# CVEs published 2022-10-03

49 CVEs were published on October 3, 2022: 2 critical, 5 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2022-42247](https://cve.now/CVE-2022-42247.md): pfSense v2.5.2 was discovered to contain a cross-site scripting (XSS) vulnerability in the browser.php component. (no CVSS)
- [CVE-2022-41443](https://cve.now/CVE-2022-41443.md): phpipam v1.5.0 was discovered to contain a header injection vulnerability via the component /admin/subnets/ripe-query.php. (no CVSS)
- [CVE-2022-33882](https://cve.now/CVE-2022-33882.md): Under certain conditions, an attacker could create an unintended sphere of control through a vulnerability present in file delete operation (no CVSS, Autodesk desktop app)
- [CVE-2022-40721](https://cve.now/CVE-2022-40721.md): Arbitrary file upload vulnerability in php uploader (no CVSS, CreativeDream file uploader)
- [CVE-2022-42299](https://cve.now/CVE-2022-42299.md): An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. (CVSS 5.3)
- [CVE-2022-42300](https://cve.now/CVE-2022-42300.md): An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. (CVSS 4.3)
- [CVE-2022-42301](https://cve.now/CVE-2022-42301.md): An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. (CVSS 5.4)
- [CVE-2022-42302](https://cve.now/CVE-2022-42302.md): An issue was discovered in Veritas NetBackup through 10.0 and related Veritas products. (CVSS 9.0)
- [CVE-2022-42303](https://cve.now/CVE-2022-42303.md): An issue was discovered in Veritas NetBackup through 10.0 and related Veritas products. (CVSS 8.0)
- [CVE-2022-42304](https://cve.now/CVE-2022-42304.md): An issue was discovered in Veritas NetBackup through 10.0 and related Veritas products. (CVSS 8.0)
- [CVE-2022-42305](https://cve.now/CVE-2022-42305.md): An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. (CVSS 5.3)
- [CVE-2022-42306](https://cve.now/CVE-2022-42306.md): An issue was discovered in Veritas NetBackup through 8.2 and related Veritas products. (CVSS 6.5)
- [CVE-2022-42307](https://cve.now/CVE-2022-42307.md): An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. (CVSS 5.3)
- [CVE-2022-42308](https://cve.now/CVE-2022-42308.md): An issue was discovered in Veritas NetBackup through 8.2 and related Veritas products. (CVSS 9.0)
- [CVE-2022-33883](https://cve.now/CVE-2022-33883.md): A malicious crafted file consumed through Moldflow Synergy, Moldflow Adviser, Moldflow Communicator, and Advanced Material Exchange applicat (no CVSS, Moldflow Synergy, Moldflow Adviser, Moldflow Communicator,…)
- [CVE-2022-33888](https://cve.now/CVE-2022-33888.md): A malicious crafted Dwg2Spd file when processed through Autodesk DWG application could lead to memory corruption vulnerability by write acce (CVSS 7.8, utodesk® AutoCAD®, Advance Steel and Civil 3D®)
- [CVE-2022-33887](https://cve.now/CVE-2022-33887.md): A maliciously crafted PDF file when parsed through Autodesk AutoCAD 2023 causes an unhandled exception. (no CVSS, utodesk® AutoCAD®, Advance Steel and Civil 3D®)
- [CVE-2022-33885](https://cve.now/CVE-2022-33885.md): A maliciously crafted X\_B, CATIA, and PDF file when parsed through Autodesk AutoCAD 2023 and 2022 can be used to write beyond the allocated (no CVSS, utodesk® AutoCAD®, Advance Steel and Civil 3D®)
- [CVE-2022-33884](https://cve.now/CVE-2022-33884.md): Parsing a maliciously crafted X\_B file can force Autodesk AutoCAD 2023 and 2022 to read beyond allocated boundaries. (no CVSS, utodesk® AutoCAD®, Advance Steel and Civil 3D®)
- [CVE-2022-33889](https://cve.now/CVE-2022-33889.md): A maliciously crafted GIF or JPEG files when parsed through Autodesk Design Review 2018, and AutoCAD 2023 and 2022 could be used to write be (no CVSS, Autodesk® Design Review, Autodesk® Advance Steel, Autodesk®…)
- [CVE-2022-40764](https://cve.now/CVE-2022-40764.md): Snyk CLI before 1.996.0 allows arbitrary command execution, affecting Snyk IDE plugins and the snyk npm package. (no CVSS, snyk · snyk-go-plugin)
- [CVE-2022-41430](https://cve.now/CVE-2022-41430.md): Bento4 v1.6.0-639 was discovered to contain a heap overflow via the AP4\_BitReader::ReadBit function in mp4mux. (no CVSS)
- [CVE-2022-41429](https://cve.now/CVE-2022-41429.md): Bento4 v1.6.0-639 was discovered to contain a heap overflow via the AP4\_Atom::TypeFromString function in mp4tag. (no CVSS)
- [CVE-2022-41428](https://cve.now/CVE-2022-41428.md): Bento4 v1.6.0-639 was discovered to contain a heap overflow via the AP4\_BitReader::ReadBits function in mp4mux. (no CVSS)
- [CVE-2022-41427](https://cve.now/CVE-2022-41427.md): Bento4 v1.6.0-639 was discovered to contain a memory leak in the AP4\_AvcFrameParser::Feed function in mp4mux. (no CVSS)
- [CVE-2022-41426](https://cve.now/CVE-2022-41426.md): Bento4 v1.6.0-639 was discovered to contain a memory leak via the AP4\_AtomFactory::CreateAtomFromStream function in mp4split. (no CVSS)
- [CVE-2022-41425](https://cve.now/CVE-2022-41425.md): Bento4 v1.6.0-639 was discovered to contain a segmentation violation via the AP4\_Processor::ProcessFragments function in mp4decrypt. (no CVSS)
- [CVE-2022-41423](https://cve.now/CVE-2022-41423.md): Bento4 v1.6.0-639 was discovered to contain a segmentation violation in the mp4fragment component. (no CVSS)
- [CVE-2022-41424](https://cve.now/CVE-2022-41424.md): Bento4 v1.6.0-639 was discovered to contain a memory leak via the AP4\_SttsAtom::Create function in mp42hls. (no CVSS)
- [CVE-2022-41420](https://cve.now/CVE-2022-41420.md): nasm v2.16 was discovered to contain a stack overflow in the Ndisasm component (no CVSS)
- [CVE-2022-41419](https://cve.now/CVE-2022-41419.md): Bento4 v1.6.0-639 was discovered to contain a memory leak via the AP4\_Processor::Process function in the mp4encrypt binary. (no CVSS)
- [CVE-2022-3132](https://cve.now/CVE-2022-3132.md): Goolytics - Simple Google Analytics \< 1.1.2 - Admin+ Stored Cross-Site Scripting (no CVSS, Goolytics – Simple Google Analytics)
- [CVE-2022-3128](https://cve.now/CVE-2022-3128.md): Donation Thermometer \< 2.1.3 - Admin+ Stored Cross-Site Scripting (no CVSS, Donation Thermometer)
- [CVE-2022-3125](https://cve.now/CVE-2022-3125.md): Frontend File Manager \< 21.3 - Subscriber+ Arbitrary File Upload (no CVSS, Frontend File Manager Plugin)
- [CVE-2022-3124](https://cve.now/CVE-2022-3124.md): Frontend File Manager \< 21.3 - Unauthenticated File Renaming (no CVSS, Frontend File Manager Plugin)
- [CVE-2022-2839](https://cve.now/CVE-2022-2839.md): Zephyr Project Manager \< 3.2.55 - Unauthorised AJAX Calls To Stored XSS (no CVSS, Zephyr Project Manager)
- [CVE-2022-2763](https://cve.now/CVE-2022-2763.md): WP Socializer \< 7.3 - Admin+ Stored Cross-Site Scripting (no CVSS, WP Socializer – Simple & Easy Social Media Share Icons)
- [CVE-2022-2628](https://cve.now/CVE-2022-2628.md): DSGVO All in one for WP \< 4.2 - Admin+ Stored Cross-Site Scripting (no CVSS, DSGVO All in one for WP)
- [CVE-2022-40123](https://cve.now/CVE-2022-40123.md): mojoPortal v2.7 was discovered to contain a path traversal vulnerability via the "f" parameter at /DesignTools/CssEditor.aspx. (no CVSS)
- [CVE-2022-40922](https://cve.now/CVE-2022-40922.md): A vulnerability in the LIEF::MachO::BinaryParser::init\_and\_parse function of LIEF v0.12.1 allows attackers to cause a denial of service (DOS (no CVSS, lief)
- [CVE-2022-38817](https://cve.now/CVE-2022-38817.md): Dapr Dashboard v0.1.0 through v0.10.0 is vulnerable to Incorrect Access Control that allows attackers to obtain sensitive data. (no CVSS, github.com/dapr/dashboard)
- [CVE-2022-32173](https://cve.now/CVE-2022-32173.md): OrchardCore - HTML Injection (no CVSS, OrchardCore)
- [CVE-2022-40886](https://cve.now/CVE-2022-40886.md): DedeCMS 5.7.98 has a file upload vulnerability in the background. (no CVSS)
- [CVE-2022-33886](https://cve.now/CVE-2022-33886.md): A maliciously crafted MODEL and SLDPRT file can be used to write beyond the allocated buffer while parsing through Autodesk AutoCAD 2023, 20 (no CVSS, Autodesk Maya)
- [CVE-2022-33890](https://cve.now/CVE-2022-33890.md): A maliciously crafted PCT or DWF file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by re (no CVSS, Autodesk® Design Review,)
- [CVE-2022-36551](https://cve.now/CVE-2022-36551.md): A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.0 and earlier allows (no CVSS, label-studio)
- [CVE-2022-41040](https://cve.now/CVE-2022-41040.md): Microsoft Exchange Server Elevation of Privilege Vulnerability (CVSS 8.8, KEV, Microsoft Exchange Server 2013 Cumulative Update · Micro… +1)
- [CVE-2022-41082](https://cve.now/CVE-2022-41082.md): Microsoft Exchange Server Remote Code Execution Vulnerability (CVSS 8.0, KEV, Microsoft Exchange Server 2013 Cumulative Update · Micro… +1)
- [CVE-2022-41301](https://cve.now/CVE-2022-41301.md): A maliciously crafted PKT file when consumed through SubassemblyComposer.exe application could lead to memory corruption vulnerability by re (no CVSS, Subassembly Composer)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-10-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.