Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: November 2022

58 records · 14 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2022-3801
    44Plan

    IBAX go-ibax rowsInfo sql injection

    HighCVSS 8.8No exploitEPSS 30%

    ibax · go-ibaxNov 1, 2022

  • CVE-2022-3602
    57Plan

    X.509 Email Address 4-byte Buffer Overflow

    HighCVSS 7.5Proof of conceptEPSS 90%

    openssl · opensslNov 1, 2022

  • CVE-2022-3786
    58Plan

    X.509 Email Address Variable Length Buffer Overflow

    HighCVSS 7.5Proof of conceptEPSS 92%

    openssl · opensslNov 1, 2022

  • CVE-2022-42827
    61This week

    An out-of-bounds write issue was addressed with improved bounds checking.

    HighCVSS 7.8KEVWeaponizedEPSS 1%

    apple · ipadosNov 1, 2022

  • CVE-2022-3654
    42Plan

    Use after free in Layout in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to potentially exploit heap corruption via a craf

    HighCVSS 8.8No exploitEPSS 23%

    google · chromeNov 1, 2022

  • CVE-2022-3723
    67This week

    Type confusion in V8 in Google Chrome prior to 107.0.5304.87 allowed a remote attacker to potentially exploit heap corruption via a crafted

    HighCVSS 8.8KEVWeaponizedEPSS 7%

    google · chromeNov 1, 2022

  • CVE-2022-38380
    24Monitor

    An improper access control [CWE-284] vulnerability in FortiOS version 7.2.0 and versions 7.0.0 through 7.0.7 may allow a remote authenticate

    MediumCVSS 4.3No exploitEPSS 22%

    fortinet · fortiosNov 2, 2022

  • CVE-2022-39379
    52Plan

    Fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration)

    CriticalCVSS 9.8No exploitEPSS 44%

    fluentd · fluentdNov 2, 2022

  • CVE-2022-39323
    50Plan

    SQL Injection on REST API in GLPI

    CriticalCVSS 9.8No exploitEPSS 36%

    glpi-project · glpiNov 3, 2022

  • CVE-2022-43571
    40Plan

    Remote Code Execution through dashboard PDF generation component in Splunk Enterprise

    HighCVSS 8.8WeaponizedEPSS 14%

    splunk · splunkNov 3, 2022

  • CVE-2022-43568
    37Monitor

    Reflected Cross-Site Scripting via the radio template in Splunk Enterprise

    MediumCVSS 6.1No exploitEPSS 42%

    splunk · splunkNov 4, 2022

  • CVE-2022-43945
    37Monitor

    The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer overflow.

    HighCVSS 7.5No exploitEPSS 22%

    linux · linux kernelNov 4, 2022

  • CVE-2022-44792
    42Plan

    handle_ipDefaultTTL in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.8 through 5.9.3 has a NULL Pointer Exception bug that can be used by

    MediumCVSS 6.5No exploitEPSS 52%

    net-snmp · net-snmpNov 6, 2022

  • CVE-2022-44793
    42Plan

    handle_ipv6IpForwarding in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.4.3 through 5.9.3 has a NULL Pointer Exception bug that can be u

    MediumCVSS 6.5No exploitEPSS 53%

    net-snmp · net-snmpNov 6, 2022

  • CVE-2022-31199
    80Now

    Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting both the Netwrix Audito

    CriticalCVSS 9.8KEVWeaponizedEPSS 36%

    netwrix · auditorNov 7, 2022

  • CVE-2022-41049
    60This week

    Windows Mark of the Web Security Feature Bypass Vulnerability

    MediumCVSS 5.4KEVWeaponizedEPSS 2%

    microsoft · windows 10 1507Nov 9, 2022

  • CVE-2022-41073
    62This week

    Windows Print Spooler Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 2%

    microsoft · windows 10 1507Nov 9, 2022

  • CVE-2022-41080
    88Now

    Microsoft Exchange Server Elevation of Privilege Vulnerability

    HighCVSS 8.8KEVWeaponizedEPSS 77%

    microsoft · exchange serverNov 9, 2022

  • CVE-2022-41091
    60This week

    Windows Mark of the Web Security Feature Bypass Vulnerability

    MediumCVSS 5.4KEVWeaponizedEPSS 1%

    microsoft · windows 10 1507Nov 9, 2022

  • CVE-2022-41125
    62This week

    Windows CNG Key Isolation Service Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 3%

    microsoft · windows 10 1507Nov 9, 2022

  • CVE-2022-41128
    72This week

    Windows Scripting Languages Remote Code Execution Vulnerability

    HighCVSS 8.8KEVWeaponizedEPSS 24%

    microsoft · windows 10 1507Nov 9, 2022

  • CVE-2022-3265
    47Plan

    A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prio

    MediumCVSS 5.4No exploitEPSS 86%

    gitlab · gitlabNov 9, 2022

  • CVE-2022-39396
    51Plan

    Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser

    CriticalCVSS 9.8No exploitEPSS 38%

    parseplatform · parse-serverNov 9, 2022

  • CVE-2022-38120
    40Plan

    POWERCOM CO., LTD. UPSMON PRO - Path Traversal

    MediumCVSS 6.5WeaponizedEPSS 6%

    upspowercom · upsmon proNov 10, 2022

  • CVE-2022-38121
    40Plan

    POWERCOM CO., LTD. UPSMON PRO - Insufficiently Protected Credentials

    MediumCVSS 6.5WeaponizedEPSS 3%

    upspowercom · upsmon proNov 10, 2022

  • CVE-2022-44088
    45Plan

    ESPCMS P8.21120101 was discovered to contain a remote code execution (RCE) vulnerability in the component INPUT_ISDESCRIPTION.

    CriticalCVSS 9.8No exploitEPSS 20%

    ecisp · espcmsNov 10, 2022

  • CVE-2022-39393
    34Monitor

    Wasmtime vulnerable to data leakage between instances in the pooling allocator

    HighCVSS 8.6No exploitEPSS 0%

    bytecodealliance · wasmtimeNov 10, 2022

  • CVE-2022-43671
    61This week

    Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection.

    CriticalCVSS 9.8No exploitEPSS 74%

    zohocorp · manageengine access manager plusNov 12, 2022

  • CVE-2022-43672
    59Plan

    Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection (in a diffe

    CriticalCVSS 9.8No exploitEPSS 67%

    zohocorp · manageengine access manager plusNov 12, 2022

  • CVE-2022-40127
    61This week

    Apache Airflow <2.4.0 has an RCE in a bash example

    HighCVSS 8.8Proof of conceptEPSS 85%

    apache · airflowNov 14, 2022

  • CVE-2022-37109
    54Plan

    patrickfuller camp up to and including commit bbd53a256ed70e79bd8758080936afbf6d738767 is vulnerable to Incorrect Access Control.

    CriticalCVSS 9.8Proof of conceptEPSS 49%

    camp project · campNov 14, 2022

  • CVE-2022-40843
    28Monitor

    The Tenda AC1200 V-W15Ev2 V15.11.0.10(1576) router is vulnerable to improper authorization / improper session management that allows the rou

    MediumCVSS 4.9Proof of conceptEPSS 28%

    tenda · w15e firmwareNov 14, 2022

  • CVE-2022-45402
    49Plan

    Apache Airflow: Open redirect during login

    MediumCVSS 6.1No exploitEPSS 81%

    apache · airflowNov 15, 2022

  • CVE-2022-43781
    68This week

    There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center.

    CriticalCVSS 9.8WeaponizedEPSS 98%

    atlassian · bitbucketNov 16, 2022

  • CVE-2022-40881
    48Plan

    SolarView Compact 6.00 was discovered to contain a command injection vulnerability via network_test.php

    CriticalCVSS 9.8Proof of conceptEPSS 30%

    contec · solarview compact firmwareNov 17, 2022

  • CVE-2022-44384
    40Plan

    An arbitrary file upload vulnerability in rconfig v3.9.6 allows attackers to execute arbitrary code via a crafted PHP file.

    HighCVSS 8.8WeaponizedEPSS 5%

    rconfig · rconfigNov 17, 2022

  • CVE-2022-23748
    63This week

    mDNSResponder.exe is vulnerable to DLL Sideloading attack.

    HighCVSS 7.8KEVWeaponizedEPSS 8%

    audinate · dante application libraryNov 17, 2022

  • CVE-2022-42904
    53Plan

    Zoho ManageEngine ADManager Plus through 7151 allows authenticated admin users to execute the commands in proxy settings.

    HighCVSS 7.2No exploitEPSS 83%

    zohocorp · manageengine admanager plusNov 18, 2022

  • CVE-2022-3562
    49Plan

    Cross-site Scripting (XSS) - Stored in librenms/librenms

    MediumCVSS 5.4No exploitEPSS 94%

    librenms · librenmsNov 20, 2022

  • CVE-2022-4067
    49Plan

    Cross-site Scripting (XSS) - Stored in librenms/librenms

    MediumCVSS 5.4No exploitEPSS 93%

    librenms · librenmsNov 20, 2022

  • CVE-2022-4068
    32Monitor

    Improperly Controlled Modification of Dynamically-Determined Object Attributes in librenms/librenms

    MediumCVSS 5.4No exploitEPSS 35%

    librenms · librenmsNov 20, 2022

  • CVE-2022-4069
    47Plan

    Cross-site Scripting (XSS) - Generic in librenms/librenms

    MediumCVSS 4.8No exploitEPSS 93%

    librenms · librenmsNov 20, 2022

  • CVE-2022-40765
    60This week

    A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker wit

    MediumCVSS 6.8KEVWeaponizedEPSS 10%

    mitel · mivoice connectNov 21, 2022

  • CVE-2022-41223
    60This week

    The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injec

    MediumCVSS 6.8KEVWeaponizedEPSS 10%

    mitel · mivoice connectNov 21, 2022

  • CVE-2022-39066
    43Plan

    There is a SQL injection vulnerability in ZTE MF286R.

    HighCVSS 8.8Proof of conceptEPSS 26%

    zte · mf286r firmwareNov 22, 2022

  • CVE-2022-4116
    49Plan

    A vulnerability was found in quarkus.

    CriticalCVSS 9.8No exploitEPSS 32%

    quarkus · quarkusNov 22, 2022

  • CVE-2020-23584
    51Plan

    Unauthenticated remote code execution in OPTILINK OP-XT71000N, Hardware Version: V2.2 occurs when the attacker passes arbitrary commands wit

    CriticalCVSS 9.8Proof of conceptEPSS 41%

    optilinknetwork · op-xt71000n firmwareNov 22, 2022

  • CVE-2022-40770
    52Plan

    Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to authenticated command injection.

    HighCVSS 7.2No exploitEPSS 81%

    zohocorp · manageengine servicedesk plusNov 22, 2022

  • CVE-2022-40303
    42Plan

    An issue was discovered in libxml2 before 2.10.3.

    HighCVSS 7.5No exploitEPSS 41%

    xmlsoft · libxml2Nov 23, 2022

  • CVE-2021-43258
    40Plan

    CartView.php in ChurchInfo 1.3.0 allows attackers to achieve remote code execution through insecure uploads.

    HighCVSS 8.8WeaponizedEPSS 11%

    churchdb · churchinfoNov 23, 2022

  • CVE-2022-4135
    78This week

    Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to p

    CriticalCVSS 9.6KEVWeaponizedEPSS 31%

    google · chromeNov 24, 2022

  • CVE-2022-24999
    35Monitor

    qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express applicat

    HighCVSS 7.5Proof of conceptEPSS 15%

    qs project · qsNov 26, 2022

  • CVE-2022-45933
    55Plan

    KubeView through 0.1.31 allows attackers to obtain control of a Kubernetes cluster because api/scrape/kube-system does not require authentic

    CriticalCVSS 9.8Proof of conceptEPSS 51%

    kubeview project · kubeviewNov 26, 2022

  • CVE-2022-38900
    37Monitor

    decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.

    HighCVSS 7.5No exploitEPSS 23%

    decode-uri-component project · decode-uri-componentNov 28, 2022

  • CVE-2022-40799
    75This week

    Data Integrity Failure in 'Backup Config' in D-Link DNR-322L <= 2.60B15 allows an authenticated attacker to execute OS level commands on the

    HighCVSS 8.8KEVWeaponizedEPSS 33%

    dlink · dnr-322l firmwareNov 29, 2022

  • CVE-2022-44635
    56Plan

    Apache Fineract allowed an authenticated user to perform remote code execution due to path traversal

    HighCVSS 8.8No exploitEPSS 68%

    apache · fineractNov 29, 2022

  • CVE-2022-36964
    40Plan

    SolarWinds Platform Deserialization of Untrusted Data

    HighCVSS 8.8No exploitEPSS 17%

    solarwinds · orion platformNov 29, 2022

  • CVE-2022-4178
    42Plan

    Use after free in Mojo in Google Chrome prior to 108.0.5359.71 allowed a remote attacker who had compromised the renderer process to potenti

    HighCVSS 8.8No exploitEPSS 23%

    google · chromeNov 29, 2022