CVEs published October 19, 2022
127 CVEs were published on October 19, 2022: 14 critical, 37 high. 1 is now in CISA KEV.
- Published
- 127
- Critical
- 14
- High
- 37
- Medium
- 68
- Low
- 2
- Unrated
- 6
- Now in CISA KEV
- 1
- Fix available
- 60
Most affected products
- Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- 6
- F5 BIG-IP
- 5
- Jenkins project Jenkins Compuware Topaz for Total Test Plug…
- 4
- Jenkins project Jenkins Katalon Plugin · org.jenkins-ci.plu…
- 4
- F5 BIG-IP Advanced WAF & ASM
- 3
- Apache Software Foundation Apache Isis · org.apache.isis.co…
- 2
- F5 BIG-IP · F5 BIG-IQ
- 2
- F5 NGINX
- 2
- F5OS-A · F5OS-C
- 2
- Fuji Electric D300win
- 2
Critical 14
- CVE-2016-20016MVPower CCTV DVR models, including TV-7104HE 1.8.4 115215B9 and TV7108HE, contain a web shell that is accessible via a /shell URI.
- CVE-2016-20017D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wil
- CVE-2022-25718Cryptographic issue in WLAN due to improper check on return value while authentication handshake in Snapdragon Auto, Snapdragon ConnectivityQualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…
- CVE-2022-25720Memory corruption in WLAN due to out of bound array access during connect/roaming in Snapdragon Auto, Snapdragon Compute, Snapdragon ConnectQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-25748Memory corruption in WLAN due to integer overflow to buffer overflow while parsing GTK frames.Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-41415Acer Altos W2000h-W570h F4 R01.03.0018 was discovered to contain a stack overflow in the RevserveMem component.
- CVE-2022-43019OpenCATS v0.9.6 was discovered to contain a remote code execution (RCE) vulnerability via the getDataGridPager's ajax functionality.
- CVE-2022-43024Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the list parameter at /goform/SetVirtualServe
- CVE-2022-43025Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the startIp parameter at /goform/SetPptpServe
- CVE-2022-43026Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the endIp parameter at /goform/SetPptpServerC
- CVE-2022-43027Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the firewallEn parameter at /goform/SetFirewa
- CVE-2022-43028Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the timeZone parameter at /goform/SetSysTimeC
- CVE-2022-43029Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the time parameter at /goform/SetSysTimeCfg.
- CVE-2022-43184D-Link DIR878 1.30B08 Hotfix_04 was discovered to contain a command injection vulnerability via the component /bin/proc.cgi.
High 37
- CVE-2022-41836BIG-IP Advanced WAF and ASM bd vulnerability CVE-2022-41836F5 BIG-IP Advanced WAF & ASM
- CVE-2022-41835F5OS vulnerability CVE-2022-41835F5OS-A · F5OS-C
- CVE-2022-41833BIG-IP iRule vulnerability CVE-2022-41833F5 BIG-IP
- CVE-2022-41832BIG-IP SIP vulnerability CVE-2022-41832F5 BIG-IP
- CVE-2022-41806BIG-IP AFM NAT64 Policy Vulnerability CVE-2022-41806F5 BIG-IP AFM
- CVE-2022-41787BIG-IP DNS Express vulnerability CVE-2022-41787F5 BIG-IP DNS · F5 BIG-IP LTM
- CVE-2022-41743NGINX ngx_http_hls_module vulnerability CVE-2022-41743F5 NGINX Plus
- CVE-2022-41742NGINX ngx_http_mp4_module vulnerability CVE-2022-41742F5 NGINX
- CVE-2022-41741NGINX ngx_http_mp4_module vulnerability CVE-2022-41741F5 NGINX
- CVE-2022-41691BIG-IP Advanced WAF/ASM bd vulnerability CVE-2022-41691F5 BIG-IP Advanced WAF & ASM
- CVE-2022-41624BIG-IP iRules vulnerability CVE-2022-41624F5 BIG-IP
- CVE-2022-41617BIG-IP Advanced WAF and ASM iControl REST vulnerability CVE-2022-41617F5 BIG-IP Advanced WAF & ASM
- CVE-2022-1738Fuji Electric D300win Out-of-bounds ReadFuji Electric D300win
- CVE-2013-4253The deployment script in the unsupported "OpenShift Extras" set of add-on scripts, in Red Hat Openshift 1, installs a default public key in Red Hat Openshift
- CVE-2020-23648Asus RT-N12E 2.0.0.39 is affected by an incorrect access control vulnerability.
- CVE-2022-14143scale API Management 2 does not perform adequate sanitation for user input in multiple fields.3scale-amp-system
- CVE-2022-23241Clustered Data ONTAP versions 9.11.1 through 9.11.1P2 with SnapLock configured FlexGroups are susceptible to a vulnerability which could allClustered Data ONTAP
- CVE-2022-23734Deserialization of Untrusted Data vulnerability in GitHub Enterprise Server leading to Remote Code ExecutionGitHub Enterprise Server
- CVE-2022-25687memory corruption in video due to buffer overflow while parsing asf clips in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, SQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-25719Information disclosure in WLAN due to improper length check while processing authentication handshake in Snapdragon Auto, Snapdragon ConnectQualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…
- CVE-2022-25736Denial of service in WLAN due to out-of-bound read happens while processing VHT action frame in Snapdragon Auto, Snapdragon Compute, SnapdraQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-25749Transient Denial-of-Service in WLAN due to buffer over-read while parsing MDNS frames.Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-33077An access control issue in nopcommerce v4.50.2 allows attackers to arbitrarily modify any customer's address via the addressedit endpoint.
- CVE-2022-3608Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaqthorsten/phpmyfaq · phpmyfaq/phpmyfaq
- CVE-2022-39260Git vulnerable to Remote Code Execution via Heap overflow in `git shell`git
- CVE-2022-39267Brokercap Bifrost vulnerable to authentication bypass for admin and monitor user groupsbrokercap Bifrost · github.com/brokercap/Bifrost
- CVE-2022-39301sra-admin is vulnerable to storage cross-site scripting (XSS) via unrestricted file uploadmomofoolish sra-admin
- CVE-2022-40798OcoMon 4.0RC1 is vulnerable to Incorrect Access Control.
- CVE-2022-41709Markdownify version 1.4.1 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdoMarkdownify · electron-markdownify
- CVE-2022-42227jsonlint 1.0 is vulnerable to heap-buffer-overflow via /home/hjsz/jsonlint/src/lexer.
- CVE-2022-43040GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a heap buffer overflow via the function gf_isom_box_dump_start_ex at /isomed
- CVE-2022-43042GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a heap buffer overflow via the function FixSDTPInTRAF at isomedia/isom_inter
- CVE-2022-43407Jenkins Pipeline: Input Step Plugin 451.vf1a_a_4f405289 and earlier does not restrict or sanitize the optionally specified ID of the 'input'Jenkins project Jenkins Pipeline: Input Step Plugin · org.j…
- CVE-2022-43415Jenkins REPO Plugin 1.15.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins project Jenkins REPO Plugin · org.jenkins-ci.plugin…
- CVE-2022-43416Jenkins Katalon Plugin 1.0.32 and earlier implements an agent/controller message that does not limit where it can be executed and allows invJenkins project Jenkins Katalon Plugin · org.jenkins-ci.plu…
- CVE-2022-43429Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be eJenkins project Jenkins Compuware Topaz for Total Test Plug…
- CVE-2022-43430Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacJenkins project Jenkins Compuware Topaz for Total Test Plug…
Medium, low and unrated 76
- CVE-2022-41983BIG-IP TMM Vulnerability CVE-2022-41983F5 BIG-IP
- CVE-2022-41813BIG-IP PEM and AFM TMUI, TMSH and iControl vulnerability CVE-2022-41813F5 BIG-IP AFM & PEM
- CVE-2022-41780F5OS CLI vulnerability CVE-2022-41780F5OS-A · F5OS-C
- CVE-2022-41770BIG-IP and BIG-IQ iControl REST vulnerability CVE-2022-41770F5 BIG-IP · F5 BIG-IQ
- CVE-2022-41694BIG-IP and BIG-IQ mcpd vulnerability CVE-2022-41694F5 BIG-IP · F5 BIG-IQ
- CVE-2022-36795BIG-IP software SYN cookies vulnerability CVE-2022-36795F5 BIG-IP
- CVE-2022-38107Sensitive Data Disclosure VulnerabilitySolarWinds SQL Sentry
- CVE-2022-1523Fuji Electric D300win Write-what-where conditionFuji Electric D300win
- CVE-2013-4281In Red Hat Openshift 1, weak default permissions are applied to the /etc/openshift/server_priv.pem file on the broker server, which could alRed Hat Openshift
- CVE-2022-25666Memory corruption due to use after free in service while trying to access maps by different threads in Snapdragon Auto, Snapdragon Compute, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-2805A flaw was found in ovirt-engine, which leads to the logging of plaintext passwords in the log file when using otapi-style.ovirt-engine
- CVE-2022-31684Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests.Reactor Netty · io.projectreactor.netty:reactor-netty-http
- CVE-2022-3327Missing Authentication for Critical Function in ikus060/rdiffwebikus060/rdiffweb · rdiffweb
- CVE-2022-3586A flaw was found in the Linux kernel’s networking code.Linux Kernel
- CVE-2022-35860Missing AES encryption in Corsair K63 Wireless 3.1.3 allows physically proximate attackers to inject and sniff keystrokes via 2.4 GHz radio
- CVE-2022-3606Linux Kernel BPF libbpf.c find_prog_by_sec_insn null pointer dereferenceLinux Kernel
- CVE-2022-3607Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in octoprint/octoprintoctoprint/octoprint · octoprint
- CVE-2022-38901A Cross-site scripting (XSS) vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platfo
- CVE-2022-39233Tuleap subject to Missing Authorization allowing for branch prefix modificationEnalean tuleap
- CVE-2022-39253Git subject to exposure of sensitive information via local clone of symbolic linksgit
- CVE-2022-40884Bento4 1.6.0 has memory leaks via the mp4fragment.
- CVE-2022-40885Bento4 v1.6.0-639 has a memory allocation issue that can cause denial of service.
- CVE-2022-41707Relatedcode's Messenger version 7bcd20b allows an authenticated external attacker to access sensitive data of any user of the application.relatedcode/Messenger
- CVE-2022-41708Relatedcode's Messenger version 7bcd20b allows an authenticated external attacker to access existing chats in the workspaces of any user of relatedcode/Messenger
- CVE-2022-42466XSS vulnerability, eg for String properties.Apache Software Foundation Apache Isis · org.apache.isis.co…
- CVE-2022-42467h2 webconsole (available only in prototype mode) should nevertheless be disabled by default.Apache Software Foundation Apache Isis · org.apache.isis.co…
- CVE-2022-43014OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the joborderID parameter.
- CVE-2022-43015OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the entriesPerPage parameter.
- CVE-2022-43016OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback component.
- CVE-2022-43017OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the indexFile component.
- CVE-2022-43018OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the email parameter in the Check Email fu
- CVE-2022-43020OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the tag_id variable in the Tag update function.
- CVE-2022-43021OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the entriesPerPage variable.
- CVE-2022-43022OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the tag_id variable in the Tag deletion function.
- CVE-2022-43023OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function.
- CVE-2022-43032An issue was discovered in Bento4 v1.6.0-639.
- CVE-2022-43033An issue was discovered in Bento4 1.6.0-639.
- CVE-2022-43034An issue was discovered in Bento4 v1.6.0-639.
- CVE-2022-43035An issue was discovered in Bento4 v1.6.0-639.
- CVE-2022-43037An issue was discovered in Bento4 1.6.0-639.
- CVE-2022-43038Bento4 v1.6.0-639 was discovered to contain a heap overflow via the AP4_BitReader::ReadCache() function in mp42ts.
- CVE-2022-43039GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a segmentation violation via the function gf_isom_meta_restore_items_ref at
- CVE-2022-43043GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a segmentation violation via the function BD_CheckSFTimeOffset at /bifs/fiel
- CVE-2022-43044GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a segmentation violation via the function gf_isom_get_meta_item_info at /iso
- CVE-2022-43045GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a segmentation violation via the function gf_dump_vrml_sffield at /scene_man
- CVE-2022-43185A stored cross-site scripting (XSS) vulnerability in the Configuration/Holidays module of Rukovoditel v3.2.1 allows attackers to execute arb
- CVE-2022-43401A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Script Security PluginJenkins project Jenkins Script Security Plugin · org.jen… +1
- CVE-2022-43402A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Pipeline: Groovy PlugiJenkins project Jenkins Pipeline: Groovy Plugin · org.jenki…
- CVE-2022-43403A sandbox bypass vulnerability involving casting an array-like value to an array type in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_4Jenkins project Jenkins Script Security Plugin · org.jenkin…
- CVE-2022-43404A sandbox bypass vulnerability involving crafted constructor bodies and calls to sandbox-generated synthetic constructors in Jenkins Script Jenkins project Jenkins Script Security Plugin · org.jen… +1
- CVE-2022-43405A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 612.v84da_9c54906d and earlier allows attackers with permission Jenkins project Jenkins Pipeline: Groovy Libraries Plugi… +1
- CVE-2022-43406A sandbox bypass vulnerability in Jenkins Pipeline: Deprecated Groovy Libraries Plugin 583.vf3b_454e43966 and earlier allows attackers with Jenkins project Jenkins Pipeline: Deprecated Groovy Libr… +1
- CVE-2022-43408Jenkins Pipeline: Stage View Plugin 2.26 and earlier does not correctly encode the ID of 'input' steps when using it to generate URLs to proJenkins project Jenkins Pipeline: Stage View Plugin · org.j…
- CVE-2022-43409Jenkins Pipeline: Supporting APIs Plugin 838.va_3a_087b_4055b and earlier does not sanitize or properly encode URLs of hyperlinks sending POJenkins project Jenkins Pipeline: Supporting APIs Plugin ·…
- CVE-2022-43410Jenkins Mercurial Plugin 1251.va_b_121f184902 and earlier provides information about which jobs were triggered or scheduled for polling throJenkins project Jenkins Mercurial Plugin · org.jenkins-ci.p…
- CVE-2022-43411Jenkins GitLab Plugin 1.5.35 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhooJenkins project Jenkins GitLab Plugin · org.jenkins-ci.plug…
- CVE-2022-43412Jenkins Generic Webhook Trigger Plugin 1.84.1 and earlier uses a non-constant time comparison function when checking whether the provided anJenkins project Jenkins Generic Webhook Trigger Plugin · or…
- CVE-2022-43413Jenkins Job Import Plugin 3.5 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permJenkins project Jenkins Job Import Plugin · org.jenkins-ci.…
- CVE-2022-43414Jenkins NUnit Plugin 0.27 and earlier implements an agent-to-controller message that parses files inside a user-specified directory as test Jenkins project Jenkins NUnit Plugin · org.jenkins-ci.plugi…
- CVE-2022-43417Jenkins Katalon Plugin 1.0.32 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/ReadJenkins project Jenkins Katalon Plugin · org.jenkins-ci.plu…
- CVE-2022-43418A cross-site request forgery (CSRF) vulnerability in Jenkins Katalon Plugin 1.0.33 and earlier allows attackers to connect to an attacker-spJenkins project Jenkins Katalon Plugin · org.jenkins-ci.plu…
- CVE-2022-43419Jenkins Katalon Plugin 1.0.32 and earlier stores API keys unencrypted in job config.xml files on the Jenkins controller where they can be viJenkins project Jenkins Katalon Plugin · org.jenkins-ci.plu…
- CVE-2022-43420Jenkins Contrast Continuous Application Security Plugin 3.9 and earlier does not escape data returned from the Contrast service when generatJenkins project Jenkins Contrast Continuous Application Sec…
- CVE-2022-43421A missing permission check in Jenkins Tuleap Git Branch Source Plugin 3.2.4 and earlier allows unauthenticated attackers to trigger Tuleap pJenkins project Jenkins Tuleap Git Branch Source Plugin · o…
- CVE-2022-43422Jenkins Compuware Topaz Utilities Plugin 1.0.8 and earlier implements an agent/controller message that does not limit where it can be executJenkins project Jenkins Compuware Topaz Utilities Plugin ·…
- CVE-2022-43423Jenkins Compuware Source Code Download for Endevor, PDS, and ISPW Plugin 2.0.12 and earlier implements an agent/controller message that doesJenkins project Jenkins Compuware Source Code Download for…
- CVE-2022-43424Jenkins Compuware Xpediter Code Coverage Plugin 1.0.7 and earlier implements an agent/controller message that does not limit where it can beJenkins project Jenkins Compuware Xpediter Code Coverage Pl…
- CVE-2022-43425Jenkins Custom Checkbox Parameter Plugin 1.4 and earlier does not escape the name and description of Custom Checkbox Parameter parameters onJenkins project Jenkins Custom Checkbox Parameter Plugin ·…
- CVE-2022-43426Jenkins S3 Explorer Plugin 1.0.8 and earlier does not mask the AWS_SECRET_ACCESS_KEY form field, increasing the potential for attackers to oJenkins project Jenkins S3 Explorer Plugin · io.jenkins.plu…
- CVE-2022-43427Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not perform permission checks in several HTTP endpoints, allowing attacJenkins project Jenkins Compuware Topaz for Total Test Plug…
- CVE-2022-43428Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be eJenkins project Jenkins Compuware Topaz for Total Test Plug…
- CVE-2022-43431Jenkins Compuware Strobe Measurement Plugin 1.0.1 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers wiJenkins project Jenkins Compuware Strobe Measurement Plugin…
- CVE-2022-43432Jenkins XFramium Builder Plugin 1.0.22 and earlier programmatically disables Content-Security-Policy protection for user-generated content iJenkins project Jenkins XFramium Builder Plugin · org.jenki…
- CVE-2022-43433Jenkins ScreenRecorder Plugin 0.7 and earlier programmatically disables Content-Security-Policy protection for user-generated content in worJenkins project Jenkins ScreenRecorder Plugin · io.jenkins.…
- CVE-2022-43434Jenkins NeuVector Vulnerability Scanner Plugin 1.20 and earlier programmatically disables Content-Security-Policy protection for user-generaJenkins project Jenkins NeuVector Vulnerability Scanner Plu…
- CVE-2022-43435Jenkins 360 FireLine Plugin 1.7.2 and earlier programmatically disables Content-Security-Policy protection for user-generated content in worJenkins project Jenkins 360 FireLine Plugin · org.jenkins-c…