CVEs published October 6, 2022
66 CVEs were published on October 6, 2022: 3 critical, 10 high.
- Published
- 66
- Critical
- 3
- High
- 10
- Medium
- 14
- Low
- 3
- Unrated
- 36
- Now in CISA KEV
- 0
- Fix available
- 26
Most affected products
- IBM Robotic Process Automation
- 4
- ikus060/rdiffweb · rdiffweb
- 3
- OMRON CX-Programmer
- 3
- jxpath
- 2
- Octopus Deploy Octopus Server
- 2
- pjsip pjproject
- 2
- Aruba Access Points: 100 Series; 103 Series; 110 Series; 12…
- 1
- Avaya Aura Application Enablement Services
- 1
- CodeIgniter4 · codeigniter4/framework
- 1
- dexidp dex · github.com/dexidp/dex
- 1
Critical 3
- CVE-2022-39222OAuth authorization code exposure in Dexdexidp dex · github.com/dexidp/dex
- CVE-2022-39269Media transport downgrade from the secure version (SRTP) to non-secure (RTP) in pjsippjsip pjproject
- CVE-2022-42457Generex CS141 through 2.10 allows remote command execution by administrators via a web interface that reaches run_update in /usr/bin/gxserve
High 10
- CVE-2022-41853Remote code execution in HyperSQL DataBaseHyperSQL DataBase hsqldb · org.hsqldb:hsqldb
- CVE-2022-3396OMRON CX-Programmer Out-of-bounds WriteOMRON CX-Programmer
- CVE-2022-3398OMRON CX-Programmer Out-of-bounds WriteOMRON CX-Programmer
- CVE-2022-3397OMRON CX-Programmer Out-of-bounds WriteOMRON CX-Programmer
- CVE-2022-2975Avaya Aura Application Enablement Services weak permissions in web applicationAvaya Aura Application Enablement Services
- CVE-2022-3389Path Traversal in ikus060/rdiffwebikus060/rdiffweb · rdiffweb
- CVE-2022-39244Buffer overflow in pjlib scanner and pjmediapjsip pjproject
- CVE-2022-39265Mail settings' command parameter injection in mybbmybb
- CVE-2022-39274Buffer Overflow in `ProcessRadioRxDone` in LoRaMac-nodeLora-net LoRaMac-node
- CVE-2022-42249Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/admin/storages/view_storage.php?id=.
Medium, low and unrated 53
- CVE-2022-41294IBM Robotic Process Automation 21.0.0, 21.0.1, 21.0.2, 21.0.3, and 21.0.4 is vulnerable to cross origin resource sharing using the bot api.IBM Robotic Process Automation
- CVE-2022-38709IBM Robotic Process Automation 21.0.1, 21.0.2, and 21.0.3 for Cloud Pak is vulnerable to cross-site scripting.IBM Robotic Process Automation
- CVE-2022-36774IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to man in the middle attacks through manipulation of the client proxIBM Robotic Process Automation
- CVE-2022-22503IBM Robotic Process Automation 21.0.0 could allow a remote attacker to hijack the clicking action of the victim.IBM Robotic Process Automation
- CVE-2022-32171Zinc - Stored XSSzinc · github.com/zincsearch/zincsearch +1
- CVE-2022-31252permissions: chkstat does not check for group-writable parent directories or target files in safeOpen()SUSE Linux Enterprise Server 12-SP5 · openSUSE Leap
- CVE-2022-32172Zinc - Cross-Site Scriptingzinc · github.com/zinclabs/zinc +1
- CVE-2021-40556A stack overflow vulnerability exists in the httpd service in ASUS RT-AX56U Router Version 3.0.0.4.386.44266.
- CVE-2022-26235A vulnerability was discovered in the Remisol Advance v2.0.12.1 and below for the Normand Message Server.
- CVE-2022-26236The default privileges for the running service Normand Remisol Advance Launcher in Beckman Coulter Remisol Advance v2.0.12.1 and prior allow
- CVE-2022-26237The default privileges for the running service Normand Viewer Service in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows non-priv
- CVE-2022-26238The default privileges for the running service Normand Service Manager in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows non-pri
- CVE-2022-26239The default privileges for the running service Normand License Manager in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows unprivi
- CVE-2022-26240The default privileges for the running service Normand Message Buffer in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows non-priv
- CVE-2022-2637Privilege Escalation Vulnerability in Hitachi Storage Plug-in for VMware vCenterHitachi Storage Plug-in for VMware vCenter
- CVE-2022-2781In affected versions of Octopus Server it was identified that the same encryption process was used for both encrypting session cookies and vOctopus Deploy Octopus Server
- CVE-2022-27810It was possible to trigger an infinite recursion condition in the error handler when Hermes executed specific maliciously formed JavaScript.Facebook Hermes
- CVE-2022-2783In affected versions of Octopus Server it was identified that a session cookie could be used as the CSRF tokenOctopus Deploy Octopus Server
- CVE-2022-2986Enabling and disabling installed H5P libraries did not include the necessary token to prevent a CSRF risk.moodle · moodle/moodle
- CVE-2022-3002Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrmyetiforcecompany/yetiforcecrm · yetiforce/yetiforce-crm
- CVE-2022-31008Predictable credential obfuscation seed value used in rabbitmq-serverrabbitmq-server
- CVE-2022-3273Allocation of Resources Without Limits or Throttling in ikus060/rdiffwebikus060/rdiffweb · rdiffweb
- CVE-2022-3376Weak Password Requirements in ikus060/rdiffwebikus060/rdiffweb · rdiffweb
- CVE-2022-37888There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sendinAruba Access Points: 100 Series; 103 Series; 110 Series; 12…
- CVE-2022-39237Digital Signature Hash Algorithms Not Validated in sylabs/sifsylabs sif · github.com/sylabs/sif/v2
- CVE-2022-39270Arbitrary HTML injection in table-of-contents theme component in DiscoTOCdiscourse DiscoTOC
- CVE-2022-39273Default OAuth Authorization Server secret in FlyteAdminflyteorg flyteadmin · github.com/flyteorg/flyteadmin
- CVE-2022-39275Improper object type validation in saleorsaleor
- CVE-2022-39279Discourse-chat plugin susceptible to XSS in channel name and descriptiondiscourse-chat
- CVE-2022-39280Regular expression denial of service in dparsepyupio dparse · dparse
- CVE-2022-39284Secure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issued in Codeigniter4CodeIgniter4 · codeigniter4/framework
- CVE-2022-39988A cross-site scripting (XSS) vulnerability in Centreon 22.04.0 allows attackers to execute arbitrary web script or HTML via a crafted payloa
- CVE-2022-40159Stack Overflow in JXPathjxpath
- CVE-2022-40160Stack Overflow in JXPathjxpath
- CVE-2022-40494NPS before v0.26.10 was discovered to contain an authentication bypass vulnerability via constantly generating and sending the Auth key and
- CVE-2022-40895In certain Nedi products, a vulnerability in the web UI of NeDi login & Community login could allow an unauthenticated, remote attacker to a
- CVE-2022-41355Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /leave_system/classes/Ma
- CVE-2022-41517TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a stack overflow in the lang parameter in the setLanguageCfg function
- CVE-2022-41518TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a command injection vulnerability via the UploadFirmwareFile function at /
- CVE-2022-41520TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the File parameter in the UploadCustom
- CVE-2022-41521TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the sPort/ePort parameter in the setIp
- CVE-2022-41522TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an unauthenticated stack overflow via the "main" function.
- CVE-2022-41523TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the command parameter in the setTracer
- CVE-2022-41524TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the week, sTime, and eTime parameters
- CVE-2022-41525TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a command injection vulnerability via the OpModeCfg function at /cgi-bin/c
- CVE-2022-41526TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the ip parameter in the setDiagnosisCf
- CVE-2022-41527TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the pppoeUser parameter in the setOpMo
- CVE-2022-41528TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the text parameter in the setSmsCfg fu
- CVE-2022-41556A resource leak in gw_backend.c in lighttpd 1.4.56 through 1.4.66 could lead to a denial of service (connection-slot exhaustion) after a lar
- CVE-2022-42241Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/classes/Master.php?f=delete_message.
- CVE-2022-42242Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/classes/Master.php?f=delete_booking.
- CVE-2022-42243Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/admin/storages/manage_storage.php?id=.
- CVE-2022-42250Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/admin/inquiries/view_details.php?id=.