# CVEs published 2022-10-12

69 CVEs were published on October 12, 2022: 10 critical, 26 high. Days are UTC.

- [CVE-2022-34391](https://cve.now/CVE-2022-34391.md): Dell Client BIOS Versions prior to the remediated version contain an improper input validation vulnerability. (CVSS 7.5, Dell CPG BIOS)
- [CVE-2022-34390](https://cve.now/CVE-2022-34390.md): Dell BIOS contains a use of uninitialized variable vulnerability. (CVSS 7.5, Dell CPG BIOS)
- [CVE-2022-33937](https://cve.now/CVE-2022-33937.md): Dell GeoDrive, Versions 1.0 - 2.2, contain a Path Traversal Vulnerability in the reporting function. (CVSS 7.1, Dell GeoDrive)
- [CVE-2022-33922](https://cve.now/CVE-2022-33922.md): Dell GeoDrive, versions prior to 2.2, contains Insecure File and Folder Permissions vulnerabilities. (CVSS 7.0, Dell GeoDrive)
- [CVE-2022-33921](https://cve.now/CVE-2022-33921.md): Dell GeoDrive, versions prior to 2.2, contains Multiple DLL Hijacking Vulnerabilities. (CVSS 7.0, Dell GeoDrive)
- [CVE-2022-33920](https://cve.now/CVE-2022-33920.md): Dell GeoDrive, versions prior to 2.2, contains an Unquoted File Path vulnerability. (CVSS 7.8, Dell GeoDrive)
- [CVE-2022-33919](https://cve.now/CVE-2022-33919.md): Dell GeoDrive, versions 2.1 - 2.2, contains an information disclosure vulnerability in GUI. (CVSS 7.8, Dell GeoDrive)
- [CVE-2022-33918](https://cve.now/CVE-2022-33918.md): Dell GeoDrive, Versions 2.1 - 2.2, contains an information disclosure vulnerability. (CVSS 5.5, Dell GeoDrive)
- [CVE-2022-32493](https://cve.now/CVE-2022-32493.md): Dell BIOS contains an Stack-Based Buffer Overflow vulnerability. (CVSS 6.0, Dell CPG BIOS)
- [CVE-2022-32491](https://cve.now/CVE-2022-32491.md): Dell Client BIOS contains a Buffer Overflow vulnerability. (CVSS 4.1, Dell CPG BIOS)
- [CVE-2022-32489](https://cve.now/CVE-2022-32489.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 8.2, Dell CPG BIOS)
- [CVE-2022-32488](https://cve.now/CVE-2022-32488.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 8.2, Dell CPG BIOS)
- [CVE-2022-32487](https://cve.now/CVE-2022-32487.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 7.5, Dell CPG BIOS)
- [CVE-2022-32485](https://cve.now/CVE-2022-32485.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 7.5, Dell CPG BIOS)
- [CVE-2022-32484](https://cve.now/CVE-2022-32484.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 5.6, Dell CPG BIOS)
- [CVE-2022-32483](https://cve.now/CVE-2022-32483.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 5.6, Dell CPG BIOS)
- [CVE-2022-31228](https://cve.now/CVE-2022-31228.md): Dell EMC XtremIO versions prior to X2 6.4.0-22 contain a bruteforce vulnerability. (CVSS 8.1, Dell XtremIO)
- [CVE-2022-0030](https://cve.now/CVE-2022-0030.md): PAN-OS: Authentication Bypass in Web Interface (CVSS 8.1, Palo Alto Networks PAN-OS · Palo Alto Networks Cloud NGFW +1)
- [CVE-2018-18446](https://cve.now/CVE-2018-18446.md): dotPDN Paint.NET before 4.1.2 allows Deserialization of Untrusted Data (issue 1 of 2). (CVSS 9.8)
- [CVE-2018-18447](https://cve.now/CVE-2018-18447.md): dotPDN Paint.NET before 4.1.2 allows Deserialization of Untrusted Data (issue 2 of 2). (CVSS 9.8)
- [CVE-2021-36369](https://cve.now/CVE-2021-36369.md): An issue was discovered in Dropbear through 2020.81. (CVSS 7.5)
- [CVE-2022-22077](https://cve.now/CVE-2022-22077.md): Memory corruption in graphics due to use-after-free in graphics dispatcher logic in Snapdragon Mobile (CVSS 8.4, Qualcomm Snapdragon Mobile)
- [CVE-2022-22078](https://cve.now/CVE-2022-22078.md): Denial of service in BOOT when partition size for a particular partition is requested due to integer overflow when blocks are calculated in (CVSS 4.6, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2022-2249](https://cve.now/CVE-2022-2249.md): Avaya Aura Communication Manager Privilege Escalation Vulnerabilities (CVSS 7.7, Avaya Aura Communication Manager)
- [CVE-2022-25660](https://cve.now/CVE-2022-25660.md): Memory corruption due to double free issue in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial (CVSS 7.8, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2022-25661](https://cve.now/CVE-2022-25661.md): Memory corruption due to untrusted pointer dereference in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2022-25662](https://cve.now/CVE-2022-25662.md): Information disclosure due to untrusted pointer dereference in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapd (CVSS 5.3, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2022-25663](https://cve.now/CVE-2022-25663.md): Possible buffer overflow due to lack of buffer length check during management frame Rx handling lead to denial of service in Snapdragon Comp (CVSS 5.5, Qualcomm Snapdragon Compute, Snapdragon Connectivity, Snapd…)
- [CVE-2022-25664](https://cve.now/CVE-2022-25664.md): Information disclosure due to exposure of information while GPU reads the data in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivi (CVSS 6.2, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2022-25665](https://cve.now/CVE-2022-25665.md): Information disclosure due to buffer over read in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Mobile (CVSS 6.8, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2022-2720](https://cve.now/CVE-2022-2720.md): In affected versions of Octopus Server it was identified that when a sensitive value is a substring of another value, sensitive value maskin (CVSS 5.3, Octopus Deploy Octopus Server)
- [CVE-2022-28887](https://cve.now/CVE-2022-28887.md): Multiple Denial of Service Vulnerability (CVSS 4.3, All F-Secure and WithSecure Endpoint Protection products fo…)
- [CVE-2022-3171](https://cve.now/CVE-2022-3171.md): Memory handling vulnerability in ProtocolBuffers Java core and lite (CVSS 4.3, Google Protocolbuffers · com.google.protobuf:protobuf-ja… +4)
- [CVE-2022-33106](https://cve.now/CVE-2022-33106.md): WiJungle NGFW Version U250 was discovered to be vulnerable to No Rate Limit attack, allowing the attacker to brute force the admin password (CVSS 9.8)
- [CVE-2022-3458](https://cve.now/CVE-2022-3458.md): SourceCodester Human Resource Management System Image File employeeview.php unrestricted upload (CVSS 6.3, SourceCodester Human Resource Management System)
- [CVE-2022-3464](https://cve.now/CVE-2022-3464.md): puppyCMS settings.php cross site scripting (CVSS 4.3, puppyCMS)
- [CVE-2022-3465](https://cve.now/CVE-2022-3465.md): Mediabridge Medialink index.asp improper authentication (CVSS 7.3, Mediabridge Medialink)
- [CVE-2022-3467](https://cve.now/CVE-2022-3467.md): Jiusi OA hntdCustomDesktopActionContent sql injection (CVSS 5.5, Jiusi OA)
- [CVE-2022-3470](https://cve.now/CVE-2022-3470.md): SourceCodester Human Resource Management System getstatecity.php sql injection (CVSS 6.3, SourceCodester Human Resource Management System)
- [CVE-2022-3471](https://cve.now/CVE-2022-3471.md): SourceCodester Human Resource Management System city.php sql injection (CVSS 6.3, SourceCodester Human Resource Management System)
- [CVE-2022-3472](https://cve.now/CVE-2022-3472.md): SourceCodester Human Resource Management System city.php sql injection (CVSS 6.3, SourceCodester Human Resource Management System)
- [CVE-2022-3473](https://cve.now/CVE-2022-3473.md): SourceCodester Human Resource Management System getstatecity.php sql injection (CVSS 6.3, SourceCodester Human Resource Management System)
- [CVE-2022-37601](https://cve.now/CVE-2022-37601.md): Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. (no CVSS, loader-utils)
- [CVE-2022-37611](https://cve.now/CVE-2022-37611.md): Prototype pollution vulnerability in tschaub gh-pages 3.1.0 via the partial variable in util.js. (CVSS 9.8, gh-pages)
- [CVE-2022-37614](https://cve.now/CVE-2022-37614.md): Prototype pollution vulnerability in function enable in mockery.js in mfncooper mockery commit 822f0566fd6d72af8c943ae5ca2aa92e516aa2cf via (CVSS 9.8, mockery)
- [CVE-2022-39282](https://cve.now/CVE-2022-39282.md): RDP client: Read of uninitialized memory with parallel port redirection (CVSS 3.5, FreeRDP)
- [CVE-2022-39283](https://cve.now/CVE-2022-39283.md): FreeRDP may read and display out of bounds data (CVSS 5.9, FreeRDP)
- [CVE-2022-39297](https://cve.now/CVE-2022-39297.md): Deserialization of untrusted data in MelisCms (CVSS 7.7, melisplatform melis-cms · melisplatform/melis-cms)
- [CVE-2022-39298](https://cve.now/CVE-2022-39298.md): Deserialization of untrusted data in MelisFront (CVSS 7.7, melisplatform melis-front · melisplatform/melis-front)
- [CVE-2022-39299](https://cve.now/CVE-2022-39299.md): Signature bypass via multiple root elements in Passport-SAML (CVSS 7.4, node-saml passport-saml · passport-saml +3)
- [CVE-2022-40469](https://cve.now/CVE-2022-40469.md): iKuai OS v3.6.7 was discovered to contain an authenticated remote code execution (RCE) vulnerability. (CVSS 8.8)
- [CVE-2022-40664](https://cve.now/CVE-2022-40664.md): Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher (CVSS 9.8, Apache Software Foundation Apache Shiro · org.apache.shiro:…)
- [CVE-2022-40871](https://cve.now/CVE-2022-40871.md): Dolibarr ERP & CRM \<=15.0.3 is vulnerable to Eval injection. (CVSS 9.8, dolibarr/dolibarr)
- [CVE-2022-41316](https://cve.now/CVE-2022-41316.md): HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role's (CVSS 5.3, github.com/hashicorp/vault)
- [CVE-2022-41348](https://cve.now/CVE-2022-41348.md): An issue was discovered in Zimbra Collaboration (ZCS) 9.0. (CVSS 6.1)
- [CVE-2022-41349](https://cve.now/CVE-2022-41349.md): In Zimbra Collaboration Suite (ZCS) 8.8.15, the URL at /h/compose accepts an attachUrl parameter that is vulnerable to Reflected XSS. (CVSS 6.1)
- [CVE-2022-41350](https://cve.now/CVE-2022-41350.md): In Zimbra Collaboration Suite (ZCS) 8.8.15, /h/search?action=voicemail&action=listen accepts a phone parameter that is vulnerable to Reflect (CVSS 6.1)
- [CVE-2022-41351](https://cve.now/CVE-2022-41351.md): In Zimbra Collaboration Suite (ZCS) 8.8.15, at the URL /h/calendar, one can trigger XSS by adding JavaScript code to the view parameter and (CVSS 6.1)
- [CVE-2022-41403](https://cve.now/CVE-2022-41403.md): OpenCart 3.x Newsletter Custom Popup was discovered to contain a SQL injection vulnerability via the email parameter at index.php?route=exte (CVSS 9.8)
- [CVE-2022-42077](https://cve.now/CVE-2022-42077.md): Tenda AC1206 US\_AC1206V1.0RTL\_V15.03.06.23\_multi\_TD01 is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolReboot. (CVSS 6.5)
- [CVE-2022-42078](https://cve.now/CVE-2022-42078.md): Tenda AC1206 US\_AC1206V1.0RTL\_V15.03.06.23\_multi\_TD01 is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolRestoreSet. (CVSS 6.5)
- [CVE-2022-42079](https://cve.now/CVE-2022-42079.md): Tenda AC1206 US\_AC1206V1.0RTL\_V15.03.06.23\_multi\_TD01 was discovered to contain a stack overflow via the function formWifiBasicSet. (CVSS 7.5)
- [CVE-2022-42080](https://cve.now/CVE-2022-42080.md): Tenda AC1206 US\_AC1206V1.0RTL\_V15.03.06.23\_multi\_TD01 was discovered to contain a heap overflow via sched\_start\_time parameter. (CVSS 7.5)
- [CVE-2022-42081](https://cve.now/CVE-2022-42081.md): Tenda AC1206 US\_AC1206V1.0RTL\_V15.03.06.23\_multi\_TD01 was discovered to contain a stack overflow via sched\_end\_time parameter. (CVSS 7.5)
- [CVE-2022-42086](https://cve.now/CVE-2022-42086.md): Tenda AX1803 US\_AX1803v2.0br\_v1.0.0.1\_2994\_CN\_ZGYD01\_4 is vulnerable to Cross Site Request Forgery (CSRF) via function TendaAteMode. (CVSS 6.5)
- [CVE-2022-42087](https://cve.now/CVE-2022-42087.md): Tenda AX1803 US\_AX1803v2.0br\_v1.0.0.1\_2994\_CN\_ZGYD01\_4 is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolReboot. (CVSS 6.5)
- [CVE-2022-42711](https://cve.now/CVE-2022-42711.md): In Progress WhatsUp Gold before 22.1.0, an SNMP MIB Walker application endpoint failed to adequately sanitize malicious input. (CVSS 9.6)
- [CVE-2022-42715](https://cve.now/CVE-2022-42715.md): A reflected XSS vulnerability exists in REDCap before 12.04.18 in the Alerts & Notifications upload feature. (CVSS 6.1)
- [CVE-2022-42897](https://cve.now/CVE-2022-42897.md): Array Networks AG/vxAG with ArrayOS AG before 9.4.0.469 allows unauthenticated command injection that leads to privilege escalation and cont (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-10-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.