# CVEs published 2022-10-18

159 CVEs were published on October 18, 2022: 8 critical, 52 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2022-39058](https://cve.now/CVE-2022-39058.md): Changing Information Technology Inc. RAVA certificate validation system - Path Traversal (CVSS 7.5, Changing Information Technology RAVA certificate validation…)
- [CVE-2022-39057](https://cve.now/CVE-2022-39057.md): Changing Information Technology Inc. RAVA certificate validation system - Command Injection (CVSS 7.2, Changing Information Technology RAVA certificate validation…)
- [CVE-2022-39056](https://cve.now/CVE-2022-39056.md): Changing Information Technology Inc. RAVA certificate validation system - SQL Injection (CVSS 9.8, Changing Information Technology RAVA certificate validation…)
- [CVE-2022-39055](https://cve.now/CVE-2022-39055.md): Changing Information Technology Inc. RAVA certificate validation system - Server-Side Request Forgery (SSRF) (CVSS 5.3, Changing Information Technology RAVA certificate validation…)
- [CVE-2022-22251](https://cve.now/CVE-2022-22251.md): cSRX Series: Storing Passwords in a Recoverable Format and software permissions issues allows a local attacker to elevate privileges (CVSS 7.8, Juniper Networks Junos OS)
- [CVE-2022-22250](https://cve.now/CVE-2022-22250.md): Junos OS and Junos OS Evolved: An FPC crash might be seen due to an EVPN MAC entry moving from local to remote (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2022-22249](https://cve.now/CVE-2022-22249.md): Junos OS: MX Series: An FPC crash might be seen due to mac-moves within the same bridge domain (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2022-22248](https://cve.now/CVE-2022-22248.md): Junos OS Evolved: Incorrect file permissions can allow low-privileged user to cause another user to execute arbitrary commands (CVSS 7.3, Juniper Networks Junos OS Evolved)
- [CVE-2022-22247](https://cve.now/CVE-2022-22247.md): Junos OS Evolved: Kernel processing of unvalidated TCP segments could lead to a Denial of Service (DoS) (CVSS 7.5, Juniper Networks Junos OS Evolved)
- [CVE-2022-22246](https://cve.now/CVE-2022-22246.md): Junos OS: PHP file inclusion vulnerability in J-Web (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2022-22245](https://cve.now/CVE-2022-22245.md): Junos OS: Path traversal vulnerability in J-Web (CVSS 4.3, Juniper Networks Junos OS)
- [CVE-2022-22244](https://cve.now/CVE-2022-22244.md): Junos OS: Unauthenticated XPath Injection vulnerability in J-Web (CVSS 5.3, Juniper Networks Junos OS)
- [CVE-2022-22243](https://cve.now/CVE-2022-22243.md): Junos OS: XPath Injection vulnerability in J-Web (CVSS 4.3, Juniper Networks Junos OS)
- [CVE-2022-22242](https://cve.now/CVE-2022-22242.md): Junos OS: Cross-site Scripting (XSS) vulnerability in J-Web (CVSS 6.1, Juniper Networks Junos OS)
- [CVE-2022-22241](https://cve.now/CVE-2022-22241.md): Junos OS: Vulnerability in J-Web may allow deserialization without authentication (CVSS 8.1, Juniper Networks Junos OS)
- [CVE-2022-22240](https://cve.now/CVE-2022-22240.md): Junos OS and Junos OS Evolved: An rpd memory leak might be observed while running a specific cli command in a RIB sharding scenario (CVSS 5.5, Juniper Networks Junos OS)
- [CVE-2022-22239](https://cve.now/CVE-2022-22239.md): Junos OS Evolved: The ssh CLI command always runs as root which can lead to privilege escalation (CVSS 8.2, Juniper Networks Junos OS Evolved)
- [CVE-2022-22238](https://cve.now/CVE-2022-22238.md): Junos OS and Junos OS Evolved: The rpd process will crash when a malformed incoming RESV message is processed (CVSS 5.3, Juniper Networks Junos OS)
- [CVE-2022-22237](https://cve.now/CVE-2022-22237.md): Junos OS: Peers not configured for TCP-AO can establish a BGP or LDP session even if authentication is configured locally (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2022-22236](https://cve.now/CVE-2022-22236.md): Junos OS: SRX Series and MX Series: When specific valid SIP packets are received the PFE will crash (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2022-22235](https://cve.now/CVE-2022-22235.md): Junos OS: SRX Series: A flowd core will be observed when malformed GPRS traffic is processed (CVSS 5.9, Juniper Networks Junos OS)
- [CVE-2022-22234](https://cve.now/CVE-2022-22234.md): Junos OS: EX2300 and EX3400 Series: One of more SFPs might become unavailable when the system is very busy (CVSS 5.5, Juniper Networks Junos OS)
- [CVE-2022-22233](https://cve.now/CVE-2022-22233.md): Junos OS and Junos OS Evolved: In an SR to LDP interworking scenario, with SRMS, when a specific low privileged command is issued on an ABR rpd will crash (CVSS 5.5, Juniper Networks Junos OS)
- [CVE-2022-22232](https://cve.now/CVE-2022-22232.md): SRX Series: If Unified Threat Management (UTM) Enhanced Content Filtering (CF) is enabled and specific traffic is processed the PFE will crash (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2022-22231](https://cve.now/CVE-2022-22231.md): SRX Series: If UTM Enhanced Content Filtering and AntiVirus are enabled, and specific traffic is processed the PFE will crash (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2022-22230](https://cve.now/CVE-2022-22230.md): Junos OS and Junos OS Evolved: RPD crash upon receipt of specific OSPFv3 LSAs (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2022-22229](https://cve.now/CVE-2022-22229.md): Paragon Active Assurance (Formerly Netrounds): Stored Cross-site Scripting (XSS) vulnerability in web administration (CVSS 8.4, Juniper Networks Paragon Active Assurance)
- [CVE-2022-22228](https://cve.now/CVE-2022-22228.md): Junos OS: IPv6 OAM SRv6 network-enabled devices are vulnerable to Denial of Service (DoS) due to RPD memory leak upon receipt of specific a IPv6 packet (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2022-22227](https://cve.now/CVE-2022-22227.md): Junos OS Evolved: ACX7000 Series: Specific IPv6 transit traffic gets exceptioned to the routing-engine which causes increased CPU utilization (CVSS 5.3, Juniper Networks Junos OS Evolved)
- [CVE-2022-22226](https://cve.now/CVE-2022-22226.md): Junos OS: EX4300-MP, EX4600, QFX5000 Series: In VxLAN scenarios specific packets processed cause a memory leak leading to a PFE crash (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2022-22225](https://cve.now/CVE-2022-22225.md): Junos OS and Junos OS Evolved: In a BGP multipath scenario, when one of the contributing routes is flapping often and rapidly, rpd may crash (CVSS 5.9, Juniper Networks Junos OS)
- [CVE-2022-22224](https://cve.now/CVE-2022-22224.md): Junos OS and Junos OS Evolved: PPMD goes into infinite loop upon receipt of malformed OSPF TLV (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2022-22223](https://cve.now/CVE-2022-22223.md): Junos OS: QFX10000 Series: In IP/MPLS PHP node scenarios upon receipt of certain crafted packets multiple interfaces in LAG configurations may detach. (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2022-22220](https://cve.now/CVE-2022-22220.md): Junos OS and Junos OS Evolved: Due to a race condition the rpd process can crash upon receipt of a BGP update message containing flow spec route (CVSS 5.9, Juniper Networks Junos OS)
- [CVE-2022-22219](https://cve.now/CVE-2022-22219.md): Junos OS and Junos OS Evolved: RPD core upon receipt of a specific EVPN route by a BGP route reflector in an EVPN environment (CVSS 5.9, Juniper Networks Junos OS)
- [CVE-2022-22218](https://cve.now/CVE-2022-22218.md): Junos OS: SRX Series: Upon processing of a genuine packet the pkid process will crash during CMPv2 auto-re-enrollment (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2022-22211](https://cve.now/CVE-2022-22211.md): Junos OS Evolved: PTX Series: Multiple FPCs become unreachable due to continuous polling of specific SNMP OID (CVSS 7.5, Juniper Networks Junos OS Evolved)
- [CVE-2022-22208](https://cve.now/CVE-2022-22208.md): Junos OS and Junos OS Evolved: An rpd crash can occur due to memory corruption caused by flapping BGP sessions (CVSS 5.9, Juniper Networks Junos OS)
- [CVE-2022-22201](https://cve.now/CVE-2022-22201.md): SRX5000 Series with SPC3, SRX4000 Series, and vSRX: When PowerMode IPsec is configured, the PFE will crash upon receipt of a malformed ESP packet (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2022-22192](https://cve.now/CVE-2022-22192.md): Junos OS Evolved: PTX Series: An attacker can cause a kernel panic by sending a malformed TCP packet to the device (CVSS 7.5, Juniper Networks Junos OS Evolved)
- [CVE-2020-15853](https://cve.now/CVE-2020-15853.md): supybot-fedora implements the command 'refresh', that refreshes the cache of all users from FAS. (CVSS 5.3, supybot-fedora)
- [CVE-2021-3305](https://cve.now/CVE-2021-3305.md): Beijing Feishu Technology Co., Ltd Feishu v3.40.3 was discovered to contain an untrusted search path vulnerability. (CVSS 7.8)
- [CVE-2022-21587](https://cve.now/CVE-2022-21587.md): Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). (CVSS 9.8, KEV, Oracle Web Applications Desktop Integrator)
- [CVE-2022-21589](https://cve.now/CVE-2022-21589.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). (CVSS 4.3, Oracle MySQL Server)
- [CVE-2022-21590](https://cve.now/CVE-2022-21590.md): Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Core Formatting API). (CVSS 7.6, Oracle BI Publisher)
- [CVE-2022-21591](https://cve.now/CVE-2022-21591.md): Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: UI Infrastructure). (CVSS 5.4, Oracle Transportation Management)
- [CVE-2022-21592](https://cve.now/CVE-2022-21592.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). (CVSS 4.3, Oracle MySQL Server)
- [CVE-2022-21593](https://cve.now/CVE-2022-21593.md): Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OHS Config MBeans). (CVSS 7.1, Oracle HTTP Server)
- [CVE-2022-21594](https://cve.now/CVE-2022-21594.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2022-21595](https://cve.now/CVE-2022-21595.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: C API). (CVSS 4.4, Oracle MySQL Server)
- [CVE-2022-21596](https://cve.now/CVE-2022-21596.md): Vulnerability in the Oracle Database - Advanced Queuing component of Oracle Database Server. (CVSS 7.2, Oracle Database - Enterprise Edition)
- [CVE-2022-21597](https://cve.now/CVE-2022-21597.md): Vulnerability in the Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaScript). (CVSS 5.3, Oracle GraalVM Enterprise Edition)
- [CVE-2022-21598](https://cve.now/CVE-2022-21598.md): Vulnerability in the Siebel Core - DB Deployment and Configuration product of Oracle Siebel CRM (component: Repository Utilities). (CVSS 7.5, Oracle Siebel Core - DB Deployment and Configuration)
- [CVE-2022-21599](https://cve.now/CVE-2022-21599.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2022-21600](https://cve.now/CVE-2022-21600.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 7.2, Oracle MySQL Server)
- [CVE-2022-21601](https://cve.now/CVE-2022-21601.md): Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: Connecti (CVSS 6.5, Oracle Communications Billing and Revenue Management)
- [CVE-2022-21602](https://cve.now/CVE-2022-21602.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). (CVSS 5.3, Oracle PeopleSoft Enterprise PT PeopleTools)
- [CVE-2022-21603](https://cve.now/CVE-2022-21603.md): Vulnerability in the Oracle Database - Sharding component of Oracle Database Server. (CVSS 7.2, Oracle Database - Enterprise Edition)
- [CVE-2022-21604](https://cve.now/CVE-2022-21604.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2022-21605](https://cve.now/CVE-2022-21605.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Data Dictionary). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2022-21606](https://cve.now/CVE-2022-21606.md): Vulnerability in the Oracle Services for Microsoft Transaction Server component of Oracle Database Server. (CVSS 6.1, Oracle Services for Microsoft Transaction Server)
- [CVE-2022-21607](https://cve.now/CVE-2022-21607.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2022-21608](https://cve.now/CVE-2022-21608.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2022-21609](https://cve.now/CVE-2022-21609.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Server). (CVSS 5.7, Oracle Business Intelligence Enterprise Edition)
- [CVE-2022-21610](https://cve.now/CVE-2022-21610.md): Vulnerability in the Oracle Solaris product of Oracle Systems (component: LDoms). (CVSS 3.3, Oracle Solaris Operating System)
- [CVE-2022-21611](https://cve.now/CVE-2022-21611.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.1, Oracle MySQL Server)
- [CVE-2022-21612](https://cve.now/CVE-2022-21612.md): Vulnerability in the Oracle Enterprise Data Quality product of Oracle Fusion Middleware (component: Dashboard). (CVSS 8.1, Oracle Enterprise Data Quality)
- [CVE-2022-21613](https://cve.now/CVE-2022-21613.md): Vulnerability in the Oracle Enterprise Data Quality product of Oracle Fusion Middleware (component: Dashboard). (CVSS 8.8, Oracle Enterprise Data Quality)
- [CVE-2022-21614](https://cve.now/CVE-2022-21614.md): Vulnerability in the Oracle Enterprise Data Quality product of Oracle Fusion Middleware (component: Dashboard). (CVSS 7.5, Oracle Enterprise Data Quality)
- [CVE-2022-21615](https://cve.now/CVE-2022-21615.md): Vulnerability in the Oracle Enterprise Data Quality product of Oracle Fusion Middleware (component: Dashboard). (CVSS 7.4, Oracle Enterprise Data Quality)
- [CVE-2022-21616](https://cve.now/CVE-2022-21616.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). (CVSS 5.2, Oracle WebLogic Server)
- [CVE-2022-21617](https://cve.now/CVE-2022-21617.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Connection Handling). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2022-21618](https://cve.now/CVE-2022-21618.md): Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS). (CVSS 5.3, Oracle Java SE JDK and JRE)
- [CVE-2022-21619](https://cve.now/CVE-2022-21619.md): Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). (CVSS 3.7, Oracle Java SE JDK and JRE)
- [CVE-2022-21620](https://cve.now/CVE-2022-21620.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 7.5, Oracle VM VirtualBox)
- [CVE-2022-21621](https://cve.now/CVE-2022-21621.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 6.0, Oracle VM VirtualBox)
- [CVE-2022-21622](https://cve.now/CVE-2022-21622.md): Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). (CVSS 7.5, Oracle SOA Suite)
- [CVE-2022-21623](https://cve.now/CVE-2022-21623.md): Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Application Config Console). (CVSS 7.5, Oracle Enterprise Manager Base Platform)
- [CVE-2022-21624](https://cve.now/CVE-2022-21624.md): Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JNDI). (CVSS 3.7, Oracle Java SE JDK and JRE)
- [CVE-2022-21625](https://cve.now/CVE-2022-21625.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.4, Oracle MySQL Server)
- [CVE-2022-21626](https://cve.now/CVE-2022-21626.md): Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). (CVSS 5.3, Oracle Java SE JDK and JRE)
- [CVE-2022-21627](https://cve.now/CVE-2022-21627.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 4.4, Oracle VM VirtualBox)
- [CVE-2022-21628](https://cve.now/CVE-2022-21628.md): Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Lightweight HTTP Server). (CVSS 5.3, Oracle Java SE JDK and JRE)
- [CVE-2022-21629](https://cve.now/CVE-2022-21629.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). (CVSS 5.4, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2022-21630](https://cve.now/CVE-2022-21630.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). (CVSS 6.1, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2022-21631](https://cve.now/CVE-2022-21631.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Design Tools SEC). (CVSS 6.1, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2022-21632](https://cve.now/CVE-2022-21632.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2022-21633](https://cve.now/CVE-2022-21633.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2022-21634](https://cve.now/CVE-2022-21634.md): Vulnerability in the Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: LLVM Interpreter). (CVSS 7.5, Oracle GraalVM Enterprise Edition)
- [CVE-2022-21635](https://cve.now/CVE-2022-21635.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 6.5, Oracle MySQL Server)
- [CVE-2022-21636](https://cve.now/CVE-2022-21636.md): Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Session Management). (CVSS 6.5, Oracle Applications Framework)
- [CVE-2022-21637](https://cve.now/CVE-2022-21637.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2022-21638](https://cve.now/CVE-2022-21638.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2022-21639](https://cve.now/CVE-2022-21639.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Elastic Search Integration). (CVSS 6.1, Oracle PeopleSoft Enterprise PT PeopleTools)
- [CVE-2022-21640](https://cve.now/CVE-2022-21640.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2022-21641](https://cve.now/CVE-2022-21641.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2022-31037](https://cve.now/CVE-2022-31037.md): OroCommerce vulnerable to Cross-site Scripting via Shipping rule editing page (CVSS 6.9, oroinc orocommerce · oro/commerce)
- [CVE-2022-31122](https://cve.now/CVE-2022-31122.md): Wire-server vulnerable to Token Recipient Confusion resulting in account impersonation, deletion or malicious account creation (CVSS 9.8, wireapp wire-server)
- [CVE-2022-3338](https://cve.now/CVE-2022-3338.md): XXE in Trellix ePO server (CVSS 5.4, Trellix ePolicy Orchestrator)
- [CVE-2022-3339](https://cve.now/CVE-2022-3339.md): Reflected XSS in Trellix ePO server (CVSS 5.4, Trellix ePolicy Orchestrator)
- [CVE-2022-3579](https://cve.now/CVE-2022-3579.md): SourceCodester Cashier Queuing System Login Page login.php sql injection (CVSS 6.3, SourceCodester Cashier Queuing System)
- [CVE-2022-3580](https://cve.now/CVE-2022-3580.md): SourceCodester Cashier Queuing System User Creation cross site scripting (CVSS 2.4, SourceCodester Cashier Queuing System)
- [CVE-2022-3581](https://cve.now/CVE-2022-3581.md): SourceCodester Cashier Queuing System Cashiers Tab cross site scripting (CVSS 2.4, SourceCodester Cashier Queuing System)
- [CVE-2022-3582](https://cve.now/CVE-2022-3582.md): SourceCodester Simple Cold Storage Management System cross-site request forgery (CVSS 4.3, SourceCodester Simple Cold Storage Management System)
- [CVE-2022-3583](https://cve.now/CVE-2022-3583.md): SourceCodester Canteen Management System login.php sql injection (CVSS 7.3, SourceCodester Canteen Management System)
- [CVE-2022-3584](https://cve.now/CVE-2022-3584.md): SourceCodester Canteen Management System edituser.php sql injection (CVSS 6.3, SourceCodester Canteen Management System)
- [CVE-2022-3585](https://cve.now/CVE-2022-3585.md): SourceCodester Simple Cold Storage Management System Contact Us cross-site request forgery (CVSS 4.3, SourceCodester Simple Cold Storage Management System)
- [CVE-2022-3587](https://cve.now/CVE-2022-3587.md): SourceCodester Simple Cold Storage Management System My Account cross site scripting (CVSS 3.5, SourceCodester Simple Cold Storage Management System)
- [CVE-2022-3594](https://cve.now/CVE-2022-3594.md): Linux Kernel BPF r8152.c intr\_callback logging of excessive data (CVSS 5.3, Linux Kernel)
- [CVE-2022-3595](https://cve.now/CVE-2022-3595.md): Linux Kernel CIFS sess.c sess\_free\_buffer double free (CVSS 3.5, Linux Kernel)
- [CVE-2022-36438](https://cve.now/CVE-2022-36438.md): AsusSwitch.exe on ASUS personal computers (running Windows) sets weak file permissions, leading to local privilege escalation (this also can (CVSS 7.8)
- [CVE-2022-36439](https://cve.now/CVE-2022-36439.md): AsusSoftwareManager.exe in ASUS System Control Interface on ASUS personal computers (running Windows) allows a local user to write into the (CVSS 6.0)
- [CVE-2022-39198](https://cve.now/CVE-2022-39198.md): Apache Dubbo Hession Deserialization Vulnerability Gadgets Bypass (CVSS 9.8, Apache Software Foundation Apache Dubbo · com.alibaba:he… +1)
- [CVE-2022-39399](https://cve.now/CVE-2022-39399.md): Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). (CVSS 3.7, Oracle Java SE JDK and JRE)
- [CVE-2022-39400](https://cve.now/CVE-2022-39400.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2022-39401](https://cve.now/CVE-2022-39401.md): Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). (CVSS 5.5, Oracle Solaris Operating System)
- [CVE-2022-39402](https://cve.now/CVE-2022-39402.md): Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: Core Client). (CVSS 4.3, Oracle MySQL Server)
- [CVE-2022-39403](https://cve.now/CVE-2022-39403.md): Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: Core Client). (CVSS 3.9, Oracle MySQL Server)
- [CVE-2022-39404](https://cve.now/CVE-2022-39404.md): Vulnerability in the MySQL Installer product of Oracle MySQL (component: Installer: General). (CVSS 4.2, Oracle MySQL Installer)
- [CVE-2022-39405](https://cve.now/CVE-2022-39405.md): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). (CVSS 5.3, Oracle Access Manager)
- [CVE-2022-39406](https://cve.now/CVE-2022-39406.md): Vulnerability in the PeopleSoft Enterprise Common Components product of Oracle PeopleSoft (component: Approval Framework). (CVSS 8.1, Oracle PeopleSoft Enterprise CC Common Application Objects)
- [CVE-2022-39407](https://cve.now/CVE-2022-39407.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security). (CVSS 5.5, Oracle PeopleSoft Enterprise PT PeopleTools)
- [CVE-2022-39408](https://cve.now/CVE-2022-39408.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 6.5, Oracle MySQL Server)
- [CVE-2022-39409](https://cve.now/CVE-2022-39409.md): Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: Business Process Automation). (CVSS 2.7, Oracle Transportation Management)
- [CVE-2022-39410](https://cve.now/CVE-2022-39410.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 6.5, Oracle MySQL Server)
- [CVE-2022-39411](https://cve.now/CVE-2022-39411.md): Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: Business Process Automation). (CVSS 4.9, Oracle Transportation Management)
- [CVE-2022-39412](https://cve.now/CVE-2022-39412.md): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Admin Console). (CVSS 7.5, Oracle Access Manager)
- [CVE-2022-39417](https://cve.now/CVE-2022-39417.md): Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). (CVSS 5.5, Oracle Solaris Operating System)
- [CVE-2022-39419](https://cve.now/CVE-2022-39419.md): Vulnerability in the Java VM component of Oracle Database Server. (CVSS 4.3, Oracle Database - Enterprise Edition)
- [CVE-2022-39420](https://cve.now/CVE-2022-39420.md): Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: Data, Functional Security). (CVSS 5.4, Oracle Transportation Management)
- [CVE-2022-39421](https://cve.now/CVE-2022-39421.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 7.3, Oracle VM VirtualBox)
- [CVE-2022-39422](https://cve.now/CVE-2022-39422.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 7.5, Oracle VM VirtualBox)
- [CVE-2022-39423](https://cve.now/CVE-2022-39423.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 6.0, Oracle VM VirtualBox)
- [CVE-2022-39424](https://cve.now/CVE-2022-39424.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 8.1, Oracle VM VirtualBox)
- [CVE-2022-39425](https://cve.now/CVE-2022-39425.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 8.1, Oracle VM VirtualBox)
- [CVE-2022-39426](https://cve.now/CVE-2022-39426.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 8.1, Oracle VM VirtualBox)
- [CVE-2022-39427](https://cve.now/CVE-2022-39427.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 8.8, Oracle VM VirtualBox)
- [CVE-2022-39428](https://cve.now/CVE-2022-39428.md): Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). (CVSS 9.8, Oracle Web Applications Desktop Integrator)
- [CVE-2022-40684](https://cve.now/CVE-2022-40684.md): An authentication bypass using an alternate path or channel \[CWE-288\] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0. (CVSS 9.8, KEV, Fortinet FortiOS, FortiProxy, FortiSwitchManager)
- [CVE-2022-40889](https://cve.now/CVE-2022-40889.md): Phpok 6.1 has a deserialization vulnerability via framework/phpok\_call.php. (CVSS 9.8)
- [CVE-2022-41479](https://cve.now/CVE-2022-41479.md): The DevExpress Resource Handler (ASPxHttpHandlerModule) in DevExpress ASP.NET Web Forms Build v19.2.3 does not verify the referenced objects (CVSS 7.5)
- [CVE-2022-41500](https://cve.now/CVE-2022-41500.md): EyouCMS V1.5.9 was discovered to contain multiple Cross-Site Request Forgery (CSRF) vulnerabilities via the Members Center, Editorial Member (CVSS 8.8)
- [CVE-2022-41504](https://cve.now/CVE-2022-41504.md): An arbitrary file upload vulnerability in the component /php\_action/editProductImage.php of Billing System Project v1.0 allows attackers to (CVSS 7.2)
- [CVE-2022-41537](https://cve.now/CVE-2022-41537.md): Online Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /user\_opera (CVSS 7.2)
- [CVE-2022-41540](https://cve.now/CVE-2022-41540.md): The web app client of TP-Link AX10v1 V1\_211117 uses hard-coded cryptographic keys when communicating with the router. (CVSS 5.9)
- [CVE-2022-41541](https://cve.now/CVE-2022-41541.md): TP-Link AX10v1 V1\_211117 allows attackers to execute a replay attack by using a previously transmitted encrypted authentication message and (CVSS 8.1)
- [CVE-2022-41544](https://cve.now/CVE-2022-41544.md): GetSimple CMS v3.3.16 was discovered to contain a remote code execution (RCE) vulnerability via the edited\_file parameter in admin/theme-edi (CVSS 8.8)
- [CVE-2022-41547](https://cve.now/CVE-2022-41547.md): Mobile Security Framework (MobSF) v0.9.2 and below was discovered to contain a local file inclusion (LFI) vulnerability in the StaticAnalyze (CVSS 7.5, mobsf)
- [CVE-2022-42112](https://cve.now/CVE-2022-42112.md): A Cross-site scripting (XSS) vulnerability in the Portal Search module's Sort widget in Liferay Portal 7.2.0 through 7.4.3.24, and Liferay D (CVSS 5.4, com.liferay:com.liferay.portal.search.web · com.liferay.por…)
- [CVE-2022-42113](https://cve.now/CVE-2022-42113.md): A Cross-site scripting (XSS) vulnerability in Document Library module in Liferay Portal 7.4.3.30 through 7.4.3.36, and Liferay DXP 7.4 updat (CVSS 6.1, com.liferay:com.liferay.document.library.web · com.liferay.…)
- [CVE-2022-42114](https://cve.now/CVE-2022-42114.md): A Cross-site scripting (XSS) vulnerability in the Role module's edit role assignees page in Liferay Portal 7.4.0 through 7.4.3.36, and Lifer (CVSS 5.4, com.liferay:com.liferay.roles.admin.web · com.liferay.porta…)
- [CVE-2022-42115](https://cve.now/CVE-2022-42115.md): Cross-site scripting (XSS) vulnerability in the Object module's edit object details page in Liferay Portal 7.4.3.4 through 7.4.3.36 allows r (CVSS 5.4, com.liferay:com.liferay.object.web)
- [CVE-2022-42116](https://cve.now/CVE-2022-42116.md): A Cross-site scripting (XSS) vulnerability in the Frontend Editor module's integration with CKEditor in Liferay Portal 7.3.2 through 7.4.3.1 (CVSS 6.1, com.liferay:com.liferay.frontend.editor.ckeditor.web · com.…)
- [CVE-2022-42117](https://cve.now/CVE-2022-42117.md): A Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.3.2 through 7.4.3.16, and Liferay DXP 7.3 befor (CVSS 6.1, com.liferay:com.liferay.frontend.taglib.clay · com.liferay.…)
- [CVE-2022-42188](https://cve.now/CVE-2022-42188.md): In Lavalite 9.0.0, the XSRF-TOKEN cookie is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server. (CVSS 7.5, lavalite/cms)
- [CVE-2022-42202](https://cve.now/CVE-2022-42202.md): TP-Link TL-WR841N 8.0 4.17.16 Build 120201 Rel.54750n is vulnerable to Cross Site Scripting (XSS). (CVSS 6.1)
- [CVE-2022-42218](https://cve.now/CVE-2022-42218.md): Open Source SACCO Management System v1.0 vulnerable to SQL Injection via /sacco\_shield/manage\_loan.php. (CVSS 7.2)
- [CVE-2022-43259](https://cve.now/CVE-2022-43259.md): Tenda AC15 V15.03.05.18 was discovered to contain a stack overflow via the timeZone parameter in the form\_fast\_setting\_wifi\_set function. (CVSS 7.5)
- [CVE-2022-43260](https://cve.now/CVE-2022-43260.md): Tenda AC18 V15.03.05.19(6318) was discovered to contain a stack overflow via the time parameter in the fromSetSysTime function. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-10-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.