22 November 2022

84 results · Feed

• Critical 9.8
  CVE-2022-44199

  Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow via parameter openvpn_server_ip.

  Nov 22, 2022
• Critical 9.8
  CVE-2022-44190

  Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow via parameter enable_band_steering.

  Nov 22, 2022
• Critical 9.8
  CVE-2022-44807

  D-Link DIR-882 1.10B02 and 1.20B06 is vulnerable to Buffer Overflow via webGetVarString.

  Nov 22, 2022
• Critical 9.8
  CVE-2022-44202

  D-Link DIR878 1.02B04 and 1.02B05 are vulnerable to Buffer Overflow.

  Nov 22, 2022
• Critical 9.8
  CVE-2022-44200

  Netgear R7000P V1.3.0.8, V1.3.1.64 is vulnerable to Buffer Overflow via parameters: stamode_dns1_pri and stamode_dns1_s…

  Nov 22, 2022
• Critical 9.8
  CVE-2022-44808

  A command injection vulnerability has been found on D-Link DIR-823G devices with firmware version 1.02B03 that allows a…

  Nov 22, 2022
• Critical 9.8
  CVE-2022-44184

  Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow in /usr/sbin/httpd via parameter wan_dns1_sec.

  Nov 22, 2022
• Critical 9.8
  CVE-2022-44806

  D-Link DIR-882 1.10B02 and 1.20B06 is vulnerable to Buffer Overflow.

  Nov 22, 2022
• Critical 9.8
  CVE-2022-44191

  Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow via parameters KEY1 and KEY2.

  Nov 22, 2022
• Critical 9.8
  CVE-2022-44188

  Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow in /usr/sbin/httpd via parameter enable_band_steering.

  Nov 22, 2022
• Critical 9.8
  CVE-2022-44187

  Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow via wan_dns1_pri.

  Nov 22, 2022
• Critical 9.8
  CVE-2022-44196

  Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow via parameter openvpn_push1.

  Nov 22, 2022
• Critical 9.8
  CVE-2022-44193

  Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow in /usr/sbin/httpd via parameters: starthour, startminute , e…

  Nov 22, 2022
• Critical 9.8
  CVE-2022-44186

  Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow in /usr/sbin/httpd via parameter wan_dns1_pri.

  Nov 22, 2022
• Critical 9.8
  CVE-2022-44201

  D-Link DIR823G 1.02B05 is vulnerable to Commad Injection.

  Nov 22, 2022
• Critical 9.8
  CVE-2022-44194

  Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow via parameters apmode_dns1_pri and apmode_dns1_sec.

  Nov 22, 2022
• Critical 9.8
  CVE-2022-44198

  Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow via parameter openvpn_push1.

  Nov 22, 2022
• Critical 9.8
  CVE-2022-44801

  D-Link DIR-878 1.02B05 is vulnerable to Incorrect Access Control.

  Nov 22, 2022
• Critical 9.8
  CVE-2022-44197

  Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow via parameter openvpn_server_ip.

  Nov 22, 2022
• Critical 9.8
  CVE-2022-44804

  D-Link DIR-882 1.10B02 and1.20B06 is vulnerable to Buffer Overflow via the websRedirect function.

  Nov 22, 2022
• Medium 6.5
  CVE-2022-41952

  Uncontrolled Resource Consumption in Matrix Synapse

  Synapse before 1.52.0 with URL preview functionality enabled will attempt to generate URL previews for media stream URLs without properly limiting connection time. Connections will only be terminated after `max_spider_size` (default: 10M) bytes have been down…

  Matrix synapse matrix-synapse matrix-synapse Ubuntu PyPI
  Nov 22, 2022
• Medium 6.8
  CVE-2022-41223 Exploited · Ransomware EPSS 11%

  The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to…

  Nov 22, 2022

  KEV Feb 21, 2023
• High 7.8
  CVE-2022-41131

  Apache Airflow Hive Provider vulnerability (command injection via hive_cli connection)

  Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Hive Provider, Apache Airflow allows an attacker to execute arbtrary commands in the task execution context, without write access to DAG…

  Apache Software Foundation Apache Airflow Apache Airflow Hive Provider apache-airflow-providers-apache-hive PyPI
  Nov 22, 2022
• Medium 6.4
  CVE-2022-41950

  Privilege Escalation Vulnerability by wrong chmod param

  super-xray is the GUI alternative for vulnerability scanning tool xray. In 0.2-beta, a privilege escalation vulnerability was discovered. This caused inaccurate default xray permissions. Note: this vulnerability only affects Linux and Mac OS systems. Users sh…

  4ra1n super-xray
  Nov 22, 2022
• Critical 9.8
  CVE-2022-41326

  The web conferencing component of Mitel MiCollab through 9.6.0.13 could allow an unauthenticated attacker to upload arb…

  Nov 22, 2022
• High 7.1
  CVE-2022-41940

  Uncaught exception in engine.io

  Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This …

  socketio engine.io js-jquery engine.io Azure Linux npm
  Nov 22, 2022
• Medium 5.3
  CVE-2022-41936

  Exposure of Private Personal Information to an Unauthorized Actor in xwiki-platform-rest-server

  XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The `modifications` rest endpoint does not filter out entries according to the user's rights. Therefore, information hidden from unauthorized users are ex…

  xwiki xwiki-platform org.xwiki.platform:xwiki-platform-rest-server Maven
  Nov 22, 2022
• Critical 9.0
  CVE-2022-41943

  Incorrect default permissions found in Sourcegraph

  sourcegraph is a code intelligence platform. As a site admin it was possible to execute arbitrary commands on Gitserver when the experimental `customGitFetch` feature was enabled. This experimental feature has now been disabled by default. This issue has been…

  sourcegraph sourcegraph
  Nov 22, 2022
• Medium 4.8
  CVE-2022-41445 Public exploit

  A cross-site scripting (XSS) vulnerability in Record Management System using CodeIgniter 1.0 allows attackers to execut…

  Nov 22, 2022
• Medium 4.2
  CVE-2022-41919

  Fastify vulnerable to Cross-Site Request Forgery (CSRF) attack via incorrect content type

  Fastify is a web framework with minimal overhead and plugin architecture. The attacker can use the incorrect `Content-Type` to bypass the `Pre-Flight` checking of `fetch`. `fetch()` requests with Content-Type’s essence as "application/x-www-form-urlencoded", …

  fastify fastify fastify npm
  Nov 22, 2022
• Critical 9.6
  CVE-2022-41937

  Missing Authorization in XWiki Platform

  XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The application allows anyone with view access to modify any page of the wiki by importing a crafted XAR package. The problem has been patched in XWiki 14…

  xwiki xwiki-platform org.xwiki.platform:xwiki-platform-filter-ui Maven
  Nov 22, 2022
• High 7.9
  CVE-2022-41942

  Sourcegraph vulnerable to Comand Injection via gitserver

  Sourcegraph is a code intelligence platform. In versions prior to 4.1.0 a command Injection vulnerability existed in the gitserver service, present in all Sourcegraph deployments. This vulnerability was caused by a lack of input validation on the host paramet…

  sourcegraph sourcegraph
  Nov 22, 2022
• Critical 9.0
  CVE-2022-42989

  ERP Sankhya before v4.11b81 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Caix…

  Nov 22, 2022
• Medium 4.8
  CVE-2022-42097 Public exploit

  Cross-site Scripting in Backdrop CMS

  Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via 'Comment.' .

  backdrop/backdrop Packagist
  Nov 22, 2022
• Medium 4.8
  CVE-2022-42094 Public exploit Scanner template

  Cross-site Scripting in Backdrop CMS

  Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the 'Card' content.

  backdrop/backdrop Packagist
  Nov 22, 2022
• High 8.8
  CVE-2022-42098 Public exploit

  KLiK SocialMediaWebsite version v1.0.1 is vulnerable to SQL Injection via the profile.php.

  Nov 22, 2022
• High 7.5
  CVE-2022-37301

  A CWE-191: Integer Underflow (Wrap or Wraparound) vulnerability exists that could cause a denial of service of the cont…

  Schneider Electric Modicon M340 CPU (part numbers BMXP34*) Modicon M580 CPU (part numbers BMEP* and BMEH*) Modicon MC80 (BMKC80) ICS / OT
  Nov 22, 2022
• Medium 6.5
  CVE-2022-37773

  An authenticated SQL Injection vulnerability in the statistics page (/statistics/retrieve) of Maarch RM 2.8, via the fi…

  Nov 22, 2022
• Medium 5.3
  CVE-2022-37774

  There is a broken access control vulnerability in the Maarch RM 2.8.3 solution. When accessing some specific document (…

  Nov 22, 2022
• Critical 9.8
  CVE-2022-43214

  Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the orderId parameter at printO…

  Nov 22, 2022