CVEs published November 22, 2022
83 CVEs were published on November 22, 2022: 36 critical, 20 high. 2 are now in CISA KEV.
- Published
- 83
- Critical
- 36
- High
- 20
- Medium
- 25
- Low
- 1
- Unrated
- 1
- Now in CISA KEV
- 2
- Fix available
- 24
Most affected products
- backdrop/backdrop
- 2
- MF286R
- 2
- sourcegraph
- 2
- 4ra1n super-xray
- 1
- All In One WP Security & Firewall Team All-In-One Security…
- 1
- Apache Software Foundation Apache Airflow Hive Provider… +1
- 1
- Apache Software Foundation Apache Airflow Pinot Provider… +1
- 1
- Apache Software Foundation Apache Airflow Spark Provider… +1
- 1
- Apache Software Foundation Apache Airlfow Pig Provider ·… +1
- 1
- ckan
- 1
Critical 36
- CVE-2021-3942Certain HP Print products and Digital Sending products may be vulnerable to potential remote code execution and buffer overflow with use of HP Print products and Digital Sending products
- CVE-2022-36179Fusiondirectory 1.3 suffers from Improper Session Handling.
- CVE-2022-36180Fusiondirectory 1.3 is vulnerable to Cross Site Scripting (XSS) via /fusiondirectory/index.php?message=[injection], /fusiondirectory/index.p
- CVE-2022-38649Apache Airflow Pinot provider allowed Command InjectionApache Software Foundation Apache Airflow Pinot Provider… +1
- CVE-2022-39070There is an access control vulnerability in some ZTE PON OLT products.ZXA10 C3XX
- CVE-2022-40189Apache Airlfow Pig Provider RCEApache Software Foundation Apache Airlfow Pig Provider ·… +1
- CVE-2022-40602A flaw in the Zyxel LTE3301-M209 firmware verisons prior to V1.00(ABLG.6)C0 could allow a remote attacker to access the device using an imprZyxel LTE3301-M209
- CVE-2022-40842ndk design NdkAdvancedCustomizationFields 3.5.0 is vulnerable to Server-side request forgery (SSRF) via rotateimg.php.
- CVE-2022-4116A vulnerability was found in quarkus.quarkus · io.quarkus:quarkus-vertx-http-deployment
- CVE-2022-41326The web conferencing component of Mitel MiCollab through 9.6.0.13 could allow an unauthenticated attacker to upload arbitrary scripts due to
- CVE-2022-41937Missing Authorization in XWiki Platformxwiki-platform · org.xwiki.platform:xwiki-platform-filter-ui
- CVE-2022-41943Incorrect default permissions found in Sourcegraphsourcegraph
- CVE-2022-42989ERP Sankhya before v4.11b81 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Caixa de Entrada.
- CVE-2022-43212Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the orderId parameter at fetchOrderData.php.
- CVE-2022-43214Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the orderId parameter at printOrder.php.
- CVE-2022-43215Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the endDate parameter at getOrderReport.php.
- CVE-2022-44184Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow in /usr/sbin/httpd via parameter wan_dns1_sec.
- CVE-2022-44186Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow in /usr/sbin/httpd via parameter wan_dns1_pri.
- CVE-2022-44187Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow via wan_dns1_pri.
- CVE-2022-44188Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow in /usr/sbin/httpd via parameter enable_band_steering.
- CVE-2022-44190Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow via parameter enable_band_steering.
- CVE-2022-44191Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow via parameters KEY1 and KEY2.
- CVE-2022-44193Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow in /usr/sbin/httpd via parameters: starthour, startminute , endhour, and endminute
- CVE-2022-44194Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow via parameters apmode_dns1_pri and apmode_dns1_sec.
- CVE-2022-44196Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow via parameter openvpn_push1.
- CVE-2022-44197Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow via parameter openvpn_server_ip.
- CVE-2022-44198Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow via parameter openvpn_push1.
- CVE-2022-44199Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow via parameter openvpn_server_ip.
- CVE-2022-44200Netgear R7000P V1.3.0.8, V1.3.1.64 is vulnerable to Buffer Overflow via parameters: stamode_dns1_pri and stamode_dns1_sec.
- CVE-2022-44201D-Link DIR823G 1.02B05 is vulnerable to Commad Injection.
- CVE-2022-44202D-Link DIR878 1.02B04 and 1.02B05 are vulnerable to Buffer Overflow.
- CVE-2022-44801D-Link DIR-878 1.02B05 is vulnerable to Incorrect Access Control.
- CVE-2022-44804D-Link DIR-882 1.10B02 and1.20B06 is vulnerable to Buffer Overflow via the websRedirect function.
- CVE-2022-44806D-Link DIR-882 1.10B02 and 1.20B06 is vulnerable to Buffer Overflow.
- CVE-2022-44807D-Link DIR-882 1.10B02 and 1.20B06 is vulnerable to Buffer Overflow via webGetVarString.
- CVE-2022-44808A command injection vulnerability has been found on D-Link DIR-823G devices with firmware version 1.02B03 that allows an attacker to execute
High 20
- CVE-2022-3910Use after free in IO_uring in the Linux KernelLinux Kernel
- CVE-2022-2513Cleartext Credentials Vulnerability on Hitachi Energy’s Multiple IED Connectivity Packages (IED ConnPacks) and PCM600 ProductsHitachi Energy PCM600 · Hitachi Energy 670 Connectivity… +4
- CVE-2022-37931A vulnerability in NetBatch-Plus software allows unauthorized access to the applicationHPE NetBatch-Plus software
- CVE-2022-0222A CWE-269: Improper Privilege Management vulnerability exists that could cause a denial of service of the Ethernet communication of the contSchneider Electric Modicon M340 CPUs · Schneider Electric M…
- CVE-2022-30529File upload vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to upload arbitrary
- CVE-2022-3088UC-8100A-ME-T System Image: Versions v1.0 to v1.6, UC-2100 System Image: Versions v1.0 to v1.12, UC-2100-W System Image: Versions v1.0 to v Moxa UC-8100A-ME-T System Imaage · Moxa UC-2100 System… +11
- CVE-2022-33012Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack.microweber/microweber
- CVE-2022-35407An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5.
- CVE-2022-37301A CWE-191: Integer Underflow (Wrap or Wraparound) vulnerability exists that could cause a denial of service of the controller due to memory Schneider Electric Modicon M340 CPU · Schneider Electric… +3
- CVE-2022-39066There is a SQL injection vulnerability in ZTE MF286R.MF286R
- CVE-2022-40303An issue was discovered in libxml2 before 2.10.3.platform/external/libxml2
- CVE-2022-40870The Web Client of Parallels Remote Application Server v18.0 is vulnerable to Host Header Injection attacks.
- CVE-2022-41131Apache Airflow Hive Provider vulnerability (command injection via hive_cli connection)Apache Software Foundation Apache Airflow Hive Provider… +1
- CVE-2022-41940Uncaught exception in engine.io socketio engine.io · engine.io
- CVE-2022-41942Sourcegraph vulnerable to Comand Injection via gitserversourcegraph
- CVE-2022-42098KLiK SocialMediaWebsite version v1.0.1 is vulnerable to SQL Injection via the profile.php.
- CVE-2022-43685CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request.ckan
- CVE-2022-43751McAfee Total Protection prior to version 16.0.49 contains an uncontrolled search path element vulnerability due to the use of a variable poi
- CVE-2022-45330AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the Category parameter at \category.php.
- CVE-2022-45331AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the p_id parameter at \post.php.
Medium, low and unrated 27
- CVE-2022-2791Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulnerable to CWE-434 Unrestricted Upload of File with Dangerous Type, Emerson Electric Proficy Machine Edition
- CVE-2022-40228IBM DataPower Gateway session fixationIBM DataPower Gateway
- CVE-2022-44737WordPress All In One WP Security plugin <= 5.1.0 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilitiesAll In One WP Security & Firewall Team All-In-One Security…
- CVE-2022-45363WordPress Betheme premium theme <= 26.6.1 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityMuffingroup Betheme
- CVE-2022-3500A vulnerability was found in keylime.keylime
- CVE-2022-36227In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if th
- CVE-2022-37773An authenticated SQL Injection vulnerability in the statistics page (/statistics/retrieve) of Maarch RM 2.8, via the filter parameter, allow
- CVE-2022-37774There is a broken access control vulnerability in the Maarch RM 2.8.3 solution.
- CVE-2022-38462Silverstripe silverstripe/framework through 4.11 is vulnerable to XSS by carefully crafting a return URL on a /dev/build or /Security/login silverstripe/framework
- CVE-2022-38724Silverstripe silverstripe/framework through 4.11.0, silverstripe/assets through 1.11.0, and silverstripe/asset-admin through 1.11.0 allow XSsilverstripe/assets · silverstripe/framework
- CVE-2022-39067There is a buffer overflow vulnerability in ZTE MF286R.MF286R
- CVE-2022-39199Lack of proper validation in immudb codenotary immudb · github.com/codenotary/immudb
- CVE-2022-39397Exposure of sensitive information in aliyun-oss-clienttu6ge oss-rs · aliyun-oss-client
- CVE-2022-40765A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker wit
- CVE-2022-40954Apache Airflow Spark Provider RCE that bypass restrictions to read arbitrary filesApache Software Foundation Apache Airflow Spark Provider… +1
- CVE-2022-4111Improper Validation of Specified Quantity in Input in tooljet/tooljettooljet/tooljet · tooljet
- CVE-2022-41223The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injec
- CVE-2022-41445A cross-site scripting (XSS) vulnerability in Record Management System using CodeIgniter 1.0 allows attackers to execute arbitrary web scrip
- CVE-2022-41919Fastify vulnerable to Cross-Site Request Forgery (CSRF) attack via incorrect content typefastify
- CVE-2022-41936Exposure of Private Personal Information to an Unauthorized Actor in xwiki-platform-rest-serverxwiki-platform · org.xwiki.platform:xwiki-platform-rest-ser…
- CVE-2022-41950Privilege Escalation Vulnerability by wrong chmod param4ra1n super-xray
- CVE-2022-41952Uncontrolled Resource Consumption in Matrix Synapse matrix-org synapse · matrix-synapse
- CVE-2022-42094Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the 'Card' content.backdrop/backdrop
- CVE-2022-42097Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via 'Comment.' .backdrop/backdrop
- CVE-2022-45529AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the post_category_id parameter at \admin\includes\edit_post.php.
- CVE-2022-45535AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the edit parameter at \admin\categories.php.
- CVE-2022-45536AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the id parameter at \admin\post_comments.php.