# CVEs published 2022-10-10

50 CVEs were published on October 10, 2022: 3 critical, 10 high. Days are UTC.

- [CVE-2022-34425](https://cve.now/CVE-2022-34425.md): Dell Enterprise SONiC OS, 4.0.0, 4.0.1, contain a cryptographic key vulnerability in SSH. (CVSS 7.5, Dell Enterprise SONiC OS)
- [CVE-2022-34402](https://cve.now/CVE-2022-34402.md): Dell Wyse ThinOS 2205 contains a Regular Expression Denial of Service Vulnerability in UI. (CVSS 6.8, Dell Wyse Proprietary OS)
- [CVE-2022-34334](https://cve.now/CVE-2022-34334.md): IBM Sterling Partner Engagement Manager 2.0 does not invalidate session after logout which could allow an authenticated user to impersonate (CVSS 6.3, IBM Sterling Partner Engagement Manager)
- [CVE-2022-20864](https://cve.now/CVE-2022-20864.md): Cisco IOS XE ROM Monitor Software for Catalyst Switches Information Disclosure Vulnerability (CVSS 4.6, Cisco IOS XE Software)
- [CVE-2022-20837](https://cve.now/CVE-2022-20837.md): Cisco IOS XE Software DNS NAT Protocol Application Layer Gateway Denial of Service Vulnerability (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2022-20920](https://cve.now/CVE-2022-20920.md): Cisco IOS and IOS XE Software SSH Denial of Service Vulnerability (CVSS 7.7, Cisco IOS)
- [CVE-2022-20915](https://cve.now/CVE-2022-20915.md): Cisco IOS XE Software IPv6 VPN over MPLS Denial of Service Vulnerability (CVSS 7.4, Cisco IOS XE Software)
- [CVE-2022-20870](https://cve.now/CVE-2022-20870.md): Cisco IOS XE Software for Catalyst Switches MPLS Denial of Service Vulnerability (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2022-20944](https://cve.now/CVE-2022-20944.md): Cisco IOS XE Software for Catalyst 9200 Series Switches Arbitrary Code Execution Vulnerability (CVSS 6.1, Cisco IOS XE Software)
- [CVE-2022-20830](https://cve.now/CVE-2022-20830.md): Cisco Software-Defined Application Visibility and Control on Cisco vManage Authentication Bypass Vulnerability (CVSS 5.3, Cisco SD-WAN vManage)
- [CVE-2021-25044](https://cve.now/CVE-2021-25044.md): Cryptocurrency Pricing list and Ticker \<= 1.5 - Reflected Cross-Site Scripting (no CVSS, Cryptocurrency Pricing list and Ticker)
- [CVE-2021-35226](https://cve.now/CVE-2021-35226.md): Hashed Credential Exposure Vulnerability (CVSS 6.5, SolarWinds Network Configuration Manager)
- [CVE-2021-44171](https://cve.now/CVE-2021-44171.md): A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiOS version 6.0.0 through 6.0.1 (CVSS 9.0, Fortinet FortiOS)
- [CVE-2022-2350](https://cve.now/CVE-2022-2350.md): Disable User Login \<= 1.0.1 - Unauthenticated Settings Update (no CVSS, Disable User Login)
- [CVE-2022-2448](https://cve.now/CVE-2022-2448.md): reSmush.it Image Optimizer \< 0.4.6 - Admin+ Cross-Site Scripting (no CVSS, reSmush.it : the only free Image Optimizer & compress plugin)
- [CVE-2022-2554](https://cve.now/CVE-2022-2554.md): Enable Media Replace \< 4.0.0 - Admin+ Path Traversal (no CVSS, Enable Media Replace)
- [CVE-2022-26121](https://cve.now/CVE-2022-26121.md): An exposure of resource to wrong sphere vulnerability \[CWE-668\] in FortiAnalyzer and FortiManager GUI 7.0.0 through 7.0.3, 6.4.0 through 6.4 (CVSS 3.7)
- [CVE-2022-2629](https://cve.now/CVE-2022-2629.md): Top Bar \< 3.0.4 - Admin+ Stored Cross-Site Scripting (no CVSS, Top Bar)
- [CVE-2022-2823](https://cve.now/CVE-2022-2823.md): Slider, Gallery, and Carousel by MetaSlider \< 3.27.9 - Admin+ Stored Cross Site Scripting (no CVSS, Slider, Gallery, and Carousel by MetaSlider – Responsive Wo…)
- [CVE-2022-2891](https://cve.now/CVE-2022-2891.md): WP 2FA \< 2.3.0 - Time-Based Side-Channel Attack (no CVSS, WP 2FA)
- [CVE-2022-29055](https://cve.now/CVE-2022-29055.md): A access of uninitialized pointer in Fortinet FortiOS version 7.2.0, 7.0.0 through 7.0.5, 6.4.0 through 6.4.8, 6.2.0 through 6.2.10, 6.0.x, (CVSS 7.5, Fortinet FortiOS, FortiProxy)
- [CVE-2022-2981](https://cve.now/CVE-2022-2981.md): Download Monitor \< 4.5.98 - Admin+ Arbitrary File Download (no CVSS, Download Monitor)
- [CVE-2022-3136](https://cve.now/CVE-2022-3136.md): Social Rocket \< 1.3.3 - Admin+ Stored Cross-Site Scripting (no CVSS, Social Rocket – Social Sharing Plugin)
- [CVE-2022-3137](https://cve.now/CVE-2022-3137.md): TaskBuilder \< 1.0.8 - Subscriber+ Stored XSS via SVG file upload (no CVSS, Taskbuilder – WordPress Project & Task Management plugin)
- [CVE-2022-3154](https://cve.now/CVE-2022-3154.md): Multiple Plugins from Viszt Peter - Multiple CSRF (no CVSS, TODO Woo Billingo Plus · TODO Integration for Billingo &… +1)
- [CVE-2022-3207](https://cve.now/CVE-2022-3207.md): Simple File List \< 4.4.12 - Admin+ Stored Cross-Site Scripting (no CVSS, Simple File List)
- [CVE-2022-3208](https://cve.now/CVE-2022-3208.md): Simple File List \< 4.4.13 - Page Creation via CSRF (no CVSS, Simple File List)
- [CVE-2022-3209](https://cve.now/CVE-2022-3209.md): Soledad \< 8.2.5 - Reflected Cross-site Scripting (no CVSS, soledad)
- [CVE-2022-3220](https://cve.now/CVE-2022-3220.md): Advanced Comment Form \< 1.2.1 - Admin+ Authenticated Stored XSS (no CVSS, Advanced Comment Form)
- [CVE-2022-33872](https://cve.now/CVE-2022-33872.md): An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities \[CWE-78\] in Telnet login compo (CVSS 9.8, Fortinet FortiTester)
- [CVE-2022-33873](https://cve.now/CVE-2022-33873.md): An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities \[CWE-78\] in Console login comp (CVSS 6.8, Fortinet FortiTester)
- [CVE-2022-33874](https://cve.now/CVE-2022-33874.md): An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities \[CWE-78\] in SSH login componen (CVSS 9.8, Fortinet FortiTester)
- [CVE-2022-3433](https://cve.now/CVE-2022-3433.md): The aeson library is not safe to use to consume untrusted JSON input. (no CVSS, aeson)
- [CVE-2022-3438](https://cve.now/CVE-2022-3438.md): Open Redirect in ikus060/rdiffweb (CVSS 5.7, ikus060/rdiffweb · rdiffweb)
- [CVE-2022-3442](https://cve.now/CVE-2022-3442.md): Crealogix EBICS ebics.aspx cross site scripting (CVSS 3.5, Crealogix EBICS)
- [CVE-2022-35844](https://cve.now/CVE-2022-35844.md): An improper neutralization of special elements used in an OS command vulnerability \[CWE-78\] in the management interface of FortiTester 2.3.0 (CVSS 6.7, Fortinet FortiTester)
- [CVE-2022-35846](https://cve.now/CVE-2022-35846.md): An improper restriction of excessive authentication attempts vulnerability \[CWE-307\] in FortiTester Telnet port 2.3.0 through 3.9.1, 4.0.0 t (CVSS 8.1, Fortinet FortiTester)
- [CVE-2022-36063](https://cve.now/CVE-2022-36063.md): USBX Host CDC ECM integer underflow with buffer overflow (CVSS 7.6, azure-rtos usbx)
- [CVE-2022-39288](https://cve.now/CVE-2022-39288.md): Denial of service in Fastify via Content-Type header (CVSS 7.5, fastify)
- [CVE-2022-39292](https://cve.now/CVE-2022-39292.md): Exposure of sensitive Slack webhook URLs in debug logs and traces (CVSS 7.5, abdolence slack-morphism-rust · slack-morphism)
- [CVE-2022-40248](https://cve.now/CVE-2022-40248.md): An HTML injection vulnerability exists in CERT/CC VINCE software prior to version 1.50.4 (no CVSS, CERT/CC VINCE - The Vulnerability Information and Coordinat…)
- [CVE-2022-40257](https://cve.now/CVE-2022-40257.md): An HTML injection vulnerability exists in CERT/CC VINCE software prior to version 1.50.4 (no CVSS, CERT/CC VINCE - The Vulnerability Information and Coordinat…)
- [CVE-2022-41744](https://cve.now/CVE-2022-41744.md): A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One Vulnerability Protection integrated component could allow a local atta (no CVSS, Trend Micro Apex One)
- [CVE-2022-41745](https://cve.now/CVE-2022-41745.md): An Out-of-Bounds access vulnerability in Trend Micro Apex One could allow a local attacker to create a specially crafted message to cause me (no CVSS, Trend Micro Apex One)
- [CVE-2022-41746](https://cve.now/CVE-2022-41746.md): A forced browsing vulnerability in Trend Micro Apex One could allow an attacker with access to the Apex One console on affected installation (no CVSS, Trend Micro Apex One)
- [CVE-2022-41747](https://cve.now/CVE-2022-41747.md): An improper certification validation vulnerability in Trend Micro Apex One agents could allow a local attacker to load a DLL file with syste (no CVSS, Trend Micro Apex One)
- [CVE-2022-41748](https://cve.now/CVE-2022-41748.md): A registry permissions vulnerability in the Trend Micro Apex One Data Loss Prevention (DLP) module could allow a local attacker with adminis (no CVSS, Trend Micro Apex One)
- [CVE-2022-41749](https://cve.now/CVE-2022-41749.md): An origin validation error vulnerability in Trend Micro Apex One agents could allow a local attacker to escalate privileges on affected inst (no CVSS, Trend Micro Apex One)
- [CVE-2022-42724](https://cve.now/CVE-2022-42724.md): app/Controller/UsersController.php in MISP before 2.4.164 allows attackers to discover role names (this is information that only the site ad (no CVSS)
- [CVE-2022-42725](https://cve.now/CVE-2022-42725.md): Warpinator through 1.2.14 allows access outside of an intended directory, as demonstrated by symbolic directory links. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-10-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.