Skip to content
OpenAdvisories

Archive

November 2022

Vulnerabilities first published in this month (UTC), newest first.

← October 2022 2022 / November December 2022 →
  1. 1211
  2. 273
  3. 3120
  4. 437
  5. 52
  6. 66
  7. 763
  8. 8120
  9. 9179
  10. 1092
  11. 1191
  12. 1211
  13. 1315
  14. 1497
  15. 15108
  16. 1644
  17. 1788
  18. 18105
  19. 195
  20. 208
  21. 2190
  22. 2284
  23. 2398
  24. 2421
  25. 2559
  26. 264
  27. 278
  28. 2867
  29. 2986
  30. 3057
All Critical High Medium Low Exploited only Public exploit

2,049 results · Feed

  • High 8.2
    CVE-2022-43983

    Browsershot 3.57.2 - Server Side XSS to LFR via HTML

    Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate that the HTML content passed to the Browsershot::html method does not contain URL's that use the file:/…

    spatie/browsershot Packagist
  • Medium 6.8
    CVE-2022-29833

    Insufficiently Protected Credentials vulnerability in Mitsubishi Electric Corporation GX Works3 versions 1.015R and lat…

    Mitsubishi Electric GX Works3 ICS / OT
  • Low 3.7
    CVE-2022-29832

    Cleartext Storage of Sensitive Information in Memory vulnerability in Mitsubishi Electric Corporation GX Works3 version…

    Mitsubishi Electric GX Works3 GX Works2 GX Developer ICS / OT
  • High 7.5
    CVE-2022-29831

    Use of Hard-coded Password vulnerability in Mitsubishi Electric Corporation GX Works3 versions from 1.015R to 1.095Z al…

    Mitsubishi Electric GX Works3 ICS / OT
  • Critical 9.1
    CVE-2022-29830

    Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z, and …

    Mitsubishi Electric GX Works3 Motion Control Setting(GX Works3 related software) ICS / OT
  • Medium 6.8
    CVE-2022-29829

    Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT D…

    Mitsubishi Electric GX Works3 GT Designer3 Version1 (GOT2000) MT Works2 ICS / OT
  • Medium 6.8
    CVE-2022-29828

    Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A and later allow…

    Mitsubishi Electric GX Works3 ICS / OT
  • Medium 6.8
    CVE-2022-29827

    Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A and later allow…

    Mitsubishi Electric GX Works3 ICS / OT
  • Medium 6.8
    CVE-2022-29826

    Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.087…

    Mitsubishi Electric GX Works3 Motion Control Setting(GX Works3 related software) ICS / OT
  • Medium 5.6
    CVE-2022-29825

    Use of Hard-coded Password vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 …

    Mitsubishi Electric GX Works3 GT Designer3 Version1 (GOT2000) MT Works2 ICS / OT
  • High 8.6
    CVE-2022-25164

    Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095…

    Mitsubishi Electric GX Works3 MX OPC UA Module Configurator-R ICS / OT
  • High 7.5
    CVE-2022-40977

    PILZ: PASvisu and PMI affected by ZipSlip

    A path traversal vulnerability was discovered in Pilz PASvisu Server before 1.12.0. An unauthenticated remote attacker could use a zipped, malicious configuration file to trigger arbitrary file writes ('zip-slip'). File writes do not affect confidentiality or…

    Pilz PASvisu PMI v7xx (266704 + 266707) PMI v5xx (265507 + 265512)
  • Medium 5.5
    CVE-2022-40976

    PILZ: Multiple products affected by ZipSlip

    A path traversal vulnerability was discovered in multiple Pilz products. An unauthenticated local attacker could use a zipped, malicious configuration file to trigger arbitrary file writes ('zip-slip'). File writes do not affect confidentiality or availabilit…

    Pilz PASmotion PNOZmulti Configurator LTS PASconnect
  • Medium 5.3
    CVE-2022-40266

    Denial-of-Service (DoS) Vulnerability in FTP Server Function on GOT2000 Series

    Improper Input Validation vulnerability in Mitsubishi Electric GOT2000 Series GT27 model FTP server versions 01.39.000 and prior, Mitsubishi Electric GOT2000 Series GT25 model FTP server versions 01.39.000 and prior and Mitsubishi Electric GOT2000 Series GT23…

    Mitsubishi Electric GOT2000 Series GT27 model GOT2000 Series GT25 model GOT2000 Series GT23 model ICS / OT
  • Medium 5.5
    CVE-2022-44749

    Opening workflows from untrusted resources may override arbitrary file system contents

    A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Analytics Platform 3.2.0 and above can result in arbitrary files being overwritten on the user's system. This vulnerability is also known as 'Zip-Slip'. An attacker can create…

    KNIME KNIME Analytics Platform
  • High 7.1
    CVE-2022-44748

    Uploading workflows to KNIME Server may override arbitrary file system contents

    A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Server since 4.3.0 can result in arbitrary files being overwritten on the server's file system. This vulnerability is also known as 'Zip-Slip'. An attacker can create a KNIME …

    KNIME KNIME Server
  • Medium 4.3
    CVE-2022-4089

    rickxy Stock Management System processlogin.php cross site scripting

    A vulnerability was found in rickxy Stock Management System. It has been declared as problematic. This vulnerability affects unknown code of the file /pages/processlogin.php. The manipulation of the argument user leads to cross site scripting. The attack can …

    rickxy Stock Management System
  • Medium 4.3
    CVE-2022-4090

    rickxy Stock Management System cross-site request forgery

    A vulnerability was found in rickxy Stock Management System and classified as problematic. This issue affects some unknown processing of the file us_transac.php?action=add. The manipulation leads to cross-site request forgery. The attack may be initiated remo…

    rickxy Stock Management System
  • High 8.6
    CVE-2022-4136

    Exposed Dangerous Method or Function in qmpaas/leadshop

    Dangerous method exposed which can lead to RCE in qmpass/leadshop v1.4.15 allows an attacker to control the target host by calling any function in leadshop.php via the GET method.

    qmpaas qmpaas/leadshop
  • High 7.3
    CVE-2022-4088

    rickxy Stock Management System processlogin.php sql injection

    A vulnerability was found in rickxy Stock Management System and classified as critical. Affected by this issue is some unknown functionality of the file /pages/processlogin.php. The manipulation of the argument user/password leads to sql injection. The attack…

    rickxy Stock Management System
  • High 7.8
    CVE-2022-2650 Public exploit

    Improper Restriction of Excessive Authentication Attempts in wger-project/wger

    Improper Restriction of Excessive Authentication Attempts in GitHub repository wger-project/wger prior to 2.2.

    wger-project wger-project/wger wger PyPI
  • High 7.5
    CVE-2022-26885

    Apache DolphinScheduler config file read by task risk

    When using tasks to read config files, there is a risk of database password disclosure. We recommend you upgrade to version 2.0.6 or higher.

    Apache Software Foundation Apache DolphinScheduler org.apache.dolphinscheduler:dolphinscheduler-common Maven
  • Medium 5.3
    CVE-2021-35246

    Unprotected Transport of Credentials (HSTS) Vulnerability

    The application fails to prevent users from connecting to it over unencrypted connections. An attacker able to modify a legitimate user's network traffic could bypass the application's use of SSL/TLS encryption and use the application as a platform for attack…

    SolarWinds Engineer's Toolset
  • Low —
    GHSA-8jh9-wqpf-q52c

    sweetalert2 v8.19.1 and above contains hidden functionality

    `sweetalert2` versions 8.19.1 and up until 9.0.0 are vulnerable to hidden functionality that was introduced by the maintainer. The package outputs audio and/or video messages that do not pertain to the functionality of the package and is not included in versi…

    sweetalert2 npm
  • Low —
    GHSA-pg98-6v7f-2xfv

    sweetalert2 v9.17.4 and above contains hidden functionality

    `sweetalert2` versions 9.17.4 and up until 10.0.0 are vulnerable to hidden functionality that was introduced by the maintainer. The package outputs audio and/or video messages that do not pertain to the functionality of the package and is not included in vers…

    sweetalert2 npm
  • Low —
    GHSA-457r-cqc8-9vj9

    sweetalert2 v10.16.10 and above contains hidden functionality

    `sweetalert2` versions 10.16.10 and up until 11.0.0 are vulnerable to hidden functionality that was introduced by the maintainer. The package outputs audio and/or video messages that do not pertain to the functionality of the package and is not included in ve…

    sweetalert2 npm
  • Low —
    GHSA-qq6h-5g6j-q3cm

    sweetalert2 v11.4.9 and above contains hidden functionality

    `sweetalert2` versions 11.4.9 and above are vulnerable to hidden functionality that was introduced by the maintainer. The package outputs audio and/or video messages that do not pertain to the functionality of the package and is not included in versions 11.0.…

    sweetalert2 npm
  • High 8.0
    CVE-2022-42896 Public exploit

    Info Leak in l2cap_core in the Linux Kernel

    There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect and l2cap_le_connect_req functions which may allow code execution and leaking kernel memory (respectively) remotely via Bluetooth. A remote attacker coul…

    Linux linux_kernel linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.1
    CVE-2022-42895

    Info Leak in l2cap_core in the Linux Kernel

    There is an infoleak vulnerability in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_parse_conf_req function which can be used to leak kernel pointers remotely. We recommend upgrading past commit  https://github.com/torvalds/linux/commit/b1a2cd50c0357f…

    Linux linux_kernel linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Low 3.1
    CVE-2022-4045

    Authenticated user could send multiple requests containing a parameter which could fetch a large amount of data and can crash a Mattermost server

    A denial-of-service vulnerability in the Mattermost allows an authenticated user to crash the server via multiple requests to one of the API endpoints which could fetch a large amount of data. 

    Mattermost Mattermost github.com/mattermost/mattermost-server Go
  • Medium 4.3
    CVE-2022-4044

    Authenticated user could send multiple requests containing a large Auto Responder Message payload and can crash a Mattermost server

    A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large autoresponder messages.

    Mattermost Mattermost github.com/mattermost/mattermost-server Go
  • Medium 4.3
    CVE-2022-4019

    Authenticated user could send multiple requests containing a large payload to a Playbooks API and can crash a Mattermost server

    A denial-of-service vulnerability in the Mattermost Playbooks plugin allows an authenticated user to crash the server via multiple large requests to one of the Playbooks API endpoints.

    Mattermost Playbooks Plugin
  • Critical 9.8
    CVE-2020-23583 Public exploit

    OPTILINK OP-XT71000N V2.2 is vulnerable to Remote Code Execution. The issue occurs when the attacker sends an arbitrary…

  • Medium 4.3
    CVE-2020-23588 Public exploit

    A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthent…

  • Medium 4.3
    CVE-2020-23586 Public exploit

    A vulnerability found in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an una…

  • Medium 6.5
    CVE-2020-23589 Public exploit

    A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthent…

  • Low 3.1
    CVE-2020-23587 Public exploit

    A vulnerability found in the OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an…

  • High 8.8
    CVE-2020-23592 Public exploit

    A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthent…

  • Critical 9.8
    CVE-2020-23591 Public exploit

    A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an attacker …

  • Medium 6.5
    CVE-2020-23593 Public exploit

    A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2, Firmware Version: OP_V3.3.1-191028 allows an unauthenti…