CVEs published November 23, 2022
94 CVEs were published on November 23, 2022: 23 critical, 30 high.
- Published
- 94
- Critical
- 23
- High
- 30
- Medium
- 37
- Low
- 3
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 33
Most affected products
- Moodle · moodle/moodle
- 3
- SolarWinds SEM
- 3
- Linux Kernel
- 2
- Mattermost · github.com/mattermost/mattermost-server
- 2
- silverstripe/framework
- 2
- xwiki-platform · org.xwiki.platform:xwiki-platform-oldcore
- 2
- airbnb optica
- 1
- Apache Software Foundation Apache DolphinScheduler · org.ap…
- 1
- backdrop/backdrop
- 1
- codenotary immudb · github.com/codenotary/immudb
- 1
Critical 23
- CVE-2020-23583OPTILINK OP-XT71000N V2.2 is vulnerable to Remote Code Execution.
- CVE-2020-23584Unauthenticated remote code execution in OPTILINK OP-XT71000N, Hardware Version: V2.2 occurs when the attacker passes arbitrary commands wit
- CVE-2020-23591A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an attacker to upload arbitrary f
- CVE-2021-35284SQL Injection vulnerability in function get_user in login_manager.php in rizalafani cms-php v1.
- CVE-2022-41875Remote Code Execution in Opticaairbnb optica
- CVE-2022-41923Grails Spring Security Core plugin vulnerable to privilege escalationgrails-spring-security-core
- CVE-2022-41924Tailscale Windows daemon is vulnerable to RCE via CSRFtailscale · tailscale.com
- CVE-2022-41928XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xmlxwiki-platform · org.xwiki.platform:xwiki-platform-attachme…
- CVE-2022-41931Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in xwiki-platform-icon-uixwiki-platform · org.xwiki.platform:xwiki-platform-icon-ui
- CVE-2022-41934Improper Neutralization of Directives in Dynamically Evaluated Code in org.xwiki.platform:xwiki-platform-menu-uixwiki-platform · org.xwiki.platform:xwiki-platform-menu-ui
- CVE-2022-43196dedecmdv6 v6.1.9 is vulnerable to Arbitrary file deletion via file_manage_control.php.
- CVE-2022-43213Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at editorder.php.
- CVE-2022-44118dedecmdv6 v6.1.9 is vulnerable to Remote Code Execution (RCE) via file_manage_control.php.
- CVE-2022-44120dedecmdv6 6.1.9 is vulnerable to SQL Injection.
- CVE-2022-44139Apartment Visitor Management System v1.0 is vulnerable to SQL Injection via /avms/index.php.
- CVE-2022-44249TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the FileName parameter in the UploadFirmwareFile function.
- CVE-2022-44250TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the hostName parameter in the setOpModeCfg function.
- CVE-2022-44251TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the ussd parameter in the setUssd function.
- CVE-2022-44252TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the FileName parameter in the setUploadSetting function.
- CVE-2022-44255TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a pre-authentication buffer overflow in the main function via long post data.
- CVE-2022-45276An issue in the /index/user/user_edit.html component of YJCMS v1.0.9 allows unauthenticated attackers to obtain the Administrator account pa
- CVE-2022-45462Apache DolphinScheduler prior to 2.0.5 have command execution vulnerabilityApache Software Foundation Apache DolphinScheduler · org.ap…
- CVE-2022-45872iTerm2 before 3.4.18 mishandles a DECRQSS response.
High 30
- CVE-2022-42896Info Leak in l2cap_core in the Linux KernelLinux Kernel
- CVE-2009-1143An issue was discovered in open-vm-tools 2009.03.18-154848.
- CVE-2020-23585A remote attacker can conduct a cross-site request forgery (CSRF) attack on OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version:
- CVE-2020-23592A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attack
- CVE-2021-29334An issue was discovered in JIZHI CMS 1.9.4.
- CVE-2021-43258CartView.php in ChurchInfo 1.3.0 allows attackers to achieve remote code execution through insecure uploads.
- CVE-2021-46854mod_radius in ProFTPD before 1.3.7c allows memory disclosure to RADIUS servers because it copies blocks of 16 characters.
- CVE-2022-23740Improper Neutralization of Argument Delimiters in a Command in GitHub Enterprise Server leading to Remote Code ExecutionGitHub Enterprise Server
- CVE-2022-34830An Arm product family through 2022-06-29 has a TOCTOU Race Condition that allows non-privileged user to make improper GPU processing operati
- CVE-2022-36337An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5.
- CVE-2022-37772Maarch RM 2.8.3 solution contains an improper restriction of excessive authentication attempts due to excessive verbose responses from the a
- CVE-2022-39833FileCloud Versions 20.2 and later allows remote attackers to potentially cause unauthorized remote code execution and access to reported API
- CVE-2022-40304An issue was discovered in libxml2 before 2.10.3.
- CVE-2022-40770Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to authenticated command injection.
- CVE-2022-41922yiisoft/yii before v1.1.27 vulnerable to Remote Code Execution if the application calls `unserialize()` on arbitrary user inputyiisoft yii · yiisoft/yii
- CVE-2022-41927XWiki Platform vulnerable to Cross-Site Request Forgery (CSRF) allowing to delete or rename tagsxwiki-platform · org.xwiki.platform:xwiki-platform-tag-ui
- CVE-2022-41930org.xwiki.platform:xwiki-platform-user-profile-ui missing authorization to enable or disable usersxwiki-platform · org.xwiki.platform:xwiki-platform-user-pro…
- CVE-2022-41932Creation of new database tables through login form on PostgreSQLxwiki-platform · org.xwiki.platform:xwiki-platform-oldcore
- CVE-2022-44140Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /Member/memberedit.html component.
- CVE-2022-44253TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter ip in the setDiagnosisCfg function.
- CVE-2022-44254TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter text in the setSmsCfg function.
- CVE-2022-44256TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter lang in the setLanguageCfg function.
- CVE-2022-44257TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter pppoeUser in the setOpModeCfg function.
- CVE-2022-44258TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter command in the setTracerouteCfg function.
- CVE-2022-44259TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter week, sTime, and eTime in the setParental
- CVE-2022-44260TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter sPort/ePort in the setIpPortFilterRules f
- CVE-2022-44278Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=user/manage_user&id=.
- CVE-2022-44789A logical issue in O_getOwnPropertyDescriptor() in Artifex MuJS 1.0.0 through 1.3.x before 1.3.2 allows an attacker to achieve Remote Code E
- CVE-2022-45278Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /index.php/admins/Fields/get_fields.html component.
- CVE-2022-45868The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allowcom.h2database:h2
Medium, low and unrated 41
- CVE-2021-35246Unprotected Transport of Credentials (HSTS) VulnerabilitySolarWinds Engineer's Toolset
- CVE-2022-42895Info Leak in l2cap_core in the Linux KernelLinux Kernel
- CVE-2022-4045Authenticated user could send multiple requests containing a parameter which could fetch a large amount of data and can crash a Mattermost serverMattermost · github.com/mattermost/mattermost-server
- CVE-2022-4044Authenticated user could send multiple requests containing a large Auto Responder Message payload and can crash a Mattermost serverMattermost · github.com/mattermost/mattermost-server
- CVE-2022-4019Authenticated user could send multiple requests containing a large payload to a Playbooks API and can crash a Mattermost serverMattermost Playbooks Plugin
- CVE-2009-1142An issue was discovered in open-vm-tools 2009.03.18-154848.
- CVE-2020-23586A vulnerability found in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote
- CVE-2020-23587A vulnerability found in the OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, rem
- CVE-2020-23588A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attack
- CVE-2020-23589A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attack
- CVE-2020-23590A vulnerability in Optilink OP-XT71000N Hardware version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated remote attacke
- CVE-2020-23593A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2, Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacke
- CVE-2022-35500Amasty Blog 2.10.3 is vulnerable to Cross Site Scripting (XSS) via leave comment functionality.
- CVE-2022-35501Stored Cross-site Scripting (XSS) exists in the Amasty Blog Pro 2.10.3 and 2.10.4 plugin for Magento 2 because of the duplicate post functio
- CVE-2022-36111immundb has insufficient verification of data authenticitycodenotary immudb · github.com/codenotary/immudb
- CVE-2022-37421Silverstripe silverstripe/cms through 4.11.0 allows XSS.silverstripe/cms
- CVE-2022-37429Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 2) via JavaScript payload to the href attribute of a link by splittisilverstripe/framework
- CVE-2022-37430Silverstripe silverstripe/framework through 4.11 allows XSS vulnerability via href attribute of a link (issue 2 of 2).silverstripe/framework
- CVE-2022-38113Information Disclosure Vulnerability SolarWinds SEM
- CVE-2022-38114Client-Side Desync Vulnerability SolarWinds SEM
- CVE-2022-38115Insecure Methods VulnerabilitySolarWinds SEM
- CVE-2022-38145Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 3) via remote attackers adding a Javascript payload to a page's metasilverstripe/versioned-admin
- CVE-2022-38147Silverstripe silverstripe/framework through 4.11 allows XSS (issue 3 of 3).silverstripe/assets
- CVE-2022-40771Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to an XML External Entity attack that leads to Information Disclo
- CVE-2022-40772Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to a validation bypass that allows users to access sensitive data
- CVE-2022-41446An access control issue in /Admin/dashboard.php of Record Management System using CodeIgniter v1.0 allows attackers to access and modify use
- CVE-2022-41925Tailscale daemon is vulnerable to information disclosure via CSRFtailscale · tailscale.com +1
- CVE-2022-41929Missing Authorization in User#setDisabledStatus in org.xwiki.platform:xwiki-platform-oldcorexwiki-platform · org.xwiki.platform:xwiki-platform-oldcore
- CVE-2022-41933Plaintext storage of password in org.xwiki.platform:xwiki-platform-security-authentication-defaultxwiki-platform · org.xwiki.platform:xwiki-platform-security…
- CVE-2022-41935Exposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-livetable-uixwiki-platform · org.xwiki.platform:xwiki-platform-livetabl…
- CVE-2022-41946TemporaryFolder on unix-like systems does not limit access to created files in pgjdbcpgjdbc · org.postgresql:postgresql
- CVE-2022-42095Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Page content.backdrop/backdrop
- CVE-2022-44117Boa 0.94.14rc21 is vulnerable to SQL Injection via username.
- CVE-2022-44280Automotive Shop Management System v1.0 is vulnerable to Delete any file via /asms/classes/Master.php?f=delete_img.
- CVE-2022-45149A vulnerability was found in Moodle which exists due to insufficient validation of the HTTP request origin in course redirect URL.Moodle · moodle/moodle
- CVE-2022-45150A reflected cross-site scripting vulnerability was discovered in Moodle.Moodle · moodle/moodle
- CVE-2022-45151The stored-XSS vulnerability was discovered in Moodle which exists due to insufficient sanitization of user-supplied data in several "socialMoodle · moodle/moodle
- CVE-2022-45280A cross-site scripting (XSS) vulnerability in the Url parameter in /login.php of EyouCMS v1.6.0 allows attackers to execute arbitrary web sc
- CVE-2022-45472CAE LearningSpace Enterprise (with Intuity License) image 267r patch 639 allows DOM XSS, related to ontouchmove and onpointerup.
- CVE-2022-45866qpress before PierreLvx/qpress 20220819 and before version 11.3, as used in Percona XtraBackup and other products, allows directory traversa
- CVE-2022-45873systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that has a long backtrace.