# CVEs published 2022-10-21

59 CVEs were published on October 21, 2022: 3 critical, 25 high. Days are UTC.

- [CVE-2022-34439](https://cve.now/CVE-2022-34439.md): Dell PowerScale OneFS, versions 8.2.0.x-9.4.0.x contain allocation of Resources Without Limits or Throttling vulnerability. (CVSS 5.3, Dell PowerScale OneFS)
- [CVE-2022-34438](https://cve.now/CVE-2022-34438.md): Dell PowerScale OneFS, versions 8.2.x-9.4.0.x, contain a privilege context switching error. (CVSS 6.7, Dell PowerScale OneFS)
- [CVE-2022-34437](https://cve.now/CVE-2022-34437.md): Dell PowerScale OneFS, versions 8.2.2-9.3.0, contain an OS command injection vulnerability. (CVSS 6.7, Dell PowerScale OneFS)
- [CVE-2022-31239](https://cve.now/CVE-2022-31239.md): Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.19, 9.2.1.12, and 9.3.0.6, contain sensitive data in log files vulnerability (CVSS 6.7, Dell PowerScale OneFS)
- [CVE-2022-26870](https://cve.now/CVE-2022-26870.md): Dell PowerStore versions 2.1.0.x contain an Authentication bypass vulnerability. (CVSS 7.0, Dell PowerStore)
- [CVE-2020-5355](https://cve.now/CVE-2020-5355.md): The Dell Isilon OneFS versions 8.2.2 and earlier SSHD process improperly allows Transmission Control Protocol (TCP) and stream forwarding. (CVSS 4.3, Dell Isilon OneFS)
- [CVE-2022-27494](https://cve.now/CVE-2022-27494.md): CROSS-SITE SCRIPTING CWE-79 (CVSS 8.2, Aethon TUG Home Base Server)
- [CVE-2022-1070](https://cve.now/CVE-2022-1070.md): CHANNEL ACCESSIBLE BY NON-ENDPOINT CWE-300 (CVSS 8.2, Aethon TUG Home Base Server)
- [CVE-2022-1059](https://cve.now/CVE-2022-1059.md): CROSS-SITE SCRIPTING CWE-79 (CVSS 8.2, Aethon TUG Home Base Server)
- [CVE-2022-26423](https://cve.now/CVE-2022-26423.md): MISSING AUTHORIZATION CWE-862 (CVSS 8.2, Aethon TUG Home Base Server)
- [CVE-2022-1066](https://cve.now/CVE-2022-1066.md): MISSING AUTHORIZATION CWE-862 (CVSS 8.2, Aethon TUG Home Base Server)
- [CVE-2022-38104](https://cve.now/CVE-2022-38104.md): WordPress Accordions plugin \<= 2.0.3 - Auth. WordPress Options Change vulnerability (CVSS 7.2, Biplob Adhikari Accordions – Multiple Accordions or FAQs Bu…)
- [CVE-2022-40311](https://cve.now/CVE-2022-40311.md): WordPress Analytics Cat plugin \<= 1.0.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, Fatcat Apps Analytics Cat – Google Analytics Made Easy)
- [CVE-2022-41638](https://cve.now/CVE-2022-41638.md): WordPress Pop-Up Chop Chop plugin \<= 2.1.7 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (CVSS 5.4, Chop-Chop Pop-Up Chop Chop)
- [CVE-2022-3203](https://cve.now/CVE-2022-3203.md): ORing net IAP-420(+) Hidden Functionality (CVSS 9.8, ORing IAP-420)
- [CVE-2021-42553](https://cve.now/CVE-2021-42553.md): STM32 USB Host Library Buffer Overflow (CVSS 6.8, STMicroelectronics STM32Cube STM32 USB Host Library)
- [CVE-2022-23462](https://cve.now/CVE-2022-23462.md): Stack Buffer Overflow in iowow (CVSS 6.2, Softmotions iowow)
- [CVE-2022-3570](https://cve.now/CVE-2022-3570.md): Multiple heap buffer overflows in tiffcrop.c utility in libtiff library Version 4.4.0 allows attacker to trigger unsafe or out of bounds mem (CVSS 7.7, libtiff)
- [CVE-2022-3597](https://cve.now/CVE-2022-3597.md): LibTIFF 4.4.0 has an out-of-bounds write in \_TIFFmemcpy in libtiff/tif\_unix.c:346 when called from extractImageSection, tools/tiffcrop.c:682 (CVSS 5.5, libtiff)
- [CVE-2022-3598](https://cve.now/CVE-2022-3598.md): LibTIFF 4.4.0 has an out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c:3604, allowing attackers to cause a denial (CVSS 5.5, libtiff)
- [CVE-2022-3599](https://cve.now/CVE-2022-3599.md): LibTIFF 4.4.0 has an out-of-bounds read in writeSingleSection in tools/tiffcrop.c:7345, allowing attackers to cause a denial-of-service via (CVSS 5.5, libtiff)
- [CVE-2022-36122](https://cve.now/CVE-2022-36122.md): The Automox Agent before 40 on Windows incorrectly sets permissions on key files. (CVSS 7.8)
- [CVE-2022-3624](https://cve.now/CVE-2022-3624.md): Linux Kernel IPsec bond\_alb.c rlb\_arp\_xmit memory leak (CVSS 3.5, Linux Kernel)
- [CVE-2022-3625](https://cve.now/CVE-2022-3625.md): Linux Kernel IPsec devlink.c devlink\_param\_get use after free (CVSS 4.6, Linux Kernel)
- [CVE-2022-3626](https://cve.now/CVE-2022-3626.md): LibTIFF 4.4.0 has an out-of-bounds write in \_TIFFmemset in libtiff/tif\_unix.c:340 when called from processCropSelections, tools/tiffcrop.c:7 (CVSS 5.5, libtiff)
- [CVE-2022-3627](https://cve.now/CVE-2022-3627.md): LibTIFF 4.4.0 has an out-of-bounds write in \_TIFFmemcpy in libtiff/tif\_unix.c:346 when called from extractImageSection, tools/tiffcrop.c:686 (CVSS 5.5, libtiff)
- [CVE-2022-3629](https://cve.now/CVE-2022-3629.md): Linux Kernel af\_vsock.c vsock\_connect memory leak (CVSS 2.6, Linux Kernel)
- [CVE-2022-3630](https://cve.now/CVE-2022-3630.md): Linux Kernel IPsec cookie.c memory leak (CVSS 3.1, Linux Kernel)
- [CVE-2022-3633](https://cve.now/CVE-2022-3633.md): Linux Kernel transport.c j1939\_session\_destroy memory leak (CVSS 3.5, Linux Kernel)
- [CVE-2022-3635](https://cve.now/CVE-2022-3635.md): Linux Kernel IPsec idt77252.c tst\_timer use after free (CVSS 5.5, Linux Kernel)
- [CVE-2022-3636](https://cve.now/CVE-2022-3636.md): Linux Kernel Ethernet mtk\_ppe.c \_\_mtk\_ppe\_check\_skb use after free (CVSS 5.1, Linux Kernel)
- [CVE-2022-3637](https://cve.now/CVE-2022-3637.md): Linux Kernel BlueZ jlink.c jlink\_init denial of service (CVSS 2.6, Linux Kernel)
- [CVE-2022-3639](https://cve.now/CVE-2022-3639.md): A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions from 10.8 before 15.1.6, all versions starting from 15.2 (CVSS 4.3, GitLab)
- [CVE-2022-3640](https://cve.now/CVE-2022-3640.md): Linux Kernel Bluetooth l2cap\_core.c l2cap\_conn\_del use after free (CVSS 5.5, Linux Kernel)
- [CVE-2022-3646](https://cve.now/CVE-2022-3646.md): Linux Kernel BPF segment.c nilfs\_attach\_log\_writer memory leak (CVSS 3.1, Linux Kernel)
- [CVE-2022-3647](https://cve.now/CVE-2022-3647.md): Redis Crash Report debug.c sigsegvHandler denial of service (CVSS 3.1, Redis)
- [CVE-2022-3649](https://cve.now/CVE-2022-3649.md): Linux Kernel BPF inode.c nilfs\_new\_inode use after free (CVSS 3.1, Linux Kernel)
- [CVE-2022-37454](https://cve.now/CVE-2022-37454.md): The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to (CVSS 9.8, libphp · libpython +6)
- [CVE-2022-39259](https://cve.now/CVE-2022-39259.md): Jadx-gui subject to Denial of Service via Swing HTML rendering (CVSS 3.3, skylot jadx · io.github.skylot:jadx-plugins-api)
- [CVE-2022-39272](https://cve.now/CVE-2022-39272.md): Flux2 vulnerable to Denial of Service due to Improper use of metav1.Duration (CVSS 5.0, fluxcd flux2 · github.com/fluxcd/helm-controller/api +12)
- [CVE-2022-41309](https://cve.now/CVE-2022-41309.md): A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by wr (CVSS 7.8, Autodesk Design Review)
- [CVE-2022-41310](https://cve.now/CVE-2022-41310.md): A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by wr (CVSS 7.8, Autodesk Design Review)
- [CVE-2022-41575](https://cve.now/CVE-2022-41575.md): A credential-exposure vulnerability in the support-bundle mechanism in Gradle Enterprise 2022.3 through 2022.3.3 allows remote attackers to (CVSS 7.5)
- [CVE-2022-42189](https://cve.now/CVE-2022-42189.md): Emlog Pro 1.6.0 plugins upload suffers from a remote code execution (RCE) vulnerability. (CVSS 7.2)
- [CVE-2022-42205](https://cve.now/CVE-2022-42205.md): PHPGurukul Hospital Management System In PHP V 4.0 is vulnerable to Cross Site Scripting (XSS) via add-patient.php. (CVSS 5.4)
- [CVE-2022-42206](https://cve.now/CVE-2022-42206.md): PHPGurukul Hospital Management System In PHP V 4.0 is vulnerable to Cross Site Scripting (XSS) via doctor/view-patient.php, admin/view-patie (CVSS 5.4)
- [CVE-2022-42933](https://cve.now/CVE-2022-42933.md): A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by wr (CVSS 7.8, Autodesk Design Review)
- [CVE-2022-42934](https://cve.now/CVE-2022-42934.md): A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by wr (CVSS 7.8, Autodesk Design Review)
- [CVE-2022-42935](https://cve.now/CVE-2022-42935.md): A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by wr (CVSS 7.8, Autodesk Design Review)
- [CVE-2022-42936](https://cve.now/CVE-2022-42936.md): A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by wr (CVSS 7.8, Autodesk Design Review)
- [CVE-2022-42937](https://cve.now/CVE-2022-42937.md): A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by wr (CVSS 7.8, Autodesk Design Review)
- [CVE-2022-42938](https://cve.now/CVE-2022-42938.md): A malicious crafted TGA file when consumed through DesignReview.exe application could lead to memory corruption vulnerability. (CVSS 7.8, Autodesk Design Review)
- [CVE-2022-42939](https://cve.now/CVE-2022-42939.md): A malicious crafted TGA file when consumed through DesignReview.exe application could lead to memory corruption vulnerability. (CVSS 7.8, Autodesk Design Review)
- [CVE-2022-42940](https://cve.now/CVE-2022-42940.md): A malicious crafted TGA file when consumed through DesignReview.exe application could lead to memory corruption vulnerability. (CVSS 7.8, Autodesk Design Review)
- [CVE-2022-42941](https://cve.now/CVE-2022-42941.md): A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by rea (CVSS 7.8, Autodesk Design Review)
- [CVE-2022-42942](https://cve.now/CVE-2022-42942.md): A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by rea (CVSS 7.8, Autodesk Design Review)
- [CVE-2022-42943](https://cve.now/CVE-2022-42943.md): A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by rea (CVSS 7.8, Autodesk Design Review)
- [CVE-2022-42944](https://cve.now/CVE-2022-42944.md): A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by rea (CVSS 7.8, Autodesk Design Review)
- [CVE-2022-43400](https://cve.now/CVE-2022-43400.md): A vulnerability has been identified in Siveillance Video Mobile Server V2022 R2 (All versions \< V22.2a (80)). (CVSS 9.8, Siemens Siveillance Video Mobile Server V2022 R2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-10-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.