Skip to content
OpenAdvisories

Archive

17 November 2022

Vulnerabilities first published on this day (UTC), newest first.

← October 2022 2022 / November /17 December 2022 →
  1. 1211
  2. 273
  3. 3120
  4. 437
  5. 52
  6. 66
  7. 763
  8. 8120
  9. 9179
  10. 1092
  11. 1191
  12. 1211
  13. 1315
  14. 1497
  15. 15108
  16. 1644
  17. 1788
  18. 18105
  19. 195
  20. 208
  21. 2190
  22. 2284
  23. 2398
  24. 2421
  25. 2559
  26. 264
  27. 278
  28. 2867
  29. 2986
  30. 3057
All Critical High Medium Low Exploited only Public exploit

88 results · Feed

  • Medium 5.7
    CVE-2022-24939

    Malformed Zigbee packet with invalid destination address causes Assert

     A malformed packet containing an invalid destination address, causes a stack overflow in the Ember ZNet stack. This causes an assert which leads to a reset, immediately clearing the error.

    silabs.com Ember ZNet
  • High 8.8
    CVE-2022-41775

    Delta Electronics DIAEnergie SQL Injection

    SQL Injection in Handler_CFG.ashx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network

    Delta Electronics DIAEnergie ICS / OT
  • High 8.8
    CVE-2022-43506

    Delta Electronics DIAEnergie SQL Injection

    SQL Injection in HandlerTag_KID.ashx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network

    Delta Electronics DIAEnergie ICS / OT
  • High 8.8
    CVE-2022-43452

    Delta Electronics DIAEnergie SQL Injection

    SQL Injection in FtyInfoSetting.aspx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network

    Delta Electronics DIAEnergie ICS / OT
  • High 8.8
    CVE-2022-43447

    Delta Electronics DIAEnergie SQL Injection

    SQL Injection in AM_EBillAnalysis.aspx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network

    Delta Electronics DIAEnergie ICS / OT
  • High 8.8
    CVE-2022-43457

    Delta Electronics DIAEnergie SQL Injection

    SQL Injection in HandlerPage_KID.ashx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network

    Delta Electronics DIAEnergie ICS / OT
  • High 8.8
    CVE-2022-36924

    Local Privilege Escalation in Zoom Rooms Installer for Windows

    The Zoom Rooms Installer for Windows prior to 5.12.6 contains a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability during the install process to escalate their privileges to the SYSTEM user.

    Zoom Video Communications Zoom Rooms Installer for Windows Windows
  • Low 3.3
    CVE-2022-28766

    DLL injection in Zoom Windows Clients

    Windows 32-bit versions of the Zoom Client for Meetings before 5.12.6 and Zoom Rooms for Conference Room before version 5.12.6 are susceptible to a DLL injection vulnerability. A local low-privileged user could exploit this vulnerability to run arbitrary code…

    Zoom Video Communications Zoom Client for Meetings for Windows (32-bit) Zoom Rooms for Conference Room for Windows (32-bit) Zoom VDI Windows Meeting Client for Windows (32-bit) Windows
  • High 8.8
    CVE-2022-28768

    Local Privilege Escalation in Zoom Client Installer for macOS

    The Zoom Client for Meetings Installer for macOS (Standard and for IT Admin) before version 5.12.6 contains a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability during the install process to escalate their p…

    Zoom Video Communications Zoom Client for Meetings Installer for macOS (Standard and for IT Admin) macOS
  • High 7.2
    CVE-2022-39179

    College Management System v1.0 - Authenticated remote code execution

    College Management System v1.0 - Authenticated remote code execution. An admin user (the authentication can be bypassed using SQL Injection that mentioned in my other report) can upload .php file that contains malicious code via student.php file.

    College Management College Management System v1.0
  • High 7.5
    CVE-2022-36785

    D-Link – G integrated Access Device4 Information Disclosure & Authorization Bypass.

    D-Link – G integrated Access Device4 Information Disclosure & Authorization Bypass. *Information Disclosure – file contains a URL with private IP at line 15 "login.asp" A. The window.location.href = http://192.168.1.1/setupWizard.asp" http://192.168.1.1/setup…

    D-Link G integrated Access Device4 Network devices
  • Critical 9.8
    CVE-2022-39180

    College Management System v1.0 - SQL Injection (SQLi)

    College Management System v1.0 - SQL Injection (SQLi). By inserting SQL commands to the username and password fields in the login.php page

    College Management College Management System v1.0
  • Medium 5.3
    CVE-2022-39178

    Webvendome - webvendome Internal Server IP Disclosure

    Webvendome - webvendome Internal Server IP Disclosure. Send GET Request to the request which is shown in the picture. Internal Server IP and Full path disclosure.

    webvendome webvendome
  • Medium 6.1
    CVE-2022-39181

    GLPI - Reports plugin for GLPI Reflected Cross-Site-Scripting (RXSS)

    GLPI - Reports plugin for GLPI Reflected Cross-Site-Scripting (RXSS). Type 1: Reflected XSS (or Non-Persistent) - The server reads data directly from the HTTP request and reflects it back in the HTTP response. Reflected XSS exploits occur when an attacker cau…

    GLPI Reports plugin for GLPI
  • Critical 9.8
    CVE-2022-36784

    Elsight – Elsight Halo Remote Code Execution (RCE)

    Elsight – Elsight Halo  Remote Code Execution (RCE) Elsight Halo web panel allows us to perform connection validation. through the POST request : /api/v1/nics/wifi/wlan0/ping we can abuse DESTINATION parameter and leverage it to remote code execution.

    Elsight Elsight Halo
  • Critical 9.8
    CVE-2022-36787

    webvendome - webvendome SQL Injection

    webvendome - webvendome SQL Injection. SQL Injection in the Parameter " DocNumber" Request : Get Request : /webvendome/showfiles.aspx?jobnumber=nullDoc Number=HERE.

    webvendome webvendome
  • Medium 6.3
    CVE-2022-45069

    WordPress Crowdsignal Dashboard plugin <= 3.0.9 - Privilege Escalation vulnerability

    Auth. (contributor+) Privilege Escalation vulnerability in Crowdsignal Dashboard plugin <= 3.0.9 on WordPress.

    Automattic Crowdsignal Dashboard – Polls, Surveys & more (WordPress plugin) Web / CMS
  • Medium 4.8
    CVE-2022-40694

    WordPress News Announcement Scroll plugin <= 8.8.8 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in News Announcement Scroll plugin <= 8.8.8 on WordPress.

    StoreApps News Announcement Scroll (WordPress plugin) Web / CMS
  • Medium 4.8
    CVE-2022-44736

    WordPress Chameleon plugin <= 1.4.3 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Chameleon plugin <= 1.4.3 on WordPress.

    Fahad Mahmood Chameleon (WordPress plugin) Web / CMS
  • High 7.1
    CVE-2022-40192

    WordPress wpForo Forum plugin <= 2.0.9 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in wpForo Forum plugin <= 2.0.9 on WordPress.

    gVectors Team wpForo Forum (WordPress plugin) Web / CMS
  • Medium 4.8
    CVE-2022-41315

    WordPress Ezoic plugin <= 2.8.8 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

    Auth. Stored Cross-Site Scripting (XSS) vulnerability in Ezoic plugin <= 2.8.8 on WordPress.

    ezoic Ezoic (WordPress plugin) Web / CMS
  • Medium 6.1
    CVE-2022-41132

    WordPress Ezoic plugin <= 2.8.8 - Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability

    Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability in Ezoic plugin <= 2.8.8 on WordPress.

    ezoic Ezoic (WordPress plugin) Web / CMS
  • Medium 4.8
    CVE-2022-44591

    WordPress Anthologize plugin <= 0.8.0 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Anthologize plugin <= 0.8.0 on WordPress.

    One Week | One Tool Anthologize (WordPress plugin) Web / CMS
  • Medium 6.8
    CVE-2022-41791

    WordPress ProfileGrid plugin <= 5.1.6 - Auth. CSV Injection vulnerability

    Auth. (subscriber+) CSV Injection vulnerability in ProfileGrid plugin <= 5.1.6 on WordPress.

    Profilegrid ProfileGrid (WordPress plugin) Web / CMS
  • Medium 6.3
    CVE-2022-45077

    WordPress Betheme theme <= 26.5.1.4 - Auth. PHP Object Injection vulnerability

    Auth. (subscriber+) PHP Object Injection vulnerability in Betheme theme <= 26.5.1.4 on WordPress.

    Muffin Group Betheme (WordPress theme) Web / CMS
  • Medium 6.1
    CVE-2022-36357

    WordPress ULTIMATE TABLES plugin <= 1.6.5 - Unauth. Reflected Cross-Site Scripting (XSS) vulnerability

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Webpsilon ULTIMATE TABLES plugin <= 1.6.5 versions.

    Webpsilon ULTIMATE TABLES
  • Medium 5.4
    CVE-2022-45066

    WordPress WooSwipe WooCommerce Gallery plugin <= 2.0.1 - Auth. Broken Access Control vulnerability

    Auth. (subscriber+) Broken Access Control vulnerability in WooSwipe WooCommerce Gallery plugin <= 2.0.1 on WordPress.

    Thrive Website Design WooSwipe WooCommerce Gallery (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-45375

    WordPress iFeature Slider plugin <= 1.2 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in iFeature Slider plugin <= 1.2 on WordPress.

    cyberchimps iFeature Slider (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2021-36905

    WordPress Quiz And Survey Master plugin <= 7.3.4 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilities

    Multiple Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in Quiz And Survey Master plugin <= 7.3.4 on WordPress.

    ExpressTech Systems Quiz And Survey Master (WordPress plugin) Web / CMS
  • Critical 9.9
    CVE-2022-40200

    WordPress wpForo Forum plugin <= 2.0.9 - Auth. Arbitrary File Upload vulnerability

    Auth. (subscriber+) Arbitrary File Upload vulnerability in wpForo Forum plugin <= 2.0.9 on WordPress.

    gVectors Team wpForo Forum (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-38461

    WordPress WPML Multilingual CMS premium plugin <= 4.5.10 - Broken Access Control vulnerability

    Broken Access Control vulnerability in WPML Multilingual CMS premium plugin <= 4.5.10 on WordPress allows users with a subscriber or higher user role to change plugin settings (selected language for legacy widgets, the default behavior for media content).

    OnTheGoSystems WPML Multilingual CMS (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-45071

    WordPress WPML Multilingual CMS premium plugin <= 4.5.13 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in WPML Multilingual CMS premium plugin <= 4.5.13 on WordPress.

    OnTheGoSystems WPML Multilingual CMS (WordPress plugin) Web / CMS
  • Medium 4.3
    CVE-2022-45072

    WordPress WPML Multilingual CMS premium plugin <= 4.5.13 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in WPML Multilingual CMS premium plugin <= 4.5.13 on WordPress.

    OnTheGoSystems WPML Multilingual CMS (WordPress plugin) Web / CMS
  • High 7.5
    CVE-2022-3090

    Red Lion Controls Crimson 3.0 versions 707.000 and prior, Crimson 3.1 versions 3126.001 and prior, and Crimson 3.2 vers…

    Red Lion Controls Crimson 3.2 Crimson 3.1 Crimson 3.0
  • Medium 4.8
    CVE-2022-32537

    Medtronic MiniMed 600 Series Pump System Communication Issue

    A vulnerability exists which could allow an unauthorized user to learn aspects of the communication protocol used to pair system components while the pump is being paired with other system components. Exploitation requires nearby wireless signal proximity wit…

    Medtronic Minimed 600 Series Insulin Pump
  • Medium 5.4
    CVE-2022-38390

    Multiple IBM Business Automation Workflow versions are vulnerable to cross-site scripting. This vulnerability allows us…

    IBM Business Automation Workflow
  • Medium 4.9
    CVE-2022-40751

    IBM UrbanCode Deploy information disclosure

    IBM UrbanCode Deploy (UCD) 6.2.7.0 through 6.2.7.17, 7.0.0.0 through 7.0.5.12, 7.1.0.0 through 7.1.2.8, and 7.2.0.0 through 7.2.3.1 could allow a user with administrative privileges including "Manage Security" permissions may be able to recover a credential p…

    IBM UrbanCode Deploy
  • Critical 9.8
    CVE-2022-43782

    Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd application via security misconfigu…

    Atlassian Crowd Data Center Crowd Server
  • Critical 9.8
    CVE-2022-43781 Public exploit EPSS 98%

    There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker…

    Atlassian Bitbucket Server Bitbucket Data Center
  • High 8.2
    CVE-2022-39389

    Witness Block Parsing DoS Vulnerability in lnd

    Lightning Network Daemon (lnd) is an implementation of a lightning bitcoin overlay network node. All lnd nodes before version `v0.15.4` are vulnerable to a block parsing bug that can cause a node to enter a degraded state once encountered. In this degraded st…

    lightningnetwork lnd github.com/lightningnetwork/lnd Go