CVEs published November 28, 2022
65 CVEs were published on November 28, 2022: 7 critical, 20 high.
- Published
- 65
- Critical
- 7
- High
- 20
- Medium
- 35
- Low
- 2
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 27
Most affected products
- Callback technologies CBFS Filter
- 3
- Linux kernel
- 3
- WP User Merger
- 3
- discourse
- 2
- Find and Replace All
- 2
- Acer Aspire A315-22 · Acer Aspire A115-21 +3
- 1
- Analytics for WP
- 1
- Awesome Support
- 1
- Beautiful Cookie Consent Banner
- 1
- Checkout Field Editor (Checkout Manager) for WooCommerce
- 1
Critical 7
- CVE-2022-3603Export customers list CSV for WooCommerce < 2.0.69 - CSV InjectionExport customers list csv for WooCommerce, WordPress users…
- CVE-2022-36193SQL injection in School Management System 1.0 allows remote attackers to modify or delete data, causing persistent changes to the applicatio
- CVE-2022-41912crewjam/saml go library is vulnerable to signature bypass via multiple Assertion elementscrewjam saml · github.com/crewjam/saml
- CVE-2022-44283AVS Audio Converter 10.3 is vulnerable to Buffer Overflow.
- CVE-2022-44399Poultry Farm Management System v1.0 contains a SQL injection vulnerability via the del parameter at /Redcock-Farm/farm/category.php.
- CVE-2022-44400Purchase Order Management System v1.0 contains a file upload vulnerability via /purchase_order/admin/?page=system_info.
- CVE-2022-44401Online Tours & Travels Management System v1.0 contains an arbitrary file upload vulnerability via /tour/admin/file.php.
High 20
- CVE-2022-38140WordPress SEO Plugin by Squirrly SEO Plugin <= 12.1.10 is vulnerable to Arbitrary File UploadSEO Plugin by Squirrly SEO
- CVE-2021-45036Velneo vClient improper authenticationVelneo vClient
- CVE-2022-3865WP User Merger < 1.5.3 - Admin+ SQLi via IDWP User Merger
- CVE-2022-3848WP User Merger < 1.5.3 - Admin+ SQLi via wpsu_user_idWP User Merger
- CVE-2022-3849WP User Merger < 1.5.3 - Admin+ SQLi via user_idWP User Merger
- CVE-2022-3490Checkout Field Editor for WooCommerce < 1.8.0 - Admin+ PHP Object InjectionCheckout Field Editor (Checkout Manager) for WooCommerce
- CVE-2022-3689HTML Forms < 1.3.25 - Admin+ SQLiHTML Forms
- CVE-2022-3769OWM Weather < 5.6.9 - Contributor+ SQLiOWM Weather
- CVE-2022-3768WPSmartContracts < 1.3.12 - Author+ SQLiWPSmartContracts
- CVE-2022-4020Acer Aspire BIOS vulnerabilityAcer Aspire A315-22 · Acer Aspire A115-21 +3
- CVE-2022-24187The user_id and device_id on the Ourphoto App version 1.4.1 /device/* end-points both suffer from insecure direct object reference vulnerabi
- CVE-2022-24188The /device/signin end-point for the Ourphoto App version 1.4.1 discloses clear-text password information for functionality within the pictu
- CVE-2022-24190The /device/acceptBind end-point for Ourphoto App version 1.4.1 does not require authentication or authorization.
- CVE-2022-31877An issue in the component MSI.TerminalServer.exe of MSI Center v1.0.41.0 allows attackers to escalate privileges via a crafted TCP packet.
- CVE-2022-38900decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.decode-uri-component
- CVE-2022-41957muhammara vulnerable to Unchecked Return Value to NULL Pointer Dereferencejulianhille MuhammaraJS · hummus +1
- CVE-2022-45442Sinatra vulnerable to Reflected File Download attacksinatra
- CVE-2022-45921FusionAuth before 1.41.3 allows a file outside of the application root to be viewed or retrieved using an HTTP request.io.fusionauth:fusionauth-java-client
- CVE-2022-45939GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etag
- CVE-2022-46147Drag and Drop XBlock v2 has XSS Issues in Xblock Input Fieldsopenedx xblock-drag-and-drop-v2 · xblock-drag-and-drop-v2
Medium, low and unrated 38
- CVE-2022-34654WordPress Manage Notification E-mails Plugin <= 1.8.2 is vulnerable to Cross Site Request Forgery (CSRF)Virgial Berveling Manage Notification E-mails
- CVE-2022-4169Theme and plugin translation for Polylang <= 3.2.16 - Missing Authorizationmarcinkazmierski Theme and plugin translation for Polylang
- CVE-2022-41732IBM Maximo information disclosureIBM Maximo Mobile
- CVE-2022-42445HCL Launch is vulnerable to Insufficiently Protected LDAP Search Credentials (CVE-2022-42445)HCL Software HCL Launch
- CVE-2022-3847Showing URL in QR Code <= 0.0.1 - Stored XSS via CSRFShowing URL in QR Code
- CVE-2022-3823Beautiful Cookie Consent Banner < 2.9.1 - Admin+ Stored XSSBeautiful Cookie Consent Banner
- CVE-2022-3511Awesome Support < 6.1.2 - Subscriber+ Arbitrary Exported Tickets DownloadAwesome Support
- CVE-2022-3839Analytics for WP <= 1.5.1 - Admin+ Stored XSSAnalytics for WP
- CVE-2022-3834Google Forms <= 0.95 - Admin+ Stored XSSGoogle Forms
- CVE-2022-3822Donations via PayPal < 1.9.9 - Admin+ Stored XSSDonations via PayPal
- CVE-2022-3833Fancier Author Box by ThematoSoup <= 1.4 - Admin+ Stored XSSFancier Author Box by ThematoSoup
- CVE-2022-3824WP Admin UI Customize < 1.5.13 - Admin+ Stored XSSWP Admin UI Customize
- CVE-2022-3828Video Thumbnails <= 2.12.3 - Admin+ Stored XSSVideo Thumbnails
- CVE-2022-2983Salat Times < 3.2.2 - Admin+ Stored Cross-Site ScriptingSalat Times
- CVE-2022-2311Find and Replace All < 1.3 - Reflected Cross Site ScriptingFind and Replace All
- CVE-2022-3610Jeeng Push Notifications < 2.0.4 - Admin+ Stored Cross-Site ScriptingJeeng Push Notifications
- CVE-2022-3850Find and Replace All <= 1.3 - Arbitrary Replacement via CSRFFind and Replace All
- CVE-2022-3831reCAPTCHA <= 1.6 - Admin+ Stored XSSreCAPTCHA
- CVE-2021-25059Download Plugin < 2.0.0 - Subscriber+ Website DownloadDownload Plugin
- CVE-2022-3601Image Hover Effects Css3 <= 4.5 - Admin+ Stored XSSImage Hover Effects Css3
- CVE-2022-43590A null pointer dereference vulnerability exists in the handle_ioctl_0x830a0_systembuffer functionality of Callback technologies CBFS Filter Callback technologies CBFS Filter
- CVE-2022-43589A null pointer dereference vulnerability exists in the handle_ioctl_8314C functionality of Callback technologies CBFS Filter 20.0.8317.Callback technologies CBFS Filter
- CVE-2022-43588A null pointer dereference vulnerability exists in the handle_ioctl_83150 functionality of Callback technologies CBFS Filter 20.0.8317.Callback technologies CBFS Filter
- CVE-2022-24189The user_token authorization header on the Ourphoto App version 1.4.1 /apiv1/* end-points is not implemented properly.
- CVE-2022-38753This update resolves a multi-factor authentication bypass attackNetIQ Advanced Authentication
- CVE-2022-4104A loop with an unreachable exit condition can be triggered by passing a crafted JPEG file to the Lepton image compression tool, resulting inDropbox Lepton
- CVE-2022-4127A NULL pointer dereference issue was discovered in the Linux kernel in io_files_update_with_index_alloc.Linux kernel
- CVE-2022-4128A NULL pointer dereference issue was discovered in the Linux kernel in the MPTCP protocol when traversing the subflow list at disconnect timLinux kernel
- CVE-2022-4129A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP).Linux kernel
- CVE-2022-41921Discourse chat messages should have a maximum character limitdiscourse
- CVE-2022-41944Discourse users can see notifications for topics they no longer have access todiscourse
- CVE-2022-41965Opencast Authenticated OpenRedirect Vulnerabilityopencast · org.opencastproject:opencast-common
- CVE-2022-44284Dinstar FXO Analog VoIP Gateway DAG2000-16O is vulnerable to Cross Site Scripting (XSS).
- CVE-2022-44937Bosscms v2.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Add function under the Administrator List module.
- CVE-2022-45214A cross-site scripting (XSS) vulnerability in Sanitization Management System v1.0.0 allows attackers to execute arbitrary web scripts or HTM
- CVE-2022-45221Web-Based Student Clearance System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in changepassword.php.
- CVE-2022-45223Web-Based Student Clearance System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /Admin/add-student.php.
- CVE-2022-45224Web-Based Student Clearance System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in Admin/add-admin.php.