Skip to content
OpenAdvisories

Archive

November 2022

Vulnerabilities first published in this month (UTC), newest first.

← October 2022 2022 / November December 2022 →
  1. 1211
  2. 273
  3. 3120
  4. 437
  5. 52
  6. 66
  7. 763
  8. 8120
  9. 9179
  10. 1092
  11. 1191
  12. 1211
  13. 1315
  14. 1497
  15. 15108
  16. 1644
  17. 1788
  18. 18105
  19. 195
  20. 208
  21. 2190
  22. 2284
  23. 2398
  24. 2421
  25. 2559
  26. 264
  27. 278
  28. 2867
  29. 2986
  30. 3057
All Critical High Medium Low Exploited only Public exploit

900 results · Clear filters · Feed

  • Medium 4.8
    CVE-2022-45012

    A cross-site scripting (XSS) vulnerability in the Modify Page module of WBCE CMS v1.5.4 allows attackers to execute arb…

  • Medium 4.8
    CVE-2022-45015

    A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute…

  • Medium 4.8
    CVE-2022-45017

    A cross-site scripting (XSS) vulnerability in the Overview Page settings module of WBCE CMS v1.5.4 allows attackers to …

  • Medium 5.5
    CVE-2022-45146

    Garbage collection issue in BC-FJA in Java 13 and later

    An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4. Changes to the JVM garbage collector in Java 13 and later trigger an issue in the BC-FJA FIPS modules where it is possible for temporary keys used by the module to be zeroed …

    opensearch-2 org.bouncycastle:bc-fips Wolfi Maven
  • Medium 4.8
    CVE-2022-45013

    A cross-site scripting (XSS) vulnerability in the Show Advanced Option module of WBCE CMS v1.5.4 allows attackers to ex…

  • Medium 4.8
    CVE-2022-40470 Public exploit

    Phpgurukul Blood Donor Management System 1.0 allows Cross Site Scripting via Add Blood Group Name Feature.

  • Medium 6.1
    CVE-2022-44787

    An issue was discovered in Appalti & Contratti 9.12.2. The web applications are vulnerable to a Reflected Cross-Site Sc…

  • Medium 6.5
    CVE-2022-44788

    An issue was discovered in Appalti & Contratti 9.12.2. It allows Session Fixation. When a user logs in providing a JSES…

  • Medium 6.5
    CVE-2022-41945

    Remote Code Execution (RCE) vulnerability in super-xray via URL input

    super-xray is a vulnerability scanner (xray) GUI launcher. In version 0.1-beta, the URL is not filtered and directly spliced ​​into the command, resulting in a possible RCE vulnerability. Users should upgrade to super-xray 0.2-beta.

    4ra1n super-xray
  • Medium 4.8
    CVE-2022-42096 Public exploit Scanner template

    Cross-site Scripting in Backdrop CMS

    Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via Post content.

    backdrop/backdrop Packagist
  • Medium 5.4
    CVE-2022-43117 Public exploit

    Sourcecodester Password Storage Application in PHP/OOP and MySQL 1.0 was discovered to contain multiple cross-site scri…

  • Medium 4.9
    CVE-2022-43709

    MyBB 1.8.31 has a SQL injection vulnerability in the Admin CP's Users module allows remote authenticated users to modif…

  • Medium 6.1
    CVE-2022-43707

    MyBB 1.8.31 has a Cross-site scripting (XSS) vulnerability in the visual MyCode editor (SCEditor) allows remote attacke…

  • Medium 6.1
    CVE-2022-43708

    MyBB 1.8.31 has a (issue 2 of 2) cross-site scripting (XSS) vulnerabilities in the post Attachments interface allow att…

  • Medium 4.3
    CVE-2022-3562 EPSS 94%

    Cross-site Scripting (XSS) - Stored in librenms/librenms

    Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0.

    librenms librenms/librenms librenms/librenms Packagist
  • Medium 5.7
    CVE-2022-3516

    Cross-site Scripting (XSS) - Stored in librenms/librenms

    Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0.

    librenms librenms/librenms librenms/librenms Packagist
  • Medium 4.3
    CVE-2022-3561

    Cross-site Scripting (XSS) - Generic in librenms/librenms

    Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 22.10.0.

    librenms librenms/librenms librenms/librenms Packagist
  • Medium 5.5
    CVE-2022-4065 Public exploit

    cbeust testng XML File Parser JarFileUtils.java testngXmlExistsInJar path traversal

    A vulnerability was found in cbeust testng 7.5.0/7.6.0/7.6.1/7.7.0. It has been declared as critical. Affected by this vulnerability is the function testngXmlExistsInJar of the file testng-core/src/main/java/org/testng/JarFileUtils.java of the component XML F…

    cbeust testng org.testng:testng testng Ubuntu Maven
  • Medium 6.1
    CVE-2022-41939

    Credential exposure when running third-party builders in knative/func

    knative.dev/func is is a client library and CLI enabling the development and deployment of Kubernetes functions. Developers using a malicious or compromised third-party buildpack could expose their registry credentials or local docker socket to a malicious `l…

    knative func
  • Medium 6.4
    CVE-2022-41609

    WordPress Better Messages plugin <= 1.9.10.68 - Server-Side Request Forgery (SSRF) vulnerability

    Auth. (subscriber+) Server-Side Request Forgery (SSRF) vulnerability in Better Messages plugin 1.9.10.68 on WordPress.

    wordplus Better Messages (WordPress plugin) Web / CMS
  • Medium 5.3
    CVE-2022-41155

    WordPress iQ Block Country plugin <= 1.2.18 - Block BYPASS vulnerability

    Block BYPASS vulnerability in iQ Block Country plugin <= 1.2.18 on WordPress.

    Pascal iQ Block Country (WordPress) Web / CMS
  • Medium 4.3
    CVE-2022-40216

    WordPress Better Messages plugin <= 1.9.10.69 - Auth. Messaging Block Bypass vulnerability

    Auth. (subscriber+) Messaging Block Bypass vulnerability in Better Messages plugin <= 1.9.10.69 on WordPress.

    wordplus Better Messages (WordPress plugin) Web / CMS
  • Medium 4.3
    CVE-2022-40130

    WordPress WP-Polls plugin <= 2.76.0 - Auth. Race Condition vulnerability

    Auth. (subscriber+) Race Condition vulnerability in WP-Polls plugin <= 2.76.0 on WordPress.

    Lester 'GaMerZ' Chan WP-Polls (WordPress plugin) Web / CMS
  • Medium 6.1
    CVE-2022-41615

    WordPress Store Locator plugin <= 1.4.5 - Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Store Locator plugin <= 1.4.5 on WordPress.

    Agile Logix Store Locator WordPress (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-41634

    WordPress Media Library Folders plugin <= 7.1.1 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Media Library Folders plugin <= 7.1.1 on WordPress.

    Max Foundry Media Library Folders (WordPress plugin) Web / CMS
  • Medium 6.5
    CVE-2022-41135

    WordPress Modula plugin <= 2.6.9 - Unauth. Plugin Settings Change vulnerability

    Unauth. Plugin Settings Change vulnerability in Modula plugin <= 2.6.9 on WordPress.

    WP Chill Modula Image Gallery (WordPress plugin) Web / CMS
  • Medium 4.3
    CVE-2022-41655

    WordPress Phone Orders for WooCommerce plugin <= 3.7.1 - Auth. Sensitive Data Exposure vulnerability

    Auth. (subscriber+) Sensitive Data Exposure vulnerability in Phone Orders for WooCommerce plugin <= 3.7.1 on WordPress.

    Algolplus Phone Orders for WooCommerce (WordPress plugin) Web / CMS
  • Medium 4.8
    CVE-2022-41643

    WordPress Accessibility plugin <= 1.0.3 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Accessibility plugin <= 1.0.3 on WordPress.

    Octa Code Accessibility (WordPress plugin) Web / CMS
  • Medium 4.8
    CVE-2022-40963

    WordPress WP Page Builder plugin <= 1.2.6 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilities

    Multiple Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerabilities in WP Page Builder plugin <= 1.2.6 on WordPress.

    Themeum WP Page Builder (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-41685

    Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Integration for Szamlazz.hu & WooCommerce and Csomagpontok és szállítási címkék WooCommerce hez plugins

    Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Viszt Péter's Integration for Szamlazz.hu & WooCommerce plugin <= 5.6.3.2 and Csomagpontok és szállítási címkék WooCommerce-hez plugin <= 1.9.0.2 on WordPress.

    Viszt Péter Integration for Szamlazz.hu & WooCommerce (WordPress plugin) Csomagpontok és szállítási címkék WooCommerce-hez (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-40695

    WordPress SEO Redirection Plugin plugin <= 8.9 - Multiple Cross-Site Scripting (CSRF) vulnerabilities

    Multiple Cross-Site Scripting (CSRF) vulnerabilities in SEO Redirection Plugin plugin <= 8.9 on WordPress.

    wp-buy SEO Redirection Plugin – 301 Redirect Manager (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-41788

    WordPress Soledad premium theme <= 8.2.5 - Auth. Cross-Site Scripting (XSS) vulnerability

    Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Soledad premium theme <= 8.2.5 on WordPress.

    PenciDesign Soledad (WordPress theme) Web / CMS
  • Medium 4.3
    CVE-2022-43492

    WordPress Comments – wpDiscuz plugin 7.4.2 - Auth. Insecure Direct Object References (IDOR) vulnerability

    Auth. (subscriber+) Insecure Direct Object References (IDOR) vulnerability in Comments – wpDiscuz plugin 7.4.2 on WordPress.

    gVectors Team Comments – wpDiscuz (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-44740

    WordPress Creative Mail plugin <= 1.5.4 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities

    Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Creative Mail plugin <= 1.5.4 on WordPress.

    Constant Contact Creative Mail (WordPress plugin) Web / CMS
  • Medium 4.9
    CVE-2022-44634

    WordPress S2W – Import Shopify to WooCommerce plugin <= 1.1.12 - Auth. Arbitrary File Read vulnerability

    Auth. (admin+) Arbitrary File Read vulnerability in S2W – Import Shopify to WooCommerce plugin <= 1.1.12 on WordPress.

    villatheme S2W – Import Shopify to WooCommerce (WordPress plugin) Web / CMS
  • Medium 4.3
    CVE-2022-45369

    WordPress Plugin for Google Reviews plugin <= 2.2.2 - Auth. Broken Access Control vulnerability

    Auth. (subscriber+) Broken Access Control vulnerability in Plugin for Google Reviews plugin <= 2.2.2 on WordPress.

    richplugins Plugin for Google Reviews (WordPress plugin) Web / CMS
  • Medium 5.3
    CVE-2022-41839

    WordPress LoginPress plugin <= 1.6.2 - Broken Access Control vulnerability

    Broken Access Control vulnerability in WordPress LoginPress plugin <= 1.6.2 on WordPress leading to unauth. changing of Opt-In or Opt-Out tracking settings.

    WPBrigade LoginPress | Custom Login Page Customizer (WordPress plugin) Web / CMS
  • Medium 5.3
    CVE-2022-42883

    WordPress Quiz And Survey Master plugin <= 7.3.10 - Sensitive Information Disclosure vulnerability

    Sensitive Information Disclosure vulnerability discovered by Quiz And Survey Master plugin <= 7.3.10 on WordPress.

    ExpressTech Systems Quiz And Survey Master (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-40698

    WordPress Quiz And Survey Master plugin <= 7.3.10 - Cross-Site Scripting (XSS) vulnerability

    Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress.

    ExpressTech Systems Quiz And Survey Master (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-45073

    WordPress REST API Authentication plugin <= 2.4.0 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in REST API Authentication plugin <= 2.4.0 on WordPress.

    miniOrange WordPress REST API Authentication (WordPress plugin) Web / CMS