# CVEs published 2022-10-07

115 CVEs were published on October 7, 2022: 9 critical, 11 high. Days are UTC.

- [CVE-2022-21936](https://cve.now/CVE-2022-21936.md): Metasys MVE (CVSS 8.1)
- [CVE-2022-41291](https://cve.now/CVE-2022-41291.md): IBM InfoSphere Information Server 11.7 does not invalidate session after logout which could allow an authenticated user to impersonate anoth (CVSS 6.3, IBM InfoSphere Information Server)
- [CVE-2022-36772](https://cve.now/CVE-2022-36772.md): IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information that should only be available to a (CVSS 4.3, IBM InfoSphere Information Server)
- [CVE-2022-34308](https://cve.now/CVE-2022-34308.md): IBM CICS TX 11.1 could allow a local user to cause a denial of service due to improper load handling. (CVSS 6.2, IBM CICS TX Standard · IBM CICS TX Advanced)
- [CVE-2022-30613](https://cve.now/CVE-2022-30613.md): IBM QRadar SIEM 7.4 and 7.5 could disclose sensitive information via a local service to a privileged user. (CVSS 4.4, IBM QRadar SIEM)
- [CVE-2022-22493](https://cve.now/CVE-2022-22493.md): IBM WebSphere Automation for Cloud Pak for Watson AIOps 1.4.2 is vulnerable to cross-site request forgery, caused by improper cookie attribu (CVSS 3.5, IBM WebSphere Automation for Cloud Pak for Watson AIOps)
- [CVE-2022-22480](https://cve.now/CVE-2022-22480.md): IBM QRadar SIEM 7.4 and 7.5 data node rebalancing does not function correctly when using encrypted hosts which could result in information d (CVSS 5.3, IBM QRadar SIEM)
- [CVE-2022-33896](https://cve.now/CVE-2022-33896.md): A buffer underflow vulnerability exists in the way Hword of Hancom Office 2020 version 11.0.0.5357 parses XML-based office files. (CVSS 7.8, Hancom Office)
- [CVE-2022-2929](https://cve.now/CVE-2022-2929.md): DHCP memory leak (CVSS 6.5, ISC DHCP)
- [CVE-2022-2928](https://cve.now/CVE-2022-2928.md): An option refcount overflow exists in dhcpd (CVSS 6.5, ISC DHCP)
- [CVE-2020-15855](https://cve.now/CVE-2020-15855.md): Two cross-site scripting vulnerabilities were fixed in Bodhi 5.6.1. (no CVSS, bodhi)
- [CVE-2021-40162](https://cve.now/CVE-2021-40162.md): A maliciously crafted TIF, PICT, TGA, or RLC files in Autodesk Image Processing component may be forced to read beyond allocated boundaries (no CVSS, Revit, Inventor, Infraworks, Navisworks, Fusion, Infrastruc…)
- [CVE-2021-40163](https://cve.now/CVE-2021-40163.md): A Memory Corruption vulnerability may lead to code execution through maliciously crafted DLL files through Autodesk Image Processing compone (no CVSS, Revit, Inventor, Infraworks, Navisworks, Fusion, Infrastruc…)
- [CVE-2021-40164](https://cve.now/CVE-2021-40164.md): A heap-based buffer overflow could occur while parsing TIFF, PICT, TGA, or RLC files. (no CVSS, Revit, Inventor, Infraworks, Navisworks, Fusion, Infrastruc…)
- [CVE-2021-40165](https://cve.now/CVE-2021-40165.md): A maliciously crafted TIFF, PICT, TGA, or RLC file in Autodesk Image Processing component may be used to write beyond the allocated buffer w (no CVSS, Revit, Inventor, Infraworks, Navisworks, Fusion, Infrastruc…)
- [CVE-2021-40166](https://cve.now/CVE-2021-40166.md): A maliciously crafted PNG file in Autodesk Image Processing component may be used to attempt to free an object that has already been freed w (no CVSS, Revit, Inventor, Infraworks, Navisworks, Fusion, Infrastruc…)
- [CVE-2022-26452](https://cve.now/CVE-2022-26452.md): In isp, there is a possible use after free due to improper locking. (no CVSS, MediaTek MT6879, MT6895, MT6983)
- [CVE-2022-26471](https://cve.now/CVE-2022-26471.md): In telephony, there is a possible escalation of privilege due to a parcel format mismatch. (no CVSS, MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6781, MT…)
- [CVE-2022-26472](https://cve.now/CVE-2022-26472.md): In ims, there is a possible escalation of privilege due to a parcel format mismatch. (no CVSS, MediaTek MT6739, MT6761, MT6762, MT6763, MT6765, MT6768, MT…)
- [CVE-2022-26473](https://cve.now/CVE-2022-26473.md): In vdec fmt, there is a possible use after free due to improper locking. (no CVSS, MediaTek MT6789, MT6855, MT6879, MT6895, MT6983, MT8168, MT…)
- [CVE-2022-26474](https://cve.now/CVE-2022-26474.md): In sensorhub, there is a possible out of bounds write due to an incorrect calculation of buffer size. (no CVSS, MediaTek MT6789, MT6855, MT6879, MT6895, MT6983)
- [CVE-2022-26475](https://cve.now/CVE-2022-26475.md): In wlan, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT6761, MT6762, MT6765, MT6768, MT6769, MT6779, MT…)
- [CVE-2022-31680](https://cve.now/CVE-2022-31680.md): The vCenter Server contains an unsafe deserialisation vulnerability in the PSC (Platform services controller). (no CVSS, VMware vCenter Server)
- [CVE-2022-31681](https://cve.now/CVE-2022-31681.md): VMware ESXi contains a null-pointer deference vulnerability. (no CVSS, VMware ESXi)
- [CVE-2022-32589](https://cve.now/CVE-2022-32589.md): In Wi-Fi driver, there is a possible way to disconnect Wi-Fi due to an improper resource release. (no CVSS, MediaTek MT6761, MT6762, MT6765, MT6768, MT6779, MT6781, MT…)
- [CVE-2022-32590](https://cve.now/CVE-2022-32590.md): In wlan, there is a possible use after free due to an incorrect status check. (no CVSS, MediaTek MT6761, MT6762, MT6765, MT6768, MT6769, MT6779, MT…)
- [CVE-2022-32591](https://cve.now/CVE-2022-32591.md): In ril, there is a possible system crash due to an incorrect bounds check. (no CVSS, MediaTek MT6580, MT6739, MT6753, MT6757, MT6761, MT6762, MT…)
- [CVE-2022-32592](https://cve.now/CVE-2022-32592.md): In cpu dvfs, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT6855, MT6879, MT6895, MT6983, MT8185, MT8321, MT…)
- [CVE-2022-32593](https://cve.now/CVE-2022-32593.md): In vowe, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT6983)
- [CVE-2022-3275](https://cve.now/CVE-2022-3275.md): Puppetlabs-apt Command Injection (CVSS 8.4, puppetlabs-apt)
- [CVE-2022-3276](https://cve.now/CVE-2022-3276.md): Puppetlabs-mysql Command Injection (CVSS 8.4, puppetlabs-mysql)
- [CVE-2022-3414](https://cve.now/CVE-2022-3414.md): SourceCodester Web-Based Student Clearance System POST Parameter login.php sql injection (CVSS 5.0, SourceCodester Web-Based Student Clearance System)
- [CVE-2022-3422](https://cve.now/CVE-2022-3422.md): Improper Privilege Management in tooljet/tooljet (CVSS 9.8, tooljet/tooljet)
- [CVE-2022-3423](https://cve.now/CVE-2022-3423.md): Allocation of Resources Without Limits or Throttling in nocodb/nocodb (CVSS 7.3, nocodb/nocodb · nocodb)
- [CVE-2022-36634](https://cve.now/CVE-2022-36634.md): An access control issue in ZKTeco ZKBioSecurity V5000 3.0.5\_r allows attackers to arbitrarily create admin users via a crafted HTTP request. (no CVSS)
- [CVE-2022-36635](https://cve.now/CVE-2022-36635.md): ZKteco ZKBioSecurity V5000 4.1.3 was discovered to contain a SQL injection vulnerability via the component /baseOpLog.do. (no CVSS)
- [CVE-2022-36868](https://cve.now/CVE-2022-36868.md): Improper restriction of broadcasting Intent in MouseNKeyHidDevice prior to SMR Oct-2022 Release 1 leaks MAC address of the connected Bluetoo (CVSS 5.9, Samsung Mobile Devices)
- [CVE-2022-37885](https://cve.now/CVE-2022-37885.md): There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sendin (no CVSS, Aruba Access Points; 100 Series; 103 Series; 110 Series; 12…)
- [CVE-2022-37886](https://cve.now/CVE-2022-37886.md): There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sendin (no CVSS, Aruba Access Points: 100 Series; 103 Series; 110 Series; 12…)
- [CVE-2022-37887](https://cve.now/CVE-2022-37887.md): There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sendin (no CVSS, Aruba Access Points: 100 Series; 103 Series; 110 Series; 12…)
- [CVE-2022-37889](https://cve.now/CVE-2022-37889.md): There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sendin (no CVSS, Aruba Access Points: 100 Series; 103 Series; 110 Series; 12…)
- [CVE-2022-37890](https://cve.now/CVE-2022-37890.md): Unauthenticated buffer overflow vulnerabilities exist within the Aruba InstantOS and ArubaOS 10 web management interface. (no CVSS, Aruba Access Points: 100 Series; 103 Series; 110 Series; 12…)
- [CVE-2022-37891](https://cve.now/CVE-2022-37891.md): Unauthenticated buffer overflow vulnerabilities exist within the Aruba InstantOS and ArubaOS 10 web management interface. (no CVSS, Aruba Access Points: 100 Series; 103 Series; 110 Series; 12…)
- [CVE-2022-37892](https://cve.now/CVE-2022-37892.md): A vulnerability in the Aruba InstantOS and ArubaOS 10 web management interface could allow an unauthenticated remote attacker to conduct a s (no CVSS, Aruba Access Points: 100 Series; 103 Series; 110 Series; 12…)
- [CVE-2022-37893](https://cve.now/CVE-2022-37893.md): An authenticated command injection vulnerability exists in the Aruba InstantOS and ArubaOS 10 command line interface. (no CVSS, Aruba Access Points: 100 Series; 103 Series; 110 Series; 12…)
- [CVE-2022-37894](https://cve.now/CVE-2022-37894.md): An unauthenticated Denial of Service (DoS) vulnerability exists in the handling of certain SSID strings by Aruba InstantOS and ArubaOS 10. (no CVSS, Aruba Access Points: 100 Series; 103 Series; 110 Series; 12…)
- [CVE-2022-37895](https://cve.now/CVE-2022-37895.md): An unauthenticated Denial of Service (DoS) vulnerability exists in the handling of certain SSID strings by Aruba InstantOS and ArubaOS 10. (no CVSS, Aruba Access Points: 100 Series; 103 Series; 110 Series; 12…)
- [CVE-2022-37896](https://cve.now/CVE-2022-37896.md): A vulnerability in the Aruba InstantOS and ArubaOS 10 web management interface could allow a remote attacker to conduct a reflected cross-si (no CVSS, Aruba Access Points: 100 Series; 103 Series; 110 Series; 12…)
- [CVE-2022-39285](https://cve.now/CVE-2022-39285.md): Stored Cross-Site Scripting Vulnerability In File Parameter in zoneminder (CVSS 7.6, zoneminder)
- [CVE-2022-39287](https://cve.now/CVE-2022-39287.md): Plaintext transmission of CSRF tokens in tiny-csrf (CVSS 8.1, valexandersaulys tiny-csrf · tiny-csrf)
- [CVE-2022-39289](https://cve.now/CVE-2022-39289.md): Database log access in ZoneMinder (CVSS 9.1, zoneminder)
- [CVE-2022-39290](https://cve.now/CVE-2022-39290.md): CSRF key bypass using HTTP methods in zoneminder (CVSS 8.0, zoneminder)
- [CVE-2022-39291](https://cve.now/CVE-2022-39291.md): Denial of service through logs in zoneminder (CVSS 5.4, zoneminder)
- [CVE-2022-39847](https://cve.now/CVE-2022-39847.md): Use after free vulnerability in set\_nft\_pid and signal\_handler function of NFC driver prior to SMR Oct-2022 Release 1 allows attackers to pe (CVSS 4.9, Samsung Mobile Devices)
- [CVE-2022-39848](https://cve.now/CVE-2022-39848.md): Exposure of sensitive information in AT\_Distributor prior to SMR Oct-2022 Release 1 allows local attacker to access SerialNo via log. (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2022-39849](https://cve.now/CVE-2022-39849.md): Improper access control in knox\_vpn\_policy service prior to SMR Oct-2022 Release 1 allows allows unauthorized read of configuration data. (no CVSS, Samsung Mobile Devices)
- [CVE-2022-39850](https://cve.now/CVE-2022-39850.md): Improper access control in mum\_container\_policy service prior to SMR Oct-2022 Release 1 allows allows unauthorized read of configuration dat (no CVSS, Samsung Mobile Devices)
- [CVE-2022-39851](https://cve.now/CVE-2022-39851.md): Improper access control vulnerability in CocktailBarService prior to SMR Oct-2022 Release 1 allows local attacker to bind service that requi (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2022-39852](https://cve.now/CVE-2022-39852.md): A heap-based overflow vulnerability in makeContactAGIF in libagifencoder.quram.so library prior to SMR Oct-2022 Release 1 allows attacker to (CVSS 8.0, Samsung Mobile Devices)
- [CVE-2022-39853](https://cve.now/CVE-2022-39853.md): A use after free vulnerability in perf-mgr driver prior to SMR Oct-2022 Release 1 allows attacker to cause memory access fault. (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2022-39854](https://cve.now/CVE-2022-39854.md): Improper protection in IOMMU prior to SMR Oct-2022 Release 1 allows unauthorized access to secure memory. (CVSS 6.4, Samsung Mobile Devices)
- [CVE-2022-39855](https://cve.now/CVE-2022-39855.md): Improper access control vulnerability in FACM application prior to SMR Oct-2022 Release 1 allows a local attacker to connect arbitrary AP an (CVSS 5.1, Samsung Mobile Devices)
- [CVE-2022-39856](https://cve.now/CVE-2022-39856.md): Improper access control vulnerability in imsservice application prior to SMR Oct-2022 Release 1 allows local attackers to access call inform (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2022-39857](https://cve.now/CVE-2022-39857.md): Improper access control vulnerability in CameraTestActivity in FactoryCameraFB prior to version 3.5.51 allows attackers to access broadcasti (CVSS 7.3, Samsung Mobile FactoryCameraFB)
- [CVE-2022-39858](https://cve.now/CVE-2022-39858.md): Path traversal vulnerability in AtBroadcastReceiver in FactoryCamera prior to version 3.5.51 allows attackers to write arbitrary file as Fac (CVSS 7.3, Samsung Mobile FactoryCamera)
- [CVE-2022-39859](https://cve.now/CVE-2022-39859.md): Implicit intent hijacking vulnerability in UPHelper library prior to version 3.0.12 allows attackers to access sensitive information via imp (CVSS 4.0, Samsung Mobile UPHelper)
- [CVE-2022-39860](https://cve.now/CVE-2022-39860.md): Improper access control vulnerability in QuickShare prior to version 13.2.3.5 allows attackers to access sensitive information via implicit (CVSS 4.4, Samsung Mobile QuickShare)
- [CVE-2022-39861](https://cve.now/CVE-2022-39861.md): Unprotected Receiver in AtBroadcastReceiver in FactoryCamera prior to version 3.5.51 allows attackers to record video without camera privile (CVSS 5.9, Samsung Mobile FactoryCamera)
- [CVE-2022-39862](https://cve.now/CVE-2022-39862.md): Improper authorization in Dynamic Lockscreen prior to SMR Sep-2022 Release 1 in Android R(11) and 3.3.03.66 in Android S(12) allows unauthor (CVSS 5.3, Samsung Mobile Devices)
- [CVE-2022-39863](https://cve.now/CVE-2022-39863.md): Intent redirection vulnerability in Samsung Account prior to version 13.5.01.3 allows attackers to access content providers without permissi (CVSS 3.6, Samsung Mobile Samsung Account)
- [CVE-2022-39864](https://cve.now/CVE-2022-39864.md): Improper access control vulnerability in WifiSetupLaunchHelper in SmartThings prior to version 1.7.89.25 allows attackers to access sensitiv (CVSS 3.3, Samsung Mobile SmartThings)
- [CVE-2022-39865](https://cve.now/CVE-2022-39865.md): Improper access control vulnerability in ContentsSharingActivity.java SmartThings prior to version 1.7.89.0 allows attackers to access sensi (CVSS 4.0, Samsung Mobile SmartThings)
- [CVE-2022-39866](https://cve.now/CVE-2022-39866.md): Improper access control vulnerability in RegisteredEventMediator.kt SmartThings prior to version 1.7.89.0 allows attackers to access sensiti (CVSS 4.0, Samsung Mobile SmartThings)
- [CVE-2022-39867](https://cve.now/CVE-2022-39867.md): Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sens (CVSS 4.0, Samsung Mobile SmartThings)
- [CVE-2022-39868](https://cve.now/CVE-2022-39868.md): Improper access control vulnerability in GedSamsungAccount.kt SmartThings prior to version 1.7.89.0 allows attackers to access sensitive inf (CVSS 4.0, Samsung Mobile SmartThings)
- [CVE-2022-39869](https://cve.now/CVE-2022-39869.md): Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sens (CVSS 4.0, Samsung Mobile SmartThings)
- [CVE-2022-39870](https://cve.now/CVE-2022-39870.md): Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sens (CVSS 4.0, Samsung Mobile SmartThings)
- [CVE-2022-39871](https://cve.now/CVE-2022-39871.md): Improper access control vulnerability cloudNotificationManager.java in SmartThings prior to version 1.7.89.0 allows attackers to access sens (CVSS 4.0, Samsung Mobile SmartThings)
- [CVE-2022-39872](https://cve.now/CVE-2022-39872.md): Improper restriction of broadcasting Intent in ShareLive prior to version 13.2.03.5 leaks MAC address of the connected Bluetooth device. (CVSS 5.9, Samsung Mobile ShareLive)
- [CVE-2022-39873](https://cve.now/CVE-2022-39873.md): Improper authorization vulnerability in Samsung Internet prior to version 18.0.4.14 allows physical attackers to add bookmarks in secret mod (CVSS 4.3, Samsung Mobile Samsung Internet)
- [CVE-2022-39874](https://cve.now/CVE-2022-39874.md): Sensitive log information leakage vulnerability in Samsung Account prior to version 13.5.0 allows attackers to unauthorized logout. (CVSS 4.0, Samsung Mobile Samsung Account)
- [CVE-2022-39875](https://cve.now/CVE-2022-39875.md): Improper component protection vulnerability in Samsung Account prior to version 13.5.0 allows attackers to unauthorized logout. (CVSS 5.1, Samsung Mobile Samsung Account)
- [CVE-2022-39876](https://cve.now/CVE-2022-39876.md): Insertion of Sensitive Information into Log in PushRegIdUpdateClient of SReminder prior to 8.2.01.13 allows attacker to access device IMEI. (CVSS 5.9, Samsung Mobile Reminder)
- [CVE-2022-39877](https://cve.now/CVE-2022-39877.md): Improper access control vulnerability in ProfileSharingAccount in Group Sharing prior to versions 13.0.6.15 in Android S(12), 13.0.6.14 in A (CVSS 4.0, Samsung Mobile Group Sharing)
- [CVE-2022-39878](https://cve.now/CVE-2022-39878.md): Improper access control vulnerability in Samsung Checkout prior to version 5.0.55.3 allows attackers to access sensitive information via imp (CVSS 4.0, Samsung Mobile Samsung Checkout)
- [CVE-2022-39959](https://cve.now/CVE-2022-39959.md): Panini Everest Engine 2.0.4 allows unprivileged users to create a file named Everest.exe in the %PROGRAMDATA%\\Panini folder. (no CVSS)
- [CVE-2022-40824](https://cve.now/CVE-2022-40824.md): B.C. (CVSS 9.8)
- [CVE-2022-40825](https://cve.now/CVE-2022-40825.md): B.C. (no CVSS)
- [CVE-2022-40826](https://cve.now/CVE-2022-40826.md): B.C. (CVSS 9.8)
- [CVE-2022-40827](https://cve.now/CVE-2022-40827.md): B.C. (CVSS 9.8)
- [CVE-2022-40828](https://cve.now/CVE-2022-40828.md): B.C. (CVSS 9.8)
- [CVE-2022-40829](https://cve.now/CVE-2022-40829.md): B.C. (CVSS 9.8)
- [CVE-2022-40830](https://cve.now/CVE-2022-40830.md): B.C. (CVSS 9.8)
- [CVE-2022-40831](https://cve.now/CVE-2022-40831.md): B.C. (no CVSS)
- [CVE-2022-40832](https://cve.now/CVE-2022-40832.md): B.C. (no CVSS)
- [CVE-2022-40833](https://cve.now/CVE-2022-40833.md): B.C. (no CVSS)
- [CVE-2022-40834](https://cve.now/CVE-2022-40834.md): B.C. (no CVSS)
- [CVE-2022-40835](https://cve.now/CVE-2022-40835.md): B.C. (no CVSS)
- [CVE-2022-40872](https://cve.now/CVE-2022-40872.md): An SQL injection vulnerability issue was discovered in Sourcecodester Simple E-Learning System 1.0., in /vcs/classRoom.php?classCode=, class (CVSS 9.8)
- [CVE-2022-41377](https://cve.now/CVE-2022-41377.md): Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /pet\_shop/admin/?page=maintenanc (no CVSS)
- [CVE-2022-41378](https://cve.now/CVE-2022-41378.md): Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /pet\_shop/admin/?page=inventory/ (no CVSS)
- [CVE-2022-41379](https://cve.now/CVE-2022-41379.md): An arbitrary file upload vulnerability in the component /leave\_system/classes/Users.php?f=save of Online Leave Management System v1.0 allows (no CVSS)
- [CVE-2022-41392](https://cve.now/CVE-2022-41392.md): A cross-site scripting (XSS) vulnerability in TotalJS commit 8c2c8909 allows attackers to execute arbitrary web scripts or HTML via a crafte (no CVSS)
- [CVE-2022-41414](https://cve.now/CVE-2022-41414.md): An insecure default in the component auth.login.prompt.enabled of Liferay Portal v7.0.0 through v7.4.2 allows attackers to enumerate usernam (no CVSS, com.liferay.portal:release.portal.bom · com.liferay.portal:…)
- [CVE-2022-41442](https://cve.now/CVE-2022-41442.md): PicUploader v2.6.3 was discovered to contain cross-site scripting (XSS) vulnerability via the setStorageParams function in SettingController (no CVSS)
- [CVE-2022-41512](https://cve.now/CVE-2022-41512.md): An arbitrary file upload vulnerability in the component /php\_action/editFile.php of Online Diagnostic Lab Management System v1.0 allows atta (no CVSS)
- [CVE-2022-41513](https://cve.now/CVE-2022-41513.md): Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /diagnostic/edi (no CVSS)
- [CVE-2022-41514](https://cve.now/CVE-2022-41514.md): Open Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /sacco\_shield/ajax. (no CVSS)
- [CVE-2022-41515](https://cve.now/CVE-2022-41515.md): Open Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /sacco\_shield/ajax. (no CVSS)
- [CVE-2022-41574](https://cve.now/CVE-2022-41574.md): An access-control vulnerability in Gradle Enterprise 2022.4 through 2022.3.1 allows remote attackers to prevent backups from occurring, and (no CVSS)
- [CVE-2022-41672](https://cve.now/CVE-2022-41672.md): Session still functional after user is deactivated (no CVSS, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2022-42073](https://cve.now/CVE-2022-42073.md): Online Diagnostic Lab Management System v1.0 is vulnerable to SQL Injection via /diagnostic/editclient.php?id=. (no CVSS)
- [CVE-2022-42074](https://cve.now/CVE-2022-42074.md): Online Diagnostic Lab Management System v1.0 is vulnerable to SQL Injection via /diagnostic/editcategory.php?id=. (no CVSS)
- [CVE-2022-42075](https://cve.now/CVE-2022-42075.md): Wedding Planner v1.0 is vulnerable to arbitrary code execution. (no CVSS)
- [CVE-2022-42092](https://cve.now/CVE-2022-42092.md): Backdrop CMS 1.22.0 has Unrestricted File Upload vulnerability via 'themes' that allows attackers to Remote Code Execution. (no CVSS, backdrop/backdrop)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-10-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.