CVEs published November 21, 2022
88 CVEs were published on November 21, 2022: 19 critical, 38 high.
- Published
- 88
- Critical
- 19
- High
- 38
- Medium
- 29
- Low
- 1
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 32
Most affected products
- Trend Micro Apex One
- 8
- Foxit Reader
- 4
- Booster for WooCommerce · Booster Plus for WooCommerce +1
- 2
- Event Monster
- 2
- 4ra1n super-xray
- 1
- Apache Software Foundation Apache Hama · org.apache.hama:ha…
- 1
- appsmithorg/appsmith
- 1
- Ask me
- 1
- backdrop/backdrop
- 1
- Contact Form 7 Database Addon
- 1
Critical 19
- CVE-2021-3919A potential security vulnerability has been identified in OMEN Gaming Hub and in HP Command Center which may allow escalation of privilege aOMEN Gaming Hub and HP Command Center
- CVE-2021-3821A potential security vulnerability has been identified for certain HP multifunction printers (MFPs).HP FutureSmart
- CVE-2021-3437Potential security vulnerabilities have been identified in an OMEN Gaming Hub SDK package which may allow escalation of privilege and/or denHP OMEN Gaming Hub SDK
- CVE-2021-24649WP User Frontend < 3.5.29 - Obscure Registration as AdminWP User Frontend
- CVE-2022-30257An issue was discovered in Technitium DNS Server through 8.0.2 that allows variant V1 of unintended domain name resolution.
- CVE-2022-30258An issue was discovered in Technitium DNS Server through 8.0.2 that allows variant V2 of unintended domain name resolution.
- CVE-2022-3600Easy Digital Downloads < 3.1.0.2 - Unauthenticated CSV InjectionEasy Digital Downloads
- CVE-2022-3634Contact Form 7 Database Addon < 1.2.6.5 - CSV InjectionContact Form 7 Database Addon
- CVE-2022-43143A cross-site scripting (XSS) vulnerability in Beekeeper Studio v3.6.6 allows attackers to execute arbitrary web scripts or HTML via a crafte
- CVE-2022-44171Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function form_fast_setting_wifi_set.
- CVE-2022-44172Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function R7WebsSecurityHandler.
- CVE-2022-44174Tenda AC18 V15.03.05.05 is vulnerable to Buffer Overflow via function formSetDeviceName.
- CVE-2022-44175Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function formSetMacFilterCfg.
- CVE-2022-44176Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function fromSetRouteStatic.
- CVE-2022-44177Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function formWifiWpsStart.
- CVE-2022-44178Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow.
- CVE-2022-44180Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function addWifiMacFilter.
- CVE-2022-44183Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function formSetWifiGuestBasic.
- CVE-2022-44785An issue was discovered in Appalti & Contratti 9.12.2.
High 38
- CVE-2021-3661A potential security vulnerability has been identified in certain HP Workstation BIOS (UEFI firmware) which may allow arbitrary code executiHP Workstation BIOS
- CVE-2022-37018A potential vulnerability has been identified in the system BIOS for certain HP PC products which may allow escalation of privileges and codHP PC BIOS
- CVE-2022-1038A potential security vulnerability has been identified in the HP Jumpstart software, which might allow escalation of privilege.HP Jumpstart
- CVE-2022-44654Affected builds of Trend Micro Apex One and Apex One as a Service contain a monitor engine component that is complied without the /SAFESEH mTrend Micro Apex One
- CVE-2022-44653A security agent directory traversal vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalatTrend Micro Apex One
- CVE-2022-44652An improper handling of exceptional conditions vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker Trend Micro Apex One
- CVE-2022-44651A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalaTrend Micro Apex One
- CVE-2022-44650A memory corruption vulnerability in the Unauthorized Change Prevention service of Trend Micro Apex One and Apex One as a Service could alloTrend Micro Apex One
- CVE-2022-44649An out-of-bounds access vulnerability in the Unauthorized Change Prevention service of Trend Micro Apex One and Apex One as a Service could Trend Micro Apex One
- CVE-2022-40746IBM i Access Family 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.0 could allow a local authenticated attacker to execute arbitrary code on IBM i
- CVE-2022-40129A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430.Foxit Reader
- CVE-2022-38097A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430.Foxit Reader
- CVE-2022-37332A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430.Foxit Reader
- CVE-2022-32774A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430.Foxit Reader
- CVE-2022-3861Betheme <= 26.5.1.4 - Authenticated (Subscriber+) PHP Object InjectionMuffinGroup Betheme
- CVE-2022-3589Miele: Vulnerability in cloud service used by appWashMiele appWash
- CVE-2022-1578My wpdb < 2.5 - Arbitrary SQL Query via CSRFMy wpdb
- CVE-2022-1579Login Block IPs <= 1.0.0 - IP Spoofing BypassLogin Block IPs
- CVE-2022-3388Input Validation Vulnerability in Hitachi Energy’s MicroSCADA Pro/X SYS600 ProductsHitachi Energy MicroSCADA Pro SYS600 · Hitachi Energy Micro…
- CVE-2022-3688WPQA < 5.9 - Follow/Unfollow via CSRFWPQA Builder
- CVE-2022-3691DeepL Pro API Translation < 1.7.5 - API Key DisclosureDeepL Pro API translation plugin
- CVE-2022-3720Event Monster < 1.2.1 - Admin+ SQLiEvent Monster
- CVE-2022-3763Booster for WooCommerce - Checkout Files Deletion via CSRFBooster for WooCommerce · Booster Plus for WooCommerce +1
- CVE-2022-38148Silverstripe silverstripe/framework through 4.11 allows SQL Injection.silverstripe/framework
- CVE-2022-4093 SQL Injection in dolibarr/dolibarrdolibarr/dolibarr
- CVE-2022-4096Server-Side Request Forgery (SSRF) in appsmithorg/appsmithappsmithorg/appsmith
- CVE-2022-4105Cross-site Scripting (XSS) - Stored in kiwitcms/kiwikiwitcms/kiwi · kiwitcms
- CVE-2022-44156Tenda AC15 V15.03.05.19 is vulnerable to Buffer Overflow via function formSetIpMacBind.
- CVE-2022-44158Tenda AC21 V16.03.08.15 is vulnerable to Buffer Overflow via function via set_device_name.
- CVE-2022-44163Tenda AC21 V16.03.08.15 is vulnerable to Buffer Overflow via function formSetMacFilterCfg.
- CVE-2022-44167Tenda AC15 V15.03.05.18 is avulnerable to Buffer Overflow via function formSetPPTPServer.
- CVE-2022-44168Tenda AC15 V15.03.05.18 is vulnerable to Buffer Overflow via function fromSetRouteStatic..
- CVE-2022-44169Tenda AC15 V15.03.05.18 is vulnerable to Buffer Overflow via function formSetVirtualSer.
- CVE-2022-44784An issue was discovered in Appalti & Contratti 9.12.2.
- CVE-2022-44786An issue was discovered in Appalti & Contratti 9.12.2.
- CVE-2022-44830Sourcecodester Event Registration App v1.0 was discovered to contain multiple CSV injection vulnerabilities via the First Name, Contact and
- CVE-2022-45422When LG SmartShare is installed, local privilege escalation is possible through DLL Hijacking attack.LG PC
- CVE-2022-45470Apache Hama allows XSS and information disclosureApache Software Foundation Apache Hama · org.apache.hama:ha…
Medium, low and unrated 31
- CVE-2022-44648An Out-of-bounds read vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to disclose sensitive infTrend Micro Apex One
- CVE-2022-44647An Out-of-bounds read vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to disclose sensitive infTrend Micro Apex One
- CVE-2020-23582A vulnerability in the "/admin/wlmultipleap.asp" of optilink OP-XT71000N version: V2.2 could allow an unauthenticated, remote attacker to co
- CVE-2022-0421Five Star Restaurant Reservations < 2.4.12 - Unauthenticated Arbitrary Payment Status Update to Stored XSSFive Star Restaurant Reservations
- CVE-2022-1581WP-Polls < 2.76.0 - IP Validation BypassWP-Polls
- CVE-2022-3336Event Monster < 1.2.0 - Visitors Deletion via CSRFEvent Monster
- CVE-2022-35897An stack buffer overflow vulnerability leads to arbitrary code execution issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.
- CVE-2022-3618Spacer < 3.0.7 - Admin+ Stored XSSSpacer
- CVE-2022-3690Popup Maker < 1.16.11 - Contributor+ Stored Cross Site ScriptingPopup Maker
- CVE-2022-3750Ask Me < 6.8.7 - Post Deletion via CSRFAsk me
- CVE-2022-3753Evaluate <= 1.0 - Admin+ Stored Cross-Site ScriptingEvaluate
- CVE-2022-3762Booster for WooCommerce - ShopManager+ Arbitrary File DownloadBooster for WooCommerce · Booster Plus for WooCommerce +1
- CVE-2022-38146Silverstripe silverstripe/framework through 4.11 allows XSS (issue 2 of 3).silverstripe/admin
- CVE-2022-38755Filr Remote unauthenticated user enumeration for versions prior to 4.3.1.1Micro Focus Filr
- CVE-2022-40470Phpgurukul Blood Donor Management System 1.0 allows Cross Site Scripting via Add Blood Group Name Feature.
- CVE-2022-4087iPXE TLS tls.c tls_new_ciphertext information exposureiPXE
- CVE-2022-41945Remote Code Execution (RCE) vulnerability in super-xray via URL input4ra1n super-xray
- CVE-2022-42096Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via Post content.backdrop/backdrop
- CVE-2022-43117Sourcecodester Password Storage Application in PHP/OOP and MySQL 1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabi
- CVE-2022-43707MyBB 1.8.31 has a Cross-site scripting (XSS) vulnerability in the visual MyCode editor (SCEditor) allows remote attackers to inject HTML via
- CVE-2022-43708MyBB 1.8.31 has a (issue 2 of 2) cross-site scripting (XSS) vulnerabilities in the post Attachments interface allow attackers to inject HTML
- CVE-2022-43709MyBB 1.8.31 has a SQL injection vulnerability in the Admin CP's Users module allows remote authenticated users to modify the query string vi
- CVE-2022-44787An issue was discovered in Appalti & Contratti 9.12.2.
- CVE-2022-44788An issue was discovered in Appalti & Contratti 9.12.2.
- CVE-2022-45012A cross-site scripting (XSS) vulnerability in the Modify Page module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or
- CVE-2022-45013A cross-site scripting (XSS) vulnerability in the Show Advanced Option module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web s
- CVE-2022-45014A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web script
- CVE-2022-45015A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web script
- CVE-2022-45016A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web script
- CVE-2022-45017A cross-site scripting (XSS) vulnerability in the Overview Page settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web
- CVE-2022-45146An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4.org.bouncycastle:bc-fips