CVEs published October 3, 2022
49 CVEs were published on October 3, 2022: 2 critical, 5 high. 2 are now in CISA KEV.
- Published
- 49
- Critical
- 2
- High
- 5
- Medium
- 6
- Low
- 0
- Unrated
- 36
- Now in CISA KEV
- 2
- Fix available
- 13
Most affected products
- utodesk® AutoCAD®, Advance Steel and Civil 3D®
- 4
- Frontend File Manager Plugin
- 2
- Microsoft Exchange Server 2013 Cumulative Update · Micro… +1
- 2
- Autodesk desktop app
- 1
- Autodesk Maya
- 1
- Autodesk® Design Review,
- 1
- Autodesk® Design Review, Autodesk® Advance Steel, Autodesk®…
- 1
- CreativeDream file uploader
- 1
- Donation Thermometer
- 1
- DSGVO All in one for WP
- 1
Critical 2
High 5
- CVE-2022-42303An issue was discovered in Veritas NetBackup through 10.0 and related Veritas products.
- CVE-2022-42304An issue was discovered in Veritas NetBackup through 10.0 and related Veritas products.
- CVE-2022-33888A malicious crafted Dwg2Spd file when processed through Autodesk DWG application could lead to memory corruption vulnerability by write acceutodesk® AutoCAD®, Advance Steel and Civil 3D®
- CVE-2022-41040Microsoft Exchange Server Elevation of Privilege VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +1
- CVE-2022-41082Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +1
Medium, low and unrated 42
- CVE-2022-42247pfSense v2.5.2 was discovered to contain a cross-site scripting (XSS) vulnerability in the browser.php component.
- CVE-2022-41443phpipam v1.5.0 was discovered to contain a header injection vulnerability via the component /admin/subnets/ripe-query.php.
- CVE-2022-33882Under certain conditions, an attacker could create an unintended sphere of control through a vulnerability present in file delete operation Autodesk desktop app
- CVE-2022-40721Arbitrary file upload vulnerability in php uploaderCreativeDream file uploader
- CVE-2022-42299An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products.
- CVE-2022-42300An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products.
- CVE-2022-42301An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products.
- CVE-2022-42305An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products.
- CVE-2022-42306An issue was discovered in Veritas NetBackup through 8.2 and related Veritas products.
- CVE-2022-42307An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products.
- CVE-2022-33883A malicious crafted file consumed through Moldflow Synergy, Moldflow Adviser, Moldflow Communicator, and Advanced Material Exchange applicatMoldflow Synergy, Moldflow Adviser, Moldflow Communicator,…
- CVE-2022-33887A maliciously crafted PDF file when parsed through Autodesk AutoCAD 2023 causes an unhandled exception.utodesk® AutoCAD®, Advance Steel and Civil 3D®
- CVE-2022-33885A maliciously crafted X_B, CATIA, and PDF file when parsed through Autodesk AutoCAD 2023 and 2022 can be used to write beyond the allocated utodesk® AutoCAD®, Advance Steel and Civil 3D®
- CVE-2022-33884Parsing a maliciously crafted X_B file can force Autodesk AutoCAD 2023 and 2022 to read beyond allocated boundaries.utodesk® AutoCAD®, Advance Steel and Civil 3D®
- CVE-2022-33889A maliciously crafted GIF or JPEG files when parsed through Autodesk Design Review 2018, and AutoCAD 2023 and 2022 could be used to write beAutodesk® Design Review, Autodesk® Advance Steel, Autodesk®…
- CVE-2022-40764Snyk CLI before 1.996.0 allows arbitrary command execution, affecting Snyk IDE plugins and the snyk npm package.snyk · snyk-go-plugin
- CVE-2022-41430Bento4 v1.6.0-639 was discovered to contain a heap overflow via the AP4_BitReader::ReadBit function in mp4mux.
- CVE-2022-41429Bento4 v1.6.0-639 was discovered to contain a heap overflow via the AP4_Atom::TypeFromString function in mp4tag.
- CVE-2022-41428Bento4 v1.6.0-639 was discovered to contain a heap overflow via the AP4_BitReader::ReadBits function in mp4mux.
- CVE-2022-41427Bento4 v1.6.0-639 was discovered to contain a memory leak in the AP4_AvcFrameParser::Feed function in mp4mux.
- CVE-2022-41426Bento4 v1.6.0-639 was discovered to contain a memory leak via the AP4_AtomFactory::CreateAtomFromStream function in mp4split.
- CVE-2022-41425Bento4 v1.6.0-639 was discovered to contain a segmentation violation via the AP4_Processor::ProcessFragments function in mp4decrypt.
- CVE-2022-41423Bento4 v1.6.0-639 was discovered to contain a segmentation violation in the mp4fragment component.
- CVE-2022-41424Bento4 v1.6.0-639 was discovered to contain a memory leak via the AP4_SttsAtom::Create function in mp42hls.
- CVE-2022-41420nasm v2.16 was discovered to contain a stack overflow in the Ndisasm component
- CVE-2022-41419Bento4 v1.6.0-639 was discovered to contain a memory leak via the AP4_Processor::Process function in the mp4encrypt binary.
- CVE-2022-3132Goolytics - Simple Google Analytics < 1.1.2 - Admin+ Stored Cross-Site ScriptingGoolytics – Simple Google Analytics
- CVE-2022-3128Donation Thermometer < 2.1.3 - Admin+ Stored Cross-Site ScriptingDonation Thermometer
- CVE-2022-3125Frontend File Manager < 21.3 - Subscriber+ Arbitrary File UploadFrontend File Manager Plugin
- CVE-2022-3124Frontend File Manager < 21.3 - Unauthenticated File RenamingFrontend File Manager Plugin
- CVE-2022-2839Zephyr Project Manager < 3.2.55 - Unauthorised AJAX Calls To Stored XSSZephyr Project Manager
- CVE-2022-2763WP Socializer < 7.3 - Admin+ Stored Cross-Site ScriptingWP Socializer – Simple & Easy Social Media Share Icons
- CVE-2022-2628DSGVO All in one for WP < 4.2 - Admin+ Stored Cross-Site ScriptingDSGVO All in one for WP
- CVE-2022-40123mojoPortal v2.7 was discovered to contain a path traversal vulnerability via the "f" parameter at /DesignTools/CssEditor.aspx.
- CVE-2022-40922A vulnerability in the LIEF::MachO::BinaryParser::init_and_parse function of LIEF v0.12.1 allows attackers to cause a denial of service (DOSlief
- CVE-2022-38817Dapr Dashboard v0.1.0 through v0.10.0 is vulnerable to Incorrect Access Control that allows attackers to obtain sensitive data.github.com/dapr/dashboard
- CVE-2022-32173OrchardCore - HTML InjectionOrchardCore
- CVE-2022-40886DedeCMS 5.7.98 has a file upload vulnerability in the background.
- CVE-2022-33886A maliciously crafted MODEL and SLDPRT file can be used to write beyond the allocated buffer while parsing through Autodesk AutoCAD 2023, 20Autodesk Maya
- CVE-2022-33890A maliciously crafted PCT or DWF file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by reAutodesk® Design Review,
- CVE-2022-36551A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.0 and earlier allowslabel-studio
- CVE-2022-41301A maliciously crafted PKT file when consumed through SubassemblyComposer.exe application could lead to memory corruption vulnerability by reSubassembly Composer