Archive

8 November 2022

Vulnerabilities first published on this day (UTC), newest first.

← October 2022 2022 / November /8 December 2022 →

All Critical High Medium Low Exploited only Public exploit

120 results · Feed

Medium —

GHSA-5m39-wx2q-mxg3

Invalid use of `mem::uninitialized` causes `use-of-uninitialized-value`

The compression and decompression function used `mem:uninitialized` to create an array of uninitialized values, to later write values into it. This later leads to reads from uninitialized memory. The flaw was corrected in commit b633bf265e41c60dfce3be7eac4e4d…

lzf crates.io

Nov 8, 2022
Medium 5.3

CVE-2022-27516

User login brute force protection functionality bypass

User login brute force protection functionality bypass

Citrix Citrix Gateway, Citrix ADC Network devices

Nov 8, 2022
Critical 9.8

CVE-2022-27510

Unauthorized access to Gateway user capabilities

Unauthorized access to Gateway user capabilities

Citrix Citrix Gateway, Citrix ADC Network devices

Nov 8, 2022
High 8.3

CVE-2022-27513

Remote desktop takeover via phishing

Remote desktop takeover via phishing

Citrix Citrix Gateway, Citrix ADC Network devices

Nov 8, 2022
Unscored —

CVE-2022-27914

[20221101] - Core - RXSS through reflection of user input in com_media

An issue was discovered in Joomla! 4.0.0 through 4.2.4. Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in com_media.

Joomla! Project Joomla! CMS Web / CMS

Nov 8, 2022
Medium 5.4

CVE-2022-32587

WordPress WP Page Widget plugin <= 3.9 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in CodeAndMore WP Page Widget plugin <= 3.9 on WordPress leading to plugin settings change.

CodeAndMore WP Page Widget (WordPress plugin) Web / CMS

Nov 8, 2022
Medium 6.1

CVE-2022-44741

WordPress Testimonial Slider plugin <= 1.3.1 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) in David Anderson Testimonial Slider plugin <= 1.3.1 on WordPress.

David Anderson Testimonial Slider (WordPress plugin) Web / CMS

Nov 8, 2022
Medium 4.8

CVE-2022-32776

WordPress Advanced Ads – Ad Manager & AdSense plugin <= 1.31.1 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Advanced Ads GmbH Advanced Ads – Ad Manager & AdSense plugin <= 1.31.1 on WordPress.

Advanced Ads Advanced Ads – Ad Manager & AdSense

Nov 8, 2022
Medium 4.8

CVE-2022-41980

WordPress Mantenimiento web plugin <= 0.13 - Auth. Cross-Site Scripting (XSS) vulnerability

Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Mantenimiento web plugin <= 0.13 on WordPress.

Carlos Doral Mantenimiento web (WordPress plugin) Web / CMS

Nov 8, 2022
Low 3.0

CVE-2022-42494

WordPress All in One SEO Pro plugin <= 4.2.5.1 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery (SSRF) vulnerability in All in One SEO Pro plugin <= 4.2.5.1 on WordPress.

Semper Plugins All in One SEO Pro (WordPress plugin) Web / CMS

Nov 8, 2022
Medium 4.3

CVE-2022-38137

WordPress Analytify plugin <= 4.2.2 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Analytify plugin <= 4.2.2 on WordPress.

Analytify Analytify (WordPress plugin) Web / CMS

Nov 8, 2022
Medium 6.3

CVE-2022-40206

WordPress wpForo Forum plugin <= 2.0.5 - Insecure direct object references (IDOR) vulnerability

Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin <= 2.0.5 on WordPress allows attackers with subscriber or higher user roles to mark any forum post as private/public.

gVectors Team wpForo Forum (WordPress plugin) Web / CMS

Nov 8, 2022
Medium 5.4

CVE-2022-27855

WordPress Analytics Cat plugin <= 1.0.9 - Plugin Settings change via Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Fatcat Apps Analytics Cat plugin <= 1.0.9 on WordPress allows Plugin Settings Change.

Fatcat Apps Analytics Cat (WordPress plugin) Web / CMS

Nov 8, 2022
High 7.4

CVE-2022-27858

WordPress Activity Log plugin <= 2.8.3 - CSV Injection vulnerability

CSV Injection vulnerability in Activity Log Team Activity Log <= 2.8.3 on WordPress.

Activity Log Team Activity Log (WordPress plugin) Web / CMS

Nov 8, 2022
Medium 6.1

CVE-2022-41136

WordPress Shortcodes Ultimate plugin <= 5.12.0 - CSRF vulnerability leading to Stored XSS

Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Vladimir Anokhin's Shortcodes Ultimate plugin <= 5.12.0 on WordPress.

Vladimir Anokhin Shortcodes Ultimate (WordPress plugin) Web / CMS

Nov 8, 2022
Medium 5.4

CVE-2022-40205

WordPress wpForo Forum plugin <= 2.0.5 - Insecure direct object references (IDOR) vulnerability

Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin <= 2.0.5 on WordPress allows attackers with subscriber or higher user roles to mark any forum post as solved/unsolved.

gVectors Team wpForo Forum (WordPress plugin) Web / CMS

Nov 8, 2022
Medium 5.4

CVE-2022-40632

WordPress wpForo Forum plugin <= 2.0.5 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 on WordPress leading to topic deletion.

gVectors Team wpForo Forum (WordPress plugin) Web / CMS

Nov 8, 2022
Medium 5.4

CVE-2022-40223

WordPress SearchWP premium plugin <= 4.2.5 - Broken Authentication vulnerability

Nonce token leakage and missing authorization in SearchWP premium plugin <= 4.2.5 on WordPress leading to plugin settings change.

SearchWP SearchWP

Nov 8, 2022
Medium 4.8

CVE-2022-30545

WordPress 5 Anker Connect plugin <= 1.2.6 - Reflected Cross-Site Scripting (XSS) vulnerability

Auth. Reflected Cross-Site Scripting (XSS) vulnerability in 5 Anker Connect plugin <= 1.2.6 on WordPress.

5 Anker 5 Anker Connect (WordPress plugin) Web / CMS

Nov 8, 2022
Medium 4.3

CVE-2022-40128

WordPress Advanced Order Export For WooCommerce plugin <= 3.3.2 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Advanced Order Export For WooCommerce plugin <= 3.3.2 on WordPress leading to export file download.

Algolplus Advanced Order Export For WooCommerce (WordPress plugin) Web / CMS

Nov 8, 2022
Medium 5.4

CVE-2022-43481

WordPress Advanced Coupons for WooCommerce Coupons plugin <= 4.5 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Advanced Coupons for WooCommerce Coupons plugin <= 4.5 on WordPress leading to notice dismissal.

Rymera Web Co Advanced Coupons (WordPress plugin) Web / CMS

Nov 8, 2022
Medium 5.4

CVE-2022-43491

WordPress Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 on WordPress leading to plugin settings import.

Algolplus Advanced Dynamic Pricing for WooCommerce (WordPress plugin) Web / CMS

Nov 8, 2022
Medium 4.3

CVE-2020-35473

An information leakage vulnerability in the Bluetooth Low Energy advertisement scan response in Bluetooth Core Specific…

Nov 8, 2022
Critical 9.8

CVE-2022-34825

Uncontrolled Search Path Element in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earl…

NEC CLUSTERPRO X

Nov 8, 2022
Critical 9.8

CVE-2022-34823

Buffer overflow vulnerability in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier…

NEC CLUSTERPRO X

Nov 8, 2022
Critical 9.8

CVE-2022-34822

Path traversal vulnerability in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier,…

NEC CLUSTERPRO X

Nov 8, 2022
Critical 9.8

CVE-2022-34824

Weak File and Folder Permissions vulnerability in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Wi…

NEC CLUSTERPRO X

Nov 8, 2022
Medium 6.1

CVE-2022-33322

Cross-site scripting vulnerability in Mitsubishi Electric consumer electronics products (Air Conditioning, Wi-Fi Interf…

Mitsubishi Electric Air Conditioning MSZ-ZXV22/25/28/36/40/56/63/71/80/9020(S) Air Conditioning MSZ-ZW22/25/28/36/40/56/63/71/80/9021(S) Wi-Fi Interface MAC-900IF ICS / OT

Nov 8, 2022
Critical 9.8

CVE-2022-33321

Cleartext Transmission of Sensitive Information vulnerability due to the use of Basic Authentication for HTTP connectio…

Mitsubishi Electric Wi-Fi Interface PAC-SK43ML Air Conditioning MSZ-EM22/25/28/36/40/56/63/71/80/9021E9(S) Air Conditioning MSZ-HXV25/28/40/56/63/71/8022S ICS / OT

Nov 8, 2022
High 7.8

CVE-2022-39157

A vulnerability has been identified in Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.0 (All versions >= V34…

Siemens Simcenter Femap Parasolid V35.0 Parasolid V34.1 ICS / OT

Nov 8, 2022
High 7.5

CVE-2022-39386

fastify-websocket vulnerable to uncaught exception via crash on malformed packet

@fastify/websocket provides WebSocket support for Fastify. Any application using @fastify/websocket could crash if a specific, malformed packet is sent. All versions of fastify-websocket are also impacted. That module is deprecated, so it will not be patched.…

fastify fastify-websocket @fastify/websocket fastify-websocket npm

Nov 8, 2022
High 7.0

CVE-2022-39377

sysstat Incorrect Buffer Size calculation on 32-bit systems results in RCE via buffer overflow

sysstat is a set of system performance tools for the Linux operating system. On 32 bit systems, in versions 9.1.16 and newer but prior to 12.7.1, allocate_structures contains a size_t overflow in sa_common.c. The allocate_structures function insufficiently ch…

sysstat sysstat sysstat sysstat Debian Ubuntu Azure Linux Alpine

Nov 8, 2022
Medium 5.6

CVE-2022-39343

Azure RTOS FileX vulnerable to Buffer Offerflow

Azure RTOS FileX is a FAT-compatible file system that’s fully integrated with Azure RTOS ThreadX. In versions before 6.2.0, the Fault Tolerant feature of Azure RTOS FileX includes integer under and overflows which may be exploited to achieve buffer overflow a…

azure-rtos filex

Nov 8, 2022
Medium 5.3

CVE-2022-39069

There is a SQL injection vulnerability in ZTE ZAIP-AIE. Due to lack of input verification by the server, an attacker co…

Nov 8, 2022
High 7.8

CVE-2022-39136

A vulnerability has been identified in JT2Go (All versions < V14.1.0.4), Teamcenter Visualization V13.2 (All versions <…

Siemens JT2Go Teamcenter Visualization V14.1 Teamcenter Visualization V13.3 ICS / OT

Nov 8, 2022
Medium 4.8

CVE-2022-39352

OpenFGA Authorization Bypass

OpenFGA is a high-performance authorization/permission engine inspired by Google Zanzibar. Versions prior to 0.2.5 are vulnerable to authorization bypass under certain conditions. You are affected by this vulnerability if you added a tuple with a wildcard (*)…

openfga openfga github.com/openfga/openfga Go

Nov 8, 2022
Critical 9.8

CVE-2022-39328

Grafana vulnerable to race condition allowing privilege escalation

Grafana is an open-source platform for monitoring and observability. Versions starting with 9.2.0 and less than 9.2.4 contain a race condition in the authentication middlewares logic which may allow an unauthenticated user to query an administration endpoint …

Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Go

Nov 8, 2022
Medium 6.7

CVE-2022-32605

In isp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation o…

MediaTek MT6879, MT6895, MT6983

Nov 8, 2022
Medium 6.7

CVE-2022-32603

In gpu drm, there is a possible out of bounds write due to improper input validation. This could lead to local escalati…

MediaTek MT6879, MT6893, MT6895, MT6985, MT8795T, MT8798

Nov 8, 2022
Medium 6.8

CVE-2022-32617

In typec, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to lo…

MediaTek MT6789, MT6855, MT6895, MT6983, MT8798

Nov 8, 2022