CVEs published October 25, 2022
122 CVEs were published on October 25, 2022: 31 critical, 44 high. 1 is now in CISA KEV.
- Published
- 122
- Critical
- 31
- High
- 44
- Medium
- 44
- Low
- 0
- Unrated
- 3
- Now in CISA KEV
- 1
- Fix available
- 34
Most affected products
- abode systems iota All-In-One Security Kit
- 38
- Robustel R1510
- 16
- Brocade Fabric OS
- 10
- Esri ArcGIS Server
- 6
- Feather js Feathers-Sequalize · feathers-sequelize
- 3
- openfga · github.com/openfga/openfga
- 3
- Adobe Illustrator
- 2
- Blog2Social: Social Media Auto Post & Scheduler
- 2
- Joomla! Project Joomla! CMS
- 2
- Synology DiskStation Manager
- 2
Critical 31
- CVE-2022-35244A format string injection vulnerability exists in the XCMD getVarHA functionality of abode systems, inc.abode systems iota All-In-One Security Kit
- CVE-2022-34850An OS command injection vulnerability exists in the web_server /action/import_authorized_keys/ functionality of Robustel R1510 3.1.16 and 3.Robustel R1510
- CVE-2022-33207Four OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc.abode systems iota All-In-One Security Kit
- CVE-2022-33206Four OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc.abode systems iota All-In-One Security Kit
- CVE-2022-33205Four OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc.abode systems iota All-In-One Security Kit
- CVE-2022-33204Four OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc.abode systems iota All-In-One Security Kit
- CVE-2022-33195Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc.abode systems iota All-In-One Security Kit
- CVE-2022-33194Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc.abode systems iota All-In-One Security Kit
- CVE-2022-33193Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc.abode systems iota All-In-One Security Kit
- CVE-2022-33192Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc.abode systems iota All-In-One Security Kit
- CVE-2022-33189An OS command injection vulnerability exists in the XCMD setAlexa functionality of Abode Systems, Inc.abode systems iota All-In-One Security Kit
- CVE-2022-33150An OS command injection vulnerability exists in the js_package install functionality of Robustel R1510 3.1.16.Robustel R1510
- CVE-2022-32775An integer overflow vulnerability exists in the web interface /action/ipcamRecordPost functionality of Abode Systems, Inc.abode systems iota All-In-One Security Kit
- CVE-2022-32773An OS command injection vulnerability exists in the XCMD doDebug functionality of Abode Systems, Inc.abode systems iota All-In-One Security Kit
- CVE-2022-32765An OS command injection vulnerability exists in the sysupgrade command injection functionality of Robustel R1510 3.1.16 and 3.3.0.Robustel R1510
- CVE-2022-32454A stack-based buffer overflow vulnerability exists in the XCMD setIPCam functionality of Abode Systems, Inc.abode systems iota All-In-One Security Kit
- CVE-2022-30603An OS command injection vulnerability exists in the web interface /action/iperf functionality of Abode Systems, Inc.abode systems iota All-In-One Security Kit
- CVE-2022-30541An OS command injection vulnerability exists in the XCMD setUPnP functionality of Abode Systems, Inc.abode systems iota All-In-One Security Kit
- CVE-2022-29889A hard-coded password vulnerability exists in the telnet functionality of Abode Systems, Inc.abode systems iota All-In-One Security Kit
- CVE-2022-29472An OS command injection vulnerability exists in the web interface util_set_serial_mac functionality of Abode Systems, Inc.abode systems iota All-In-One Security Kit
- CVE-2022-27805An authentication bypass vulnerability exists in the GHOME control functionality of Abode Systems, Inc.abode systems iota All-In-One Security Kit
- CVE-2022-2421Socket.io - Improper type validation in attachment parsingSocket.io-Parser
- CVE-2022-2422Feathers - SQL injection via attribute aliasesFeather js Feathers-Sequalize · feathers-sequelize
- CVE-2022-29822Feathers - Improper parameter filtering in the Feathers js library, which may ultimately lead to SQL injectionFeather js Feathers-Sequalize · feathers-sequelize
- CVE-2022-29823Feathers - Query “__proto__” is converted to real prototypeFeather js Feathers-Sequalize · feathers-sequelize
- CVE-2022-3393Post to CSV by BestWebSoft <= 1.4.0 - Author+ CSV InjectionPost to CSV by BestWebSoft
- CVE-2022-36452A vulnerability in the web conferencing component of Mitel MiCollab through 9.5.0.101 could allow an unauthenticated attacker to upload mali
- CVE-2022-39312Dataease Mysql Data Source JDBC Connection Parameters Not Verified Leads to Deserialization Vulnerabilitydataease · io.dataease:dataease-plugin-common
- CVE-2022-39322@keystone-6/core vulnerable to field-level access-control bypass for multiselect fieldkeystonejs keystone · @keystone-6/core
- CVE-2022-39345Gin-vue-admin arbitrary file upload vulnerability caused by path traversalflipped-aurora gin-vue-admin · github.com/flipped-aurora/gi…
- CVE-2022-41711Badaso version 2.6.0 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server.Badaso · badaso/core
High 44
- CVE-2022-38435Adobe Illustrator PCX File Parsing Memory Corruption Remote Code Execution VulnerabilityAdobe Illustrator
- CVE-2022-38436Adobe Illustrator CDR File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Illustrator
- CVE-2022-35887Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc.abode systems iota All-In-One Security Kit
- CVE-2022-35886Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc.abode systems iota All-In-One Security Kit
- CVE-2022-35885Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc.abode systems iota All-In-One Security Kit
- CVE-2022-35884Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc.abode systems iota All-In-One Security Kit
- CVE-2022-35881Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc.abode systems iota All-In-One Security Kit
- CVE-2022-35880Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc.abode systems iota All-In-One Security Kit
- CVE-2022-35879Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc.abode systems iota All-In-One Security Kit
- CVE-2022-35878Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc.abode systems iota All-In-One Security Kit
- CVE-2022-35877Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc.abode systems iota All-In-One Security Kit
- CVE-2022-35876Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc.abode systems iota All-In-One Security Kit
- CVE-2022-35875Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc.abode systems iota All-In-One Security Kit
- CVE-2022-35874Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc.abode systems iota All-In-One Security Kit
- CVE-2022-33938A format string injection vulnerability exists in the ghome_process_control_packet functionality of Abode Systems, Inc.abode systems iota All-In-One Security Kit
- CVE-2022-32760A denial of service vulnerability exists in the XCMD doDebug functionality of Abode Systems, Inc.abode systems iota All-In-One Security Kit
- CVE-2022-32586An OS command injection vulnerability exists in the web interface /action/ipcamRecordPost functionality of Abode Systems, Inc.abode systems iota All-In-One Security Kit
- CVE-2022-32574A double-free vulnerability exists in the web interface /action/ipcamSetParamPost functionality of Abode Systems, Inc.abode systems iota All-In-One Security Kit
- CVE-2022-29520An OS command injection vulnerability exists in the console_main_loop :sys functionality of Abode Systems, Inc.abode systems iota All-In-One Security Kit
- CVE-2022-29477An authentication bypass vulnerability exists in the web interface /action/factory* functionality of Abode Systems, Inc.abode systems iota All-In-One Security Kit
- CVE-2022-27804An os command injection vulnerability exists in the web interface util_set_abode_code functionality of Abode Systems, Inc.abode systems iota All-In-One Security Kit
- CVE-2022-27623Missing authentication for critical function vulnerability in iSCSI management functionality in Synology DiskStation Manager (DSM) before 7.Synology DiskStation Manager
- CVE-2022-28169Brocade Webtools in Brocade Fabric OS versions before Brocade Fabric OS versions v9.1.1, v9.0.1e, and v8.2.3c could allow a low privilege weBrocade Fabric OS
- CVE-2022-3246Blog2Social < 6.9.10 - Subscriber+ SQLiBlog2Social: Social Media Auto Post & Scheduler
- CVE-2022-3300Form Maker by 10Web < 1.15.6 - Admin+ SQLIForm Maker by 10Web – Mobile-Friendly Drag & Drop Contact F…
- CVE-2022-3302Anti-Spam by CleanTalk < 5.185.1 - Admin+ SQLiSpam protection, AntiSpam, FireWall by CleanTalk
- CVE-2022-33178A vulnerability in the radius authentication system of Brocade Fabric OS before Brocade Fabric OS 9.0 could allow a remote attacker to execuBrocade Fabric OS
- CVE-2022-33179A vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, and 7.4.2j could allow a local authenticated user Brocade Fabric OS
- CVE-2022-33182A privilege escalation vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5, could allow a locaBrocade Fabric OS
- CVE-2022-33183A vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5, 7.4.2.j could allow a remote authenticaBrocade Fabric OS
- CVE-2022-33184A vulnerability in fab_seg.c.h libraries of all Brocade Fabric OS versions before Brocade Fabric OS v9.1.1, v9.0.1e, v8.2.3c, v8.2.0_cbn5, 7Brocade Fabric OS
- CVE-2022-33185Several commands in Brocade Fabric OS before Brocade Fabric OS v.9.0.1e, and v9.1.0 use unsafe string functions to process user input.Brocade Fabric OS
- CVE-2022-3335Kadence WooCommerce Email Designer < 1.5.7 - Admin+ PHP Objection InjectionKadence WooCommerce Email Designer
- CVE-2022-3394WP All Export Pro < 1.7.9 - Authenticated Code InjectionWP All Export Pro
- CVE-2022-3395WP All Export Pro < 1.7.9 - Authenticated SQLiWP All Export Pro
- CVE-2022-35132Usermin through 1.850 allows a remote authenticated user to execute OS commands via command injection in a filename for the GPG module.
- CVE-2022-36451A vulnerability in the MiCollab Client server component of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to conduct
- CVE-2022-36453A vulnerability in the MiCollab Client API of Mitel MiCollab 9.1.3 through 9.5.0.101 could allow an authenticated attacker to modify their p
- CVE-2022-38181The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled.
- CVE-2022-38870Free5gc v3.2.1 is vulnerable to Information disclosure.
- CVE-2022-39321GitHub Actions Runner vulnerable to Docker Command Escapingactions runner
- CVE-2022-39326kartverket/github-workflows's run-terraform allows for RCE via terraform plankartverket github-workflows
- CVE-2022-39327Improper Control of Generation of Code ('Code Injection') in Azure CLIazure-cli
- CVE-2022-41704Apache Batik prior to 1.16 allows RCE when loading untrusted SVG inputApache Software Foundation Apache XML Graphics · org.apache…
Medium, low and unrated 47
- CVE-2022-27913[20221002] - Core - RXSS through reflection of user input in headingsJoomla! Project Joomla! CMS
- CVE-2022-27912[20221001] - Core - Debug Mode leaks full request payloads including passwordsJoomla! Project Joomla! CMS
- CVE-2022-35271A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0.Robustel R1510
- CVE-2022-35270A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0.Robustel R1510
- CVE-2022-35269A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0.Robustel R1510
- CVE-2022-35268A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0.Robustel R1510
- CVE-2022-35267A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0.Robustel R1510
- CVE-2022-35266A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0.Robustel R1510
- CVE-2022-35265A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0.Robustel R1510
- CVE-2022-35264A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0.Robustel R1510
- CVE-2022-35263A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0.Robustel R1510
- CVE-2022-35262A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0.Robustel R1510
- CVE-2022-35261A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0.Robustel R1510
- CVE-2022-34845A firmware update vulnerability exists in the sysupgrade functionality of Robustel R1510 3.1.16 and 3.3.0.Robustel R1510
- CVE-2022-33897A directory traversal vulnerability exists in the web_server /ajax/remove/ functionality of Robustel R1510 3.1.16.Robustel R1510
- CVE-2022-29475An information disclosure vulnerability exists in the XFINDER functionality of Abode Systems, Inc.abode systems iota All-In-One Security Kit
- CVE-2022-38195BUG-000150540 - Reflected XSS vulnerability in ArcGIS ServerEsri ArcGIS Server
- CVE-2022-38196BUG-000150537 - ArcGIS Server has a local file inclusion (LFI) vulnerabilityEsri ArcGIS Server
- CVE-2022-38197BUG-000148347 Unvalidated redirect issues in ArcGIS Server.Esri ArcGIS Server
- CVE-2022-38198BUG-000146513 - Reflected XSS vulnerability in ArcGIS ServerEsri ArcGIS Server
- CVE-2022-38199BUG-000144172 - Remote file download issue in ArcGIS ServerEsri ArcGIS Server
- CVE-2022-38200BUG-000142376 - Reflected Cross-Site Scripting (XSS) vulnerability in ArcGIS Server.Esri ArcGIS Server
- CVE-2022-27622Server-Side Request Forgery (SSRF) vulnerability in Package Center functionality in Synology DiskStation Manager (DSM) before 7.1-42661 alloSynology DiskStation Manager
- CVE-2022-36783AlgoSec – FireFlow Reflected Cross-Site-Scripting (RXSS)AlgoSec FireFlow A32.0 · AlgoSec FireFlow A32.10 +1
- CVE-2022-2762AdminPad < 2.2 - Note Update via CSRFAdminPad
- CVE-2022-28170Brocade Fabric OS Web Application services before Brocade Fabric v9.1.0, v9.0.1e, v8.2.3c, v7.4.2j store server and user passwords in the deBrocade Fabric OS
- CVE-2022-3097LBStopAttack < 1.1.3 - Arbitrary Settings Update via CSRFPlugin LBstopattack
- CVE-2022-3247Blog2Social < 6.9.10 - Subscriber+ SSRFBlog2Social: Social Media Auto Post & Scheduler
- CVE-2022-33180A vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5 could allow a local authenticated attackBrocade Fabric OS
- CVE-2022-33181An information disclosure vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5, 7.4.2.j could aBrocade Fabric OS
- CVE-2022-3350Contact Bank <= 3.0.30 - Admin+ Stored Cross-Site ScriptingContact Bank – Contact Form Builder for WordPress
- CVE-2022-3391Retain Live Chat <= 0.1 - Admin+ Stored Cross-Site ScriptingRetain Live Chat
- CVE-2022-3392WP Humans.txt <= 1.0.6 - Admin+ Stored Cross-Site ScriptingWP Humans.txt
- CVE-2022-34870Apache Geode stored Cross-Site Scripting (XSS) via data injection vulnerability in Pulse web applicationApache Software Foundation Apache Geode · org.apache.geode:…
- CVE-2022-35739PRTG Network Monitor through 22.2.77.2204 does not prevent custom input for a device’s icon, which can be modified to insert arbitrary conte
- CVE-2022-3644The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write modpulp_ansible · pulp-ansible
- CVE-2022-36454A vulnerability in the MiCollab Client API of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to modify their profile
- CVE-2022-38162Reflected cross-site scripting (XSS) vulnerabilities in WithSecure through 2022-08-10) exists within the F-Secure Policy Manager due to an u
- CVE-2022-39315Kirby CMS vulnerable to user enumeration in the brute force protectiongetkirby kirby · getkirby/cms
- CVE-2022-39340OpenFGA Information Disclosureopenfga · github.com/openfga/openfga
- CVE-2022-39341OpenFGA Authorization Bypassopenfga · github.com/openfga/openfga
- CVE-2022-39342OpenFGA Authorization Bypassopenfga · github.com/openfga/openfga
- CVE-2022-39349Tasks.org vulnerable to data exfiltration by malicous app or adbtasks
- CVE-2022-39350@dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via Vulnerability DetailsDependencyTrack frontend · @dependencytrack/frontend
- CVE-2022-39351Dependency-Track vulnerable to logging of API keys in clear text when handling API requests using keys with insufficient permissionsDependencyTrack dependency-track
- CVE-2022-39354evm has incorrect is_static parameter for custom stateful precompilesrust-blockchain evm · evm
- CVE-2022-42890Apache Batik prior to 1.16 allows RCE via scriptingApache Software Foundation Apache XML Graphics · org.apa… +1