CVEs published November 25, 2022
59 CVEs were published on November 25, 2022: 11 critical, 20 high. 1 is now in CISA KEV.
- Published
- 59
- Critical
- 11
- High
- 20
- Medium
- 18
- Low
- 6
- Unrated
- 4
- Now in CISA KEV
- 1
- Fix available
- 23
Most affected products
- nextcloud security-advisories
- 8
- org.jeecgframework.boot:jeecg-module-system
- 4
- Browsershot · spatie/browsershot
- 3
- Tiny File Manager
- 3
- 4ra1n super-xray
- 1
- Badaso · badaso/core
- 1
- baserproject basercms · baserproject/basercms
- 1
- ETMS Co. OndiskPlayerAgent
- 1
- eyoom Co. eyoom builder
- 1
- Fortinet FortiManager · Fortinet FortiAnalyzer
- 1
Critical 11
- CVE-2022-36133The WebConfig functionality of Epson TM-C3500 and TM-C7500 devices with firmware version WAM31500 allows authentication bypass.
- CVE-2022-37720Orchardproject Orchard CMS 1.10.3 is vulnerable to Cross Site Scripting (XSS).
- CVE-2022-37721PyroCMS 3.9 is vulnerable to a stored Cross Site Scripting (XSS_ when a low privileged user such as an author, injects a crafted html and japyrocms/pyrocms
- CVE-2022-4135Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to pGoogle Chrome · electron
- CVE-2022-41705Badaso version 2.6.3 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server.Badaso · badaso/core
- CVE-2022-44843TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the port parameter in the setting/set
- CVE-2022-44844TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the pass parameter in the setting/set
- CVE-2022-45152A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle.Moodle · moodle/moodle
- CVE-2022-45206Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/duplicate/check.org.jeecgframework.boot:jeecg-module-system
- CVE-2022-45207Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component updateNullByEmptyString.org.jeecgframework.boot:jeecg-module-system
- CVE-2022-45476Tiny File Manager version 2.4.8 executes the code of files uploaded by users of the application, instead of just returning them for downloadTiny File Manager
High 20
- CVE-2022-23044Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to persuade users to perform unintended actions within the applicaTiny File Manager
- CVE-2022-2721In affected versions of Octopus Server it is possible for target discovery to print certain values marked as sensitive to log files in plainOctopus Deploy Octopus Server
- CVE-2022-38166In F-Secure Endpoint Protection for Windows and macOS before channel with Capricorn database 2022-11-22_07, the aerdl.dll unpacker handler c
- CVE-2022-38767An issue was discovered in Wind River VxWorks 6.9 and 7, that allows a specifically crafted packet sent by a Radius server, may cause Denial
- CVE-2022-38813PHPGurukul Blood Donor Management System 1.0 does not properly restrict access to admin/dashboard.php, which allows attackers to access all
- CVE-2022-40282The web server of Hirschmann BAT-C2 before 09.13.01.00R04 allows authenticated command injection.
- CVE-2022-41156OndiskPlayer Remote Code Execution VulnerabilityETMS Co. OndiskPlayerAgent
- CVE-2022-41157ERP solution Remote Code Execution VulnerabilityWebcash Co. sERP Server
- CVE-2022-41158eyoom builder Remote Code Execution Vulnerabilityeyoom Co. eyoom builder
- CVE-2022-4141Heap-based Buffer Overflow in vim/vimvim/vim
- CVE-2022-41706Browsershot 3.57.2 - Server Side XSS to LFR via URLBrowsershot · spatie/browsershot
- CVE-2022-41958Deserialization Vulnerability by yaml config input in super-xray4ra1n super-xray
- CVE-2022-43983Browsershot 3.57.2 - Server Side XSS to LFR via HTMLBrowsershot · spatie/browsershot
- CVE-2022-43984Browsershot 3.57.3 - Server Side XSS to LFR via HTMLBrowsershot · spatie/browsershot
- CVE-2022-44411Web Based Quiz System v1.0 transmits user passwords in plaintext during the authentication process, allowing attackers to obtain users' pass
- CVE-2022-44858Automotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /asms/products/view_p
- CVE-2022-44859Automotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /asms/admin/products/
- CVE-2022-44860Automotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/transactions/u
- CVE-2022-45039An arbitrary file upload vulnerability in the Server Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary code via a cra
- CVE-2022-45885An issue was discovered in the Linux kernel through 6.0.9.
Medium, low and unrated 28
- CVE-2022-38377An improper access control vulnerability [CWE-284] in FortiManager 7.2.0, 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2.0 through 6.2.9, 6.0Fortinet FortiManager · Fortinet FortiAnalyzer
- CVE-2022-0698Microweber version 1.3.1 allows an unauthenticated user to perform an account takeover via an XSS on the 'select-file' parameter.Microweber · microweber/microweber
- CVE-2022-39325Cross-site scripting vulnerability in BaserCMSbaserproject basercms · baserproject/basercms
- CVE-2022-39331Cross-site Scripting (XSS) in Nexcloud Desktop Clientnextcloud security-advisories
- CVE-2022-39332Cross-site scripting (XSS) in Nextcloud Desktop Client nextcloud security-advisories
- CVE-2022-39333Cross-site scripting (XSS) in Nextcloud Desktop Clientnextcloud security-advisories
- CVE-2022-39334nextcloudcmd incorrectly trusts bad TLS certificatesnextcloud security-advisories
- CVE-2022-39338Stored cross site scripting (XSS) vulnerability via Authorization Endpoint in user_oidcnextcloud security-advisories
- CVE-2022-39339Cleartext Transmission of Sensitive Information in user_oidcnextcloud security-advisories
- CVE-2022-39346Missing length validation of user displayname in nextcloud servernextcloud security-advisories
- CVE-2022-4091SourceCodester Canteen Management System food.php query cross site scriptingSourceCodester Canteen Management System
- CVE-2022-41712Frappe version 14.10.0 allows an external attacker to remotely obtain arbitrary local files.Frappe
- CVE-2022-41926Nextcloud Talk Android broadcast incorrect permission handlingnextcloud security-advisories
- CVE-2022-41954Temporary File Information Disclosure Vulnerabilityjoniles mpxj · net.sf.mpxj:mpxj +4
- CVE-2022-45036A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web script
- CVE-2022-45037A cross-site scripting (XSS) vulnerability in /admin/users/index.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or
- CVE-2022-45038A cross-site scripting (XSS) vulnerability in /admin/settings/save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts
- CVE-2022-45040A cross-site scripting (XSS) vulnerability in /admin/pages/sections_save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web sc
- CVE-2022-45205Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/dict/queryTableData.
- CVE-2022-45208Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/user/putRecycleBin.org.jeecgframework.boot:jeecg-module-system
- CVE-2022-45210Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/user/deleteRecycleBin.org.jeecgframework.boot:jeecg-module-system
- CVE-2022-45218Human Resource Management System v1.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability.
- CVE-2022-45225Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/index.php/book.
- CVE-2022-45475Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to access the application's internal files.Tiny File Manager
- CVE-2022-45884An issue was discovered in the Linux kernel through 6.0.9.
- CVE-2022-45886An issue was discovered in the Linux kernel through 6.0.9.
- CVE-2022-45887An issue was discovered in the Linux kernel through 6.0.9.
- CVE-2022-45888An issue was discovered in the Linux kernel through 6.0.9.