CVEs published October 10, 2022
50 CVEs were published on October 10, 2022: 3 critical, 10 high.
- Published
- 50
- Critical
- 3
- High
- 10
- Medium
- 9
- Low
- 2
- Unrated
- 26
- Now in CISA KEV
- 0
- Fix available
- 22
Most affected products
- Trend Micro Apex One
- 6
- Cisco IOS XE Software
- 5
- Fortinet FortiTester
- 5
- CERT/CC VINCE - The Vulnerability Information and Coordinat…
- 2
- Simple File List
- 2
- abdolence slack-morphism-rust · slack-morphism
- 1
- Advanced Comment Form
- 1
- aeson
- 1
- azure-rtos usbx
- 1
- Cisco IOS
- 1
Critical 3
- CVE-2021-44171A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiOS version 6.0.0 through 6.0.1Fortinet FortiOS
- CVE-2022-33872An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in Telnet login compoFortinet FortiTester
- CVE-2022-33874An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in SSH login componenFortinet FortiTester
High 10
- CVE-2022-34425Dell Enterprise SONiC OS, 4.0.0, 4.0.1, contain a cryptographic key vulnerability in SSH.Dell Enterprise SONiC OS
- CVE-2022-20837Cisco IOS XE Software DNS NAT Protocol Application Layer Gateway Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2022-20920Cisco IOS and IOS XE Software SSH Denial of Service VulnerabilityCisco IOS
- CVE-2022-20915Cisco IOS XE Software IPv6 VPN over MPLS Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2022-20870Cisco IOS XE Software for Catalyst Switches MPLS Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2022-29055A access of uninitialized pointer in Fortinet FortiOS version 7.2.0, 7.0.0 through 7.0.5, 6.4.0 through 6.4.8, 6.2.0 through 6.2.10, 6.0.x, Fortinet FortiOS, FortiProxy
- CVE-2022-35846An improper restriction of excessive authentication attempts vulnerability [CWE-307] in FortiTester Telnet port 2.3.0 through 3.9.1, 4.0.0 tFortinet FortiTester
- CVE-2022-36063USBX Host CDC ECM integer underflow with buffer overflowazure-rtos usbx
- CVE-2022-39288Denial of service in Fastify via Content-Type headerfastify
- CVE-2022-39292Exposure of sensitive Slack webhook URLs in debug logs and tracesabdolence slack-morphism-rust · slack-morphism
Medium, low and unrated 37
- CVE-2022-34402Dell Wyse ThinOS 2205 contains a Regular Expression Denial of Service Vulnerability in UI.Dell Wyse Proprietary OS
- CVE-2022-34334IBM Sterling Partner Engagement Manager 2.0 does not invalidate session after logout which could allow an authenticated user to impersonate IBM Sterling Partner Engagement Manager
- CVE-2022-20864Cisco IOS XE ROM Monitor Software for Catalyst Switches Information Disclosure VulnerabilityCisco IOS XE Software
- CVE-2022-20944Cisco IOS XE Software for Catalyst 9200 Series Switches Arbitrary Code Execution VulnerabilityCisco IOS XE Software
- CVE-2022-20830Cisco Software-Defined Application Visibility and Control on Cisco vManage Authentication Bypass VulnerabilityCisco SD-WAN vManage
- CVE-2021-25044Cryptocurrency Pricing list and Ticker <= 1.5 - Reflected Cross-Site ScriptingCryptocurrency Pricing list and Ticker
- CVE-2021-35226Hashed Credential Exposure VulnerabilitySolarWinds Network Configuration Manager
- CVE-2022-2350Disable User Login <= 1.0.1 - Unauthenticated Settings UpdateDisable User Login
- CVE-2022-2448reSmush.it Image Optimizer < 0.4.6 - Admin+ Cross-Site ScriptingreSmush.it : the only free Image Optimizer & compress plugin
- CVE-2022-2554Enable Media Replace < 4.0.0 - Admin+ Path TraversalEnable Media Replace
- CVE-2022-26121An exposure of resource to wrong sphere vulnerability [CWE-668] in FortiAnalyzer and FortiManager GUI 7.0.0 through 7.0.3, 6.4.0 through 6.4
- CVE-2022-2629Top Bar < 3.0.4 - Admin+ Stored Cross-Site ScriptingTop Bar
- CVE-2022-2823Slider, Gallery, and Carousel by MetaSlider < 3.27.9 - Admin+ Stored Cross Site ScriptingSlider, Gallery, and Carousel by MetaSlider – Responsive Wo…
- CVE-2022-2891WP 2FA < 2.3.0 - Time-Based Side-Channel AttackWP 2FA
- CVE-2022-2981Download Monitor < 4.5.98 - Admin+ Arbitrary File DownloadDownload Monitor
- CVE-2022-3136Social Rocket < 1.3.3 - Admin+ Stored Cross-Site ScriptingSocial Rocket – Social Sharing Plugin
- CVE-2022-3137TaskBuilder < 1.0.8 - Subscriber+ Stored XSS via SVG file uploadTaskbuilder – WordPress Project & Task Management plugin
- CVE-2022-3154Multiple Plugins from Viszt Peter - Multiple CSRFTODO Woo Billingo Plus · TODO Integration for Billingo &… +1
- CVE-2022-3207Simple File List < 4.4.12 - Admin+ Stored Cross-Site ScriptingSimple File List
- CVE-2022-3208Simple File List < 4.4.13 - Page Creation via CSRFSimple File List
- CVE-2022-3209Soledad < 8.2.5 - Reflected Cross-site Scriptingsoledad
- CVE-2022-3220Advanced Comment Form < 1.2.1 - Admin+ Authenticated Stored XSSAdvanced Comment Form
- CVE-2022-33873An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in Console login compFortinet FortiTester
- CVE-2022-3433The aeson library is not safe to use to consume untrusted JSON input.aeson
- CVE-2022-3438Open Redirect in ikus060/rdiffwebikus060/rdiffweb · rdiffweb
- CVE-2022-3442Crealogix EBICS ebics.aspx cross site scriptingCrealogix EBICS
- CVE-2022-35844An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiTester 2.3.0Fortinet FortiTester
- CVE-2022-40248An HTML injection vulnerability exists in CERT/CC VINCE software prior to version 1.50.4CERT/CC VINCE - The Vulnerability Information and Coordinat…
- CVE-2022-40257An HTML injection vulnerability exists in CERT/CC VINCE software prior to version 1.50.4CERT/CC VINCE - The Vulnerability Information and Coordinat…
- CVE-2022-41744A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One Vulnerability Protection integrated component could allow a local attaTrend Micro Apex One
- CVE-2022-41745An Out-of-Bounds access vulnerability in Trend Micro Apex One could allow a local attacker to create a specially crafted message to cause meTrend Micro Apex One
- CVE-2022-41746A forced browsing vulnerability in Trend Micro Apex One could allow an attacker with access to the Apex One console on affected installationTrend Micro Apex One
- CVE-2022-41747An improper certification validation vulnerability in Trend Micro Apex One agents could allow a local attacker to load a DLL file with systeTrend Micro Apex One
- CVE-2022-41748A registry permissions vulnerability in the Trend Micro Apex One Data Loss Prevention (DLP) module could allow a local attacker with adminisTrend Micro Apex One
- CVE-2022-41749An origin validation error vulnerability in Trend Micro Apex One agents could allow a local attacker to escalate privileges on affected instTrend Micro Apex One
- CVE-2022-42724app/Controller/UsersController.php in MISP before 2.4.164 allows attackers to discover role names (this is information that only the site ad
- CVE-2022-42725Warpinator through 1.2.14 allows access outside of an intended directory, as demonstrated by symbolic directory links.