# CVEs published 2022-11-16

44 CVEs were published on November 16, 2022: 12 critical, 5 high. Days are UTC.

- [CVE-2022-34354](https://cve.now/CVE-2022-34354.md): IBM Sterling Partner Engagement Manager information disclosure (CVSS 4.0, IBM Partner Engagement Manager)
- [CVE-2022-4022](https://cve.now/CVE-2022-4022.md): The SVG Support plugin for WordPress defaults to insecure settings in version 2.5 and 2.5.1. (CVSS 6.4, benbodhi SVG Support)
- [CVE-2022-4021](https://cve.now/CVE-2022-4021.md): Permalink Manager Lite \<= 2.2.20.1 - Cross-Site Request Forgery (CVSS 8.8, mbis Permalink Manager Lite)
- [CVE-2022-24036](https://cve.now/CVE-2022-24036.md): Unauthorized modification in Karmasis Informatics Infraskope SIEM+ (CVSS 8.6, Karmasis Informatics Infraskope SIEM+)
- [CVE-2021-38819](https://cve.now/CVE-2021-38819.md): A SQL injection vulnerability exits on the Simple Image Gallery System 1.0 application through "id" parameter on the album page. (CVSS 8.8)
- [CVE-2022-2166](https://cve.now/CVE-2022-2166.md): Improper Restriction of Excessive Authentication Attempts in mastodon/mastodon (CVSS 9.8, mastodon/mastodon)
- [CVE-2022-39316](https://cve.now/CVE-2022-39316.md): Out of bound read in FreeRDP (CVSS 4.8, FreeRDP)
- [CVE-2022-39317](https://cve.now/CVE-2022-39317.md): Out of bounds read in zgfx decoder in FreeRDP (CVSS 4.6, FreeRDP)
- [CVE-2022-39318](https://cve.now/CVE-2022-39318.md): Division by zero in urbdrc channel in FreeRDP (CVSS 4.8, FreeRDP)
- [CVE-2022-39319](https://cve.now/CVE-2022-39319.md): Missing length validation in urbdrc channel in FreeRDP (CVSS 4.6, FreeRDP)
- [CVE-2022-39320](https://cve.now/CVE-2022-39320.md): Heap buffer overflow in urbdrc channel (CVSS 5.5, FreeRDP)
- [CVE-2022-39347](https://cve.now/CVE-2022-39347.md): Missing path sanitation with \`drive\` channel in FreeRDP (CVSS 2.6, FreeRDP)
- [CVE-2022-39383](https://cve.now/CVE-2022-39383.md): SSRF vulnerability in KubeVela VelaUX APIServer (CVSS 4.9, kubevela · github.com/oam-dev/kubevela)
- [CVE-2022-3980](https://cve.now/CVE-2022-3980.md): An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in Sophos Mobile managed o (CVSS 9.8, Sophos Mobile managed on-premises)
- [CVE-2022-4011](https://cve.now/CVE-2022-4011.md): Simple History Plugin Header neutralization for logs (CVSS 6.5, Simple History Plugin)
- [CVE-2022-4012](https://cve.now/CVE-2022-4012.md): Hospital Management Center patient-info.php sql injection (CVSS 6.3, Hospital Management Center)
- [CVE-2022-4013](https://cve.now/CVE-2022-4013.md): Hospital Management Center appointment.php cross-site request forgery (CVSS 4.3, Hospital Management Center)
- [CVE-2022-4014](https://cve.now/CVE-2022-4014.md): FeehiCMS Post My Comment Tab cross-site request forgery (CVSS 4.3, FeehiCMS · feehi/feehicms)
- [CVE-2022-4015](https://cve.now/CVE-2022-4015.md): Sports Club Management System make\_payments.php sql injection (CVSS 4.7, Sports Club Management System)
- [CVE-2022-4018](https://cve.now/CVE-2022-4018.md): Missing Authentication for Critical Function in ikus060/rdiffweb (CVSS 6.1, ikus060/rdiffweb · rdiffweb)
- [CVE-2022-40752](https://cve.now/CVE-2022-40752.md): IBM InfoSphere DataStage 11.7 is vulnerable to a command injection vulnerability due to improper neutralization of special elements. (CVSS 9.8, IBM InfoSphere DataStage)
- [CVE-2022-41877](https://cve.now/CVE-2022-41877.md): Missing input length validation in \`drive\` channel in FreeRDP (CVSS 4.6, FreeRDP)
- [CVE-2022-41914](https://cve.now/CVE-2022-41914.md): Non-constant-time SCIM token comparison in Zulip Server (CVSS 3.7, zulip)
- [CVE-2022-42960](https://cve.now/CVE-2022-42960.md): EqualWeb Accessibility Widget 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.1.10, 3.0.0, 3.0.1, 3.0.2, 4.0.0, and 4.0.1 allows DOM XSS due to imprope (CVSS 5.4)
- [CVE-2022-43135](https://cve.now/CVE-2022-43135.md): Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at /diagnost (CVSS 9.8)
- [CVE-2022-43234](https://cve.now/CVE-2022-43234.md): An arbitrary file upload vulnerability in the /attachments component of Hoosk v1.8 allows attackers to execute arbitrary code via a crafted (CVSS 9.8)
- [CVE-2022-43256](https://cve.now/CVE-2022-43256.md): SeaCms before v12.6 was discovered to contain a SQL injection vulnerability via the component /js/player/dmplayer/dmku/index.php. (CVSS 9.8)
- [CVE-2022-43262](https://cve.now/CVE-2022-43262.md): Human Resource Management System v1.0 was discovered to contain a SQL injection vulnerability via the password parameter at /hrm/controller/ (no CVSS)
- [CVE-2022-43263](https://cve.now/CVE-2022-43263.md): A cross-site scripting (XSS) vulnerability in Arobas Music Guitar Pro for iPad and iPhone before v1.10.2 allows attackers to execute arbitra (CVSS 6.1)
- [CVE-2022-43264](https://cve.now/CVE-2022-43264.md): Arobas Music Guitar Pro for iPad and iPhone before v1.10.2 allows attackers to perform directory traversal and download arbitrary files via (CVSS 7.5)
- [CVE-2022-43999](https://cve.now/CVE-2022-43999.md): An issue was discovered in BACKCLICK Professional 5.9.63. (CVSS 9.8)
- [CVE-2022-44000](https://cve.now/CVE-2022-44000.md): An issue was discovered in BACKCLICK Professional 5.9.63. (CVSS 9.8)
- [CVE-2022-44002](https://cve.now/CVE-2022-44002.md): An issue was discovered in BACKCLICK Professional 5.9.63. (CVSS 6.1)
- [CVE-2022-44003](https://cve.now/CVE-2022-44003.md): An issue was discovered in BACKCLICK Professional 5.9.63. (CVSS 9.8)
- [CVE-2022-44004](https://cve.now/CVE-2022-44004.md): An issue was discovered in BACKCLICK Professional 5.9.63. (CVSS 9.8)
- [CVE-2022-44005](https://cve.now/CVE-2022-44005.md): An issue was discovered in BACKCLICK Professional 5.9.63. (CVSS 5.3)
- [CVE-2022-44006](https://cve.now/CVE-2022-44006.md): An issue was discovered in BACKCLICK Professional 5.9.63. (CVSS 9.8)
- [CVE-2022-44007](https://cve.now/CVE-2022-44007.md): An issue was discovered in BACKCLICK Professional 5.9.63. (CVSS 8.8)
- [CVE-2022-44008](https://cve.now/CVE-2022-44008.md): An issue was discovered in BACKCLICK Professional 5.9.63. (CVSS 6.5)
- [CVE-2022-44069](https://cve.now/CVE-2022-44069.md): Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via the Nest library module. (CVSS 5.4, tribalsystems/zenario)
- [CVE-2022-44070](https://cve.now/CVE-2022-44070.md): Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via News articles. (CVSS 5.4, tribalsystems/zenario)
- [CVE-2022-44071](https://cve.now/CVE-2022-44071.md): Zenario CMS 9.3.57186 is is vulnerable to Cross Site Scripting (XSS) via profile. (CVSS 5.4, tribalsystems/zenario)
- [CVE-2022-44073](https://cve.now/CVE-2022-44073.md): Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via svg,Users & Contacts. (CVSS 5.4, tribalsystems/zenario)
- [CVE-2022-45047](https://cve.now/CVE-2022-45047.md): Apache MINA SSHD: Java unsafe deserialization vulnerability (CVSS 9.8, Apache Software Foundation Apache MINA SSHD · org.apache… +1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-11-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.