# CVEs published 2022-10-19

127 CVEs were published on October 19, 2022: 14 critical, 37 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2022-41983](https://cve.now/CVE-2022-41983.md): BIG-IP TMM Vulnerability CVE-2022-41983 (CVSS 3.7, F5 BIG-IP)
- [CVE-2022-41836](https://cve.now/CVE-2022-41836.md): BIG-IP Advanced WAF and ASM bd vulnerability CVE-2022-41836 (CVSS 7.5, F5 BIG-IP Advanced WAF & ASM)
- [CVE-2022-41835](https://cve.now/CVE-2022-41835.md): F5OS vulnerability CVE-2022-41835 (CVSS 7.3, F5OS-A · F5OS-C)
- [CVE-2022-41833](https://cve.now/CVE-2022-41833.md): BIG-IP iRule vulnerability CVE-2022-41833 (CVSS 7.5, F5 BIG-IP)
- [CVE-2022-41832](https://cve.now/CVE-2022-41832.md): BIG-IP SIP vulnerability CVE-2022-41832 (CVSS 7.5, F5 BIG-IP)
- [CVE-2022-41813](https://cve.now/CVE-2022-41813.md): BIG-IP PEM and AFM TMUI, TMSH and iControl vulnerability CVE-2022-41813 (CVSS 6.5, F5 BIG-IP AFM & PEM)
- [CVE-2022-41806](https://cve.now/CVE-2022-41806.md): BIG-IP AFM NAT64 Policy Vulnerability CVE-2022-41806 (CVSS 7.5, F5 BIG-IP AFM)
- [CVE-2022-41787](https://cve.now/CVE-2022-41787.md): BIG-IP DNS Express vulnerability CVE-2022-41787 (CVSS 7.5, F5 BIG-IP DNS · F5 BIG-IP LTM)
- [CVE-2022-41780](https://cve.now/CVE-2022-41780.md): F5OS CLI vulnerability CVE-2022-41780 (CVSS 5.5, F5OS-A · F5OS-C)
- [CVE-2022-41770](https://cve.now/CVE-2022-41770.md): BIG-IP and BIG-IQ iControl REST vulnerability CVE-2022-41770 (CVSS 6.5, F5 BIG-IP · F5 BIG-IQ)
- [CVE-2022-41743](https://cve.now/CVE-2022-41743.md): NGINX ngx\_http\_hls\_module vulnerability CVE-2022-41743 (CVSS 7.0, F5 NGINX Plus)
- [CVE-2022-41742](https://cve.now/CVE-2022-41742.md): NGINX ngx\_http\_mp4\_module vulnerability CVE-2022-41742 (CVSS 7.1, F5 NGINX)
- [CVE-2022-41741](https://cve.now/CVE-2022-41741.md): NGINX ngx\_http\_mp4\_module vulnerability CVE-2022-41741 (CVSS 7.0, F5 NGINX)
- [CVE-2022-41694](https://cve.now/CVE-2022-41694.md): BIG-IP and BIG-IQ mcpd vulnerability CVE-2022-41694 (CVSS 4.9, F5 BIG-IP · F5 BIG-IQ)
- [CVE-2022-41691](https://cve.now/CVE-2022-41691.md): BIG-IP Advanced WAF/ASM bd vulnerability CVE-2022-41691 (CVSS 7.5, F5 BIG-IP Advanced WAF & ASM)
- [CVE-2022-41624](https://cve.now/CVE-2022-41624.md): BIG-IP iRules vulnerability CVE-2022-41624 (CVSS 7.5, F5 BIG-IP)
- [CVE-2022-41617](https://cve.now/CVE-2022-41617.md): BIG-IP Advanced WAF and ASM iControl REST vulnerability CVE-2022-41617 (CVSS 7.2, F5 BIG-IP Advanced WAF & ASM)
- [CVE-2022-36795](https://cve.now/CVE-2022-36795.md): BIG-IP software SYN cookies vulnerability CVE-2022-36795 (CVSS 5.3, F5 BIG-IP)
- [CVE-2022-38107](https://cve.now/CVE-2022-38107.md): Sensitive Data Disclosure Vulnerability (CVSS 5.3, SolarWinds SQL Sentry)
- [CVE-2022-1523](https://cve.now/CVE-2022-1523.md): Fuji Electric D300win Write-what-where condition (CVSS 6.1, Fuji Electric D300win)
- [CVE-2022-1738](https://cve.now/CVE-2022-1738.md): Fuji Electric D300win Out-of-bounds Read (CVSS 8.7, Fuji Electric D300win)
- [CVE-2013-4253](https://cve.now/CVE-2013-4253.md): The deployment script in the unsupported "OpenShift Extras" set of add-on scripts, in Red Hat Openshift 1, installs a default public key in (CVSS 7.5, Red Hat Openshift)
- [CVE-2013-4281](https://cve.now/CVE-2013-4281.md): In Red Hat Openshift 1, weak default permissions are applied to the /etc/openshift/server\_priv.pem file on the broker server, which could al (CVSS 5.5, Red Hat Openshift)
- [CVE-2016-20016](https://cve.now/CVE-2016-20016.md): MVPower CCTV DVR models, including TV-7104HE 1.8.4 115215B9 and TV7108HE, contain a web shell that is accessible via a /shell URI. (CVSS 9.8)
- [CVE-2016-20017](https://cve.now/CVE-2016-20017.md): D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wil (CVSS 9.8, KEV)
- [CVE-2020-23648](https://cve.now/CVE-2020-23648.md): Asus RT-N12E 2.0.0.39 is affected by an incorrect access control vulnerability. (CVSS 7.5)
- [CVE-2022-1414](https://cve.now/CVE-2022-1414.md): 3scale API Management 2 does not perform adequate sanitation for user input in multiple fields. (CVSS 8.8, 3scale-amp-system)
- [CVE-2022-23241](https://cve.now/CVE-2022-23241.md): Clustered Data ONTAP versions 9.11.1 through 9.11.1P2 with SnapLock configured FlexGroups are susceptible to a vulnerability which could all (CVSS 8.1, Clustered Data ONTAP)
- [CVE-2022-23734](https://cve.now/CVE-2022-23734.md): Deserialization of Untrusted Data vulnerability in GitHub Enterprise Server leading to Remote Code Execution (CVSS 8.8, GitHub Enterprise Server)
- [CVE-2022-25666](https://cve.now/CVE-2022-25666.md): Memory corruption due to use after free in service while trying to access maps by different threads in Snapdragon Auto, Snapdragon Compute, (CVSS 6.7, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2022-25687](https://cve.now/CVE-2022-25687.md): memory corruption in video due to buffer overflow while parsing asf clips in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, S (CVSS 7.3, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2022-25718](https://cve.now/CVE-2022-25718.md): Cryptographic issue in WLAN due to improper check on return value while authentication handshake in Snapdragon Auto, Snapdragon Connectivity (CVSS 9.1, Qualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…)
- [CVE-2022-25719](https://cve.now/CVE-2022-25719.md): Information disclosure in WLAN due to improper length check while processing authentication handshake in Snapdragon Auto, Snapdragon Connect (CVSS 8.2, Qualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…)
- [CVE-2022-25720](https://cve.now/CVE-2022-25720.md): Memory corruption in WLAN due to out of bound array access during connect/roaming in Snapdragon Auto, Snapdragon Compute, Snapdragon Connect (CVSS 9.8, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2022-25736](https://cve.now/CVE-2022-25736.md): Denial of service in WLAN due to out-of-bound read happens while processing VHT action frame in Snapdragon Auto, Snapdragon Compute, Snapdra (CVSS 7.5, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2022-25748](https://cve.now/CVE-2022-25748.md): Memory corruption in WLAN due to integer overflow to buffer overflow while parsing GTK frames. (CVSS 9.8, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2022-25749](https://cve.now/CVE-2022-25749.md): Transient Denial-of-Service in WLAN due to buffer over-read while parsing MDNS frames. (CVSS 7.5, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2022-2805](https://cve.now/CVE-2022-2805.md): A flaw was found in ovirt-engine, which leads to the logging of plaintext passwords in the log file when using otapi-style. (CVSS 6.5, ovirt-engine)
- [CVE-2022-31684](https://cve.now/CVE-2022-31684.md): Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. (CVSS 4.3, Reactor Netty · io.projectreactor.netty:reactor-netty-http)
- [CVE-2022-33077](https://cve.now/CVE-2022-33077.md): An access control issue in nopcommerce v4.50.2 allows attackers to arbitrarily modify any customer's address via the addressedit endpoint. (CVSS 7.5)
- [CVE-2022-3327](https://cve.now/CVE-2022-3327.md): Missing Authentication for Critical Function in ikus060/rdiffweb (CVSS 4.5, ikus060/rdiffweb · rdiffweb)
- [CVE-2022-3586](https://cve.now/CVE-2022-3586.md): A flaw was found in the Linux kernel’s networking code. (CVSS 5.5, Linux Kernel)
- [CVE-2022-35860](https://cve.now/CVE-2022-35860.md): Missing AES encryption in Corsair K63 Wireless 3.1.3 allows physically proximate attackers to inject and sniff keystrokes via 2.4 GHz radio (CVSS 6.8)
- [CVE-2022-3606](https://cve.now/CVE-2022-3606.md): Linux Kernel BPF libbpf.c find\_prog\_by\_sec\_insn null pointer dereference (CVSS 3.5, Linux Kernel)
- [CVE-2022-3607](https://cve.now/CVE-2022-3607.md): Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in octoprint/octoprint (CVSS 6.0, octoprint/octoprint · octoprint)
- [CVE-2022-3608](https://cve.now/CVE-2022-3608.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 7.2, thorsten/phpmyfaq · phpmyfaq/phpmyfaq)
- [CVE-2022-38901](https://cve.now/CVE-2022-38901.md): A Cross-site scripting (XSS) vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platfo (CVSS 5.4)
- [CVE-2022-39233](https://cve.now/CVE-2022-39233.md): Tuleap subject to Missing Authorization allowing for branch prefix modification (CVSS 4.3, Enalean tuleap)
- [CVE-2022-39253](https://cve.now/CVE-2022-39253.md): Git subject to exposure of sensitive information via local clone of symbolic links (CVSS 5.5, git)
- [CVE-2022-39260](https://cve.now/CVE-2022-39260.md): Git vulnerable to Remote Code Execution via Heap overflow in \`git shell\` (CVSS 8.5, git)
- [CVE-2022-39267](https://cve.now/CVE-2022-39267.md): Brokercap Bifrost vulnerable to authentication bypass for admin and monitor user groups (CVSS 8.8, brokercap Bifrost · github.com/brokercap/Bifrost)
- [CVE-2022-39301](https://cve.now/CVE-2022-39301.md): sra-admin is vulnerable to storage cross-site scripting (XSS) via unrestricted file upload (CVSS 8.2, momofoolish sra-admin)
- [CVE-2022-40798](https://cve.now/CVE-2022-40798.md): OcoMon 4.0RC1 is vulnerable to Incorrect Access Control. (CVSS 7.5)
- [CVE-2022-40884](https://cve.now/CVE-2022-40884.md): Bento4 1.6.0 has memory leaks via the mp4fragment. (CVSS 5.5)
- [CVE-2022-40885](https://cve.now/CVE-2022-40885.md): Bento4 v1.6.0-639 has a memory allocation issue that can cause denial of service. (CVSS 5.5)
- [CVE-2022-41415](https://cve.now/CVE-2022-41415.md): Acer Altos W2000h-W570h F4 R01.03.0018 was discovered to contain a stack overflow in the RevserveMem component. (CVSS 9.8)
- [CVE-2022-41707](https://cve.now/CVE-2022-41707.md): Relatedcode's Messenger version 7bcd20b allows an authenticated external attacker to access sensitive data of any user of the application. (CVSS 6.5, relatedcode/Messenger)
- [CVE-2022-41708](https://cve.now/CVE-2022-41708.md): Relatedcode's Messenger version 7bcd20b allows an authenticated external attacker to access existing chats in the workspaces of any user of (CVSS 4.3, relatedcode/Messenger)
- [CVE-2022-41709](https://cve.now/CVE-2022-41709.md): Markdownify version 1.4.1 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdo (CVSS 7.8, Markdownify · electron-markdownify)
- [CVE-2022-42227](https://cve.now/CVE-2022-42227.md): jsonlint 1.0 is vulnerable to heap-buffer-overflow via /home/hjsz/jsonlint/src/lexer. (CVSS 7.5)
- [CVE-2022-42466](https://cve.now/CVE-2022-42466.md): XSS vulnerability, eg for String properties. (CVSS 6.1, Apache Software Foundation Apache Isis · org.apache.isis.co…)
- [CVE-2022-42467](https://cve.now/CVE-2022-42467.md): h2 webconsole (available only in prototype mode) should nevertheless be disabled by default. (CVSS 5.3, Apache Software Foundation Apache Isis · org.apache.isis.co…)
- [CVE-2022-43014](https://cve.now/CVE-2022-43014.md): OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the joborderID parameter. (CVSS 6.1)
- [CVE-2022-43015](https://cve.now/CVE-2022-43015.md): OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the entriesPerPage parameter. (CVSS 6.1)
- [CVE-2022-43016](https://cve.now/CVE-2022-43016.md): OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback component. (CVSS 6.1)
- [CVE-2022-43017](https://cve.now/CVE-2022-43017.md): OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the indexFile component. (CVSS 6.1)
- [CVE-2022-43018](https://cve.now/CVE-2022-43018.md): OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the email parameter in the Check Email fu (CVSS 6.1)
- [CVE-2022-43019](https://cve.now/CVE-2022-43019.md): OpenCATS v0.9.6 was discovered to contain a remote code execution (RCE) vulnerability via the getDataGridPager's ajax functionality. (CVSS 9.8)
- [CVE-2022-43020](https://cve.now/CVE-2022-43020.md): OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the tag\_id variable in the Tag update function. (CVSS 6.5)
- [CVE-2022-43021](https://cve.now/CVE-2022-43021.md): OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the entriesPerPage variable. (CVSS 6.5)
- [CVE-2022-43022](https://cve.now/CVE-2022-43022.md): OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the tag\_id variable in the Tag deletion function. (CVSS 6.5)
- [CVE-2022-43023](https://cve.now/CVE-2022-43023.md): OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function. (CVSS 6.5)
- [CVE-2022-43024](https://cve.now/CVE-2022-43024.md): Tenda TX3 US\_TX3V1.0br\_V16.03.13.11\_multi\_TDE01 was discovered to contain a stack overflow via the list parameter at /goform/SetVirtualServe (CVSS 9.8)
- [CVE-2022-43025](https://cve.now/CVE-2022-43025.md): Tenda TX3 US\_TX3V1.0br\_V16.03.13.11\_multi\_TDE01 was discovered to contain a stack overflow via the startIp parameter at /goform/SetPptpServe (CVSS 9.8)
- [CVE-2022-43026](https://cve.now/CVE-2022-43026.md): Tenda TX3 US\_TX3V1.0br\_V16.03.13.11\_multi\_TDE01 was discovered to contain a stack overflow via the endIp parameter at /goform/SetPptpServerC (CVSS 9.8)
- [CVE-2022-43027](https://cve.now/CVE-2022-43027.md): Tenda TX3 US\_TX3V1.0br\_V16.03.13.11\_multi\_TDE01 was discovered to contain a stack overflow via the firewallEn parameter at /goform/SetFirewa (CVSS 9.8)
- [CVE-2022-43028](https://cve.now/CVE-2022-43028.md): Tenda TX3 US\_TX3V1.0br\_V16.03.13.11\_multi\_TDE01 was discovered to contain a stack overflow via the timeZone parameter at /goform/SetSysTimeC (CVSS 9.8)
- [CVE-2022-43029](https://cve.now/CVE-2022-43029.md): Tenda TX3 US\_TX3V1.0br\_V16.03.13.11\_multi\_TDE01 was discovered to contain a stack overflow via the time parameter at /goform/SetSysTimeCfg. (CVSS 9.8)
- [CVE-2022-43032](https://cve.now/CVE-2022-43032.md): An issue was discovered in Bento4 v1.6.0-639. (CVSS 6.5)
- [CVE-2022-43033](https://cve.now/CVE-2022-43033.md): An issue was discovered in Bento4 1.6.0-639. (CVSS 6.5)
- [CVE-2022-43034](https://cve.now/CVE-2022-43034.md): An issue was discovered in Bento4 v1.6.0-639. (CVSS 6.5)
- [CVE-2022-43035](https://cve.now/CVE-2022-43035.md): An issue was discovered in Bento4 v1.6.0-639. (CVSS 6.5)
- [CVE-2022-43037](https://cve.now/CVE-2022-43037.md): An issue was discovered in Bento4 1.6.0-639. (CVSS 6.5)
- [CVE-2022-43038](https://cve.now/CVE-2022-43038.md): Bento4 v1.6.0-639 was discovered to contain a heap overflow via the AP4\_BitReader::ReadCache() function in mp42ts. (CVSS 6.5)
- [CVE-2022-43039](https://cve.now/CVE-2022-43039.md): GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a segmentation violation via the function gf\_isom\_meta\_restore\_items\_ref at (CVSS 5.5)
- [CVE-2022-43040](https://cve.now/CVE-2022-43040.md): GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a heap buffer overflow via the function gf\_isom\_box\_dump\_start\_ex at /isomed (CVSS 7.8)
- [CVE-2022-43042](https://cve.now/CVE-2022-43042.md): GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a heap buffer overflow via the function FixSDTPInTRAF at isomedia/isom\_inter (CVSS 7.8)
- [CVE-2022-43043](https://cve.now/CVE-2022-43043.md): GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a segmentation violation via the function BD\_CheckSFTimeOffset at /bifs/fiel (CVSS 5.5)
- [CVE-2022-43044](https://cve.now/CVE-2022-43044.md): GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a segmentation violation via the function gf\_isom\_get\_meta\_item\_info at /iso (CVSS 5.5)
- [CVE-2022-43045](https://cve.now/CVE-2022-43045.md): GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a segmentation violation via the function gf\_dump\_vrml\_sffield at /scene\_man (CVSS 5.5)
- [CVE-2022-43184](https://cve.now/CVE-2022-43184.md): D-Link DIR878 1.30B08 Hotfix\_04 was discovered to contain a command injection vulnerability via the component /bin/proc.cgi. (CVSS 9.8)
- [CVE-2022-43185](https://cve.now/CVE-2022-43185.md): A stored cross-site scripting (XSS) vulnerability in the Configuration/Holidays module of Rukovoditel v3.2.1 allows attackers to execute arb (CVSS 5.4)
- [CVE-2022-43401](https://cve.now/CVE-2022-43401.md): A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Script Security Plugin (no CVSS, Jenkins project Jenkins Script Security Plugin · org.jen… +1)
- [CVE-2022-43402](https://cve.now/CVE-2022-43402.md): A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Pipeline: Groovy Plugi (no CVSS, Jenkins project Jenkins Pipeline: Groovy Plugin · org.jenki…)
- [CVE-2022-43403](https://cve.now/CVE-2022-43403.md): A sandbox bypass vulnerability involving casting an array-like value to an array type in Jenkins Script Security Plugin 1183.v774b\_0b\_0a\_a\_4 (no CVSS, Jenkins project Jenkins Script Security Plugin · org.jenkin…)
- [CVE-2022-43404](https://cve.now/CVE-2022-43404.md): A sandbox bypass vulnerability involving crafted constructor bodies and calls to sandbox-generated synthetic constructors in Jenkins Script (no CVSS, Jenkins project Jenkins Script Security Plugin · org.jen… +1)
- [CVE-2022-43405](https://cve.now/CVE-2022-43405.md): A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 612.v84da\_9c54906d and earlier allows attackers with permission (no CVSS, Jenkins project Jenkins Pipeline: Groovy Libraries Plugi… +1)
- [CVE-2022-43406](https://cve.now/CVE-2022-43406.md): A sandbox bypass vulnerability in Jenkins Pipeline: Deprecated Groovy Libraries Plugin 583.vf3b\_454e43966 and earlier allows attackers with (no CVSS, Jenkins project Jenkins Pipeline: Deprecated Groovy Libr… +1)
- [CVE-2022-43407](https://cve.now/CVE-2022-43407.md): Jenkins Pipeline: Input Step Plugin 451.vf1a\_a\_4f405289 and earlier does not restrict or sanitize the optionally specified ID of the 'input' (CVSS 8.8, Jenkins project Jenkins Pipeline: Input Step Plugin · org.j…)
- [CVE-2022-43408](https://cve.now/CVE-2022-43408.md): Jenkins Pipeline: Stage View Plugin 2.26 and earlier does not correctly encode the ID of 'input' steps when using it to generate URLs to pro (CVSS 6.5, Jenkins project Jenkins Pipeline: Stage View Plugin · org.j…)
- [CVE-2022-43409](https://cve.now/CVE-2022-43409.md): Jenkins Pipeline: Supporting APIs Plugin 838.va\_3a\_087b\_4055b and earlier does not sanitize or properly encode URLs of hyperlinks sending PO (CVSS 5.4, Jenkins project Jenkins Pipeline: Supporting APIs Plugin ·…)
- [CVE-2022-43410](https://cve.now/CVE-2022-43410.md): Jenkins Mercurial Plugin 1251.va\_b\_121f184902 and earlier provides information about which jobs were triggered or scheduled for polling thro (CVSS 5.3, Jenkins project Jenkins Mercurial Plugin · org.jenkins-ci.p…)
- [CVE-2022-43411](https://cve.now/CVE-2022-43411.md): Jenkins GitLab Plugin 1.5.35 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhoo (CVSS 5.3, Jenkins project Jenkins GitLab Plugin · org.jenkins-ci.plug…)
- [CVE-2022-43412](https://cve.now/CVE-2022-43412.md): Jenkins Generic Webhook Trigger Plugin 1.84.1 and earlier uses a non-constant time comparison function when checking whether the provided an (CVSS 5.3, Jenkins project Jenkins Generic Webhook Trigger Plugin · or…)
- [CVE-2022-43413](https://cve.now/CVE-2022-43413.md): Jenkins Job Import Plugin 3.5 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read perm (CVSS 4.3, Jenkins project Jenkins Job Import Plugin · org.jenkins-ci.…)
- [CVE-2022-43414](https://cve.now/CVE-2022-43414.md): Jenkins NUnit Plugin 0.27 and earlier implements an agent-to-controller message that parses files inside a user-specified directory as test (CVSS 5.3, Jenkins project Jenkins NUnit Plugin · org.jenkins-ci.plugi…)
- [CVE-2022-43415](https://cve.now/CVE-2022-43415.md): Jenkins REPO Plugin 1.15.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (CVSS 7.5, Jenkins project Jenkins REPO Plugin · org.jenkins-ci.plugin…)
- [CVE-2022-43416](https://cve.now/CVE-2022-43416.md): Jenkins Katalon Plugin 1.0.32 and earlier implements an agent/controller message that does not limit where it can be executed and allows inv (CVSS 8.8, Jenkins project Jenkins Katalon Plugin · org.jenkins-ci.plu…)
- [CVE-2022-43417](https://cve.now/CVE-2022-43417.md): Jenkins Katalon Plugin 1.0.32 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read (CVSS 4.3, Jenkins project Jenkins Katalon Plugin · org.jenkins-ci.plu…)
- [CVE-2022-43418](https://cve.now/CVE-2022-43418.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Katalon Plugin 1.0.33 and earlier allows attackers to connect to an attacker-sp (CVSS 4.3, Jenkins project Jenkins Katalon Plugin · org.jenkins-ci.plu…)
- [CVE-2022-43419](https://cve.now/CVE-2022-43419.md): Jenkins Katalon Plugin 1.0.32 and earlier stores API keys unencrypted in job config.xml files on the Jenkins controller where they can be vi (CVSS 6.5, Jenkins project Jenkins Katalon Plugin · org.jenkins-ci.plu…)
- [CVE-2022-43420](https://cve.now/CVE-2022-43420.md): Jenkins Contrast Continuous Application Security Plugin 3.9 and earlier does not escape data returned from the Contrast service when generat (CVSS 5.4, Jenkins project Jenkins Contrast Continuous Application Sec…)
- [CVE-2022-43421](https://cve.now/CVE-2022-43421.md): A missing permission check in Jenkins Tuleap Git Branch Source Plugin 3.2.4 and earlier allows unauthenticated attackers to trigger Tuleap p (CVSS 5.3, Jenkins project Jenkins Tuleap Git Branch Source Plugin · o…)
- [CVE-2022-43422](https://cve.now/CVE-2022-43422.md): Jenkins Compuware Topaz Utilities Plugin 1.0.8 and earlier implements an agent/controller message that does not limit where it can be execut (CVSS 5.3, Jenkins project Jenkins Compuware Topaz Utilities Plugin ·…)
- [CVE-2022-43423](https://cve.now/CVE-2022-43423.md): Jenkins Compuware Source Code Download for Endevor, PDS, and ISPW Plugin 2.0.12 and earlier implements an agent/controller message that does (CVSS 5.3, Jenkins project Jenkins Compuware Source Code Download for…)
- [CVE-2022-43424](https://cve.now/CVE-2022-43424.md): Jenkins Compuware Xpediter Code Coverage Plugin 1.0.7 and earlier implements an agent/controller message that does not limit where it can be (CVSS 5.3, Jenkins project Jenkins Compuware Xpediter Code Coverage Pl…)
- [CVE-2022-43425](https://cve.now/CVE-2022-43425.md): Jenkins Custom Checkbox Parameter Plugin 1.4 and earlier does not escape the name and description of Custom Checkbox Parameter parameters on (CVSS 5.4, Jenkins project Jenkins Custom Checkbox Parameter Plugin ·…)
- [CVE-2022-43426](https://cve.now/CVE-2022-43426.md): Jenkins S3 Explorer Plugin 1.0.8 and earlier does not mask the AWS\_SECRET\_ACCESS\_KEY form field, increasing the potential for attackers to o (CVSS 5.3, Jenkins project Jenkins S3 Explorer Plugin · io.jenkins.plu…)
- [CVE-2022-43427](https://cve.now/CVE-2022-43427.md): Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not perform permission checks in several HTTP endpoints, allowing attac (CVSS 4.3, Jenkins project Jenkins Compuware Topaz for Total Test Plug…)
- [CVE-2022-43428](https://cve.now/CVE-2022-43428.md): Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be e (CVSS 5.3, Jenkins project Jenkins Compuware Topaz for Total Test Plug…)
- [CVE-2022-43429](https://cve.now/CVE-2022-43429.md): Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be e (CVSS 7.5, Jenkins project Jenkins Compuware Topaz for Total Test Plug…)
- [CVE-2022-43430](https://cve.now/CVE-2022-43430.md): Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attac (CVSS 7.5, Jenkins project Jenkins Compuware Topaz for Total Test Plug…)
- [CVE-2022-43431](https://cve.now/CVE-2022-43431.md): Jenkins Compuware Strobe Measurement Plugin 1.0.1 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers wi (CVSS 4.3, Jenkins project Jenkins Compuware Strobe Measurement Plugin…)
- [CVE-2022-43432](https://cve.now/CVE-2022-43432.md): Jenkins XFramium Builder Plugin 1.0.22 and earlier programmatically disables Content-Security-Policy protection for user-generated content i (CVSS 4.3, Jenkins project Jenkins XFramium Builder Plugin · org.jenki…)
- [CVE-2022-43433](https://cve.now/CVE-2022-43433.md): Jenkins ScreenRecorder Plugin 0.7 and earlier programmatically disables Content-Security-Policy protection for user-generated content in wor (CVSS 4.3, Jenkins project Jenkins ScreenRecorder Plugin · io.jenkins.…)
- [CVE-2022-43434](https://cve.now/CVE-2022-43434.md): Jenkins NeuVector Vulnerability Scanner Plugin 1.20 and earlier programmatically disables Content-Security-Policy protection for user-genera (CVSS 5.3, Jenkins project Jenkins NeuVector Vulnerability Scanner Plu…)
- [CVE-2022-43435](https://cve.now/CVE-2022-43435.md): Jenkins 360 FireLine Plugin 1.7.2 and earlier programmatically disables Content-Security-Policy protection for user-generated content in wor (CVSS 5.3, Jenkins project Jenkins 360 FireLine Plugin · org.jenkins-c…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-10-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.