUC Business, Intel(R) NUC Enthusiast, Intel(R) NUC Kits bef (CVSS 7.7, Intel(R) NUC Boards, Intel(R) NUC Business, Intel(R) NUC En…)
- [CVE-2022-37345](https://cve.now/CVE-2022-37345.md): Improper authentication in BIOS firmware\[A1\] for some Intel(R) NUC Kits before version RY0386 may allow an authenticated user to potentially (CVSS 7.8, Intel(R) NUC Kits)
- [CVE-2022-33176](https://cve.now/CVE-2022-33176.md): Improper input validation in BIOS firmware for some Intel(R) NUC 11 Performance kits and Intel(R) NUC 11 Performance Mini PCs before version (CVSS 8.2, Intel(R) NUC 11 Performance kits and Intel(R) NUC 11 Perfor…)
- [CVE-2021-33164](https://cve.now/CVE-2021-33164.md): Improper access control in BIOS firmware for some Intel(R) NUCs before version INWHL357.0046 may allow a privileged user to potentially enab (CVSS 8.2, Intel(R) NUCs)
- [CVE-2022-26045](https://cve.now/CVE-2022-26045.md): Improper buffer restrictions in some Intel(R) XMM(TM) 7560 Modem software before version M2\_7560\_R\_01.2146.00 may allow a privileged user to (CVSS 3.3, Intel(R) XMM(TM) 7560 Modem software)
- [CVE-2022-27639](https://cve.now/CVE-2022-27639.md): Incomplete cleanup in some Intel(R) XMM(TM) 7560 Modem software before version M2\_7560\_R\_01.2146.00 may allow a privileged user to potential (CVSS 5.4, Intel(R) XMM(TM) 7560 Modem software)
- [CVE-2022-26079](https://cve.now/CVE-2022-26079.md): Improper conditions check in some Intel(R) XMM(TM) 7560 Modem software before version M2\_7560\_R\_01.2146.00 may allow a privileged user to po (CVSS 6.0, Intel(R) XMM(TM) 7560 Modem software)
- [CVE-2022-26367](https://cve.now/CVE-2022-26367.md): Improper buffer restrictions in some Intel(R) XMM(TM) 7560 Modem software before version M2\_7560\_R\_01.2146.00 may allow a privileged user to (CVSS 6.0, Intel(R) XMM(TM) 7560 Modem software)
- [CVE-2022-28126](https://cve.now/CVE-2022-28126.md): Improper input validation in some Intel(R) XMM(TM) 7560 Modem software before version M2\_7560\_R\_01.2146.00 may allow a privileged user to po (CVSS 6.0, Intel(R) XMM(TM) 7560 Modem software)
- [CVE-2022-26369](https://cve.now/CVE-2022-26369.md): Out-of-bounds read in some Intel(R) XMM(TM) 7560 Modem software before version M2\_7560\_R\_01.2146.00 may allow a privileged user to potential (CVSS 6.2, Intel(R) XMM(TM) 7560 Modem software)
- [CVE-2022-28611](https://cve.now/CVE-2022-28611.md): Improper input validation in some Intel(R) XMM(TM) 7560 Modem software before version M2\_7560\_R\_01.2146.00 may allow a privileged user to po (CVSS 6.8, Intel(R) XMM(TM) 7560 Modem software)
- [CVE-2022-27874](https://cve.now/CVE-2022-27874.md): Improper authentication in some Intel(R) XMM(TM) 7560 Modem software before version M2\_7560\_R\_01.2146.00 may allow a privileged user to pote (CVSS 6.8, Intel(R) XMM(TM) 7560 Modem software)
- [CVE-2022-26513](https://cve.now/CVE-2022-26513.md): Out-of-bounds write in some Intel(R) XMM(TM) 7560 Modem software before version M2\_7560\_R\_01.2146.00 may allow an unauthenticated user to po (CVSS 8.0, Intel(R) XMM(TM) 7560 Modem software)
- [CVE-2022-29486](https://cve.now/CVE-2022-29486.md): Improper buffer restrictions in the Hyperscan library maintained by Intel(R) all versions downloaded before 04/29/2022 may allow an unauthen (CVSS 4.3, Hyperscan library maintained by Intel)
- [CVE-2022-33942](https://cve.now/CVE-2022-33942.md): Protection mechanism failure in the Intel(R) DCM software before version 5.0 may allow an unauthenticated user to potentially enable escalat (CVSS 8.8, Intel(R) DCM software)
- [CVE-2021-26251](https://cve.now/CVE-2021-26251.md): Improper input validation in the Intel(R) Distribution of OpenVINO(TM) Toolkit may allow an authenticated user to potentially enable denial (CVSS 5.3, Intel(R) Distribution of OpenVINO(TM) Toolkit)
- [CVE-2022-27233](https://cve.now/CVE-2022-27233.md): XML injection in the Quartus(R) Prime Programmer included in the Intel(R) Quartus Prime Pro and Standard edition software may allow an unaut (CVSS 6.5, Intel(R) Quartus Prime Pro and Standard edition software)
- [CVE-2022-27187](https://cve.now/CVE-2022-27187.md): Uncontrolled search path element in the Intel(R) Quartus Prime Standard edition software before version 21.1 Patch 0.02std may allow an auth (CVSS 6.7, Intel(R) Quartus Prime Standard edition software)
- [CVE-2022-30548](https://cve.now/CVE-2022-30548.md): Uncontrolled search path element in the Intel(R) Glorp software may allow an authenticated user to potentially enable escalation of privileg (CVSS 6.7, Intel(R) Glorp software)
- [CVE-2022-27499](https://cve.now/CVE-2022-27499.md): Premature release of resource during expected lifetime in the Intel(R) SGX SDK software may allow a privileged user to potentially enable in (CVSS 2.5, Intel(R) SGX SDK software)
- [CVE-2022-26508](https://cve.now/CVE-2022-26508.md): Improper authentication in the Intel(R) SDP Tool before version 3.0.0 may allow an unauthenticated user to potentially enable information di (CVSS 4.3, Intel(R) SDP Tool)
- [CVE-2022-26086](https://cve.now/CVE-2022-26086.md): Uncontrolled search path element in the PresentMon software maintained by Intel(R) before version 1.7.1 may allow an authenticated user to p (CVSS 6.7, PresentMon software maintained by Intel)
- [CVE-2022-27638](https://cve.now/CVE-2022-27638.md): Uncontrolled search path element in the Intel(R) Advanced Link Analyzer Pro before version 22.2 and Standard edition software before version (CVSS 6.7, Intel(R) Advanced Link Analyzer Pro and Standard edition)
- [CVE-2022-30297](https://cve.now/CVE-2022-30297.md): Cross-site scripting in the Intel(R) EMA software before version 1.8.0 may allow a privileged user to potentially enable escalation of privi (CVSS 3.8, Intel(R) EMA software)
- [CVE-2022-36367](https://cve.now/CVE-2022-36367.md): Incorrect default permissions in the Intel(R) Support Android application before version v22.02.28 may allow a privileged user to potentiall (CVSS 4.4, Intel(R) Support Android application)
- [CVE-2022-30691](https://cve.now/CVE-2022-30691.md): Uncontrolled resource consumption in the Intel(R) Support Android application before version 22.02.28 may allow an authenticated user to pot (CVSS 5.9, Intel(R) Support Android application)
- [CVE-2022-29515](https://cve.now/CVE-2022-29515.md): Missing release of memory after effective lifetime in firmware for Intel(R) SPS before versions SPS\_E3\_06.00.03.035.0 may allow a privileged (CVSS 6.0, Intel(R) SPS)
- [CVE-2022-29466](https://cve.now/CVE-2022-29466.md): Improper input validation in firmware for Intel(R) SPS before version SPS\_E3\_04.01.04.700.0 may allow an authenticated user to potentially e (CVSS 7.3, Intel(R) SPS)
- [CVE-2021-33159](https://cve.now/CVE-2021-33159.md): Improper authentication in subsystem for Intel(R) AMT before versions 11.8.93, 11.22.93, 11.12.93, 12.0.92, 14.1.67, 15.0.42, 16.1.25 may al (CVSS 7.4, Intel(R) AMT)
- [CVE-2022-29893](https://cve.now/CVE-2022-29893.md): Improper authentication in firmware for Intel(R) AMT before versions 11.8.93, 11.22.93, 11.12.93, 12.0.92, 14.1.67, 15.0.42, 16.1.25 may all (CVSS 8.1, Intel(R) AMT)
- [CVE-2022-27497](https://cve.now/CVE-2022-27497.md): Null pointer dereference in firmware for Intel(R) AMT before version 11.8.93, 11.22.93, 11.12.93, 12.0.92, 14.1.67, 15.0.42, 16.1.25 may all (CVSS 8.6, Intel(R) AMT)
- [CVE-2022-26845](https://cve.now/CVE-2022-26845.md): Improper authentication in firmware for Intel(R) AMT before versions 11.8.93, 11.22.93, 11.12.93, 12.0.92, 14.1.67, 15.0.42, 16.1.25 may all (CVSS 8.7, Intel(R) AMT)
- [CVE-2022-26341](https://cve.now/CVE-2022-26341.md): Insufficiently protected credentials in software in Intel(R) AMT SDK before version 16.0.4.1, Intel(R) EMA before version 1.7.1 and Intel(R) (CVSS 8.2, Intel(R) AMT SDK, Intel(R) EMA and Intel(R) MC)
- [CVE-2022-41854](https://cve.now/CVE-2022-41854.md): Stack Overflow in Snakeyaml (CVSS 5.8, SnakeYaml · org.yaml:snakeyaml)
- [CVE-2022-3939](https://cve.now/CVE-2022-3939.md): lanyulei ferry API file.go path traversal (CVSS 6.3, lanyulei ferry)
- [CVE-2022-3940](https://cve.now/CVE-2022-3940.md): lanyulei ferry task.go path traversal (CVSS 3.5, lanyulei ferry)
- [CVE-2022-3941](https://cve.now/CVE-2022-3941.md): Activity Log Plugin HTTP Header neutralization for logs (CVSS 5.3, Activity Log Plugin)
- [CVE-2022-3942](https://cve.now/CVE-2022-3942.md): SourceCodester Sanitization Management System cross site scripting (CVSS 4.3, SourceCodester Sanitization Management System)
- [CVE-2022-3943](https://cve.now/CVE-2022-3943.md): ForU CMS cms\_chip.php cross site scripting (CVSS 3.5, ForU CMS)
- [CVE-2022-3944](https://cve.now/CVE-2022-3944.md): jerryhanjj ERP Commodity Management inventory.php uploadImages unrestricted upload (CVSS 6.3, jerryhanjj ERP)
- [CVE-2022-3945](https://cve.now/CVE-2022-3945.md): Improper Restriction of Excessive Authentication Attempts in kareadita/kavita (CVSS 9.4, kareadita/kavita)
- [CVE-2022-3947](https://cve.now/CVE-2022-3947.md): eolinker goku\_lite list sql injection (CVSS 6.3, eolinker goku\_lite)
- [CVE-2022-3948](https://cve.now/CVE-2022-3948.md): eolinker goku\_lite getList sql injection (CVSS 6.3, eolinker goku\_lite)
- [CVE-2022-3949](https://cve.now/CVE-2022-3949.md): Sourcecodester Simple Cashiering System User Account cross site scripting (CVSS 3.5, Sourcecodester Simple Cashiering System)
- [CVE-2022-3950](https://cve.now/CVE-2022-3950.md): sanluan PublicCMS Tab dwz.min.js initLink cross site scripting (CVSS 3.5, sanluan PublicCMS)
- [CVE-2022-3952](https://cve.now/CVE-2022-3952.md): ManyDesigns Portofino WarFileLauncher.java createTempDir temp file (CVSS 2.6, ManyDesigns Portofino · com.manydesigns:portofino)
- [CVE-2022-3955](https://cve.now/CVE-2022-3955.md): tholum crm42 Login class.user.php sql injection (CVSS 7.3, tholum crm42)
- [CVE-2022-3956](https://cve.now/CVE-2022-3956.md): tsruban HHIMS Patient Portrait sql injection (CVSS 6.3, tsruban HHIMS)
- [CVE-2022-3957](https://cve.now/CVE-2022-3957.md): GPAC SVG Parser svg\_attributes.c svg\_parse\_preserveaspectratio memory leak (CVSS 4.3, GPAC)
- [CVE-2022-3959](https://cve.now/CVE-2022-3959.md): drogon Session Hash small space of random values (CVSS 3.1, drogon)
- [CVE-2022-41873](https://cve.now/CVE-2022-41873.md): Out-of-bounds read and write in BLE L2CAP module (CVSS 4.2, contiki-ng)
- [CVE-2022-41882](https://cve.now/CVE-2022-41882.md): Nextcloud Desktop vulnerable to code injection via malicious link (CVSS 6.6, nextcloud security-advisories)
- [CVE-2022-41892](https://cve.now/CVE-2022-41892.md): Arches vulnerable to SQL Injection (CVSS 8.6, archesproject arches · arches)
- [CVE-2022-41904](https://cve.now/CVE-2022-41904.md): Element iOS is vulnerable due to missing decoration for events decrypted with untrusted Megolm sessions (CVSS 6.4, vector-im element-ios)
- [CVE-2022-41905](https://cve.now/CVE-2022-41905.md): wsgidav is vulnerable to Cross-Site Scripting (XSS) when directory browsing is enabled (CVSS 8.2, mar10 wsgidav · wsgidav)
- [CVE-2022-41906](https://cve.now/CVE-2022-41906.md): OpenSearch Notifications is vulnerable to Server-Side Request Forgery (SSRF) (CVSS 7.7, opensearch-project notifications)
- [CVE-2022-45182](https://cve.now/CVE-2022-45182.md): Pi-Star\_DV\_Dash (for Pi-Star DV) before 5aa194d mishandles the module parameter. (CVSS 9.8)
- [CVE-2022-45193](https://cve.now/CVE-2022-45193.md): CBRN-Analysis before 22 has weak file permissions under Public Profile, leading to disclosure of file contents or privilege escalation. (CVSS 5.9)
- [CVE-2022-45194](https://cve.now/CVE-2022-45194.md): CBRN-Analysis before 22 allows XXE attacks via am mws XML document, leading to NTLMv2-SSP hash disclosure. (CVSS 3.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-11-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.