Lista CVE - 2022 / Novembre
Visualizzazione 1101 - 1200 di 2020 CVE per Novembre 2022 (Pagina 12 di 21)
| ID CVE | Data | Titolo |
|---|---|---|
| CVE-2022-43279 | 2022-11-15 | LimeSurvey before v5.0.4 was discovered to contain a SQL injection vulnerability via the component /application/views/themeOptions/update.php. |
| CVE-2022-45379 | 2022-11-15 | Jenkins Script Security Plugin 1189.vb_a_b_7c8fd5fde and earlier stores whole-script approvals as the SHA-1 hash of the script, making it vulnerable to collision attacks. |
| CVE-2021-4240 | 2022-11-15 | phpservermon User.php generatePasswordResetToken predictable algorithm in random number generator |
| CVE-2021-4241 | 2022-11-15 | phpservermon User.php setUserLoggedIn predictable algorithm in random number generator |
| CVE-2022-25667 | 2022-11-15 | Information disclosure in kernel due to improper handling of ICMP requests in Snapdragon Wired Infrastructure and Networking |
| CVE-2022-25671 | 2022-11-15 | Denial of service in MODEM due to reachable assertion in Snapdragon Mobile |
| CVE-2022-25674 | 2022-11-15 | Cryptographic issues in WLAN during the group key handshake of the WPA/WPA2 protocol in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music |
| CVE-2022-25676 | 2022-11-15 | Information disclosure in video due to buffer over-read while parsing avi files in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables |
| CVE-2022-25679 | 2022-11-15 | Denial of service in video due to improper access control in broadcast receivers in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables |
| CVE-2022-25710 | 2022-11-15 | Denial of service due to null pointer dereference when GATT is disconnected in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music |
| CVE-2022-25724 | 2022-11-15 | Memory corruption in graphics due to buffer overflow while validating the user address in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice... |
| CVE-2022-25727 | 2022-11-15 | Memory Corruption in modem due to improper length check while copying into memory in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music |
| CVE-2022-25741 | 2022-11-15 | Denial of service in WLAN due to potential null pointer dereference while accessing the memory location in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon... |
| CVE-2022-25742 | 2022-11-15 | Denial of service in modem due to infinite loop while parsing IGMPv2 packet from server in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music |
| CVE-2022-25743 | 2022-11-15 | Memory corruption in graphics due to use-after-free while importing graphics buffer in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music,... |
| CVE-2022-29275 | 2022-11-15 | In UsbCoreDxe, untrusted input may allow SMRAM or OS memory tampering Use of untrusted pointers could allow OS or SMRAM memory tampering leading to escalation of privileges. This issue was... |
| CVE-2022-29276 | 2022-11-15 | SMI functions in AhciBusDxe use untrusted inputs leading to corruption of SMRAM. SMI functions in AhciBusDxe use untrusted inputs leading to corruption of SMRAM. This issue was discovered by Insyde... |
| CVE-2022-29277 | 2022-11-15 | Incorrect pointer checks within the the FwBlockServiceSmm driver can allow arbitrary RAM modifications During review of the FwBlockServiceSmm driver, certain instances of SpiAccessLib could be tricked into writing 0xff to... |
| CVE-2022-29278 | 2022-11-15 | Incorrect pointer checks within the NvmExpressDxe driver can allow tampering with SMRAM and OS memory Incorrect pointer checks within the NvmExpressDxe driver can allow tampering with SMRAM and OS memory.... |
| CVE-2022-29279 | 2022-11-15 | Use of a untrusted pointer allows tampering with SMRAM and OS memory in SdHostDriver and SdMmcDevice Use of a untrusted pointer allows tampering with SMRAM and OS memory in SdHostDriver... |
| CVE-2022-30283 | 2022-11-15 | In UsbCoreDxe, tampering with the contents of the USB working buffer using DMA while certain USB transactions are in process leads to a TOCTOU problem that could be used by... |
| CVE-2022-30768 | 2022-11-15 | A Stored Cross Site Scripting (XSS) issue in ZoneMinder 1.36.12 allows an attacker to execute HTML or JavaScript code via the Username field when an Admin (or non-Admin users that... |
| CVE-2022-30769 | 2022-11-15 | Session fixation exists in ZoneMinder through 1.36.12 as an attacker can poison a session cookie to the next logged-in user. |
| CVE-2022-30771 | 2022-11-15 | Initialization function in PnpSmm could lead to SMRAM corruption when using subsequent PNP SMI functions Initialization function in PnpSmm could lead to SMRAM corruption when using subsequent PNP SMI functions.... |
| CVE-2022-30772 | 2022-11-15 | Manipulation of the input address in PnpSmm function 0x52 could be used by malware to overwrite SMRAM or OS kernel memory. Function 0x52 of the PnpSmm driver is passed the... |
| CVE-2022-33234 | 2022-11-15 | Memory corruption in video due to configuration weakness. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables |
| CVE-2022-33236 | 2022-11-15 | Transient DOS due to buffer over-read in WLAN firmware while parsing cipher suite info attributes. in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking |
| CVE-2022-33237 | 2022-11-15 | Transient DOS due to buffer over-read in WLAN firmware while processing PPE threshold. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT,... |
| CVE-2022-33239 | 2022-11-15 | Transient DOS due to loop with unreachable exit condition in WLAN firmware while parsing IPV6 extension header. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer... |
| CVE-2022-38201 | 2022-11-15 | An unvalidated redirect vulnerability exists in Esri ArcGIS Quick Capture Web Designer versions 10.8.1 to 10.9.1. |
| CVE-2022-38666 | 2022-11-15 | Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.146 and earlier unconditionally disables SSL/TLS certificate and hostname validation for several features. |
| CVE-2022-3997 | 2022-11-15 | MonikaBrzica scm upis_u_bazu.php sql injection |
| CVE-2022-3998 | 2022-11-15 | MonikaBrzica scm uredi_korisnika.php sql injection |
| CVE-2022-4006 | 2022-11-15 | WBCE CMS Header class.login.php increase_attempts excessive authentication |
| CVE-2022-40308 | 2022-11-15 | Apache Archiva prior to 2.2.9 may allow the anonymous user to read arbitrary files |
| CVE-2022-40309 | 2022-11-15 | Apache Archiva prior to 2.2.9 allows an authenticated user to delete arbitrary directories |
| CVE-2022-40844 | 2022-11-15 | In Tenda (Shenzhen Tenda Technology Co., Ltd) AC1200 Router model W15Ev2 V15.11.0.10(1576), a Stored Cross Site Scripting (XSS) issue exists allowing an attacker to execute JavaScript code via the applications... |
| CVE-2022-40845 | 2022-11-15 | The Tenda AC1200 Router model W15Ev2 V15.11.0.10(1576) is affected by a password exposure vulnerability. When combined with the improper authorization/improper session management vulnerability, an attacker with access to the router... |
| CVE-2022-40846 | 2022-11-15 | In Tenda AC1200 Router model W15Ev2 V15.11.0.10(1576), a Stored Cross Site Scripting (XSS) vulnerability exists allowing an attacker to execute JavaScript code via the applications stored hostname. |
| CVE-2022-40847 | 2022-11-15 | In Tenda AC1200 Router model W15Ev2 V15.11.0.10(1576), there exists a command injection vulnerability in the function formSetFixTools. This vulnerability allows attackers to run arbitrary commands on the server via the... |
| CVE-2022-41395 | 2022-11-15 | Tenda AC1200 Router Model W15Ev2 V15.11.0.10(1576) was discovered to contain a command injection vulnerability via the dmzHost parameter in the setDMZ function. |
| CVE-2022-41396 | 2022-11-15 | Tenda AC1200 Router Model W15Ev2 V15.11.0.10(1576) was discovered to contain multiple command injection vulnerabilities in the function setIPsecTunnelList via the IPsecLocalNet and IPsecRemoteNet parameters. |
| CVE-2022-41916 | 2022-11-15 | Read one byte past a buffer when normalizing Unicode |
| CVE-2022-41917 | 2022-11-15 | Incorrect Error Handling Allowed Partial File Reads Over REST API in OpenSearch |
| CVE-2022-41918 | 2022-11-15 | Issue with fine-grained access control of indices backing data streams |
| CVE-2022-42053 | 2022-11-15 | Tenda AC1200 Router Model W15Ev2 V15.11.0.10(1576) was discovered to contain a command injection vulnerability via the PortMappingServer parameter in the setPortMapping function. |
| CVE-2022-42058 | 2022-11-15 | Tenda AC1200 Router Model W15Ev2 V15.11.0.10(1576) was discovered to contain a stack overflow via the setRemoteWebManage function. This vulnerability allows attackers to cause a Denial of Service (DoS) via crafted... |
| CVE-2022-42060 | 2022-11-15 | Tenda AC1200 Router Model W15Ev2 V15.11.0.10(1576) was discovered to contain a stack overflow via the setWanPpoe function. This vulnerability allows attackers to cause a Denial of Service (DoS) via crafted... |
| CVE-2022-42118 | 2022-11-15 | A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and... |
| CVE-2022-42119 | 2022-11-15 | Certain Liferay products are vulnerable to Cross Site Scripting (XSS) via the Commerce module. This affects Liferay Portal 7.3.5 through 7.4.2 and Liferay DXP 7.3 before update 8. |
| CVE-2022-42120 | 2022-11-15 | A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through 7.4.3.16, and Liferay DXP 7.3 before update 4, and 7.4 before update 17 allows attackers to execute... |
| CVE-2022-42121 | 2022-11-15 | A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before service... |
| CVE-2022-42122 | 2022-11-15 | A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and Liferay DXP 7.3 fix pack 2 through update 4 allows attackers to execute arbitrary SQL commands... |
| CVE-2022-42123 | 2022-11-15 | A Zip slip vulnerability in the Elasticsearch Connector in Liferay Portal 7.3.3 through 7.4.3.18, and Liferay DXP 7.3 before update 6, and 7.4 before update 19 allows attackers to create... |
| CVE-2022-42124 | 2022-11-15 | ReDoS vulnerability in LayoutPageTemplateEntryUpgradeProcess in Liferay Portal 7.3.2 through 7.4.3.4 and Liferay DXP 7.2 fix pack 9 through fix pack 18, 7.3 before update 4, and DXP 7.4 GA allows... |
| CVE-2022-42125 | 2022-11-15 | Zip slip vulnerability in FileUtil.unzip in Liferay Portal 7.4.3.5 through 7.4.3.35 and Liferay DXP 7.4 update 1 through update 34 allows attackers to create or overwrite existing files on the... |
| CVE-2022-42126 | 2022-11-15 | The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does not properly check permissions of asset... |
| CVE-2022-42127 | 2022-11-15 | The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36, and Liferay DXP 7.4 update 1 though 36 does not properly check user permissions, which allows remote attackers to obtain... |
| CVE-2022-42128 | 2022-11-15 | The Hypermedia REST APIs module in Liferay Portal 7.4.1 through 7.4.3.4, and Liferay DXP 7.4 GA does not properly check permissions, which allows remote attackers to obtain a WikiNode object... |
| CVE-2022-42129 | 2022-11-15 | An Insecure direct object reference (IDOR) vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and Liferay DXP 7.3 before update 4, and 7.4 GA allows... |
| CVE-2022-42130 | 2022-11-15 | The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 19, 7.3 before update 4, and 7.4... |
| CVE-2022-42131 | 2022-11-15 | Certain Liferay products are affected by: Missing SSL Certificate Validation in the Dynamic Data Mapping module's REST data providers. This affects Liferay Portal 7.1.0 through 7.4.2 and Liferay DXP 7.1... |
| CVE-2022-42132 | 2022-11-15 | The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix pack 27, 7.2 before fix pack 17,... |
| CVE-2022-42977 | 2022-11-15 | The Netic User Export add-on before 1.3.5 for Atlassian Confluence has the functionality to generate a list of users in the application, and export it. During export, the HTTP request... |
| CVE-2022-42978 | 2022-11-15 | In the Netic User Export add-on before 1.3.5 for Atlassian Confluence, authorization is mishandled. An unauthenticated attacker could access files on the remote system. |
| CVE-2022-43071 | 2022-11-15 | A stack overflow in the Catalog::readPageLabelTree2(Object*) function of XPDF v4.04 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file. |
| CVE-2022-43265 | 2022-11-15 | An arbitrary file upload vulnerability in the component /pages/save_user.php of Canteen Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file. |
| CVE-2022-45380 | 2022-11-15 | Jenkins JUnit Plugin 1159.v0b_396e1e07dd and earlier converts HTTP(S) URLs in test report output to clickable links in an unsafe manner, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by... |
| CVE-2022-45381 | 2022-11-15 | Jenkins Pipeline Utility Steps Plugin 2.13.1 and earlier does not restrict the set of enabled prefix interpolators and bundles versions of Apache Commons Configuration library that enable the 'file:' prefix... |
| CVE-2022-45382 | 2022-11-15 | Jenkins Naginator Plugin 1.18.1 and earlier does not escape display names of source builds in builds that were triggered via Retry action, resulting in a stored cross-site scripting (XSS) vulnerability... |
| CVE-2022-45383 | 2022-11-15 | An incorrect permission check in Jenkins Support Core Plugin 1206.v14049fa_b_d860 and earlier allows attackers with Support/DownloadBundle permission to download a previously created support bundle containing information limited to users with... |
| CVE-2022-45384 | 2022-11-15 | Jenkins Reverse Proxy Auth Plugin 1.7.3 and earlier stores the LDAP manager password unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by attackers... |
| CVE-2022-45385 | 2022-11-15 | A missing permission check in Jenkins CloudBees Docker Hub/Registry Notification Plugin 2.6.2 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository. |
| CVE-2022-45386 | 2022-11-15 | Jenkins Violations Plugin 0.7.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2022-45387 | 2022-11-15 | Jenkins BART Plugin 1.0.3 and earlier does not escape the parsed content of build logs before rendering it on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability. |
| CVE-2022-45388 | 2022-11-15 | Jenkins Config Rotator Plugin 2.0.1 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing unauthenticated attackers to read arbitrary files with '.xml' extension on... |
| CVE-2022-45389 | 2022-11-15 | A missing permission check in Jenkins XP-Dev Plugin 1.0 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to an attacker-specified repository. |
| CVE-2022-45390 | 2022-11-15 | A missing permission check in Jenkins loader.io Plugin 1.0.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. |
| CVE-2022-45391 | 2022-11-15 | Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier globally and unconditionally disables SSL/TLS certificate and hostname validation for the entire Jenkins controller JVM. |
| CVE-2022-45392 | 2022-11-15 | Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by attackers with Extended Read... |
| CVE-2022-45393 | 2022-11-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins Delete log Plugin 1.0 and earlier allows attackers to delete build logs. |
| CVE-2022-45394 | 2022-11-15 | A missing permission check in Jenkins Delete log Plugin 1.0 and earlier allows attackers with Item/Read permission to delete build logs. |
| CVE-2022-45395 | 2022-11-15 | Jenkins CCCC Plugin 0.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2022-45396 | 2022-11-15 | Jenkins SourceMonitor Plugin 0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2022-45397 | 2022-11-15 | Jenkins OSF Builder Suite : : XML Linter Plugin 1.0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2022-45398 | 2022-11-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins Cluster Statistics Plugin 0.4.6 and earlier allows attackers to delete recorded Jenkins Cluster Statistics. |
| CVE-2022-45399 | 2022-11-15 | A missing permission check in Jenkins Cluster Statistics Plugin 0.4.6 and earlier allows attackers to delete recorded Jenkins Cluster Statistics. |
| CVE-2022-45400 | 2022-11-15 | Jenkins JAPEX Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
| CVE-2022-45401 | 2022-11-15 | Jenkins Associated Files Plugin 0.2.1 and earlier does not escape names of associated files, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-45402 | 2022-11-15 | Apache Airflow: Open redirect during login |
| CVE-2022-3480 | 2022-11-15 | Denial-of-Service vulnerability in PHOENIX CONTACT mGuard product family |
| CVE-2022-3737 | 2022-11-15 | Out-of-bounds Read in PHOENIX CONTACT Automationworx Software Suite |
| CVE-2022-3461 | 2022-11-15 | Buffer Overflow in PHOENIX CONTACT Automationworx Software Suite |
| CVE-2022-3240 | 2022-11-15 | The "Follow Me Plugin" plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1.1. This is due to missing nonce validation on the FollowMeIgniteSocialMedia_options_page()... |
| CVE-2022-3893 | 2022-11-15 | Potential XSS on custom menu navigation |
| CVE-2022-3895 | 2022-11-15 | Potential XSS in common user interface component library |
| CVE-2022-3958 | 2022-11-15 | Potential XSS on personal menu navigation |
| CVE-2022-41611 | 2022-11-15 | Potential XSS on sidebar navigation |
| CVE-2022-41789 | 2022-11-15 | Potential XSS on default page header |
| CVE-2022-41814 | 2022-11-15 | Potential XSS in history view |