CVEs published November 17, 2022
88 CVEs were published on November 17, 2022: 12 critical, 32 high. 1 is now in CISA KEV.
- Published
- 88
- Critical
- 12
- High
- 32
- Medium
- 41
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 12
Most affected products
- Siemens syngo Dynamics
- 7
- Android
- 5
- Delta Electronics DIAEnergie
- 5
- OnTheGoSystems WPML Multilingual CMS
- 3
- College Management System
- 2
- Ezoic
- 2
- gVectors Team wpForo Forum
- 2
- Student Attendance Management System
- 2
- webvendome
- 2
- Atlassian Bitbucket Data Center · Atlassian Bitbucket Server
- 1
Critical 12
- CVE-2022-39180College Management System v1.0 - SQL Injection (SQLi)College Management System
- CVE-2022-36784Elsight – Elsight Halo Remote Code Execution (RCE)Elsight Halo
- CVE-2022-36787webvendome - webvendome SQL Injectionwebvendome
- CVE-2022-40200WordPress wpForo Forum plugin <= 2.0.9 - Auth. Arbitrary File Upload vulnerabilitygVectors Team wpForo Forum
- CVE-2022-43782Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd application via security misconfiguration and subsequentAtlassian Crowd Data Center · Atlassian Crowd Server
- CVE-2022-43781There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center.Atlassian Bitbucket Data Center · Atlassian Bitbucket Server
- CVE-2022-36786DLINK - DSL-224 Post-auth RCE.D-Link DSL-224
- CVE-2022-38165Arbitrary file write in F-Secure Policy Manager through 2022-08-10 allows unauthenticated users to write the file with the contents in arbit
- CVE-2022-40881SolarView Compact 6.00 was discovered to contain a command injection vulnerability via network_test.php
- CVE-2022-42245Dreamer CMS 4.0.01 is vulnerable to SQL Injection.
- CVE-2022-43138Dolibarr Open Source ERP & CRM for Business before v14.0.1 allows attackers to escalate privileges via a crafted API.dolibarr/dolibarr
- CVE-2022-44001An issue was discovered in BACKCLICK Professional 5.9.63.
High 32
- CVE-2022-43506Delta Electronics DIAEnergie SQL InjectionDelta Electronics DIAEnergie
- CVE-2022-41775Delta Electronics DIAEnergie SQL InjectionDelta Electronics DIAEnergie
- CVE-2022-43452Delta Electronics DIAEnergie SQL InjectionDelta Electronics DIAEnergie
- CVE-2022-43457Delta Electronics DIAEnergie SQL InjectionDelta Electronics DIAEnergie
- CVE-2022-43447Delta Electronics DIAEnergie SQL InjectionDelta Electronics DIAEnergie
- CVE-2022-36924Local Privilege Escalation in Zoom Rooms Installer for WindowsZoom Video Communications Zoom Rooms Installer for Windows
- CVE-2022-28768Local Privilege Escalation in Zoom Client Installer for macOSZoom Video Communications Zoom Client for Meetings Installe…
- CVE-2022-36785D-Link – G integrated Access Device4 Information Disclosure & Authorization Bypass.D-Link G integrated Access Device4
- CVE-2022-39179College Management System v1.0 - Authenticated remote code executionCollege Management System
- CVE-2022-40192WordPress wpForo Forum plugin <= 2.0.9 - Cross-Site Request Forgery (CSRF) vulnerabilitygVectors Team wpForo Forum
- CVE-2022-3090Red Lion Controls Crimson 3.0 versions 707.000 and prior, Crimson 3.1 versions 3126.001 and prior, and Crimson 3.2 versions 3.2.0044.0 and pRed Lion Controls Crimson
- CVE-2022-23748mDNSResponder.exe is vulnerable to DLL Sideloading attack.Audinate Dante Application Library for Windows
- CVE-2022-39389Witness Block Parsing DoS Vulnerability in lndlightningnetwork lnd · github.com/lightningnetwork/lnd
- CVE-2022-42246Doufox 0.0.4 contains a CSRF vulnerability that can add system administrator account.
- CVE-2022-42533In shared_metadata_init of SharedMetadata.cpp, there is a possible out of bounds write due to an integer overflow.Android
- CVE-2022-42732A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01).Siemens syngo Dynamics
- CVE-2022-42733A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01).Siemens syngo Dynamics
- CVE-2022-42734A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01).Siemens syngo Dynamics
- CVE-2022-42891A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01).Siemens syngo Dynamics
- CVE-2022-42893A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01).Siemens syngo Dynamics
- CVE-2022-42894A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01).Siemens syngo Dynamics
- CVE-2022-42982BKG Professional NtripCaster 2.0.39 allows querying information over the UDP protocol without authentication.
- CVE-2022-43140kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component cn.keking.web.controller.OnlinePreviewCon
- CVE-2022-43162Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /tests/view_tes
- CVE-2022-43163Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /clients/view_c
- CVE-2022-43179Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /admin/?page=user/manage_user&
- CVE-2022-43183XXL-Job before v2.3.1 contains a Server-Side Request Forgery (SSRF) via the component /admin/controller/JobLogController.java.com.xuxueli:xxl-job-core
- CVE-2022-44384An arbitrary file upload vulnerability in rconfig v3.9.6 allows attackers to execute arbitrary code via a crafted PHP file.
- CVE-2022-44402Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/classes/Master.php?f=delete_transaction.
- CVE-2022-44403Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/admin/?page=user/manage_user&id=.
- CVE-2022-44725OPC Foundation Local Discovery Server (LDS) through 1.04.403.478 uses a hard-coded file path to a configuration file.
- CVE-2022-45461The Java Admin Console in Veritas NetBackup through 10.1 and related Veritas products on Linux and UNIX allows authenticated non-root users
Medium, low and unrated 44
- CVE-2022-24939 Malformed Zigbee packet with invalid destination address causes Assert silabs.com Ember ZNet
- CVE-2022-28766DLL injection in Zoom Windows ClientsZoom Video Communications Zoom Client for Meetings for W… +1
- CVE-2022-39178Webvendome - webvendome Internal Server IP Disclosurewebvendome
- CVE-2022-39181GLPI - Reports plugin for GLPI Reflected Cross-Site-Scripting (RXSS)Reports plugin for GLPI
- CVE-2022-45069WordPress Crowdsignal Dashboard plugin <= 3.0.9 - Privilege Escalation vulnerabilityAutomattic Crowdsignal Dashboard – Polls, Surveys & more
- CVE-2022-40694WordPress News Announcement Scroll plugin <= 8.8.8 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityStoreApps News Announcement Scroll
- CVE-2022-44736WordPress Chameleon plugin <= 1.4.3 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityFahad Mahmood Chameleon
- CVE-2022-41315WordPress Ezoic plugin <= 2.8.8 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityEzoic
- CVE-2022-41132WordPress Ezoic plugin <= 2.8.8 - Unauthenticated Plugin Settings Change Leading To Stored XSS VulnerabilityEzoic
- CVE-2022-44591WordPress Anthologize plugin <= 0.8.0 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityOne Week | One Tool Anthologize
- CVE-2022-41791WordPress ProfileGrid plugin <= 5.1.6 - Auth. CSV Injection vulnerabilityProfileGrid
- CVE-2022-45077WordPress Betheme theme <= 26.5.1.4 - Auth. PHP Object Injection vulnerabilityMuffingroup Betheme
- CVE-2022-36357WordPress ULTIMATE TABLES plugin <= 1.6.5 - Unauth. Reflected Cross-Site Scripting (XSS) vulnerabilityWebpsilon ULTIMATE TABLES
- CVE-2022-45066WordPress WooSwipe WooCommerce Gallery plugin <= 2.0.1 - Auth. Broken Access Control vulnerabilityThrive Website Design WooSwipe WooCommerce Gallery
- CVE-2022-45375WordPress iFeature Slider plugin <= 1.2 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityCyberChimps iFeature Slider
- CVE-2021-36905WordPress Quiz And Survey Master plugin <= 7.3.4 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilitiesExpressTech Quiz And Survey Master
- CVE-2022-38461WordPress WPML Multilingual CMS premium plugin <= 4.5.10 - Broken Access Control vulnerabilityOnTheGoSystems WPML Multilingual CMS
- CVE-2022-45071WordPress WPML Multilingual CMS premium plugin <= 4.5.13 - Cross-Site Request Forgery (CSRF) vulnerabilityOnTheGoSystems WPML Multilingual CMS
- CVE-2022-45072WordPress WPML Multilingual CMS premium plugin <= 4.5.13 - Cross-Site Request Forgery (CSRF) vulnerabilityOnTheGoSystems WPML Multilingual CMS
- CVE-2022-32537Medtronic MiniMed 600 Series Pump System Communication IssueMedtronic Minimed 600 Series Insulin Pump
- CVE-2022-38390Multiple IBM Business Automation Workflow versions are vulnerable to cross-site scripting.IBM Business Automation Workflow
- CVE-2022-40751IBM UrbanCode Deploy information disclosureIBM UrbanCode Deploy
- CVE-2021-31608Proofpoint Enterprise Protection before 18.8.0 allows a Bypass of a Security Control.
- CVE-2021-33897A buffer overflow in Synthesia before 10.7.5567, when a non-Latin locale is used, allows user-assisted attackers to cause a denial of servic
- CVE-2022-20427In (TBD) of (TBD), there is a possible way to corrupt memory due to improper input validation.Android
- CVE-2022-20428In (TBD) of (TBD), there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2022-20459In (TBD) of (TBD), there is a possible way to redirect code execution due to improper input validation.Android
- CVE-2022-20460In (TBD) mprot_unmap? of (TBD), there is a possible way to corrupt the memory mapping due to improper input validation.Android
- CVE-2022-36432The Preview functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 uses eval unsafely.
- CVE-2022-39834A stored XSS vulnerability was discovered in adminweb/ra/viewendentity.jsp in PrimeKey EJBCA through 7.9.0.2.
- CVE-2022-4051Hostel Searching Project view-property.php sql injectionHostel Searching Project
- CVE-2022-4052Student Attendance Management System createClass.php sql injectionStudent Attendance Management System
- CVE-2022-4053Student Attendance Management System createClass.php cross site scriptingStudent Attendance Management System
- CVE-2022-41920Zip slip in Lancetduke-git lancet · github.com/duke-git/lancet +1
- CVE-2022-42187Hustoj 22.09.22 has a XSS Vulnerability in /admin/problem_judge.php.
- CVE-2022-42892A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01).Siemens syngo Dynamics
- CVE-2022-42903Zoho ManageEngine SupportCenter Plus through 11024 allows low-privileged users to view the organization users list.
- CVE-2022-42954Keyfactor EJBCA before 7.10.0 allows XSS.
- CVE-2022-42985The ScratchLogin extension through 1.1 for MediaWiki does not escape verification failure messages, which allows users with administrator pr
- CVE-2022-43096Mediatrix 4102 before v48.5.2718 allows local attackers to gain root access via the UART port.
- CVE-2022-43142A cross-site scripting (XSS) vulnerability in the add-fee.php component of Password Storage Application v1.0 allows attackers to execute arb
- CVE-2022-43171A heap buffer overflow in the LIEF::MachO::BinaryParser::parse_dyldinfo_generic_bind function of LIEF v0.12.1 allows attackers to cause a Delief
- CVE-2022-43192An arbitrary file upload vulnerability in the component /dede/file_manage_control.php of Dedecms v5.7.101 allows attackers to execute arbitr
- CVE-2022-43332A cross-site scripting (XSS) vulnerability in Wondercms v3.3.4 allows attackers to execute arbitrary web scripts or HTML via a crafted paylo