CVEs published November 16, 2022
44 CVEs were published on November 16, 2022: 12 critical, 5 high.
- Published
- 44
- Critical
- 12
- High
- 5
- Medium
- 24
- Low
- 2
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 13
Most affected products
- FreeRDP
- 7
- tribalsystems/zenario
- 4
- Hospital Management Center
- 2
- Apache Software Foundation Apache MINA SSHD · org.apache… +1
- 1
- benbodhi SVG Support
- 1
- FeehiCMS · feehi/feehicms
- 1
- IBM InfoSphere DataStage
- 1
- IBM Partner Engagement Manager
- 1
- ikus060/rdiffweb · rdiffweb
- 1
- Karmasis Informatics Infraskope SIEM+
- 1
Critical 12
- CVE-2022-2166Improper Restriction of Excessive Authentication Attempts in mastodon/mastodonmastodon/mastodon
- CVE-2022-3980An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in Sophos Mobile managed oSophos Mobile managed on-premises
- CVE-2022-40752IBM InfoSphere DataStage 11.7 is vulnerable to a command injection vulnerability due to improper neutralization of special elements.IBM InfoSphere DataStage
- CVE-2022-43135Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at /diagnost
- CVE-2022-43234An arbitrary file upload vulnerability in the /attachments component of Hoosk v1.8 allows attackers to execute arbitrary code via a crafted
- CVE-2022-43256SeaCms before v12.6 was discovered to contain a SQL injection vulnerability via the component /js/player/dmplayer/dmku/index.php.
- CVE-2022-43999An issue was discovered in BACKCLICK Professional 5.9.63.
- CVE-2022-44000An issue was discovered in BACKCLICK Professional 5.9.63.
- CVE-2022-44003An issue was discovered in BACKCLICK Professional 5.9.63.
- CVE-2022-44004An issue was discovered in BACKCLICK Professional 5.9.63.
- CVE-2022-44006An issue was discovered in BACKCLICK Professional 5.9.63.
- CVE-2022-45047Apache MINA SSHD: Java unsafe deserialization vulnerabilityApache Software Foundation Apache MINA SSHD · org.apache… +1
High 5
- CVE-2022-4021Permalink Manager Lite <= 2.2.20.1 - Cross-Site Request Forgerymbis Permalink Manager Lite
- CVE-2022-24036Unauthorized modification in Karmasis Informatics Infraskope SIEM+Karmasis Informatics Infraskope SIEM+
- CVE-2021-38819A SQL injection vulnerability exits on the Simple Image Gallery System 1.0 application through "id" parameter on the album page.
- CVE-2022-43264Arobas Music Guitar Pro for iPad and iPhone before v1.10.2 allows attackers to perform directory traversal and download arbitrary files via
- CVE-2022-44007An issue was discovered in BACKCLICK Professional 5.9.63.
Medium, low and unrated 27
- CVE-2022-34354IBM Sterling Partner Engagement Manager information disclosureIBM Partner Engagement Manager
- CVE-2022-4022The SVG Support plugin for WordPress defaults to insecure settings in version 2.5 and 2.5.1.benbodhi SVG Support
- CVE-2022-39316Out of bound read in FreeRDPFreeRDP
- CVE-2022-39317Out of bounds read in zgfx decoder in FreeRDPFreeRDP
- CVE-2022-39318Division by zero in urbdrc channel in FreeRDPFreeRDP
- CVE-2022-39319Missing length validation in urbdrc channel in FreeRDPFreeRDP
- CVE-2022-39320Heap buffer overflow in urbdrc channelFreeRDP
- CVE-2022-39347Missing path sanitation with `drive` channel in FreeRDPFreeRDP
- CVE-2022-39383SSRF vulnerability in KubeVela VelaUX APIServerkubevela · github.com/oam-dev/kubevela
- CVE-2022-4011Simple History Plugin Header neutralization for logsSimple History Plugin
- CVE-2022-4012Hospital Management Center patient-info.php sql injectionHospital Management Center
- CVE-2022-4013Hospital Management Center appointment.php cross-site request forgeryHospital Management Center
- CVE-2022-4014FeehiCMS Post My Comment Tab cross-site request forgeryFeehiCMS · feehi/feehicms
- CVE-2022-4015Sports Club Management System make_payments.php sql injectionSports Club Management System
- CVE-2022-4018Missing Authentication for Critical Function in ikus060/rdiffwebikus060/rdiffweb · rdiffweb
- CVE-2022-41877Missing input length validation in `drive` channel in FreeRDPFreeRDP
- CVE-2022-41914Non-constant-time SCIM token comparison in Zulip Serverzulip
- CVE-2022-42960EqualWeb Accessibility Widget 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.1.10, 3.0.0, 3.0.1, 3.0.2, 4.0.0, and 4.0.1 allows DOM XSS due to imprope
- CVE-2022-43262Human Resource Management System v1.0 was discovered to contain a SQL injection vulnerability via the password parameter at /hrm/controller/
- CVE-2022-43263A cross-site scripting (XSS) vulnerability in Arobas Music Guitar Pro for iPad and iPhone before v1.10.2 allows attackers to execute arbitra
- CVE-2022-44002An issue was discovered in BACKCLICK Professional 5.9.63.
- CVE-2022-44005An issue was discovered in BACKCLICK Professional 5.9.63.
- CVE-2022-44008An issue was discovered in BACKCLICK Professional 5.9.63.
- CVE-2022-44069Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via the Nest library module.tribalsystems/zenario
- CVE-2022-44070Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via News articles.tribalsystems/zenario
- CVE-2022-44071Zenario CMS 9.3.57186 is is vulnerable to Cross Site Scripting (XSS) via profile.tribalsystems/zenario
- CVE-2022-44073Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via svg,Users & Contacts.tribalsystems/zenario