CVEs published October 13, 2022
63 CVEs were published on October 13, 2022: 6 critical, 31 high.
- Published
- 63
- Critical
- 6
- High
- 31
- Medium
- 22
- Low
- 2
- Unrated
- 2
- Now in CISA KEV
- 0
- Fix available
- 20
Most affected products
- :linux_kernel:
- 4
- grafana · github.com/grafana/grafana
- 4
- ikus060/rdiffweb · rdiffweb
- 2
- Ree6-Applications Ree6
- 2
- SourceCodester Human Resource Management System
- 2
- Apache Software Foundation Apache Commons Text · org.apa… +1
- 1
- Apache Software Foundation Apache Kylin · org.apache.kyl… +2
- 1
- azure-rtos usbx
- 1
- istio
- 1
- KnowageLabs Knowage-Server
- 1
Critical 6
- CVE-2022-24697Apache Kylin prior to 4.0.2 allows command injection when the configuration overwrites function overwrites system parametersApache Software Foundation Apache Kylin · org.apache.kyl… +2
- CVE-2022-41390OcoMon v4.0 was discovered to contain a SQL injection vulnerability via the cod parameter at download.php.
- CVE-2022-41391OcoMon v4.0 was discovered to contain a SQL injection vulnerability via the cod parameter at showImg.php.
- CVE-2022-41495ClipperCMS 1.3.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the rss_url_news parameter at /manager/index.php.
- CVE-2022-41496iCMS v7.0.16 was discovered to contain a Server-Side Request Forgery (SSRF) via the url parameter at admincp.php.
- CVE-2022-41497ClipperCMS 1.3.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the pkg_url parameter at /manager/index.php.
High 31
- CVE-2021-20030SonicWall GMS is vulnerable to file path manipulation resulting that an unauthenticated attacker can gain access to web directory containingSonicWall GMS
- CVE-2022-34020Cross Site Request Forgery (CSRF) vulnerability in ResIOT ResIOT IOT Platform + LoRaWAN Network Server through 4.1.1000114 allows attackers
- CVE-2022-34022SQL injection vulnerability in ResIOT IOT Platform + LoRaWAN Network Server through 4.1.1000114 via a crafted POST request to /ResiotQueryDB
- CVE-2022-35135Boodskap IoT Platform v4.4.9-02 allows attackers to escalate privileges via a crafted request sent to /api/user/upsert/<uuid>.
- CVE-2022-37208JFinal CMS 5.1.0 is vulnerable to SQL Injection.
- CVE-2022-39278Istio vulnerable to denial of service attack due to Golang Regex Libraryistio
- CVE-2022-39293Azure RTOS USBX Host PIMA vulnerable to read integer underflow with buffer overflowazure-rtos usbx
- CVE-2022-39300Signature bypass via multiple root elements in node-SAMLnode-saml
- CVE-2022-39303Ree6 vulnerable to SQL InjectionRee6-Applications Ree6
- CVE-2022-40187Foresight GC3 Launch Monitor 1.3.15.68 ships with a Target Communication Framework (TCF) service enabled.
- CVE-2022-41475RPCMS v3.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add an administrator accoun
- CVE-2022-41480Tenda AC1200 US_AC6V2.0RTL_V15.03.06.51_multi_TDE01 was discovered to contain a buffer overflow in the 0x475dc function.
- CVE-2022-41481Tenda AC1200 US_AC6V2.0RTL_V15.03.06.51_multi_TDE01 was discovered to contain a buffer overflow in the 0x47de1c function.
- CVE-2022-41482Tenda AC1200 US_AC6V2.0RTL_V15.03.06.51_multi_TDE01 was discovered to contain a buffer overflow in the 0x47c5dc function.
- CVE-2022-41483Tenda AC1200 US_AC6V2.0RTL_V15.03.06.51_multi_TDE01 was discovered to contain a buffer overflow in the 0x4a12cc function.
- CVE-2022-41484Tenda AC1900 AP500(US)_V1_180320(Beta) was discovered to contain a buffer overflow in the 0x32384 function.
- CVE-2022-41485Tenda AC1200 US_AC6V2.0RTL_V15.03.06.51_multi_TDE01 was discovered to contain a buffer overflow in the 0x47ce00 function.
- CVE-2022-41489WAYOS LQ_09 22.03.17V was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to send crafted requests to the s
- CVE-2022-41533Online Diagnostic Lab Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /php_action/
- CVE-2022-41534Online Diagnostic Lab Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /php_action/
- CVE-2022-41674An issue was discovered in the Linux kernel before 5.19.16.:linux_kernel:
- CVE-2022-42156D-Link COVR 1200,1203 v1.08 was discovered to contain a command injection vulnerability via the tomography_ping_number parameter at function
- CVE-2022-42160D-Link COVR 1200,1202,1203 v1.08 was discovered to contain a command injection vulnerability via the system_time_timezone parameter at funct
- CVE-2022-42161D-Link COVR 1200,1202,1203 v1.08 was discovered to contain a command injection vulnerability via the /SetTriggerWPS/PIN parameter at functio
- CVE-2022-42719A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through 5.19.x before 5.19.16 could be use:linux_kernel:
- CVE-2022-42720Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used:linux_kernel:
- CVE-2022-42899Bentley MicroStation and MicroStation-based applications may be affected by out-of-bounds read and stack overflow issues when opening crafte
- CVE-2022-42900Bentley MicroStation and MicroStation-based applications may be affected by out-of-bounds read issues when opening crafted FBX files.
- CVE-2022-42901Bentley MicroStation and MicroStation-based applications may be affected by out-of-bounds and stack overflow issues when opening crafted XMT
- CVE-2022-42902In Linaro Automated Validation Architecture (LAVA) before 2022.10, there is dynamic code execution in lava_server/lavatable.py.
- CVE-2022-42906powerline-gitstatus (aka Powerline Gitstatus) before 1.3.2 allows arbitrary code execution.powerline-gitstatus
Medium, low and unrated 26
- CVE-2022-2828In affected versions of Octopus Server it is possible to reveal information about teams via the API due to an Insecure Direct Object ReferenOctopus Deploy Octopus Server
- CVE-2022-31123Grafana plugin signature bypass vulnerabilitygrafana · github.com/grafana/grafana
- CVE-2022-31130Grafana data source and plugin proxy endpoints leaking authentication tokens to some destination pluginsgrafana · github.com/grafana/grafana
- CVE-2022-34021Multiple Cross Site Scripting (XSS) vulnerabilities in ResIOT IOT Platform + LoRaWAN Network Server through 4.1.1000114 via the form fields.
- CVE-2022-3456Allocation of Resources Without Limits or Throttling in ikus060/rdiffwebikus060/rdiffweb · rdiffweb
- CVE-2022-3457Origin Validation Error in ikus060/rdiffwebikus060/rdiffweb · rdiffweb
- CVE-2022-3492SourceCodester Human Resource Management System Profile Photo os command injectionSourceCodester Human Resource Management System
- CVE-2022-3493SourceCodester Human Resource Management System Add Employee cross site scriptingSourceCodester Human Resource Management System
- CVE-2022-35080SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via png_load at /lib/png.c.
- CVE-2022-35081SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via png_read_header at /src/png2swf.c.
- CVE-2022-35134Boodskap IoT Platform v4.4.9-02 contains a cross-site scripting (XSS) vulnerability.
- CVE-2022-35136Boodskap IoT Platform v4.4.9-02 allows attackers to make unauthenticated API requests.
- CVE-2022-35611A Cross-Site Request Forgery (CSRF) in MQTTRoute v3.3 and below allows attackers to create and remove dashboards.
- CVE-2022-35612A cross-site scripting (XSS) vulnerability in MQTTRoute v3.3 and below allows attackers to execute arbitrary web scripts or HTML via a craft
- CVE-2022-35944October CMS Safe Mode bypass leads to authenticated RCE (Remote Code Execution)octobercms october · october/system
- CVE-2022-38902A Cross-site scripting (XSS) vulnerability in the Blog module - add new topic functionality in Liferay Digital Experience Platform 7.3.10 SP
- CVE-2022-39201Data source and plugin proxy endpoints could leak the authentication cookie to some destination pluginsgrafana · github.com/grafana/grafana
- CVE-2022-39229Grafana users with email as a username can block other users from signing ingrafana · github.com/grafana/grafana
- CVE-2022-39295Improper Neutralization of Alternate XSS Syntax in Knowage-ServerKnowageLabs Knowage-Server
- CVE-2022-39302Ree6 may bypass webhook protectionRee6-Applications Ree6
- CVE-2022-41473RPCMS v3.0.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the Search function.
- CVE-2022-41474RPCMS v3.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily change the password of any
- CVE-2022-42159D-Link COVR 1200,1202,1203 v1.08 was discovered to have a predictable seed in a Pseudo-Random Number Generator.
- CVE-2022-42721A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local att:linux_kernel:
- CVE-2022-42722In the Linux kernel 5.8 through 5.19.x before 5.19.16, local attackers able to inject WLAN frames into the mac80211 stack could cause a NULL
- CVE-2022-42889Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaultsApache Software Foundation Apache Commons Text · org.apa… +1