Archive

18 November 2022

Vulnerabilities first published on this day (UTC), newest first.

← October 2022 2022 / November /18 December 2022 →

All Critical High Medium Low Exploited only Public exploit

66 results · Clear filters · Feed

Medium 6.4

CVE-2022-41609

WordPress Better Messages plugin <= 1.9.10.68 - Server-Side Request Forgery (SSRF) vulnerability

Auth. (subscriber+) Server-Side Request Forgery (SSRF) vulnerability in Better Messages plugin 1.9.10.68 on WordPress.

wordplus Better Messages (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 5.3

CVE-2022-41155

WordPress iQ Block Country plugin <= 1.2.18 - Block BYPASS vulnerability

Block BYPASS vulnerability in iQ Block Country plugin <= 1.2.18 on WordPress.

Pascal iQ Block Country (WordPress) Web / CMS

Nov 18, 2022
Medium 4.3

CVE-2022-40216

WordPress Better Messages plugin <= 1.9.10.69 - Auth. Messaging Block Bypass vulnerability

Auth. (subscriber+) Messaging Block Bypass vulnerability in Better Messages plugin <= 1.9.10.69 on WordPress.

wordplus Better Messages (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 4.3

CVE-2022-40130

WordPress WP-Polls plugin <= 2.76.0 - Auth. Race Condition vulnerability

Auth. (subscriber+) Race Condition vulnerability in WP-Polls plugin <= 2.76.0 on WordPress.

Lester 'GaMerZ' Chan WP-Polls (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 6.1

CVE-2022-41615

WordPress Store Locator plugin <= 1.4.5 - Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Store Locator plugin <= 1.4.5 on WordPress.

Agile Logix Store Locator WordPress (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 5.4

CVE-2022-41634

WordPress Media Library Folders plugin <= 7.1.1 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Media Library Folders plugin <= 7.1.1 on WordPress.

Max Foundry Media Library Folders (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 6.5

CVE-2022-41135

WordPress Modula plugin <= 2.6.9 - Unauth. Plugin Settings Change vulnerability

Unauth. Plugin Settings Change vulnerability in Modula plugin <= 2.6.9 on WordPress.

WP Chill Modula Image Gallery (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 4.3

CVE-2022-41655

WordPress Phone Orders for WooCommerce plugin <= 3.7.1 - Auth. Sensitive Data Exposure vulnerability

Auth. (subscriber+) Sensitive Data Exposure vulnerability in Phone Orders for WooCommerce plugin <= 3.7.1 on WordPress.

Algolplus Phone Orders for WooCommerce (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 4.8

CVE-2022-41643

WordPress Accessibility plugin <= 1.0.3 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Accessibility plugin <= 1.0.3 on WordPress.

Octa Code Accessibility (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 4.8

CVE-2022-40963

WordPress WP Page Builder plugin <= 1.2.6 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilities

Multiple Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerabilities in WP Page Builder plugin <= 1.2.6 on WordPress.

Themeum WP Page Builder (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 5.4

CVE-2022-41685

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Integration for Szamlazz.hu & WooCommerce and Csomagpontok és szállítási címkék WooCommerce hez plugins

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Viszt Péter's Integration for Szamlazz.hu & WooCommerce plugin <= 5.6.3.2 and Csomagpontok és szállítási címkék WooCommerce-hez plugin <= 1.9.0.2 on WordPress.

Viszt Péter Integration for Szamlazz.hu & WooCommerce (WordPress plugin) Csomagpontok és szállítási címkék WooCommerce-hez (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 5.4

CVE-2022-40695

WordPress SEO Redirection Plugin plugin <= 8.9 - Multiple Cross-Site Scripting (CSRF) vulnerabilities

Multiple Cross-Site Scripting (CSRF) vulnerabilities in SEO Redirection Plugin plugin <= 8.9 on WordPress.

wp-buy SEO Redirection Plugin – 301 Redirect Manager (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 5.4

CVE-2022-41788

WordPress Soledad premium theme <= 8.2.5 - Auth. Cross-Site Scripting (XSS) vulnerability

Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Soledad premium theme <= 8.2.5 on WordPress.

PenciDesign Soledad (WordPress theme) Web / CMS

Nov 18, 2022
Medium 4.3

CVE-2022-43492

WordPress Comments – wpDiscuz plugin 7.4.2 - Auth. Insecure Direct Object References (IDOR) vulnerability

Auth. (subscriber+) Insecure Direct Object References (IDOR) vulnerability in Comments – wpDiscuz plugin 7.4.2 on WordPress.

gVectors Team Comments – wpDiscuz (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 5.4

CVE-2022-44740

WordPress Creative Mail plugin <= 1.5.4 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Creative Mail plugin <= 1.5.4 on WordPress.

Constant Contact Creative Mail (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 4.9

CVE-2022-44634

WordPress S2W – Import Shopify to WooCommerce plugin <= 1.1.12 - Auth. Arbitrary File Read vulnerability

Auth. (admin+) Arbitrary File Read vulnerability in S2W – Import Shopify to WooCommerce plugin <= 1.1.12 on WordPress.

villatheme S2W – Import Shopify to WooCommerce (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 4.3

CVE-2022-45369

WordPress Plugin for Google Reviews plugin <= 2.2.2 - Auth. Broken Access Control vulnerability

Auth. (subscriber+) Broken Access Control vulnerability in Plugin for Google Reviews plugin <= 2.2.2 on WordPress.

richplugins Plugin for Google Reviews (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 5.3

CVE-2022-41839

WordPress LoginPress plugin <= 1.6.2 - Broken Access Control vulnerability

Broken Access Control vulnerability in WordPress LoginPress plugin <= 1.6.2 on WordPress leading to unauth. changing of Opt-In or Opt-Out tracking settings.

WPBrigade LoginPress | Custom Login Page Customizer (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 5.3

CVE-2022-42883

WordPress Quiz And Survey Master plugin <= 7.3.10 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered by Quiz And Survey Master plugin <= 7.3.10 on WordPress.

ExpressTech Systems Quiz And Survey Master (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 5.4

CVE-2022-40698

WordPress Quiz And Survey Master plugin <= 7.3.10 - Cross-Site Scripting (XSS) vulnerability

Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress.

ExpressTech Systems Quiz And Survey Master (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 5.4

CVE-2022-45073

WordPress REST API Authentication plugin <= 2.4.0 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in REST API Authentication plugin <= 2.4.0 on WordPress.

miniOrange WordPress REST API Authentication (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 5.4

CVE-2022-42461

WordPress miniOrange's Google Authenticator plugin <= 5.6.1 - Broken Access Control vulnerability

Broken Access Control vulnerability in miniOrange's Google Authenticator plugin <= 5.6.1 on WordPress.

miniOrange miniOrange's Google Authenticator (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 4.3

CVE-2022-43482

WordPress Appointment Booking Calendar plugin <= 1.3.69 - Missing Authorization vulnerability

Missing Authorization vulnerability in Appointment Booking Calendar plugin <= 1.3.69 on WordPress.

codepeople Appointment Booking Calendar (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 6.5

CVE-2022-41781

WordPress Permalink Manager Lite plugin <= 2.2.20 - Broken Access Control vulnerability

Broken Access Control vulnerability in Permalink Manager Lite plugin <= 2.2.20 on WordPress.

Maciej Bis Permalink Manager Lite

Nov 18, 2022
Medium 6.1

CVE-2022-38075

WordPress Mantenimiento web plugin <= 0.13 - Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS)

Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Mantenimiento web plugin <= 0.13 on WordPress.

Carlos Doral Mantenimiento web (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 4.3

CVE-2022-41692

WordPress Appointment Hour Booking plugin <= 1.3.71 - Missing Authorization vulnerability

Missing Authorization vulnerability in Appointment Hour Booking plugin <= 1.3.71 on WordPress.

codepeople Appointment Hour Booking (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 4.8

CVE-2022-43463

WordPress Custom Product Tabs for WooCommerce plugin <= 1.7.9 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Custom Product Tabs for WooCommerce plugin <= 1.7.9 on WordPress.

YIKES Custom Product Tabs for WooCommerce (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 5.4

CVE-2022-40687

WordPress Creative Mail plugin <= 1.5.4 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Creative Mail plugin <= 1.5.4 on WordPress.

Constant Contact Creative Mail (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 5.4

CVE-2022-41805

WordPress Booster for WooCommerce plugin <= 5.6.6 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Booster for WooCommerce plugin <= 5.6.6 on WordPress.

Pluggabl Booster for WooCommerce (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 5.4

CVE-2022-40686

WordPress Creative Mail plugin <= 1.5.4 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Creative Mail plugin <= 1.5.4 on WordPress.

Constant Contact Creative Mail (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 6.5

CVE-2022-41652

WordPress Quiz And Survey Master plugin <= 7.3.10 - Bypass vulnerability

Bypass vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress.

ExpressTech Systems Quiz And Survey Master (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 4.3

CVE-2022-38974

WordPress WPML Multilingual CMS premium plugin <= 4.5.10 - Broken Access Control vulnerability

Broken Access Control vulnerability in WPML Multilingual CMS premium plugin <= 4.5.10 on WordPress allows users with subscriber or higher user roles to change the status of the translation jobs.

OnTheGoSystems WPML Multilingual CMS (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 4.9

CVE-2022-22488

IBM OpenBMC denial of service

IBM OpenBMC OP910 and OP940 could allow a privileged user to cause a denial of service by uploading or deleting too many CA certificates in a short period of time. IBM X-Force ID: 2226337.

IBM OPENBMC

Nov 18, 2022
Medium 6.5

CVE-2022-24038

Unauthorized modification in Karmasis Informatics Infraskope SIEM+

Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to damage the page where the agents are listed.

Karmasis Informatics Infraskope SIEM+

Nov 18, 2022
Medium 4.4

CVE-2022-34667

NVIDIA CUDA Toolkit SDK contains a stack-based buffer overflow vulnerability in cuobjdump, where an unprivileged remote…

NVIDIA NVIDIA CUDA Toolkit nvidia-cuda-toolkit nvidia-cuda-toolkit Debian Ubuntu

Nov 18, 2022
Medium 6.5

CVE-2022-34665

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a local user w…

NVIDIA NVIDIA Cloud Gaming (guest driver), NVIDIA Cloud Gaming (Virtual GPU Manager) nvidia-graphics-drivers-304 nvidia-graphics-drivers-340 Debian Ubuntu

Nov 18, 2022
Medium 6.1

CVE-2022-31616

NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for Dxgk…

NVIDIA NVIDIA Cloud Gaming (guest driver) nvidia-graphics-drivers-304 nvidia-graphics-drivers-340 Ubuntu

Nov 18, 2022
Medium 5.5

CVE-2022-31615

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where a local user with basic ca…

NVIDIA GeForce, Workstation, Compute nvidia-graphics-drivers-304 nvidia-graphics-drivers-340 Debian Ubuntu

Nov 18, 2022
Medium 5.5

CVE-2022-45473

In drachtio-server 0.8.18, /var/log/drachtio has mode 0777 and drachtio.log has mode 0666.

Nov 18, 2022
Medium 5.3

CVE-2022-45163

An information-disclosure vulnerability exists on select NXP devices when configured in Serial Download Protocol (SDP) …

Nov 18, 2022