CVEs published October 20, 2022
34 CVEs were published on October 20, 2022: 6 critical, 14 high.
- Published
- 34
- Critical
- 6
- High
- 14
- Medium
- 12
- Low
- 1
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 8
Most affected products
- Synology DiskStation Manager
- 4
- Linux Kernel
- 3
- SolarWinds Platform · SolarWinds Orion Platform
- 3
- Adobe Commerce · magento/community-edition
- 1
- Exim
- 1
- Kernel
- 1
- org.opencrx:opencrx-client
- 1
- shinken
- 1
- Siemens JT2Go · Siemens Teamcenter Visualization
- 1
- SolarWinds Platform
- 1
Critical 6
- CVE-2022-27624A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the packet decryption functionSynology DiskStation Manager
- CVE-2022-27625A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the message processing functioSynology DiskStation Manager
- CVE-2022-27626A vulnerability regarding concurrent execution using shared resource with improper synchronization ('Race Condition') is found in the sessioSynology DiskStation Manager
- CVE-2022-37298Shinken Solutions Shinken Monitoring Version 2.4.3 affected is vulnerable to Incorrect Access Control.shinken
- CVE-2022-42021Best Student Result Management System v1.0 is vulnerable to SQL Injection via /upresult/upresult/notice-details.php?nid=.
- CVE-2022-42233Tenda 11N with firmware version V5.07.33_cn suffers from an Authentication Bypass vulnerability.
High 14
- CVE-2022-38108SolarWinds Platform Deserialization of Untrusted DataSolarWinds Platform · SolarWinds Orion Platform
- CVE-2022-36958SolarWinds Platform Deserialization of Untrusted DataSolarWinds Platform · SolarWinds Orion Platform
- CVE-2022-36957SolarWinds Platform Deserialization of Untrusted DataSolarWinds Platform · SolarWinds Orion Platform
- CVE-2022-42344[CVE-2021-36032] Magento IDOR Leads to Account TakeoverAdobe Commerce · magento/community-edition
- CVE-2020-12744The MSI installer in Verint Desktop Resources 15.2 allows an unprivileged local user to elevate their privileges during install or repair.
- CVE-2022-2069 Datalogics APDFL library Heap-based Buffer OverflowSiemens JT2Go · Siemens Teamcenter Visualization
- CVE-2022-31366An arbitrary file upload vulnerability in the apiImportLabs function in api_labs.php of EVE-NG 2.0.3-112 Community allows attackers to execu
- CVE-2022-3577An out-of-bounds memory write flaw was found in the Linux kernel’s Kid-friendly Wired Controller driver.Kernel
- CVE-2022-37453An issue was discovered in Softing OPC UA C++ SDK before 6.10.
- CVE-2022-39823An issue was discovered in Softing OPC UA C++ SDK 5.66 through 6.x before 6.10.
- CVE-2022-42176In PCTechSoft PCSecure V5.0.8.xw, use of Hard-coded Credentials in configuration files leads to admin panel access.
- CVE-2022-42198In Simple Exam Reviewer Management System v1.0 the User List function suffers from insecure file upload.
- CVE-2022-42199Simple Exam Reviewer Management System v1.0 is vulnerable to Cross Site Request Forgery (CSRF) via the Exam List.
- CVE-2022-42201Simple Exam Reviewer Management System v1.0 is vulnerable to Insecure file upload.
Medium, low and unrated 14
- CVE-2022-36966Insecure Direct Object Reference Vulnerability: Orion Platform 2020.2.6SolarWinds Platform
- CVE-2022-3576A vulnerability regarding out-of-bounds read is found in the session processing functionality of Out-of-Band (OOB) Management.Synology DiskStation Manager
- CVE-2020-9285Some versions of Sonos One (1st and 2nd generation) allow partial or full memory access via attacker controlled hardware that can be attache
- CVE-2021-33231Cross Site Scripting (XSS) vulnerability in New equipment page in EasyVista Service Manager 2018.1.181.1 allows remote attackers to run arbi
- CVE-2022-26954Multiple open redirect vulnerabilities in NopCommerce 4.10 through 4.50.1 allow remote attackers to conduct phishing attacks by redirecting
- CVE-2022-3619Linux Kernel Bluetooth l2cap_core.c l2cap_recv_acldata memory leakLinux Kernel
- CVE-2022-3620Exim DMARC dmarc.c dmarc_dns_lookup use after freeExim
- CVE-2022-3621Linux Kernel nilfs2 inode.c nilfs_bmap_lookup_at_level null pointer dereferenceLinux Kernel
- CVE-2022-3623Linux Kernel BPF gup.c follow_page_pte race conditionLinux Kernel
- CVE-2022-37598Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js.
- CVE-2022-40084OpenCRX before v5.2.2 was discovered to be vulnerable to password enumeration due to the difference in error messages received during a passorg.opencrx:opencrx-client
- CVE-2022-41358A stored cross-site scripting (XSS) vulnerability in Garage Management System v1.0 allows attackers to execute arbitrary web scripts or HTML
- CVE-2022-42197In Simple Exam Reviewer Management System v1.0 the User List function has improper access control that allows low privileged users to modify
- CVE-2022-42200Simple Exam Reviewer Management System v1.0 is vulnerable to Stored Cross Site Scripting (XSS) via the Exam List.