Skip to content
OpenAdvisories

Archive

17 November 2022

Vulnerabilities first published on this day (UTC), newest first.

← October 2022 2022 / November /17 December 2022 →
  1. 1211
  2. 273
  3. 3120
  4. 437
  5. 52
  6. 66
  7. 763
  8. 8120
  9. 9179
  10. 1092
  11. 1191
  12. 1211
  13. 1315
  14. 1497
  15. 15108
  16. 1644
  17. 1788
  18. 18105
  19. 195
  20. 208
  21. 2190
  22. 2284
  23. 2398
  24. 2421
  25. 2559
  26. 264
  27. 278
  28. 2867
  29. 2986
  30. 3057
All Critical High Medium Low Exploited only Public exploit

41 results · Clear filters · Feed

  • Medium 5.7
    CVE-2022-24939

    Malformed Zigbee packet with invalid destination address causes Assert

     A malformed packet containing an invalid destination address, causes a stack overflow in the Ember ZNet stack. This causes an assert which leads to a reset, immediately clearing the error.

    silabs.com Ember ZNet
  • Medium 5.3
    CVE-2022-39178

    Webvendome - webvendome Internal Server IP Disclosure

    Webvendome - webvendome Internal Server IP Disclosure. Send GET Request to the request which is shown in the picture. Internal Server IP and Full path disclosure.

    webvendome webvendome
  • Medium 6.1
    CVE-2022-39181

    GLPI - Reports plugin for GLPI Reflected Cross-Site-Scripting (RXSS)

    GLPI - Reports plugin for GLPI Reflected Cross-Site-Scripting (RXSS). Type 1: Reflected XSS (or Non-Persistent) - The server reads data directly from the HTTP request and reflects it back in the HTTP response. Reflected XSS exploits occur when an attacker cau…

    GLPI Reports plugin for GLPI
  • Medium 6.3
    CVE-2022-45069

    WordPress Crowdsignal Dashboard plugin <= 3.0.9 - Privilege Escalation vulnerability

    Auth. (contributor+) Privilege Escalation vulnerability in Crowdsignal Dashboard plugin <= 3.0.9 on WordPress.

    Automattic Crowdsignal Dashboard – Polls, Surveys & more (WordPress plugin) Web / CMS
  • Medium 4.8
    CVE-2022-40694

    WordPress News Announcement Scroll plugin <= 8.8.8 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in News Announcement Scroll plugin <= 8.8.8 on WordPress.

    StoreApps News Announcement Scroll (WordPress plugin) Web / CMS
  • Medium 4.8
    CVE-2022-44736

    WordPress Chameleon plugin <= 1.4.3 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Chameleon plugin <= 1.4.3 on WordPress.

    Fahad Mahmood Chameleon (WordPress plugin) Web / CMS
  • Medium 4.8
    CVE-2022-41315

    WordPress Ezoic plugin <= 2.8.8 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

    Auth. Stored Cross-Site Scripting (XSS) vulnerability in Ezoic plugin <= 2.8.8 on WordPress.

    ezoic Ezoic (WordPress plugin) Web / CMS
  • Medium 6.1
    CVE-2022-41132

    WordPress Ezoic plugin <= 2.8.8 - Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability

    Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability in Ezoic plugin <= 2.8.8 on WordPress.

    ezoic Ezoic (WordPress plugin) Web / CMS
  • Medium 4.8
    CVE-2022-44591

    WordPress Anthologize plugin <= 0.8.0 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Anthologize plugin <= 0.8.0 on WordPress.

    One Week | One Tool Anthologize (WordPress plugin) Web / CMS
  • Medium 6.8
    CVE-2022-41791

    WordPress ProfileGrid plugin <= 5.1.6 - Auth. CSV Injection vulnerability

    Auth. (subscriber+) CSV Injection vulnerability in ProfileGrid plugin <= 5.1.6 on WordPress.

    Profilegrid ProfileGrid (WordPress plugin) Web / CMS
  • Medium 6.3
    CVE-2022-45077

    WordPress Betheme theme <= 26.5.1.4 - Auth. PHP Object Injection vulnerability

    Auth. (subscriber+) PHP Object Injection vulnerability in Betheme theme <= 26.5.1.4 on WordPress.

    Muffin Group Betheme (WordPress theme) Web / CMS
  • Medium 6.1
    CVE-2022-36357

    WordPress ULTIMATE TABLES plugin <= 1.6.5 - Unauth. Reflected Cross-Site Scripting (XSS) vulnerability

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Webpsilon ULTIMATE TABLES plugin <= 1.6.5 versions.

    Webpsilon ULTIMATE TABLES
  • Medium 5.4
    CVE-2022-45066

    WordPress WooSwipe WooCommerce Gallery plugin <= 2.0.1 - Auth. Broken Access Control vulnerability

    Auth. (subscriber+) Broken Access Control vulnerability in WooSwipe WooCommerce Gallery plugin <= 2.0.1 on WordPress.

    Thrive Website Design WooSwipe WooCommerce Gallery (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-45375

    WordPress iFeature Slider plugin <= 1.2 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in iFeature Slider plugin <= 1.2 on WordPress.

    cyberchimps iFeature Slider (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2021-36905

    WordPress Quiz And Survey Master plugin <= 7.3.4 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilities

    Multiple Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in Quiz And Survey Master plugin <= 7.3.4 on WordPress.

    ExpressTech Systems Quiz And Survey Master (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-38461

    WordPress WPML Multilingual CMS premium plugin <= 4.5.10 - Broken Access Control vulnerability

    Broken Access Control vulnerability in WPML Multilingual CMS premium plugin <= 4.5.10 on WordPress allows users with a subscriber or higher user role to change plugin settings (selected language for legacy widgets, the default behavior for media content).

    OnTheGoSystems WPML Multilingual CMS (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-45071

    WordPress WPML Multilingual CMS premium plugin <= 4.5.13 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in WPML Multilingual CMS premium plugin <= 4.5.13 on WordPress.

    OnTheGoSystems WPML Multilingual CMS (WordPress plugin) Web / CMS
  • Medium 4.3
    CVE-2022-45072

    WordPress WPML Multilingual CMS premium plugin <= 4.5.13 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in WPML Multilingual CMS premium plugin <= 4.5.13 on WordPress.

    OnTheGoSystems WPML Multilingual CMS (WordPress plugin) Web / CMS
  • Medium 4.8
    CVE-2022-32537

    Medtronic MiniMed 600 Series Pump System Communication Issue

    A vulnerability exists which could allow an unauthorized user to learn aspects of the communication protocol used to pair system components while the pump is being paired with other system components. Exploitation requires nearby wireless signal proximity wit…

    Medtronic Minimed 600 Series Insulin Pump
  • Medium 5.4
    CVE-2022-38390

    Multiple IBM Business Automation Workflow versions are vulnerable to cross-site scripting. This vulnerability allows us…

    IBM Business Automation Workflow
  • Medium 4.9
    CVE-2022-40751

    IBM UrbanCode Deploy information disclosure

    IBM UrbanCode Deploy (UCD) 6.2.7.0 through 6.2.7.17, 7.0.0.0 through 7.0.5.12, 7.1.0.0 through 7.1.2.8, and 7.2.0.0 through 7.2.3.1 could allow a user with administrative privileges including "Manage Security" permissions may be able to recover a credential p…

    IBM UrbanCode Deploy
  • Medium 5.4
    CVE-2022-39834

    A stored XSS vulnerability was discovered in adminweb/ra/viewendentity.jsp in PrimeKey EJBCA through 7.9.0.2. A low-pri…

  • Medium 4.7
    CVE-2022-4052

    Student Attendance Management System createClass.php sql injection

    A vulnerability was found in Student Attendance Management System and classified as critical. This issue affects some unknown processing of the file /Admin/createClass.php. The manipulation of the argument Id leads to sql injection. The attack may be initiate…

  • Medium 6.3
    CVE-2022-4051

    Hostel Searching Project view-property.php sql injection

    A vulnerability has been found in Hostel Searching Project and classified as critical. This vulnerability affects unknown code of the file view-property.php. The manipulation of the argument property_id leads to sql injection. The attack can be initiated remo…

  • Medium 5.4
    CVE-2022-36432 Public exploit

    The Preview functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 uses eval unsafely. This allows attackers …

  • Medium 6.3
    CVE-2022-41920

    Zip slip in Lancet

    Lancet is a general utility library for the go programming language. Affected versions are subject to a ZipSlip issue when using the fileutil package to unzip files. This issue has been addressed and a fix will be included in versions 2.1.10 and 1.3.4. Users …

    duke-git lancet github.com/duke-git/lancet/v2 github.com/duke-git/lancet Go
  • Medium 5.3
    CVE-2022-42892

    A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server ho…

    Siemens syngo Dynamics ICS / OT
  • Medium 6.1
    CVE-2022-42187

    Hustoj 22.09.22 has a XSS Vulnerability in /admin/problem_judge.php.

  • Medium 5.4
    CVE-2022-42954

    Keyfactor EJBCA before 7.10.0 allows XSS.

  • Medium 4.8
    CVE-2022-42985

    The ScratchLogin extension through 1.1 for MediaWiki does not escape verification failure messages, which allows users …

  • Medium 6.8
    CVE-2022-43096 Public exploit

    Mediatrix 4102 before v48.5.2718 allows local attackers to gain root access via the UART port.

  • Medium 6.1
    CVE-2022-43142

    A cross-site scripting (XSS) vulnerability in the add-fee.php component of Password Storage Application v1.0 allows att…

  • Medium 6.7
    CVE-2022-43192

    An arbitrary file upload vulnerability in the component /dede/file_manage_control.php of Dedecms v5.7.101 allows attack…

  • Medium 6.1
    CVE-2022-43332 Public exploit

    A cross-site scripting (XSS) vulnerability in Wondercms v3.3.4 allows attackers to execute arbitrary web scripts or HTM…

  • Medium 6.5
    CVE-2022-43171

    LIEF heap buffer overflow in the LIEF::MachO::BinaryParser::parse_dyldinfo_generic_bind

    A heap buffer overflow in the LIEF::MachO::BinaryParser::parse_dyldinfo_generic_bind function of LIEF v0.12.1 allows attackers to cause a Denial of Service (DoS) via a crafted MachO file.

    lief PyPI
  • Medium 6.7
    CVE-2022-20428

    In (TBD) of (TBD), there is a possible out of bounds write due to a missing bounds check. This could lead to local esca…

    Android
  • Medium 6.7
    CVE-2022-20460

    In (TBD) mprot_unmap? of (TBD), there is a possible way to corrupt the memory mapping due to improper input validation.…

    Android
  • Medium 6.7
    CVE-2022-20427

    In (TBD) of (TBD), there is a possible way to corrupt memory due to improper input validation. This could lead to local…

    Android
  • Medium 6.7
    CVE-2022-20459

    In (TBD) of (TBD), there is a possible way to redirect code execution due to improper input validation. This could lead…

    Android
  • Medium 5.5
    CVE-2021-33897

    A buffer overflow in Synthesia before 10.7.5567, when a non-Latin locale is used, allows user-assisted attackers to cau…