CVEs published October 12, 2022
69 CVEs were published on October 12, 2022: 10 critical, 26 high.
- Published
- 69
- Critical
- 10
- High
- 26
- Medium
- 31
- Low
- 1
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 27
Most affected products
- Dell CPG BIOS
- 10
- Dell GeoDrive
- 6
- Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- 6
- SourceCodester Human Resource Management System
- 5
- FreeRDP
- 2
- All F-Secure and WithSecure Endpoint Protection products fo…
- 1
- Apache Software Foundation Apache Shiro · org.apache.shiro:…
- 1
- Avaya Aura Communication Manager
- 1
- Dell XtremIO
- 1
- dolibarr/dolibarr
- 1
Critical 10
- CVE-2018-18446dotPDN Paint.NET before 4.1.2 allows Deserialization of Untrusted Data (issue 1 of 2).
- CVE-2018-18447dotPDN Paint.NET before 4.1.2 allows Deserialization of Untrusted Data (issue 2 of 2).
- CVE-2022-33106WiJungle NGFW Version U250 was discovered to be vulnerable to No Rate Limit attack, allowing the attacker to brute force the admin password
- CVE-2022-37611Prototype pollution vulnerability in tschaub gh-pages 3.1.0 via the partial variable in util.js.gh-pages
- CVE-2022-37614Prototype pollution vulnerability in function enable in mockery.js in mfncooper mockery commit 822f0566fd6d72af8c943ae5ca2aa92e516aa2cf via mockery
- CVE-2022-40664Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcherApache Software Foundation Apache Shiro · org.apache.shiro:…
- CVE-2022-40871Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection.dolibarr/dolibarr
- CVE-2022-41403OpenCart 3.x Newsletter Custom Popup was discovered to contain a SQL injection vulnerability via the email parameter at index.php?route=exte
- CVE-2022-42711In Progress WhatsUp Gold before 22.1.0, an SNMP MIB Walker application endpoint failed to adequately sanitize malicious input.
- CVE-2022-42897Array Networks AG/vxAG with ArrayOS AG before 9.4.0.469 allows unauthenticated command injection that leads to privilege escalation and cont
High 26
- CVE-2022-34391Dell Client BIOS Versions prior to the remediated version contain an improper input validation vulnerability.Dell CPG BIOS
- CVE-2022-34390Dell BIOS contains a use of uninitialized variable vulnerability.Dell CPG BIOS
- CVE-2022-33937Dell GeoDrive, Versions 1.0 - 2.2, contain a Path Traversal Vulnerability in the reporting function.Dell GeoDrive
- CVE-2022-33922Dell GeoDrive, versions prior to 2.2, contains Insecure File and Folder Permissions vulnerabilities.Dell GeoDrive
- CVE-2022-33921Dell GeoDrive, versions prior to 2.2, contains Multiple DLL Hijacking Vulnerabilities.Dell GeoDrive
- CVE-2022-33920Dell GeoDrive, versions prior to 2.2, contains an Unquoted File Path vulnerability.Dell GeoDrive
- CVE-2022-33919Dell GeoDrive, versions 2.1 - 2.2, contains an information disclosure vulnerability in GUI.Dell GeoDrive
- CVE-2022-32489Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2022-32488Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2022-32487Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2022-32485Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2022-31228Dell EMC XtremIO versions prior to X2 6.4.0-22 contain a bruteforce vulnerability.Dell XtremIO
- CVE-2022-0030PAN-OS: Authentication Bypass in Web InterfacePalo Alto Networks PAN-OS · Palo Alto Networks Cloud NGFW +1
- CVE-2021-36369An issue was discovered in Dropbear through 2020.81.
- CVE-2022-22077Memory corruption in graphics due to use-after-free in graphics dispatcher logic in Snapdragon MobileQualcomm Snapdragon Mobile
- CVE-2022-2249Avaya Aura Communication Manager Privilege Escalation VulnerabilitiesAvaya Aura Communication Manager
- CVE-2022-25660Memory corruption due to double free issue in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-25661Memory corruption due to untrusted pointer dereference in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, SnapdragonQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-3465Mediabridge Medialink index.asp improper authenticationMediabridge Medialink
- CVE-2022-39297Deserialization of untrusted data in MelisCmsmelisplatform melis-cms · melisplatform/melis-cms
- CVE-2022-39298Deserialization of untrusted data in MelisFrontmelisplatform melis-front · melisplatform/melis-front
- CVE-2022-39299Signature bypass via multiple root elements in Passport-SAMLnode-saml passport-saml · passport-saml +3
- CVE-2022-40469iKuai OS v3.6.7 was discovered to contain an authenticated remote code execution (RCE) vulnerability.
- CVE-2022-42079Tenda AC1206 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01 was discovered to contain a stack overflow via the function formWifiBasicSet.
- CVE-2022-42080Tenda AC1206 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01 was discovered to contain a heap overflow via sched_start_time parameter.
- CVE-2022-42081Tenda AC1206 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01 was discovered to contain a stack overflow via sched_end_time parameter.
Medium, low and unrated 33
- CVE-2022-33918Dell GeoDrive, Versions 2.1 - 2.2, contains an information disclosure vulnerability.Dell GeoDrive
- CVE-2022-32493Dell BIOS contains an Stack-Based Buffer Overflow vulnerability.Dell CPG BIOS
- CVE-2022-32491Dell Client BIOS contains a Buffer Overflow vulnerability.Dell CPG BIOS
- CVE-2022-32484Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2022-32483Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2022-22078Denial of service in BOOT when partition size for a particular partition is requested due to integer overflow when blocks are calculated in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-25662Information disclosure due to untrusted pointer dereference in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, SnapdQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-25663Possible buffer overflow due to lack of buffer length check during management frame Rx handling lead to denial of service in Snapdragon CompQualcomm Snapdragon Compute, Snapdragon Connectivity, Snapd…
- CVE-2022-25664Information disclosure due to exposure of information while GPU reads the data in Snapdragon Auto, Snapdragon Compute, Snapdragon ConnectiviQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-25665Information disclosure due to buffer over read in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon MobileQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-2720In affected versions of Octopus Server it was identified that when a sensitive value is a substring of another value, sensitive value maskinOctopus Deploy Octopus Server
- CVE-2022-28887Multiple Denial of Service VulnerabilityAll F-Secure and WithSecure Endpoint Protection products fo…
- CVE-2022-3171Memory handling vulnerability in ProtocolBuffers Java core and liteGoogle Protocolbuffers · com.google.protobuf:protobuf-ja… +4
- CVE-2022-3458SourceCodester Human Resource Management System Image File employeeview.php unrestricted uploadSourceCodester Human Resource Management System
- CVE-2022-3464puppyCMS settings.php cross site scriptingpuppyCMS
- CVE-2022-3467Jiusi OA hntdCustomDesktopActionContent sql injectionJiusi OA
- CVE-2022-3470SourceCodester Human Resource Management System getstatecity.php sql injectionSourceCodester Human Resource Management System
- CVE-2022-3471SourceCodester Human Resource Management System city.php sql injectionSourceCodester Human Resource Management System
- CVE-2022-3472SourceCodester Human Resource Management System city.php sql injectionSourceCodester Human Resource Management System
- CVE-2022-3473SourceCodester Human Resource Management System getstatecity.php sql injectionSourceCodester Human Resource Management System
- CVE-2022-37601Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js.loader-utils
- CVE-2022-39282RDP client: Read of uninitialized memory with parallel port redirectionFreeRDP
- CVE-2022-39283FreeRDP may read and display out of bounds data FreeRDP
- CVE-2022-41316HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role'sgithub.com/hashicorp/vault
- CVE-2022-41348An issue was discovered in Zimbra Collaboration (ZCS) 9.0.
- CVE-2022-41349In Zimbra Collaboration Suite (ZCS) 8.8.15, the URL at /h/compose accepts an attachUrl parameter that is vulnerable to Reflected XSS.
- CVE-2022-41350In Zimbra Collaboration Suite (ZCS) 8.8.15, /h/search?action=voicemail&action=listen accepts a phone parameter that is vulnerable to Reflect
- CVE-2022-41351In Zimbra Collaboration Suite (ZCS) 8.8.15, at the URL /h/calendar, one can trigger XSS by adding JavaScript code to the view parameter and
- CVE-2022-42077Tenda AC1206 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01 is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolReboot.
- CVE-2022-42078Tenda AC1206 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01 is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolRestoreSet.
- CVE-2022-42086Tenda AX1803 US_AX1803v2.0br_v1.0.0.1_2994_CN_ZGYD01_4 is vulnerable to Cross Site Request Forgery (CSRF) via function TendaAteMode.
- CVE-2022-42087Tenda AX1803 US_AX1803v2.0br_v1.0.0.1_2994_CN_ZGYD01_4 is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolReboot.
- CVE-2022-42715A reflected XSS vulnerability exists in REDCap before 12.04.18 in the Alerts & Notifications upload feature.