# CVEs published 2022-11-17

88 CVEs were published on November 17, 2022: 12 critical, 32 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2022-24939](https://cve.now/CVE-2022-24939.md): Malformed Zigbee packet with invalid destination address causes Assert (CVSS 5.7, silabs.com Ember ZNet)
- [CVE-2022-43506](https://cve.now/CVE-2022-43506.md): Delta Electronics DIAEnergie SQL Injection (CVSS 8.8, Delta Electronics DIAEnergie)
- [CVE-2022-41775](https://cve.now/CVE-2022-41775.md): Delta Electronics DIAEnergie SQL Injection (CVSS 8.8, Delta Electronics DIAEnergie)
- [CVE-2022-43452](https://cve.now/CVE-2022-43452.md): Delta Electronics DIAEnergie SQL Injection (CVSS 8.8, Delta Electronics DIAEnergie)
- [CVE-2022-43457](https://cve.now/CVE-2022-43457.md): Delta Electronics DIAEnergie SQL Injection (CVSS 8.8, Delta Electronics DIAEnergie)
- [CVE-2022-43447](https://cve.now/CVE-2022-43447.md): Delta Electronics DIAEnergie SQL Injection (CVSS 8.8, Delta Electronics DIAEnergie)
- [CVE-2022-36924](https://cve.now/CVE-2022-36924.md): Local Privilege Escalation in Zoom Rooms Installer for Windows (CVSS 8.8, Zoom Video Communications Zoom Rooms Installer for Windows)
- [CVE-2022-28766](https://cve.now/CVE-2022-28766.md): DLL injection in Zoom Windows Clients (CVSS 3.3, Zoom Video Communications Zoom Client for Meetings for W… +1)
- [CVE-2022-28768](https://cve.now/CVE-2022-28768.md): Local Privilege Escalation in Zoom Client Installer for macOS (CVSS 8.8, Zoom Video Communications Zoom Client for Meetings Installe…)
- [CVE-2022-36785](https://cve.now/CVE-2022-36785.md): D-Link – G integrated Access Device4 Information Disclosure & Authorization Bypass. (CVSS 7.5, D-Link G integrated Access Device4)
- [CVE-2022-39179](https://cve.now/CVE-2022-39179.md): College Management System v1.0 - Authenticated remote code execution (CVSS 7.2, College Management System)
- [CVE-2022-39178](https://cve.now/CVE-2022-39178.md): Webvendome - webvendome Internal Server IP Disclosure (CVSS 5.3, webvendome)
- [CVE-2022-39180](https://cve.now/CVE-2022-39180.md): College Management System v1.0 - SQL Injection (SQLi) (CVSS 9.8, College Management System)
- [CVE-2022-39181](https://cve.now/CVE-2022-39181.md): GLPI - Reports plugin for GLPI Reflected Cross-Site-Scripting (RXSS) (CVSS 6.1, Reports plugin for GLPI)
- [CVE-2022-36784](https://cve.now/CVE-2022-36784.md): Elsight – Elsight Halo Remote Code Execution (RCE) (CVSS 9.8, Elsight Halo)
- [CVE-2022-36787](https://cve.now/CVE-2022-36787.md): webvendome - webvendome SQL Injection (CVSS 9.8, webvendome)
- [CVE-2022-45069](https://cve.now/CVE-2022-45069.md): WordPress Crowdsignal Dashboard plugin \<= 3.0.9 - Privilege Escalation vulnerability (CVSS 6.3, Automattic Crowdsignal Dashboard – Polls, Surveys & more)
- [CVE-2022-40694](https://cve.now/CVE-2022-40694.md): WordPress News Announcement Scroll plugin \<= 8.8.8 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, StoreApps News Announcement Scroll)
- [CVE-2022-44736](https://cve.now/CVE-2022-44736.md): WordPress Chameleon plugin \<= 1.4.3 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, Fahad Mahmood Chameleon)
- [CVE-2022-40192](https://cve.now/CVE-2022-40192.md): WordPress wpForo Forum plugin \<= 2.0.9 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 7.1, gVectors Team wpForo Forum)
- [CVE-2022-41315](https://cve.now/CVE-2022-41315.md): WordPress Ezoic plugin \<= 2.8.8 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, Ezoic)
- [CVE-2022-41132](https://cve.now/CVE-2022-41132.md): WordPress Ezoic plugin \<= 2.8.8 - Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability (CVSS 6.1, Ezoic)
- [CVE-2022-44591](https://cve.now/CVE-2022-44591.md): WordPress Anthologize plugin \<= 0.8.0 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, One Week | One Tool Anthologize)
- [CVE-2022-41791](https://cve.now/CVE-2022-41791.md): WordPress ProfileGrid plugin \<= 5.1.6 - Auth. CSV Injection vulnerability (CVSS 6.8, ProfileGrid)
- [CVE-2022-45077](https://cve.now/CVE-2022-45077.md): WordPress Betheme theme \<= 26.5.1.4 - Auth. PHP Object Injection vulnerability (CVSS 6.3, Muffingroup Betheme)
- [CVE-2022-36357](https://cve.now/CVE-2022-36357.md): WordPress ULTIMATE TABLES plugin \<= 1.6.5 - Unauth. Reflected Cross-Site Scripting (XSS) vulnerability (CVSS 6.1, Webpsilon ULTIMATE TABLES)
- [CVE-2022-45066](https://cve.now/CVE-2022-45066.md): WordPress WooSwipe WooCommerce Gallery plugin \<= 2.0.1 - Auth. Broken Access Control vulnerability (CVSS 5.4, Thrive Website Design WooSwipe WooCommerce Gallery)
- [CVE-2022-45375](https://cve.now/CVE-2022-45375.md): WordPress iFeature Slider plugin \<= 1.2 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (CVSS 5.4, CyberChimps iFeature Slider)
- [CVE-2021-36905](https://cve.now/CVE-2021-36905.md): WordPress Quiz And Survey Master plugin \<= 7.3.4 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilities (CVSS 5.4, ExpressTech Quiz And Survey Master)
- [CVE-2022-40200](https://cve.now/CVE-2022-40200.md): WordPress wpForo Forum plugin \<= 2.0.9 - Auth. Arbitrary File Upload vulnerability (CVSS 9.9, gVectors Team wpForo Forum)
- [CVE-2022-38461](https://cve.now/CVE-2022-38461.md): WordPress WPML Multilingual CMS premium plugin \<= 4.5.10 - Broken Access Control vulnerability (CVSS 5.4, OnTheGoSystems WPML Multilingual CMS)
- [CVE-2022-45071](https://cve.now/CVE-2022-45071.md): WordPress WPML Multilingual CMS premium plugin \<= 4.5.13 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 5.4, OnTheGoSystems WPML Multilingual CMS)
- [CVE-2022-45072](https://cve.now/CVE-2022-45072.md): WordPress WPML Multilingual CMS premium plugin \<= 4.5.13 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 4.3, OnTheGoSystems WPML Multilingual CMS)
- [CVE-2022-3090](https://cve.now/CVE-2022-3090.md): Red Lion Controls Crimson 3.0 versions 707.000 and prior, Crimson 3.1 versions 3126.001 and prior, and Crimson 3.2 versions 3.2.0044.0 and p (CVSS 7.5, Red Lion Controls Crimson)
- [CVE-2022-32537](https://cve.now/CVE-2022-32537.md): Medtronic MiniMed 600 Series Pump System Communication Issue (CVSS 4.8, Medtronic Minimed 600 Series Insulin Pump)
- [CVE-2022-38390](https://cve.now/CVE-2022-38390.md): Multiple IBM Business Automation Workflow versions are vulnerable to cross-site scripting. (CVSS 5.4, IBM Business Automation Workflow)
- [CVE-2022-40751](https://cve.now/CVE-2022-40751.md): IBM UrbanCode Deploy information disclosure (CVSS 4.9, IBM UrbanCode Deploy)
- [CVE-2022-43782](https://cve.now/CVE-2022-43782.md): Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd application via security misconfiguration and subsequent (CVSS 9.8, Atlassian Crowd Data Center · Atlassian Crowd Server)
- [CVE-2022-43781](https://cve.now/CVE-2022-43781.md): There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. (CVSS 9.8, Atlassian Bitbucket Data Center · Atlassian Bitbucket Server)
- [CVE-2021-31608](https://cve.now/CVE-2021-31608.md): Proofpoint Enterprise Protection before 18.8.0 allows a Bypass of a Security Control. (CVSS 4.3)
- [CVE-2021-33897](https://cve.now/CVE-2021-33897.md): A buffer overflow in Synthesia before 10.7.5567, when a non-Latin locale is used, allows user-assisted attackers to cause a denial of servic (CVSS 5.5)
- [CVE-2022-20427](https://cve.now/CVE-2022-20427.md): In (TBD) of (TBD), there is a possible way to corrupt memory due to improper input validation. (CVSS 6.7, Android)
- [CVE-2022-20428](https://cve.now/CVE-2022-20428.md): In (TBD) of (TBD), there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, Android)
- [CVE-2022-20459](https://cve.now/CVE-2022-20459.md): In (TBD) of (TBD), there is a possible way to redirect code execution due to improper input validation. (CVSS 6.7, Android)
- [CVE-2022-20460](https://cve.now/CVE-2022-20460.md): In (TBD) mprot\_unmap? of (TBD), there is a possible way to corrupt the memory mapping due to improper input validation. (CVSS 6.7, Android)
- [CVE-2022-23748](https://cve.now/CVE-2022-23748.md): mDNSResponder.exe is vulnerable to DLL Sideloading attack. (CVSS 7.8, KEV, Audinate Dante Application Library for Windows)
- [CVE-2022-36432](https://cve.now/CVE-2022-36432.md): The Preview functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 uses eval unsafely. (CVSS 5.4)
- [CVE-2022-36786](https://cve.now/CVE-2022-36786.md): DLINK - DSL-224 Post-auth RCE. (CVSS 9.9, D-Link DSL-224)
- [CVE-2022-38165](https://cve.now/CVE-2022-38165.md): Arbitrary file write in F-Secure Policy Manager through 2022-08-10 allows unauthenticated users to write the file with the contents in arbit (CVSS 9.8)
- [CVE-2022-39389](https://cve.now/CVE-2022-39389.md): Witness Block Parsing DoS Vulnerability in lnd (CVSS 8.2, lightningnetwork lnd · github.com/lightningnetwork/lnd)
- [CVE-2022-39834](https://cve.now/CVE-2022-39834.md): A stored XSS vulnerability was discovered in adminweb/ra/viewendentity.jsp in PrimeKey EJBCA through 7.9.0.2. (CVSS 5.4)
- [CVE-2022-4051](https://cve.now/CVE-2022-4051.md): Hostel Searching Project view-property.php sql injection (CVSS 6.3, Hostel Searching Project)
- [CVE-2022-4052](https://cve.now/CVE-2022-4052.md): Student Attendance Management System createClass.php sql injection (CVSS 4.7, Student Attendance Management System)
- [CVE-2022-4053](https://cve.now/CVE-2022-4053.md): Student Attendance Management System createClass.php cross site scripting (CVSS 2.4, Student Attendance Management System)
- [CVE-2022-40881](https://cve.now/CVE-2022-40881.md): SolarView Compact 6.00 was discovered to contain a command injection vulnerability via network\_test.php (CVSS 9.8)
- [CVE-2022-41920](https://cve.now/CVE-2022-41920.md): Zip slip in Lancet (CVSS 6.3, duke-git lancet · github.com/duke-git/lancet +1)
- [CVE-2022-42187](https://cve.now/CVE-2022-42187.md): Hustoj 22.09.22 has a XSS Vulnerability in /admin/problem\_judge.php. (CVSS 6.1)
- [CVE-2022-42245](https://cve.now/CVE-2022-42245.md): Dreamer CMS 4.0.01 is vulnerable to SQL Injection. (CVSS 9.8)
- [CVE-2022-42246](https://cve.now/CVE-2022-42246.md): Doufox 0.0.4 contains a CSRF vulnerability that can add system administrator account. (CVSS 8.8)
- [CVE-2022-42533](https://cve.now/CVE-2022-42533.md): In shared\_metadata\_init of SharedMetadata.cpp, there is a possible out of bounds write due to an integer overflow. (CVSS 7.8, Android)
- [CVE-2022-42732](https://cve.now/CVE-2022-42732.md): A vulnerability has been identified in syngo Dynamics (All versions \< VA40G HF01). (CVSS 7.5, Siemens syngo Dynamics)
- [CVE-2022-42733](https://cve.now/CVE-2022-42733.md): A vulnerability has been identified in syngo Dynamics (All versions \< VA40G HF01). (CVSS 7.5, Siemens syngo Dynamics)
- [CVE-2022-42734](https://cve.now/CVE-2022-42734.md): A vulnerability has been identified in syngo Dynamics (All versions \< VA40G HF01). (CVSS 7.5, Siemens syngo Dynamics)
- [CVE-2022-42891](https://cve.now/CVE-2022-42891.md): A vulnerability has been identified in syngo Dynamics (All versions \< VA40G HF01). (CVSS 7.5, Siemens syngo Dynamics)
- [CVE-2022-42892](https://cve.now/CVE-2022-42892.md): A vulnerability has been identified in syngo Dynamics (All versions \< VA40G HF01). (CVSS 5.3, Siemens syngo Dynamics)
- [CVE-2022-42893](https://cve.now/CVE-2022-42893.md): A vulnerability has been identified in syngo Dynamics (All versions \< VA40G HF01). (CVSS 7.5, Siemens syngo Dynamics)
- [CVE-2022-42894](https://cve.now/CVE-2022-42894.md): A vulnerability has been identified in syngo Dynamics (All versions \< VA40G HF01). (CVSS 7.5, Siemens syngo Dynamics)
- [CVE-2022-42903](https://cve.now/CVE-2022-42903.md): Zoho ManageEngine SupportCenter Plus through 11024 allows low-privileged users to view the organization users list. (CVSS 3.3)
- [CVE-2022-42954](https://cve.now/CVE-2022-42954.md): Keyfactor EJBCA before 7.10.0 allows XSS. (CVSS 5.4)
- [CVE-2022-42982](https://cve.now/CVE-2022-42982.md): BKG Professional NtripCaster 2.0.39 allows querying information over the UDP protocol without authentication. (CVSS 7.5)
- [CVE-2022-42985](https://cve.now/CVE-2022-42985.md): The ScratchLogin extension through 1.1 for MediaWiki does not escape verification failure messages, which allows users with administrator pr (CVSS 4.8)
- [CVE-2022-43096](https://cve.now/CVE-2022-43096.md): Mediatrix 4102 before v48.5.2718 allows local attackers to gain root access via the UART port. (CVSS 6.8)
- [CVE-2022-43138](https://cve.now/CVE-2022-43138.md): Dolibarr Open Source ERP & CRM for Business before v14.0.1 allows attackers to escalate privileges via a crafted API. (CVSS 9.8, dolibarr/dolibarr)
- [CVE-2022-43140](https://cve.now/CVE-2022-43140.md): kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component cn.keking.web.controller.OnlinePreviewCon (CVSS 7.5)
- [CVE-2022-43142](https://cve.now/CVE-2022-43142.md): A cross-site scripting (XSS) vulnerability in the add-fee.php component of Password Storage Application v1.0 allows attackers to execute arb (CVSS 6.1)
- [CVE-2022-43162](https://cve.now/CVE-2022-43162.md): Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /tests/view\_tes (CVSS 7.2)
- [CVE-2022-43163](https://cve.now/CVE-2022-43163.md): Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /clients/view\_c (CVSS 7.2)
- [CVE-2022-43171](https://cve.now/CVE-2022-43171.md): A heap buffer overflow in the LIEF::MachO::BinaryParser::parse\_dyldinfo\_generic\_bind function of LIEF v0.12.1 allows attackers to cause a De (CVSS 6.5, lief)
- [CVE-2022-43179](https://cve.now/CVE-2022-43179.md): Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /admin/?page=user/manage\_user& (CVSS 7.2)
- [CVE-2022-43183](https://cve.now/CVE-2022-43183.md): XXL-Job before v2.3.1 contains a Server-Side Request Forgery (SSRF) via the component /admin/controller/JobLogController.java. (CVSS 8.8, com.xuxueli:xxl-job-core)
- [CVE-2022-43192](https://cve.now/CVE-2022-43192.md): An arbitrary file upload vulnerability in the component /dede/file\_manage\_control.php of Dedecms v5.7.101 allows attackers to execute arbitr (CVSS 6.7)
- [CVE-2022-43332](https://cve.now/CVE-2022-43332.md): A cross-site scripting (XSS) vulnerability in Wondercms v3.3.4 allows attackers to execute arbitrary web scripts or HTML via a crafted paylo (CVSS 6.1)
- [CVE-2022-44001](https://cve.now/CVE-2022-44001.md): An issue was discovered in BACKCLICK Professional 5.9.63. (CVSS 9.8)
- [CVE-2022-44384](https://cve.now/CVE-2022-44384.md): An arbitrary file upload vulnerability in rconfig v3.9.6 allows attackers to execute arbitrary code via a crafted PHP file. (CVSS 8.8)
- [CVE-2022-44402](https://cve.now/CVE-2022-44402.md): Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/classes/Master.php?f=delete\_transaction. (CVSS 7.2)
- [CVE-2022-44403](https://cve.now/CVE-2022-44403.md): Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/admin/?page=user/manage\_user&id=. (CVSS 7.2)
- [CVE-2022-44725](https://cve.now/CVE-2022-44725.md): OPC Foundation Local Discovery Server (LDS) through 1.04.403.478 uses a hard-coded file path to a configuration file. (CVSS 7.8)
- [CVE-2022-45461](https://cve.now/CVE-2022-45461.md): The Java Admin Console in Veritas NetBackup through 10.1 and related Veritas products on Linux and UNIX allows authenticated non-root users (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-11-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.