# CVEs published 2022-11-15

108 CVEs were published on November 15, 2022: 10 critical, 42 high. Days are UTC.

- [CVE-2022-3920](https://cve.now/CVE-2022-3920.md): Consul Peering Imported Nodes/Services Leak (CVSS 5.3, HashiCorp Consul · github.com/hashicorp/consul)
- [CVE-2022-27895](https://cve.now/CVE-2022-27895.md): A component in Foundry logging was found to be capturing sensitive information in logs. (CVSS 4.2, Palantir Foundry Build2)
- [CVE-2022-41558](https://cve.now/CVE-2022-41558.md): TIBCO Spotfire Stored Cross Site Scripting (XSS) Vulnerability (CVSS 9.0, TIBCO Software TIBCO Spotfire Analyst · TIBCO Software T… +2)
- [CVE-2022-43780](https://cve.now/CVE-2022-43780.md): Certain HP ENVY, OfficeJet, and DeskJet printers may be vulnerable to a Denial of Service attack. (CVSS 7.5, Certain HP ENVY, OfficeJet, and DeskJet printers)
- [CVE-2022-42001](https://cve.now/CVE-2022-42001.md): Potential XSS in book navigation (CVSS 3.3, Hallo Welt! BlueSpice)
- [CVE-2022-42000](https://cve.now/CVE-2022-42000.md): Potential XSS in comment section (CVSS 3.3, Hallo Welt! BlueSpice)
- [CVE-2022-41814](https://cve.now/CVE-2022-41814.md): Potential XSS in history view (CVSS 3.3, Hallo Welt! BlueSpice)
- [CVE-2022-41789](https://cve.now/CVE-2022-41789.md): Potential XSS on default page header (CVSS 3.3, Hallo Welt! BlueSpice)
- [CVE-2022-41611](https://cve.now/CVE-2022-41611.md): Potential XSS on sidebar navigation (CVSS 2.3, Hallo Welt! BlueSpice)
- [CVE-2022-3958](https://cve.now/CVE-2022-3958.md): Potential XSS on personal menu navigation (CVSS 3.3, Hallo Welt! BlueSpice)
- [CVE-2022-3895](https://cve.now/CVE-2022-3895.md): Potential XSS in common user interface component library (CVSS 4.0, Hallo Welt! Common User Interface Component)
- [CVE-2022-3893](https://cve.now/CVE-2022-3893.md): Potential XSS on custom menu navigation (CVSS 2.3, Hallo Welt! BlueSpice)
- [CVE-2022-3240](https://cve.now/CVE-2022-3240.md): Follow Me Plugin \<= 3.1.1 - Cross-Site Request Forgery to Cross-Site Scripting (CVSS 8.8, brian-chappell Follow Me Plugin)
- [CVE-2022-3461](https://cve.now/CVE-2022-3461.md): Buffer Overflow in PHOENIX CONTACT Automationworx Software Suite (CVSS 7.8, PHOENIX CONTACT Config+ · PHOENIX CONTACT PC Worx)
- [CVE-2022-3737](https://cve.now/CVE-2022-3737.md): Out-of-bounds Read in PHOENIX CONTACT Automationworx Software Suite (CVSS 7.8, PHOENIX CONTACT Config+ · PHOENIX CONTACT PC Worx)
- [CVE-2022-3480](https://cve.now/CVE-2022-3480.md): Denial-of-Service vulnerability in PHOENIX CONTACT mGuard product family (CVSS 7.5, PHOENIX CONTACT FL MGUARD CENTERPORT · PHOENIX CONTACT… +20)
- [CVE-2021-4240](https://cve.now/CVE-2021-4240.md): phpservermon User.php generatePasswordResetToken predictable algorithm in random number generator (CVSS 2.6, phpservermon · phpservermon/phpservermon)
- [CVE-2021-4241](https://cve.now/CVE-2021-4241.md): phpservermon User.php setUserLoggedIn predictable algorithm in random number generator (CVSS 2.6, phpservermon · phpservermon/phpservermon)
- [CVE-2022-25667](https://cve.now/CVE-2022-25667.md): Information disclosure in kernel due to improper handling of ICMP requests in Snapdragon Wired Infrastructure and Networking (CVSS 7.5, Qualcomm Snapdragon Wired Infrastructure and Networking)
- [CVE-2022-25671](https://cve.now/CVE-2022-25671.md): Denial of service in MODEM due to reachable assertion in Snapdragon Mobile (CVSS 7.5, Qualcomm Snapdragon Mobile)
- [CVE-2022-25674](https://cve.now/CVE-2022-25674.md): Cryptographic issues in WLAN during the group key handshake of the WPA/WPA2 protocol in Snapdragon Consumer IOT, Snapdragon Industrial IOT, (CVSS 6.5, Qualcomm Snapdragon Consumer IOT, Snapdragon Industrial IOT…)
- [CVE-2022-25676](https://cve.now/CVE-2022-25676.md): Information disclosure in video due to buffer over-read while parsing avi files in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer (CVSS 6.8, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2022-25679](https://cve.now/CVE-2022-25679.md): Denial of service in video due to improper access control in broadcast receivers in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon (CVSS 6.2, Qualcomm Snapdragon Compute, Snapdragon Consumer IOT, Snapd…)
- [CVE-2022-25710](https://cve.now/CVE-2022-25710.md): Denial of service due to null pointer dereference when GATT is disconnected in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industri (CVSS 7.5, Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…)
- [CVE-2022-25724](https://cve.now/CVE-2022-25724.md): Memory corruption in graphics due to buffer overflow while validating the user address in Snapdragon Auto, Snapdragon Compute, Snapdragon Co (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2022-25727](https://cve.now/CVE-2022-25727.md): Memory Corruption in modem due to improper length check while copying into memory in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Sna (CVSS 9.8, Qualcomm Snapdragon Consumer IOT, Snapdragon Industrial IOT…)
- [CVE-2022-25741](https://cve.now/CVE-2022-25741.md): Denial of service in WLAN due to potential null pointer dereference while accessing the memory location in Snapdragon Auto, Snapdragon Compu (CVSS 7.5, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2022-25742](https://cve.now/CVE-2022-25742.md): Denial of service in modem due to infinite loop while parsing IGMPv2 packet from server in Snapdragon Consumer IOT, Snapdragon Industrial IO (CVSS 7.5, Qualcomm Snapdragon Consumer IOT, Snapdragon Industrial IOT…)
- [CVE-2022-25743](https://cve.now/CVE-2022-25743.md): Memory corruption in graphics due to use-after-free while importing graphics buffer in Snapdragon Auto, Snapdragon Compute, Snapdragon Conne (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2022-29275](https://cve.now/CVE-2022-29275.md): In UsbCoreDxe, untrusted input may allow SMRAM or OS memory tampering Use of untrusted pointers could allow OS or SMRAM memory tampering lea (CVSS 8.2)
- [CVE-2022-29276](https://cve.now/CVE-2022-29276.md): SMI functions in AhciBusDxe use untrusted inputs leading to corruption of SMRAM. (CVSS 8.2)
- [CVE-2022-29277](https://cve.now/CVE-2022-29277.md): Incorrect pointer checks within the the FwBlockServiceSmm driver can allow arbitrary RAM modifications During review of the FwBlockServiceSm (CVSS 8.8)
- [CVE-2022-29278](https://cve.now/CVE-2022-29278.md): Incorrect pointer checks within the NvmExpressDxe driver can allow tampering with SMRAM and OS memory Incorrect pointer checks within the Nv (CVSS 8.2)
- [CVE-2022-29279](https://cve.now/CVE-2022-29279.md): Use of a untrusted pointer allows tampering with SMRAM and OS memory in SdHostDriver and SdMmcDevice Use of a untrusted pointer allows tampe (CVSS 8.2)
- [CVE-2022-30283](https://cve.now/CVE-2022-30283.md): In UsbCoreDxe, tampering with the contents of the USB working buffer using DMA while certain USB transactions are in process leads to a TOCT (CVSS 7.5)
- [CVE-2022-30768](https://cve.now/CVE-2022-30768.md): A Stored Cross Site Scripting (XSS) issue in ZoneMinder 1.36.12 allows an attacker to execute HTML or JavaScript code via the Username field (CVSS 5.4)
- [CVE-2022-30769](https://cve.now/CVE-2022-30769.md): Session fixation exists in ZoneMinder through 1.36.12 as an attacker can poison a session cookie to the next logged-in user. (CVSS 4.6)
- [CVE-2022-30771](https://cve.now/CVE-2022-30771.md): Initialization function in PnpSmm could lead to SMRAM corruption when using subsequent PNP SMI functions Initialization function in PnpSmm c (CVSS 8.2)
- [CVE-2022-30772](https://cve.now/CVE-2022-30772.md): Manipulation of the input address in PnpSmm function 0x52 could be used by malware to overwrite SMRAM or OS kernel memory. (CVSS 8.2)
- [CVE-2022-33234](https://cve.now/CVE-2022-33234.md): Memory corruption in video due to configuration weakness. (CVSS 7.3, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2022-33236](https://cve.now/CVE-2022-33236.md): Transient DOS due to buffer over-read in WLAN firmware while parsing cipher suite info attributes. (CVSS 7.5, Qualcomm Snapdragon Compute, Snapdragon Connectivity, Snapd…)
- [CVE-2022-33237](https://cve.now/CVE-2022-33237.md): Transient DOS due to buffer over-read in WLAN firmware while processing PPE threshold. (CVSS 7.5, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2022-33239](https://cve.now/CVE-2022-33239.md): Transient DOS due to loop with unreachable exit condition in WLAN firmware while parsing IPV6 extension header. (CVSS 7.5, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2022-38201](https://cve.now/CVE-2022-38201.md): An unvalidated redirect vulnerability exists in Esri ArcGIS Quick Capture Web Designer versions 10.8.1 to 10.9.1. (CVSS 6.1, Esri ArcGIS Quickcapture)
- [CVE-2022-38666](https://cve.now/CVE-2022-38666.md): Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.146 and earlier unconditionally disables SSL/TLS certificate and hostname valid (CVSS 7.5, Jenkins project Jenkins NS-ND Integration Performance Publi…)
- [CVE-2022-3997](https://cve.now/CVE-2022-3997.md): MonikaBrzica scm upis\_u\_bazu.php sql injection (CVSS 6.3, MonikaBrzica scm)
- [CVE-2022-3998](https://cve.now/CVE-2022-3998.md): MonikaBrzica scm uredi\_korisnika.php sql injection (CVSS 6.3, MonikaBrzica scm)
- [CVE-2022-4006](https://cve.now/CVE-2022-4006.md): WBCE CMS Header class.login.php increase\_attempts excessive authentication (CVSS 3.7, WBCE CMS)
- [CVE-2022-40308](https://cve.now/CVE-2022-40308.md): Apache Archiva prior to 2.2.9 may allow the anonymous user to read arbitrary files (CVSS 7.5, Apache Software Foundation Apache Archiva · org.apache.arch…)
- [CVE-2022-40309](https://cve.now/CVE-2022-40309.md): Apache Archiva prior to 2.2.9 allows an authenticated user to delete arbitrary directories (CVSS 4.3, Apache Software Foundation Apache Archiva · org.apache.arch…)
- [CVE-2022-40843](https://cve.now/CVE-2022-40843.md): The Tenda AC1200 V-W15Ev2 V15.11.0.10(1576) router is vulnerable to improper authorization / improper session management that allows the rou (no CVSS)
- [CVE-2022-40844](https://cve.now/CVE-2022-40844.md): In Tenda (Shenzhen Tenda Technology Co., Ltd) AC1200 Router model W15Ev2 V15.11.0.10(1576), a Stored Cross Site Scripting (XSS) issue exists (CVSS 5.4)
- [CVE-2022-40845](https://cve.now/CVE-2022-40845.md): The Tenda AC1200 Router model W15Ev2 V15.11.0.10(1576) is affected by a password exposure vulnerability. (CVSS 6.5)
- [CVE-2022-40846](https://cve.now/CVE-2022-40846.md): In Tenda AC1200 Router model W15Ev2 V15.11.0.10(1576), a Stored Cross Site Scripting (XSS) vulnerability exists allowing an attacker to exec (CVSS 4.8)
- [CVE-2022-40847](https://cve.now/CVE-2022-40847.md): In Tenda AC1200 Router model W15Ev2 V15.11.0.10(1576), there exists a command injection vulnerability in the function formSetFixTools. (CVSS 7.8)
- [CVE-2022-41395](https://cve.now/CVE-2022-41395.md): Tenda AC1200 Router Model W15Ev2 V15.11.0.10(1576) was discovered to contain a command injection vulnerability via the dmzHost parameter in (CVSS 7.8)
- [CVE-2022-41396](https://cve.now/CVE-2022-41396.md): Tenda AC1200 Router Model W15Ev2 V15.11.0.10(1576) was discovered to contain multiple command injection vulnerabilities in the function setI (CVSS 7.8)
- [CVE-2022-41916](https://cve.now/CVE-2022-41916.md): Read one byte past a buffer when normalizing Unicode (CVSS 5.9, heimdal)
- [CVE-2022-41917](https://cve.now/CVE-2022-41917.md): Incorrect Error Handling Allowed Partial File Reads Over REST API in OpenSearch (CVSS 4.3, opensearch-project OpenSearch)
- [CVE-2022-41918](https://cve.now/CVE-2022-41918.md): Issue with fine-grained access control of indices backing data streams (CVSS 6.3, opensearch-project security · org.opensearch.plugin:opensea…)
- [CVE-2022-42053](https://cve.now/CVE-2022-42053.md): Tenda AC1200 Router Model W15Ev2 V15.11.0.10(1576) was discovered to contain a command injection vulnerability via the PortMappingServer par (CVSS 7.8)
- [CVE-2022-42058](https://cve.now/CVE-2022-42058.md): Tenda AC1200 Router Model W15Ev2 V15.11.0.10(1576) was discovered to contain a stack overflow via the setRemoteWebManage function. (CVSS 9.8)
- [CVE-2022-42060](https://cve.now/CVE-2022-42060.md): Tenda AC1200 Router Model W15Ev2 V15.11.0.10(1576) was discovered to contain a stack overflow via the setWanPpoe function. (CVSS 7.5)
- [CVE-2022-42111](https://cve.now/CVE-2022-42111.md): A Cross-site scripting (XSS) vulnerability in the Sharing module's user notification in Liferay Portal 7.2.1 through 7.4.2, and Liferay DXP (no CVSS, com.liferay:com.liferay.sharing.web · com.liferay.portal:re…)
- [CVE-2022-42118](https://cve.now/CVE-2022-42118.md): A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix (CVSS 6.1, com.liferay:com.liferay.portal.search.web · com.liferay.por…)
- [CVE-2022-42119](https://cve.now/CVE-2022-42119.md): Certain Liferay products are vulnerable to Cross Site Scripting (XSS) via the Commerce module. (CVSS 5.4, com.liferay.commerce:com.liferay.commerce.catalog.web · com…)
- [CVE-2022-42120](https://cve.now/CVE-2022-42120.md): A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through 7.4.3.16, and Liferay DXP 7.3 before update 4, and 7.4 (CVSS 9.8, com.liferay:com.liferay.fragment.service · com.liferay.port…)
- [CVE-2022-42121](https://cve.now/CVE-2022-42121.md): A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 befo (CVSS 8.8, com.liferay:com.liferay.layout.page.template.service · com.…)
- [CVE-2022-42122](https://cve.now/CVE-2022-42122.md): A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and Liferay DXP 7.3 fix pack 2 through update 4 allows att (CVSS 9.8, com.liferay.portal:release.portal.bom · com.liferay.port… +1)
- [CVE-2022-42123](https://cve.now/CVE-2022-42123.md): A Zip slip vulnerability in the Elasticsearch Connector in Liferay Portal 7.3.3 through 7.4.3.18, and Liferay DXP 7.3 before update 6, and 7 (CVSS 7.5, com.liferay.portal:release.portal.bom)
- [CVE-2022-42124](https://cve.now/CVE-2022-42124.md): ReDoS vulnerability in LayoutPageTemplateEntryUpgradeProcess in Liferay Portal 7.3.2 through 7.4.3.4 and Liferay DXP 7.2 fix pack 9 through (CVSS 7.5, com.liferay.portal:release.portal.bom)
- [CVE-2022-42125](https://cve.now/CVE-2022-42125.md): Zip slip vulnerability in FileUtil.unzip in Liferay Portal 7.4.3.5 through 7.4.3.35 and Liferay DXP 7.4 update 1 through update 34 allows at (CVSS 7.5, com.liferay.portal:release.portal.bom)
- [CVE-2022-42126](https://cve.now/CVE-2022-42126.md): The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does (CVSS 4.3, com.liferay.portal:release.portal.bom)
- [CVE-2022-42127](https://cve.now/CVE-2022-42127.md): The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36, and Liferay DXP 7.4 update 1 though 36 does not properly check user perm (CVSS 5.3, com.liferay.portal:release.portal.bom)
- [CVE-2022-42128](https://cve.now/CVE-2022-42128.md): The Hypermedia REST APIs module in Liferay Portal 7.4.1 through 7.4.3.4, and Liferay DXP 7.4 GA does not properly check permissions, which a (CVSS 5.3, com.liferay.portal:release.portal.bom)
- [CVE-2022-42129](https://cve.now/CVE-2022-42129.md): An Insecure direct object reference (IDOR) vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and Lif (CVSS 4.3, com.liferay.portal:release.portal.bom)
- [CVE-2022-42130](https://cve.now/CVE-2022-42130.md): The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 19, 7.3 (CVSS 4.3, com.liferay.portal:release.portal.bom)
- [CVE-2022-42131](https://cve.now/CVE-2022-42131.md): Certain Liferay products are affected by: Missing SSL Certificate Validation in the Dynamic Data Mapping module's REST data providers. (CVSS 4.8, com.liferay.portal:release.portal.bom)
- [CVE-2022-42132](https://cve.now/CVE-2022-42132.md): The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix pack (CVSS 5.9, com.liferay.portal:release.portal.bom · com.liferay.port… +1)
- [CVE-2022-42977](https://cve.now/CVE-2022-42977.md): The Netic User Export add-on before 1.3.5 for Atlassian Confluence has the functionality to generate a list of users in the application, and (CVSS 7.5)
- [CVE-2022-42978](https://cve.now/CVE-2022-42978.md): In the Netic User Export add-on before 1.3.5 for Atlassian Confluence, authorization is mishandled. (CVSS 7.5)
- [CVE-2022-43071](https://cve.now/CVE-2022-43071.md): A stack overflow in the Catalog::readPageLabelTree2(Object\*) function of XPDF v4.04 allows attackers to cause a Denial of Service (DoS) via (CVSS 5.5)
- [CVE-2022-43265](https://cve.now/CVE-2022-43265.md): An arbitrary file upload vulnerability in the component /pages/save\_user.php of Canteen Management System v1.0 allows attackers to execute a (CVSS 9.8)
- [CVE-2022-43279](https://cve.now/CVE-2022-43279.md): LimeSurvey before v5.0.4 was discovered to contain a SQL injection vulnerability via the component /application/views/themeOptions/update.ph (CVSS 7.2)
- [CVE-2022-45379](https://cve.now/CVE-2022-45379.md): Jenkins Script Security Plugin 1189.vb\_a\_b\_7c8fd5fde and earlier stores whole-script approvals as the SHA-1 hash of the script, making it vu (no CVSS, Jenkins project Jenkins Script Security Plugin · org.jenkin…)
- [CVE-2022-45380](https://cve.now/CVE-2022-45380.md): Jenkins JUnit Plugin 1159.v0b\_396e1e07dd and earlier converts HTTP(S) URLs in test report output to clickable links in an unsafe manner, res (CVSS 5.4, Jenkins project Jenkins JUnit Plugin · org.jenkins-ci.plugi…)
- [CVE-2022-45381](https://cve.now/CVE-2022-45381.md): Jenkins Pipeline Utility Steps Plugin 2.13.1 and earlier does not restrict the set of enabled prefix interpolators and bundles versions of A (CVSS 8.1, Jenkins project Jenkins Pipeline Utility Steps Plugin · org…)
- [CVE-2022-45382](https://cve.now/CVE-2022-45382.md): Jenkins Naginator Plugin 1.18.1 and earlier does not escape display names of source builds in builds that were triggered via Retry action, r (CVSS 5.4, Jenkins project Jenkins Naginator Plugin · org.jenkins-ci.p…)
- [CVE-2022-45383](https://cve.now/CVE-2022-45383.md): An incorrect permission check in Jenkins Support Core Plugin 1206.v14049fa\_b\_d860 and earlier allows attackers with Support/DownloadBundle p (CVSS 6.5, Jenkins project Jenkins Support Core Plugin · org.jenkins-c…)
- [CVE-2022-45384](https://cve.now/CVE-2022-45384.md): Jenkins Reverse Proxy Auth Plugin 1.7.3 and earlier stores the LDAP manager password unencrypted in the global config.xml file on the Jenkin (CVSS 6.5, Jenkins project Jenkins Reverse Proxy Auth Plugin · org.jen…)
- [CVE-2022-45385](https://cve.now/CVE-2022-45385.md): A missing permission check in Jenkins CloudBees Docker Hub/Registry Notification Plugin 2.6.2 and earlier allows unauthenticated attackers t (CVSS 7.5, Jenkins project Jenkins CloudBees Docker Hub/Registry Notif…)
- [CVE-2022-45386](https://cve.now/CVE-2022-45386.md): Jenkins Violations Plugin 0.7.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (CVSS 5.5, Jenkins project Jenkins Violations Plugin · org.jenkins-ci.…)
- [CVE-2022-45387](https://cve.now/CVE-2022-45387.md): Jenkins BART Plugin 1.0.3 and earlier does not escape the parsed content of build logs before rendering it on the Jenkins UI, resulting in a (CVSS 5.4, Jenkins project Jenkins BART Plugin · org.jenkins-ci.plugin…)
- [CVE-2022-45388](https://cve.now/CVE-2022-45388.md): Jenkins Config Rotator Plugin 2.0.1 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing unauthenticated (CVSS 7.5, Jenkins project Jenkins Config Rotator Plugin · org.jenkins…)
- [CVE-2022-45389](https://cve.now/CVE-2022-45389.md): A missing permission check in Jenkins XP-Dev Plugin 1.0 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding (CVSS 5.3, Jenkins project Jenkins XP-Dev Plugin · com.cloudbees.jenki…)
- [CVE-2022-45390](https://cve.now/CVE-2022-45390.md): A missing permission check in Jenkins loader.io Plugin 1.0.1 and earlier allows attackers with Overall/Read permission to enumerate credenti (CVSS 4.3, Jenkins project Jenkins loader.io Plugin · io.loader:loader…)
- [CVE-2022-45391](https://cve.now/CVE-2022-45391.md): Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier globally and unconditionally disables SSL/TLS certificate and h (CVSS 7.5, Jenkins project Jenkins NS-ND Integration Performance Publi…)
- [CVE-2022-45392](https://cve.now/CVE-2022-45392.md): Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier stores passwords unencrypted in job config.xml files on the Jen (CVSS 6.5, Jenkins project Jenkins NS-ND Integration Performance Publi…)
- [CVE-2022-45393](https://cve.now/CVE-2022-45393.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Delete log Plugin 1.0 and earlier allows attackers to delete build logs. (CVSS 3.5, Jenkins project Jenkins Delete log Plugin · org.jenkins-ci.…)
- [CVE-2022-45394](https://cve.now/CVE-2022-45394.md): A missing permission check in Jenkins Delete log Plugin 1.0 and earlier allows attackers with Item/Read permission to delete build logs. (CVSS 4.3, Jenkins project Jenkins Delete log Plugin · org.jenkins-ci.…)
- [CVE-2022-45395](https://cve.now/CVE-2022-45395.md): Jenkins CCCC Plugin 0.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (CVSS 9.8, Jenkins project Jenkins CCCC Plugin · com.thalesgroup.jenki…)
- [CVE-2022-45396](https://cve.now/CVE-2022-45396.md): Jenkins SourceMonitor Plugin 0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (CVSS 9.8, Jenkins project Jenkins SourceMonitor Plugin · com.thalesgr…)
- [CVE-2022-45397](https://cve.now/CVE-2022-45397.md): Jenkins OSF Builder Suite : : XML Linter Plugin 1.0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) att (CVSS 9.8, Jenkins project Jenkins OSF Builder Suite : : XML Linter Pl…)
- [CVE-2022-45398](https://cve.now/CVE-2022-45398.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Cluster Statistics Plugin 0.4.6 and earlier allows attackers to delete recorded (CVSS 4.3, Jenkins project Jenkins Cluster Statistics Plugin · org.zer…)
- [CVE-2022-45399](https://cve.now/CVE-2022-45399.md): A missing permission check in Jenkins Cluster Statistics Plugin 0.4.6 and earlier allows attackers to delete recorded Jenkins Cluster Statis (CVSS 4.3, Jenkins project Jenkins Cluster Statistics Plugin · org.zer…)
- [CVE-2022-45400](https://cve.now/CVE-2022-45400.md): Jenkins JAPEX Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (CVSS 9.8, Jenkins project Jenkins JAPEX Plugin · org.jvnet.hudson.plu…)
- [CVE-2022-45401](https://cve.now/CVE-2022-45401.md): Jenkins Associated Files Plugin 0.2.1 and earlier does not escape names of associated files, resulting in a stored cross-site scripting (XSS (CVSS 5.4, Jenkins project Jenkins Associated Files Plugin · org.jenki…)
- [CVE-2022-45402](https://cve.now/CVE-2022-45402.md): Apache Airflow: Open redirect during login (CVSS 6.1, Apache Software Foundation Apache Airflow · apache-airflow)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-11-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.