CVEs published October 11, 2022
269 CVEs were published on October 11, 2022: 22 critical, 99 high. 2 are now in CISA KEV.
- Published
- 269
- Critical
- 22
- High
- 99
- Medium
- 35
- Low
- 4
- Unrated
- 109
- Now in CISA KEV
- 2
- Fix available
- 111
Most affected products
- Microsoft Windows
- 64
- Android
- 28
- SAP SE SAP 3D Visual Enterprise Author
- 26
- SAP SE SAP 3D Visual Enterprise Viewer
- 17
- Siemens Desigo PXM30-1 · Siemens Desigo PXM30.E +8
- 7
- Microsoft SharePoint Enterprise Server · Microsoft Share… +1
- 4
- SAP SE SAP BusinessObjects Business Intelligence Platform
- 4
- Dell Hybrid Client
- 3
- Facebook Hermes
- 3
- Siemens LOGO! 12/24RCE · Siemens LOGO! 12/24RCEo +14
- 3
Critical 22
- CVE-2022-32174Gogs - XSSgogs · gogs.io/gogs
- CVE-2022-36361A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA1) (All versionSiemens LOGO! 12/24RCE · Siemens LOGO! 12/24RCEo +14
- CVE-2022-37968Azure Arc-enabled Kubernetes cluster Connect Elevation of Privilege VulnerabilityMicrosoft Azure Arc-enabled Kubernetes cluster · Microsoft…
- CVE-2022-38465A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP Siemens SIMATIC Drive Controller family · Siemens SIMATI… +7
- CVE-2022-41380The d8s-yaml package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.democritus-file-system · d8s-yaml
- CVE-2022-41381The d8s-utility package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.democritus-file-system · d8s-utility
- CVE-2022-41382The d8s-json package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.democritus-file-system · d8s-json
- CVE-2022-41383The d8s-archives package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.d8s-archives · democritus-file-system
- CVE-2022-41384The d8s-domains package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.democritus-urls · d8s-domains
- CVE-2022-41385The d8s-html package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.democritus-urls · d8s-html
- CVE-2022-41386The d8s-utility package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.democritus-urls · d8s-utility
- CVE-2022-41387The d8s-pdfs package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.democritus-urls · d8s-pdfs
- CVE-2022-41408Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/view_order.
- CVE-2022-41665A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.10), SICAM P850 (7KG8500-0AA00-2AA0) (All versionsSiemens SICAM P850 · Siemens SICAM P855 +1
- CVE-2022-42037The d8s-asns package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.d8s-asns · democritus-csv
- CVE-2022-42038The d8s-ip-addresses package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.
- CVE-2022-42039The d8s-lists package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.d8s-lists · democritus-dicts
- CVE-2022-42040The d8s-algorithms package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.d8s-algorithms · democritus-dicts
- CVE-2022-42041The d8s-file-system package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.democritus-hashes · d8s-file-system
- CVE-2022-42042The d8s-networking package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.democritus-hashes · d8s-networking
- CVE-2022-42043The d8s-xml package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.d8s-xml · democritus-html
- CVE-2022-42044The d8s-asns package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.democritus-html · d8s-asns
High 99
- CVE-2021-36913Redirection for Contact Form 7 <= 2.4.0 - Unauthenticated Options Change and Content Injection vulnerabilityQube One Redirection for Contact Form
- CVE-2022-34432Dell Hybrid Client below 1.8 version contains a gedit vulnerability.Dell Hybrid Client
- CVE-2022-34430Dell Hybrid Client below 1.8 version contains a Zip Bomb Vulnerability in UI.Dell Hybrid Client
- CVE-2022-34427Dell Container Storage Modules 1.2 contains an OS Command Injection in goiscsi and gobrick libraries.Dell Container Storage Modules
- CVE-2022-34426Dell Container Storage Modules 1.2 contains an Improper Limitation of a Pathname to a Restricted Directory in goiscsi and gobrick libraries Dell Container Storage Modules
- CVE-2022-32492Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2022-32486Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2022-22035Windows Point-to-Point Tunneling Protocol Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-24504Windows Point-to-Point Tunneling Protocol Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-30198Windows Point-to-Point Tunneling Protocol Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-31765Affected devices do not properly authorize the change password function of the web interface.Siemens RUGGEDCOM RM1224 LTE(4G) EU · Siemens RUGGEDCOM… +86
- CVE-2022-31766A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.1.2), RUGGEDCOM RM1224 LTE(4G) NASiemens RUGGEDCOM RM1224 LTE(4G) EU · Siemens RUGGEDCOM… +16
- CVE-2022-33634Windows Point-to-Point Tunneling Protocol Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-33635Windows GDI+ Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-33645Windows TCP/IP Driver Denial of Service VulnerabilityMicrosoft Windows
- CVE-2022-34689Windows CryptoAPI Spoofing VulnerabilityMicrosoft Windows
- CVE-2022-36362A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions), LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versionsSiemens LOGO! 12/24RCE · Siemens LOGO! 12/24RCEo +14
- CVE-2022-37970Windows DWM Core Library Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-37971Microsoft Windows Defender Elevation of Privilege VulnerabilityMicrosoft Malware Protection Engine
- CVE-2022-37973Windows Local Session Manager (LSM) Denial of Service VulnerabilityMicrosoft Windows
- CVE-2022-37975Windows Group Policy Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-37976Active Directory Certificate Services Elevation of Privilege VulnerabilityMicrosoft Windows Server
- CVE-2022-37978Windows Active Directory Certificate Services Security Feature BypassMicrosoft Windows
- CVE-2022-37979Windows Hyper-V Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-37980Windows DHCP Client Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-37982Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-37983Microsoft DWM Core Library Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-37984Windows WLAN Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-37986Windows Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-37987Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-37988Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-37989Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-37990Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-37991Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-37993Windows Group Policy Preference Client Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-37994Windows Group Policy Preference Client Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-37995Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-37997Windows Graphics Component Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-37998Windows Local Session Manager (LSM) Denial of Service VulnerabilityMicrosoft Windows
- CVE-2022-37999Windows Group Policy Preference Client Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-38000Windows Point-to-Point Tunneling Protocol Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-38003Windows Resilient File System Elevation of PrivilegeMicrosoft Windows
- CVE-2022-38016Windows Local Security Authority (LSA) Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-38021Connected User Experiences and Telemetry Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-38027Windows Storage Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-38028Windows Print Spooler Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-38029Windows ALPC Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-38031Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-38034Windows Workstation Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-38036Internet Key Exchange (IKE) Protocol Denial of Service VulnerabilityMicrosoft Windows Server · Microsoft Windows
- CVE-2022-38037Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-38038Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-38039Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-38040Microsoft ODBC Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-38041Windows Secure Channel Denial of Service VulnerabilityMicrosoft Windows
- CVE-2022-38042Active Directory Domain Services Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-38044Windows CD-ROM File System Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-38045Windows Server Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-38046Web Account Manager Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2022-38047Windows Point-to-Point Tunneling Protocol Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-38048Microsoft Office Remote Code Execution VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise
- CVE-2022-38049Microsoft Office Graphics Remote Code Execution VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise
- CVE-2022-38050Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-38051Windows Graphics Component Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-38053Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft Share… +1
- CVE-2022-38138The Triangle Microworks IEC 61850 Library (Any client or server using the C language library with a version number of 11.2.0 or earlier and Triangle Microworks Library: IEC
- CVE-2022-38371A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (Siemens APOGEE MBC (PPC) · Siemens APOGEE MEC (PPC) +20
- CVE-2022-39271Traefik HTTP/2 connections management could cause a denial of servicetraefik · github.com/traefik/traefik/v2
- CVE-2022-39296Path traversal in MelisAssetManagermelisplatform melis-asset-manager · melisplatform/melis-ass…
- CVE-2022-40226A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.10), SICAM P850 (7KG8500-0AA00-2AA0) (All versionsSiemens SICAM P850 · Siemens SICAM P855 +1
- CVE-2022-40227A vulnerability has been identified in SIMATIC HMI Comfort Panels (incl.Siemens SIMATIC HMI Comfort Panels · Siemens SIMATIC HMI… +8
- CVE-2022-41031Microsoft Word Remote Code Execution VulnerabilityMicrosoft Office LTSC · Microsoft 365 Apps for Enterprise +1
- CVE-2022-41032NuGet Client Elevation of Privilege VulnerabilityMicrosoft .NET · Microsoft Visual Studio +3
- CVE-2022-41033Windows COM+ Event System Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-41034Visual Studio Code Remote Code Execution VulnerabilityMicrosoft Visual Studio Code
- CVE-2022-41036Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft Share… +1
- CVE-2022-41037Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft Share… +1
- CVE-2022-41038Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft Share… +1
- CVE-2022-41042Visual Studio Code Information Disclosure VulnerabilityMicrosoft Visual Studio Code
- CVE-2022-41081Windows Point-to-Point Tunneling Protocol Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-41083Visual Studio Code Elevation of Privilege VulnerabilityMicrosoft Jupyter Extension for Visual Studio Code
- CVE-2022-41189Due to lack of proper memory management, when a victim opens a manipulated AutoCAD (.dwg, TeighaTranslator.exe) file received from untrustedSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2022-41191Due to lack of proper memory management, when a victim opens a manipulated Jupiter Tesselation (.jt, JTReader.x3d) file received from untrusSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2022-41199Due to lack of proper memory management, when a victim opens a manipulated Open Inventor File (.iv, vrml.x3d) file received from untrusted sSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2022-41201Due to lack of proper memory management, when a victim opens a manipulated Right Hemisphere Binary (.rh, rh.x3d) file received from untrusteSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2022-41202Due to lack of proper memory management, when a victim opens a manipulated Visual Design Stream (.vds, vds.x3d) file received from untrustedSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2022-41204An attacker can change the content of an SAP Commerce - versions 1905, 2005, 2105, 2011, 2205, login page through a manipulated URL.SAP SE SAP Commerce
- CVE-2022-41404An issue in the fetch() method in the BasicProfile class of org.ini4j through version v0.5.4 allows attackers to cause a Denial of Service (org.ini4j:ini4j
- CVE-2022-41406An arbitrary file upload vulnerability in the /admin/admin_pic.php component of Church Management System v1.0 allows attackers to execute ar
- CVE-2022-41407Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/view_order.
- CVE-2022-41530Open Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /sacco_shield/ajax.
- CVE-2022-41532Open Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /sacco_shield/ajax.
- CVE-2022-41851A vulnerability has been identified in JTTK (All versions < V11.1.1.0), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap Siemens JTTK · Siemens Simcenter Femap
- CVE-2022-42034Wedding Planner v1.0 is vulnerable to arbitrary code execution via users_profile.php.
- CVE-2022-42229Wedding Planner v1.0 is vulnerable to Arbitrary code execution via package_edit.php.
- CVE-2022-42230Simple Cold Storage Management System v1.0 is vulnerable to SQL Injection via /csms/admin/?page=user/manage_user&id=.
- CVE-2022-42238A Vertical Privilege Escalation issue in Merchandise Online Store v.1.0 allows an attacker to get access to the admin dashboard.
- CVE-2022-42717An issue was discovered in Hashicorp Packer before 2.3.1.
- CVE-2022-42731mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a udjango-mfa2
Medium, low and unrated 148
- CVE-2021-36201CCURE Observable Response DiscrepancyJohnson Controls C•CURE
- CVE-2022-38086WordPress Shortcodes Ultimate plugin <= 5.12.0 - Cross-Site Request Forgery (CSRF) vulnerabilityVladimir Anokhin Shortcodes Ultimate
- CVE-2021-36915WordPress Profile Builder plugin <= 3.6.0 - Cross-Site Request Forgery (CSRF) vulnerabilityCozmoslabs Profile Builder – User Profile & User Registrati…
- CVE-2021-36899WordPress Asset CleanUp: Page Speed Booster plugin <= 1.3.8.4 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilityGabe Livan Asset CleanUp: Page Speed Booster
- CVE-2022-33978WordPress FontMeister plugin <= 1.08 - Reflected Cross-Site Scripting (XSS) vulnerabilitySayontan Sinha FontMeister
- CVE-2022-34434Cloud Mobility for Dell Storage versions 1.3.0 and earlier contains an Improper Access Control vulnerability within the Postgres database.Cloud Mobility for Dell Storage
- CVE-2022-34431Dell Hybrid Client below 1.8 version contains a guest user profile corruption vulnerability.Dell Hybrid Client
- CVE-2022-38388IBM Navigator Mobile Android 3.4.1.1 and 3.4.1.2 app could allow a local user to obtain sensitive information due to improper access controlIBM Navigator Mobile
- CVE-2022-3358Using a Custom Cipher with NID_undef may lead to NULL encryptionOpenSSL · openssl-src
- CVE-2022-32175AdGuardHome - CSRFAdguardHome · github.com/AdguardTeam/AdGuardHome
- CVE-2020-14129A logic vulnerability exists in a Xiaomi product.Xiaomi a certain APP
- CVE-2020-14131The Xiaomi Security Center expresses heartfelt thanks to ADLab of VenusTech ! At the same time, we also welcome more outstanding and professXiaomi specific devices
- CVE-2021-0696In dllist_remove_node of TBD, there is a possible use after free bug due to a race condition.Android
- CVE-2021-0951In DevmemIntHeapAcquire of TBD, there is a possible arbitrary code execution due to an integer overflow.Android
- CVE-2022-20351In queryInternal of CallLogProvider.java, there is a possible access to voicemail information due to SQL injection.Android
- CVE-2022-20394In getInputMethodWindowVisibleHeight of InputMethodManagerService.java, there is a possible way to determine when another app is showing an Android
- CVE-2022-20409In io_identity_cow of io_uring.c, there is a possible way to corrupt memory due to a use after free.Android
- CVE-2022-20410In avrc_ctrl_pars_vendor_rsp of avrc_pars_ct.cc, there is a possible out of bounds read due to an integer overflow.Android
- CVE-2022-20412In fdt_next_tag of fdt.c, there is a possible out of bounds read due to an incorrect bounds check.Android
- CVE-2022-20413In start of Threads.cpp, there is a possible way to record audio during a phone call due to a logic error in the code.Android
- CVE-2022-20415In handleFullScreenIntent of StatusBarNotificationActivityStarter.java, there is a possible bypass of the restriction of starting activity fAndroid
- CVE-2022-20416In audioTransportsToHal of HidlUtils.cpp, there is a possible out of bounds write due to an incorrect bounds check.Android
- CVE-2022-20417In audioTransportsToHal of HidlUtils.cpp, there is a possible out of bounds write due to an incorrect bounds check.Android
- CVE-2022-20418In pickStartSeq of AAVCAssembler.cpp, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2022-20419In setOptions of ActivityRecord.java, there is a possible load any arbitrary Java code into launcher process due to a logic error in the codAndroid
- CVE-2022-20420In getBackgroundRestrictionExemptionReason of AppRestrictionController.java, there is a possible way to bypass device policy restrictions duAndroid
- CVE-2022-20421In binder_inc_ref_for_node of binder.c, there is a possible way to corrupt memory due to a use after free.Android · :linux_kernel:
- CVE-2022-20422In emulation_proc_handler of armv8_deprecated.c, there is a possible way to corrupt memory due to a race condition.Android · :linux_kernel:
- CVE-2022-20423In rndis_set_response of rndis.c, there is a possible out of bounds write due to an integer overflow.Android
- CVE-2022-20425In addAutomaticZenRule of ZenModeHelper.java, there is a possible permanent degradation of performance due to resource exhaustion.Android
- CVE-2022-20429In CarSettings of app packages, there is a possible permission bypass due to a confused deputy.Android
- CVE-2022-20430There is an missing authorization issue in the system service.Android
- CVE-2022-20431There is an missing authorization issue in the system service.Android
- CVE-2022-20432There is an missing authorization issue in the system service.Android
- CVE-2022-20433There is an missing authorization issue in the system service.Android
- CVE-2022-20434There is an missing authorization issue in the system service.Android
- CVE-2022-20435There is a Unauthorized service in the system service, may cause the system reboot.Android
- CVE-2022-20436There is an unauthorized service in the system service.Android
- CVE-2022-20437In Messaging, There has unauthorized broadcast, this could cause Local Deny of Service.Product: AndroidVersions: Android SoCAndroid ID: A-24Android
- CVE-2022-20438In Messaging, There has unauthorized broadcast, this could cause Local Deny of Service.Product: AndroidVersions: Android SoCAndroid ID: A-24Android
- CVE-2022-20439In Messaging, There has unauthorized provider, this could cause Local Deny of Service.Product: AndroidVersions: Android SoCAndroid ID: A-242Android
- CVE-2022-20440In Messaging, There has unauthorized broadcast, this could cause Local Deny of Service.Product: AndroidVersions: Android SoCAndroid ID: A-24Android
- CVE-2022-28866Multiple Improper Access Control was discovered in Nokia AirFrame BMC Web GUI < R18 Firmware v4.13.00.
- CVE-2022-3140Macro URL arbitrary script executionThe Document Foundation LibreOffice
- CVE-2022-31682VMware Aria Operations contains an arbitrary file read vulnerability.VMware Aria Operations
- CVE-2022-32234An out of bounds write in hermes, while handling large arrays, prior to commit 06eaec767e376bfdb883d912cb15e987ddf2bda1 allows attackers to Facebook Hermes
- CVE-2022-33746P2M pool freeing may take excessively long The P2M pool backing second level address translation for guests may be of significant size.xen
- CVE-2022-33747Arm: unbounded memory consumption for 2nd-level page tables Certain actions require e.g.xen
- CVE-2022-33748lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was inserted on an error handling path.xen
- CVE-2022-33749XAPI open file limit DoS It is possible for an unauthenticated client on the network to cause XAPI to hit its file-descriptor limit.Xapi
- CVE-2022-3452SourceCodester Book Store Management System category.php cross site scriptingSourceCodester Book Store Management System
- CVE-2022-3453SourceCodester Book Store Management System transcation.php cross site scriptingSourceCodester Book Store Management System
- CVE-2022-35226SAP Data Services Management allows an attacker to copy the data from a request and echoed into the application's immediate response, it wilSAP SE SAP Data Services Management Console
- CVE-2022-35289A write-what-where condition in hermes caused by an integer overflow, prior to commit 5b6255ae049fa4641791e47fad994e8e8c4da374 allows attackFacebook Hermes
- CVE-2022-35296Under certain conditions, the application SAP BusinessObjects Business Intelligence Platform (Version Management System) exposes sensitive iSAP SE SAP BusinessObjects Business Intelligence Platform
- CVE-2022-35297The application SAP Enable Now does not sufficiently encode user-controlled inputs over the network before it is placed in the output being SAP SE SAP Enable Now
- CVE-2022-35299SAP SQL Anywhere - version 17.0, and SAP IQ - version 16.1, allows an attacker to leverage logical errors in memory management to cause a meSAP SE SAP SQL Anywhere · SAP SE SAP IQ
- CVE-2022-35770Windows NTLM Spoofing VulnerabilityMicrosoft Windows
- CVE-2022-35829Service Fabric Explorer Spoofing VulnerabilityMicrosoft Azure Service Fabric Explorer
- CVE-2022-36360A vulnerability has been identified in LOGO! 8 BM (incl.Siemens LOGO! 8 BM
- CVE-2022-36363A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA1) (All versionSiemens LOGO! 12/24RCE · Siemens LOGO! 12/24RCEo +14
- CVE-2022-37599A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.loader-utils
- CVE-2022-37609Prototype pollution vulnerability in beautify-web js-beautify 1.13.7 via the name variable in options.js.
- CVE-2022-37616A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 f
- CVE-2022-37617Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the k variable in resobrowserify-shim
- CVE-2022-37864A vulnerability has been identified in Solid Edge (All Versions < SE2022MP9).Siemens Solid Edge
- CVE-2022-37965Windows Point-to-Point Tunneling Protocol Denial of Service VulnerabilityMicrosoft Windows
- CVE-2022-37974Windows Mixed Reality Developer Tools Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2022-37977Local Security Authority Subsystem Service (LSASS) Denial of Service VulnerabilityMicrosoft Windows
- CVE-2022-37981Windows Event Logging Service Denial of Service VulnerabilityMicrosoft Windows
- CVE-2022-37985Windows Graphics Component Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2022-37996Windows Kernel Memory Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2022-38001Microsoft Office Spoofing VulnerabilityMicrosoft Office LTSC · Microsoft 365 Apps for Enterprise +1
- CVE-2022-38017StorSimple 8000 Series Elevation of Privilege VulnerabilityMicrosoft Azure StorSimple 8000 Series
- CVE-2022-38022Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-38025Windows Distributed File System (DFS) Information Disclosure VulnerabilityMicrosoft Windows Server · Microsoft Windows
- CVE-2022-38026Windows DHCP Client Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2022-38030Windows USB Serial Driver Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2022-38032Windows Portable Device Enumerator Service Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2022-38033Windows Server Remotely Accessible Registry Keys Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2022-38043Windows Security Support Provider Interface Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2022-39013Under certain conditions an authenticated attacker can get access to OS credentials.SAP SE SAP BusinessObjects Business Intelligence Platform
- CVE-2022-39015Under certain conditions, BOE AdminTools/ BOE SDK allows an attacker to access information which would otherwise be restricted.SAP SE SAP BusinessObjects Business Intelligence Platform
- CVE-2022-39800SAP BusinessObjects BI LaunchPad - versions 420, 430, is susceptible to script execution attack by an unauthenticated attacker due to impropSAP SE SAP BusinessObjects Business Intelligence Platform
- CVE-2022-39802SAP Manufacturing Execution - versions 15.1, 15.2, 15.3, allows an attacker to exploit insufficient validation of a file path request parameSAP SE SAP Manufacturing Execution
- CVE-2022-39803Due to lack of proper memory management, when a victim opens a manipulated ACIS Part and Assembly (.sat, CoreCadTranslator.exe) file receiveSAP SE SAP 3D Visual Enterprise Author
- CVE-2022-39804Due to lack of proper memory management, when a victim opens a manipulated SolidWorks Part (.sldprt, CoreCadTranslator.exe) file received frSAP SE SAP 3D Visual Enterprise Author
- CVE-2022-39805Due to lack of proper memory management, when a victim opens a manipulated Computer Graphics Metafile (.cgm, CgmTranslator.exe) file receiveSAP SE SAP 3D Visual Enterprise Author
- CVE-2022-39806Due to lack of proper memory management, when a victim opens a manipulated SolidWorks Drawing (.slddrw, CoreCadTranslator.exe) file receivedSAP SE SAP 3D Visual Enterprise Author
- CVE-2022-39807Due to lack of proper memory management, when a victim opens manipulated SolidWorks Drawing (.sldasm, CoreCadTranslator.exe) file received fSAP SE SAP 3D Visual Enterprise Author
- CVE-2022-39808Due to lack of proper memory management, when a victim opens a manipulated Wavefront Object (.obj, ObjTranslator.exe) file received from untSAP SE SAP 3D Visual Enterprise Author
- CVE-2022-40047Flatpress v1.2.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the page parameter at /flatpress/admin.p
- CVE-2022-40138An integer conversion error in Hermes bytecode generation, prior to commit 6aa825e480d48127b480b08d13adf70033237097, could have been used toFacebook Hermes
- CVE-2022-40147A vulnerability has been identified in Industrial Edge Management (All versions < V1.5.1).Siemens Industrial Edge Management
- CVE-2022-40176A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), DSiemens Desigo PXM30-1 · Siemens Desigo PXM30.E +8
- CVE-2022-40177A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), DSiemens Desigo PXM30-1 · Siemens Desigo PXM30.E +8
- CVE-2022-40178A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), DSiemens Desigo PXM30-1 · Siemens Desigo PXM30.E +8
- CVE-2022-40179A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), DSiemens Desigo PXM30-1 · Siemens Desigo PXM30.E +8
- CVE-2022-40180A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), DSiemens Desigo PXM30-1 · Siemens Desigo PXM30.E +8
- CVE-2022-40181A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), DSiemens Desigo PXM30-1 · Siemens Desigo PXM30.E +8
- CVE-2022-40182A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), DSiemens Desigo PXM30-1 · Siemens Desigo PXM30.E +8
- CVE-2022-40440mxGraph v4.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the setTooltips() function.mxgraph
- CVE-2022-40631A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5.0), SCALANCE X201-3P IRT (All versions < V5.5.0), SCALANCE Siemens SCALANCE X200-4P IRT · Siemens SCALANCE X201-3P… +24
- CVE-2022-40777Interspire Email Marketer through 6.5.0 allows arbitrary file upload via a surveys_submit.php "create survey and submit survey" operation, w
- CVE-2022-40921DedeCMS V5.7.99 was discovered to contain an arbitrary file upload vulnerability via the component /dede/file_manage_control.php.
- CVE-2022-41035Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2022-41043Microsoft Office Information Disclosure VulnerabilityMicrosoft Office 2019 for Mac · Microsoft Office LTSC for M…
- CVE-2022-41166Due to lack of proper memory management, when a victim opens manipulated Wavefront Object (.obj, ObjTranslator.exe) file received from untruSAP SE SAP 3D Visual Enterprise Author
- CVE-2022-41167Due to lack of proper memory management, when a victim opens a manipulated AutoCAD (.dwg, TeighaTranslator.exe) file received from untrustedSAP SE SAP 3D Visual Enterprise Author
- CVE-2022-41168Due to lack of proper memory management, when a victim opens a manipulated CATIA5 Part (.catpart, CatiaTranslator.exe) file received from unSAP SE SAP 3D Visual Enterprise Author
- CVE-2022-41169Due to lack of proper memory management, when a victim opens manipulated CATIA5 Part (.catpart, CatiaTranslator.exe) file received from untrSAP SE SAP 3D Visual Enterprise Author
- CVE-2022-41170Due to lack of proper memory management, when a victim opens a manipulated CATIA4 Part (.model, CatiaTranslator.exe) file received from untrSAP SE SAP 3D Visual Enterprise Author
- CVE-2022-41171Due to lack of proper memory management, when a victim opens manipulated CATIA4 Part (.model, CatiaTranslator.exe) file received from untrusSAP SE SAP 3D Visual Enterprise Author
- CVE-2022-41172Due to lack of proper memory management, when a victim opens a manipulated AutoCAD (.dxf, TeighaTranslator.exe) file received from untrustedSAP SE SAP 3D Visual Enterprise Author
- CVE-2022-41173Due to lack of proper memory management, when a victim opens manipulated AutoCAD (.dxf, TeighaTranslator.exe) file received from untrusted sSAP SE SAP 3D Visual Enterprise Author
- CVE-2022-41174Due to lack of proper memory management, when a victim opens manipulated Right Hemisphere Material (.rhm, rh.x3d) file received from untrustSAP SE SAP 3D Visual Enterprise Author
- CVE-2022-41175Due to lack of proper memory management, when a victim opens a manipulated Enhanced Metafile (.emf, emf.x3d) file received from untrusted soSAP SE SAP 3D Visual Enterprise Author
- CVE-2022-41176Due to lack of proper memory management, when a victim opens manipulated Enhanced Metafile (.emf, emf.x3d) file received from untrusted sourSAP SE SAP 3D Visual Enterprise Author
- CVE-2022-41177Due to lack of proper memory management, when a victim opens a manipulated Iges Part and Assembly (.igs, .iges, CoreCadTranslator.exe) file SAP SE SAP 3D Visual Enterprise Author
- CVE-2022-41178Due to lack of proper memory management, when a victim opens manipulated Iges Part and Assembly (.igs, .iges, CoreCadTranslator.exe) file reSAP SE SAP 3D Visual Enterprise Author
- CVE-2022-41179Due to lack of proper memory management, when a victim opens a manipulated Jupiter Tesselation (.jt, JtTranslator.exe) file received from unSAP SE SAP 3D Visual Enterprise Author
- CVE-2022-41180Due to lack of proper memory management, when a victim opens a manipulated Portable Document Format (.pdf, PDFPublishing.dll) file received SAP SE SAP 3D Visual Enterprise Author
- CVE-2022-41181Due to lack of proper memory management, when a victim opens manipulated Portable Document Format (.pdf, PDFPublishing.dll) file received frSAP SE SAP 3D Visual Enterprise Author
- CVE-2022-41182Due to lack of proper memory management, when a victim opens manipulated Parasolid Part and Assembly (.x_b, CoreCadTranslator.exe) file receSAP SE SAP 3D Visual Enterprise Author
- CVE-2022-41183Due to lack of proper memory management, when a victim opens manipulated Windows Cursor File (.cur, ico.x3d) file received from untrusted soSAP SE SAP 3D Visual Enterprise Author
- CVE-2022-41184Due to lack of proper memory management, when a victim opens a manipulated Windows Cursor File (.cur, ico.x3d) file received from untrusted SAP SE SAP 3D Visual Enterprise Author
- CVE-2022-41185Due to lack of proper memory management, when a victim opens a manipulated Visual Design Stream (.vds, MataiPersistence.dll) file received fSAP SE SAP 3D Visual Enterprise Author
- CVE-2022-41186Due to lack of proper memory management, when a victim opens manipulated Computer Graphics Metafile (.cgm, CgmCore.dll) file received from uSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2022-41187Due to lack of proper memory management, when a victim opens a manipulated Wavefront Object (.obj, ObjTranslator.exe) file received from untSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2022-41188Due to lack of proper memory management, when a victim opens manipulated Wavefront Object (.obj, ObjTranslator.exe) file received from untruSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2022-41190Due to lack of proper memory management, when a victim opens a manipulated AutoCAD (.dxf, TeighaTranslator.exe) file received from untrustedSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2022-41192Due to lack of proper memory management, when a victim opens manipulated Jupiter Tesselation (.jt, JTReader.x3d) file received from untrusteSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2022-41193Due to lack of proper memory management, when a victim opens a manipulated Encapsulated Post Script (.eps, ai.x3d) file received from untrusSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2022-41194Due to lack of proper memory management, when a victim opens a manipulated Encapsulated Postscript (.eps, ai.x3d) file received from untrustSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2022-41195Due to lack of proper memory management, when a victim opens a manipulated EAAmiga Interchange File Format (.iff, 2d.x3d) file received fromSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2022-41196Due to lack of proper memory management, when a victim opens a manipulated VRML Worlds (.wrl, vrml.x3d) file received from untrusted sourcesSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2022-41197Due to lack of proper memory management, when a victim opens a manipulated VRML Worlds (.wrl, vrml.x3d) file received from untrusted sourcesSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2022-41198Due to lack of proper memory management, when a victim opens a manipulated SketchUp (.skp, SketchUp.x3d) file received from untrusted sourceSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2022-41200Due to lack of proper memory management, when a victim opens a manipulated Scalable Vector Graphic (.svg, svg.x3d) file received from untrusSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2022-41206SAP BusinessObjects Business Intelligence platform (Analysis for OLAP) - versions 420, 430, allows an authenticated attacker to send user-coSAP SE SAP BusinessObjects Business Intelligence platform
- CVE-2022-41209SAP Customer Data Cloud (Gigya mobile app for Android) - version 7.4, uses encryption method which lacks proper diffusion and does not hide SAP SE SAP Customer Data Cloud
- CVE-2022-41210SAP Customer Data Cloud (Gigya mobile app for Android) - version 7.4, uses insecure random number generator program which makes it easy for SAP SE SAP Customer Data Cloud
- CVE-2022-41376Metro UI v4.4.0 to v4.5.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Javascript function.metro4
- CVE-2022-41550GNU oSIP v5.3.0 was discovered to contain an integer overflow via the component osip_body_parse_header.
- CVE-2022-41606HashiCorp Nomad and Nomad Enterprise 1.0.2 up to 1.2.12, and 1.3.5 jobs submitted with an artifact stanza using invalid S3 or GCS URLs can bgithub.com/hashicorp/nomad
- CVE-2022-42036The d8s-urls package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.democritus-csv · d8s-urls
- CVE-2022-42235A Stored XSS issue in Student Clearance System v.1.0 allows the injection of arbitrary JavaScript in the Student registration form.
- CVE-2022-42236A Stored XSS issue in Merchandise Online Store v.1.0 allows to injection of Arbitrary JavaScript in edit account form.