# CVEs published 2022-11-22

83 CVEs were published on November 22, 2022: 36 critical, 20 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2021-3942](https://cve.now/CVE-2021-3942.md): Certain HP Print products and Digital Sending products may be vulnerable to potential remote code execution and buffer overflow with use of (CVSS 9.8, HP Print products and Digital Sending products)
- [CVE-2022-2791](https://cve.now/CVE-2022-2791.md): Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulnerable to CWE-434 Unrestricted Upload of File with Dangerous Type, (CVSS 5.9, Emerson Electric Proficy Machine Edition)
- [CVE-2022-40228](https://cve.now/CVE-2022-40228.md): IBM DataPower Gateway session fixation (CVSS 3.7, IBM DataPower Gateway)
- [CVE-2022-44737](https://cve.now/CVE-2022-44737.md): WordPress All In One WP Security plugin \<= 5.1.0 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities (CVSS 6.5, All In One WP Security & Firewall Team All-In-One Security…)
- [CVE-2022-3910](https://cve.now/CVE-2022-3910.md): Use after free in IO\_uring in the Linux Kernel (CVSS 7.8, Linux Kernel)
- [CVE-2022-2513](https://cve.now/CVE-2022-2513.md): Cleartext Credentials Vulnerability on Hitachi Energy’s Multiple IED Connectivity Packages (IED ConnPacks) and PCM600 Products (CVSS 7.1, Hitachi Energy PCM600 · Hitachi Energy 670 Connectivity… +4)
- [CVE-2022-45363](https://cve.now/CVE-2022-45363.md): WordPress Betheme premium theme \<= 26.6.1 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (CVSS 5.4, Muffingroup Betheme)
- [CVE-2022-37931](https://cve.now/CVE-2022-37931.md): A vulnerability in NetBatch-Plus software allows unauthorized access to the application (CVSS 7.3, HPE NetBatch-Plus software)
- [CVE-2022-0222](https://cve.now/CVE-2022-0222.md): A CWE-269: Improper Privilege Management vulnerability exists that could cause a denial of service of the Ethernet communication of the cont (CVSS 7.5, Schneider Electric Modicon M340 CPUs · Schneider Electric M…)
- [CVE-2022-30529](https://cve.now/CVE-2022-30529.md): File upload vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to upload arbitrary (CVSS 7.2)
- [CVE-2022-3088](https://cve.now/CVE-2022-3088.md): UC-8100A-ME-T System Image: Versions v1.0 to v1.6, UC-2100 System Image: Versions v1.0 to v1.12, UC-2100-W System Image: Versions v1.0 to v (CVSS 7.8, Moxa UC-8100A-ME-T System Imaage · Moxa UC-2100 System… +11)
- [CVE-2022-33012](https://cve.now/CVE-2022-33012.md): Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack. (CVSS 8.8, microweber/microweber)
- [CVE-2022-3500](https://cve.now/CVE-2022-3500.md): A vulnerability was found in keylime. (CVSS 5.1, keylime)
- [CVE-2022-35407](https://cve.now/CVE-2022-35407.md): An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. (CVSS 7.8)
- [CVE-2022-36179](https://cve.now/CVE-2022-36179.md): Fusiondirectory 1.3 suffers from Improper Session Handling. (CVSS 9.8)
- [CVE-2022-36180](https://cve.now/CVE-2022-36180.md): Fusiondirectory 1.3 is vulnerable to Cross Site Scripting (XSS) via /fusiondirectory/index.php?message=\[injection\], /fusiondirectory/index.p (CVSS 9.6)
- [CVE-2022-36227](https://cve.now/CVE-2022-36227.md): In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if th (no CVSS)
- [CVE-2022-37301](https://cve.now/CVE-2022-37301.md): A CWE-191: Integer Underflow (Wrap or Wraparound) vulnerability exists that could cause a denial of service of the controller due to memory (CVSS 7.5, Schneider Electric Modicon M340 CPU · Schneider Electric… +3)
- [CVE-2022-37773](https://cve.now/CVE-2022-37773.md): An authenticated SQL Injection vulnerability in the statistics page (/statistics/retrieve) of Maarch RM 2.8, via the filter parameter, allow (CVSS 6.5)
- [CVE-2022-37774](https://cve.now/CVE-2022-37774.md): There is a broken access control vulnerability in the Maarch RM 2.8.3 solution. (CVSS 5.3)
- [CVE-2022-38462](https://cve.now/CVE-2022-38462.md): Silverstripe silverstripe/framework through 4.11 is vulnerable to XSS by carefully crafting a return URL on a /dev/build or /Security/login (CVSS 6.1, silverstripe/framework)
- [CVE-2022-38649](https://cve.now/CVE-2022-38649.md): Apache Airflow Pinot provider allowed Command Injection (CVSS 9.8, Apache Software Foundation Apache Airflow Pinot Provider… +1)
- [CVE-2022-38724](https://cve.now/CVE-2022-38724.md): Silverstripe silverstripe/framework through 4.11.0, silverstripe/assets through 1.11.0, and silverstripe/asset-admin through 1.11.0 allow XS (CVSS 5.4, silverstripe/assets · silverstripe/framework)
- [CVE-2022-39066](https://cve.now/CVE-2022-39066.md): There is a SQL injection vulnerability in ZTE MF286R. (CVSS 8.8, MF286R)
- [CVE-2022-39067](https://cve.now/CVE-2022-39067.md): There is a buffer overflow vulnerability in ZTE MF286R. (CVSS 6.5, MF286R)
- [CVE-2022-39070](https://cve.now/CVE-2022-39070.md): There is an access control vulnerability in some ZTE PON OLT products. (CVSS 9.8, ZXA10 C3XX)
- [CVE-2022-39199](https://cve.now/CVE-2022-39199.md): Lack of proper validation in immudb (CVSS 5.8, codenotary immudb · github.com/codenotary/immudb)
- [CVE-2022-39397](https://cve.now/CVE-2022-39397.md): Exposure of sensitive information in aliyun-oss-client (CVSS 5.6, tu6ge oss-rs · aliyun-oss-client)
- [CVE-2022-40189](https://cve.now/CVE-2022-40189.md): Apache Airlfow Pig Provider RCE (CVSS 9.8, Apache Software Foundation Apache Airlfow Pig Provider ·… +1)
- [CVE-2022-40303](https://cve.now/CVE-2022-40303.md): An issue was discovered in libxml2 before 2.10.3. (CVSS 7.5, platform/external/libxml2)
- [CVE-2022-40602](https://cve.now/CVE-2022-40602.md): A flaw in the Zyxel LTE3301-M209 firmware verisons prior to V1.00(ABLG.6)C0 could allow a remote attacker to access the device using an impr (CVSS 9.8, Zyxel LTE3301-M209)
- [CVE-2022-40765](https://cve.now/CVE-2022-40765.md): A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker wit (CVSS 6.8, KEV)
- [CVE-2022-40842](https://cve.now/CVE-2022-40842.md): ndk design NdkAdvancedCustomizationFields 3.5.0 is vulnerable to Server-side request forgery (SSRF) via rotateimg.php. (CVSS 9.1)
- [CVE-2022-40870](https://cve.now/CVE-2022-40870.md): The Web Client of Parallels Remote Application Server v18.0 is vulnerable to Host Header Injection attacks. (CVSS 8.1)
- [CVE-2022-40954](https://cve.now/CVE-2022-40954.md): Apache Airflow Spark Provider RCE that bypass restrictions to read arbitrary files (CVSS 5.5, Apache Software Foundation Apache Airflow Spark Provider… +1)
- [CVE-2022-4111](https://cve.now/CVE-2022-4111.md): Improper Validation of Specified Quantity in Input in tooljet/tooljet (CVSS 6.5, tooljet/tooljet · tooljet)
- [CVE-2022-41131](https://cve.now/CVE-2022-41131.md): Apache Airflow Hive Provider vulnerability (command injection via hive\_cli connection) (CVSS 7.8, Apache Software Foundation Apache Airflow Hive Provider… +1)
- [CVE-2022-4116](https://cve.now/CVE-2022-4116.md): A vulnerability was found in quarkus. (CVSS 9.8, quarkus · io.quarkus:quarkus-vertx-http-deployment)
- [CVE-2022-41223](https://cve.now/CVE-2022-41223.md): The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injec (CVSS 6.8, KEV)
- [CVE-2022-41326](https://cve.now/CVE-2022-41326.md): The web conferencing component of Mitel MiCollab through 9.6.0.13 could allow an unauthenticated attacker to upload arbitrary scripts due to (CVSS 9.8)
- [CVE-2022-41445](https://cve.now/CVE-2022-41445.md): A cross-site scripting (XSS) vulnerability in Record Management System using CodeIgniter 1.0 allows attackers to execute arbitrary web scrip (CVSS 4.8)
- [CVE-2022-41919](https://cve.now/CVE-2022-41919.md): Fastify vulnerable to Cross-Site Request Forgery (CSRF) attack via incorrect content type (CVSS 4.2, fastify)
- [CVE-2022-41936](https://cve.now/CVE-2022-41936.md): Exposure of Private Personal Information to an Unauthorized Actor in xwiki-platform-rest-server (CVSS 5.3, xwiki-platform · org.xwiki.platform:xwiki-platform-rest-ser…)
- [CVE-2022-41937](https://cve.now/CVE-2022-41937.md): Missing Authorization in XWiki Platform (CVSS 9.6, xwiki-platform · org.xwiki.platform:xwiki-platform-filter-ui)
- [CVE-2022-41940](https://cve.now/CVE-2022-41940.md): Uncaught exception in engine.io (CVSS 7.1, socketio engine.io · engine.io)
- [CVE-2022-41942](https://cve.now/CVE-2022-41942.md): Sourcegraph vulnerable to Comand Injection via gitserver (CVSS 7.9, sourcegraph)
- [CVE-2022-41943](https://cve.now/CVE-2022-41943.md): Incorrect default permissions found in Sourcegraph (CVSS 9.0, sourcegraph)
- [CVE-2022-41950](https://cve.now/CVE-2022-41950.md): Privilege Escalation Vulnerability by wrong chmod param (CVSS 6.4, 4ra1n super-xray)
- [CVE-2022-41952](https://cve.now/CVE-2022-41952.md): Uncontrolled Resource Consumption in Matrix Synapse (CVSS 6.5, matrix-org synapse · matrix-synapse)
- [CVE-2022-42094](https://cve.now/CVE-2022-42094.md): Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the 'Card' content. (CVSS 4.8, backdrop/backdrop)
- [CVE-2022-42097](https://cve.now/CVE-2022-42097.md): Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via 'Comment.' . (CVSS 4.8, backdrop/backdrop)
- [CVE-2022-42098](https://cve.now/CVE-2022-42098.md): KLiK SocialMediaWebsite version v1.0.1 is vulnerable to SQL Injection via the profile.php. (CVSS 8.8)
- [CVE-2022-42989](https://cve.now/CVE-2022-42989.md): ERP Sankhya before v4.11b81 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Caixa de Entrada. (CVSS 9.0)
- [CVE-2022-43212](https://cve.now/CVE-2022-43212.md): Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the orderId parameter at fetchOrderData.php. (CVSS 9.8)
- [CVE-2022-43214](https://cve.now/CVE-2022-43214.md): Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the orderId parameter at printOrder.php. (CVSS 9.8)
- [CVE-2022-43215](https://cve.now/CVE-2022-43215.md): Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the endDate parameter at getOrderReport.php. (CVSS 9.8)
- [CVE-2022-43685](https://cve.now/CVE-2022-43685.md): CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request. (CVSS 8.8, ckan)
- [CVE-2022-43751](https://cve.now/CVE-2022-43751.md): McAfee Total Protection prior to version 16.0.49 contains an uncontrolled search path element vulnerability due to the use of a variable poi (CVSS 7.8)
- [CVE-2022-44184](https://cve.now/CVE-2022-44184.md): Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow in /usr/sbin/httpd via parameter wan\_dns1\_sec. (CVSS 9.8)
- [CVE-2022-44186](https://cve.now/CVE-2022-44186.md): Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow in /usr/sbin/httpd via parameter wan\_dns1\_pri. (CVSS 9.8)
- [CVE-2022-44187](https://cve.now/CVE-2022-44187.md): Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow via wan\_dns1\_pri. (CVSS 9.8)
- [CVE-2022-44188](https://cve.now/CVE-2022-44188.md): Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow in /usr/sbin/httpd via parameter enable\_band\_steering. (CVSS 9.8)
- [CVE-2022-44190](https://cve.now/CVE-2022-44190.md): Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow via parameter enable\_band\_steering. (CVSS 9.8)
- [CVE-2022-44191](https://cve.now/CVE-2022-44191.md): Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow via parameters KEY1 and KEY2. (CVSS 9.8)
- [CVE-2022-44193](https://cve.now/CVE-2022-44193.md): Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow in /usr/sbin/httpd via parameters: starthour, startminute , endhour, and endminute (CVSS 9.8)
- [CVE-2022-44194](https://cve.now/CVE-2022-44194.md): Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow via parameters apmode\_dns1\_pri and apmode\_dns1\_sec. (CVSS 9.8)
- [CVE-2022-44196](https://cve.now/CVE-2022-44196.md): Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow via parameter openvpn\_push1. (CVSS 9.8)
- [CVE-2022-44197](https://cve.now/CVE-2022-44197.md): Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow via parameter openvpn\_server\_ip. (CVSS 9.8)
- [CVE-2022-44198](https://cve.now/CVE-2022-44198.md): Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow via parameter openvpn\_push1. (CVSS 9.8)
- [CVE-2022-44199](https://cve.now/CVE-2022-44199.md): Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow via parameter openvpn\_server\_ip. (CVSS 9.8)
- [CVE-2022-44200](https://cve.now/CVE-2022-44200.md): Netgear R7000P V1.3.0.8, V1.3.1.64 is vulnerable to Buffer Overflow via parameters: stamode\_dns1\_pri and stamode\_dns1\_sec. (CVSS 9.8)
- [CVE-2022-44201](https://cve.now/CVE-2022-44201.md): D-Link DIR823G 1.02B05 is vulnerable to Commad Injection. (CVSS 9.8)
- [CVE-2022-44202](https://cve.now/CVE-2022-44202.md): D-Link DIR878 1.02B04 and 1.02B05 are vulnerable to Buffer Overflow. (CVSS 9.8)
- [CVE-2022-44801](https://cve.now/CVE-2022-44801.md): D-Link DIR-878 1.02B05 is vulnerable to Incorrect Access Control. (CVSS 9.8)
- [CVE-2022-44804](https://cve.now/CVE-2022-44804.md): D-Link DIR-882 1.10B02 and1.20B06 is vulnerable to Buffer Overflow via the websRedirect function. (CVSS 9.8)
- [CVE-2022-44806](https://cve.now/CVE-2022-44806.md): D-Link DIR-882 1.10B02 and 1.20B06 is vulnerable to Buffer Overflow. (CVSS 9.8)
- [CVE-2022-44807](https://cve.now/CVE-2022-44807.md): D-Link DIR-882 1.10B02 and 1.20B06 is vulnerable to Buffer Overflow via webGetVarString. (CVSS 9.8)
- [CVE-2022-44808](https://cve.now/CVE-2022-44808.md): A command injection vulnerability has been found on D-Link DIR-823G devices with firmware version 1.02B03 that allows an attacker to execute (CVSS 9.8)
- [CVE-2022-45330](https://cve.now/CVE-2022-45330.md): AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the Category parameter at \\category.php. (CVSS 7.5)
- [CVE-2022-45331](https://cve.now/CVE-2022-45331.md): AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the p\_id parameter at \\post.php. (CVSS 7.5)
- [CVE-2022-45529](https://cve.now/CVE-2022-45529.md): AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the post\_category\_id parameter at \\admin\\includes\\edit\_post.php. (CVSS 4.9)
- [CVE-2022-45535](https://cve.now/CVE-2022-45535.md): AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the edit parameter at \\admin\\categories.php. (CVSS 4.9)
- [CVE-2022-45536](https://cve.now/CVE-2022-45536.md): AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the id parameter at \\admin\\post\_comments.php. (CVSS 4.9)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-11-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.