# CVEs published 2022-11-25

59 CVEs were published on November 25, 2022: 11 critical, 20 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2022-38377](https://cve.now/CVE-2022-38377.md): An improper access control vulnerability \[CWE-284\] in FortiManager 7.2.0, 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2.0 through 6.2.9, 6.0 (CVSS 4.1, Fortinet FortiManager · Fortinet FortiAnalyzer)
- [CVE-2022-0698](https://cve.now/CVE-2022-0698.md): Microweber version 1.3.1 allows an unauthenticated user to perform an account takeover via an XSS on the 'select-file' parameter. (CVSS 6.1, Microweber · microweber/microweber)
- [CVE-2022-23044](https://cve.now/CVE-2022-23044.md): Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to persuade users to perform unintended actions within the applica (CVSS 8.8, Tiny File Manager)
- [CVE-2022-2721](https://cve.now/CVE-2022-2721.md): In affected versions of Octopus Server it is possible for target discovery to print certain values marked as sensitive to log files in plain (CVSS 7.5, Octopus Deploy Octopus Server)
- [CVE-2022-36133](https://cve.now/CVE-2022-36133.md): The WebConfig functionality of Epson TM-C3500 and TM-C7500 devices with firmware version WAM31500 allows authentication bypass. (CVSS 9.1)
- [CVE-2022-37720](https://cve.now/CVE-2022-37720.md): Orchardproject Orchard CMS 1.10.3 is vulnerable to Cross Site Scripting (XSS). (CVSS 9.0)
- [CVE-2022-37721](https://cve.now/CVE-2022-37721.md): PyroCMS 3.9 is vulnerable to a stored Cross Site Scripting (XSS\_ when a low privileged user such as an author, injects a crafted html and ja (CVSS 9.0, pyrocms/pyrocms)
- [CVE-2022-38166](https://cve.now/CVE-2022-38166.md): In F-Secure Endpoint Protection for Windows and macOS before channel with Capricorn database 2022-11-22\_07, the aerdl.dll unpacker handler c (CVSS 7.5)
- [CVE-2022-38767](https://cve.now/CVE-2022-38767.md): An issue was discovered in Wind River VxWorks 6.9 and 7, that allows a specifically crafted packet sent by a Radius server, may cause Denial (CVSS 7.5)
- [CVE-2022-38813](https://cve.now/CVE-2022-38813.md): PHPGurukul Blood Donor Management System 1.0 does not properly restrict access to admin/dashboard.php, which allows attackers to access all (CVSS 8.1)
- [CVE-2022-39325](https://cve.now/CVE-2022-39325.md): Cross-site scripting vulnerability in BaserCMS (CVSS 4.6, baserproject basercms · baserproject/basercms)
- [CVE-2022-39331](https://cve.now/CVE-2022-39331.md): Cross-site Scripting (XSS) in Nexcloud Desktop Client (CVSS 4.6, nextcloud security-advisories)
- [CVE-2022-39332](https://cve.now/CVE-2022-39332.md): Cross-site scripting (XSS) in Nextcloud Desktop Client (CVSS 4.6, nextcloud security-advisories)
- [CVE-2022-39333](https://cve.now/CVE-2022-39333.md): Cross-site scripting (XSS) in Nextcloud Desktop Client (CVSS 4.6, nextcloud security-advisories)
- [CVE-2022-39334](https://cve.now/CVE-2022-39334.md): nextcloudcmd incorrectly trusts bad TLS certificates (CVSS 3.9, nextcloud security-advisories)
- [CVE-2022-39338](https://cve.now/CVE-2022-39338.md): Stored cross site scripting (XSS) vulnerability via Authorization Endpoint in user\_oidc (CVSS 3.5, nextcloud security-advisories)
- [CVE-2022-39339](https://cve.now/CVE-2022-39339.md): Cleartext Transmission of Sensitive Information in user\_oidc (CVSS 4.3, nextcloud security-advisories)
- [CVE-2022-39346](https://cve.now/CVE-2022-39346.md): Missing length validation of user displayname in nextcloud server (CVSS 3.5, nextcloud security-advisories)
- [CVE-2022-40282](https://cve.now/CVE-2022-40282.md): The web server of Hirschmann BAT-C2 before 09.13.01.00R04 allows authenticated command injection. (CVSS 8.8)
- [CVE-2022-4091](https://cve.now/CVE-2022-4091.md): SourceCodester Canteen Management System food.php query cross site scripting (CVSS 3.5, SourceCodester Canteen Management System)
- [CVE-2022-41156](https://cve.now/CVE-2022-41156.md): OndiskPlayer Remote Code Execution Vulnerability (CVSS 7.8, ETMS Co. OndiskPlayerAgent)
- [CVE-2022-41157](https://cve.now/CVE-2022-41157.md): ERP solution Remote Code Execution Vulnerability (CVSS 8.1, Webcash Co. sERP Server)
- [CVE-2022-41158](https://cve.now/CVE-2022-41158.md): eyoom builder Remote Code Execution Vulnerability (CVSS 7.2, eyoom Co. eyoom builder)
- [CVE-2022-4135](https://cve.now/CVE-2022-4135.md): Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to p (CVSS 9.6, KEV, Google Chrome · electron)
- [CVE-2022-4141](https://cve.now/CVE-2022-4141.md): Heap-based Buffer Overflow in vim/vim (CVSS 7.3, vim/vim)
- [CVE-2022-41705](https://cve.now/CVE-2022-41705.md): Badaso version 2.6.3 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. (CVSS 9.8, Badaso · badaso/core)
- [CVE-2022-41706](https://cve.now/CVE-2022-41706.md): Browsershot 3.57.2 - Server Side XSS to LFR via URL (CVSS 8.2, Browsershot · spatie/browsershot)
- [CVE-2022-41712](https://cve.now/CVE-2022-41712.md): Frappe version 14.10.0 allows an external attacker to remotely obtain arbitrary local files. (CVSS 6.5, Frappe)
- [CVE-2022-41926](https://cve.now/CVE-2022-41926.md): Nextcloud Talk Android broadcast incorrect permission handling (CVSS 3.3, nextcloud security-advisories)
- [CVE-2022-41954](https://cve.now/CVE-2022-41954.md): Temporary File Information Disclosure Vulnerability (CVSS 3.3, joniles mpxj · net.sf.mpxj:mpxj +4)
- [CVE-2022-41958](https://cve.now/CVE-2022-41958.md): Deserialization Vulnerability by yaml config input in super-xray (CVSS 7.3, 4ra1n super-xray)
- [CVE-2022-43983](https://cve.now/CVE-2022-43983.md): Browsershot 3.57.2 - Server Side XSS to LFR via HTML (CVSS 8.2, Browsershot · spatie/browsershot)
- [CVE-2022-43984](https://cve.now/CVE-2022-43984.md): Browsershot 3.57.3 - Server Side XSS to LFR via HTML (CVSS 8.2, Browsershot · spatie/browsershot)
- [CVE-2022-44411](https://cve.now/CVE-2022-44411.md): Web Based Quiz System v1.0 transmits user passwords in plaintext during the authentication process, allowing attackers to obtain users' pass (CVSS 7.5)
- [CVE-2022-44843](https://cve.now/CVE-2022-44843.md): TOTOlink A7100RU V7.4cu.2313\_B20191024 was discovered to contain a command injection vulnerability via the port parameter in the setting/set (CVSS 9.8)
- [CVE-2022-44844](https://cve.now/CVE-2022-44844.md): TOTOlink A7100RU V7.4cu.2313\_B20191024 was discovered to contain a command injection vulnerability via the pass parameter in the setting/set (CVSS 9.8)
- [CVE-2022-44858](https://cve.now/CVE-2022-44858.md): Automotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /asms/products/view\_p (CVSS 7.2)
- [CVE-2022-44859](https://cve.now/CVE-2022-44859.md): Automotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /asms/admin/products/ (CVSS 7.2)
- [CVE-2022-44860](https://cve.now/CVE-2022-44860.md): Automotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/transactions/u (CVSS 7.2)
- [CVE-2022-45036](https://cve.now/CVE-2022-45036.md): A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web script (CVSS 5.4)
- [CVE-2022-45037](https://cve.now/CVE-2022-45037.md): A cross-site scripting (XSS) vulnerability in /admin/users/index.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or (CVSS 5.4)
- [CVE-2022-45038](https://cve.now/CVE-2022-45038.md): A cross-site scripting (XSS) vulnerability in /admin/settings/save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts (CVSS 5.4)
- [CVE-2022-45039](https://cve.now/CVE-2022-45039.md): An arbitrary file upload vulnerability in the Server Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary code via a cra (CVSS 7.2)
- [CVE-2022-45040](https://cve.now/CVE-2022-45040.md): A cross-site scripting (XSS) vulnerability in /admin/pages/sections\_save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web sc (CVSS 5.4)
- [CVE-2022-45152](https://cve.now/CVE-2022-45152.md): A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. (CVSS 9.1, Moodle · moodle/moodle)
- [CVE-2022-45205](https://cve.now/CVE-2022-45205.md): Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/dict/queryTableData. (CVSS 5.3)
- [CVE-2022-45206](https://cve.now/CVE-2022-45206.md): Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/duplicate/check. (CVSS 9.8, org.jeecgframework.boot:jeecg-module-system)
- [CVE-2022-45207](https://cve.now/CVE-2022-45207.md): Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component updateNullByEmptyString. (CVSS 9.8, org.jeecgframework.boot:jeecg-module-system)
- [CVE-2022-45208](https://cve.now/CVE-2022-45208.md): Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/user/putRecycleBin. (CVSS 4.3, org.jeecgframework.boot:jeecg-module-system)
- [CVE-2022-45210](https://cve.now/CVE-2022-45210.md): Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/user/deleteRecycleBin. (CVSS 4.3, org.jeecgframework.boot:jeecg-module-system)
- [CVE-2022-45218](https://cve.now/CVE-2022-45218.md): Human Resource Management System v1.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability. (no CVSS)
- [CVE-2022-45225](https://cve.now/CVE-2022-45225.md): Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms\_ci/index.php/book. (CVSS 6.1)
- [CVE-2022-45475](https://cve.now/CVE-2022-45475.md): Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to access the application's internal files. (CVSS 6.5, Tiny File Manager)
- [CVE-2022-45476](https://cve.now/CVE-2022-45476.md): Tiny File Manager version 2.4.8 executes the code of files uploaded by users of the application, instead of just returning them for download (CVSS 9.8, Tiny File Manager)
- [CVE-2022-45884](https://cve.now/CVE-2022-45884.md): An issue was discovered in the Linux kernel through 6.0.9. (no CVSS)
- [CVE-2022-45885](https://cve.now/CVE-2022-45885.md): An issue was discovered in the Linux kernel through 6.0.9. (CVSS 7.0)
- [CVE-2022-45886](https://cve.now/CVE-2022-45886.md): An issue was discovered in the Linux kernel through 6.0.9. (no CVSS)
- [CVE-2022-45887](https://cve.now/CVE-2022-45887.md): An issue was discovered in the Linux kernel through 6.0.9. (CVSS 4.7)
- [CVE-2022-45888](https://cve.now/CVE-2022-45888.md): An issue was discovered in the Linux kernel through 6.0.9. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-11-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.