# CVEs published 2022-10-25

122 CVEs were published on October 25, 2022: 31 critical, 44 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2022-27913](https://cve.now/CVE-2022-27913.md): \[20221002\] - Core - RXSS through reflection of user input in headings (no CVSS, Joomla! Project Joomla! CMS)
- [CVE-2022-27912](https://cve.now/CVE-2022-27912.md): \[20221001\] - Core - Debug Mode leaks full request payloads including passwords (no CVSS, Joomla! Project Joomla! CMS)
- [CVE-2022-38435](https://cve.now/CVE-2022-38435.md): Adobe Illustrator PCX File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, Adobe Illustrator)
- [CVE-2022-38436](https://cve.now/CVE-2022-38436.md): Adobe Illustrator CDR File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Illustrator)
- [CVE-2022-35887](https://cve.now/CVE-2022-35887.md): Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. (CVSS 8.2, abode systems iota All-In-One Security Kit)
- [CVE-2022-35886](https://cve.now/CVE-2022-35886.md): Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. (CVSS 8.2, abode systems iota All-In-One Security Kit)
- [CVE-2022-35885](https://cve.now/CVE-2022-35885.md): Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. (CVSS 8.2, abode systems iota All-In-One Security Kit)
- [CVE-2022-35884](https://cve.now/CVE-2022-35884.md): Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. (CVSS 8.2, abode systems iota All-In-One Security Kit)
- [CVE-2022-35881](https://cve.now/CVE-2022-35881.md): Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. (CVSS 7.1, abode systems iota All-In-One Security Kit)
- [CVE-2022-35880](https://cve.now/CVE-2022-35880.md): Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. (CVSS 7.1, abode systems iota All-In-One Security Kit)
- [CVE-2022-35879](https://cve.now/CVE-2022-35879.md): Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. (CVSS 7.1, abode systems iota All-In-One Security Kit)
- [CVE-2022-35878](https://cve.now/CVE-2022-35878.md): Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. (CVSS 7.1, abode systems iota All-In-One Security Kit)
- [CVE-2022-35877](https://cve.now/CVE-2022-35877.md): Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. (CVSS 8.2, abode systems iota All-In-One Security Kit)
- [CVE-2022-35876](https://cve.now/CVE-2022-35876.md): Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. (CVSS 8.2, abode systems iota All-In-One Security Kit)
- [CVE-2022-35875](https://cve.now/CVE-2022-35875.md): Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. (CVSS 8.2, abode systems iota All-In-One Security Kit)
- [CVE-2022-35874](https://cve.now/CVE-2022-35874.md): Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. (CVSS 8.2, abode systems iota All-In-One Security Kit)
- [CVE-2022-35271](https://cve.now/CVE-2022-35271.md): A denial of service vulnerability exists in the web\_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. (CVSS 4.9, Robustel R1510)
- [CVE-2022-35270](https://cve.now/CVE-2022-35270.md): A denial of service vulnerability exists in the web\_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. (CVSS 4.9, Robustel R1510)
- [CVE-2022-35269](https://cve.now/CVE-2022-35269.md): A denial of service vulnerability exists in the web\_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. (CVSS 4.9, Robustel R1510)
- [CVE-2022-35268](https://cve.now/CVE-2022-35268.md): A denial of service vulnerability exists in the web\_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. (CVSS 4.9, Robustel R1510)
- [CVE-2022-35267](https://cve.now/CVE-2022-35267.md): A denial of service vulnerability exists in the web\_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. (CVSS 4.9, Robustel R1510)
- [CVE-2022-35266](https://cve.now/CVE-2022-35266.md): A denial of service vulnerability exists in the web\_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. (CVSS 4.9, Robustel R1510)
- [CVE-2022-35265](https://cve.now/CVE-2022-35265.md): A denial of service vulnerability exists in the web\_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. (CVSS 4.9, Robustel R1510)
- [CVE-2022-35264](https://cve.now/CVE-2022-35264.md): A denial of service vulnerability exists in the web\_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. (CVSS 4.9, Robustel R1510)
- [CVE-2022-35263](https://cve.now/CVE-2022-35263.md): A denial of service vulnerability exists in the web\_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. (CVSS 4.9, Robustel R1510)
- [CVE-2022-35262](https://cve.now/CVE-2022-35262.md): A denial of service vulnerability exists in the web\_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. (CVSS 4.9, Robustel R1510)
- [CVE-2022-35261](https://cve.now/CVE-2022-35261.md): A denial of service vulnerability exists in the web\_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. (CVSS 4.9, Robustel R1510)
- [CVE-2022-35244](https://cve.now/CVE-2022-35244.md): A format string injection vulnerability exists in the XCMD getVarHA functionality of abode systems, inc. (CVSS 9.8, abode systems iota All-In-One Security Kit)
- [CVE-2022-34850](https://cve.now/CVE-2022-34850.md): An OS command injection vulnerability exists in the web\_server /action/import\_authorized\_keys/ functionality of Robustel R1510 3.1.16 and 3. (CVSS 9.1, Robustel R1510)
- [CVE-2022-34845](https://cve.now/CVE-2022-34845.md): A firmware update vulnerability exists in the sysupgrade functionality of Robustel R1510 3.1.16 and 3.3.0. (CVSS 6.7, Robustel R1510)
- [CVE-2022-33938](https://cve.now/CVE-2022-33938.md): A format string injection vulnerability exists in the ghome\_process\_control\_packet functionality of Abode Systems, Inc. (CVSS 8.2, abode systems iota All-In-One Security Kit)
- [CVE-2022-33897](https://cve.now/CVE-2022-33897.md): A directory traversal vulnerability exists in the web\_server /ajax/remove/ functionality of Robustel R1510 3.1.16. (CVSS 4.9, Robustel R1510)
- [CVE-2022-33207](https://cve.now/CVE-2022-33207.md): Four OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. (CVSS 10.0, abode systems iota All-In-One Security Kit)
- [CVE-2022-33206](https://cve.now/CVE-2022-33206.md): Four OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. (CVSS 10.0, abode systems iota All-In-One Security Kit)
- [CVE-2022-33205](https://cve.now/CVE-2022-33205.md): Four OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. (CVSS 10.0, abode systems iota All-In-One Security Kit)
- [CVE-2022-33204](https://cve.now/CVE-2022-33204.md): Four OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. (CVSS 10.0, abode systems iota All-In-One Security Kit)
- [CVE-2022-33195](https://cve.now/CVE-2022-33195.md): Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. (CVSS 10.0, abode systems iota All-In-One Security Kit)
- [CVE-2022-33194](https://cve.now/CVE-2022-33194.md): Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. (CVSS 10.0, abode systems iota All-In-One Security Kit)
- [CVE-2022-33193](https://cve.now/CVE-2022-33193.md): Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. (CVSS 10.0, abode systems iota All-In-One Security Kit)
- [CVE-2022-33192](https://cve.now/CVE-2022-33192.md): Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. (CVSS 10.0, abode systems iota All-In-One Security Kit)
- [CVE-2022-33189](https://cve.now/CVE-2022-33189.md): An OS command injection vulnerability exists in the XCMD setAlexa functionality of Abode Systems, Inc. (CVSS 10.0, abode systems iota All-In-One Security Kit)
- [CVE-2022-33150](https://cve.now/CVE-2022-33150.md): An OS command injection vulnerability exists in the js\_package install functionality of Robustel R1510 3.1.16. (CVSS 9.1, Robustel R1510)
- [CVE-2022-32775](https://cve.now/CVE-2022-32775.md): An integer overflow vulnerability exists in the web interface /action/ipcamRecordPost functionality of Abode Systems, Inc. (CVSS 9.0, abode systems iota All-In-One Security Kit)
- [CVE-2022-32773](https://cve.now/CVE-2022-32773.md): An OS command injection vulnerability exists in the XCMD doDebug functionality of Abode Systems, Inc. (CVSS 10.0, abode systems iota All-In-One Security Kit)
- [CVE-2022-32765](https://cve.now/CVE-2022-32765.md): An OS command injection vulnerability exists in the sysupgrade command injection functionality of Robustel R1510 3.1.16 and 3.3.0. (CVSS 9.1, Robustel R1510)
- [CVE-2022-32760](https://cve.now/CVE-2022-32760.md): A denial of service vulnerability exists in the XCMD doDebug functionality of Abode Systems, Inc. (CVSS 8.6, abode systems iota All-In-One Security Kit)
- [CVE-2022-32586](https://cve.now/CVE-2022-32586.md): An OS command injection vulnerability exists in the web interface /action/ipcamRecordPost functionality of Abode Systems, Inc. (CVSS 8.0, abode systems iota All-In-One Security Kit)
- [CVE-2022-32574](https://cve.now/CVE-2022-32574.md): A double-free vulnerability exists in the web interface /action/ipcamSetParamPost functionality of Abode Systems, Inc. (CVSS 7.5, abode systems iota All-In-One Security Kit)
- [CVE-2022-32454](https://cve.now/CVE-2022-32454.md): A stack-based buffer overflow vulnerability exists in the XCMD setIPCam functionality of Abode Systems, Inc. (CVSS 10.0, abode systems iota All-In-One Security Kit)
- [CVE-2022-30603](https://cve.now/CVE-2022-30603.md): An OS command injection vulnerability exists in the web interface /action/iperf functionality of Abode Systems, Inc. (CVSS 10.0, abode systems iota All-In-One Security Kit)
- [CVE-2022-30541](https://cve.now/CVE-2022-30541.md): An OS command injection vulnerability exists in the XCMD setUPnP functionality of Abode Systems, Inc. (CVSS 10.0, abode systems iota All-In-One Security Kit)
- [CVE-2022-29889](https://cve.now/CVE-2022-29889.md): A hard-coded password vulnerability exists in the telnet functionality of Abode Systems, Inc. (CVSS 9.8, abode systems iota All-In-One Security Kit)
- [CVE-2022-29520](https://cve.now/CVE-2022-29520.md): An OS command injection vulnerability exists in the console\_main\_loop :sys functionality of Abode Systems, Inc. (CVSS 8.1, abode systems iota All-In-One Security Kit)
- [CVE-2022-29477](https://cve.now/CVE-2022-29477.md): An authentication bypass vulnerability exists in the web interface /action/factory\* functionality of Abode Systems, Inc. (CVSS 8.6, abode systems iota All-In-One Security Kit)
- [CVE-2022-29475](https://cve.now/CVE-2022-29475.md): An information disclosure vulnerability exists in the XFINDER functionality of Abode Systems, Inc. (CVSS 4.7, abode systems iota All-In-One Security Kit)
- [CVE-2022-29472](https://cve.now/CVE-2022-29472.md): An OS command injection vulnerability exists in the web interface util\_set\_serial\_mac functionality of Abode Systems, Inc. (CVSS 10.0, abode systems iota All-In-One Security Kit)
- [CVE-2022-27805](https://cve.now/CVE-2022-27805.md): An authentication bypass vulnerability exists in the GHOME control functionality of Abode Systems, Inc. (CVSS 9.8, abode systems iota All-In-One Security Kit)
- [CVE-2022-27804](https://cve.now/CVE-2022-27804.md): An os command injection vulnerability exists in the web interface util\_set\_abode\_code functionality of Abode Systems, Inc. (CVSS 8.0, abode systems iota All-In-One Security Kit)
- [CVE-2022-38195](https://cve.now/CVE-2022-38195.md): BUG-000150540 - Reflected XSS vulnerability in ArcGIS Server (CVSS 6.1, Esri ArcGIS Server)
- [CVE-2022-38196](https://cve.now/CVE-2022-38196.md): BUG-000150537 - ArcGIS Server has a local file inclusion (LFI) vulnerability (CVSS 6.5, Esri ArcGIS Server)
- [CVE-2022-38197](https://cve.now/CVE-2022-38197.md): BUG-000148347 Unvalidated redirect issues in ArcGIS Server. (CVSS 6.1, Esri ArcGIS Server)
- [CVE-2022-38198](https://cve.now/CVE-2022-38198.md): BUG-000146513 - Reflected XSS vulnerability in ArcGIS Server (CVSS 6.1, Esri ArcGIS Server)
- [CVE-2022-38199](https://cve.now/CVE-2022-38199.md): BUG-000144172 - Remote file download issue in ArcGIS Server (CVSS 6.1, Esri ArcGIS Server)
- [CVE-2022-38200](https://cve.now/CVE-2022-38200.md): BUG-000142376 - Reflected Cross-Site Scripting (XSS) vulnerability in ArcGIS Server. (CVSS 6.1, Esri ArcGIS Server)
- [CVE-2022-27622](https://cve.now/CVE-2022-27622.md): Server-Side Request Forgery (SSRF) vulnerability in Package Center functionality in Synology DiskStation Manager (DSM) before 7.1-42661 allo (CVSS 4.1, Synology DiskStation Manager)
- [CVE-2022-27623](https://cve.now/CVE-2022-27623.md): Missing authentication for critical function vulnerability in iSCSI management functionality in Synology DiskStation Manager (DSM) before 7. (CVSS 7.4, Synology DiskStation Manager)
- [CVE-2022-36783](https://cve.now/CVE-2022-36783.md): AlgoSec – FireFlow Reflected Cross-Site-Scripting (RXSS) (CVSS 6.5, AlgoSec FireFlow A32.0 · AlgoSec FireFlow A32.10 +1)
- [CVE-2022-2421](https://cve.now/CVE-2022-2421.md): Socket.io - Improper type validation in attachment parsing (CVSS 10.0, Socket.io-Parser)
- [CVE-2022-2422](https://cve.now/CVE-2022-2422.md): Feathers - SQL injection via attribute aliases (CVSS 10.0, Feather js Feathers-Sequalize · feathers-sequelize)
- [CVE-2022-2762](https://cve.now/CVE-2022-2762.md): AdminPad \< 2.2 - Note Update via CSRF (CVSS 6.5, AdminPad)
- [CVE-2022-28169](https://cve.now/CVE-2022-28169.md): Brocade Webtools in Brocade Fabric OS versions before Brocade Fabric OS versions v9.1.1, v9.0.1e, and v8.2.3c could allow a low privilege we (CVSS 8.8, Brocade Fabric OS)
- [CVE-2022-28170](https://cve.now/CVE-2022-28170.md): Brocade Fabric OS Web Application services before Brocade Fabric v9.1.0, v9.0.1e, v8.2.3c, v7.4.2j store server and user passwords in the de (CVSS 6.5, Brocade Fabric OS)
- [CVE-2022-29822](https://cve.now/CVE-2022-29822.md): Feathers - Improper parameter filtering in the Feathers js library, which may ultimately lead to SQL injection (CVSS 10.0, Feather js Feathers-Sequalize · feathers-sequelize)
- [CVE-2022-29823](https://cve.now/CVE-2022-29823.md): Feathers - Query “\_\_proto\_\_” is converted to real prototype (CVSS 10.0, Feather js Feathers-Sequalize · feathers-sequelize)
- [CVE-2022-3097](https://cve.now/CVE-2022-3097.md): LBStopAttack \< 1.1.3 - Arbitrary Settings Update via CSRF (CVSS 6.5, Plugin LBstopattack)
- [CVE-2022-3246](https://cve.now/CVE-2022-3246.md): Blog2Social \< 6.9.10 - Subscriber+ SQLi (CVSS 8.8, Blog2Social: Social Media Auto Post & Scheduler)
- [CVE-2022-3247](https://cve.now/CVE-2022-3247.md): Blog2Social \< 6.9.10 - Subscriber+ SSRF (CVSS 6.5, Blog2Social: Social Media Auto Post & Scheduler)
- [CVE-2022-3300](https://cve.now/CVE-2022-3300.md): Form Maker by 10Web \< 1.15.6 - Admin+ SQLI (CVSS 7.2, Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact F…)
- [CVE-2022-3302](https://cve.now/CVE-2022-3302.md): Anti-Spam by CleanTalk \< 5.185.1 - Admin+ SQLi (CVSS 7.2, Spam protection, AntiSpam, FireWall by CleanTalk)
- [CVE-2022-33178](https://cve.now/CVE-2022-33178.md): A vulnerability in the radius authentication system of Brocade Fabric OS before Brocade Fabric OS 9.0 could allow a remote attacker to execu (CVSS 7.2, Brocade Fabric OS)
- [CVE-2022-33179](https://cve.now/CVE-2022-33179.md): A vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, and 7.4.2j could allow a local authenticated user (CVSS 8.8, Brocade Fabric OS)
- [CVE-2022-33180](https://cve.now/CVE-2022-33180.md): A vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5 could allow a local authenticated attack (CVSS 5.5, Brocade Fabric OS)
- [CVE-2022-33181](https://cve.now/CVE-2022-33181.md): An information disclosure vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5, 7.4.2.j could a (CVSS 5.5, Brocade Fabric OS)
- [CVE-2022-33182](https://cve.now/CVE-2022-33182.md): A privilege escalation vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5, could allow a loca (CVSS 7.8, Brocade Fabric OS)
- [CVE-2022-33183](https://cve.now/CVE-2022-33183.md): A vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5, 7.4.2.j could allow a remote authentica (CVSS 8.8, Brocade Fabric OS)
- [CVE-2022-33184](https://cve.now/CVE-2022-33184.md): A vulnerability in fab\_seg.c.h libraries of all Brocade Fabric OS versions before Brocade Fabric OS v9.1.1, v9.0.1e, v8.2.3c, v8.2.0\_cbn5, 7 (CVSS 7.8, Brocade Fabric OS)
- [CVE-2022-33185](https://cve.now/CVE-2022-33185.md): Several commands in Brocade Fabric OS before Brocade Fabric OS v.9.0.1e, and v9.1.0 use unsafe string functions to process user input. (CVSS 7.8, Brocade Fabric OS)
- [CVE-2022-3335](https://cve.now/CVE-2022-3335.md): Kadence WooCommerce Email Designer \< 1.5.7 - Admin+ PHP Objection Injection (CVSS 7.2, Kadence WooCommerce Email Designer)
- [CVE-2022-3350](https://cve.now/CVE-2022-3350.md): Contact Bank \<= 3.0.30 - Admin+ Stored Cross-Site Scripting (CVSS 4.8, Contact Bank – Contact Form Builder for WordPress)
- [CVE-2022-3391](https://cve.now/CVE-2022-3391.md): Retain Live Chat \<= 0.1 - Admin+ Stored Cross-Site Scripting (CVSS 4.8, Retain Live Chat)
- [CVE-2022-3392](https://cve.now/CVE-2022-3392.md): WP Humans.txt \<= 1.0.6 - Admin+ Stored Cross-Site Scripting (CVSS 4.8, WP Humans.txt)
- [CVE-2022-3393](https://cve.now/CVE-2022-3393.md): Post to CSV by BestWebSoft \<= 1.4.0 - Author+ CSV Injection (CVSS 9.8, Post to CSV by BestWebSoft)
- [CVE-2022-3394](https://cve.now/CVE-2022-3394.md): WP All Export Pro \< 1.7.9 - Authenticated Code Injection (CVSS 7.2, WP All Export Pro)
- [CVE-2022-3395](https://cve.now/CVE-2022-3395.md): WP All Export Pro \< 1.7.9 - Authenticated SQLi (CVSS 8.8, WP All Export Pro)
- [CVE-2022-34870](https://cve.now/CVE-2022-34870.md): Apache Geode stored Cross-Site Scripting (XSS) via data injection vulnerability in Pulse web application (CVSS 5.4, Apache Software Foundation Apache Geode · org.apache.geode:…)
- [CVE-2022-35132](https://cve.now/CVE-2022-35132.md): Usermin through 1.850 allows a remote authenticated user to execute OS commands via command injection in a filename for the GPG module. (CVSS 8.8)
- [CVE-2022-35739](https://cve.now/CVE-2022-35739.md): PRTG Network Monitor through 22.2.77.2204 does not prevent custom input for a device’s icon, which can be modified to insert arbitrary conte (CVSS 5.3)
- [CVE-2022-3644](https://cve.now/CVE-2022-3644.md): The collection remote for pulp\_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mod (CVSS 5.5, pulp\_ansible · pulp-ansible)
- [CVE-2022-36451](https://cve.now/CVE-2022-36451.md): A vulnerability in the MiCollab Client server component of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to conduct (CVSS 8.8)
- [CVE-2022-36452](https://cve.now/CVE-2022-36452.md): A vulnerability in the web conferencing component of Mitel MiCollab through 9.5.0.101 could allow an unauthenticated attacker to upload mali (CVSS 9.8)
- [CVE-2022-36453](https://cve.now/CVE-2022-36453.md): A vulnerability in the MiCollab Client API of Mitel MiCollab 9.1.3 through 9.5.0.101 could allow an authenticated attacker to modify their p (CVSS 8.8)
- [CVE-2022-36454](https://cve.now/CVE-2022-36454.md): A vulnerability in the MiCollab Client API of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to modify their profile (CVSS 6.5)
- [CVE-2022-38162](https://cve.now/CVE-2022-38162.md): Reflected cross-site scripting (XSS) vulnerabilities in WithSecure through 2022-08-10) exists within the F-Secure Policy Manager due to an u (CVSS 6.1)
- [CVE-2022-38181](https://cve.now/CVE-2022-38181.md): The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled. (CVSS 8.8, KEV)
- [CVE-2022-38870](https://cve.now/CVE-2022-38870.md): Free5gc v3.2.1 is vulnerable to Information disclosure. (CVSS 7.5)
- [CVE-2022-39312](https://cve.now/CVE-2022-39312.md): Dataease Mysql Data Source JDBC Connection Parameters Not Verified Leads to Deserialization Vulnerability (CVSS 9.8, dataease · io.dataease:dataease-plugin-common)
- [CVE-2022-39315](https://cve.now/CVE-2022-39315.md): Kirby CMS vulnerable to user enumeration in the brute force protection (CVSS 6.5, getkirby kirby · getkirby/cms)
- [CVE-2022-39321](https://cve.now/CVE-2022-39321.md): GitHub Actions Runner vulnerable to Docker Command Escaping (CVSS 8.8, actions runner)
- [CVE-2022-39322](https://cve.now/CVE-2022-39322.md): @keystone-6/core vulnerable to field-level access-control bypass for multiselect field (CVSS 9.1, keystonejs keystone · @keystone-6/core)
- [CVE-2022-39326](https://cve.now/CVE-2022-39326.md): kartverket/github-workflows's run-terraform allows for RCE via terraform plan (CVSS 8.8, kartverket github-workflows)
- [CVE-2022-39327](https://cve.now/CVE-2022-39327.md): Improper Control of Generation of Code ('Code Injection') in Azure CLI (CVSS 8.1, azure-cli)
- [CVE-2022-39340](https://cve.now/CVE-2022-39340.md): OpenFGA Information Disclosure (CVSS 5.3, openfga · github.com/openfga/openfga)
- [CVE-2022-39341](https://cve.now/CVE-2022-39341.md): OpenFGA Authorization Bypass (CVSS 5.9, openfga · github.com/openfga/openfga)
- [CVE-2022-39342](https://cve.now/CVE-2022-39342.md): OpenFGA Authorization Bypass (CVSS 5.9, openfga · github.com/openfga/openfga)
- [CVE-2022-39345](https://cve.now/CVE-2022-39345.md): Gin-vue-admin arbitrary file upload vulnerability caused by path traversal (CVSS 9.8, flipped-aurora gin-vue-admin · github.com/flipped-aurora/gi…)
- [CVE-2022-39349](https://cve.now/CVE-2022-39349.md): Tasks.org vulnerable to data exfiltration by malicous app or adb (CVSS 5.5, tasks)
- [CVE-2022-39350](https://cve.now/CVE-2022-39350.md): @dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via Vulnerability Details (CVSS 5.4, DependencyTrack frontend · @dependencytrack/frontend)
- [CVE-2022-39351](https://cve.now/CVE-2022-39351.md): Dependency-Track vulnerable to logging of API keys in clear text when handling API requests using keys with insufficient permissions (CVSS 4.4, DependencyTrack dependency-track)
- [CVE-2022-39354](https://cve.now/CVE-2022-39354.md): evm has incorrect is\_static parameter for custom stateful precompiles (CVSS 5.9, rust-blockchain evm · evm)
- [CVE-2022-41704](https://cve.now/CVE-2022-41704.md): Apache Batik prior to 1.16 allows RCE when loading untrusted SVG input (CVSS 7.5, Apache Software Foundation Apache XML Graphics · org.apache…)
- [CVE-2022-41711](https://cve.now/CVE-2022-41711.md): Badaso version 2.6.0 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. (CVSS 9.8, Badaso · badaso/core)
- [CVE-2022-42890](https://cve.now/CVE-2022-42890.md): Apache Batik prior to 1.16 allows RCE via scripting (no CVSS, Apache Software Foundation Apache XML Graphics · org.apa… +1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-10-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.