CVEs published November 14, 2022
97 CVEs were published on November 14, 2022: 8 critical, 21 high.
- Published
- 97
- Critical
- 8
- High
- 21
- Medium
- 57
- Low
- 4
- Unrated
- 7
- Now in CISA KEV
- 0
- Fix available
- 32
Most affected products
- concrete5/concrete5
- 12
- IBM CICS TX
- 11
- Apache Software Foundation Apache Airflow · apache-airflow
- 2
- Kernel
- 2
- OAuth Client by DigitialPixies
- 2
- pillow
- 2
- reSmush.it : the only free Image Optimizer & compress plugin
- 2
- Apache Software Foundation Apache Jena SDB · org.apache.jen…
- 1
- Apache Software Foundation Apache SOAP · soap:soap
- 1
- Chat Bubble – Floating Chat with Contact Chat Icons, Messag…
- 1
Critical 8
- CVE-2022-3477tagDiv Composer < 3.5 - Unauthenticated Account TakeovertagDiv Composer · tagDiv Newspaper +1
- CVE-2022-3574WPForms Pro < 1.7.7 - CSV InjectionWPForms Pro
- CVE-2022-37109patrickfuller camp up to and including commit bbd53a256ed70e79bd8758080936afbf6d738767 is vulnerable to Incorrect Access Control.
- CVE-2022-3993Improper Restriction of Excessive Authentication Attempts in kareadita/kavitakareadita/kavita
- CVE-2022-42984WoWonder Social Network Platform 4.1.4 was discovered to contain a SQL injection vulnerability via the offset parameter at requests.php?f=se
- CVE-2022-43294Tasmota before commit 066878da4d4762a9b6cb169fdf353e804d735cfd was discovered to contain a stack overflow via the ClientPortPtr parameter at
- CVE-2022-45136Apache Jena SDB allows arbitrary deserialisation via JDBCApache Software Foundation Apache Jena SDB · org.apache.jen…
- CVE-2022-45378Apache SOAP allows unauthenticated users to potentially invoke arbitrary codeApache Software Foundation Apache SOAP · soap:soap
High 21
- CVE-2022-0137A heap buffer overflow in image_set_mask function of HTMLDOC before 1.9.15 allows an attacker to write outside the buffer boundaries.michaelrsweet htmldoc
- CVE-2022-0324Buffer Overflow in Dhcp6relay in Software for Open Networking in the Cloud (SONiC)Linux Foundation Software for Open Networking in the Cloud
- CVE-2021-38827Xiongmai Camera XM-JPR2-LX V4.02.R12.A6420987.10002.147502.00000 is vulnerable to account takeover.
- CVE-2022-27949Apache Airflow prior to 2.3.1 may include sensitive values in rendered templateApache Software Foundation Apache Airflow · apache-airflow
- CVE-2022-3238A double-free flaw was found in the Linux kernel’s NTFS3 subsystem in how a user triggers remount and umount simultaneously.Kernel
- CVE-2022-33905DMA transactions which are targeted at input buffers used for the AhciBusDxe software SMI handler could cause SMRAM corruption (a TOCTOU att
- CVE-2022-33908DMA transactions which are targeted at input buffers used for the SdHostDriver software SMI handler could cause SMRAM corruption through a T
- CVE-2022-33909DMA transactions which are targeted at input buffers used for the HddPassword software SMI handler could cause SMRAM corruption through a TO
- CVE-2022-33983DMA transactions which are targeted at input buffers used for the NvmExpressLegacy software SMI handler could cause SMRAM corruption through
- CVE-2022-33984DMA transactions which are targeted at input buffers used for the SdMmcDevice software SMI handler could cause SMRAM corruption through a TO
- CVE-2022-33985DMA transactions which are targeted at input buffers used for the NvmExpressDxe software SMI handler could cause SMRAM corruption through a
- CVE-2022-34325DMA transactions which are targeted at input buffers used for the StorageSecurityCommandDxe software SMI handler could cause SMRAM corruptio
- CVE-2022-35613Konker v2.3.9 was to discovered to contain a Cross-Site Request Forgery (CSRF).
- CVE-2022-40127Apache Airflow <2.4.0 has an RCE in a bash exampleApache Software Foundation Apache Airflow · apache-airflow
- CVE-2022-40405WoWonder Social Network Platform v4.1.2 was discovered to contain a SQL injection vulnerability via the offset parameter at requests.php?f=l
- CVE-2022-43030Siyucms v6.1.7 was discovered to contain a remote code execution (RCE) vulnerability in the background.
- CVE-2022-43146An arbitrary file upload vulnerability in the image upload function of Canteen Management System v1.0 allows attackers to execute arbitrary
- CVE-2022-43288Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the order_by parameter at /rukovoditel/index.php?module=logs/
- CVE-2022-43323EyouCMS V1.5.9-UTF8-SP1 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Top Up Balance component under the Edit Member
- CVE-2022-43693Concrete CMS is vulnerable to CSRF due to the lack of "State" parameter for external Concrete authentication service for users of Concrete wconcrete5/concrete5
- CVE-2022-44387EyouCMS V1.5.9-UTF8-SP1 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Basic Information component under the Edit Mem
Medium, low and unrated 68
- CVE-2022-27896The Foundry Code-Workbooks service was found to contain an issue leading to information disclosure.Palantir Foundry Code-Workbooks
- CVE-2022-28764Local information exposure in Zoom ClientsZoom Video Communications Zoom Client for Meetings · Zoo… +1
- CVE-2022-34320IBM CICS TX information disclosureIBM CICS TX
- CVE-2022-34317IBM CICS TX cross-site scriptingIBM CICS TX
- CVE-2022-34318IBM CICS TX clickjackingIBM CICS TX
- CVE-2022-34316IBM CICS TX information disclosureIBM CICS TX
- CVE-2022-34314 IBM CICS TX 11.1 could disclose sensitive information to a local user due to insecure permission settings.IBM CICS TX
- CVE-2022-34315IBM CICS TX cross-site scriptingIBM CICS TX
- CVE-2022-38705IBM CICS TX phishingIBM CICS TX
- CVE-2022-34312IBM CICS TX information disclosureIBM CICS TX
- CVE-2022-24938Malformed Zigbee packet causes Assert in EmberZNet 7.0.1 or earliersilabs.com Ember ZNet
- CVE-2022-34329IBM CICS TX information disclosureIBM CICS TX
- CVE-2022-34319IBM CICS TX information disclosureIBM CICS TX
- CVE-2022-24937Malformed Zigbee packet causes Assert in EmberZNet 7.0.0 or earlierSilicon Labs Ember ZNet
- CVE-2022-34313IBM CICS TX Standard is vulnerable to allowing attackers access to an application via insecure session cookiesIBM CICS TX
- CVE-2022-35719IBM MQ Internet Pass-Thru 2.1, 9.2 LTS and 9.2 CD stores potentially sensitive information in trace files that could be read by a local userIBM MQ Internet Pass-Thru
- CVE-2022-31630OOB read due to insufficient input validation in imageloadfont()PHP Group PHP
- CVE-2021-38828Xiongmai Camera XM-JPR2-LX V4.02.R12.A6420987.10002.147502.00000 is vulnerable to plain-text traffic sniffing.
- CVE-2021-40272OP5 Monitor 8.3.1, 8.3.2, and OP5 8.3.3 are vulnerable to Cross Site Scripting (XSS).
- CVE-2022-2449reSmush.it Image Optimizer < 0.4.7 - Multiple CSRFreSmush.it : the only free Image Optimizer & compress plugin
- CVE-2022-2450reSmush.it Image Optimizer < 0.4.4 - Subscriber+ AJAX CallsreSmush.it : the only free Image Optimizer & compress plugin
- CVE-2022-30773DMA attacks on the parameter buffer used by the IhisiSmm driver could change the contents after parameter values have been checked but befor
- CVE-2022-30774DMA attacks on the parameter buffer used by the PnpSmm driver could change the contents after parameter values have been checked but before
- CVE-2022-31243Update description and links DMA transactions which are targeted at input buffers used for the software SMI handler used by the FvbServicesR
- CVE-2022-32266DMA attacks on the parameter buffer used by a software SMI handler used by the driver PcdSmmDxe could lead to a TOCTOU attack on the SMI han
- CVE-2022-32267DMA transactions which are targeted at input buffers used for the SmmResourceCheckDxe software SMI handler cause SMRAM corruption (a TOCTOU
- CVE-2022-3362Insufficient Session Expiration in ikus060/rdiffwebikus060/rdiffweb · rdiffweb
- CVE-2022-33906DMA transactions which are targeted at input buffers used for the FwBlockServiceSmm software SMI handler could cause SMRAM corruption throug
- CVE-2022-33907DMA transactions which are targeted at input buffers used for the software SMI handler used by the IdeBusDxe driver could cause SMRAM corrup
- CVE-2022-33982DMA attacks on the parameter buffer used by the Int15ServiceSmm software SMI handler could lead to a TOCTOU attack on the SMI handler and le
- CVE-2022-33986DMA attacks on the parameter buffer used by the VariableRuntimeDxe software SMI handler could lead to a TOCTOU attack.
- CVE-2022-3415Chat Bubble < 2.3 - Unauthenticated Stored Cross-Site ScriptingChat Bubble – Floating Chat with Contact Chat Icons, Messag…
- CVE-2022-3469WP Attachments < 5.0.5 - Admin+ Stored Cross-Site ScriptingWP Attachments
- CVE-2022-3484WPB Show Core - Reflected Cross-Site Scriptingwpb-show-core
- CVE-2022-3538Webmaster Tools Verification <= 1.2 - Unauthenticated Arbitrary Plugin DeactivationWebmaster Tools Verification
- CVE-2022-3539Testimonials (Free < 2.7, Pro < 1.0.8) - Admin+ Stored Cross-Site ScriptingTestimonials · Testimonial Pro
- CVE-2022-3578ProfileGrid < 5.1.1 - Reflected Cross-Site ScriptingProfileGrid – User Profiles, Memberships, Groups and Commun…
- CVE-2022-3631OAuth Client by DigitialPixies <= 1.1.0 - Admin+ Stored Cross-Site ScriptingOAuth Client by DigitialPixies
- CVE-2022-3632OAuth Client by DigitialPixies <= 1.1.0 - CSRFOAuth Client by DigitialPixies
- CVE-2022-37290GNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename application crash via a pasted ZIP archive.
- CVE-2022-38167The Nintex Workflow plugin 5.2.2.30 for SharePoint allows XSS.
- CVE-2022-3903An incorrect read request flaw was found in the Infrared Transceiver USB driver in the Linux kernel.Kernel
- CVE-2022-39385Users erroneously and transparently added to private messages in Discoursediscourse
- CVE-2022-3988Frappe Search navbar_search.html cross site scriptingFrappe
- CVE-2022-3992SourceCodester Sanitization Management System Banner Image cross site scriptingSourceCodester Sanitization Management System
- CVE-2022-40735The Diffie-Hellman Key Agreement Protocol allows use of long exponents that arguably make certain calculations unnecessarily expensive, beca
- CVE-2022-40903Aiphone GT-DMB-N 3-in-1 Video Entrance Station with NFC Reader 1.0.3 does not mitigate against repeated failed access attempts, which allows
- CVE-2022-41913Discourse-calendar exposes members of hidden groupsdiscourse-calendar
- CVE-2022-42110A Cross-site scripting (XSS) vulnerability in the Announcements module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fixcom.liferay:com.liferay.announcements.web · com.liferay.por…
- CVE-2022-43295XPDF v4.04 was discovered to contain a stack overflow via the function FileStream::copy() at xpdf/Stream.cc:795.
- CVE-2022-43342A stored cross-site scripting (XSS) vulnerability in the Add function of Eramba GRC Software c2.8.1 allows attackers to execute arbitrary we
- CVE-2022-43686In Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2, the authTypeConcreteCookieMap table can be filled up causing concrete5/concrete5
- CVE-2022-43687Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 does not issue a new session ID upon successful OAuth authenticatconcrete5/concrete5
- CVE-2022-43688Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Stored Cross-Site Scripting (XSS) in icons sinceconcrete5/concrete5
- CVE-2022-43689Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XXE based DNS requests leading to IP disclosure.concrete5/concrete5
- CVE-2022-43690Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 did not use strict comparison for the legacy_salt so that limitedconcrete5/concrete5
- CVE-2022-43691Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 inadvertently disclose server-side sensitive information (secretsconcrete5/concrete5
- CVE-2022-43692Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS - user can cause an administrator concrete5/concrete5
- CVE-2022-43694Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the image manipulation library concrete5/concrete5
- CVE-2022-43695Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Stored Cross-Site Scripting (XSS) in dashboard/sconcrete5/concrete5
- CVE-2022-43967Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the multilingual report due to concrete5/concrete5
- CVE-2022-43968Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the dashboard icons due to un-sconcrete5/concrete5
- CVE-2022-44389EyouCMS V1.5.9-UTF8-SP1 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Edit Admin Profile module.
- CVE-2022-44390A cross-site scripting (XSS) vulnerability in EyouCMS V1.5.9-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafte
- CVE-2022-45183Escalation of privileges in the Web Server in Ironman Software PowerShell Universal 2.x and 3.x allows an attacker with a valid app token to
- CVE-2022-45184The Web Server in Ironman Software PowerShell Universal v3.x and v2.x allows for directory traversal outside of the configuration directory,
- CVE-2022-45198Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).pillow
- CVE-2022-45199Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL.pillow