Skip to content
OpenAdvisories

Archive

22 November 2022

Vulnerabilities first published on this day (UTC), newest first.

← October 2022 2022 / November /22 December 2022 →
  1. 1211
  2. 273
  3. 3120
  4. 437
  5. 52
  6. 66
  7. 763
  8. 8120
  9. 9179
  10. 1092
  11. 1191
  12. 1211
  13. 1315
  14. 1497
  15. 15108
  16. 1644
  17. 1788
  18. 18105
  19. 195
  20. 208
  21. 2190
  22. 2284
  23. 2398
  24. 2421
  25. 2559
  26. 264
  27. 278
  28. 2867
  29. 2986
  30. 3057
All Critical High Medium Low Exploited only Public exploit

20 results · Clear filters · Feed

  • High 7.8
    CVE-2022-3910 Public exploit

    Use after free in IO_uring in the Linux Kernel

    Use After Free vulnerability in Linux Kernel allows Privilege Escalation. An improper Update of Reference Count in io_uring leads to Use-After-Free and Local Privilege Escalation. When io_msg_ring was invoked with a fixed file, it called io_fput_file() which …

    Linux linux_kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2022-2513

    Cleartext Credentials Vulnerability on Hitachi Energy’s Multiple IED Connectivity Packages (IED ConnPacks) and PCM600 Products

    A vulnerability exists in the Intelligent Electronic Device (IED) Connectivity Package (ConnPack) credential storage function in Hitachi Energy’s PCM600 product included in the versions listed below, where IEDs credentials are stored in a cleartext format in …

    Hitachi Energy PCM600 PWC600 Connectivity Package 650 Connectivity Package ICS / OT
  • High 7.3
    CVE-2022-37931

    A vulnerability in NetBatch-Plus software allows unauthorized access to the application

    A vulnerability in NetBatch-Plus software allows unauthorized access to the application.  HPE has provided a workaround and fix. Please refer to HPE Security Bulletin HPESBNS04388 for details.

    HPE NetBatch-Plus software
  • High 7.5
    CVE-2022-0222

    A CWE-269: Improper Privilege Management vulnerability exists that could cause a denial of service of the Ethernet comm…

    Schneider Electric Modicon M340 CPUs Modicon M340 X80 Ethernet Communication modules: BMXNOE0100 (H) BMXNOE0110 (H) BMXNOR0200H RTU ICS / OT
  • High 8.8
    CVE-2022-33012

    Account Takeover Through Password Reset Poisoning

    Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack.

    microweber/microweber Packagist
  • High 7.8
    CVE-2022-35407

    An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. A stack buffer overflow leads to arbitrary cod…

  • High 8.8
    CVE-2022-39066 Public exploit EPSS 27%

    There is a SQL injection vulnerability in ZTE MF286R. Due to insufficient validation of the input parameters of the pho…

  • High 7.8
    CVE-2022-3088

    UC-8100A-ME-T System Image: Versions v1.0 to v1.6, UC-2100 System Image: Versions v1.0 to v1.12, UC-2100-W System Image…

    Moxa UC-2100 System Image UC-8580 with Debian 9 System Image UC-3100 System Image ICS / OT
  • High 7.5
    CVE-2022-45330

    AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the Category parameter at \category.php. Thi…

  • High 7.5
    CVE-2022-45331

    AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the p_id parameter at \post.php. This vulner…

  • High 7.2
    CVE-2022-30529

    File upload vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attacker…

  • High 8.1
    CVE-2022-40870

    The Web Client of Parallels Remote Application Server v18.0 is vulnerable to Host Header Injection attacks. This vulner…

  • High 7.5
    CVE-2022-40303 EPSS 41%

    An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE pa…

    libxml2 libxml2 libxml2 libxml2 Debian Ubuntu Azure Linux Alpine
  • High 7.8
    CVE-2022-41131

    Apache Airflow Hive Provider vulnerability (command injection via hive_cli connection)

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Hive Provider, Apache Airflow allows an attacker to execute arbtrary commands in the task execution context, without write access to DAG…

    Apache Software Foundation Apache Airflow Apache Airflow Hive Provider apache-airflow-providers-apache-hive PyPI
  • High 7.1
    CVE-2022-41940

    Uncaught exception in engine.io

    Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This …

    socketio engine.io js-jquery engine.io Azure Linux npm
  • High 7.9
    CVE-2022-41942

    Sourcegraph vulnerable to Comand Injection via gitserver

    Sourcegraph is a code intelligence platform. In versions prior to 4.1.0 a command Injection vulnerability existed in the gitserver service, present in all Sourcegraph deployments. This vulnerability was caused by a lack of input validation on the host paramet…

    sourcegraph sourcegraph
  • High 8.8
    CVE-2022-42098 Public exploit

    KLiK SocialMediaWebsite version v1.0.1 is vulnerable to SQL Injection via the profile.php.

  • High 7.5
    CVE-2022-37301

    A CWE-191: Integer Underflow (Wrap or Wraparound) vulnerability exists that could cause a denial of service of the cont…

    Schneider Electric Modicon M340 CPU (part numbers BMXP34*) Modicon M580 CPU (part numbers BMEP* and BMEH*) Modicon MC80 (BMKC80) ICS / OT
  • High 8.8
    CVE-2022-43685

    CKAN contains Improper Authentication leading to account takeover

    CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request. This allows a user to take over an existing account including superuser accounts.

    ckan PyPI
  • High 7.8
    CVE-2022-43751

    McAfee Total Protection prior to version 16.0.49 contains an uncontrolled search path element vulnerability due to the …