CVEs published October 7, 2022
115 CVEs were published on October 7, 2022: 9 critical, 11 high.
- Published
- 115
- Critical
- 9
- High
- 11
- Medium
- 35
- Low
- 3
- Unrated
- 57
- Now in CISA KEV
- 0
- Fix available
- 43
Most affected products
- Samsung Mobile Devices
- 12
- Aruba Access Points: 100 Series; 103 Series; 110 Series; 12…
- 10
- Samsung Mobile SmartThings
- 8
- Revit, Inventor, Infraworks, Navisworks, Fusion, Infrastruc…
- 5
- zoneminder
- 4
- Samsung Mobile Samsung Account
- 3
- IBM InfoSphere Information Server
- 2
- IBM QRadar SIEM
- 2
- ISC DHCP
- 2
- MediaTek MT6761, MT6762, MT6765, MT6768, MT6769, MT6779, MT…
- 2
Critical 9
- CVE-2022-3422Improper Privilege Management in tooljet/tooljettooljet/tooljet
- CVE-2022-39289Database log access in ZoneMinderzoneminder
- CVE-2022-40824B.C.
- CVE-2022-40826B.C.
- CVE-2022-40827B.C.
- CVE-2022-40828B.C.
- CVE-2022-40829B.C.
- CVE-2022-40830B.C.
- CVE-2022-40872An SQL injection vulnerability issue was discovered in Sourcecodester Simple E-Learning System 1.0., in /vcs/classRoom.php?classCode=, class
High 11
- CVE-2022-21936Metasys MVE
- CVE-2022-33896A buffer underflow vulnerability exists in the way Hword of Hancom Office 2020 version 11.0.0.5357 parses XML-based office files.Hancom Office
- CVE-2022-3275Puppetlabs-apt Command Injectionpuppetlabs-apt
- CVE-2022-3276Puppetlabs-mysql Command Injectionpuppetlabs-mysql
- CVE-2022-3423Allocation of Resources Without Limits or Throttling in nocodb/nocodbnocodb/nocodb · nocodb
- CVE-2022-39285Stored Cross-Site Scripting Vulnerability In File Parameter in zoneminderzoneminder
- CVE-2022-39287Plaintext transmission of CSRF tokens in tiny-csrfvalexandersaulys tiny-csrf · tiny-csrf
- CVE-2022-39290CSRF key bypass using HTTP methods in zoneminderzoneminder
- CVE-2022-39852A heap-based overflow vulnerability in makeContactAGIF in libagifencoder.quram.so library prior to SMR Oct-2022 Release 1 allows attacker toSamsung Mobile Devices
- CVE-2022-39857Improper access control vulnerability in CameraTestActivity in FactoryCameraFB prior to version 3.5.51 allows attackers to access broadcastiSamsung Mobile FactoryCameraFB
- CVE-2022-39858Path traversal vulnerability in AtBroadcastReceiver in FactoryCamera prior to version 3.5.51 allows attackers to write arbitrary file as FacSamsung Mobile FactoryCamera
Medium, low and unrated 95
- CVE-2022-41291IBM InfoSphere Information Server 11.7 does not invalidate session after logout which could allow an authenticated user to impersonate anothIBM InfoSphere Information Server
- CVE-2022-36772IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information that should only be available to a IBM InfoSphere Information Server
- CVE-2022-34308IBM CICS TX 11.1 could allow a local user to cause a denial of service due to improper load handling.IBM CICS TX Standard · IBM CICS TX Advanced
- CVE-2022-30613IBM QRadar SIEM 7.4 and 7.5 could disclose sensitive information via a local service to a privileged user.IBM QRadar SIEM
- CVE-2022-22493IBM WebSphere Automation for Cloud Pak for Watson AIOps 1.4.2 is vulnerable to cross-site request forgery, caused by improper cookie attribuIBM WebSphere Automation for Cloud Pak for Watson AIOps
- CVE-2022-22480IBM QRadar SIEM 7.4 and 7.5 data node rebalancing does not function correctly when using encrypted hosts which could result in information dIBM QRadar SIEM
- CVE-2022-2929DHCP memory leakISC DHCP
- CVE-2022-2928An option refcount overflow exists in dhcpdISC DHCP
- CVE-2020-15855Two cross-site scripting vulnerabilities were fixed in Bodhi 5.6.1.bodhi
- CVE-2021-40162A maliciously crafted TIF, PICT, TGA, or RLC files in Autodesk Image Processing component may be forced to read beyond allocated boundaries Revit, Inventor, Infraworks, Navisworks, Fusion, Infrastruc…
- CVE-2021-40163A Memory Corruption vulnerability may lead to code execution through maliciously crafted DLL files through Autodesk Image Processing componeRevit, Inventor, Infraworks, Navisworks, Fusion, Infrastruc…
- CVE-2021-40164A heap-based buffer overflow could occur while parsing TIFF, PICT, TGA, or RLC files.Revit, Inventor, Infraworks, Navisworks, Fusion, Infrastruc…
- CVE-2021-40165A maliciously crafted TIFF, PICT, TGA, or RLC file in Autodesk Image Processing component may be used to write beyond the allocated buffer wRevit, Inventor, Infraworks, Navisworks, Fusion, Infrastruc…
- CVE-2021-40166A maliciously crafted PNG file in Autodesk Image Processing component may be used to attempt to free an object that has already been freed wRevit, Inventor, Infraworks, Navisworks, Fusion, Infrastruc…
- CVE-2022-26452In isp, there is a possible use after free due to improper locking.MediaTek MT6879, MT6895, MT6983
- CVE-2022-26471In telephony, there is a possible escalation of privilege due to a parcel format mismatch.MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6781, MT…
- CVE-2022-26472In ims, there is a possible escalation of privilege due to a parcel format mismatch.MediaTek MT6739, MT6761, MT6762, MT6763, MT6765, MT6768, MT…
- CVE-2022-26473In vdec fmt, there is a possible use after free due to improper locking.MediaTek MT6789, MT6855, MT6879, MT6895, MT6983, MT8168, MT…
- CVE-2022-26474In sensorhub, there is a possible out of bounds write due to an incorrect calculation of buffer size.MediaTek MT6789, MT6855, MT6879, MT6895, MT6983
- CVE-2022-26475In wlan, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6761, MT6762, MT6765, MT6768, MT6769, MT6779, MT…
- CVE-2022-31680The vCenter Server contains an unsafe deserialisation vulnerability in the PSC (Platform services controller).VMware vCenter Server
- CVE-2022-31681VMware ESXi contains a null-pointer deference vulnerability.VMware ESXi
- CVE-2022-32589In Wi-Fi driver, there is a possible way to disconnect Wi-Fi due to an improper resource release.MediaTek MT6761, MT6762, MT6765, MT6768, MT6779, MT6781, MT…
- CVE-2022-32590In wlan, there is a possible use after free due to an incorrect status check.MediaTek MT6761, MT6762, MT6765, MT6768, MT6769, MT6779, MT…
- CVE-2022-32591In ril, there is a possible system crash due to an incorrect bounds check.MediaTek MT6580, MT6739, MT6753, MT6757, MT6761, MT6762, MT…
- CVE-2022-32592In cpu dvfs, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6855, MT6879, MT6895, MT6983, MT8185, MT8321, MT…
- CVE-2022-32593In vowe, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6983
- CVE-2022-3414SourceCodester Web-Based Student Clearance System POST Parameter login.php sql injectionSourceCodester Web-Based Student Clearance System
- CVE-2022-36634An access control issue in ZKTeco ZKBioSecurity V5000 3.0.5_r allows attackers to arbitrarily create admin users via a crafted HTTP request.
- CVE-2022-36635ZKteco ZKBioSecurity V5000 4.1.3 was discovered to contain a SQL injection vulnerability via the component /baseOpLog.do.
- CVE-2022-36868Improper restriction of broadcasting Intent in MouseNKeyHidDevice prior to SMR Oct-2022 Release 1 leaks MAC address of the connected BluetooSamsung Mobile Devices
- CVE-2022-37885There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sendinAruba Access Points; 100 Series; 103 Series; 110 Series; 12…
- CVE-2022-37886There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sendinAruba Access Points: 100 Series; 103 Series; 110 Series; 12…
- CVE-2022-37887There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sendinAruba Access Points: 100 Series; 103 Series; 110 Series; 12…
- CVE-2022-37889There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sendinAruba Access Points: 100 Series; 103 Series; 110 Series; 12…
- CVE-2022-37890Unauthenticated buffer overflow vulnerabilities exist within the Aruba InstantOS and ArubaOS 10 web management interface.Aruba Access Points: 100 Series; 103 Series; 110 Series; 12…
- CVE-2022-37891Unauthenticated buffer overflow vulnerabilities exist within the Aruba InstantOS and ArubaOS 10 web management interface.Aruba Access Points: 100 Series; 103 Series; 110 Series; 12…
- CVE-2022-37892A vulnerability in the Aruba InstantOS and ArubaOS 10 web management interface could allow an unauthenticated remote attacker to conduct a sAruba Access Points: 100 Series; 103 Series; 110 Series; 12…
- CVE-2022-37893An authenticated command injection vulnerability exists in the Aruba InstantOS and ArubaOS 10 command line interface.Aruba Access Points: 100 Series; 103 Series; 110 Series; 12…
- CVE-2022-37894An unauthenticated Denial of Service (DoS) vulnerability exists in the handling of certain SSID strings by Aruba InstantOS and ArubaOS 10.Aruba Access Points: 100 Series; 103 Series; 110 Series; 12…
- CVE-2022-37895An unauthenticated Denial of Service (DoS) vulnerability exists in the handling of certain SSID strings by Aruba InstantOS and ArubaOS 10.Aruba Access Points: 100 Series; 103 Series; 110 Series; 12…
- CVE-2022-37896A vulnerability in the Aruba InstantOS and ArubaOS 10 web management interface could allow a remote attacker to conduct a reflected cross-siAruba Access Points: 100 Series; 103 Series; 110 Series; 12…
- CVE-2022-39291Denial of service through logs in zoneminderzoneminder
- CVE-2022-39847Use after free vulnerability in set_nft_pid and signal_handler function of NFC driver prior to SMR Oct-2022 Release 1 allows attackers to peSamsung Mobile Devices
- CVE-2022-39848Exposure of sensitive information in AT_Distributor prior to SMR Oct-2022 Release 1 allows local attacker to access SerialNo via log.Samsung Mobile Devices
- CVE-2022-39849Improper access control in knox_vpn_policy service prior to SMR Oct-2022 Release 1 allows allows unauthorized read of configuration data.Samsung Mobile Devices
- CVE-2022-39850Improper access control in mum_container_policy service prior to SMR Oct-2022 Release 1 allows allows unauthorized read of configuration datSamsung Mobile Devices
- CVE-2022-39851Improper access control vulnerability in CocktailBarService prior to SMR Oct-2022 Release 1 allows local attacker to bind service that requiSamsung Mobile Devices
- CVE-2022-39853A use after free vulnerability in perf-mgr driver prior to SMR Oct-2022 Release 1 allows attacker to cause memory access fault.Samsung Mobile Devices
- CVE-2022-39854Improper protection in IOMMU prior to SMR Oct-2022 Release 1 allows unauthorized access to secure memory.Samsung Mobile Devices
- CVE-2022-39855Improper access control vulnerability in FACM application prior to SMR Oct-2022 Release 1 allows a local attacker to connect arbitrary AP anSamsung Mobile Devices
- CVE-2022-39856Improper access control vulnerability in imsservice application prior to SMR Oct-2022 Release 1 allows local attackers to access call informSamsung Mobile Devices
- CVE-2022-39859Implicit intent hijacking vulnerability in UPHelper library prior to version 3.0.12 allows attackers to access sensitive information via impSamsung Mobile UPHelper
- CVE-2022-39860Improper access control vulnerability in QuickShare prior to version 13.2.3.5 allows attackers to access sensitive information via implicit Samsung Mobile QuickShare
- CVE-2022-39861Unprotected Receiver in AtBroadcastReceiver in FactoryCamera prior to version 3.5.51 allows attackers to record video without camera privileSamsung Mobile FactoryCamera
- CVE-2022-39862Improper authorization in Dynamic Lockscreen prior to SMR Sep-2022 Release 1 in Android R(11) and 3.3.03.66 in Android S(12) allows unauthorSamsung Mobile Devices
- CVE-2022-39863Intent redirection vulnerability in Samsung Account prior to version 13.5.01.3 allows attackers to access content providers without permissiSamsung Mobile Samsung Account
- CVE-2022-39864Improper access control vulnerability in WifiSetupLaunchHelper in SmartThings prior to version 1.7.89.25 allows attackers to access sensitivSamsung Mobile SmartThings
- CVE-2022-39865Improper access control vulnerability in ContentsSharingActivity.java SmartThings prior to version 1.7.89.0 allows attackers to access sensiSamsung Mobile SmartThings
- CVE-2022-39866Improper access control vulnerability in RegisteredEventMediator.kt SmartThings prior to version 1.7.89.0 allows attackers to access sensitiSamsung Mobile SmartThings
- CVE-2022-39867Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sensSamsung Mobile SmartThings
- CVE-2022-39868Improper access control vulnerability in GedSamsungAccount.kt SmartThings prior to version 1.7.89.0 allows attackers to access sensitive infSamsung Mobile SmartThings
- CVE-2022-39869Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sensSamsung Mobile SmartThings
- CVE-2022-39870Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sensSamsung Mobile SmartThings
- CVE-2022-39871Improper access control vulnerability cloudNotificationManager.java in SmartThings prior to version 1.7.89.0 allows attackers to access sensSamsung Mobile SmartThings
- CVE-2022-39872Improper restriction of broadcasting Intent in ShareLive prior to version 13.2.03.5 leaks MAC address of the connected Bluetooth device.Samsung Mobile ShareLive
- CVE-2022-39873Improper authorization vulnerability in Samsung Internet prior to version 18.0.4.14 allows physical attackers to add bookmarks in secret modSamsung Mobile Samsung Internet
- CVE-2022-39874Sensitive log information leakage vulnerability in Samsung Account prior to version 13.5.0 allows attackers to unauthorized logout.Samsung Mobile Samsung Account
- CVE-2022-39875Improper component protection vulnerability in Samsung Account prior to version 13.5.0 allows attackers to unauthorized logout.Samsung Mobile Samsung Account
- CVE-2022-39876Insertion of Sensitive Information into Log in PushRegIdUpdateClient of SReminder prior to 8.2.01.13 allows attacker to access device IMEI.Samsung Mobile Reminder
- CVE-2022-39877Improper access control vulnerability in ProfileSharingAccount in Group Sharing prior to versions 13.0.6.15 in Android S(12), 13.0.6.14 in ASamsung Mobile Group Sharing
- CVE-2022-39878Improper access control vulnerability in Samsung Checkout prior to version 5.0.55.3 allows attackers to access sensitive information via impSamsung Mobile Samsung Checkout
- CVE-2022-39959Panini Everest Engine 2.0.4 allows unprivileged users to create a file named Everest.exe in the %PROGRAMDATA%\Panini folder.
- CVE-2022-40825B.C.
- CVE-2022-40831B.C.
- CVE-2022-40832B.C.
- CVE-2022-40833B.C.
- CVE-2022-40834B.C.
- CVE-2022-40835B.C.
- CVE-2022-41377Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /pet_shop/admin/?page=maintenanc
- CVE-2022-41378Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /pet_shop/admin/?page=inventory/
- CVE-2022-41379An arbitrary file upload vulnerability in the component /leave_system/classes/Users.php?f=save of Online Leave Management System v1.0 allows
- CVE-2022-41392A cross-site scripting (XSS) vulnerability in TotalJS commit 8c2c8909 allows attackers to execute arbitrary web scripts or HTML via a crafte
- CVE-2022-41414An insecure default in the component auth.login.prompt.enabled of Liferay Portal v7.0.0 through v7.4.2 allows attackers to enumerate usernamcom.liferay.portal:release.portal.bom · com.liferay.portal:…
- CVE-2022-41442PicUploader v2.6.3 was discovered to contain cross-site scripting (XSS) vulnerability via the setStorageParams function in SettingController
- CVE-2022-41512An arbitrary file upload vulnerability in the component /php_action/editFile.php of Online Diagnostic Lab Management System v1.0 allows atta
- CVE-2022-41513Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /diagnostic/edi
- CVE-2022-41514Open Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /sacco_shield/ajax.
- CVE-2022-41515Open Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /sacco_shield/ajax.
- CVE-2022-41574An access-control vulnerability in Gradle Enterprise 2022.4 through 2022.3.1 allows remote attackers to prevent backups from occurring, and
- CVE-2022-41672Session still functional after user is deactivatedApache Software Foundation Apache Airflow · apache-airflow
- CVE-2022-42073Online Diagnostic Lab Management System v1.0 is vulnerable to SQL Injection via /diagnostic/editclient.php?id=.
- CVE-2022-42074Online Diagnostic Lab Management System v1.0 is vulnerable to SQL Injection via /diagnostic/editcategory.php?id=.
- CVE-2022-42075Wedding Planner v1.0 is vulnerable to arbitrary code execution.
- CVE-2022-42092Backdrop CMS 1.22.0 has Unrestricted File Upload vulnerability via 'themes' that allows attackers to Remote Code Execution.backdrop/backdrop