# CVEs published 2022-10-20 34 CVEs were published on October 20, 2022: 6 critical, 14 high. Days are UTC. - [CVE-2022-38108](https://cve.now/CVE-2022-38108.md): SolarWinds Platform Deserialization of Untrusted Data (CVSS 7.2, SolarWinds Platform · SolarWinds Orion Platform) - [CVE-2022-36958](https://cve.now/CVE-2022-36958.md): SolarWinds Platform Deserialization of Untrusted Data (CVSS 8.8, SolarWinds Platform · SolarWinds Orion Platform) - [CVE-2022-36957](https://cve.now/CVE-2022-36957.md): SolarWinds Platform Deserialization of Untrusted Data (CVSS 7.2, SolarWinds Platform · SolarWinds Orion Platform) - [CVE-2022-36966](https://cve.now/CVE-2022-36966.md): Insecure Direct Object Reference Vulnerability: Orion Platform 2020.2.6 (CVSS 5.4, SolarWinds Platform) - [CVE-2022-42344](https://cve.now/CVE-2022-42344.md): \[CVE-2021-36032\] Magento IDOR Leads to Account Takeover (CVSS 8.8, Adobe Commerce · magento/community-edition) - [CVE-2022-3576](https://cve.now/CVE-2022-3576.md): A vulnerability regarding out-of-bounds read is found in the session processing functionality of Out-of-Band (OOB) Management. (CVSS 5.3, Synology DiskStation Manager) - [CVE-2022-27624](https://cve.now/CVE-2022-27624.md): A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the packet decryption function (CVSS 10.0, Synology DiskStation Manager) - [CVE-2022-27625](https://cve.now/CVE-2022-27625.md): A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the message processing functio (CVSS 10.0, Synology DiskStation Manager) - [CVE-2022-27626](https://cve.now/CVE-2022-27626.md): A vulnerability regarding concurrent execution using shared resource with improper synchronization ('Race Condition') is found in the sessio (CVSS 10.0, Synology DiskStation Manager) - [CVE-2020-12744](https://cve.now/CVE-2020-12744.md): The MSI installer in Verint Desktop Resources 15.2 allows an unprivileged local user to elevate their privileges during install or repair. (CVSS 7.8) - [CVE-2020-9285](https://cve.now/CVE-2020-9285.md): Some versions of Sonos One (1st and 2nd generation) allow partial or full memory access via attacker controlled hardware that can be attache (CVSS 6.8) - [CVE-2021-33231](https://cve.now/CVE-2021-33231.md): Cross Site Scripting (XSS) vulnerability in New equipment page in EasyVista Service Manager 2018.1.181.1 allows remote attackers to run arbi (CVSS 5.4) - [CVE-2022-2069](https://cve.now/CVE-2022-2069.md): Datalogics APDFL library Heap-based Buffer Overflow (CVSS 7.8, Siemens JT2Go · Siemens Teamcenter Visualization) - [CVE-2022-26954](https://cve.now/CVE-2022-26954.md): Multiple open redirect vulnerabilities in NopCommerce 4.10 through 4.50.1 allow remote attackers to conduct phishing attacks by redirecting (CVSS 6.1) - [CVE-2022-31366](https://cve.now/CVE-2022-31366.md): An arbitrary file upload vulnerability in the apiImportLabs function in api\_labs.php of EVE-NG 2.0.3-112 Community allows attackers to execu (CVSS 7.2) - [CVE-2022-3577](https://cve.now/CVE-2022-3577.md): An out-of-bounds memory write flaw was found in the Linux kernel’s Kid-friendly Wired Controller driver. (CVSS 7.8, Kernel) - [CVE-2022-3619](https://cve.now/CVE-2022-3619.md): Linux Kernel Bluetooth l2cap\_core.c l2cap\_recv\_acldata memory leak (CVSS 3.5, Linux Kernel) - [CVE-2022-3620](https://cve.now/CVE-2022-3620.md): Exim DMARC dmarc.c dmarc\_dns\_lookup use after free (CVSS 5.6, Exim) - [CVE-2022-3621](https://cve.now/CVE-2022-3621.md): Linux Kernel nilfs2 inode.c nilfs\_bmap\_lookup\_at\_level null pointer dereference (CVSS 4.3, Linux Kernel) - [CVE-2022-3623](https://cve.now/CVE-2022-3623.md): Linux Kernel BPF gup.c follow\_page\_pte race condition (CVSS 5.0, Linux Kernel) - [CVE-2022-37298](https://cve.now/CVE-2022-37298.md): Shinken Solutions Shinken Monitoring Version 2.4.3 affected is vulnerable to Incorrect Access Control. (CVSS 9.8, shinken) - [CVE-2022-37453](https://cve.now/CVE-2022-37453.md): An issue was discovered in Softing OPC UA C++ SDK before 6.10. (CVSS 7.5) - [CVE-2022-37598](https://cve.now/CVE-2022-37598.md): Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js. (no CVSS) - [CVE-2022-39823](https://cve.now/CVE-2022-39823.md): An issue was discovered in Softing OPC UA C++ SDK 5.66 through 6.x before 6.10. (CVSS 7.5) - [CVE-2022-40084](https://cve.now/CVE-2022-40084.md): OpenCRX before v5.2.2 was discovered to be vulnerable to password enumeration due to the difference in error messages received during a pass (CVSS 5.3, org.opencrx:opencrx-client) - [CVE-2022-41358](https://cve.now/CVE-2022-41358.md): A stored cross-site scripting (XSS) vulnerability in Garage Management System v1.0 allows attackers to execute arbitrary web scripts or HTML (CVSS 5.4) - [CVE-2022-42021](https://cve.now/CVE-2022-42021.md): Best Student Result Management System v1.0 is vulnerable to SQL Injection via /upresult/upresult/notice-details.php?nid=. (CVSS 9.8) - [CVE-2022-42176](https://cve.now/CVE-2022-42176.md): In PCTechSoft PCSecure V5.0.8.xw, use of Hard-coded Credentials in configuration files leads to admin panel access. (CVSS 7.8) - [CVE-2022-42197](https://cve.now/CVE-2022-42197.md): In Simple Exam Reviewer Management System v1.0 the User List function has improper access control that allows low privileged users to modify (CVSS 6.5) - [CVE-2022-42198](https://cve.now/CVE-2022-42198.md): In Simple Exam Reviewer Management System v1.0 the User List function suffers from insecure file upload. (CVSS 8.8) - [CVE-2022-42199](https://cve.now/CVE-2022-42199.md): Simple Exam Reviewer Management System v1.0 is vulnerable to Cross Site Request Forgery (CSRF) via the Exam List. (CVSS 8.8) - [CVE-2022-42200](https://cve.now/CVE-2022-42200.md): Simple Exam Reviewer Management System v1.0 is vulnerable to Stored Cross Site Scripting (XSS) via the Exam List. (CVSS 5.4) - [CVE-2022-42201](https://cve.now/CVE-2022-42201.md): Simple Exam Reviewer Management System v1.0 is vulnerable to Insecure file upload. (CVSS 7.2) - [CVE-2022-42233](https://cve.now/CVE-2022-42233.md): Tenda 11N with firmware version V5.07.33\_cn suffers from an Authentication Bypass vulnerability. (CVSS 9.8) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2022-10-20 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.