# CVEs published 2022-11-30

55 CVEs were published on November 30, 2022: 4 critical, 22 high. Days are UTC.

- [CVE-2022-40204](https://cve.now/CVE-2022-40204.md): A cross-site scripting (XSS) vulnerability exists in all current versions of Digital Alert Systems DASDEC software via the Host Header in un (CVSS 4.1, Digital Alert Systems DASDEC)
- [CVE-2019-18265](https://cve.now/CVE-2019-18265.md): Digital Alert Systems’ DASDEC software prior to version 4.1 contains a cross-site scripting (XSS) vulnerability that allows remote attackers (CVSS 4.7, Digital Alert Systems DASDEC)
- [CVE-2022-42446](https://cve.now/CVE-2022-42446.md): HCL Sametime 12.0 and 12.0FP1 anonymous users have directory lookup access (CVSS 6.5, HCL Software HCL Sametime)
- [CVE-2022-44533](https://cve.now/CVE-2022-44533.md): A vulnerability in the Aruba EdgeConnect Enterprise web management interface allows remote authenticated users to run arbitrary commands on (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2022-44532](https://cve.now/CVE-2022-44532.md): An authenticated path traversal vulnerability exists in the Aruba EdgeConnect Enterprise command line interface. (CVSS 4.9, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2022-43542](https://cve.now/CVE-2022-43542.md): Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on the (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2022-43541](https://cve.now/CVE-2022-43541.md): Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on the (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2022-43518](https://cve.now/CVE-2022-43518.md): An authenticated path traversal vulnerability exists in the Aruba EdgeConnect Enterprise web interface. (CVSS 4.9, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2022-37926](https://cve.now/CVE-2022-37926.md): A vulnerability within the web-based management interface of EdgeConnect Enterprise could allow a remote attacker to conduct a stored cross- (CVSS 5.5, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2022-37925](https://cve.now/CVE-2022-37925.md): A vulnerability within the web-based management interface of Aruba EdgeConnect Enterprise could allow a remote attacker to conduct a reflect (CVSS 6.1, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2022-37924](https://cve.now/CVE-2022-37924.md): Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on the (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2022-37923](https://cve.now/CVE-2022-37923.md): Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on the (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2022-37922](https://cve.now/CVE-2022-37922.md): Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on the (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2022-37921](https://cve.now/CVE-2022-37921.md): Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on the (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2022-37920](https://cve.now/CVE-2022-37920.md): Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on the (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2022-37919](https://cve.now/CVE-2022-37919.md): A vulnerability exists in the API of Aruba EdgeConnect Enterprise. (CVSS 7.5, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2022-37932](https://cve.now/CVE-2022-37932.md): A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S Network switches. (CVSS 8.8, Hewlett Packard Enterprise (HPE) Hewlett Packard Enterprise…)
- [CVE-2022-1911](https://cve.now/CVE-2022-1911.md): Information disclosure in M-Files Server (CVSS 5.3, M-Files Server)
- [CVE-2022-1606](https://cve.now/CVE-2022-1606.md): Incorrect privilege assignment in M-Files Server (CVSS 2.4, M-Files Server)
- [CVE-2022-45842](https://cve.now/CVE-2022-45842.md): WordPress WP ULike Plugin \<= 4.6.4 is vulnerable to Race Condition vulnerability (CVSS 5.3, TechnoWich WP ULike)
- [CVE-2022-26366](https://cve.now/CVE-2022-26366.md): WordPress AdRotate Banner Manager Plugin \<= 5.9 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Arnan de Gans AdRotate Banner Manager)
- [CVE-2022-3859](https://cve.now/CVE-2022-3859.md): An uncontrolled search path vulnerability exists in Trellix Agent (TA) for Windows in versions prior to 5.7.8. (CVSS 6.7, Trellix Agent)
- [CVE-2022-40265](https://cve.now/CVE-2022-40265.md): Denial of Service (DoS) Vulnerability in MELSEC iQ-R Series Ethernet Interface Module (CVSS 8.6, Mitsubishi Electric MELSEC iQ-R Series RJ71EN71 · Mitsubish…)
- [CVE-2021-31740](https://cve.now/CVE-2021-31740.md): SEPPMail's web frontend, user input is not embedded correctly in the web page and therefore leads to cross-site scripting vulnerabilities (X (CVSS 6.1)
- [CVE-2021-4242](https://cve.now/CVE-2021-4242.md): Sapido BR270n/BRC76n/GR297/RB1732 syscmd.htm os command injection (CVSS 6.3, Sapido BR270n · Sapido BRC76n +2)
- [CVE-2022-22984](https://cve.now/CVE-2022-22984.md): Command Injection (CVSS 5.0, snyk · snyk-mvn-plugin +6)
- [CVE-2022-23746](https://cve.now/CVE-2022-23746.md): The IPsec VPN blade has a dedicated portal for downloading and connecting through SSL Network Extender (SNX). (CVSS 7.5, Gateway & Management, IPsec VPN blade SNX portal.)
- [CVE-2022-24441](https://cve.now/CVE-2022-24441.md): Code Injection (CVSS 5.8, snyk)
- [CVE-2022-38801](https://cve.now/CVE-2022-38801.md): In Zkteco BioTime \< 8.5.3 Build:20200816.447, an employee can hijack an administrator session and cookies using blind cross-site scripting. (CVSS 5.4)
- [CVE-2022-38802](https://cve.now/CVE-2022-38802.md): Zkteco BioTime \< 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via resign, private message, manual log, time interval, (CVSS 6.2)
- [CVE-2022-38803](https://cve.now/CVE-2022-38803.md): Zkteco BioTime \< 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via Leave, overtime, Manual log. (CVSS 6.8)
- [CVE-2022-41412](https://cve.now/CVE-2022-41412.md): An issue in the graphData.cgi component of perfSONAR v4.4.5 and prior allows attackers to access sensitive data and execute Server-Side Requ (CVSS 8.6)
- [CVE-2022-41413](https://cve.now/CVE-2022-41413.md): perfSONAR v4.x \<= v4.4.5 was discovered to contain a Cross-Site Request Forgery (CSRF) which is triggered when an attacker injects crafted i (CVSS 4.3)
- [CVE-2022-4222](https://cve.now/CVE-2022-4222.md): SourceCodester Canteen Management System POST Request ajax\_invoice.php query sql injection (CVSS 5.0, SourceCodester Canteen Management System)
- [CVE-2022-4228](https://cve.now/CVE-2022-4228.md): SourceCodester Book Store Management System information disclosure (CVSS 5.3, SourceCodester Book Store Management System)
- [CVE-2022-4229](https://cve.now/CVE-2022-4229.md): SourceCodester Book Store Management System index.php access control (CVSS 7.3, SourceCodester Book Store Management System)
- [CVE-2022-4231](https://cve.now/CVE-2022-4231.md): Tribal Systems Zenario CMS Remember Me session fixiation (CVSS 4.2, Tribal Systems Zenario CMS · tribalsystems/zenario)
- [CVE-2022-4232](https://cve.now/CVE-2022-4232.md): SourceCodester Event Registration System unrestricted upload (CVSS 4.7, SourceCodester Event Registration System)
- [CVE-2022-4233](https://cve.now/CVE-2022-4233.md): SourceCodester Event Registration System cross site scripting (CVSS 2.4, SourceCodester Event Registration System)
- [CVE-2022-4234](https://cve.now/CVE-2022-4234.md): SourceCodester Canteen Management System brand.php builtin\_echo cross site scripting (CVSS 3.5, SourceCodester Canteen Management System)
- [CVE-2022-44096](https://cve.now/CVE-2022-44096.md): Sanitization Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access (CVSS 9.8)
- [CVE-2022-44097](https://cve.now/CVE-2022-44097.md): Book Store Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access t (CVSS 9.8)
- [CVE-2022-44136](https://cve.now/CVE-2022-44136.md): Zenario CMS 9.3.57186 is vulnerable to Remote Code Excution (RCE). (CVSS 9.8, tribalsystems/zenario)
- [CVE-2022-44151](https://cve.now/CVE-2022-44151.md): Simple Inventory Management System v1.0 is vulnerable to SQL Injection via /ims/login.php. (CVSS 9.8)
- [CVE-2022-44294](https://cve.now/CVE-2022-44294.md): Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=services/manage\_service&id=. (CVSS 7.2)
- [CVE-2022-44295](https://cve.now/CVE-2022-44295.md): Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/orders/assign\_team.php?id=. (CVSS 7.2)
- [CVE-2022-44296](https://cve.now/CVE-2022-44296.md): Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/quotes/manage\_remark.php?id=. (CVSS 7.2)
- [CVE-2022-45328](https://cve.now/CVE-2022-45328.md): Church Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/edit\_members.php. (CVSS 7.2)
- [CVE-2022-45332](https://cve.now/CVE-2022-45332.md): LibreDWG v0.12.4.4643 was discovered to contain a heap buffer overflow via the function decode\_preR13\_section\_hdr at decode\_r11.c. (CVSS 7.8)
- [CVE-2022-45337](https://cve.now/CVE-2022-45337.md): Tenda TX9 Pro v22.03.02.10 was discovered to contain a stack overflow via the list parameter at /goform/SetIpMacBind. (CVSS 7.5)
- [CVE-2022-45869](https://cve.now/CVE-2022-45869.md): A race condition in the x86 KVM subsystem in the Linux kernel through 6.1-rc6 allows guest OS users to cause a denial of service (host OS cr (CVSS 5.5)
- [CVE-2022-46149](https://cve.now/CVE-2022-46149.md): Cap'n Proto vulnerable to out-of-bounds read due to logic error handling list-of-list. (CVSS 5.4, capnproto · capnp)
- [CVE-2022-46156](https://cve.now/CVE-2022-46156.md): Grafana's default installation of \`synthetic-monitoring-agent\` exposes sensitive information (CVSS 7.2, grafana synthetic-monitoring-agent · github.com/grafana/… +1)
- [CVE-2022-46162](https://cve.now/CVE-2022-46162.md): Discourse BBCode plugin vulnerable to arbitrary CSS injection (CVSS 8.8, discourse-bbcode)
- [CVE-2022-46338](https://cve.now/CVE-2022-46338.md): g810-led 0.4.2, a LED configuration tool for Logitech Gx10 keyboards, contained a udev rule to make supported device nodes world-readable an (CVSS 6.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-11-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.