# CVEs published 2022-10-14

186 CVEs were published on October 14, 2022: 21 critical, 72 high. Days are UTC.

- [CVE-2022-38448](https://cve.now/CVE-2022-38448.md): Adobe Dimension SKP File Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Dimension)
- [CVE-2022-38444](https://cve.now/CVE-2022-38444.md): Adobe Dimension SKP File Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Dimension)
- [CVE-2022-38446](https://cve.now/CVE-2022-38446.md): Adobe Dimension SKP File Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Dimension)
- [CVE-2022-38443](https://cve.now/CVE-2022-38443.md): Adobe Dimension GLB File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Dimension)
- [CVE-2022-38442](https://cve.now/CVE-2022-38442.md): Adobe Dimension SKP File Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Dimension)
- [CVE-2022-38445](https://cve.now/CVE-2022-38445.md): Adobe Dimension SKP File Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Dimension)
- [CVE-2022-38447](https://cve.now/CVE-2022-38447.md): Adobe Dimension SKP File Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Dimension)
- [CVE-2022-38441](https://cve.now/CVE-2022-38441.md): Adobe Dimension GLB File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Dimension)
- [CVE-2022-38440](https://cve.now/CVE-2022-38440.md): Adobe Dimension SKP File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Dimension)
- [CVE-2022-35689](https://cve.now/CVE-2022-35689.md): Adobe Commerce Improper Access Control Security feature bypass (CVSS 5.3, Adobe Magento Commerce · magento/community-edition +1)
- [CVE-2022-35698](https://cve.now/CVE-2022-35698.md): Adobe Commerce Stored XSS Arbitrary code execution (CVSS 10.0, Adobe Magento Commerce · magento/community-edition +1)
- [CVE-2022-38437](https://cve.now/CVE-2022-38437.md): Adobe Acrobat Reader Use After Free Memory leak (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2022-38449](https://cve.now/CVE-2022-38449.md): Adobe Acrobat Reader DC JP2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2022-35691](https://cve.now/CVE-2022-35691.md): Adobe Acrobat Reader NULL Pointer Dereference Application denial-of-service (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2022-42339](https://cve.now/CVE-2022-42339.md): Adobe Acrobat Reader DC XFA Parsing Stack Overflow Remote Code Execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-42342](https://cve.now/CVE-2022-42342.md): Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2022-38450](https://cve.now/CVE-2022-38450.md): Adobe Acrobat Reader DC XFA Parsing Stack Overflow Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-42341](https://cve.now/CVE-2022-42341.md): Adobe ColdFusion Improper Restriction of XML External Entity Reference Arbitrary file system read (CVSS 7.5, Adobe ColdFusion)
- [CVE-2022-38424](https://cve.now/CVE-2022-38424.md): Adobe ColdFusion Application Server Directory Traversal Arbitrary file system write (CVSS 7.2, Adobe ColdFusion)
- [CVE-2022-42340](https://cve.now/CVE-2022-42340.md): Adobe ColdFusion Improper Input Validation Arbitrary file system read (CVSS 7.5, Adobe ColdFusion)
- [CVE-2022-38423](https://cve.now/CVE-2022-38423.md): Adobe ColdFusion Application Server Directory Traversal Information Disclosure Vulnerability (CVSS 4.9, Adobe ColdFusion)
- [CVE-2022-38422](https://cve.now/CVE-2022-38422.md): Adobe ColdFusion Application Server Directory Traversal Information Disclosure Vulnerability (CVSS 7.5, Adobe ColdFusion)
- [CVE-2022-38421](https://cve.now/CVE-2022-38421.md): Adobe ColdFusion Application Server Directory Traversal Remote Code Execution Vulnerability (CVSS 7.2, Adobe ColdFusion)
- [CVE-2022-38419](https://cve.now/CVE-2022-38419.md): Adobe ColdFusion Solr Service XML External Entity Processing Arbitrary file system read (CVSS 7.5, Adobe ColdFusion)
- [CVE-2022-35711](https://cve.now/CVE-2022-35711.md): Adobe ColdFusion ODBC Server Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 9.8, Adobe ColdFusion)
- [CVE-2022-38420](https://cve.now/CVE-2022-38420.md): Adobe ColdFusion Use of Hard-coded Credentials Application denial-of-service (CVSS 7.5, Adobe ColdFusion)
- [CVE-2022-35690](https://cve.now/CVE-2022-35690.md): Adobe ColdFusion ODBC Agent Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 9.8, Adobe ColdFusion)
- [CVE-2022-35712](https://cve.now/CVE-2022-35712.md): Adobe ColdFusion ODBC Agent Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 9.8, Adobe ColdFusion)
- [CVE-2022-35710](https://cve.now/CVE-2022-35710.md): Adobe ColdFusion ODBC Server Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 9.8, Adobe ColdFusion)
- [CVE-2022-38418](https://cve.now/CVE-2022-38418.md): Adobe ColdFusion Application Server Directory Traversal Remote Code Execution Vulnerability (CVSS 9.8, Adobe ColdFusion)
- [CVE-2022-41623](https://cve.now/CVE-2022-41623.md): WordPress ALD - AliExpress Dropshipping and Fulfillment for WooCommerce premium plugin \<= 1.1.0 - Sensitive Data Exposure vulnerability (CVSS 7.5, Villatheme ALD - AliExpress Dropshipping and Fulfillment fo…)
- [CVE-2022-28761](https://cve.now/CVE-2022-28761.md): Zoom On-Premise Deployments: Improper Access Control (CVSS 6.5, Zoom Video Communications Zoom On-Premise Meeting Connector…)
- [CVE-2022-28759](https://cve.now/CVE-2022-28759.md): Zoom On-Premise Deployments: Improper Access Control (CVSS 8.2, Zoom Video Communications Zoom On-Premise Meeting Connector…)
- [CVE-2022-28760](https://cve.now/CVE-2022-28760.md): Zoom On-Premise Deployments: Improper Access Control (CVSS 6.5, Zoom Video Communications Zoom On-Premise Meeting Connector…)
- [CVE-2022-28762](https://cve.now/CVE-2022-28762.md): Debugging port misconfiguration in Zoom Apps in the Zoom Client for Meetings for macOS (CVSS 7.3, Zoom Video Communications Zoom Client for Meetings for MacOS)
- [CVE-2022-42464](https://cve.now/CVE-2022-42464.md): Kernel memory pool override in /dev/mmz\_userdev device driver. The impact depends on the privileges of the attacker. The unprivileged process run on the device could disclose sensitive information including kernel pointer, which could be used in furth ... (CVSS 6.7, OpenHarmony)
- [CVE-2022-42463](https://cve.now/CVE-2022-42463.md): Softbus\_server in communication subsystem has a authenication bypass vulnerability in a callback handler function. Attackers can launch attacks on distributed networks by sending Bluetooth rfcomm packets to any remote device and executing arbitrary co ... (CVSS 8.3, OpenHarmony)
- [CVE-2022-41686](https://cve.now/CVE-2022-41686.md): Out-of-bound memory read and write in /dev/mmz\_userdev device driver. The impact depends on the privileges of the attacker. The unprivileged process run on the device could read out-of-bound memory leading sensitive to information disclosure. The proc ... (CVSS 5.1, OpenHarmony)
- [CVE-2022-42488](https://cve.now/CVE-2022-42488.md): Startup subsystem missed permission validation in param service. An malicious application installed on the device could elevate its privileges to the root user, disable security features, or cause DoS by disabling particular services. (CVSS 8.4, OpenHarmony)
- [CVE-2022-32177](https://cve.now/CVE-2022-32177.md): Gin-vue-admin - Unrestricted File Upload (CVSS 9.0, gin-vue-admin)
- [CVE-2022-36803](https://cve.now/CVE-2022-36803.md): The MasterUserEdit API in Atlassian Jira Align Server before version 10.109.2 allows An authenticated attacker with the People role permissi (CVSS 8.8, Atlassian Jira Align)
- [CVE-2022-36802](https://cve.now/CVE-2022-36802.md): The ManageJiraConnectors API in Atlassian Jira Align before version 10.109.2 allows remote attackers to exploit this issue to access interna (CVSS 4.9, Atlassian Jira Align)
- [CVE-2021-0699](https://cve.now/CVE-2021-0699.md): In HTBLogKM of TBD, there is a possible out of bounds write due to a missing bounds check. (CVSS 7.8, Android)
- [CVE-2021-22685](https://cve.now/CVE-2021-22685.md): Cassia Networks Access Controller Path Traversal (CVSS 6.2, Cassia Networks Access Controller)
- [CVE-2021-27406](https://cve.now/CVE-2021-27406.md): PerFact OpenVPN-Client (CVSS 8.8, PerFact OpenVPN-Client)
- [CVE-2021-46839](https://cve.now/CVE-2021-46839.md): The HW\_KEYMASTER module has a vulnerability of missing bounds check on length.Successful exploitation of this vulnerability may cause malici (CVSS 9.1, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2021-46840](https://cve.now/CVE-2021-46840.md): The HW\_KEYMASTER module has an out-of-bounds access vulnerability in parameter set verification.Successful exploitation of this vulnerabilit (CVSS 9.1, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-20397](https://cve.now/CVE-2022-20397.md): In SitRilClient\_OnResponse of SitRilSe.cpp, there is a possible out of bounds write due to a missing bounds check. (CVSS 7.8, Android)
- [CVE-2022-20464](https://cve.now/CVE-2022-20464.md): In various functions of ap\_input\_processor.c, there is a possible way to record audio during a phone call due to a logic error in the code. (CVSS 5.5, Android)
- [CVE-2022-2780](https://cve.now/CVE-2022-2780.md): In affected versions of Octopus Server it is possible to use the Git Connectivity test function on the VCS project to initiate an SMB reques (CVSS 8.1, Octopus Deploy Octopus Server)
- [CVE-2022-2850](https://cve.now/CVE-2022-2850.md): A flaw was found In 389-ds-base. (CVSS 6.5, 389-ds-base)
- [CVE-2022-2879](https://cve.now/CVE-2022-2879.md): Unbounded memory consumption when reading headers in archive/tar (no CVSS, Go standard library archive/tar · stdlib)
- [CVE-2022-2880](https://cve.now/CVE-2022-2880.md): Incorrect sanitization of forwarded query parameters in net/http/httputil (no CVSS, Go standard library net/http/httputil · stdlib)
- [CVE-2022-2963](https://cve.now/CVE-2022-2963.md): A vulnerability found in jasper. (CVSS 7.5, jasper)
- [CVE-2022-2984](https://cve.now/CVE-2022-2984.md): In jpg driver, there is a possible out of bounds write due to a missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-2985](https://cve.now/CVE-2022-2985.md): In music service, there is a missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-32149](https://cve.now/CVE-2022-32149.md): Denial of service via crafted Accept-Language header in golang.org/x/text/language (CVSS 7.5, golang.org/x/text/language · golang.org/x/text)
- [CVE-2022-3439](https://cve.now/CVE-2022-3439.md): Allocation of Resources Without Limits or Throttling in ikus060/rdiffweb (CVSS 4.5, ikus060/rdiffweb · rdiffweb)
- [CVE-2022-3479](https://cve.now/CVE-2022-3479.md): A vulnerability found in nss. (no CVSS, nss)
- [CVE-2022-3495](https://cve.now/CVE-2022-3495.md): SourceCodester Simple Online Public Access Catalog Admin Login sql injection (CVSS 7.3, SourceCodester Simple Online Public Access Catalog)
- [CVE-2022-3496](https://cve.now/CVE-2022-3496.md): SourceCodester Human Resource Management System Admin Panel employeeadd.php access control (CVSS 6.3, SourceCodester Human Resource Management System)
- [CVE-2022-3497](https://cve.now/CVE-2022-3497.md): SourceCodester Human Resource Management System Master List cross site scripting (CVSS 3.5, SourceCodester Human Resource Management System)
- [CVE-2022-3502](https://cve.now/CVE-2022-3502.md): Human Resource Management System Leave cross site scripting (CVSS 3.5, Human Resource Management System)
- [CVE-2022-3503](https://cve.now/CVE-2022-3503.md): SourceCodester Purchase Order Management System Supplier cross site scripting (CVSS 3.5, SourceCodester Purchase Order Management System)
- [CVE-2022-3504](https://cve.now/CVE-2022-3504.md): SourceCodester Sanitization Management System sql injection (CVSS 6.3, SourceCodester Sanitization Management System)
- [CVE-2022-35040](https://cve.now/CVE-2022-35040.md): OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b5567. (CVSS 6.5)
- [CVE-2022-35041](https://cve.now/CVE-2022-35041.md): OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b558f. (CVSS 6.5)
- [CVE-2022-35042](https://cve.now/CVE-2022-35042.md): OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x4adb11. (CVSS 6.5)
- [CVE-2022-35043](https://cve.now/CVE-2022-35043.md): OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6c08a6. (CVSS 6.5)
- [CVE-2022-35044](https://cve.now/CVE-2022-35044.md): OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x617087. (CVSS 6.5)
- [CVE-2022-35045](https://cve.now/CVE-2022-35045.md): OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b0d63. (CVSS 6.5)
- [CVE-2022-35046](https://cve.now/CVE-2022-35046.md): OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b0466. (CVSS 6.5)
- [CVE-2022-35047](https://cve.now/CVE-2022-35047.md): OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b05aa. (CVSS 6.5)
- [CVE-2022-35048](https://cve.now/CVE-2022-35048.md): OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b0b2c. (CVSS 6.5)
- [CVE-2022-35049](https://cve.now/CVE-2022-35049.md): OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b03b5. (CVSS 6.5)
- [CVE-2022-3505](https://cve.now/CVE-2022-3505.md): SourceCodester Sanitization Management System cross site scripting (CVSS 3.5, SourceCodester Sanitization Management System)
- [CVE-2022-35050](https://cve.now/CVE-2022-35050.md): OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b04de. (CVSS 6.5)
- [CVE-2022-35051](https://cve.now/CVE-2022-35051.md): OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b55af. (no CVSS)
- [CVE-2022-35052](https://cve.now/CVE-2022-35052.md): OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b84b1. (CVSS 6.5)
- [CVE-2022-35053](https://cve.now/CVE-2022-35053.md): OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x61731f. (CVSS 6.5)
- [CVE-2022-35054](https://cve.now/CVE-2022-35054.md): OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6171b2. (CVSS 6.5)
- [CVE-2022-35055](https://cve.now/CVE-2022-35055.md): OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6c0473. (CVSS 6.5)
- [CVE-2022-35056](https://cve.now/CVE-2022-35056.md): OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b0478. (CVSS 6.5)
- [CVE-2022-35058](https://cve.now/CVE-2022-35058.md): OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b05ce. (CVSS 6.5)
- [CVE-2022-35059](https://cve.now/CVE-2022-35059.md): OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6c0414. (CVSS 6.5)
- [CVE-2022-3506](https://cve.now/CVE-2022-3506.md): Cross-site Scripting (XSS) - Stored in barrykooij/related-posts-for-wp (CVSS 5.5, barrykooij/related-posts-for-wp)
- [CVE-2022-37602](https://cve.now/CVE-2022-37602.md): Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js. (CVSS 9.8, grunt-karma)
- [CVE-2022-37603](https://cve.now/CVE-2022-37603.md): A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0. (CVSS 7.5, loader-utils)
- [CVE-2022-38669](https://cve.now/CVE-2022-38669.md): In soundrecorder service, there is a missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-38670](https://cve.now/CVE-2022-38670.md): In soundrecorder service, there is a missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-38671](https://cve.now/CVE-2022-38671.md): In camera driver, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-38672](https://cve.now/CVE-2022-38672.md): In face detect driver, there is a possible out of bounds write due to a missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-38673](https://cve.now/CVE-2022-38673.md): In face detect driver, there is a possible out of bounds write due to a missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-38676](https://cve.now/CVE-2022-38676.md): In gpu driver, there is a possible out of bounds write due to a missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-38677](https://cve.now/CVE-2022-38677.md): In cell service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-38679](https://cve.now/CVE-2022-38679.md): In music service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-38687](https://cve.now/CVE-2022-38687.md): In messaging service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-38688](https://cve.now/CVE-2022-38688.md): In telephony service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-38689](https://cve.now/CVE-2022-38689.md): In telephony service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-38690](https://cve.now/CVE-2022-38690.md): In camera driver, there is a possible memory corruption due to improper locking. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-38697](https://cve.now/CVE-2022-38697.md): In messaging service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-38698](https://cve.now/CVE-2022-38698.md): In messaging service, there is a missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-38977](https://cve.now/CVE-2022-38977.md): The HwAirlink module has a heap overflow vulnerability.Successful exploitation of this vulnerability may cause out-of-bounds writes, resulti (CVSS 7.5, Huawei HarmonyOS)
- [CVE-2022-38980](https://cve.now/CVE-2022-38980.md): The HwAirlink module has a heap overflow vulnerability in processing data packets of the proprietary protocol.Successful exploitation of thi (CVSS 9.8, Huawei HarmonyOS)
- [CVE-2022-38981](https://cve.now/CVE-2022-38981.md): The HwAirlink module has an out-of-bounds read vulnerability.Successful exploitation of this vulnerability may cause information leakage. (CVSS 7.5, Huawei HarmonyOS)
- [CVE-2022-38982](https://cve.now/CVE-2022-38982.md): The fingerprint module has service logic errors.Successful exploitation of this vulnerability will cause the phone lock to be cracked. (CVSS 9.8, Huawei HarmonyOS)
- [CVE-2022-38983](https://cve.now/CVE-2022-38983.md): The BT Hfp Client module has a Use-After-Free (UAF) vulnerability.Successful exploitation of this vulnerability may result in arbitrary code (CVSS 9.8, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-38984](https://cve.now/CVE-2022-38984.md): The HIPP module has a vulnerability of not verifying the data transferred in the kernel space.Successful exploitation of this vulnerability (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-38985](https://cve.now/CVE-2022-38985.md): The facial recognition module has a vulnerability in input validation.Successful exploitation of this vulnerability may affect data confiden (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-38986](https://cve.now/CVE-2022-38986.md): The HIPP module has a vulnerability of bypassing the check of the data transferred in the kernel space.Successful exploitation of this vulne (CVSS 9.1, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-38998](https://cve.now/CVE-2022-38998.md): The HISP module has a vulnerability of not verifying the data transferred in the kernel space.Successful exploitation of this vulnerability (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-39011](https://cve.now/CVE-2022-39011.md): The HISP module has a vulnerability of bypassing the check of the data transferred in the kernel space.Successful exploitation of this vulne (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-39064](https://cve.now/CVE-2022-39064.md): An attacker sending a single malformed IEEE 802.15.4 (Zigbee) frame makes the TRÅDFRI bulb blink, and if they replay (i.e. (CVSS 8.1, Ikea TRÅDFRI smart lighting system)
- [CVE-2022-39065](https://cve.now/CVE-2022-39065.md): A single malformed IEEE 802.15.4 (Zigbee) frame makes the TRÅDFRI gateway unresponsive, such that connected lighting cannot be controlled wi (CVSS 6.5, Ikea TRÅDFRI gateway system)
- [CVE-2022-39080](https://cve.now/CVE-2022-39080.md): In messaging service, there is a missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39103](https://cve.now/CVE-2022-39103.md): In Gallery service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39105](https://cve.now/CVE-2022-39105.md): In sensor driver, there is a possible out of bounds write due to a missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39107](https://cve.now/CVE-2022-39107.md): In Soundrecorder service, there is a missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39108](https://cve.now/CVE-2022-39108.md): In Music service, there is a missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39109](https://cve.now/CVE-2022-39109.md): In Music service, there is a missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39110](https://cve.now/CVE-2022-39110.md): In Music service, there is a missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39111](https://cve.now/CVE-2022-39111.md): In Music service, there is a missing permission check. (CVSS 7.8, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39112](https://cve.now/CVE-2022-39112.md): In Music service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39113](https://cve.now/CVE-2022-39113.md): In Music service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39114](https://cve.now/CVE-2022-39114.md): In Music service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39115](https://cve.now/CVE-2022-39115.md): In Music service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39117](https://cve.now/CVE-2022-39117.md): In messaging service, there is a missing permission check. (CVSS 8.1, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39120](https://cve.now/CVE-2022-39120.md): In sensor driver, there is a possible out of bounds write due to a missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39121](https://cve.now/CVE-2022-39121.md): In sensor driver, there is a possible out of bounds write due to a missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39122](https://cve.now/CVE-2022-39122.md): In sensor driver, there is a possible out of bounds write due to a missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39123](https://cve.now/CVE-2022-39123.md): In sensor driver, there is a possible out of bounds write due to a missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39124](https://cve.now/CVE-2022-39124.md): In sensor driver, there is a possible out of bounds write due to a missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39125](https://cve.now/CVE-2022-39125.md): In sensor driver, there is a possible out of bounds write due to a missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39126](https://cve.now/CVE-2022-39126.md): In sensor driver, there is a possible out of bounds write due to a missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39127](https://cve.now/CVE-2022-39127.md): In sensor driver, there is a possible out of bounds write due to a missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39128](https://cve.now/CVE-2022-39128.md): In sensor driver, there is a possible out of bounds write due to a missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39308](https://cve.now/CVE-2022-39308.md): GoCD API authentication of user access tokens subject to timing attack during comparison (CVSS 6.5, gocd)
- [CVE-2022-39309](https://cve.now/CVE-2022-39309.md): GoCD server secret encryption/decryption key leaked to agents during material serialization (CVSS 4.9, gocd)
- [CVE-2022-39310](https://cve.now/CVE-2022-39310.md): Malicious agent may be able to impersonate another agent in GoCD (CVSS 4.9, gocd)
- [CVE-2022-39311](https://cve.now/CVE-2022-39311.md): Compromised agents may be able to execute remote code on GoCD Server (CVSS 9.1, gocd)
- [CVE-2022-41302](https://cve.now/CVE-2022-41302.md): An Out-Of-Bounds Read Vulnerability in Autodesk FBX SDK version 2020. (CVSS 7.8, FBX SDK)
- [CVE-2022-41303](https://cve.now/CVE-2022-41303.md): A user may be tricked into opening a malicious FBX file which may exploit a use-after-free vulnerability in Autodesk FBX SDK 2020 version ca (CVSS 7.8, FBX SDK)
- [CVE-2022-41304](https://cve.now/CVE-2022-41304.md): An Out-Of-Bounds Write Vulnerability in Autodesk FBX SDK 2020 version and prior may lead to code execution through maliciously crafted FBX f (CVSS 7.8, FBX SDK)
- [CVE-2022-41305](https://cve.now/CVE-2022-41305.md): A maliciously crafted PKT file when consumed through SubassemblyComposer.exe application could lead to memory corruption vulnerability by wr (CVSS 7.8, Subassembly Composer)
- [CVE-2022-41306](https://cve.now/CVE-2022-41306.md): A maliciously crafted PCT file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write acc (CVSS 7.8, Autodesk® Design Review)
- [CVE-2022-41307](https://cve.now/CVE-2022-41307.md): A maliciously crafted PKT file when consumed through SubassemblyComposer.exe application could lead to memory corruption vulnerability by re (CVSS 7.8, Subassembly Composer)
- [CVE-2022-41308](https://cve.now/CVE-2022-41308.md): A maliciously crafted PKT file when consumed through SubassemblyComposer.exe application could lead to memory corruption vulnerability by re (CVSS 7.8, Subassembly Composer)
- [CVE-2022-41416](https://cve.now/CVE-2022-41416.md): Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /user/update\_b (CVSS 7.2)
- [CVE-2022-41436](https://cve.now/CVE-2022-41436.md): An issue in OXHOO TP50 OXH1.50 allows unauthenticated attackers to access the administrative panel via browsing to the URL http://device\_ip/ (CVSS 9.1)
- [CVE-2022-41477](https://cve.now/CVE-2022-41477.md): A security issue was discovered in WeBid \<=1.2.2. (CVSS 9.1)
- [CVE-2022-41535](https://cve.now/CVE-2022-41535.md): Open Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /sacco\_shield/manag (CVSS 7.2)
- [CVE-2022-41536](https://cve.now/CVE-2022-41536.md): Open Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /sacco\_shield/manag (CVSS 7.2)
- [CVE-2022-41538](https://cve.now/CVE-2022-41538.md): Wedding Planner v1.0 was discovered to contain an arbitrary file upload vulnerability in the component /Wedding-Management-PHP/admin/photos\_ (CVSS 8.8)
- [CVE-2022-41539](https://cve.now/CVE-2022-41539.md): Wedding Planner v1.0 was discovered to contain an arbitrary file upload vulnerability in the component /admin/users\_add.php. (CVSS 8.8)
- [CVE-2022-41576](https://cve.now/CVE-2022-41576.md): The rphone module has a script that can be maliciously modified.Successful exploitation of this vulnerability may cause irreversible program (CVSS 7.8, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-41577](https://cve.now/CVE-2022-41577.md): The kernel server has a vulnerability of not verifying the length of the data transferred in the user space.Successful exploitation of this (CVSS 7.1, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-41578](https://cve.now/CVE-2022-41578.md): The MPTCP module has an out-of-bounds write vulnerability.Successful exploitation of this vulnerability may cause root privilege escalation (CVSS 9.8, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-41580](https://cve.now/CVE-2022-41580.md): The HW\_KEYMASTER module has a vulnerability of not verifying the data read.Successful exploitation of this vulnerability may cause malicious (CVSS 9.8, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-41581](https://cve.now/CVE-2022-41581.md): The HW\_KEYMASTER module has a vulnerability of not verifying the data read.Successful exploitation of this vulnerability may cause malicious (CVSS 9.1, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-41582](https://cve.now/CVE-2022-41582.md): The security module has configuration defects.Successful exploitation of this vulnerability may affect system availability. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-41583](https://cve.now/CVE-2022-41583.md): The storage maintenance and debugging module has an array out-of-bounds read vulnerability.Successful exploitation of this vulnerability wil (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-41584](https://cve.now/CVE-2022-41584.md): The kernel module has an out-of-bounds read vulnerability.Successful exploitation of this vulnerability may cause memory overwriting. (CVSS 7.8, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-41585](https://cve.now/CVE-2022-41585.md): The kernel module has an out-of-bounds read vulnerability.Successful exploitation of this vulnerability may cause memory overwriting. (CVSS 7.8, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-41586](https://cve.now/CVE-2022-41586.md): The communication framework module has a vulnerability of not truncating data properly.Successful exploitation of this vulnerability may aff (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-41587](https://cve.now/CVE-2022-41587.md): Uncaptured exceptions in the home screen module. (CVSS 5.3, EMUI)
- [CVE-2022-41588](https://cve.now/CVE-2022-41588.md): The home screen module has a vulnerability in service logic processing.Successful exploitation of this vulnerability may affect data integri (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-41589](https://cve.now/CVE-2022-41589.md): The DFX unwind stack module of the ArkCompiler has a vulnerability in interface calling.Successful exploitation of this vulnerability affect (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-41592](https://cve.now/CVE-2022-41592.md): The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successf (CVSS 3.4, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-41593](https://cve.now/CVE-2022-41593.md): The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successf (CVSS 3.4, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-41594](https://cve.now/CVE-2022-41594.md): The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successf (CVSS 3.4, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-41595](https://cve.now/CVE-2022-41595.md): The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successf (CVSS 3.4, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-41597](https://cve.now/CVE-2022-41597.md): The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successf (CVSS 3.4, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-41598](https://cve.now/CVE-2022-41598.md): The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successf (CVSS 3.4, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-41600](https://cve.now/CVE-2022-41600.md): The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successf (CVSS 3.4, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-41601](https://cve.now/CVE-2022-41601.md): The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successf (CVSS 3.4, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-41602](https://cve.now/CVE-2022-41602.md): The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successf (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-41603](https://cve.now/CVE-2022-41603.md): The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successf (CVSS 3.4, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-41715](https://cve.now/CVE-2022-41715.md): Memory exhaustion when compiling regular expressions in regexp/syntax (no CVSS, Go standard library regexp/syntax · stdlib)
- [CVE-2022-42064](https://cve.now/CVE-2022-42064.md): Online Diagnostic Lab Management System version 1.0 remote exploit that bypasses login with SQL injection and then uploads a shell. (CVSS 9.8)
- [CVE-2022-42066](https://cve.now/CVE-2022-42066.md): Online Examination System version 1.0 suffers from a cross site scripting vulnerability via index.php. (CVSS 6.1)
- [CVE-2022-42067](https://cve.now/CVE-2022-42067.md): Online Birth Certificate Management System version 1.0 suffers from an Insecure Direct Object Reference (IDOR) vulnerability (CVSS 4.3)
- [CVE-2022-42069](https://cve.now/CVE-2022-42069.md): Online Birth Certificate Management System version 1.0 suffers from a persistent Cross Site Scripting (XSS) vulnerability. (CVSS 5.4)
- [CVE-2022-42070](https://cve.now/CVE-2022-42070.md): Online Birth Certificate Management System version 1.0 is vulnerable to Cross Site Request Forgery (CSRF). (CVSS 8.8)
- [CVE-2022-42071](https://cve.now/CVE-2022-42071.md): Online Birth Certificate Management System version 1.0 suffers from a Cross Site Scripting (XSS) Vulnerability. (CVSS 6.1)
- [CVE-2022-42232](https://cve.now/CVE-2022-42232.md): Simple Cold Storage Management System v1.0 is vulnerable to SQL Injection via /csms/classes/Master.php?f=delete\_storage. (no CVSS)
- [CVE-2022-42234](https://cve.now/CVE-2022-42234.md): There is a file inclusion vulnerability in the template management module in UCMS 1.6 (CVSS 8.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-10-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.