# CVEs published 2022-10-12

69 CVEs were published on October 12, 2022: 10 critical, 26 high. Days are UTC.

- [CVE-2022-34391](https://cve.now/CVE-2022-34391.md): Dell Client BIOS Versions prior to the remediated version contain an improper input validation vulnerability. (CVSS 7.5, Dell CPG BIOS)
- [CVE-2022-34390](https://cve.now/CVE-2022-34390.md): Dell BIOS contains a use of uninitialized variable vulnerability. (CVSS 7.5, Dell CPG BIOS)
- [CVE-2022-33937](https://cve.now/CVE-2022-33937.md): Dell GeoDrive, Versions 1.0 - 2.2, contain a Path Traversal Vulnerability in the reporting function. (CVSS 7.1, Dell GeoDrive)
- [CVE-2022-33922](https://cve.now/CVE-2022-33922.md): Dell GeoDrive, versions prior to 2.2, contains Insecure File and Folder Permissions vulnerabilities. (CVSS 7.0, Dell GeoDrive)
- [CVE-2022-33921](https://cve.now/CVE-2022-33921.md): Dell GeoDrive, versions prior to 2.2, contains Multiple DLL Hijacking Vulnerabilities. (CVSS 7.0, Dell GeoDrive)
- [CVE-2022-33920](https://cve.now/CVE-2022-33920.md): Dell GeoDrive, versions prior to 2.2, contains an Unquoted File Path vulnerability. (CVSS 7.8, Dell GeoDrive)
- [CVE-2022-33919](https://cve.now/CVE-2022-33919.md): Dell GeoDrive, versions 2.1 - 2.2, contains an information disclosure vulnerability in GUI. (CVSS 7.8, Dell GeoDrive)
- [CVE-2022-33918](https://cve.now/CVE-2022-33918.md): Dell GeoDrive, Versions 2.1 - 2.2, contains an information disclosure vulnerability. (CVSS 5.5, Dell GeoDrive)
- [CVE-2022-32493](https://cve.now/CVE-2022-32493.md): Dell BIOS contains an Stack-Based Buffer Overflow vulnerability. (CVSS 6.0, Dell CPG BIOS)
- [CVE-2022-32491](https://cve.now/CVE-2022-32491.md): Dell Client BIOS contains a Buffer Overflow vulnerability. (CVSS 4.1, Dell CPG BIOS)
- [CVE-2022-32489](https://cve.now/CVE-2022-32489.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 8.2, Dell CPG BIOS)
- [CVE-2022-32488](https://cve.now/CVE-2022-32488.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 8.2, Dell CPG BIOS)
- [CVE-2022-32487](https://cve.now/CVE-2022-32487.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 7.5, Dell CPG BIOS)
- [CVE-2022-32485](https://cve.now/CVE-2022-32485.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 7.5, Dell CPG BIOS)
- [CVE-2022-32484](https://cve.now/CVE-2022-32484.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 5.6, Dell CPG BIOS)
- [CVE-2022-32483](https://cve.now/CVE-2022-32483.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 5.6, Dell CPG BIOS)
- [CVE-2022-31228](https://cve.now/CVE-2022-31228.md): Dell EMC XtremIO versions prior to X2 6.4.0-22 contain a bruteforce vulnerability. (CVSS 8.1, Dell XtremIO)
- [CVE-2022-0030](https://cve.now/CVE-2022-0030.md): PAN-OS: Authentication Bypass in Web Interface (CVSS 8.1, Palo Alto Networks PAN-OS · Palo Alto Networks Cloud NGFW +1)
- [CVE-2018-18446](https://cve.now/CVE-2018-18446.md): dotPDN Paint.NET before 4.1.2 allows Deserialization of Untrusted Data (issue 1 of 2). (CVSS 9.8)
- [CVE-2018-18447](https://cve.now/CVE-2018-18447.md): dotPDN Paint.NET before 4.1.2 allows Deserialization of Untrusted Data (issue 2 of 2). (CVSS 9.8)
- [CVE-2021-36369](https://cve.now/CVE-2021-36369.md): An issue was discovered in Dropbear through 2020.81. (CVSS 7.5)
- [CVE-2022-22077](https://cve.now/CVE-2022-22077.md): Memory corruption in graphics due to use-after-free in graphics dispatcher logic in Snapdragon Mobile (CVSS 8.4, Qualcomm Snapdragon Mobile)
- [CVE-2022-22078](https://cve.now/CVE-2022-22078.md): Denial of service in BOOT when partition size for a particular partition is requested due to integer overflow when blocks are calculated… (CVSS 4.6, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2022-2249](https://cve.now/CVE-2022-2249.md): Avaya Aura Communication Manager Privilege Escalation Vulnerabilities (CVSS 7.7, Avaya Aura Communication Manager)
- [CVE-2022-25660](https://cve.now/CVE-2022-25660.md): Memory corruption due to double free issue in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon… (CVSS 7.8, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2022-25661](https://cve.now/CVE-2022-25661.md): Memory corruption due to untrusted pointer dereference in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT… (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2022-25662](https://cve.now/CVE-2022-25662.md): Information disclosure due to untrusted pointer dereference in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity… (CVSS 5.3, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2022-25663](https://cve.now/CVE-2022-25663.md): Possible buffer overflow due to lack of buffer length check during management frame Rx handling lead to denial of service in Snapdragon… (CVSS 5.5, Qualcomm Snapdragon Compute, Snapdragon Connectivity, Snapd…)
- [CVE-2022-25664](https://cve.now/CVE-2022-25664.md): Information disclosure due to exposure of information while GPU reads the data in Snapdragon Auto, Snapdragon Compute, Snapdragon… (CVSS 6.2, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2022-25665](https://cve.now/CVE-2022-25665.md): Information disclosure due to buffer over read in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Mobile (CVSS 6.8, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2022-2720](https://cve.now/CVE-2022-2720.md): In affected versions of Octopus Server it was identified that when a sensitive value is a substring of another value, sensitive value… (CVSS 5.3, Octopus Deploy Octopus Server)
- [CVE-2022-28887](https://cve.now/CVE-2022-28887.md): Multiple Denial of Service Vulnerability (CVSS 4.3, All F-Secure and WithSecure Endpoint Protection products fo…)
- [CVE-2022-3171](https://cve.now/CVE-2022-3171.md): Memory handling vulnerability in ProtocolBuffers Java core and lite (CVSS 4.3, Google Protocolbuffers · com.google.protobuf:protobuf-ja… +4)
- [CVE-2022-33106](https://cve.now/CVE-2022-33106.md): WiJungle NGFW Version U250 was discovered to be vulnerable to No Rate Limit attack, allowing the attacker to brute force the admin… (CVSS 9.8)
- [CVE-2022-3458](https://cve.now/CVE-2022-3458.md): SourceCodester Human Resource Management System Image File employeeview.php unrestricted upload (CVSS 6.3, SourceCodester Human Resource Management System)
- [CVE-2022-3464](https://cve.now/CVE-2022-3464.md): puppyCMS settings.php cross site scripting (CVSS 4.3, puppyCMS)
- [CVE-2022-3465](https://cve.now/CVE-2022-3465.md): Mediabridge Medialink index.asp improper authentication (CVSS 7.3, Mediabridge Medialink)
- [CVE-2022-3467](https://cve.now/CVE-2022-3467.md): Jiusi OA hntdCustomDesktopActionContent sql injection (CVSS 5.5, Jiusi OA)
- [CVE-2022-3470](https://cve.now/CVE-2022-3470.md): SourceCodester Human Resource Management System getstatecity.php sql injection (CVSS 6.3, SourceCodester Human Resource Management System)
- [CVE-2022-3471](https://cve.now/CVE-2022-3471.md): SourceCodester Human Resource Management System city.php sql injection (CVSS 6.3, SourceCodester Human Resource Management System)
- [CVE-2022-3472](https://cve.now/CVE-2022-3472.md): SourceCodester Human Resource Management System city.php sql injection (CVSS 6.3, SourceCodester Human Resource Management System)
- [CVE-2022-3473](https://cve.now/CVE-2022-3473.md): SourceCodester Human Resource Management System getstatecity.php sql injection (CVSS 6.3, SourceCodester Human Resource Management System)
- [CVE-2022-37601](https://cve.now/CVE-2022-37601.md): Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. (no CVSS, loader-utils)
- [CVE-2022-37611](https://cve.now/CVE-2022-37611.md): Prototype pollution vulnerability in tschaub gh-pages 3.1.0 via the partial variable in util.js. (CVSS 9.8, gh-pages)
- [CVE-2022-37614](https://cve.now/CVE-2022-37614.md): Prototype pollution vulnerability in function enable in mockery.js in mfncooper mockery commit 822f0566fd6d72af8c943ae5ca2aa92e516aa2cf… (CVSS 9.8, mockery)
- [CVE-2022-39282](https://cve.now/CVE-2022-39282.md): RDP client: Read of uninitialized memory with parallel port redirection (CVSS 3.5, FreeRDP)
- [CVE-2022-39283](https://cve.now/CVE-2022-39283.md): FreeRDP may read and display out of bounds data (CVSS 5.9, FreeRDP)
- [CVE-2022-39297](https://cve.now/CVE-2022-39297.md): Deserialization of untrusted data in MelisCms (CVSS 7.7, melisplatform melis-cms · melisplatform/melis-cms)
- [CVE-2022-39298](https://cve.now/CVE-2022-39298.md): Deserialization of untrusted data in MelisFront (CVSS 7.7, melisplatform melis-front · melisplatform/melis-front)
- [CVE-2022-39299](https://cve.now/CVE-2022-39299.md): Signature bypass via multiple root elements in Passport-SAML (CVSS 7.4, node-saml passport-saml · passport-saml +3)
- [CVE-2022-40469](https://cve.now/CVE-2022-40469.md): iKuai OS v3.6.7 was discovered to contain an authenticated remote code execution (RCE) vulnerability. (CVSS 8.8)
- [CVE-2022-40664](https://cve.now/CVE-2022-40664.md): Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher (CVSS 9.8, Apache Software Foundation Apache Shiro · org.apache.shiro:…)
- [CVE-2022-40871](https://cve.now/CVE-2022-40871.md): Dolibarr ERP & CRM \<=15.0.3 is vulnerable to Eval injection. (CVSS 9.8, dolibarr/dolibarr)
- [CVE-2022-41316](https://cve.now/CVE-2022-41316.md): HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the… (CVSS 5.3, github.com/hashicorp/vault)
- [CVE-2022-41348](https://cve.now/CVE-2022-41348.md): An issue was discovered in Zimbra Collaboration (ZCS) 9.0. (CVSS 6.1)
- [CVE-2022-41349](https://cve.now/CVE-2022-41349.md): In Zimbra Collaboration Suite (ZCS) 8.8.15, the URL at /h/compose accepts an attachUrl parameter that is vulnerable to Reflected XSS. (CVSS 6.1)
- [CVE-2022-41350](https://cve.now/CVE-2022-41350.md): In Zimbra Collaboration Suite (ZCS) 8.8.15, /h/search?action=voicemail&action=listen accepts a phone parameter that is vulnerable to… (CVSS 6.1)
- [CVE-2022-41351](https://cve.now/CVE-2022-41351.md): In Zimbra Collaboration Suite (ZCS) 8.8.15, at the URL /h/calendar, one can trigger XSS by adding JavaScript code to the view parameter… (CVSS 6.1)
- [CVE-2022-41403](https://cve.now/CVE-2022-41403.md): OpenCart 3.x Newsletter Custom Popup was discovered to contain a SQL injection vulnerability via the email parameter at… (CVSS 9.8)
- [CVE-2022-42077](https://cve.now/CVE-2022-42077.md): Tenda AC1206 US\_AC1206V1.0RTL\_V15.03.06.23\_multi\_TD01 is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolReboot. (CVSS 6.5)
- [CVE-2022-42078](https://cve.now/CVE-2022-42078.md): Tenda AC1206 US\_AC1206V1.0RTL\_V15.03.06.23\_multi\_TD01 is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolRestoreSet. (CVSS 6.5)
- [CVE-2022-42079](https://cve.now/CVE-2022-42079.md): Tenda AC1206 US\_AC1206V1.0RTL\_V15.03.06.23\_multi\_TD01 was discovered to contain a stack overflow via the function formWifiBasicSet. (CVSS 7.5)
- [CVE-2022-42080](https://cve.now/CVE-2022-42080.md): Tenda AC1206 US\_AC1206V1.0RTL\_V15.03.06.23\_multi\_TD01 was discovered to contain a heap overflow via sched\_start\_time parameter. (CVSS 7.5)
- [CVE-2022-42081](https://cve.now/CVE-2022-42081.md): Tenda AC1206 US\_AC1206V1.0RTL\_V15.03.06.23\_multi\_TD01 was discovered to contain a stack overflow via sched\_end\_time parameter. (CVSS 7.5)
- [CVE-2022-42086](https://cve.now/CVE-2022-42086.md): Tenda AX1803 US\_AX1803v2.0br\_v1.0.0.1\_2994\_CN\_ZGYD01\_4 is vulnerable to Cross Site Request Forgery (CSRF) via function TendaAteMode. (CVSS 6.5)
- [CVE-2022-42087](https://cve.now/CVE-2022-42087.md): Tenda AX1803 US\_AX1803v2.0br\_v1.0.0.1\_2994\_CN\_ZGYD01\_4 is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolReboot. (CVSS 6.5)
- [CVE-2022-42711](https://cve.now/CVE-2022-42711.md): In Progress WhatsUp Gold before 22.1.0, an SNMP MIB Walker application endpoint failed to adequately sanitize malicious input. (CVSS 9.6)
- [CVE-2022-42715](https://cve.now/CVE-2022-42715.md): A reflected XSS vulnerability exists in REDCap before 12.04.18 in the Alerts & Notifications upload feature. (CVSS 6.1)
- [CVE-2022-42897](https://cve.now/CVE-2022-42897.md): Array Networks AG/vxAG with ArrayOS AG before 9.4.0.469 allows unauthenticated command injection that leads to privilege escalation and… (CVSS 9.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2022-10-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.