# CVEs published 2022-11-21

88 CVEs were published on November 21, 2022: 19 critical, 38 high. Days are UTC.

- [CVE-2021-3919](https://cve.now/CVE-2021-3919.md): A potential security vulnerability has been identified in OMEN Gaming Hub and in HP Command Center which may allow escalation of privilege a (CVSS 9.8, OMEN Gaming Hub and HP Command Center)
- [CVE-2021-3821](https://cve.now/CVE-2021-3821.md): A potential security vulnerability has been identified for certain HP multifunction printers (MFPs). (CVSS 9.8, HP FutureSmart)
- [CVE-2021-3661](https://cve.now/CVE-2021-3661.md): A potential security vulnerability has been identified in certain HP Workstation BIOS (UEFI firmware) which may allow arbitrary code executi (CVSS 8.4, HP Workstation BIOS)
- [CVE-2021-3437](https://cve.now/CVE-2021-3437.md): Potential security vulnerabilities have been identified in an OMEN Gaming Hub SDK package which may allow escalation of privilege and/or den (CVSS 9.8, HP OMEN Gaming Hub SDK)
- [CVE-2022-37018](https://cve.now/CVE-2022-37018.md): A potential vulnerability has been identified in the system BIOS for certain HP PC products which may allow escalation of privileges and cod (CVSS 8.4, HP PC BIOS)
- [CVE-2022-1038](https://cve.now/CVE-2022-1038.md): A potential security vulnerability has been identified in the HP Jumpstart software, which might allow escalation of privilege. (CVSS 7.8, HP Jumpstart)
- [CVE-2022-44654](https://cve.now/CVE-2022-44654.md): Affected builds of Trend Micro Apex One and Apex One as a Service contain a monitor engine component that is complied without the /SAFESEH m (CVSS 7.5, Trend Micro Apex One)
- [CVE-2022-44653](https://cve.now/CVE-2022-44653.md): A security agent directory traversal vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalat (CVSS 7.8, Trend Micro Apex One)
- [CVE-2022-44652](https://cve.now/CVE-2022-44652.md): An improper handling of exceptional conditions vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker (CVSS 7.8, Trend Micro Apex One)
- [CVE-2022-44651](https://cve.now/CVE-2022-44651.md): A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escala (CVSS 7.0, Trend Micro Apex One)
- [CVE-2022-44650](https://cve.now/CVE-2022-44650.md): A memory corruption vulnerability in the Unauthorized Change Prevention service of Trend Micro Apex One and Apex One as a Service could allo (CVSS 7.8, Trend Micro Apex One)
- [CVE-2022-44649](https://cve.now/CVE-2022-44649.md): An out-of-bounds access vulnerability in the Unauthorized Change Prevention service of Trend Micro Apex One and Apex One as a Service could (CVSS 7.8, Trend Micro Apex One)
- [CVE-2022-44648](https://cve.now/CVE-2022-44648.md): An Out-of-bounds read vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to disclose sensitive inf (CVSS 5.5, Trend Micro Apex One)
- [CVE-2022-44647](https://cve.now/CVE-2022-44647.md): An Out-of-bounds read vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to disclose sensitive inf (CVSS 5.5, Trend Micro Apex One)
- [CVE-2022-40746](https://cve.now/CVE-2022-40746.md): IBM i Access Family 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.0 could allow a local authenticated attacker to execute arbitrary code on (CVSS 7.2, IBM i)
- [CVE-2022-40129](https://cve.now/CVE-2022-40129.md): A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430. (CVSS 8.8, Foxit Reader)
- [CVE-2022-38097](https://cve.now/CVE-2022-38097.md): A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430. (CVSS 8.8, Foxit Reader)
- [CVE-2022-37332](https://cve.now/CVE-2022-37332.md): A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430. (CVSS 8.8, Foxit Reader)
- [CVE-2022-32774](https://cve.now/CVE-2022-32774.md): A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430. (CVSS 8.8, Foxit Reader)
- [CVE-2022-3861](https://cve.now/CVE-2022-3861.md): Betheme \<= 26.5.1.4 - Authenticated (Subscriber+) PHP Object Injection (CVSS 8.8, MuffinGroup Betheme)
- [CVE-2022-3589](https://cve.now/CVE-2022-3589.md): Miele: Vulnerability in cloud service used by appWash (CVSS 8.1, Miele appWash)
- [CVE-2020-23582](https://cve.now/CVE-2020-23582.md): A vulnerability in the "/admin/wlmultipleap.asp" of optilink OP-XT71000N version: V2.2 could allow an unauthenticated, remote attacker to co (CVSS 6.5)
- [CVE-2021-24649](https://cve.now/CVE-2021-24649.md): WP User Frontend \< 3.5.29 - Obscure Registration as Admin (CVSS 9.8, WP User Frontend)
- [CVE-2022-0421](https://cve.now/CVE-2022-0421.md): Five Star Restaurant Reservations \< 2.4.12 - Unauthenticated Arbitrary Payment Status Update to Stored XSS (CVSS 6.1, Five Star Restaurant Reservations)
- [CVE-2022-1578](https://cve.now/CVE-2022-1578.md): My wpdb \< 2.5 - Arbitrary SQL Query via CSRF (CVSS 8.8, My wpdb)
- [CVE-2022-1579](https://cve.now/CVE-2022-1579.md): Login Block IPs \<= 1.0.0 - IP Spoofing Bypass (CVSS 7.5, Login Block IPs)
- [CVE-2022-1581](https://cve.now/CVE-2022-1581.md): WP-Polls \< 2.76.0 - IP Validation Bypass (CVSS 5.3, WP-Polls)
- [CVE-2022-30257](https://cve.now/CVE-2022-30257.md): An issue was discovered in Technitium DNS Server through 8.0.2 that allows variant V1 of unintended domain name resolution. (CVSS 9.8)
- [CVE-2022-30258](https://cve.now/CVE-2022-30258.md): An issue was discovered in Technitium DNS Server through 8.0.2 that allows variant V2 of unintended domain name resolution. (CVSS 9.8)
- [CVE-2022-3336](https://cve.now/CVE-2022-3336.md): Event Monster \< 1.2.0 - Visitors Deletion via CSRF (CVSS 4.3, Event Monster)
- [CVE-2022-3388](https://cve.now/CVE-2022-3388.md): Input Validation Vulnerability in Hitachi Energy’s MicroSCADA Pro/X SYS600 Products (CVSS 8.8, Hitachi Energy MicroSCADA Pro SYS600 · Hitachi Energy Micro…)
- [CVE-2022-35897](https://cve.now/CVE-2022-35897.md): An stack buffer overflow vulnerability leads to arbitrary code execution issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5. (CVSS 6.8)
- [CVE-2022-3600](https://cve.now/CVE-2022-3600.md): Easy Digital Downloads \< 3.1.0.2 - Unauthenticated CSV Injection (CVSS 9.8, Easy Digital Downloads)
- [CVE-2022-3618](https://cve.now/CVE-2022-3618.md): Spacer \< 3.0.7 - Admin+ Stored XSS (CVSS 4.8, Spacer)
- [CVE-2022-3634](https://cve.now/CVE-2022-3634.md): Contact Form 7 Database Addon \< 1.2.6.5 - CSV Injection (CVSS 9.8, Contact Form 7 Database Addon)
- [CVE-2022-3688](https://cve.now/CVE-2022-3688.md): WPQA \< 5.9 - Follow/Unfollow via CSRF (CVSS 8.8, WPQA Builder)
- [CVE-2022-3690](https://cve.now/CVE-2022-3690.md): Popup Maker \< 1.16.11 - Contributor+ Stored Cross Site Scripting (CVSS 5.5, Popup Maker)
- [CVE-2022-3691](https://cve.now/CVE-2022-3691.md): DeepL Pro API Translation \< 1.7.5 - API Key Disclosure (CVSS 7.5, DeepL Pro API translation plugin)
- [CVE-2022-3720](https://cve.now/CVE-2022-3720.md): Event Monster \< 1.2.1 - Admin+ SQLi (CVSS 7.2, Event Monster)
- [CVE-2022-3750](https://cve.now/CVE-2022-3750.md): Ask Me \< 6.8.7 - Post Deletion via CSRF (CVSS 4.7, Ask me)
- [CVE-2022-3753](https://cve.now/CVE-2022-3753.md): Evaluate \<= 1.0 - Admin+ Stored Cross-Site Scripting (CVSS 4.8, Evaluate)
- [CVE-2022-3762](https://cve.now/CVE-2022-3762.md): Booster for WooCommerce - ShopManager+ Arbitrary File Download (CVSS 6.5, Booster for WooCommerce · Booster Plus for WooCommerce +1)
- [CVE-2022-3763](https://cve.now/CVE-2022-3763.md): Booster for WooCommerce - Checkout Files Deletion via CSRF (CVSS 8.1, Booster for WooCommerce · Booster Plus for WooCommerce +1)
- [CVE-2022-38146](https://cve.now/CVE-2022-38146.md): Silverstripe silverstripe/framework through 4.11 allows XSS (issue 2 of 3). (CVSS 5.4, silverstripe/admin)
- [CVE-2022-38148](https://cve.now/CVE-2022-38148.md): Silverstripe silverstripe/framework through 4.11 allows SQL Injection. (CVSS 8.8, silverstripe/framework)
- [CVE-2022-38755](https://cve.now/CVE-2022-38755.md): Filr Remote unauthenticated user enumeration for versions prior to 4.3.1.1 (CVSS 5.3, Micro Focus Filr)
- [CVE-2022-40470](https://cve.now/CVE-2022-40470.md): Phpgurukul Blood Donor Management System 1.0 allows Cross Site Scripting via Add Blood Group Name Feature. (CVSS 4.8)
- [CVE-2022-4087](https://cve.now/CVE-2022-4087.md): iPXE TLS tls.c tls\_new\_ciphertext information exposure (CVSS 2.6, iPXE)
- [CVE-2022-4093](https://cve.now/CVE-2022-4093.md): SQL Injection in dolibarr/dolibarr (CVSS 8.1, dolibarr/dolibarr)
- [CVE-2022-4096](https://cve.now/CVE-2022-4096.md): Server-Side Request Forgery (SSRF) in appsmithorg/appsmith (CVSS 8.8, appsmithorg/appsmith)
- [CVE-2022-4105](https://cve.now/CVE-2022-4105.md): Cross-site Scripting (XSS) - Stored in kiwitcms/kiwi (CVSS 7.1, kiwitcms/kiwi · kiwitcms)
- [CVE-2022-41945](https://cve.now/CVE-2022-41945.md): Remote Code Execution (RCE) vulnerability in super-xray via URL input (CVSS 6.5, 4ra1n super-xray)
- [CVE-2022-42096](https://cve.now/CVE-2022-42096.md): Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via Post content. (CVSS 4.8, backdrop/backdrop)
- [CVE-2022-43117](https://cve.now/CVE-2022-43117.md): Sourcecodester Password Storage Application in PHP/OOP and MySQL 1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabi (CVSS 5.4)
- [CVE-2022-43143](https://cve.now/CVE-2022-43143.md): A cross-site scripting (XSS) vulnerability in Beekeeper Studio v3.6.6 allows attackers to execute arbitrary web scripts or HTML via a crafte (CVSS 9.6)
- [CVE-2022-43707](https://cve.now/CVE-2022-43707.md): MyBB 1.8.31 has a Cross-site scripting (XSS) vulnerability in the visual MyCode editor (SCEditor) allows remote attackers to inject HTML via (CVSS 6.1)
- [CVE-2022-43708](https://cve.now/CVE-2022-43708.md): MyBB 1.8.31 has a (issue 2 of 2) cross-site scripting (XSS) vulnerabilities in the post Attachments interface allow attackers to inject HTML (CVSS 6.1)
- [CVE-2022-43709](https://cve.now/CVE-2022-43709.md): MyBB 1.8.31 has a SQL injection vulnerability in the Admin CP's Users module allows remote authenticated users to modify the query string vi (CVSS 4.9)
- [CVE-2022-44156](https://cve.now/CVE-2022-44156.md): Tenda AC15 V15.03.05.19 is vulnerable to Buffer Overflow via function formSetIpMacBind. (CVSS 7.5)
- [CVE-2022-44158](https://cve.now/CVE-2022-44158.md): Tenda AC21 V16.03.08.15 is vulnerable to Buffer Overflow via function via set\_device\_name. (CVSS 7.5)
- [CVE-2022-44163](https://cve.now/CVE-2022-44163.md): Tenda AC21 V16.03.08.15 is vulnerable to Buffer Overflow via function formSetMacFilterCfg. (CVSS 7.5)
- [CVE-2022-44167](https://cve.now/CVE-2022-44167.md): Tenda AC15 V15.03.05.18 is avulnerable to Buffer Overflow via function formSetPPTPServer. (CVSS 7.5)
- [CVE-2022-44168](https://cve.now/CVE-2022-44168.md): Tenda AC15 V15.03.05.18 is vulnerable to Buffer Overflow via function fromSetRouteStatic.. (CVSS 7.5)
- [CVE-2022-44169](https://cve.now/CVE-2022-44169.md): Tenda AC15 V15.03.05.18 is vulnerable to Buffer Overflow via function formSetVirtualSer. (CVSS 7.5)
- [CVE-2022-44171](https://cve.now/CVE-2022-44171.md): Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function form\_fast\_setting\_wifi\_set. (CVSS 9.8)
- [CVE-2022-44172](https://cve.now/CVE-2022-44172.md): Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function R7WebsSecurityHandler. (CVSS 9.8)
- [CVE-2022-44174](https://cve.now/CVE-2022-44174.md): Tenda AC18 V15.03.05.05 is vulnerable to Buffer Overflow via function formSetDeviceName. (CVSS 9.8)
- [CVE-2022-44175](https://cve.now/CVE-2022-44175.md): Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function formSetMacFilterCfg. (CVSS 9.8)
- [CVE-2022-44176](https://cve.now/CVE-2022-44176.md): Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function fromSetRouteStatic. (CVSS 9.8)
- [CVE-2022-44177](https://cve.now/CVE-2022-44177.md): Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function formWifiWpsStart. (CVSS 9.8)
- [CVE-2022-44178](https://cve.now/CVE-2022-44178.md): Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow. (CVSS 9.8)
- [CVE-2022-44180](https://cve.now/CVE-2022-44180.md): Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function addWifiMacFilter. (CVSS 9.8)
- [CVE-2022-44183](https://cve.now/CVE-2022-44183.md): Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function formSetWifiGuestBasic. (CVSS 9.8)
- [CVE-2022-44784](https://cve.now/CVE-2022-44784.md): An issue was discovered in Appalti & Contratti 9.12.2. (CVSS 8.8)
- [CVE-2022-44785](https://cve.now/CVE-2022-44785.md): An issue was discovered in Appalti & Contratti 9.12.2. (CVSS 9.8)
- [CVE-2022-44786](https://cve.now/CVE-2022-44786.md): An issue was discovered in Appalti & Contratti 9.12.2. (CVSS 7.5)
- [CVE-2022-44787](https://cve.now/CVE-2022-44787.md): An issue was discovered in Appalti & Contratti 9.12.2. (CVSS 6.1)
- [CVE-2022-44788](https://cve.now/CVE-2022-44788.md): An issue was discovered in Appalti & Contratti 9.12.2. (CVSS 6.5)
- [CVE-2022-44830](https://cve.now/CVE-2022-44830.md): Sourcecodester Event Registration App v1.0 was discovered to contain multiple CSV injection vulnerabilities via the First Name, Contact and (CVSS 7.8)
- [CVE-2022-45012](https://cve.now/CVE-2022-45012.md): A cross-site scripting (XSS) vulnerability in the Modify Page module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or (CVSS 4.8)
- [CVE-2022-45013](https://cve.now/CVE-2022-45013.md): A cross-site scripting (XSS) vulnerability in the Show Advanced Option module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web s (CVSS 4.8)
- [CVE-2022-45014](https://cve.now/CVE-2022-45014.md): A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web script (CVSS 4.8)
- [CVE-2022-45015](https://cve.now/CVE-2022-45015.md): A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web script (CVSS 4.8)
- [CVE-2022-45016](https://cve.now/CVE-2022-45016.md): A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web script (CVSS 4.8)
- [CVE-2022-45017](https://cve.now/CVE-2022-45017.md): A cross-site scripting (XSS) vulnerability in the Overview Page settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web (CVSS 4.8)
- [CVE-2022-45146](https://cve.now/CVE-2022-45146.md): An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4. (no CVSS, org.bouncycastle:bc-fips)
- [CVE-2022-45422](https://cve.now/CVE-2022-45422.md): When LG SmartShare is installed, local privilege escalation is possible through DLL Hijacking attack. (CVSS 7.8, LG PC)
- [CVE-2022-45470](https://cve.now/CVE-2022-45470.md): Apache Hama allows XSS and information disclosure (CVSS 7.5, Apache Software Foundation Apache Hama · org.apache.hama:ha…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-11-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.