# CVEs published 2022-10-07

115 CVEs were published on October 7, 2022: 9 critical, 11 high. Days are UTC.

- [CVE-2022-21936](https://cve.now/CVE-2022-21936.md): Metasys MVE (CVSS 8.1)
- [CVE-2022-41291](https://cve.now/CVE-2022-41291.md): IBM InfoSphere Information Server 11.7 does not invalidate session after logout which could allow an authenticated user to impersonate… (CVSS 6.3, IBM InfoSphere Information Server)
- [CVE-2022-36772](https://cve.now/CVE-2022-36772.md): IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information that should only be available to… (CVSS 4.3, IBM InfoSphere Information Server)
- [CVE-2022-34308](https://cve.now/CVE-2022-34308.md): IBM CICS TX 11.1 could allow a local user to cause a denial of service due to improper load handling. (CVSS 6.2, IBM CICS TX Standard · IBM CICS TX Advanced)
- [CVE-2022-30613](https://cve.now/CVE-2022-30613.md): IBM QRadar SIEM 7.4 and 7.5 could disclose sensitive information via a local service to a privileged user. (CVSS 4.4, IBM QRadar SIEM)
- [CVE-2022-22493](https://cve.now/CVE-2022-22493.md): IBM WebSphere Automation for Cloud Pak for Watson AIOps 1.4.2 is vulnerable to cross-site request forgery, caused by improper cookie… (CVSS 3.5, IBM WebSphere Automation for Cloud Pak for Watson AIOps)
- [CVE-2022-22480](https://cve.now/CVE-2022-22480.md): IBM QRadar SIEM 7.4 and 7.5 data node rebalancing does not function correctly when using encrypted hosts which could result in information… (CVSS 5.3, IBM QRadar SIEM)
- [CVE-2022-33896](https://cve.now/CVE-2022-33896.md): A buffer underflow vulnerability exists in the way Hword of Hancom Office 2020 version 11.0.0.5357 parses XML-based office files. (CVSS 7.8, Hancom Office)
- [CVE-2022-2929](https://cve.now/CVE-2022-2929.md): DHCP memory leak (CVSS 6.5, ISC DHCP)
- [CVE-2022-2928](https://cve.now/CVE-2022-2928.md): An option refcount overflow exists in dhcpd (CVSS 6.5, ISC DHCP)
- [CVE-2020-15855](https://cve.now/CVE-2020-15855.md): Two cross-site scripting vulnerabilities were fixed in Bodhi 5.6.1. (no CVSS, bodhi)
- [CVE-2021-40162](https://cve.now/CVE-2021-40162.md): A maliciously crafted TIF, PICT, TGA, or RLC files in Autodesk Image Processing component may be forced to read beyond allocated… (no CVSS, Revit, Inventor, Infraworks, Navisworks, Fusion, Infrastruc…)
- [CVE-2021-40163](https://cve.now/CVE-2021-40163.md): A Memory Corruption vulnerability may lead to code execution through maliciously crafted DLL files through Autodesk Image Processing… (no CVSS, Revit, Inventor, Infraworks, Navisworks, Fusion, Infrastruc…)
- [CVE-2021-40164](https://cve.now/CVE-2021-40164.md): A heap-based buffer overflow could occur while parsing TIFF, PICT, TGA, or RLC files. (no CVSS, Revit, Inventor, Infraworks, Navisworks, Fusion, Infrastruc…)
- [CVE-2021-40165](https://cve.now/CVE-2021-40165.md): A maliciously crafted TIFF, PICT, TGA, or RLC file in Autodesk Image Processing component may be used to write beyond the allocated buffer… (no CVSS, Revit, Inventor, Infraworks, Navisworks, Fusion, Infrastruc…)
- [CVE-2021-40166](https://cve.now/CVE-2021-40166.md): A maliciously crafted PNG file in Autodesk Image Processing component may be used to attempt to free an object that has already been freed… (no CVSS, Revit, Inventor, Infraworks, Navisworks, Fusion, Infrastruc…)
- [CVE-2022-26452](https://cve.now/CVE-2022-26452.md): In isp, there is a possible use after free due to improper locking. (no CVSS, MediaTek MT6879, MT6895, MT6983)
- [CVE-2022-26471](https://cve.now/CVE-2022-26471.md): In telephony, there is a possible escalation of privilege due to a parcel format mismatch. (no CVSS, MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6781, MT…)
- [CVE-2022-26472](https://cve.now/CVE-2022-26472.md): In ims, there is a possible escalation of privilege due to a parcel format mismatch. (no CVSS, MediaTek MT6739, MT6761, MT6762, MT6763, MT6765, MT6768, MT…)
- [CVE-2022-26473](https://cve.now/CVE-2022-26473.md): In vdec fmt, there is a possible use after free due to improper locking. (no CVSS, MediaTek MT6789, MT6855, MT6879, MT6895, MT6983, MT8168, MT…)
- [CVE-2022-26474](https://cve.now/CVE-2022-26474.md): In sensorhub, there is a possible out of bounds write due to an incorrect calculation of buffer size. (no CVSS, MediaTek MT6789, MT6855, MT6879, MT6895, MT6983)
- [CVE-2022-26475](https://cve.now/CVE-2022-26475.md): In wlan, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT6761, MT6762, MT6765, MT6768, MT6769, MT6779, MT…)
- [CVE-2022-31680](https://cve.now/CVE-2022-31680.md): The vCenter Server contains an unsafe deserialisation vulnerability in the PSC (Platform services controller). (no CVSS, VMware vCenter Server)
- [CVE-2022-31681](https://cve.now/CVE-2022-31681.md): VMware ESXi contains a null-pointer deference vulnerability. (no CVSS, VMware ESXi)
- [CVE-2022-32589](https://cve.now/CVE-2022-32589.md): In Wi-Fi driver, there is a possible way to disconnect Wi-Fi due to an improper resource release. (no CVSS, MediaTek MT6761, MT6762, MT6765, MT6768, MT6779, MT6781, MT…)
- [CVE-2022-32590](https://cve.now/CVE-2022-32590.md): In wlan, there is a possible use after free due to an incorrect status check. (no CVSS, MediaTek MT6761, MT6762, MT6765, MT6768, MT6769, MT6779, MT…)
- [CVE-2022-32591](https://cve.now/CVE-2022-32591.md): In ril, there is a possible system crash due to an incorrect bounds check. (no CVSS, MediaTek MT6580, MT6739, MT6753, MT6757, MT6761, MT6762, MT…)
- [CVE-2022-32592](https://cve.now/CVE-2022-32592.md): In cpu dvfs, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT6855, MT6879, MT6895, MT6983, MT8185, MT8321, MT…)
- [CVE-2022-32593](https://cve.now/CVE-2022-32593.md): In vowe, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT6983)
- [CVE-2022-3275](https://cve.now/CVE-2022-3275.md): Puppetlabs-apt Command Injection (CVSS 8.4, puppetlabs-apt)
- [CVE-2022-3276](https://cve.now/CVE-2022-3276.md): Puppetlabs-mysql Command Injection (CVSS 8.4, puppetlabs-mysql)
- [CVE-2022-3414](https://cve.now/CVE-2022-3414.md): SourceCodester Web-Based Student Clearance System POST Parameter login.php sql injection (CVSS 5.0, SourceCodester Web-Based Student Clearance System)
- [CVE-2022-3422](https://cve.now/CVE-2022-3422.md): Improper Privilege Management in tooljet/tooljet (CVSS 9.8, tooljet/tooljet)
- [CVE-2022-3423](https://cve.now/CVE-2022-3423.md): Allocation of Resources Without Limits or Throttling in nocodb/nocodb (CVSS 7.3, nocodb/nocodb · nocodb)
- [CVE-2022-36634](https://cve.now/CVE-2022-36634.md): An access control issue in ZKTeco ZKBioSecurity V5000 3.0.5\_r allows attackers to arbitrarily create admin users via a crafted HTTP request. (no CVSS)
- [CVE-2022-36635](https://cve.now/CVE-2022-36635.md): ZKteco ZKBioSecurity V5000 4.1.3 was discovered to contain a SQL injection vulnerability via the component /baseOpLog.do. (no CVSS)
- [CVE-2022-36868](https://cve.now/CVE-2022-36868.md): Improper restriction of broadcasting Intent in MouseNKeyHidDevice prior to SMR Oct-2022 Release 1 leaks MAC address of the connected… (CVSS 5.9, Samsung Mobile Devices)
- [CVE-2022-37885](https://cve.now/CVE-2022-37885.md): There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by… (no CVSS, Aruba Access Points; 100 Series; 103 Series; 110 Series; 12…)
- [CVE-2022-37886](https://cve.now/CVE-2022-37886.md): There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by… (no CVSS, Aruba Access Points: 100 Series; 103 Series; 110 Series; 12…)
- [CVE-2022-37887](https://cve.now/CVE-2022-37887.md): There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by… (no CVSS, Aruba Access Points: 100 Series; 103 Series; 110 Series; 12…)
- [CVE-2022-37889](https://cve.now/CVE-2022-37889.md): There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by… (no CVSS, Aruba Access Points: 100 Series; 103 Series; 110 Series; 12…)
- [CVE-2022-37890](https://cve.now/CVE-2022-37890.md): Unauthenticated buffer overflow vulnerabilities exist within the Aruba InstantOS and ArubaOS 10 web management interface. (no CVSS, Aruba Access Points: 100 Series; 103 Series; 110 Series; 12…)
- [CVE-2022-37891](https://cve.now/CVE-2022-37891.md): Unauthenticated buffer overflow vulnerabilities exist within the Aruba InstantOS and ArubaOS 10 web management interface. (no CVSS, Aruba Access Points: 100 Series; 103 Series; 110 Series; 12…)
- [CVE-2022-37892](https://cve.now/CVE-2022-37892.md): A vulnerability in the Aruba InstantOS and ArubaOS 10 web management interface could allow an unauthenticated remote attacker to conduct a… (no CVSS, Aruba Access Points: 100 Series; 103 Series; 110 Series; 12…)
- [CVE-2022-37893](https://cve.now/CVE-2022-37893.md): An authenticated command injection vulnerability exists in the Aruba InstantOS and ArubaOS 10 command line interface. (no CVSS, Aruba Access Points: 100 Series; 103 Series; 110 Series; 12…)
- [CVE-2022-37894](https://cve.now/CVE-2022-37894.md): An unauthenticated Denial of Service (DoS) vulnerability exists in the handling of certain SSID strings by Aruba InstantOS and ArubaOS 10. (no CVSS, Aruba Access Points: 100 Series; 103 Series; 110 Series; 12…)
- [CVE-2022-37895](https://cve.now/CVE-2022-37895.md): An unauthenticated Denial of Service (DoS) vulnerability exists in the handling of certain SSID strings by Aruba InstantOS and ArubaOS 10. (no CVSS, Aruba Access Points: 100 Series; 103 Series; 110 Series; 12…)
- [CVE-2022-37896](https://cve.now/CVE-2022-37896.md): A vulnerability in the Aruba InstantOS and ArubaOS 10 web management interface could allow a remote attacker to conduct a reflected… (no CVSS, Aruba Access Points: 100 Series; 103 Series; 110 Series; 12…)
- [CVE-2022-39285](https://cve.now/CVE-2022-39285.md): Stored Cross-Site Scripting Vulnerability In File Parameter in zoneminder (CVSS 7.6, zoneminder)
- [CVE-2022-39287](https://cve.now/CVE-2022-39287.md): Plaintext transmission of CSRF tokens in tiny-csrf (CVSS 8.1, valexandersaulys tiny-csrf · tiny-csrf)
- [CVE-2022-39289](https://cve.now/CVE-2022-39289.md): Database log access in ZoneMinder (CVSS 9.1, zoneminder)
- [CVE-2022-39290](https://cve.now/CVE-2022-39290.md): CSRF key bypass using HTTP methods in zoneminder (CVSS 8.0, zoneminder)
- [CVE-2022-39291](https://cve.now/CVE-2022-39291.md): Denial of service through logs in zoneminder (CVSS 5.4, zoneminder)
- [CVE-2022-39847](https://cve.now/CVE-2022-39847.md): Use after free vulnerability in set\_nft\_pid and signal\_handler function of NFC driver prior to SMR Oct-2022 Release 1 allows attackers to… (CVSS 4.9, Samsung Mobile Devices)
- [CVE-2022-39848](https://cve.now/CVE-2022-39848.md): Exposure of sensitive information in AT\_Distributor prior to SMR Oct-2022 Release 1 allows local attacker to access SerialNo via log. (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2022-39849](https://cve.now/CVE-2022-39849.md): Improper access control in knox\_vpn\_policy service prior to SMR Oct-2022 Release 1 allows allows unauthorized read of configuration data. (no CVSS, Samsung Mobile Devices)
- [CVE-2022-39850](https://cve.now/CVE-2022-39850.md): Improper access control in mum\_container\_policy service prior to SMR Oct-2022 Release 1 allows allows unauthorized read of configuration… (no CVSS, Samsung Mobile Devices)
- [CVE-2022-39851](https://cve.now/CVE-2022-39851.md): Improper access control vulnerability in CocktailBarService prior to SMR Oct-2022 Release 1 allows local attacker to bind service that… (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2022-39852](https://cve.now/CVE-2022-39852.md): A heap-based overflow vulnerability in makeContactAGIF in libagifencoder.quram.so library prior to SMR Oct-2022 Release 1 allows attacker… (CVSS 8.0, Samsung Mobile Devices)
- [CVE-2022-39853](https://cve.now/CVE-2022-39853.md): A use after free vulnerability in perf-mgr driver prior to SMR Oct-2022 Release 1 allows attacker to cause memory access fault. (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2022-39854](https://cve.now/CVE-2022-39854.md): Improper protection in IOMMU prior to SMR Oct-2022 Release 1 allows unauthorized access to secure memory. (CVSS 6.4, Samsung Mobile Devices)
- [CVE-2022-39855](https://cve.now/CVE-2022-39855.md): Improper access control vulnerability in FACM application prior to SMR Oct-2022 Release 1 allows a local attacker to connect arbitrary AP… (CVSS 5.1, Samsung Mobile Devices)
- [CVE-2022-39856](https://cve.now/CVE-2022-39856.md): Improper access control vulnerability in imsservice application prior to SMR Oct-2022 Release 1 allows local attackers to access call… (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2022-39857](https://cve.now/CVE-2022-39857.md): Improper access control vulnerability in CameraTestActivity in FactoryCameraFB prior to version 3.5.51 allows attackers to access… (CVSS 7.3, Samsung Mobile FactoryCameraFB)
- [CVE-2022-39858](https://cve.now/CVE-2022-39858.md): Path traversal vulnerability in AtBroadcastReceiver in FactoryCamera prior to version 3.5.51 allows attackers to write arbitrary file as… (CVSS 7.3, Samsung Mobile FactoryCamera)
- [CVE-2022-39859](https://cve.now/CVE-2022-39859.md): Implicit intent hijacking vulnerability in UPHelper library prior to version 3.0.12 allows attackers to access sensitive information via… (CVSS 4.0, Samsung Mobile UPHelper)
- [CVE-2022-39860](https://cve.now/CVE-2022-39860.md): Improper access control vulnerability in QuickShare prior to version 13.2.3.5 allows attackers to access sensitive information via… (CVSS 4.4, Samsung Mobile QuickShare)
- [CVE-2022-39861](https://cve.now/CVE-2022-39861.md): Unprotected Receiver in AtBroadcastReceiver in FactoryCamera prior to version 3.5.51 allows attackers to record video without camera… (CVSS 5.9, Samsung Mobile FactoryCamera)
- [CVE-2022-39862](https://cve.now/CVE-2022-39862.md): Improper authorization in Dynamic Lockscreen prior to SMR Sep-2022 Release 1 in Android R(11) and 3.3.03.66 in Android S(12) allows… (CVSS 5.3, Samsung Mobile Devices)
- [CVE-2022-39863](https://cve.now/CVE-2022-39863.md): Intent redirection vulnerability in Samsung Account prior to version 13.5.01.3 allows attackers to access content providers without… (CVSS 3.6, Samsung Mobile Samsung Account)
- [CVE-2022-39864](https://cve.now/CVE-2022-39864.md): Improper access control vulnerability in WifiSetupLaunchHelper in SmartThings prior to version 1.7.89.25 allows attackers to access… (CVSS 3.3, Samsung Mobile SmartThings)
- [CVE-2022-39865](https://cve.now/CVE-2022-39865.md): Improper access control vulnerability in ContentsSharingActivity.java SmartThings prior to version 1.7.89.0 allows attackers to access… (CVSS 4.0, Samsung Mobile SmartThings)
- [CVE-2022-39866](https://cve.now/CVE-2022-39866.md): Improper access control vulnerability in RegisteredEventMediator.kt SmartThings prior to version 1.7.89.0 allows attackers to access… (CVSS 4.0, Samsung Mobile SmartThings)
- [CVE-2022-39867](https://cve.now/CVE-2022-39867.md): Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access… (CVSS 4.0, Samsung Mobile SmartThings)
- [CVE-2022-39868](https://cve.now/CVE-2022-39868.md): Improper access control vulnerability in GedSamsungAccount.kt SmartThings prior to version 1.7.89.0 allows attackers to access sensitive… (CVSS 4.0, Samsung Mobile SmartThings)
- [CVE-2022-39869](https://cve.now/CVE-2022-39869.md): Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access… (CVSS 4.0, Samsung Mobile SmartThings)
- [CVE-2022-39870](https://cve.now/CVE-2022-39870.md): Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access… (CVSS 4.0, Samsung Mobile SmartThings)
- [CVE-2022-39871](https://cve.now/CVE-2022-39871.md): Improper access control vulnerability cloudNotificationManager.java in SmartThings prior to version 1.7.89.0 allows attackers to access… (CVSS 4.0, Samsung Mobile SmartThings)
- [CVE-2022-39872](https://cve.now/CVE-2022-39872.md): Improper restriction of broadcasting Intent in ShareLive prior to version 13.2.03.5 leaks MAC address of the connected Bluetooth device. (CVSS 5.9, Samsung Mobile ShareLive)
- [CVE-2022-39873](https://cve.now/CVE-2022-39873.md): Improper authorization vulnerability in Samsung Internet prior to version 18.0.4.14 allows physical attackers to add bookmarks in secret… (CVSS 4.3, Samsung Mobile Samsung Internet)
- [CVE-2022-39874](https://cve.now/CVE-2022-39874.md): Sensitive log information leakage vulnerability in Samsung Account prior to version 13.5.0 allows attackers to unauthorized logout. (CVSS 4.0, Samsung Mobile Samsung Account)
- [CVE-2022-39875](https://cve.now/CVE-2022-39875.md): Improper component protection vulnerability in Samsung Account prior to version 13.5.0 allows attackers to unauthorized logout. (CVSS 5.1, Samsung Mobile Samsung Account)
- [CVE-2022-39876](https://cve.now/CVE-2022-39876.md): Insertion of Sensitive Information into Log in PushRegIdUpdateClient of SReminder prior to 8.2.01.13 allows attacker to access device IMEI. (CVSS 5.9, Samsung Mobile Reminder)
- [CVE-2022-39877](https://cve.now/CVE-2022-39877.md): Improper access control vulnerability in ProfileSharingAccount in Group Sharing prior to versions 13.0.6.15 in Android S(12), 13.0.6.14 in… (CVSS 4.0, Samsung Mobile Group Sharing)
- [CVE-2022-39878](https://cve.now/CVE-2022-39878.md): Improper access control vulnerability in Samsung Checkout prior to version 5.0.55.3 allows attackers to access sensitive information via… (CVSS 4.0, Samsung Mobile Samsung Checkout)
- [CVE-2022-39959](https://cve.now/CVE-2022-39959.md): Panini Everest Engine 2.0.4 allows unprivileged users to create a file named Everest.exe in the %PROGRAMDATA%\\Panini folder. (no CVSS)
- [CVE-2022-40824](https://cve.now/CVE-2022-40824.md): B.C. (CVSS 9.8)
- [CVE-2022-40825](https://cve.now/CVE-2022-40825.md): B.C. (no CVSS)
- [CVE-2022-40826](https://cve.now/CVE-2022-40826.md): B.C. (CVSS 9.8)
- [CVE-2022-40827](https://cve.now/CVE-2022-40827.md): B.C. (CVSS 9.8)
- [CVE-2022-40828](https://cve.now/CVE-2022-40828.md): B.C. (CVSS 9.8)
- [CVE-2022-40829](https://cve.now/CVE-2022-40829.md): B.C. (CVSS 9.8)
- [CVE-2022-40830](https://cve.now/CVE-2022-40830.md): B.C. (CVSS 9.8)
- [CVE-2022-40831](https://cve.now/CVE-2022-40831.md): B.C. (no CVSS)
- [CVE-2022-40832](https://cve.now/CVE-2022-40832.md): B.C. (no CVSS)
- [CVE-2022-40833](https://cve.now/CVE-2022-40833.md): B.C. (no CVSS)
- [CVE-2022-40834](https://cve.now/CVE-2022-40834.md): B.C. (no CVSS)
- [CVE-2022-40835](https://cve.now/CVE-2022-40835.md): B.C. (no CVSS)
- [CVE-2022-40872](https://cve.now/CVE-2022-40872.md): An SQL injection vulnerability issue was discovered in Sourcecodester Simple E-Learning System 1.0., in /vcs/classRoom.php?classCode=… (CVSS 9.8)
- [CVE-2022-41377](https://cve.now/CVE-2022-41377.md): Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at… (no CVSS)
- [CVE-2022-41378](https://cve.now/CVE-2022-41378.md): Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at… (no CVSS)
- [CVE-2022-41379](https://cve.now/CVE-2022-41379.md): An arbitrary file upload vulnerability in the component /leave\_system/classes/Users.php?f=save of Online Leave Management System v1.0… (no CVSS)
- [CVE-2022-41392](https://cve.now/CVE-2022-41392.md): A cross-site scripting (XSS) vulnerability in TotalJS commit 8c2c8909 allows attackers to execute arbitrary web scripts or HTML via a… (no CVSS)
- [CVE-2022-41414](https://cve.now/CVE-2022-41414.md): An insecure default in the component auth.login.prompt.enabled of Liferay Portal v7.0.0 through v7.4.2 allows attackers to enumerate… (no CVSS, com.liferay.portal:release.portal.bom · com.liferay.portal:…)
- [CVE-2022-41442](https://cve.now/CVE-2022-41442.md): PicUploader v2.6.3 was discovered to contain cross-site scripting (XSS) vulnerability via the setStorageParams function in… (no CVSS)
- [CVE-2022-41512](https://cve.now/CVE-2022-41512.md): An arbitrary file upload vulnerability in the component /php\_action/editFile.php of Online Diagnostic Lab Management System v1.0 allows… (no CVSS)
- [CVE-2022-41513](https://cve.now/CVE-2022-41513.md): Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at… (no CVSS)
- [CVE-2022-41514](https://cve.now/CVE-2022-41514.md): Open Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at… (no CVSS)
- [CVE-2022-41515](https://cve.now/CVE-2022-41515.md): Open Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at… (no CVSS)
- [CVE-2022-41574](https://cve.now/CVE-2022-41574.md): An access-control vulnerability in Gradle Enterprise 2022.4 through 2022.3.1 allows remote attackers to prevent backups from occurring… (no CVSS)
- [CVE-2022-41672](https://cve.now/CVE-2022-41672.md): Session still functional after user is deactivated (no CVSS, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2022-42073](https://cve.now/CVE-2022-42073.md): Online Diagnostic Lab Management System v1.0 is vulnerable to SQL Injection via /diagnostic/editclient.php?id=. (no CVSS)
- [CVE-2022-42074](https://cve.now/CVE-2022-42074.md): Online Diagnostic Lab Management System v1.0 is vulnerable to SQL Injection via /diagnostic/editcategory.php?id=. (no CVSS)
- [CVE-2022-42075](https://cve.now/CVE-2022-42075.md): Wedding Planner v1.0 is vulnerable to arbitrary code execution. (no CVSS)
- [CVE-2022-42092](https://cve.now/CVE-2022-42092.md): Backdrop CMS 1.22.0 has Unrestricted File Upload vulnerability via 'themes' that allows attackers to Remote Code Execution. (no CVSS, backdrop/backdrop)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2022-10-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.