# CVEs published 2022-10-11

269 CVEs were published on October 11, 2022: 22 critical, 99 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2021-36201](https://cve.now/CVE-2021-36201.md): CCURE Observable Response Discrepancy (CVSS 4.3, Johnson Controls C•CURE)
- [CVE-2022-38086](https://cve.now/CVE-2022-38086.md): WordPress Shortcodes Ultimate plugin \<= 5.12.0 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Vladimir Anokhin Shortcodes Ultimate)
- [CVE-2021-36915](https://cve.now/CVE-2021-36915.md): WordPress Profile Builder plugin \<= 3.6.0 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 4.2, Cozmoslabs Profile Builder – User Profile & User Registrati…)
- [CVE-2021-36913](https://cve.now/CVE-2021-36913.md): Redirection for Contact Form 7 \<= 2.4.0 - Unauthenticated Options Change and Content Injection vulnerability (CVSS 7.5, Qube One Redirection for Contact Form)
- [CVE-2021-36899](https://cve.now/CVE-2021-36899.md): WordPress Asset CleanUp: Page Speed Booster plugin \<= 1.3.8.4 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, Gabe Livan Asset CleanUp: Page Speed Booster)
- [CVE-2022-33978](https://cve.now/CVE-2022-33978.md): WordPress FontMeister plugin \<= 1.08 - Reflected Cross-Site Scripting (XSS) vulnerability (CVSS 6.1, Sayontan Sinha FontMeister)
- [CVE-2022-34434](https://cve.now/CVE-2022-34434.md): Cloud Mobility for Dell Storage versions 1.3.0 and earlier contains an Improper Access Control vulnerability within the Postgres database. (CVSS 6.7, Cloud Mobility for Dell Storage)
- [CVE-2022-34432](https://cve.now/CVE-2022-34432.md): Dell Hybrid Client below 1.8 version contains a gedit vulnerability. (CVSS 7.3, Dell Hybrid Client)
- [CVE-2022-34431](https://cve.now/CVE-2022-34431.md): Dell Hybrid Client below 1.8 version contains a guest user profile corruption vulnerability. (CVSS 6.5, Dell Hybrid Client)
- [CVE-2022-34430](https://cve.now/CVE-2022-34430.md): Dell Hybrid Client below 1.8 version contains a Zip Bomb Vulnerability in UI. (CVSS 7.1, Dell Hybrid Client)
- [CVE-2022-34427](https://cve.now/CVE-2022-34427.md): Dell Container Storage Modules 1.2 contains an OS Command Injection in goiscsi and gobrick libraries. (CVSS 8.8, Dell Container Storage Modules)
- [CVE-2022-34426](https://cve.now/CVE-2022-34426.md): Dell Container Storage Modules 1.2 contains an Improper Limitation of a Pathname to a Restricted Directory in goiscsi and gobrick libraries (CVSS 8.8, Dell Container Storage Modules)
- [CVE-2022-32492](https://cve.now/CVE-2022-32492.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 7.5, Dell CPG BIOS)
- [CVE-2022-32486](https://cve.now/CVE-2022-32486.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 7.5, Dell CPG BIOS)
- [CVE-2022-38388](https://cve.now/CVE-2022-38388.md): IBM Navigator Mobile Android 3.4.1.1 and 3.4.1.2 app could allow a local user to obtain sensitive information due to improper access control (CVSS 4.0, IBM Navigator Mobile)
- [CVE-2022-3358](https://cve.now/CVE-2022-3358.md): Using a Custom Cipher with NID\_undef may lead to NULL encryption (no CVSS, OpenSSL · openssl-src)
- [CVE-2022-32174](https://cve.now/CVE-2022-32174.md): Gogs - XSS (CVSS 9.0, gogs · gogs.io/gogs)
- [CVE-2022-32175](https://cve.now/CVE-2022-32175.md): AdGuardHome - CSRF (CVSS 5.4, AdguardHome · github.com/AdguardTeam/AdGuardHome)
- [CVE-2020-14129](https://cve.now/CVE-2020-14129.md): A logic vulnerability exists in a Xiaomi product. (no CVSS, Xiaomi a certain APP)
- [CVE-2020-14131](https://cve.now/CVE-2020-14131.md): The Xiaomi Security Center expresses heartfelt thanks to ADLab of VenusTech ! At the same time, we also welcome more outstanding and profess (no CVSS, Xiaomi specific devices)
- [CVE-2021-0696](https://cve.now/CVE-2021-0696.md): In dllist\_remove\_node of TBD, there is a possible use after free bug due to a race condition. (no CVSS, Android)
- [CVE-2021-0951](https://cve.now/CVE-2021-0951.md): In DevmemIntHeapAcquire of TBD, there is a possible arbitrary code execution due to an integer overflow. (no CVSS, Android)
- [CVE-2022-20351](https://cve.now/CVE-2022-20351.md): In queryInternal of CallLogProvider.java, there is a possible access to voicemail information due to SQL injection. (no CVSS, Android)
- [CVE-2022-20394](https://cve.now/CVE-2022-20394.md): In getInputMethodWindowVisibleHeight of InputMethodManagerService.java, there is a possible way to determine when another app is showing an (no CVSS, Android)
- [CVE-2022-20409](https://cve.now/CVE-2022-20409.md): In io\_identity\_cow of io\_uring.c, there is a possible way to corrupt memory due to a use after free. (no CVSS, Android)
- [CVE-2022-20410](https://cve.now/CVE-2022-20410.md): In avrc\_ctrl\_pars\_vendor\_rsp of avrc\_pars\_ct.cc, there is a possible out of bounds read due to an integer overflow. (no CVSS, Android)
- [CVE-2022-20412](https://cve.now/CVE-2022-20412.md): In fdt\_next\_tag of fdt.c, there is a possible out of bounds read due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2022-20413](https://cve.now/CVE-2022-20413.md): In start of Threads.cpp, there is a possible way to record audio during a phone call due to a logic error in the code. (no CVSS, Android)
- [CVE-2022-20415](https://cve.now/CVE-2022-20415.md): In handleFullScreenIntent of StatusBarNotificationActivityStarter.java, there is a possible bypass of the restriction of starting activity f (no CVSS, Android)
- [CVE-2022-20416](https://cve.now/CVE-2022-20416.md): In audioTransportsToHal of HidlUtils.cpp, there is a possible out of bounds write due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2022-20417](https://cve.now/CVE-2022-20417.md): In audioTransportsToHal of HidlUtils.cpp, there is a possible out of bounds write due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2022-20418](https://cve.now/CVE-2022-20418.md): In pickStartSeq of AAVCAssembler.cpp, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2022-20419](https://cve.now/CVE-2022-20419.md): In setOptions of ActivityRecord.java, there is a possible load any arbitrary Java code into launcher process due to a logic error in the cod (no CVSS, Android)
- [CVE-2022-20420](https://cve.now/CVE-2022-20420.md): In getBackgroundRestrictionExemptionReason of AppRestrictionController.java, there is a possible way to bypass device policy restrictions du (no CVSS, Android)
- [CVE-2022-20421](https://cve.now/CVE-2022-20421.md): In binder\_inc\_ref\_for\_node of binder.c, there is a possible way to corrupt memory due to a use after free. (no CVSS, Android · :linux\_kernel:)
- [CVE-2022-20422](https://cve.now/CVE-2022-20422.md): In emulation\_proc\_handler of armv8\_deprecated.c, there is a possible way to corrupt memory due to a race condition. (no CVSS, Android · :linux\_kernel:)
- [CVE-2022-20423](https://cve.now/CVE-2022-20423.md): In rndis\_set\_response of rndis.c, there is a possible out of bounds write due to an integer overflow. (no CVSS, Android)
- [CVE-2022-20425](https://cve.now/CVE-2022-20425.md): In addAutomaticZenRule of ZenModeHelper.java, there is a possible permanent degradation of performance due to resource exhaustion. (no CVSS, Android)
- [CVE-2022-20429](https://cve.now/CVE-2022-20429.md): In CarSettings of app packages, there is a possible permission bypass due to a confused deputy. (no CVSS, Android)
- [CVE-2022-20430](https://cve.now/CVE-2022-20430.md): There is an missing authorization issue in the system service. (no CVSS, Android)
- [CVE-2022-20431](https://cve.now/CVE-2022-20431.md): There is an missing authorization issue in the system service. (no CVSS, Android)
- [CVE-2022-20432](https://cve.now/CVE-2022-20432.md): There is an missing authorization issue in the system service. (no CVSS, Android)
- [CVE-2022-20433](https://cve.now/CVE-2022-20433.md): There is an missing authorization issue in the system service. (no CVSS, Android)
- [CVE-2022-20434](https://cve.now/CVE-2022-20434.md): There is an missing authorization issue in the system service. (no CVSS, Android)
- [CVE-2022-20435](https://cve.now/CVE-2022-20435.md): There is a Unauthorized service in the system service, may cause the system reboot. (no CVSS, Android)
- [CVE-2022-20436](https://cve.now/CVE-2022-20436.md): There is an unauthorized service in the system service. (no CVSS, Android)
- [CVE-2022-20437](https://cve.now/CVE-2022-20437.md): In Messaging, There has unauthorized broadcast, this could cause Local Deny of Service.Product: AndroidVersions: Android SoCAndroid ID: A-24 (no CVSS, Android)
- [CVE-2022-20438](https://cve.now/CVE-2022-20438.md): In Messaging, There has unauthorized broadcast, this could cause Local Deny of Service.Product: AndroidVersions: Android SoCAndroid ID: A-24 (no CVSS, Android)
- [CVE-2022-20439](https://cve.now/CVE-2022-20439.md): In Messaging, There has unauthorized provider, this could cause Local Deny of Service.Product: AndroidVersions: Android SoCAndroid ID: A-242 (no CVSS, Android)
- [CVE-2022-20440](https://cve.now/CVE-2022-20440.md): In Messaging, There has unauthorized broadcast, this could cause Local Deny of Service.Product: AndroidVersions: Android SoCAndroid ID: A-24 (no CVSS, Android)
- [CVE-2022-22035](https://cve.now/CVE-2022-22035.md): Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2022-24504](https://cve.now/CVE-2022-24504.md): Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2022-28866](https://cve.now/CVE-2022-28866.md): Multiple Improper Access Control was discovered in Nokia AirFrame BMC Web GUI \< R18 Firmware v4.13.00. (no CVSS)
- [CVE-2022-30198](https://cve.now/CVE-2022-30198.md): Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2022-3140](https://cve.now/CVE-2022-3140.md): Macro URL arbitrary script execution (no CVSS, The Document Foundation LibreOffice)
- [CVE-2022-31682](https://cve.now/CVE-2022-31682.md): VMware Aria Operations contains an arbitrary file read vulnerability. (no CVSS, VMware Aria Operations)
- [CVE-2022-31765](https://cve.now/CVE-2022-31765.md): Affected devices do not properly authorize the change password function of the web interface. (CVSS 8.8, Siemens RUGGEDCOM RM1224 LTE(4G) EU · Siemens RUGGEDCOM… +86)
- [CVE-2022-31766](https://cve.now/CVE-2022-31766.md): A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions \< V7.1.2), RUGGEDCOM RM1224 LTE(4G) NA (CVSS 8.6, Siemens RUGGEDCOM RM1224 LTE(4G) EU · Siemens RUGGEDCOM… +16)
- [CVE-2022-32234](https://cve.now/CVE-2022-32234.md): An out of bounds write in hermes, while handling large arrays, prior to commit 06eaec767e376bfdb883d912cb15e987ddf2bda1 allows attackers to (no CVSS, Facebook Hermes)
- [CVE-2022-33634](https://cve.now/CVE-2022-33634.md): Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2022-33635](https://cve.now/CVE-2022-33635.md): Windows GDI+ Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-33645](https://cve.now/CVE-2022-33645.md): Windows TCP/IP Driver Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2022-33746](https://cve.now/CVE-2022-33746.md): P2M pool freeing may take excessively long The P2M pool backing second level address translation for guests may be of significant size. (no CVSS, xen)
- [CVE-2022-33747](https://cve.now/CVE-2022-33747.md): Arm: unbounded memory consumption for 2nd-level page tables Certain actions require e.g. (no CVSS, xen)
- [CVE-2022-33748](https://cve.now/CVE-2022-33748.md): lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was inserted on an error handling path. (no CVSS, xen)
- [CVE-2022-33749](https://cve.now/CVE-2022-33749.md): XAPI open file limit DoS It is possible for an unauthenticated client on the network to cause XAPI to hit its file-descriptor limit. (no CVSS, Xapi)
- [CVE-2022-3452](https://cve.now/CVE-2022-3452.md): SourceCodester Book Store Management System category.php cross site scripting (CVSS 3.5, SourceCodester Book Store Management System)
- [CVE-2022-3453](https://cve.now/CVE-2022-3453.md): SourceCodester Book Store Management System transcation.php cross site scripting (CVSS 3.5, SourceCodester Book Store Management System)
- [CVE-2022-34689](https://cve.now/CVE-2022-34689.md): Windows CryptoAPI Spoofing Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2022-35226](https://cve.now/CVE-2022-35226.md): SAP Data Services Management allows an attacker to copy the data from a request and echoed into the application's immediate response, it wil (no CVSS, SAP SE SAP Data Services Management Console)
- [CVE-2022-35289](https://cve.now/CVE-2022-35289.md): A write-what-where condition in hermes caused by an integer overflow, prior to commit 5b6255ae049fa4641791e47fad994e8e8c4da374 allows attack (no CVSS, Facebook Hermes)
- [CVE-2022-35296](https://cve.now/CVE-2022-35296.md): Under certain conditions, the application SAP BusinessObjects Business Intelligence Platform (Version Management System) exposes sensitive i (no CVSS, SAP SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2022-35297](https://cve.now/CVE-2022-35297.md): The application SAP Enable Now does not sufficiently encode user-controlled inputs over the network before it is placed in the output being (no CVSS, SAP SE SAP Enable Now)
- [CVE-2022-35299](https://cve.now/CVE-2022-35299.md): SAP SQL Anywhere - version 17.0, and SAP IQ - version 16.1, allows an attacker to leverage logical errors in memory management to cause a me (no CVSS, SAP SE SAP SQL Anywhere · SAP SE SAP IQ)
- [CVE-2022-35770](https://cve.now/CVE-2022-35770.md): Windows NTLM Spoofing Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2022-35829](https://cve.now/CVE-2022-35829.md): Service Fabric Explorer Spoofing Vulnerability (CVSS 6.2, Microsoft Azure Service Fabric Explorer)
- [CVE-2022-36360](https://cve.now/CVE-2022-36360.md): A vulnerability has been identified in LOGO! 8 BM (incl. (no CVSS, Siemens LOGO! 8 BM)
- [CVE-2022-36361](https://cve.now/CVE-2022-36361.md): A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA1) (All version (CVSS 9.8, Siemens LOGO! 12/24RCE · Siemens LOGO! 12/24RCEo +14)
- [CVE-2022-36362](https://cve.now/CVE-2022-36362.md): A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions), LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versions (CVSS 7.5, Siemens LOGO! 12/24RCE · Siemens LOGO! 12/24RCEo +14)
- [CVE-2022-36363](https://cve.now/CVE-2022-36363.md): A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA1) (All version (CVSS 5.3, Siemens LOGO! 12/24RCE · Siemens LOGO! 12/24RCEo +14)
- [CVE-2022-37599](https://cve.now/CVE-2022-37599.md): A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0. (no CVSS, loader-utils)
- [CVE-2022-37609](https://cve.now/CVE-2022-37609.md): Prototype pollution vulnerability in beautify-web js-beautify 1.13.7 via the name variable in options.js. (no CVSS)
- [CVE-2022-37616](https://cve.now/CVE-2022-37616.md): A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 f (no CVSS)
- [CVE-2022-37617](https://cve.now/CVE-2022-37617.md): Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the k variable in reso (no CVSS, browserify-shim)
- [CVE-2022-37864](https://cve.now/CVE-2022-37864.md): A vulnerability has been identified in Solid Edge (All Versions \< SE2022MP9). (no CVSS, Siemens Solid Edge)
- [CVE-2022-37965](https://cve.now/CVE-2022-37965.md): Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerability (CVSS 5.9, Microsoft Windows)
- [CVE-2022-37968](https://cve.now/CVE-2022-37968.md): Azure Arc-enabled Kubernetes cluster Connect Elevation of Privilege Vulnerability (CVSS 10.0, Microsoft Azure Arc-enabled Kubernetes cluster · Microsoft…)
- [CVE-2022-37970](https://cve.now/CVE-2022-37970.md): Windows DWM Core Library Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-37971](https://cve.now/CVE-2022-37971.md): Microsoft Windows Defender Elevation of Privilege Vulnerability (CVSS 7.1, Microsoft Malware Protection Engine)
- [CVE-2022-37973](https://cve.now/CVE-2022-37973.md): Windows Local Session Manager (LSM) Denial of Service Vulnerability (CVSS 7.7, Microsoft Windows)
- [CVE-2022-37974](https://cve.now/CVE-2022-37974.md): Windows Mixed Reality Developer Tools Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2022-37975](https://cve.now/CVE-2022-37975.md): Windows Group Policy Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-37976](https://cve.now/CVE-2022-37976.md): Active Directory Certificate Services Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows Server)
- [CVE-2022-37977](https://cve.now/CVE-2022-37977.md): Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2022-37978](https://cve.now/CVE-2022-37978.md): Windows Active Directory Certificate Services Security Feature Bypass (CVSS 7.5, Microsoft Windows)
- [CVE-2022-37979](https://cve.now/CVE-2022-37979.md): Windows Hyper-V Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-37980](https://cve.now/CVE-2022-37980.md): Windows DHCP Client Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-37981](https://cve.now/CVE-2022-37981.md): Windows Event Logging Service Denial of Service Vulnerability (CVSS 4.3, Microsoft Windows)
- [CVE-2022-37982](https://cve.now/CVE-2022-37982.md): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-37983](https://cve.now/CVE-2022-37983.md): Microsoft DWM Core Library Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-37984](https://cve.now/CVE-2022-37984.md): Windows WLAN Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-37985](https://cve.now/CVE-2022-37985.md): Windows Graphics Component Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2022-37986](https://cve.now/CVE-2022-37986.md): Windows Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-37987](https://cve.now/CVE-2022-37987.md): Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-37988](https://cve.now/CVE-2022-37988.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-37989](https://cve.now/CVE-2022-37989.md): Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-37990](https://cve.now/CVE-2022-37990.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-37991](https://cve.now/CVE-2022-37991.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-37993](https://cve.now/CVE-2022-37993.md): Windows Group Policy Preference Client Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-37994](https://cve.now/CVE-2022-37994.md): Windows Group Policy Preference Client Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-37995](https://cve.now/CVE-2022-37995.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-37996](https://cve.now/CVE-2022-37996.md): Windows Kernel Memory Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2022-37997](https://cve.now/CVE-2022-37997.md): Windows Graphics Component Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-37998](https://cve.now/CVE-2022-37998.md): Windows Local Session Manager (LSM) Denial of Service Vulnerability (CVSS 7.7, Microsoft Windows)
- [CVE-2022-37999](https://cve.now/CVE-2022-37999.md): Windows Group Policy Preference Client Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-38000](https://cve.now/CVE-2022-38000.md): Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2022-38001](https://cve.now/CVE-2022-38001.md): Microsoft Office Spoofing Vulnerability (CVSS 6.5, Microsoft Office LTSC · Microsoft 365 Apps for Enterprise +1)
- [CVE-2022-38003](https://cve.now/CVE-2022-38003.md): Windows Resilient File System Elevation of Privilege (CVSS 7.8, Microsoft Windows)
- [CVE-2022-38016](https://cve.now/CVE-2022-38016.md): Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-38017](https://cve.now/CVE-2022-38017.md): StorSimple 8000 Series Elevation of Privilege Vulnerability (CVSS 6.8, Microsoft Azure StorSimple 8000 Series)
- [CVE-2022-38021](https://cve.now/CVE-2022-38021.md): Connected User Experiences and Telemetry Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2022-38022](https://cve.now/CVE-2022-38022.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 3.3, Microsoft Windows)
- [CVE-2022-38025](https://cve.now/CVE-2022-38025.md): Windows Distributed File System (DFS) Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows Server · Microsoft Windows)
- [CVE-2022-38026](https://cve.now/CVE-2022-38026.md): Windows DHCP Client Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2022-38027](https://cve.now/CVE-2022-38027.md): Windows Storage Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2022-38028](https://cve.now/CVE-2022-38028.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2022-38029](https://cve.now/CVE-2022-38029.md): Windows ALPC Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2022-38030](https://cve.now/CVE-2022-38030.md): Windows USB Serial Driver Information Disclosure Vulnerability (CVSS 4.3, Microsoft Windows)
- [CVE-2022-38031](https://cve.now/CVE-2022-38031.md): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-38032](https://cve.now/CVE-2022-38032.md): Windows Portable Device Enumerator Service Security Feature Bypass Vulnerability (CVSS 6.6, Microsoft Windows)
- [CVE-2022-38033](https://cve.now/CVE-2022-38033.md): Windows Server Remotely Accessible Registry Keys Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2022-38034](https://cve.now/CVE-2022-38034.md): Windows Workstation Service Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-38036](https://cve.now/CVE-2022-38036.md): Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows Server · Microsoft Windows)
- [CVE-2022-38037](https://cve.now/CVE-2022-38037.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-38038](https://cve.now/CVE-2022-38038.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-38039](https://cve.now/CVE-2022-38039.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-38040](https://cve.now/CVE-2022-38040.md): Microsoft ODBC Driver Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-38041](https://cve.now/CVE-2022-38041.md): Windows Secure Channel Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2022-38042](https://cve.now/CVE-2022-38042.md): Active Directory Domain Services Elevation of Privilege Vulnerability (CVSS 7.1, Microsoft Windows)
- [CVE-2022-38043](https://cve.now/CVE-2022-38043.md): Windows Security Support Provider Interface Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2022-38044](https://cve.now/CVE-2022-38044.md): Windows CD-ROM File System Driver Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-38045](https://cve.now/CVE-2022-38045.md): Windows Server Service Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-38046](https://cve.now/CVE-2022-38046.md): Web Account Manager Information Disclosure Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2022-38047](https://cve.now/CVE-2022-38047.md): Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2022-38048](https://cve.now/CVE-2022-38048.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise)
- [CVE-2022-38049](https://cve.now/CVE-2022-38049.md): Microsoft Office Graphics Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise)
- [CVE-2022-38050](https://cve.now/CVE-2022-38050.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-38051](https://cve.now/CVE-2022-38051.md): Windows Graphics Component Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-38053](https://cve.now/CVE-2022-38053.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2022-38138](https://cve.now/CVE-2022-38138.md): The Triangle Microworks IEC 61850 Library (Any client or server using the C language library with a version number of 11.2.0 or earlier and (CVSS 7.5, Triangle Microworks Library: IEC)
- [CVE-2022-38371](https://cve.now/CVE-2022-38371.md): A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC ( (CVSS 7.5, Siemens APOGEE MBC (PPC) · Siemens APOGEE MEC (PPC) +20)
- [CVE-2022-38465](https://cve.now/CVE-2022-38465.md): A vulnerability has been identified in SIMATIC Drive Controller family (All versions \< V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP (CVSS 9.3, Siemens SIMATIC Drive Controller family · Siemens SIMATI… +7)
- [CVE-2022-39013](https://cve.now/CVE-2022-39013.md): Under certain conditions an authenticated attacker can get access to OS credentials. (no CVSS, SAP SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2022-39015](https://cve.now/CVE-2022-39015.md): Under certain conditions, BOE AdminTools/ BOE SDK allows an attacker to access information which would otherwise be restricted. (no CVSS, SAP SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2022-39271](https://cve.now/CVE-2022-39271.md): Traefik HTTP/2 connections management could cause a denial of service (CVSS 7.5, traefik · github.com/traefik/traefik/v2)
- [CVE-2022-39296](https://cve.now/CVE-2022-39296.md): Path traversal in MelisAssetManager (CVSS 8.6, melisplatform melis-asset-manager · melisplatform/melis-ass…)
- [CVE-2022-39800](https://cve.now/CVE-2022-39800.md): SAP BusinessObjects BI LaunchPad - versions 420, 430, is susceptible to script execution attack by an unauthenticated attacker due to improp (no CVSS, SAP SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2022-39802](https://cve.now/CVE-2022-39802.md): SAP Manufacturing Execution - versions 15.1, 15.2, 15.3, allows an attacker to exploit insufficient validation of a file path request parame (no CVSS, SAP SE SAP Manufacturing Execution)
- [CVE-2022-39803](https://cve.now/CVE-2022-39803.md): Due to lack of proper memory management, when a victim opens a manipulated ACIS Part and Assembly (.sat, CoreCadTranslator.exe) file receive (no CVSS, SAP SE SAP 3D Visual Enterprise Author)
- [CVE-2022-39804](https://cve.now/CVE-2022-39804.md): Due to lack of proper memory management, when a victim opens a manipulated SolidWorks Part (.sldprt, CoreCadTranslator.exe) file received fr (no CVSS, SAP SE SAP 3D Visual Enterprise Author)
- [CVE-2022-39805](https://cve.now/CVE-2022-39805.md): Due to lack of proper memory management, when a victim opens a manipulated Computer Graphics Metafile (.cgm, CgmTranslator.exe) file receive (no CVSS, SAP SE SAP 3D Visual Enterprise Author)
- [CVE-2022-39806](https://cve.now/CVE-2022-39806.md): Due to lack of proper memory management, when a victim opens a manipulated SolidWorks Drawing (.slddrw, CoreCadTranslator.exe) file received (no CVSS, SAP SE SAP 3D Visual Enterprise Author)
- [CVE-2022-39807](https://cve.now/CVE-2022-39807.md): Due to lack of proper memory management, when a victim opens manipulated SolidWorks Drawing (.sldasm, CoreCadTranslator.exe) file received f (no CVSS, SAP SE SAP 3D Visual Enterprise Author)
- [CVE-2022-39808](https://cve.now/CVE-2022-39808.md): Due to lack of proper memory management, when a victim opens a manipulated Wavefront Object (.obj, ObjTranslator.exe) file received from unt (no CVSS, SAP SE SAP 3D Visual Enterprise Author)
- [CVE-2022-40047](https://cve.now/CVE-2022-40047.md): Flatpress v1.2.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the page parameter at /flatpress/admin.p (no CVSS)
- [CVE-2022-40138](https://cve.now/CVE-2022-40138.md): An integer conversion error in Hermes bytecode generation, prior to commit 6aa825e480d48127b480b08d13adf70033237097, could have been used to (no CVSS, Facebook Hermes)
- [CVE-2022-40147](https://cve.now/CVE-2022-40147.md): A vulnerability has been identified in Industrial Edge Management (All versions \< V1.5.1). (no CVSS, Siemens Industrial Edge Management)
- [CVE-2022-40176](https://cve.now/CVE-2022-40176.md): A vulnerability has been identified in Desigo PXM30-1 (All versions \< V02.20.126.11-41), Desigo PXM30.E (All versions \< V02.20.126.11-41), D (no CVSS, Siemens Desigo PXM30-1 · Siemens Desigo PXM30.E +8)
- [CVE-2022-40177](https://cve.now/CVE-2022-40177.md): A vulnerability has been identified in Desigo PXM30-1 (All versions \< V02.20.126.11-41), Desigo PXM30.E (All versions \< V02.20.126.11-41), D (no CVSS, Siemens Desigo PXM30-1 · Siemens Desigo PXM30.E +8)
- [CVE-2022-40178](https://cve.now/CVE-2022-40178.md): A vulnerability has been identified in Desigo PXM30-1 (All versions \< V02.20.126.11-41), Desigo PXM30.E (All versions \< V02.20.126.11-41), D (no CVSS, Siemens Desigo PXM30-1 · Siemens Desigo PXM30.E +8)
- [CVE-2022-40179](https://cve.now/CVE-2022-40179.md): A vulnerability has been identified in Desigo PXM30-1 (All versions \< V02.20.126.11-41), Desigo PXM30.E (All versions \< V02.20.126.11-41), D (no CVSS, Siemens Desigo PXM30-1 · Siemens Desigo PXM30.E +8)
- [CVE-2022-40180](https://cve.now/CVE-2022-40180.md): A vulnerability has been identified in Desigo PXM30-1 (All versions \< V02.20.126.11-41), Desigo PXM30.E (All versions \< V02.20.126.11-41), D (no CVSS, Siemens Desigo PXM30-1 · Siemens Desigo PXM30.E +8)
- [CVE-2022-40181](https://cve.now/CVE-2022-40181.md): A vulnerability has been identified in Desigo PXM30-1 (All versions \< V02.20.126.11-41), Desigo PXM30.E (All versions \< V02.20.126.11-41), D (no CVSS, Siemens Desigo PXM30-1 · Siemens Desigo PXM30.E +8)
- [CVE-2022-40182](https://cve.now/CVE-2022-40182.md): A vulnerability has been identified in Desigo PXM30-1 (All versions \< V02.20.126.11-41), Desigo PXM30.E (All versions \< V02.20.126.11-41), D (no CVSS, Siemens Desigo PXM30-1 · Siemens Desigo PXM30.E +8)
- [CVE-2022-40226](https://cve.now/CVE-2022-40226.md): A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions \< V3.10), SICAM P850 (7KG8500-0AA00-2AA0) (All versions (CVSS 7.5, Siemens SICAM P850 · Siemens SICAM P855 +1)
- [CVE-2022-40227](https://cve.now/CVE-2022-40227.md): A vulnerability has been identified in SIMATIC HMI Comfort Panels (incl. (CVSS 7.5, Siemens SIMATIC HMI Comfort Panels · Siemens SIMATIC HMI… +8)
- [CVE-2022-40440](https://cve.now/CVE-2022-40440.md): mxGraph v4.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the setTooltips() function. (no CVSS, mxgraph)
- [CVE-2022-40631](https://cve.now/CVE-2022-40631.md): A vulnerability has been identified in SCALANCE X200-4P IRT (All versions \< V5.5.0), SCALANCE X201-3P IRT (All versions \< V5.5.0), SCALANCE (no CVSS, Siemens SCALANCE X200-4P IRT · Siemens SCALANCE X201-3P… +24)
- [CVE-2022-40777](https://cve.now/CVE-2022-40777.md): Interspire Email Marketer through 6.5.0 allows arbitrary file upload via a surveys\_submit.php "create survey and submit survey" operation, w (no CVSS)
- [CVE-2022-40921](https://cve.now/CVE-2022-40921.md): DedeCMS V5.7.99 was discovered to contain an arbitrary file upload vulnerability via the component /dede/file\_manage\_control.php. (no CVSS)
- [CVE-2022-41031](https://cve.now/CVE-2022-41031.md): Microsoft Word Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office LTSC · Microsoft 365 Apps for Enterprise +1)
- [CVE-2022-41032](https://cve.now/CVE-2022-41032.md): NuGet Client Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft .NET · Microsoft Visual Studio +3)
- [CVE-2022-41033](https://cve.now/CVE-2022-41033.md): Windows COM+ Event System Service Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2022-41034](https://cve.now/CVE-2022-41034.md): Visual Studio Code Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio Code)
- [CVE-2022-41035](https://cve.now/CVE-2022-41035.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 5.3, Microsoft Edge)
- [CVE-2022-41036](https://cve.now/CVE-2022-41036.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2022-41037](https://cve.now/CVE-2022-41037.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2022-41038](https://cve.now/CVE-2022-41038.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2022-41042](https://cve.now/CVE-2022-41042.md): Visual Studio Code Information Disclosure Vulnerability (CVSS 7.4, Microsoft Visual Studio Code)
- [CVE-2022-41043](https://cve.now/CVE-2022-41043.md): Microsoft Office Information Disclosure Vulnerability (CVSS 3.3, Microsoft Office 2019 for Mac · Microsoft Office LTSC for M…)
- [CVE-2022-41081](https://cve.now/CVE-2022-41081.md): Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2022-41083](https://cve.now/CVE-2022-41083.md): Visual Studio Code Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Jupyter Extension for Visual Studio Code)
- [CVE-2022-41166](https://cve.now/CVE-2022-41166.md): Due to lack of proper memory management, when a victim opens manipulated Wavefront Object (.obj, ObjTranslator.exe) file received from untru (no CVSS, SAP SE SAP 3D Visual Enterprise Author)
- [CVE-2022-41167](https://cve.now/CVE-2022-41167.md): Due to lack of proper memory management, when a victim opens a manipulated AutoCAD (.dwg, TeighaTranslator.exe) file received from untrusted (no CVSS, SAP SE SAP 3D Visual Enterprise Author)
- [CVE-2022-41168](https://cve.now/CVE-2022-41168.md): Due to lack of proper memory management, when a victim opens a manipulated CATIA5 Part (.catpart, CatiaTranslator.exe) file received from un (no CVSS, SAP SE SAP 3D Visual Enterprise Author)
- [CVE-2022-41169](https://cve.now/CVE-2022-41169.md): Due to lack of proper memory management, when a victim opens manipulated CATIA5 Part (.catpart, CatiaTranslator.exe) file received from untr (no CVSS, SAP SE SAP 3D Visual Enterprise Author)
- [CVE-2022-41170](https://cve.now/CVE-2022-41170.md): Due to lack of proper memory management, when a victim opens a manipulated CATIA4 Part (.model, CatiaTranslator.exe) file received from untr (no CVSS, SAP SE SAP 3D Visual Enterprise Author)
- [CVE-2022-41171](https://cve.now/CVE-2022-41171.md): Due to lack of proper memory management, when a victim opens manipulated CATIA4 Part (.model, CatiaTranslator.exe) file received from untrus (no CVSS, SAP SE SAP 3D Visual Enterprise Author)
- [CVE-2022-41172](https://cve.now/CVE-2022-41172.md): Due to lack of proper memory management, when a victim opens a manipulated AutoCAD (.dxf, TeighaTranslator.exe) file received from untrusted (no CVSS, SAP SE SAP 3D Visual Enterprise Author)
- [CVE-2022-41173](https://cve.now/CVE-2022-41173.md): Due to lack of proper memory management, when a victim opens manipulated AutoCAD (.dxf, TeighaTranslator.exe) file received from untrusted s (no CVSS, SAP SE SAP 3D Visual Enterprise Author)
- [CVE-2022-41174](https://cve.now/CVE-2022-41174.md): Due to lack of proper memory management, when a victim opens manipulated Right Hemisphere Material (.rhm, rh.x3d) file received from untrust (no CVSS, SAP SE SAP 3D Visual Enterprise Author)
- [CVE-2022-41175](https://cve.now/CVE-2022-41175.md): Due to lack of proper memory management, when a victim opens a manipulated Enhanced Metafile (.emf, emf.x3d) file received from untrusted so (no CVSS, SAP SE SAP 3D Visual Enterprise Author)
- [CVE-2022-41176](https://cve.now/CVE-2022-41176.md): Due to lack of proper memory management, when a victim opens manipulated Enhanced Metafile (.emf, emf.x3d) file received from untrusted sour (no CVSS, SAP SE SAP 3D Visual Enterprise Author)
- [CVE-2022-41177](https://cve.now/CVE-2022-41177.md): Due to lack of proper memory management, when a victim opens a manipulated Iges Part and Assembly (.igs, .iges, CoreCadTranslator.exe) file (no CVSS, SAP SE SAP 3D Visual Enterprise Author)
- [CVE-2022-41178](https://cve.now/CVE-2022-41178.md): Due to lack of proper memory management, when a victim opens manipulated Iges Part and Assembly (.igs, .iges, CoreCadTranslator.exe) file re (no CVSS, SAP SE SAP 3D Visual Enterprise Author)
- [CVE-2022-41179](https://cve.now/CVE-2022-41179.md): Due to lack of proper memory management, when a victim opens a manipulated Jupiter Tesselation (.jt, JtTranslator.exe) file received from un (no CVSS, SAP SE SAP 3D Visual Enterprise Author)
- [CVE-2022-41180](https://cve.now/CVE-2022-41180.md): Due to lack of proper memory management, when a victim opens a manipulated Portable Document Format (.pdf, PDFPublishing.dll) file received (no CVSS, SAP SE SAP 3D Visual Enterprise Author)
- [CVE-2022-41181](https://cve.now/CVE-2022-41181.md): Due to lack of proper memory management, when a victim opens manipulated Portable Document Format (.pdf, PDFPublishing.dll) file received fr (no CVSS, SAP SE SAP 3D Visual Enterprise Author)
- [CVE-2022-41182](https://cve.now/CVE-2022-41182.md): Due to lack of proper memory management, when a victim opens manipulated Parasolid Part and Assembly (.x\_b, CoreCadTranslator.exe) file rece (no CVSS, SAP SE SAP 3D Visual Enterprise Author)
- [CVE-2022-41183](https://cve.now/CVE-2022-41183.md): Due to lack of proper memory management, when a victim opens manipulated Windows Cursor File (.cur, ico.x3d) file received from untrusted so (no CVSS, SAP SE SAP 3D Visual Enterprise Author)
- [CVE-2022-41184](https://cve.now/CVE-2022-41184.md): Due to lack of proper memory management, when a victim opens a manipulated Windows Cursor File (.cur, ico.x3d) file received from untrusted (no CVSS, SAP SE SAP 3D Visual Enterprise Author)
- [CVE-2022-41185](https://cve.now/CVE-2022-41185.md): Due to lack of proper memory management, when a victim opens a manipulated Visual Design Stream (.vds, MataiPersistence.dll) file received f (no CVSS, SAP SE SAP 3D Visual Enterprise Author)
- [CVE-2022-41186](https://cve.now/CVE-2022-41186.md): Due to lack of proper memory management, when a victim opens manipulated Computer Graphics Metafile (.cgm, CgmCore.dll) file received from u (no CVSS, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2022-41187](https://cve.now/CVE-2022-41187.md): Due to lack of proper memory management, when a victim opens a manipulated Wavefront Object (.obj, ObjTranslator.exe) file received from unt (no CVSS, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2022-41188](https://cve.now/CVE-2022-41188.md): Due to lack of proper memory management, when a victim opens manipulated Wavefront Object (.obj, ObjTranslator.exe) file received from untru (no CVSS, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2022-41189](https://cve.now/CVE-2022-41189.md): Due to lack of proper memory management, when a victim opens a manipulated AutoCAD (.dwg, TeighaTranslator.exe) file received from untrusted (CVSS 7.8, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2022-41190](https://cve.now/CVE-2022-41190.md): Due to lack of proper memory management, when a victim opens a manipulated AutoCAD (.dxf, TeighaTranslator.exe) file received from untrusted (no CVSS, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2022-41191](https://cve.now/CVE-2022-41191.md): Due to lack of proper memory management, when a victim opens a manipulated Jupiter Tesselation (.jt, JTReader.x3d) file received from untrus (CVSS 7.8, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2022-41192](https://cve.now/CVE-2022-41192.md): Due to lack of proper memory management, when a victim opens manipulated Jupiter Tesselation (.jt, JTReader.x3d) file received from untruste (no CVSS, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2022-41193](https://cve.now/CVE-2022-41193.md): Due to lack of proper memory management, when a victim opens a manipulated Encapsulated Post Script (.eps, ai.x3d) file received from untrus (no CVSS, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2022-41194](https://cve.now/CVE-2022-41194.md): Due to lack of proper memory management, when a victim opens a manipulated Encapsulated Postscript (.eps, ai.x3d) file received from untrust (no CVSS, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2022-41195](https://cve.now/CVE-2022-41195.md): Due to lack of proper memory management, when a victim opens a manipulated EAAmiga Interchange File Format (.iff, 2d.x3d) file received from (no CVSS, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2022-41196](https://cve.now/CVE-2022-41196.md): Due to lack of proper memory management, when a victim opens a manipulated VRML Worlds (.wrl, vrml.x3d) file received from untrusted sources (no CVSS, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2022-41197](https://cve.now/CVE-2022-41197.md): Due to lack of proper memory management, when a victim opens a manipulated VRML Worlds (.wrl, vrml.x3d) file received from untrusted sources (no CVSS, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2022-41198](https://cve.now/CVE-2022-41198.md): Due to lack of proper memory management, when a victim opens a manipulated SketchUp (.skp, SketchUp.x3d) file received from untrusted source (no CVSS, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2022-41199](https://cve.now/CVE-2022-41199.md): Due to lack of proper memory management, when a victim opens a manipulated Open Inventor File (.iv, vrml.x3d) file received from untrusted s (CVSS 7.8, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2022-41200](https://cve.now/CVE-2022-41200.md): Due to lack of proper memory management, when a victim opens a manipulated Scalable Vector Graphic (.svg, svg.x3d) file received from untrus (no CVSS, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2022-41201](https://cve.now/CVE-2022-41201.md): Due to lack of proper memory management, when a victim opens a manipulated Right Hemisphere Binary (.rh, rh.x3d) file received from untruste (CVSS 7.8, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2022-41202](https://cve.now/CVE-2022-41202.md): Due to lack of proper memory management, when a victim opens a manipulated Visual Design Stream (.vds, vds.x3d) file received from untrusted (CVSS 7.8, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2022-41204](https://cve.now/CVE-2022-41204.md): An attacker can change the content of an SAP Commerce - versions 1905, 2005, 2105, 2011, 2205, login page through a manipulated URL. (CVSS 8.8, SAP SE SAP Commerce)
- [CVE-2022-41206](https://cve.now/CVE-2022-41206.md): SAP BusinessObjects Business Intelligence platform (Analysis for OLAP) - versions 420, 430, allows an authenticated attacker to send user-co (CVSS 5.4, SAP SE SAP BusinessObjects Business Intelligence platform)
- [CVE-2022-41209](https://cve.now/CVE-2022-41209.md): SAP Customer Data Cloud (Gigya mobile app for Android) - version 7.4, uses encryption method which lacks proper diffusion and does not hide (CVSS 5.2, SAP SE SAP Customer Data Cloud)
- [CVE-2022-41210](https://cve.now/CVE-2022-41210.md): SAP Customer Data Cloud (Gigya mobile app for Android) - version 7.4, uses insecure random number generator program which makes it easy for (CVSS 5.2, SAP SE SAP Customer Data Cloud)
- [CVE-2022-41376](https://cve.now/CVE-2022-41376.md): Metro UI v4.4.0 to v4.5.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Javascript function. (CVSS 6.1, metro4)
- [CVE-2022-41380](https://cve.now/CVE-2022-41380.md): The d8s-yaml package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (CVSS 9.8, democritus-file-system · d8s-yaml)
- [CVE-2022-41381](https://cve.now/CVE-2022-41381.md): The d8s-utility package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (CVSS 9.8, democritus-file-system · d8s-utility)
- [CVE-2022-41382](https://cve.now/CVE-2022-41382.md): The d8s-json package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (CVSS 9.8, democritus-file-system · d8s-json)
- [CVE-2022-41383](https://cve.now/CVE-2022-41383.md): The d8s-archives package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (CVSS 9.8, d8s-archives · democritus-file-system)
- [CVE-2022-41384](https://cve.now/CVE-2022-41384.md): The d8s-domains package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (CVSS 9.8, democritus-urls · d8s-domains)
- [CVE-2022-41385](https://cve.now/CVE-2022-41385.md): The d8s-html package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (CVSS 9.8, democritus-urls · d8s-html)
- [CVE-2022-41386](https://cve.now/CVE-2022-41386.md): The d8s-utility package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (CVSS 9.8, democritus-urls · d8s-utility)
- [CVE-2022-41387](https://cve.now/CVE-2022-41387.md): The d8s-pdfs package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (CVSS 9.8, democritus-urls · d8s-pdfs)
- [CVE-2022-41404](https://cve.now/CVE-2022-41404.md): An issue in the fetch() method in the BasicProfile class of org.ini4j through version v0.5.4 allows attackers to cause a Denial of Service ( (CVSS 7.5, org.ini4j:ini4j)
- [CVE-2022-41406](https://cve.now/CVE-2022-41406.md): An arbitrary file upload vulnerability in the /admin/admin\_pic.php component of Church Management System v1.0 allows attackers to execute ar (CVSS 7.2)
- [CVE-2022-41407](https://cve.now/CVE-2022-41407.md): Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/view\_order. (CVSS 7.2)
- [CVE-2022-41408](https://cve.now/CVE-2022-41408.md): Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/view\_order. (CVSS 9.8)
- [CVE-2022-41530](https://cve.now/CVE-2022-41530.md): Open Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /sacco\_shield/ajax. (CVSS 7.2)
- [CVE-2022-41532](https://cve.now/CVE-2022-41532.md): Open Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /sacco\_shield/ajax. (CVSS 7.2)
- [CVE-2022-41550](https://cve.now/CVE-2022-41550.md): GNU oSIP v5.3.0 was discovered to contain an integer overflow via the component osip\_body\_parse\_header. (CVSS 6.5)
- [CVE-2022-41606](https://cve.now/CVE-2022-41606.md): HashiCorp Nomad and Nomad Enterprise 1.0.2 up to 1.2.12, and 1.3.5 jobs submitted with an artifact stanza using invalid S3 or GCS URLs can b (CVSS 6.5, github.com/hashicorp/nomad)
- [CVE-2022-41665](https://cve.now/CVE-2022-41665.md): A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions \< V3.10), SICAM P850 (7KG8500-0AA00-2AA0) (All versions (CVSS 9.8, Siemens SICAM P850 · Siemens SICAM P855 +1)
- [CVE-2022-41851](https://cve.now/CVE-2022-41851.md): A vulnerability has been identified in JTTK (All versions \< V11.1.1.0), Simcenter Femap V2022.1 (All versions \< V2022.1.3), Simcenter Femap (CVSS 7.8, Siemens JTTK · Siemens Simcenter Femap)
- [CVE-2022-42034](https://cve.now/CVE-2022-42034.md): Wedding Planner v1.0 is vulnerable to arbitrary code execution via users\_profile.php. (CVSS 8.8)
- [CVE-2022-42036](https://cve.now/CVE-2022-42036.md): The d8s-urls package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (no CVSS, democritus-csv · d8s-urls)
- [CVE-2022-42037](https://cve.now/CVE-2022-42037.md): The d8s-asns package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (CVSS 9.8, d8s-asns · democritus-csv)
- [CVE-2022-42038](https://cve.now/CVE-2022-42038.md): The d8s-ip-addresses package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (CVSS 9.8)
- [CVE-2022-42039](https://cve.now/CVE-2022-42039.md): The d8s-lists package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (CVSS 9.8, d8s-lists · democritus-dicts)
- [CVE-2022-42040](https://cve.now/CVE-2022-42040.md): The d8s-algorithms package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (CVSS 9.8, d8s-algorithms · democritus-dicts)
- [CVE-2022-42041](https://cve.now/CVE-2022-42041.md): The d8s-file-system package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (CVSS 9.8, democritus-hashes · d8s-file-system)
- [CVE-2022-42042](https://cve.now/CVE-2022-42042.md): The d8s-networking package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (CVSS 9.8, democritus-hashes · d8s-networking)
- [CVE-2022-42043](https://cve.now/CVE-2022-42043.md): The d8s-xml package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (CVSS 9.8, d8s-xml · democritus-html)
- [CVE-2022-42044](https://cve.now/CVE-2022-42044.md): The d8s-asns package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (CVSS 9.8, democritus-html · d8s-asns)
- [CVE-2022-42229](https://cve.now/CVE-2022-42229.md): Wedding Planner v1.0 is vulnerable to Arbitrary code execution via package\_edit.php. (CVSS 8.8)
- [CVE-2022-42230](https://cve.now/CVE-2022-42230.md): Simple Cold Storage Management System v1.0 is vulnerable to SQL Injection via /csms/admin/?page=user/manage\_user&id=. (CVSS 7.2)
- [CVE-2022-42235](https://cve.now/CVE-2022-42235.md): A Stored XSS issue in Student Clearance System v.1.0 allows the injection of arbitrary JavaScript in the Student registration form. (CVSS 5.4)
- [CVE-2022-42236](https://cve.now/CVE-2022-42236.md): A Stored XSS issue in Merchandise Online Store v.1.0 allows to injection of Arbitrary JavaScript in edit account form. (CVSS 5.4)
- [CVE-2022-42238](https://cve.now/CVE-2022-42238.md): A Vertical Privilege Escalation issue in Merchandise Online Store v.1.0 allows an attacker to get access to the admin dashboard. (CVSS 8.8)
- [CVE-2022-42717](https://cve.now/CVE-2022-42717.md): An issue was discovered in Hashicorp Packer before 2.3.1. (CVSS 7.8)
- [CVE-2022-42731](https://cve.now/CVE-2022-42731.md): mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a u (CVSS 7.5, django-mfa2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-10-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.