CVEs published November 15, 2022
108 CVEs were published on November 15, 2022: 10 critical, 42 high.
- Published
- 108
- Critical
- 10
- High
- 42
- Medium
- 42
- Low
- 11
- Unrated
- 3
- Now in CISA KEV
- 0
- Fix available
- 44
Most affected products
- com.liferay.portal:release.portal.bom
- 9
- Hallo Welt! BlueSpice
- 7
- Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- 7
- Jenkins project Jenkins NS-ND Integration Performance Publi…
- 3
- Qualcomm Snapdragon Consumer IOT, Snapdragon Industrial IOT…
- 3
- Apache Software Foundation Apache Archiva · org.apache.arch…
- 2
- com.liferay.portal:release.portal.bom · com.liferay.port… +1
- 2
- Jenkins project Jenkins Cluster Statistics Plugin · org.zer…
- 2
- Jenkins project Jenkins Delete log Plugin · org.jenkins-ci.…
- 2
- MonikaBrzica scm
- 2
Critical 10
- CVE-2022-41558TIBCO Spotfire Stored Cross Site Scripting (XSS) VulnerabilityTIBCO Software TIBCO Spotfire Analyst · TIBCO Software T… +2
- CVE-2022-25727Memory Corruption in modem due to improper length check while copying into memory in Snapdragon Consumer IOT, Snapdragon Industrial IOT, SnaQualcomm Snapdragon Consumer IOT, Snapdragon Industrial IOT…
- CVE-2022-42058Tenda AC1200 Router Model W15Ev2 V15.11.0.10(1576) was discovered to contain a stack overflow via the setRemoteWebManage function.
- CVE-2022-42120A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through 7.4.3.16, and Liferay DXP 7.3 before update 4, and 7.4 com.liferay:com.liferay.fragment.service · com.liferay.port…
- CVE-2022-42122A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and Liferay DXP 7.3 fix pack 2 through update 4 allows attcom.liferay.portal:release.portal.bom · com.liferay.port… +1
- CVE-2022-43265An arbitrary file upload vulnerability in the component /pages/save_user.php of Canteen Management System v1.0 allows attackers to execute a
- CVE-2022-45395Jenkins CCCC Plugin 0.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins project Jenkins CCCC Plugin · com.thalesgroup.jenki…
- CVE-2022-45396Jenkins SourceMonitor Plugin 0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins project Jenkins SourceMonitor Plugin · com.thalesgr…
- CVE-2022-45397Jenkins OSF Builder Suite : : XML Linter Plugin 1.0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attJenkins project Jenkins OSF Builder Suite : : XML Linter Pl…
- CVE-2022-45400Jenkins JAPEX Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins project Jenkins JAPEX Plugin · org.jvnet.hudson.plu…
High 42
- CVE-2022-43780Certain HP ENVY, OfficeJet, and DeskJet printers may be vulnerable to a Denial of Service attack.Certain HP ENVY, OfficeJet, and DeskJet printers
- CVE-2022-3240Follow Me Plugin <= 3.1.1 - Cross-Site Request Forgery to Cross-Site Scriptingbrian-chappell Follow Me Plugin
- CVE-2022-3461Buffer Overflow in PHOENIX CONTACT Automationworx Software SuitePHOENIX CONTACT Config+ · PHOENIX CONTACT PC Worx
- CVE-2022-3737Out-of-bounds Read in PHOENIX CONTACT Automationworx Software SuitePHOENIX CONTACT Config+ · PHOENIX CONTACT PC Worx
- CVE-2022-3480Denial-of-Service vulnerability in PHOENIX CONTACT mGuard product familyPHOENIX CONTACT FL MGUARD CENTERPORT · PHOENIX CONTACT… +20
- CVE-2022-25667Information disclosure in kernel due to improper handling of ICMP requests in Snapdragon Wired Infrastructure and NetworkingQualcomm Snapdragon Wired Infrastructure and Networking
- CVE-2022-25671Denial of service in MODEM due to reachable assertion in Snapdragon MobileQualcomm Snapdragon Mobile
- CVE-2022-25710Denial of service due to null pointer dereference when GATT is disconnected in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon IndustriQualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…
- CVE-2022-25724Memory corruption in graphics due to buffer overflow while validating the user address in Snapdragon Auto, Snapdragon Compute, Snapdragon CoQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-25741Denial of service in WLAN due to potential null pointer dereference while accessing the memory location in Snapdragon Auto, Snapdragon CompuQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-25742Denial of service in modem due to infinite loop while parsing IGMPv2 packet from server in Snapdragon Consumer IOT, Snapdragon Industrial IOQualcomm Snapdragon Consumer IOT, Snapdragon Industrial IOT…
- CVE-2022-25743Memory corruption in graphics due to use-after-free while importing graphics buffer in Snapdragon Auto, Snapdragon Compute, Snapdragon ConneQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-29275In UsbCoreDxe, untrusted input may allow SMRAM or OS memory tampering Use of untrusted pointers could allow OS or SMRAM memory tampering lea
- CVE-2022-29276SMI functions in AhciBusDxe use untrusted inputs leading to corruption of SMRAM.
- CVE-2022-29277Incorrect pointer checks within the the FwBlockServiceSmm driver can allow arbitrary RAM modifications During review of the FwBlockServiceSm
- CVE-2022-29278Incorrect pointer checks within the NvmExpressDxe driver can allow tampering with SMRAM and OS memory Incorrect pointer checks within the Nv
- CVE-2022-29279Use of a untrusted pointer allows tampering with SMRAM and OS memory in SdHostDriver and SdMmcDevice Use of a untrusted pointer allows tampe
- CVE-2022-30283In UsbCoreDxe, tampering with the contents of the USB working buffer using DMA while certain USB transactions are in process leads to a TOCT
- CVE-2022-30771Initialization function in PnpSmm could lead to SMRAM corruption when using subsequent PNP SMI functions Initialization function in PnpSmm c
- CVE-2022-30772Manipulation of the input address in PnpSmm function 0x52 could be used by malware to overwrite SMRAM or OS kernel memory.
- CVE-2022-33234Memory corruption in video due to configuration weakness.Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-33236Transient DOS due to buffer over-read in WLAN firmware while parsing cipher suite info attributes.Qualcomm Snapdragon Compute, Snapdragon Connectivity, Snapd…
- CVE-2022-33237Transient DOS due to buffer over-read in WLAN firmware while processing PPE threshold.Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-33239Transient DOS due to loop with unreachable exit condition in WLAN firmware while parsing IPV6 extension header.Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-38666Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.146 and earlier unconditionally disables SSL/TLS certificate and hostname validJenkins project Jenkins NS-ND Integration Performance Publi…
- CVE-2022-40308Apache Archiva prior to 2.2.9 may allow the anonymous user to read arbitrary filesApache Software Foundation Apache Archiva · org.apache.arch…
- CVE-2022-40847In Tenda AC1200 Router model W15Ev2 V15.11.0.10(1576), there exists a command injection vulnerability in the function formSetFixTools.
- CVE-2022-41395Tenda AC1200 Router Model W15Ev2 V15.11.0.10(1576) was discovered to contain a command injection vulnerability via the dmzHost parameter in
- CVE-2022-41396Tenda AC1200 Router Model W15Ev2 V15.11.0.10(1576) was discovered to contain multiple command injection vulnerabilities in the function setI
- CVE-2022-42053Tenda AC1200 Router Model W15Ev2 V15.11.0.10(1576) was discovered to contain a command injection vulnerability via the PortMappingServer par
- CVE-2022-42060Tenda AC1200 Router Model W15Ev2 V15.11.0.10(1576) was discovered to contain a stack overflow via the setWanPpoe function.
- CVE-2022-42121A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 befocom.liferay:com.liferay.layout.page.template.service · com.…
- CVE-2022-42123A Zip slip vulnerability in the Elasticsearch Connector in Liferay Portal 7.3.3 through 7.4.3.18, and Liferay DXP 7.3 before update 6, and 7com.liferay.portal:release.portal.bom
- CVE-2022-42124ReDoS vulnerability in LayoutPageTemplateEntryUpgradeProcess in Liferay Portal 7.3.2 through 7.4.3.4 and Liferay DXP 7.2 fix pack 9 through com.liferay.portal:release.portal.bom
- CVE-2022-42125Zip slip vulnerability in FileUtil.unzip in Liferay Portal 7.4.3.5 through 7.4.3.35 and Liferay DXP 7.4 update 1 through update 34 allows atcom.liferay.portal:release.portal.bom
- CVE-2022-42977The Netic User Export add-on before 1.3.5 for Atlassian Confluence has the functionality to generate a list of users in the application, and
- CVE-2022-42978In the Netic User Export add-on before 1.3.5 for Atlassian Confluence, authorization is mishandled.
- CVE-2022-43279LimeSurvey before v5.0.4 was discovered to contain a SQL injection vulnerability via the component /application/views/themeOptions/update.ph
- CVE-2022-45381Jenkins Pipeline Utility Steps Plugin 2.13.1 and earlier does not restrict the set of enabled prefix interpolators and bundles versions of AJenkins project Jenkins Pipeline Utility Steps Plugin · org…
- CVE-2022-45385A missing permission check in Jenkins CloudBees Docker Hub/Registry Notification Plugin 2.6.2 and earlier allows unauthenticated attackers tJenkins project Jenkins CloudBees Docker Hub/Registry Notif…
- CVE-2022-45388Jenkins Config Rotator Plugin 2.0.1 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing unauthenticated Jenkins project Jenkins Config Rotator Plugin · org.jenkins…
- CVE-2022-45391Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier globally and unconditionally disables SSL/TLS certificate and hJenkins project Jenkins NS-ND Integration Performance Publi…
Medium, low and unrated 56
- CVE-2022-3920Consul Peering Imported Nodes/Services LeakHashiCorp Consul · github.com/hashicorp/consul
- CVE-2022-27895A component in Foundry logging was found to be capturing sensitive information in logs.Palantir Foundry Build2
- CVE-2022-42001Potential XSS in book navigationHallo Welt! BlueSpice
- CVE-2022-42000Potential XSS in comment sectionHallo Welt! BlueSpice
- CVE-2022-41814Potential XSS in history viewHallo Welt! BlueSpice
- CVE-2022-41789Potential XSS on default page headerHallo Welt! BlueSpice
- CVE-2022-41611Potential XSS on sidebar navigationHallo Welt! BlueSpice
- CVE-2022-3958Potential XSS on personal menu navigationHallo Welt! BlueSpice
- CVE-2022-3895Potential XSS in common user interface component libraryHallo Welt! Common User Interface Component
- CVE-2022-3893Potential XSS on custom menu navigationHallo Welt! BlueSpice
- CVE-2021-4240phpservermon User.php generatePasswordResetToken predictable algorithm in random number generatorphpservermon · phpservermon/phpservermon
- CVE-2021-4241phpservermon User.php setUserLoggedIn predictable algorithm in random number generatorphpservermon · phpservermon/phpservermon
- CVE-2022-25674Cryptographic issues in WLAN during the group key handshake of the WPA/WPA2 protocol in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Qualcomm Snapdragon Consumer IOT, Snapdragon Industrial IOT…
- CVE-2022-25676Information disclosure in video due to buffer over-read while parsing avi files in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-25679Denial of service in video due to improper access control in broadcast receivers in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Qualcomm Snapdragon Compute, Snapdragon Consumer IOT, Snapd…
- CVE-2022-30768A Stored Cross Site Scripting (XSS) issue in ZoneMinder 1.36.12 allows an attacker to execute HTML or JavaScript code via the Username field
- CVE-2022-30769Session fixation exists in ZoneMinder through 1.36.12 as an attacker can poison a session cookie to the next logged-in user.
- CVE-2022-38201An unvalidated redirect vulnerability exists in Esri ArcGIS Quick Capture Web Designer versions 10.8.1 to 10.9.1.Esri ArcGIS Quickcapture
- CVE-2022-3997MonikaBrzica scm upis_u_bazu.php sql injectionMonikaBrzica scm
- CVE-2022-3998MonikaBrzica scm uredi_korisnika.php sql injectionMonikaBrzica scm
- CVE-2022-4006WBCE CMS Header class.login.php increase_attempts excessive authenticationWBCE CMS
- CVE-2022-40309Apache Archiva prior to 2.2.9 allows an authenticated user to delete arbitrary directoriesApache Software Foundation Apache Archiva · org.apache.arch…
- CVE-2022-40843The Tenda AC1200 V-W15Ev2 V15.11.0.10(1576) router is vulnerable to improper authorization / improper session management that allows the rou
- CVE-2022-40844In Tenda (Shenzhen Tenda Technology Co., Ltd) AC1200 Router model W15Ev2 V15.11.0.10(1576), a Stored Cross Site Scripting (XSS) issue exists
- CVE-2022-40845The Tenda AC1200 Router model W15Ev2 V15.11.0.10(1576) is affected by a password exposure vulnerability.
- CVE-2022-40846In Tenda AC1200 Router model W15Ev2 V15.11.0.10(1576), a Stored Cross Site Scripting (XSS) vulnerability exists allowing an attacker to exec
- CVE-2022-41916Read one byte past a buffer when normalizing Unicodeheimdal
- CVE-2022-41917Incorrect Error Handling Allowed Partial File Reads Over REST API in OpenSearchopensearch-project OpenSearch
- CVE-2022-41918Issue with fine-grained access control of indices backing data streamsopensearch-project security · org.opensearch.plugin:opensea…
- CVE-2022-42111A Cross-site scripting (XSS) vulnerability in the Sharing module's user notification in Liferay Portal 7.2.1 through 7.4.2, and Liferay DXP com.liferay:com.liferay.sharing.web · com.liferay.portal:re…
- CVE-2022-42118A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fixcom.liferay:com.liferay.portal.search.web · com.liferay.por…
- CVE-2022-42119Certain Liferay products are vulnerable to Cross Site Scripting (XSS) via the Commerce module.com.liferay.commerce:com.liferay.commerce.catalog.web · com…
- CVE-2022-42126The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does com.liferay.portal:release.portal.bom
- CVE-2022-42127The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36, and Liferay DXP 7.4 update 1 though 36 does not properly check user permcom.liferay.portal:release.portal.bom
- CVE-2022-42128The Hypermedia REST APIs module in Liferay Portal 7.4.1 through 7.4.3.4, and Liferay DXP 7.4 GA does not properly check permissions, which acom.liferay.portal:release.portal.bom
- CVE-2022-42129An Insecure direct object reference (IDOR) vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and Lifcom.liferay.portal:release.portal.bom
- CVE-2022-42130The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 19, 7.3com.liferay.portal:release.portal.bom
- CVE-2022-42131Certain Liferay products are affected by: Missing SSL Certificate Validation in the Dynamic Data Mapping module's REST data providers.com.liferay.portal:release.portal.bom
- CVE-2022-42132The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix packcom.liferay.portal:release.portal.bom · com.liferay.port… +1
- CVE-2022-43071A stack overflow in the Catalog::readPageLabelTree2(Object*) function of XPDF v4.04 allows attackers to cause a Denial of Service (DoS) via
- CVE-2022-45379Jenkins Script Security Plugin 1189.vb_a_b_7c8fd5fde and earlier stores whole-script approvals as the SHA-1 hash of the script, making it vuJenkins project Jenkins Script Security Plugin · org.jenkin…
- CVE-2022-45380Jenkins JUnit Plugin 1159.v0b_396e1e07dd and earlier converts HTTP(S) URLs in test report output to clickable links in an unsafe manner, resJenkins project Jenkins JUnit Plugin · org.jenkins-ci.plugi…
- CVE-2022-45382Jenkins Naginator Plugin 1.18.1 and earlier does not escape display names of source builds in builds that were triggered via Retry action, rJenkins project Jenkins Naginator Plugin · org.jenkins-ci.p…
- CVE-2022-45383An incorrect permission check in Jenkins Support Core Plugin 1206.v14049fa_b_d860 and earlier allows attackers with Support/DownloadBundle pJenkins project Jenkins Support Core Plugin · org.jenkins-c…
- CVE-2022-45384Jenkins Reverse Proxy Auth Plugin 1.7.3 and earlier stores the LDAP manager password unencrypted in the global config.xml file on the JenkinJenkins project Jenkins Reverse Proxy Auth Plugin · org.jen…
- CVE-2022-45386Jenkins Violations Plugin 0.7.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins project Jenkins Violations Plugin · org.jenkins-ci.…
- CVE-2022-45387Jenkins BART Plugin 1.0.3 and earlier does not escape the parsed content of build logs before rendering it on the Jenkins UI, resulting in aJenkins project Jenkins BART Plugin · org.jenkins-ci.plugin…
- CVE-2022-45389A missing permission check in Jenkins XP-Dev Plugin 1.0 and earlier allows unauthenticated attackers to trigger builds of jobs correspondingJenkins project Jenkins XP-Dev Plugin · com.cloudbees.jenki…
- CVE-2022-45390A missing permission check in Jenkins loader.io Plugin 1.0.1 and earlier allows attackers with Overall/Read permission to enumerate credentiJenkins project Jenkins loader.io Plugin · io.loader:loader…
- CVE-2022-45392Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier stores passwords unencrypted in job config.xml files on the JenJenkins project Jenkins NS-ND Integration Performance Publi…
- CVE-2022-45393A cross-site request forgery (CSRF) vulnerability in Jenkins Delete log Plugin 1.0 and earlier allows attackers to delete build logs.Jenkins project Jenkins Delete log Plugin · org.jenkins-ci.…
- CVE-2022-45394A missing permission check in Jenkins Delete log Plugin 1.0 and earlier allows attackers with Item/Read permission to delete build logs.Jenkins project Jenkins Delete log Plugin · org.jenkins-ci.…
- CVE-2022-45398A cross-site request forgery (CSRF) vulnerability in Jenkins Cluster Statistics Plugin 0.4.6 and earlier allows attackers to delete recordedJenkins project Jenkins Cluster Statistics Plugin · org.zer…
- CVE-2022-45399A missing permission check in Jenkins Cluster Statistics Plugin 0.4.6 and earlier allows attackers to delete recorded Jenkins Cluster StatisJenkins project Jenkins Cluster Statistics Plugin · org.zer…
- CVE-2022-45401Jenkins Associated Files Plugin 0.2.1 and earlier does not escape names of associated files, resulting in a stored cross-site scripting (XSSJenkins project Jenkins Associated Files Plugin · org.jenki…
- CVE-2022-45402Apache Airflow: Open redirect during loginApache Software Foundation Apache Airflow · apache-airflow