# CVEs published 2022-10-06

66 CVEs were published on October 6, 2022: 3 critical, 10 high. Days are UTC.

- [CVE-2022-41294](https://cve.now/CVE-2022-41294.md): IBM Robotic Process Automation 21.0.0, 21.0.1, 21.0.2, 21.0.3, and 21.0.4 is vulnerable to cross origin resource sharing using the bot api. (CVSS 6.5, IBM Robotic Process Automation)
- [CVE-2022-38709](https://cve.now/CVE-2022-38709.md): IBM Robotic Process Automation 21.0.1, 21.0.2, and 21.0.3 for Cloud Pak is vulnerable to cross-site scripting. (CVSS 6.1, IBM Robotic Process Automation)
- [CVE-2022-36774](https://cve.now/CVE-2022-36774.md): IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to man in the middle attacks through manipulation of the client prox (CVSS 6.5, IBM Robotic Process Automation)
- [CVE-2022-22503](https://cve.now/CVE-2022-22503.md): IBM Robotic Process Automation 21.0.0 could allow a remote attacker to hijack the clicking action of the victim. (CVSS 6.1, IBM Robotic Process Automation)
- [CVE-2022-41853](https://cve.now/CVE-2022-41853.md): Remote code execution in HyperSQL DataBase (CVSS 8.0, HyperSQL DataBase hsqldb · org.hsqldb:hsqldb)
- [CVE-2022-32171](https://cve.now/CVE-2022-32171.md): Zinc - Stored XSS (no CVSS, zinc · github.com/zincsearch/zincsearch +1)
- [CVE-2022-31252](https://cve.now/CVE-2022-31252.md): permissions: chkstat does not check for group-writable parent directories or target files in safeOpen() (CVSS 4.4, SUSE Linux Enterprise Server 12-SP5 · openSUSE Leap)
- [CVE-2022-32172](https://cve.now/CVE-2022-32172.md): Zinc - Cross-Site Scripting (no CVSS, zinc · github.com/zinclabs/zinc +1)
- [CVE-2022-3396](https://cve.now/CVE-2022-3396.md): OMRON CX-Programmer Out-of-bounds Write (CVSS 7.8, OMRON CX-Programmer)
- [CVE-2022-3398](https://cve.now/CVE-2022-3398.md): OMRON CX-Programmer Out-of-bounds Write (CVSS 7.8, OMRON CX-Programmer)
- [CVE-2022-3397](https://cve.now/CVE-2022-3397.md): OMRON CX-Programmer Out-of-bounds Write (CVSS 7.8, OMRON CX-Programmer)
- [CVE-2021-40556](https://cve.now/CVE-2021-40556.md): A stack overflow vulnerability exists in the httpd service in ASUS RT-AX56U Router Version 3.0.0.4.386.44266. (no CVSS)
- [CVE-2022-26235](https://cve.now/CVE-2022-26235.md): A vulnerability was discovered in the Remisol Advance v2.0.12.1 and below for the Normand Message Server. (no CVSS)
- [CVE-2022-26236](https://cve.now/CVE-2022-26236.md): The default privileges for the running service Normand Remisol Advance Launcher in Beckman Coulter Remisol Advance v2.0.12.1 and prior allow (no CVSS)
- [CVE-2022-26237](https://cve.now/CVE-2022-26237.md): The default privileges for the running service Normand Viewer Service in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows non-priv (no CVSS)
- [CVE-2022-26238](https://cve.now/CVE-2022-26238.md): The default privileges for the running service Normand Service Manager in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows non-pri (no CVSS)
- [CVE-2022-26239](https://cve.now/CVE-2022-26239.md): The default privileges for the running service Normand License Manager in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows unprivi (no CVSS)
- [CVE-2022-26240](https://cve.now/CVE-2022-26240.md): The default privileges for the running service Normand Message Buffer in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows non-priv (no CVSS)
- [CVE-2022-2637](https://cve.now/CVE-2022-2637.md): Privilege Escalation Vulnerability in Hitachi Storage Plug-in for VMware vCenter (CVSS 5.4, Hitachi Storage Plug-in for VMware vCenter)
- [CVE-2022-2781](https://cve.now/CVE-2022-2781.md): In affected versions of Octopus Server it was identified that the same encryption process was used for both encrypting session cookies and v (no CVSS, Octopus Deploy Octopus Server)
- [CVE-2022-27810](https://cve.now/CVE-2022-27810.md): It was possible to trigger an infinite recursion condition in the error handler when Hermes executed specific maliciously formed JavaScript. (no CVSS, Facebook Hermes)
- [CVE-2022-2783](https://cve.now/CVE-2022-2783.md): In affected versions of Octopus Server it was identified that a session cookie could be used as the CSRF token (no CVSS, Octopus Deploy Octopus Server)
- [CVE-2022-2975](https://cve.now/CVE-2022-2975.md): Avaya Aura Application Enablement Services weak permissions in web application (CVSS 7.7, Avaya Aura Application Enablement Services)
- [CVE-2022-2986](https://cve.now/CVE-2022-2986.md): Enabling and disabling installed H5P libraries did not include the necessary token to prevent a CSRF risk. (no CVSS, moodle · moodle/moodle)
- [CVE-2022-3002](https://cve.now/CVE-2022-3002.md): Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm (CVSS 5.4, yetiforcecompany/yetiforcecrm · yetiforce/yetiforce-crm)
- [CVE-2022-31008](https://cve.now/CVE-2022-31008.md): Predictable credential obfuscation seed value used in rabbitmq-server (CVSS 5.5, rabbitmq-server)
- [CVE-2022-3273](https://cve.now/CVE-2022-3273.md): Allocation of Resources Without Limits or Throttling in ikus060/rdiffweb (CVSS 3.6, ikus060/rdiffweb · rdiffweb)
- [CVE-2022-3376](https://cve.now/CVE-2022-3376.md): Weak Password Requirements in ikus060/rdiffweb (CVSS 3.5, ikus060/rdiffweb · rdiffweb)
- [CVE-2022-3389](https://cve.now/CVE-2022-3389.md): Path Traversal in ikus060/rdiffweb (CVSS 8.2, ikus060/rdiffweb · rdiffweb)
- [CVE-2022-37888](https://cve.now/CVE-2022-37888.md): There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sendin (no CVSS, Aruba Access Points: 100 Series; 103 Series; 110 Series; 12…)
- [CVE-2022-39222](https://cve.now/CVE-2022-39222.md): OAuth authorization code exposure in Dex (CVSS 9.3, dexidp dex · github.com/dexidp/dex)
- [CVE-2022-39237](https://cve.now/CVE-2022-39237.md): Digital Signature Hash Algorithms Not Validated in sylabs/sif (CVSS 6.3, sylabs sif · github.com/sylabs/sif/v2)
- [CVE-2022-39244](https://cve.now/CVE-2022-39244.md): Buffer overflow in pjlib scanner and pjmedia (CVSS 7.5, pjsip pjproject)
- [CVE-2022-39265](https://cve.now/CVE-2022-39265.md): Mail settings' command parameter injection in mybb (CVSS 7.2, mybb)
- [CVE-2022-39269](https://cve.now/CVE-2022-39269.md): Media transport downgrade from the secure version (SRTP) to non-secure (RTP) in pjsip (CVSS 9.1, pjsip pjproject)
- [CVE-2022-39270](https://cve.now/CVE-2022-39270.md): Arbitrary HTML injection in table-of-contents theme component in DiscoTOC (CVSS 5.4, discourse DiscoTOC)
- [CVE-2022-39273](https://cve.now/CVE-2022-39273.md): Default OAuth Authorization Server secret in FlyteAdmin (CVSS 4.8, flyteorg flyteadmin · github.com/flyteorg/flyteadmin)
- [CVE-2022-39274](https://cve.now/CVE-2022-39274.md): Buffer Overflow in \`ProcessRadioRxDone\` in LoRaMac-node (CVSS 7.5, Lora-net LoRaMac-node)
- [CVE-2022-39275](https://cve.now/CVE-2022-39275.md): Improper object type validation in saleor (CVSS 5.3, saleor)
- [CVE-2022-39279](https://cve.now/CVE-2022-39279.md): Discourse-chat plugin susceptible to XSS in channel name and description (CVSS 4.3, discourse-chat)
- [CVE-2022-39280](https://cve.now/CVE-2022-39280.md): Regular expression denial of service in dparse (CVSS 5.9, pyupio dparse · dparse)
- [CVE-2022-39284](https://cve.now/CVE-2022-39284.md): Secure or HttpOnly flag set in Config\\Cookie is not reflected in Cookies issued in Codeigniter4 (CVSS 2.6, CodeIgniter4 · codeigniter4/framework)
- [CVE-2022-39988](https://cve.now/CVE-2022-39988.md): A cross-site scripting (XSS) vulnerability in Centreon 22.04.0 allows attackers to execute arbitrary web script or HTML via a crafted payloa (no CVSS)
- [CVE-2022-40159](https://cve.now/CVE-2022-40159.md): Stack Overflow in JXPath (no CVSS, jxpath)
- [CVE-2022-40160](https://cve.now/CVE-2022-40160.md): Stack Overflow in JXPath (no CVSS, jxpath)
- [CVE-2022-40494](https://cve.now/CVE-2022-40494.md): NPS before v0.26.10 was discovered to contain an authentication bypass vulnerability via constantly generating and sending the Auth key and (no CVSS)
- [CVE-2022-40895](https://cve.now/CVE-2022-40895.md): In certain Nedi products, a vulnerability in the web UI of NeDi login & Community login could allow an unauthenticated, remote attacker to a (no CVSS)
- [CVE-2022-41355](https://cve.now/CVE-2022-41355.md): Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /leave\_system/classes/Ma (no CVSS)
- [CVE-2022-41517](https://cve.now/CVE-2022-41517.md): TOTOLINK NR1800X V9.1.0u.6279\_B20210910 was discovered to contain a stack overflow in the lang parameter in the setLanguageCfg function (no CVSS)
- [CVE-2022-41518](https://cve.now/CVE-2022-41518.md): TOTOLINK NR1800X V9.1.0u.6279\_B20210910 was discovered to contain a command injection vulnerability via the UploadFirmwareFile function at / (no CVSS)
- [CVE-2022-41520](https://cve.now/CVE-2022-41520.md): TOTOLINK NR1800X V9.1.0u.6279\_B20210910 was discovered to contain an authenticated stack overflow via the File parameter in the UploadCustom (no CVSS)
- [CVE-2022-41521](https://cve.now/CVE-2022-41521.md): TOTOLINK NR1800X V9.1.0u.6279\_B20210910 was discovered to contain an authenticated stack overflow via the sPort/ePort parameter in the setIp (no CVSS)
- [CVE-2022-41522](https://cve.now/CVE-2022-41522.md): TOTOLINK NR1800X V9.1.0u.6279\_B20210910 was discovered to contain an unauthenticated stack overflow via the "main" function. (no CVSS)
- [CVE-2022-41523](https://cve.now/CVE-2022-41523.md): TOTOLINK NR1800X V9.1.0u.6279\_B20210910 was discovered to contain an authenticated stack overflow via the command parameter in the setTracer (no CVSS)
- [CVE-2022-41524](https://cve.now/CVE-2022-41524.md): TOTOLINK NR1800X V9.1.0u.6279\_B20210910 was discovered to contain an authenticated stack overflow via the week, sTime, and eTime parameters (no CVSS)
- [CVE-2022-41525](https://cve.now/CVE-2022-41525.md): TOTOLINK NR1800X V9.1.0u.6279\_B20210910 was discovered to contain a command injection vulnerability via the OpModeCfg function at /cgi-bin/c (no CVSS)
- [CVE-2022-41526](https://cve.now/CVE-2022-41526.md): TOTOLINK NR1800X V9.1.0u.6279\_B20210910 was discovered to contain an authenticated stack overflow via the ip parameter in the setDiagnosisCf (no CVSS)
- [CVE-2022-41527](https://cve.now/CVE-2022-41527.md): TOTOLINK NR1800X V9.1.0u.6279\_B20210910 was discovered to contain an authenticated stack overflow via the pppoeUser parameter in the setOpMo (no CVSS)
- [CVE-2022-41528](https://cve.now/CVE-2022-41528.md): TOTOLINK NR1800X V9.1.0u.6279\_B20210910 was discovered to contain an authenticated stack overflow via the text parameter in the setSmsCfg fu (no CVSS)
- [CVE-2022-41556](https://cve.now/CVE-2022-41556.md): A resource leak in gw\_backend.c in lighttpd 1.4.56 through 1.4.66 could lead to a denial of service (connection-slot exhaustion) after a lar (no CVSS)
- [CVE-2022-42241](https://cve.now/CVE-2022-42241.md): Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/classes/Master.php?f=delete\_message. (no CVSS)
- [CVE-2022-42242](https://cve.now/CVE-2022-42242.md): Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/classes/Master.php?f=delete\_booking. (no CVSS)
- [CVE-2022-42243](https://cve.now/CVE-2022-42243.md): Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/admin/storages/manage\_storage.php?id=. (no CVSS)
- [CVE-2022-42249](https://cve.now/CVE-2022-42249.md): Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/admin/storages/view\_storage.php?id=. (CVSS 7.2)
- [CVE-2022-42250](https://cve.now/CVE-2022-42250.md): Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/admin/inquiries/view\_details.php?id=. (no CVSS)
- [CVE-2022-42457](https://cve.now/CVE-2022-42457.md): Generex CS141 through 2.10 allows remote command execution by administrators via a web interface that reaches run\_update in /usr/bin/gxserve (CVSS 9.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-10-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.