CVEs published October 17, 2022
123 CVEs were published on October 17, 2022: 23 critical, 36 high.
- Published
- 123
- Critical
- 23
- High
- 36
- Medium
- 46
- Low
- 18
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 48
Most affected products
- GitLab
- 26
- Linux Kernel
- 11
- SourceCodester Simple Cold Storage Management System
- 4
- ZGR TPS200 NG
- 4
- Qualcomm Snapdragon Mobile
- 3
- X.org Server
- 3
- Business-central
- 2
- FactoryTalk VantagePoint
- 2
- Import all XML, CSV & TXT into WordPress
- 2
- WP Custom Cursors
- 2
Critical 23
- CVE-2020-8976ZGR TPS200 Cross-Site Request Forgery (CSRF)ZGR TPS200 NG
- CVE-2020-8973ZGR TPS200 NG Improper access controlZGR TPS200 NG
- CVE-2020-8974ZGR TPS200 NG Missing Reference to Active Allocated ResourceZGR TPS200 NG
- CVE-2022-32176Gin-vue-admin - Unrestricted File Uploadgin-vue-admin
- CVE-2022-2052TRUMPF TruTops default user accounts vulnerabilityTRUMPF Werkzeugmaschinen SE + Co. KG TruTops Monitor · T… +4
- CVE-2022-0699A double-free condition exists in contrib/shpsort.c of shapelib 1.5.0 and older releases.shapelib
- CVE-2022-22128Tableau discovered a path traversal vulnerability affecting Tableau Server Administration Agent’s internal file transfer service that could Tableau Server
- CVE-2022-2884A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authGitLab
- CVE-2022-2992A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated usGitLab
- CVE-2022-40055An issue in GX Group GPON ONT Titanium 2122A T2122-V1.26EXL allows attackers to escalate privileges via a brute force attack at the login pa
- CVE-2022-42149kkFileView 4.0 is vulnerable to Server-side request forgery (SSRF) via controller\OnlinePreviewController.java.
- CVE-2022-42154An arbitrary file upload vulnerability in the component /apiadmin/upload/attach of 74cmsSE v3.13.0 allows attackers to execute arbitrary cod
- CVE-2022-42163Tenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/fromNatStaticSetting.
- CVE-2022-42164Tenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/formSetClientState.
- CVE-2022-42165Tenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/formSetDeviceName.
- CVE-2022-42166Tenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/formSetSpeedWan.
- CVE-2022-42167Tenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/formSetFirewallCfg.
- CVE-2022-42168Tenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/fromSetIpMacBind.
- CVE-2022-42169Tenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/addWifiMacFilter.
- CVE-2022-42170Tenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/formWifiWpsStart.
- CVE-2022-42171Tenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/saveParentControlInfo.
- CVE-2022-42237A SQL Injection issue in Merchandise Online Store v.1.0 allows an attacker to log in to the admin account.
- CVE-2022-42980go-admin (aka GO Admin) 2.0.12 uses the string go-admin as a production JWT key.
High 36
- CVE-2022-3569Due to an issue with incorrect sudo permissions, Zimbra Collaboration Suite (ZCS) suffers from a local privilege escalation issue in versionSynacor Zimbra Collaboration Suite
- CVE-2020-8975ZGR TPS200 NG Information ExposureZGR TPS200 NG
- CVE-2022-3368Software Updater of Avira Security for Windows vulnerable to Privilege EscalationNortonlifelock "Avira Security" – for Windows
- CVE-2022-3382HIWIN Robot System Software version 3.3.21.9869 does not properly address the terminated command source.HIWIN Robot System Software
- CVE-2022-39052DoS attack using emailOTRS AG OTRS · OTRS AG ((OTRS)) Community Edition
- CVE-2022-3281WAGO: multiple products - Loss of MAC-Address-Filtering after rebootWAGO 750-81xx/xxx-xxx Series PFC100/PFC200 · WAGO 750-82… +6
- CVE-2019-14840A flaw was found in the RHDM, where sensitive HTML form fields like Password has auto-complete enabled which may lead to leak of credentialsBusiness-central
- CVE-2019-14841A flaw was found in the RHDM, where an authenticated attacker can change their assigned role in the response header.Business-central
- CVE-2022-23769Secuever reverseWall-MDS Remote Code Execution VulnerabilitySecuever Co. reverseWall-MDS
- CVE-2022-23770WISA Smart Wing CMS Remote Command Execution VulnerabilityWISA Smart Wing CMS
- CVE-2022-23771IPTIME NAS1DUAL CSRF VulnerabilityEFM Networks Co. NAS1dual, NAS2dual, NAS4dual
- CVE-2022-2527An issue in Incident Timelines has been discovered in GitLab CE/EE affecting all versions starting from 14.9 before 15.1.6, all versions staGitLab
- CVE-2022-25723Memory corruption in multimedia due to use after free during callback registration failure in Snapdragon MobileQualcomm Snapdragon Mobile
- CVE-2022-25750Memory corruption in BTHOST due to double free while music playback and calls over bluetooth headset in Snapdragon MobileQualcomm Snapdragon Mobile
- CVE-2022-2865A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, 15.2 to 15.2.4 and 15.3 prior to 15.3GitLab
- CVE-2022-2931A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15GitLab
- CVE-2022-3060Improper control of a resource identifier in Error Tracking in GitLab CE/EE affecting all versions from 12.7 allows an authenticated attackeGitLab
- CVE-2022-3131Search Logger <= 0.9 - Admin+ SQLiSearch Logger – Know What Your Visitors Search
- CVE-2022-3150WP Custom Cursors < 3.2 - Admin+ SQLiWP Custom Cursors | WordPress Cursor Plugin
- CVE-2022-3158Rockwell Automation FactoryTalk VantagePoint versions 8.0, 8.10, 8.20, 8.30, 8.31 are vulnerable to an input validation vulnerability.FactoryTalk VantagePoint
- CVE-2022-3243Import all XML, CSV & TXT into WordPress < 6.5.8 - Admin+ SQLiImport all XML, CSV & TXT into WordPress
- CVE-2022-3283A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before before 15.2.5, all versions starting from 15.3 beGitLab
- CVE-2022-33210Memory corruption in automotive multimedia due to use of out-of-range pointer offset while parsing command request packet with a very large Qualcomm Snapdragon Auto
- CVE-2022-33214Memory corruption in display due to time-of-check time-of-use of metadata reserved size in Snapdragon Auto, Snapdragon Compute, Snapdragon CQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-33217Memory corruption in Qualcomm IPC due to buffer copy without checking the size of input while starting communication with a compromised kernQualcomm Snapdragon Mobile
- CVE-2022-3517A vulnerability was found in the minimatch package.minimatch
- CVE-2022-3552Unrestricted Upload of File with Dangerous Type in boxbilling/boxbillingboxbilling/boxbilling
- CVE-2022-38743Rockwell Automation FactoryTalk VantagePoint versions 8.0, 8.10, 8.20, 8.30, 8.31 are vulnerable to an improper access control vulnerabilityFactoryTalk VantagePoint
- CVE-2022-41498Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinventory/editbrand.php.
- CVE-2022-41751Jhead 3.06.0.1 allows attackers to execute arbitrary OS commands by placing them in a JPEG filename and then using the regeneration -rgt50 o
- CVE-2022-42029Chamilo 1.11.16 is affected by an authenticated local file inclusion vulnerability which allows authenticated users with access to 'big file
- CVE-2022-42142Online Tours & Travels Management System v1.0 is vulnerable to Arbitrary code execution via ip/tour/admin/operations/update_settings.php.
- CVE-2022-42143Open Source SACCO Management System v1.0 is vulnerable to SQL Injection via /sacco_shield/manage_payment.php.
- CVE-2022-42221Netgear R6220 v1.1.0.114_1.0.1 suffers from Incorrect Access Control, resulting in a command injection vulnerability.
- CVE-2022-42975socket/transport.ex in Phoenix before 1.6.14 mishandles check_origin wildcarding.
- CVE-2022-42983anji-plus AJ-Report 0.9.8.6 allows remote attackers to bypass login authentication by spoofing JWT Tokens.
Medium, low and unrated 64
- CVE-2022-26375WordPress AB Press Optimizer plugin <= 1.1.1 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityMammothology AB Press Optimizer
- CVE-2022-3501Information exposure of template content due to missing check of permissionsAccessing template content without permissions OTRS
- CVE-2017-7517An input validation vulnerability exists in Openshift Enterprise due to a 1:1 mapping of tenants in Hawkular Metrics and projects/namespacesHawkular Metrics
- CVE-2022-2428A crafted tag in the Jupyter Notebook viewer in GitLab EE/CE affecting all versions before 15.1.6, 15.2 to 15.2.4, and 15.3 to 15.3.2 allowsGitLab
- CVE-2022-2455A business logic issue in the handling of large repositories in all versions of GitLab CE/EE from 10.0 before 15.1.6, all versions starting GitLab
- CVE-2022-2533An issue has been discovered in GitLab affecting all versions starting from 12.10 before 15.1.6, all versions starting from 15.2 before 15.2GitLab
- CVE-2022-2563Tutor LMS < 2.0.10 - Admin+ Stored Cross-Site ScriptingTutor LMS – eLearning and online course solution
- CVE-2022-2574Meks Easy Social Share < 1.2.8 - Admin+ Stored Cross-Site ScriptingMeks Easy Social Share
- CVE-2022-2592A lack of length validation in Snippet descriptions in GitLab CE/EE affecting all versions prior to 15.1.6, 15.2 prior to 15.2.4 and 15.3 prGitLab
- CVE-2022-2630An improper access control issue in GitLab CE/EE affecting all versions starting from 15.2 before 15.2.4, all versions from 15.3 before 15.3GitLab
- CVE-2022-28291Insufficiently Protected Credentials: An authenticated user with debug privileges can retrieve stored Nessus policy credentials from the “neNessus Professional
- CVE-2022-2834Helpful < 4.5.26 - Information DisclosureHelpful
- CVE-2022-2908A potential DoS vulnerability was discovered in Gitlab CE/EE versions starting from 10.7 before 15.1.5, all versions starting from 15.2 befoGitLab
- CVE-2022-3030An improper access control issue in GitLab CE/EE affecting all versions starting before 15.1.6, all versions from 15.2 before 15.2.4, all veGitLab
- CVE-2022-3031An issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15.2.4, all versioGitLab
- CVE-2022-3066An issue has been discovered in GitLab affecting all versions starting from 10.0 before 15.2.5, all versions starting from 15.3 before 15.3.GitLab
- CVE-2022-3067An issue has been discovered in the Import functionality of GitLab CE/EE affecting all versions starting from 14.4 before 15.2.5, all versioGitLab
- CVE-2022-3082miniOrange Discord Integration < 2.1.6 - Subscriber+ App DisablingminiOrange Discord Integration
- CVE-2022-3126Frontend File Manager < 21.4 - File Upload via CSRFFrontend File Manager Plugin
- CVE-2022-3139We’re Open! < 1.42 - Admin+ Stored Cross-Site ScriptingWe’re Open!
- CVE-2022-3149WP Custom Cursors < 3.0.1 - Stored Cross-Site Scripting via CSRFWP Custom Cursors
- CVE-2022-3151WP Custom Cursors < 3.0.1 - Arbitrary Cursor Deletion via CSRFWP Custom Cursors
- CVE-2022-3165An integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the extended format.QEMU
- CVE-2022-3206Passster < 3.5.5.5.2 - Insecure Storage of PasswordPassster
- CVE-2022-3244Import all XML, CSV & TXT into WordPress < 6.5.8 - Missing AuthorisationImport all XML, CSV & TXT into WordPress
- CVE-2022-3279An unhandled exception in job log parsing in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15GitLab
- CVE-2022-3282Drag and Drop Multiple File Upload < 1.3.6.5 - File Upload Size Limit BypassDrag and Drop Multiple File Upload – Contact Form
- CVE-2022-3286Lack of IP address checking in GitLab EE affecting all versions from 14.2 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 alGitLab
- CVE-2022-3288A branch/tag name confusion in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows anGitLab
- CVE-2022-3291Serialization of sensitive data in GitLab EE affecting all versions from 14.9 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.GitLab
- CVE-2022-3293Email addresses were leaked in WebHook logs in GitLab EE affecting all versions from 9.3 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 priGitLab
- CVE-2022-3325Improper access control in the GitLab CE/EE API affecting all versions starting from 12.8 before 15.2.5, all versions starting from 15.3 befGitLab
- CVE-2022-3330It was possible for a guest user to read a todo targeting an inaccessible note in Gitlab CE/EE affecting all versions from 15.0 prior to 15.GitLab
- CVE-2022-3331An issue has been discovered in GitLab EE affecting all versions starting from 14.5 before 15.1.6, all versions starting from 15.2 before 15GitLab
- CVE-2022-3351An issue has been discovered in GitLab EE affecting all versions starting from 13.7 before 15.2.5, all versions starting from 15.3 before 15GitLab
- CVE-2022-3421Privilege escalation in Google Drive for Desktop on MacOSGoogle Drive for Desktop MacOS
- CVE-2022-3533Linux Kernel BPF usdt.c parse_usdt_arg memory leakLinux Kernel
- CVE-2022-3534Linux Kernel libbpf btf_dump.c btf_dump_name_dups use after freeLinux Kernel
- CVE-2022-3540An issue has been discovered in hunter2 affecting all versions before 2.1.0.The hunter2 Contributors hunter2
- CVE-2022-3541Linux Kernel BPF spl2sw_driver.c spl2sw_nvmem_get_mac_address use after freeLinux Kernel
- CVE-2022-3543Linux Kernel BPF af_unix.c unix_release_sock memory leakLinux Kernel
- CVE-2022-3544Linux Kernel Netfilter sysfs.c damon_sysfs_add_target memory leakLinux Kernel
- CVE-2022-3545Linux Kernel IPsec nfp_cppcore.c area_cache_get use after freeLinux Kernel
- CVE-2022-3546SourceCodester Simple Cold Storage Management System Create User cross site scriptingSourceCodester Simple Cold Storage Management System
- CVE-2022-3547SourceCodester Simple Cold Storage Management System Setting cross site scriptingSourceCodester Simple Cold Storage Management System
- CVE-2022-3548SourceCodester Simple Cold Storage Management System Add New Storage cross site scriptingSourceCodester Simple Cold Storage Management System
- CVE-2022-3549SourceCodester Simple Cold Storage Management System Avatar unrestricted uploadSourceCodester Simple Cold Storage Management System
- CVE-2022-3550X.org Server xkb.c _GetCountedString buffer overflowX.org Server
- CVE-2022-3551X.org Server xkb.c ProcXkbGetKbdByName memory leakX.org Server
- CVE-2022-3553X.org Server xquartz X11Controller.m denial of serviceX.org Server
- CVE-2022-3559Exim Regex use after freeExim
- CVE-2022-3563Linux Kernel BlueZ mgmt-tester.c read_50_controller_cap_complete null pointer dereferenceLinux Kernel
- CVE-2022-3564Linux Kernel Bluetooth l2cap_core.c l2cap_reassemble_sdu use after freeLinux Kernel
- CVE-2022-3565Linux Kernel Bluetooth l1oip_core.c del_timer use after freeLinux Kernel
- CVE-2022-3566Linux Kernel TCP tcp_setsockopt race conditionLinux Kernel
- CVE-2022-3567Linux Kernel IPv6 inet6_dgram_ops race conditionLinux Kernel
- CVE-2022-40605MITRE CALDERA before 4.1.0 allows XSS in the Operations tab and/or Debrief plugin via a crafted operation name, a different vulnerability th
- CVE-2022-40606MITRE CALDERA before 4.1.0 allows XSS in the Operations tab and/or Debrief plugin via a crafted operation name, a different vulnerability th
- CVE-2022-41139MITRE CALDERA 4.1.0 allows stored XSS via app.contact.gist (aka the gist contact configuration field), leading to execution of arbitrary com
- CVE-2022-41431xzs v3.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /admin/question/edit.
- CVE-2022-4147174cmsSE v3.12.0 allows authenticated attackers with low-level privileges to arbitrarily change the rights and credentials of the Super Admin
- CVE-2022-4147274cmsSE v3.12.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /apiadmin/notice/add.
- CVE-2022-41542devhub 0.102.0 was discovered to contain a broken session control.
- CVE-2022-42147kkFileView 4.0 is vulnerable to Cross Site Scripting (XSS) via controller\ Filecontroller.java.