CVEs published November 30, 2022
55 CVEs were published on November 30, 2022: 4 critical, 22 high.
- Published
- 55
- Critical
- 4
- High
- 22
- Medium
- 26
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 8
Most affected products
- Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…
- 13
- Digital Alert Systems DASDEC
- 2
- M-Files Server
- 2
- SourceCodester Book Store Management System
- 2
- SourceCodester Canteen Management System
- 2
- SourceCodester Event Registration System
- 2
- Arnan de Gans AdRotate Banner Manager
- 1
- capnproto · capnp
- 1
- discourse-bbcode
- 1
- Gateway & Management, IPsec VPN blade SNX portal.
- 1
Critical 4
- CVE-2022-44096Sanitization Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access
- CVE-2022-44097Book Store Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access t
- CVE-2022-44136Zenario CMS 9.3.57186 is vulnerable to Remote Code Excution (RCE).tribalsystems/zenario
- CVE-2022-44151Simple Inventory Management System v1.0 is vulnerable to SQL Injection via /ims/login.php.
High 22
- CVE-2022-44533A vulnerability in the Aruba EdgeConnect Enterprise web management interface allows remote authenticated users to run arbitrary commands on Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…
- CVE-2022-43542Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on theHewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…
- CVE-2022-43541Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on theHewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…
- CVE-2022-37924Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on theHewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…
- CVE-2022-37923Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on theHewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…
- CVE-2022-37922Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on theHewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…
- CVE-2022-37921Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on theHewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…
- CVE-2022-37920Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on theHewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…
- CVE-2022-37919A vulnerability exists in the API of Aruba EdgeConnect Enterprise.Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…
- CVE-2022-37932A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S Network switches.Hewlett Packard Enterprise (HPE) Hewlett Packard Enterprise…
- CVE-2022-40265Denial of Service (DoS) Vulnerability in MELSEC iQ-R Series Ethernet Interface ModuleMitsubishi Electric MELSEC iQ-R Series RJ71EN71 · Mitsubish…
- CVE-2022-23746The IPsec VPN blade has a dedicated portal for downloading and connecting through SSL Network Extender (SNX).Gateway & Management, IPsec VPN blade SNX portal.
- CVE-2022-41412An issue in the graphData.cgi component of perfSONAR v4.4.5 and prior allows attackers to access sensitive data and execute Server-Side Requ
- CVE-2022-4229SourceCodester Book Store Management System index.php access controlSourceCodester Book Store Management System
- CVE-2022-44294Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=services/manage_service&id=.
- CVE-2022-44295Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/orders/assign_team.php?id=.
- CVE-2022-44296Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/quotes/manage_remark.php?id=.
- CVE-2022-45328Church Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/edit_members.php.
- CVE-2022-45332LibreDWG v0.12.4.4643 was discovered to contain a heap buffer overflow via the function decode_preR13_section_hdr at decode_r11.c.
- CVE-2022-45337Tenda TX9 Pro v22.03.02.10 was discovered to contain a stack overflow via the list parameter at /goform/SetIpMacBind.
- CVE-2022-46156Grafana's default installation of `synthetic-monitoring-agent` exposes sensitive informationgrafana synthetic-monitoring-agent · github.com/grafana/… +1
- CVE-2022-46162Discourse BBCode plugin vulnerable to arbitrary CSS injectiondiscourse-bbcode
Medium, low and unrated 29
- CVE-2022-40204A cross-site scripting (XSS) vulnerability exists in all current versions of Digital Alert Systems DASDEC software via the Host Header in unDigital Alert Systems DASDEC
- CVE-2019-18265Digital Alert Systems’ DASDEC software prior to version 4.1 contains a cross-site scripting (XSS) vulnerability that allows remote attackersDigital Alert Systems DASDEC
- CVE-2022-42446HCL Sametime 12.0 and 12.0FP1 anonymous users have directory lookup accessHCL Software HCL Sametime
- CVE-2022-44532An authenticated path traversal vulnerability exists in the Aruba EdgeConnect Enterprise command line interface.Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…
- CVE-2022-43518An authenticated path traversal vulnerability exists in the Aruba EdgeConnect Enterprise web interface.Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…
- CVE-2022-37926A vulnerability within the web-based management interface of EdgeConnect Enterprise could allow a remote attacker to conduct a stored cross-Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…
- CVE-2022-37925A vulnerability within the web-based management interface of Aruba EdgeConnect Enterprise could allow a remote attacker to conduct a reflectHewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…
- CVE-2022-1911Information disclosure in M-Files ServerM-Files Server
- CVE-2022-1606Incorrect privilege assignment in M-Files ServerM-Files Server
- CVE-2022-45842WordPress WP ULike Plugin <= 4.6.4 is vulnerable to Race Condition vulnerabilityTechnoWich WP ULike
- CVE-2022-26366WordPress AdRotate Banner Manager Plugin <= 5.9 is vulnerable to Cross Site Request Forgery (CSRF)Arnan de Gans AdRotate Banner Manager
- CVE-2022-3859An uncontrolled search path vulnerability exists in Trellix Agent (TA) for Windows in versions prior to 5.7.8.Trellix Agent
- CVE-2021-31740SEPPMail's web frontend, user input is not embedded correctly in the web page and therefore leads to cross-site scripting vulnerabilities (X
- CVE-2021-4242Sapido BR270n/BRC76n/GR297/RB1732 syscmd.htm os command injectionSapido BR270n · Sapido BRC76n +2
- CVE-2022-22984Command Injectionsnyk · snyk-mvn-plugin +6
- CVE-2022-24441Code Injectionsnyk
- CVE-2022-38801In Zkteco BioTime < 8.5.3 Build:20200816.447, an employee can hijack an administrator session and cookies using blind cross-site scripting.
- CVE-2022-38802Zkteco BioTime < 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via resign, private message, manual log, time interval,
- CVE-2022-38803Zkteco BioTime < 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via Leave, overtime, Manual log.
- CVE-2022-41413perfSONAR v4.x <= v4.4.5 was discovered to contain a Cross-Site Request Forgery (CSRF) which is triggered when an attacker injects crafted i
- CVE-2022-4222SourceCodester Canteen Management System POST Request ajax_invoice.php query sql injectionSourceCodester Canteen Management System
- CVE-2022-4228SourceCodester Book Store Management System information disclosureSourceCodester Book Store Management System
- CVE-2022-4231Tribal Systems Zenario CMS Remember Me session fixiationTribal Systems Zenario CMS · tribalsystems/zenario
- CVE-2022-4232SourceCodester Event Registration System unrestricted uploadSourceCodester Event Registration System
- CVE-2022-4233SourceCodester Event Registration System cross site scriptingSourceCodester Event Registration System
- CVE-2022-4234SourceCodester Canteen Management System brand.php builtin_echo cross site scriptingSourceCodester Canteen Management System
- CVE-2022-45869A race condition in the x86 KVM subsystem in the Linux kernel through 6.1-rc6 allows guest OS users to cause a denial of service (host OS cr
- CVE-2022-46149Cap'n Proto vulnerable to out-of-bounds read due to logic error handling list-of-list.capnproto · capnp
- CVE-2022-46338g810-led 0.4.2, a LED configuration tool for Logitech Gx10 keyboards, contained a udev rule to make supported device nodes world-readable an