# CVEs published 2022-11-18

105 CVEs were published on November 18, 2022: 6 critical, 29 high. Days are UTC.

- [CVE-2022-41609](https://cve.now/CVE-2022-41609.md): WordPress Better Messages plugin \<= 1.9.10.68 - Server-Side Request Forgery (SSRF) vulnerability (CVSS 6.4, WordPlus Better Messages)
- [CVE-2022-41155](https://cve.now/CVE-2022-41155.md): WordPress iQ Block Country plugin \<= 1.2.18 - Block BYPASS vulnerability (CVSS 5.3, Pascal iQ Block Country)
- [CVE-2022-40216](https://cve.now/CVE-2022-40216.md): WordPress Better Messages plugin \<= 1.9.10.69 - Auth. Messaging Block Bypass vulnerability (CVSS 4.3, WordPlus Better Messages)
- [CVE-2022-40130](https://cve.now/CVE-2022-40130.md): WordPress WP-Polls plugin \<= 2.76.0 - Auth. Race Condition vulnerability (CVSS 4.3, Lester 'GaMerZ' Chan WP-Polls)
- [CVE-2022-41618](https://cve.now/CVE-2022-41618.md): WordPress Media Library Assistant plugin \<= 3.00 - Unauthenticated Error Log Disclosure vulnerability (CVSS 3.7, David Lingren Media Library Assistant)
- [CVE-2022-41615](https://cve.now/CVE-2022-41615.md): WordPress Store Locator plugin \<= 1.4.5 - Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability (CVSS 6.1, AGILELOGIX Store Locator WordPress)
- [CVE-2022-41634](https://cve.now/CVE-2022-41634.md): WordPress Media Library Folders plugin \<= 7.1.1 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Max Foundry Media Library Folders)
- [CVE-2022-41135](https://cve.now/CVE-2022-41135.md): WordPress Modula plugin \<= 2.6.9 - Unauth. Plugin Settings Change vulnerability (CVSS 6.5, WPChill Modula Image Gallery)
- [CVE-2022-41655](https://cve.now/CVE-2022-41655.md): WordPress Phone Orders for WooCommerce plugin \<= 3.7.1 - Auth. Sensitive Data Exposure vulnerability (CVSS 4.3, AlgolPlus Phone Orders for WooCommerce)
- [CVE-2022-41643](https://cve.now/CVE-2022-41643.md): WordPress Accessibility plugin \<= 1.0.3 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, Octa Code Accessibility)
- [CVE-2022-40963](https://cve.now/CVE-2022-40963.md): WordPress WP Page Builder plugin \<= 1.2.6 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilities (CVSS 4.8, Themeum WP Page Builder)
- [CVE-2022-41685](https://cve.now/CVE-2022-41685.md): Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Integration for Szamlazz.hu & WooCommerce and Csomagpontok és szállítási címkék WooCommerce hez plugins (CVSS 5.4, Viszt Péter Integration for Szamlazz.hu & WooCommerce · Vis…)
- [CVE-2022-42459](https://cve.now/CVE-2022-42459.md): WordPress Image Hover Effects Ultimate plugin \<= 9.7.1 - Auth. WordPress Options Change vulnerability (CVSS 7.2, Biplob Adhikari Image Hover Effects Ultimate)
- [CVE-2022-40695](https://cve.now/CVE-2022-40695.md): WordPress SEO Redirection Plugin plugin \<= 8.9 - Multiple Cross-Site Scripting (CSRF) vulnerabilities (CVSS 5.4, WP-buy SEO Redirection Plugin – 301 Redirect Manager)
- [CVE-2022-42698](https://cve.now/CVE-2022-42698.md): WordPress Api2Cart Bridge Connector plugin \<= 1.1.0 - Arbitrary File Upload vulnerability (CVSS 9.8, Api2Cart Bridge Connector)
- [CVE-2022-42497](https://cve.now/CVE-2022-42497.md): WordPress Api2Cart Bridge Connector plugin \<= 1.1.0 - Arbitrary Code Execution vulnerability (CVSS 10.0, Api2Cart Bridge Connector)
- [CVE-2022-41788](https://cve.now/CVE-2022-41788.md): WordPress Soledad premium theme \<= 8.2.5 - Auth. Cross-Site Scripting (XSS) vulnerability (CVSS 5.4, PenciDesign Soledad)
- [CVE-2022-43492](https://cve.now/CVE-2022-43492.md): WordPress Comments – wpDiscuz plugin 7.4.2 - Auth. Insecure Direct Object References (IDOR) vulnerability (CVSS 4.3, gVectors Team Comments – wpDiscuz)
- [CVE-2022-44740](https://cve.now/CVE-2022-44740.md): WordPress Creative Mail plugin \<= 1.5.4 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities (CVSS 5.4, Constant Contact Creative Mail)
- [CVE-2022-44583](https://cve.now/CVE-2022-44583.md): WordPress WatchTowerHQ plugin \<= 3.6.15 - Unauth. Arbitrary File Download vulnerability (CVSS 7.5, WhatArmy WatchTowerHQ)
- [CVE-2022-44584](https://cve.now/CVE-2022-44584.md): WordPress WatchTowerHQ plugin \<= 3.6.15 - Unauth. Arbitrary File Deletion vulnerability (CVSS 9.1, WhatArmy WatchTowerHQ)
- [CVE-2022-45082](https://cve.now/CVE-2022-45082.md): WordPress Accordions plugin \<= 2.0.3 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilities (CVSS 3.4, Biplob Adhikari Accordions – Multiple Accordions or FAQs Bu…)
- [CVE-2022-44634](https://cve.now/CVE-2022-44634.md): WordPress S2W – Import Shopify to WooCommerce plugin \<= 1.1.12 - Auth. Arbitrary File Read vulnerability (CVSS 4.9, VillaTheme S2W – Import Shopify to WooCommerce)
- [CVE-2022-45369](https://cve.now/CVE-2022-45369.md): WordPress Plugin for Google Reviews plugin \<= 2.2.2 - Auth. Broken Access Control vulnerability (CVSS 4.3, RichPlugins Plugin for Google Reviews)
- [CVE-2022-41839](https://cve.now/CVE-2022-41839.md): WordPress LoginPress plugin \<= 1.6.2 - Broken Access Control vulnerability (CVSS 5.3, WPBrigade LoginPress | Custom Login Page Customizer)
- [CVE-2022-42883](https://cve.now/CVE-2022-42883.md): WordPress Quiz And Survey Master plugin \<= 7.3.10 - Sensitive Information Disclosure vulnerability (CVSS 5.3, ExpressTech Quiz And Survey Master)
- [CVE-2022-40698](https://cve.now/CVE-2022-40698.md): WordPress Quiz And Survey Master plugin \<= 7.3.10 - Cross-Site Scripting (XSS) vulnerability (CVSS 5.4, ExpressTech Quiz And Survey Master)
- [CVE-2022-45073](https://cve.now/CVE-2022-45073.md): WordPress REST API Authentication plugin \<= 2.4.0 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 5.4, miniOrange WordPress REST API Authentication)
- [CVE-2022-38395](https://cve.now/CVE-2022-38395.md): HP Support Assistant uses HP Performance Tune-up as a diagnostic tool. (CVSS 7.8, HP Support Assistant)
- [CVE-2022-2794](https://cve.now/CVE-2022-2794.md): Certain HP PageWide Pro Printers may be vulnerable to a potential denial of service attack. (CVSS 7.5, Certain HP PageWide Pro printers)
- [CVE-2022-42461](https://cve.now/CVE-2022-42461.md): WordPress miniOrange's Google Authenticator plugin \<= 5.6.1 - Broken Access Control vulnerability (CVSS 5.4, miniOrange's Google Authenticator)
- [CVE-2022-43482](https://cve.now/CVE-2022-43482.md): WordPress Appointment Booking Calendar plugin \<= 1.3.69 - Missing Authorization vulnerability (CVSS 4.3, CodePeople Appointment Booking Calendar)
- [CVE-2022-41781](https://cve.now/CVE-2022-41781.md): WordPress Permalink Manager Lite plugin \<= 2.2.20 - Broken Access Control vulnerability (CVSS 6.5, Maciej Bis Permalink Manager Lite)
- [CVE-2022-38075](https://cve.now/CVE-2022-38075.md): WordPress Mantenimiento web plugin \<= 0.13 - Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) (CVSS 6.1, Carlos Doral Mantenimiento web)
- [CVE-2022-41692](https://cve.now/CVE-2022-41692.md): WordPress Appointment Hour Booking plugin \<= 1.3.71 - Missing Authorization vulnerability (CVSS 4.3, CodePeople Appointment Hour Booking)
- [CVE-2022-43463](https://cve.now/CVE-2022-43463.md): WordPress Custom Product Tabs for WooCommerce plugin \<= 1.7.9 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, YIKES Custom Product Tabs for WooCommerce)
- [CVE-2022-40687](https://cve.now/CVE-2022-40687.md): WordPress Creative Mail plugin \<= 1.5.4 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Constant Contact Creative Mail)
- [CVE-2022-41805](https://cve.now/CVE-2022-41805.md): WordPress Booster for WooCommerce plugin \<= 5.6.6 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Pluggabl Booster for WooCommerce)
- [CVE-2022-40686](https://cve.now/CVE-2022-40686.md): WordPress Creative Mail plugin \<= 1.5.4 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Constant Contact Creative Mail)
- [CVE-2022-41652](https://cve.now/CVE-2022-41652.md): WordPress Quiz And Survey Master plugin \<= 7.3.10 - Bypass vulnerability (CVSS 6.5, ExpressTech Quiz And Survey Master)
- [CVE-2022-41840](https://cve.now/CVE-2022-41840.md): WordPress Welcart eCommerce plugin \<= 2.7.7 - Unauth. Directory Traversal vulnerability (CVSS 7.5, Collne Welcart e-Commerce)
- [CVE-2022-38974](https://cve.now/CVE-2022-38974.md): WordPress WPML Multilingual CMS premium plugin \<= 4.5.10 - Broken Access Control vulnerability (CVSS 4.3, OnTheGoSystems WPML Multilingual CMS)
- [CVE-2022-22488](https://cve.now/CVE-2022-22488.md): IBM OpenBMC denial of service (CVSS 4.9, IBM OpenBMC)
- [CVE-2022-45471](https://cve.now/CVE-2022-45471.md): In JetBrains Hub before 2022.3.15181 Throttling was missed when sending emails to a particular email address (CVSS 3.5, JetBrains Hub)
- [CVE-2022-24038](https://cve.now/CVE-2022-24038.md): Unauthorized modification in Karmasis Informatics Infraskope SIEM+ (CVSS 6.5, Karmasis Informatics Infraskope SIEM+)
- [CVE-2022-24037](https://cve.now/CVE-2022-24037.md): Unauthorized modification in Karmasis Informatics Infraskope SIEM+ (CVSS 8.2, Karmasis Informatics Infraskope SIEM+)
- [CVE-2021-22141](https://cve.now/CVE-2021-22141.md): An open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. (CVSS 6.1, Elastic Kibana)
- [CVE-2021-31739](https://cve.now/CVE-2021-31739.md): The SEPPmail solution is vulnerable to a Cross-Site Scripting vulnerability (XSS), because user input is not correctly encoded in HTML attri (CVSS 6.1)
- [CVE-2021-33621](https://cve.now/CVE-2021-33621.md): The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. (no CVSS, cgi)
- [CVE-2021-37936](https://cve.now/CVE-2021-37936.md): It was discovered that Kibana was not sanitizing document fields containing HTML snippets. (CVSS 5.4, Elastic Kibana)
- [CVE-2022-30256](https://cve.now/CVE-2022-30256.md): An issue was discovered in MaraDNS Deadwood through 3.5.0021 that allows variant V1 of unintended domain name resolution. (CVSS 7.5)
- [CVE-2022-31606](https://cve.now/CVE-2022-31606.md): NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where a fa (CVSS 7.8, NVIDIA Cloud Gaming)
- [CVE-2022-31607](https://cve.now/CVE-2022-31607.md): NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where a local user with basic capabilitie (CVSS 7.8, NVIDIA Cloud Gaming (guest driver), NVIDIA Cloud Gaming)
- [CVE-2022-31608](https://cve.now/CVE-2022-31608.md): NVIDIA GPU Display Driver for Linux contains a vulnerability in an optional D-Bus configuration file, where a local user with basic capabili (CVSS 7.8, NVIDIA GeForce, Workstation, Compute)
- [CVE-2022-31610](https://cve.now/CVE-2022-31610.md): NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where a local user with basic capabi (CVSS 7.8, NVIDIA Cloud Gaming)
- [CVE-2022-31612](https://cve.now/CVE-2022-31612.md): NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where a lo (CVSS 7.1, NVIDIA Cloud Gaming)
- [CVE-2022-31613](https://cve.now/CVE-2022-31613.md): NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer, where any local user can cause a null-pointer deref (CVSS 7.1, NVIDIA Cloud Gaming)
- [CVE-2022-31615](https://cve.now/CVE-2022-31615.md): NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where a local user with basic capabilities can cause (CVSS 5.5, NVIDIA GeForce, Workstation, Compute)
- [CVE-2022-31616](https://cve.now/CVE-2022-31616.md): NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where a lo (CVSS 6.1, NVIDIA Cloud Gaming)
- [CVE-2022-31617](https://cve.now/CVE-2022-31617.md): NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where a local user with basic capabi (CVSS 7.8, NVIDIA Cloud Gaming)
- [CVE-2022-31694](https://cve.now/CVE-2022-31694.md): InstallBuilder Qt installers built with versions previous to 22.10 try to load DLLs from the installer binary parent directory when displayi (CVSS 7.3, VMware InstallBuilder)
- [CVE-2022-34665](https://cve.now/CVE-2022-34665.md): NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a local user with basic capabilitie (CVSS 6.5, NVIDIA Cloud Gaming (guest driver), NVIDIA Cloud Gaming)
- [CVE-2022-34667](https://cve.now/CVE-2022-34667.md): NVIDIA CUDA Toolkit SDK contains a stack-based buffer overflow vulnerability in cuobjdump, where an unprivileged remote attacker could explo (CVSS 4.4, NVIDIA CUDA Toolkit)
- [CVE-2022-34827](https://cve.now/CVE-2022-34827.md): Carel Boss Mini 1.5.0 has Improper Access Control. (CVSS 8.8)
- [CVE-2022-37197](https://cve.now/CVE-2022-37197.md): IOBit IOTransfer V4 is vulnerable to Unquoted Service Path. (CVSS 7.8)
- [CVE-2022-38871](https://cve.now/CVE-2022-38871.md): In Free5gc v3.0.5, the AMF breaks due to malformed NAS messages. (CVSS 7.5, github.com/free5gc/free5gc)
- [CVE-2022-4055](https://cve.now/CVE-2022-4055.md): When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to t (CVSS 7.4, xdg-utils)
- [CVE-2022-41880](https://cve.now/CVE-2022-41880.md): ThreadUnsafeUnigramCandidateSampler Heap out of bounds in Tensorflow (CVSS 6.8, tensorflow · tensorflow-cpu +1)
- [CVE-2022-41883](https://cve.now/CVE-2022-41883.md): Out of bounds segmentation fault due to unequal op inputs in Tensorflow (CVSS 6.8, tensorflow · tensorflow-cpu +1)
- [CVE-2022-41884](https://cve.now/CVE-2022-41884.md): Seg fault in \`ndarray\_tensor\_bridge\` due to zero and large inputs in Tensorflow (CVSS 4.8, tensorflow · tensorflow-gpu +1)
- [CVE-2022-41885](https://cve.now/CVE-2022-41885.md): Overflow in \`FusedResizeAndPadConv2D\` in Tensorflow (CVSS 4.8, tensorflow · tensorflow-cpu +1)
- [CVE-2022-41886](https://cve.now/CVE-2022-41886.md): Overflow in \`ImageProjectiveTransformV2\` in Tensorflow (CVSS 4.8, tensorflow · tensorflow-cpu +1)
- [CVE-2022-41887](https://cve.now/CVE-2022-41887.md): Overflow in \`tf.keras.losses.poisson\` in Tensorflow (CVSS 4.8, tensorflow · tensorflow-gpu +1)
- [CVE-2022-41888](https://cve.now/CVE-2022-41888.md): Unckecked rank size in \`tf.image.generate\_bounding\_box\_proposals\` in Tensorflow (CVSS 4.8, tensorflow · tensorflow-gpu +1)
- [CVE-2022-41889](https://cve.now/CVE-2022-41889.md): Segfault via invalid attributes in \`pywrap\_tfe\_src.cc\` in Tensorflow (CVSS 5.5, tensorflow · tensorflow-cpu +1)
- [CVE-2022-41890](https://cve.now/CVE-2022-41890.md): \`CHECK\` fail in \`BCast\` overflow in Tensorflow (CVSS 4.8, tensorflow · tensorflow-cpu +1)
- [CVE-2022-41891](https://cve.now/CVE-2022-41891.md): Segfault in \`tf.raw\_ops.TensorListConcat\` in Tensorflow (CVSS 4.8, tensorflow · tensorflow-gpu +1)
- [CVE-2022-41893](https://cve.now/CVE-2022-41893.md): \`CHECK\_EQ\` fail in \`tf.raw\_ops.TensorListResize\` in Tensorflow (CVSS 4.8, tensorflow · tensorflow-cpu +1)
- [CVE-2022-41894](https://cve.now/CVE-2022-41894.md): Buffer overflow in \`CONV\_3D\_TRANSPOSE\` on TFLite (CVSS 7.1, tensorflow)
- [CVE-2022-41895](https://cve.now/CVE-2022-41895.md): \`MirrorPadGrad\` heap out of bounds read in Tensorflow (CVSS 4.8, tensorflow · tensorflow-gpu +1)
- [CVE-2022-41896](https://cve.now/CVE-2022-41896.md): \`tf.raw\_ops.Mfcc\` crashes in Tensorflow (CVSS 4.8, tensorflow · tensorflow-cpu +1)
- [CVE-2022-41897](https://cve.now/CVE-2022-41897.md): \`FractionalMaxPoolGrad\` Heap out of bounds read in Tensorflow (CVSS 4.8, tensorflow · tensorflow-cpu +1)
- [CVE-2022-41898](https://cve.now/CVE-2022-41898.md): \`CHECK\` fail via inputs in \`SparseFillEmptyRowsGrad\` in Tensorflow (CVSS 4.8, tensorflow · tensorflow-cpu +1)
- [CVE-2022-41899](https://cve.now/CVE-2022-41899.md): \`CHECK\` fail via inputs in \`SdcaOptimizer\` in Tensorflow (CVSS 4.8, tensorflow · tensorflow-cpu +1)
- [CVE-2022-41900](https://cve.now/CVE-2022-41900.md): FractionalMaxPool and FractionalAVGPool heap out-of-bounds acess in Tensorflow (CVSS 7.1, tensorflow · tensorflow-cpu +1)
- [CVE-2022-41901](https://cve.now/CVE-2022-41901.md): \`CHECK\_EQ\` fail via input in \`SparseMatrixNNZ\` in Tensorflow (CVSS 4.8, tensorflow · tensorflow-gpu +1)
- [CVE-2022-41907](https://cve.now/CVE-2022-41907.md): Overflow in \`ResizeNearestNeighborGrad\` in Tensorflow (CVSS 4.8, tensorflow · tensorflow-gpu +1)
- [CVE-2022-41908](https://cve.now/CVE-2022-41908.md): \`CHECK\` fail via inputs in \`PyFunc\` in Tensorflow (CVSS 4.8, tensorflow · tensorflow-gpu +1)
- [CVE-2022-41909](https://cve.now/CVE-2022-41909.md): Segfault in \`CompositeTensorVariantToComponents\` in Tensorflow (CVSS 4.8, tensorflow · tensorflow-cpu +1)
- [CVE-2022-41911](https://cve.now/CVE-2022-41911.md): Invalid char to bool conversion when printing a tensor in Tensorflow (CVSS 4.8, tensorflow · tensorflow-cpu +1)
- [CVE-2022-42904](https://cve.now/CVE-2022-42904.md): Zoho ManageEngine ADManager Plus through 7151 allows authenticated admin users to execute the commands in proxy settings. (CVSS 7.2)
- [CVE-2022-43308](https://cve.now/CVE-2022-43308.md): INTELBRAS SG 2404 MR 20180928-rel64938 allows authenticated attackers to arbitrarily create Administrator accounts via crafted user cookies. (CVSS 7.8)
- [CVE-2022-43673](https://cve.now/CVE-2022-43673.md): Wire through 3.22.3993 on Windows advertises deletion of sent messages; nonetheless, all messages can be retrieved (for a limited period of (CVSS 4.7)
- [CVE-2022-44204](https://cve.now/CVE-2022-44204.md): D-Link DIR3060 DIR3060A1\_FW111B04.bin is vulnerable to Buffer Overflow. (CVSS 9.8)
- [CVE-2022-44378](https://cve.now/CVE-2022-44378.md): Automotive Shop Management System v1.0 is vulnerable to SQL via /asms/classes/Master.php?f=delete\_mechanic. (CVSS 7.2)
- [CVE-2022-44379](https://cve.now/CVE-2022-44379.md): Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/classes/Master.php?f=delete\_service. (CVSS 7.2)
- [CVE-2022-44413](https://cve.now/CVE-2022-44413.md): Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/admin/mechanics/manage\_mechanic.php?id=. (CVSS 7.2)
- [CVE-2022-44414](https://cve.now/CVE-2022-44414.md): Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/admin/services/manage\_service.php?id=. (CVSS 7.2)
- [CVE-2022-44415](https://cve.now/CVE-2022-44415.md): Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/admin/mechanics/view\_mechanic.php?id=. (CVSS 7.2)
- [CVE-2022-44641](https://cve.now/CVE-2022-44641.md): In Linaro Automated Validation Architecture (LAVA) before 2022.11, users with valid credentials can submit crafted XMLRPC requests that caus (CVSS 6.5)
- [CVE-2022-44820](https://cve.now/CVE-2022-44820.md): Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/admin/?page=transactions/manage\_transaction&id=. (CVSS 7.2)
- [CVE-2022-45132](https://cve.now/CVE-2022-45132.md): In Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be achieved through user-submitted Jinja2 tem (CVSS 9.8)
- [CVE-2022-45163](https://cve.now/CVE-2022-45163.md): An information-disclosure vulnerability exists on select NXP devices when configured in Serial Download Protocol (SDP) mode: i.MX RT 1010, i (CVSS 5.3)
- [CVE-2022-45473](https://cve.now/CVE-2022-45473.md): In drachtio-server 0.8.18, /var/log/drachtio has mode 0777 and drachtio.log has mode 0666. (CVSS 5.5)
- [CVE-2022-45474](https://cve.now/CVE-2022-45474.md): drachtio-server 0.8.18 has a request-handler.cpp event\_cb use-after-free for any request. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-11-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.