# CVEs published 2022-10-17

123 CVEs were published on October 17, 2022: 23 critical, 36 high. Days are UTC.

- [CVE-2022-3569](https://cve.now/CVE-2022-3569.md): Due to an issue with incorrect sudo permissions, Zimbra Collaboration Suite (ZCS) suffers from a local privilege escalation issue in version (CVSS 7.8, Synacor Zimbra Collaboration Suite)
- [CVE-2020-8976](https://cve.now/CVE-2020-8976.md): ZGR TPS200 Cross-Site Request Forgery (CSRF) (CVSS 9.6, ZGR TPS200 NG)
- [CVE-2020-8973](https://cve.now/CVE-2020-8973.md): ZGR TPS200 NG Improper access control (CVSS 9.3, ZGR TPS200 NG)
- [CVE-2020-8974](https://cve.now/CVE-2020-8974.md): ZGR TPS200 NG Missing Reference to Active Allocated Resource (CVSS 10.0, ZGR TPS200 NG)
- [CVE-2020-8975](https://cve.now/CVE-2020-8975.md): ZGR TPS200 NG Information Exposure (CVSS 7.5, ZGR TPS200 NG)
- [CVE-2022-3368](https://cve.now/CVE-2022-3368.md): Software Updater of Avira Security for Windows vulnerable to Privilege Escalation (CVSS 7.3, Nortonlifelock "Avira Security" – for Windows)
- [CVE-2022-3382](https://cve.now/CVE-2022-3382.md): HIWIN Robot System Software version 3.3.21.9869 does not properly address the terminated command source. (CVSS 7.5, HIWIN Robot System Software)
- [CVE-2022-32176](https://cve.now/CVE-2022-32176.md): Gin-vue-admin - Unrestricted File Upload (CVSS 9.0, gin-vue-admin)
- [CVE-2022-26375](https://cve.now/CVE-2022-26375.md): WordPress AB Press Optimizer plugin \<= 1.1.1 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, Mammothology AB Press Optimizer)
- [CVE-2022-3501](https://cve.now/CVE-2022-3501.md): Information exposure of template content due to missing check of permissions (CVSS 3.5, Accessing template content without permissions OTRS)
- [CVE-2022-39052](https://cve.now/CVE-2022-39052.md): DoS attack using email (CVSS 7.5, OTRS AG OTRS · OTRS AG ((OTRS)) Community Edition)
- [CVE-2022-3281](https://cve.now/CVE-2022-3281.md): WAGO: multiple products - Loss of MAC-Address-Filtering after reboot (CVSS 7.5, WAGO 750-81xx/xxx-xxx Series PFC100/PFC200 · WAGO 750-82… +6)
- [CVE-2022-2052](https://cve.now/CVE-2022-2052.md): TRUMPF TruTops default user accounts vulnerability (CVSS 9.8, TRUMPF Werkzeugmaschinen SE + Co. KG TruTops Monitor · T… +4)
- [CVE-2017-7517](https://cve.now/CVE-2017-7517.md): An input validation vulnerability exists in Openshift Enterprise due to a 1:1 mapping of tenants in Hawkular Metrics and projects/namespaces (CVSS 3.5, Hawkular Metrics)
- [CVE-2019-14840](https://cve.now/CVE-2019-14840.md): A flaw was found in the RHDM, where sensitive HTML form fields like Password has auto-complete enabled which may lead to leak of credentials (CVSS 7.5, Business-central)
- [CVE-2019-14841](https://cve.now/CVE-2019-14841.md): A flaw was found in the RHDM, where an authenticated attacker can change their assigned role in the response header. (CVSS 8.8, Business-central)
- [CVE-2022-0699](https://cve.now/CVE-2022-0699.md): A double-free condition exists in contrib/shpsort.c of shapelib 1.5.0 and older releases. (CVSS 9.8, shapelib)
- [CVE-2022-22128](https://cve.now/CVE-2022-22128.md): Tableau discovered a path traversal vulnerability affecting Tableau Server Administration Agent’s internal file transfer service that could (CVSS 9.8, Tableau Server)
- [CVE-2022-23769](https://cve.now/CVE-2022-23769.md): Secuever reverseWall-MDS Remote Code Execution Vulnerability (CVSS 7.5, Secuever Co. reverseWall-MDS)
- [CVE-2022-23770](https://cve.now/CVE-2022-23770.md): WISA Smart Wing CMS Remote Command Execution Vulnerability (CVSS 8.8, WISA Smart Wing CMS)
- [CVE-2022-23771](https://cve.now/CVE-2022-23771.md): IPTIME NAS1DUAL CSRF Vulnerability (CVSS 8.0, EFM Networks Co. NAS1dual, NAS2dual, NAS4dual)
- [CVE-2022-2428](https://cve.now/CVE-2022-2428.md): A crafted tag in the Jupyter Notebook viewer in GitLab EE/CE affecting all versions before 15.1.6, 15.2 to 15.2.4, and 15.3 to 15.3.2 allows (CVSS 6.4, GitLab)
- [CVE-2022-2455](https://cve.now/CVE-2022-2455.md): A business logic issue in the handling of large repositories in all versions of GitLab CE/EE from 10.0 before 15.1.6, all versions starting (CVSS 6.5, GitLab)
- [CVE-2022-2527](https://cve.now/CVE-2022-2527.md): An issue in Incident Timelines has been discovered in GitLab CE/EE affecting all versions starting from 14.9 before 15.1.6, all versions sta (CVSS 7.3, GitLab)
- [CVE-2022-2533](https://cve.now/CVE-2022-2533.md): An issue has been discovered in GitLab affecting all versions starting from 12.10 before 15.1.6, all versions starting from 15.2 before 15.2 (CVSS 6.5, GitLab)
- [CVE-2022-2563](https://cve.now/CVE-2022-2563.md): Tutor LMS \< 2.0.10 - Admin+ Stored Cross-Site Scripting (CVSS 4.8, Tutor LMS – eLearning and online course solution)
- [CVE-2022-25723](https://cve.now/CVE-2022-25723.md): Memory corruption in multimedia due to use after free during callback registration failure in Snapdragon Mobile (CVSS 8.4, Qualcomm Snapdragon Mobile)
- [CVE-2022-2574](https://cve.now/CVE-2022-2574.md): Meks Easy Social Share \< 1.2.8 - Admin+ Stored Cross-Site Scripting (CVSS 4.8, Meks Easy Social Share)
- [CVE-2022-25750](https://cve.now/CVE-2022-25750.md): Memory corruption in BTHOST due to double free while music playback and calls over bluetooth headset in Snapdragon Mobile (CVSS 8.4, Qualcomm Snapdragon Mobile)
- [CVE-2022-2592](https://cve.now/CVE-2022-2592.md): A lack of length validation in Snippet descriptions in GitLab CE/EE affecting all versions prior to 15.1.6, 15.2 prior to 15.2.4 and 15.3 pr (CVSS 6.5, GitLab)
- [CVE-2022-2630](https://cve.now/CVE-2022-2630.md): An improper access control issue in GitLab CE/EE affecting all versions starting from 15.2 before 15.2.4, all versions from 15.3 before 15.3 (CVSS 4.3, GitLab)
- [CVE-2022-28291](https://cve.now/CVE-2022-28291.md): Insufficiently Protected Credentials: An authenticated user with debug privileges can retrieve stored Nessus policy credentials from the “ne (CVSS 6.5, Nessus Professional)
- [CVE-2022-2834](https://cve.now/CVE-2022-2834.md): Helpful \< 4.5.26 - Information Disclosure (CVSS 5.3, Helpful)
- [CVE-2022-2865](https://cve.now/CVE-2022-2865.md): A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, 15.2 to 15.2.4 and 15.3 prior to 15.3 (CVSS 7.3, GitLab)
- [CVE-2022-2884](https://cve.now/CVE-2022-2884.md): A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an auth (CVSS 9.9, GitLab)
- [CVE-2022-2908](https://cve.now/CVE-2022-2908.md): A potential DoS vulnerability was discovered in Gitlab CE/EE versions starting from 10.7 before 15.1.5, all versions starting from 15.2 befo (CVSS 4.3, GitLab)
- [CVE-2022-2931](https://cve.now/CVE-2022-2931.md): A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15 (CVSS 7.5, GitLab)
- [CVE-2022-2992](https://cve.now/CVE-2022-2992.md): A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated us (CVSS 9.9, GitLab)
- [CVE-2022-3030](https://cve.now/CVE-2022-3030.md): An improper access control issue in GitLab CE/EE affecting all versions starting before 15.1.6, all versions from 15.2 before 15.2.4, all ve (CVSS 4.3, GitLab)
- [CVE-2022-3031](https://cve.now/CVE-2022-3031.md): An issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15.2.4, all versio (CVSS 3.7, GitLab)
- [CVE-2022-3060](https://cve.now/CVE-2022-3060.md): Improper control of a resource identifier in Error Tracking in GitLab CE/EE affecting all versions from 12.7 allows an authenticated attacke (CVSS 7.3, GitLab)
- [CVE-2022-3066](https://cve.now/CVE-2022-3066.md): An issue has been discovered in GitLab affecting all versions starting from 10.0 before 15.2.5, all versions starting from 15.3 before 15.3. (CVSS 5.4, GitLab)
- [CVE-2022-3067](https://cve.now/CVE-2022-3067.md): An issue has been discovered in the Import functionality of GitLab CE/EE affecting all versions starting from 14.4 before 15.2.5, all versio (CVSS 6.5, GitLab)
- [CVE-2022-3082](https://cve.now/CVE-2022-3082.md): miniOrange Discord Integration \< 2.1.6 - Subscriber+ App Disabling (CVSS 6.5, miniOrange Discord Integration)
- [CVE-2022-3126](https://cve.now/CVE-2022-3126.md): Frontend File Manager \< 21.4 - File Upload via CSRF (CVSS 4.3, Frontend File Manager Plugin)
- [CVE-2022-3131](https://cve.now/CVE-2022-3131.md): Search Logger \<= 0.9 - Admin+ SQLi (CVSS 7.2, Search Logger – Know What Your Visitors Search)
- [CVE-2022-3139](https://cve.now/CVE-2022-3139.md): We’re Open! \< 1.42 - Admin+ Stored Cross-Site Scripting (CVSS 4.8, We’re Open!)
- [CVE-2022-3149](https://cve.now/CVE-2022-3149.md): WP Custom Cursors \< 3.0.1 - Stored Cross-Site Scripting via CSRF (CVSS 6.1, WP Custom Cursors)
- [CVE-2022-3150](https://cve.now/CVE-2022-3150.md): WP Custom Cursors \< 3.2 - Admin+ SQLi (CVSS 7.2, WP Custom Cursors | WordPress Cursor Plugin)
- [CVE-2022-3151](https://cve.now/CVE-2022-3151.md): WP Custom Cursors \< 3.0.1 - Arbitrary Cursor Deletion via CSRF (CVSS 4.3, WP Custom Cursors)
- [CVE-2022-3158](https://cve.now/CVE-2022-3158.md): Rockwell Automation FactoryTalk VantagePoint versions 8.0, 8.10, 8.20, 8.30, 8.31 are vulnerable to an input validation vulnerability. (CVSS 8.8, FactoryTalk VantagePoint)
- [CVE-2022-3165](https://cve.now/CVE-2022-3165.md): An integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the extended format. (CVSS 6.5, QEMU)
- [CVE-2022-3206](https://cve.now/CVE-2022-3206.md): Passster \< 3.5.5.5.2 - Insecure Storage of Password (CVSS 5.9, Passster)
- [CVE-2022-3243](https://cve.now/CVE-2022-3243.md): Import all XML, CSV & TXT into WordPress \< 6.5.8 - Admin+ SQLi (CVSS 7.2, Import all XML, CSV & TXT into WordPress)
- [CVE-2022-3244](https://cve.now/CVE-2022-3244.md): Import all XML, CSV & TXT into WordPress \< 6.5.8 - Missing Authorisation (CVSS 4.2, Import all XML, CSV & TXT into WordPress)
- [CVE-2022-3279](https://cve.now/CVE-2022-3279.md): An unhandled exception in job log parsing in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15 (CVSS 2.7, GitLab)
- [CVE-2022-3282](https://cve.now/CVE-2022-3282.md): Drag and Drop Multiple File Upload \< 1.3.6.5 - File Upload Size Limit Bypass (CVSS 4.3, Drag and Drop Multiple File Upload – Contact Form)
- [CVE-2022-3283](https://cve.now/CVE-2022-3283.md): A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before before 15.2.5, all versions starting from 15.3 be (CVSS 7.5, GitLab)
- [CVE-2022-3286](https://cve.now/CVE-2022-3286.md): Lack of IP address checking in GitLab EE affecting all versions from 14.2 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 al (CVSS 5.3, GitLab)
- [CVE-2022-3288](https://cve.now/CVE-2022-3288.md): A branch/tag name confusion in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows an (CVSS 3.5, GitLab)
- [CVE-2022-3291](https://cve.now/CVE-2022-3291.md): Serialization of sensitive data in GitLab EE affecting all versions from 14.9 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4. (CVSS 6.5, GitLab)
- [CVE-2022-3293](https://cve.now/CVE-2022-3293.md): Email addresses were leaked in WebHook logs in GitLab EE affecting all versions from 9.3 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 pri (CVSS 3.5, GitLab)
- [CVE-2022-33210](https://cve.now/CVE-2022-33210.md): Memory corruption in automotive multimedia due to use of out-of-range pointer offset while parsing command request packet with a very large (CVSS 8.4, Qualcomm Snapdragon Auto)
- [CVE-2022-33214](https://cve.now/CVE-2022-33214.md): Memory corruption in display due to time-of-check time-of-use of metadata reserved size in Snapdragon Auto, Snapdragon Compute, Snapdragon C (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2022-33217](https://cve.now/CVE-2022-33217.md): Memory corruption in Qualcomm IPC due to buffer copy without checking the size of input while starting communication with a compromised kern (CVSS 7.8, Qualcomm Snapdragon Mobile)
- [CVE-2022-3325](https://cve.now/CVE-2022-3325.md): Improper access control in the GitLab CE/EE API affecting all versions starting from 12.8 before 15.2.5, all versions starting from 15.3 bef (CVSS 2.7, GitLab)
- [CVE-2022-3330](https://cve.now/CVE-2022-3330.md): It was possible for a guest user to read a todo targeting an inaccessible note in Gitlab CE/EE affecting all versions from 15.0 prior to 15. (CVSS 4.3, GitLab)
- [CVE-2022-3331](https://cve.now/CVE-2022-3331.md): An issue has been discovered in GitLab EE affecting all versions starting from 14.5 before 15.1.6, all versions starting from 15.2 before 15 (CVSS 3.5, GitLab)
- [CVE-2022-3351](https://cve.now/CVE-2022-3351.md): An issue has been discovered in GitLab EE affecting all versions starting from 13.7 before 15.2.5, all versions starting from 15.3 before 15 (CVSS 4.3, GitLab)
- [CVE-2022-3421](https://cve.now/CVE-2022-3421.md): Privilege escalation in Google Drive for Desktop on MacOS (CVSS 5.6, Google Drive for Desktop MacOS)
- [CVE-2022-3517](https://cve.now/CVE-2022-3517.md): A vulnerability was found in the minimatch package. (CVSS 7.5, minimatch)
- [CVE-2022-3533](https://cve.now/CVE-2022-3533.md): Linux Kernel BPF usdt.c parse\_usdt\_arg memory leak (CVSS 3.5, Linux Kernel)
- [CVE-2022-3534](https://cve.now/CVE-2022-3534.md): Linux Kernel libbpf btf\_dump.c btf\_dump\_name\_dups use after free (CVSS 5.1, Linux Kernel)
- [CVE-2022-3540](https://cve.now/CVE-2022-3540.md): An issue has been discovered in hunter2 affecting all versions before 2.1.0. (CVSS 6.5, The hunter2 Contributors hunter2)
- [CVE-2022-3541](https://cve.now/CVE-2022-3541.md): Linux Kernel BPF spl2sw\_driver.c spl2sw\_nvmem\_get\_mac\_address use after free (CVSS 5.5, Linux Kernel)
- [CVE-2022-3543](https://cve.now/CVE-2022-3543.md): Linux Kernel BPF af\_unix.c unix\_release\_sock memory leak (CVSS 3.5, Linux Kernel)
- [CVE-2022-3544](https://cve.now/CVE-2022-3544.md): Linux Kernel Netfilter sysfs.c damon\_sysfs\_add\_target memory leak (CVSS 3.5, Linux Kernel)
- [CVE-2022-3545](https://cve.now/CVE-2022-3545.md): Linux Kernel IPsec nfp\_cppcore.c area\_cache\_get use after free (CVSS 5.5, Linux Kernel)
- [CVE-2022-3546](https://cve.now/CVE-2022-3546.md): SourceCodester Simple Cold Storage Management System Create User cross site scripting (CVSS 2.4, SourceCodester Simple Cold Storage Management System)
- [CVE-2022-3547](https://cve.now/CVE-2022-3547.md): SourceCodester Simple Cold Storage Management System Setting cross site scripting (CVSS 2.4, SourceCodester Simple Cold Storage Management System)
- [CVE-2022-3548](https://cve.now/CVE-2022-3548.md): SourceCodester Simple Cold Storage Management System Add New Storage cross site scripting (CVSS 2.4, SourceCodester Simple Cold Storage Management System)
- [CVE-2022-3549](https://cve.now/CVE-2022-3549.md): SourceCodester Simple Cold Storage Management System Avatar unrestricted upload (CVSS 4.7, SourceCodester Simple Cold Storage Management System)
- [CVE-2022-3550](https://cve.now/CVE-2022-3550.md): X.org Server xkb.c \_GetCountedString buffer overflow (CVSS 5.5, X.org Server)
- [CVE-2022-3551](https://cve.now/CVE-2022-3551.md): X.org Server xkb.c ProcXkbGetKbdByName memory leak (CVSS 3.5, X.org Server)
- [CVE-2022-3552](https://cve.now/CVE-2022-3552.md): Unrestricted Upload of File with Dangerous Type in boxbilling/boxbilling (CVSS 7.2, boxbilling/boxbilling)
- [CVE-2022-3553](https://cve.now/CVE-2022-3553.md): X.org Server xquartz X11Controller.m denial of service (CVSS 3.5, X.org Server)
- [CVE-2022-3559](https://cve.now/CVE-2022-3559.md): Exim Regex use after free (CVSS 4.6, Exim)
- [CVE-2022-3563](https://cve.now/CVE-2022-3563.md): Linux Kernel BlueZ mgmt-tester.c read\_50\_controller\_cap\_complete null pointer dereference (CVSS 3.5, Linux Kernel)
- [CVE-2022-3564](https://cve.now/CVE-2022-3564.md): Linux Kernel Bluetooth l2cap\_core.c l2cap\_reassemble\_sdu use after free (CVSS 5.5, Linux Kernel)
- [CVE-2022-3565](https://cve.now/CVE-2022-3565.md): Linux Kernel Bluetooth l1oip\_core.c del\_timer use after free (CVSS 4.6, Linux Kernel)
- [CVE-2022-3566](https://cve.now/CVE-2022-3566.md): Linux Kernel TCP tcp\_setsockopt race condition (CVSS 2.1, Linux Kernel)
- [CVE-2022-3567](https://cve.now/CVE-2022-3567.md): Linux Kernel IPv6 inet6\_dgram\_ops race condition (CVSS 4.6, Linux Kernel)
- [CVE-2022-38743](https://cve.now/CVE-2022-38743.md): Rockwell Automation FactoryTalk VantagePoint versions 8.0, 8.10, 8.20, 8.30, 8.31 are vulnerable to an improper access control vulnerability (CVSS 8.8, FactoryTalk VantagePoint)
- [CVE-2022-40055](https://cve.now/CVE-2022-40055.md): An issue in GX Group GPON ONT Titanium 2122A T2122-V1.26EXL allows attackers to escalate privileges via a brute force attack at the login pa (CVSS 9.8)
- [CVE-2022-40605](https://cve.now/CVE-2022-40605.md): MITRE CALDERA before 4.1.0 allows XSS in the Operations tab and/or Debrief plugin via a crafted operation name, a different vulnerability th (CVSS 6.1)
- [CVE-2022-40606](https://cve.now/CVE-2022-40606.md): MITRE CALDERA before 4.1.0 allows XSS in the Operations tab and/or Debrief plugin via a crafted operation name, a different vulnerability th (CVSS 6.1)
- [CVE-2022-41139](https://cve.now/CVE-2022-41139.md): MITRE CALDERA 4.1.0 allows stored XSS via app.contact.gist (aka the gist contact configuration field), leading to execution of arbitrary com (CVSS 5.4)
- [CVE-2022-41431](https://cve.now/CVE-2022-41431.md): xzs v3.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /admin/question/edit. (CVSS 5.4)
- [CVE-2022-41471](https://cve.now/CVE-2022-41471.md): 74cmsSE v3.12.0 allows authenticated attackers with low-level privileges to arbitrarily change the rights and credentials of the Super Admin (CVSS 6.5)
- [CVE-2022-41472](https://cve.now/CVE-2022-41472.md): 74cmsSE v3.12.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /apiadmin/notice/add. (CVSS 5.4)
- [CVE-2022-41498](https://cve.now/CVE-2022-41498.md): Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinventory/editbrand.php. (CVSS 7.2)
- [CVE-2022-41542](https://cve.now/CVE-2022-41542.md): devhub 0.102.0 was discovered to contain a broken session control. (CVSS 5.4)
- [CVE-2022-41751](https://cve.now/CVE-2022-41751.md): Jhead 3.06.0.1 allows attackers to execute arbitrary OS commands by placing them in a JPEG filename and then using the regeneration -rgt50 o (CVSS 7.8)
- [CVE-2022-42029](https://cve.now/CVE-2022-42029.md): Chamilo 1.11.16 is affected by an authenticated local file inclusion vulnerability which allows authenticated users with access to 'big file (CVSS 8.8)
- [CVE-2022-42142](https://cve.now/CVE-2022-42142.md): Online Tours & Travels Management System v1.0 is vulnerable to Arbitrary code execution via ip/tour/admin/operations/update\_settings.php. (CVSS 7.2)
- [CVE-2022-42143](https://cve.now/CVE-2022-42143.md): Open Source SACCO Management System v1.0 is vulnerable to SQL Injection via /sacco\_shield/manage\_payment.php. (CVSS 7.2)
- [CVE-2022-42147](https://cve.now/CVE-2022-42147.md): kkFileView 4.0 is vulnerable to Cross Site Scripting (XSS) via controller\\ Filecontroller.java. (CVSS 6.1)
- [CVE-2022-42149](https://cve.now/CVE-2022-42149.md): kkFileView 4.0 is vulnerable to Server-side request forgery (SSRF) via controller\\OnlinePreviewController.java. (CVSS 9.8)
- [CVE-2022-42154](https://cve.now/CVE-2022-42154.md): An arbitrary file upload vulnerability in the component /apiadmin/upload/attach of 74cmsSE v3.13.0 allows attackers to execute arbitrary cod (CVSS 9.8)
- [CVE-2022-42163](https://cve.now/CVE-2022-42163.md): Tenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/fromNatStaticSetting. (CVSS 9.8)
- [CVE-2022-42164](https://cve.now/CVE-2022-42164.md): Tenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/formSetClientState. (CVSS 9.8)
- [CVE-2022-42165](https://cve.now/CVE-2022-42165.md): Tenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/formSetDeviceName. (CVSS 9.8)
- [CVE-2022-42166](https://cve.now/CVE-2022-42166.md): Tenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/formSetSpeedWan. (CVSS 9.8)
- [CVE-2022-42167](https://cve.now/CVE-2022-42167.md): Tenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/formSetFirewallCfg. (CVSS 9.8)
- [CVE-2022-42168](https://cve.now/CVE-2022-42168.md): Tenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/fromSetIpMacBind. (CVSS 9.8)
- [CVE-2022-42169](https://cve.now/CVE-2022-42169.md): Tenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/addWifiMacFilter. (CVSS 9.8)
- [CVE-2022-42170](https://cve.now/CVE-2022-42170.md): Tenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/formWifiWpsStart. (CVSS 9.8)
- [CVE-2022-42171](https://cve.now/CVE-2022-42171.md): Tenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/saveParentControlInfo. (CVSS 9.8)
- [CVE-2022-42221](https://cve.now/CVE-2022-42221.md): Netgear R6220 v1.1.0.114\_1.0.1 suffers from Incorrect Access Control, resulting in a command injection vulnerability. (CVSS 8.8)
- [CVE-2022-42237](https://cve.now/CVE-2022-42237.md): A SQL Injection issue in Merchandise Online Store v.1.0 allows an attacker to log in to the admin account. (CVSS 9.8)
- [CVE-2022-42975](https://cve.now/CVE-2022-42975.md): socket/transport.ex in Phoenix before 1.6.14 mishandles check\_origin wildcarding. (CVSS 7.5)
- [CVE-2022-42980](https://cve.now/CVE-2022-42980.md): go-admin (aka GO Admin) 2.0.12 uses the string go-admin as a production JWT key. (CVSS 9.8)
- [CVE-2022-42983](https://cve.now/CVE-2022-42983.md): anji-plus AJ-Report 0.9.8.6 allows remote attackers to bypass login authentication by spoofing JWT Tokens. (CVSS 8.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-10-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.