CVEs published October 26, 2022
56 CVEs were published on October 26, 2022: 10 critical, 20 high.
- Published
- 56
- Critical
- 10
- High
- 20
- Medium
- 22
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 19
Most affected products
- Axiomatic Bento4
- 9
- Cisco RoomOS Software
- 5
- metabase
- 5
- SourceCodester Sanitization Management System
- 3
- Cisco Identity Services Engine Software
- 2
- Delta Electronics DIAEnergie
- 2
- Synology Presto File Server
- 2
- AliveCor Kardia App
- 1
- Apache Software Foundation Apache Flume · org.apache.flume.…
- 1
- Apache Software Foundation Apache IoTDB · apache-iotdb +3
- 1
Critical 10
- CVE-2022-2782In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the sessionOctopus Deploy Octopus Server
- CVE-2022-39355Discourse Patreon vulnerable to improper validation of email during Patreon authenticationdiscourse-patreon
- CVE-2022-42468Apache Flume prior to 1.11.0 has an Improper Input Validation (JNDI Injection) in JMSSourceApache Software Foundation Apache Flume · org.apache.flume.…
- CVE-2022-42998D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the srcip parameter at /goform/form2IPQoSTcAdd.
- CVE-2022-43000D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the wizardstep4_pskpwd parameter at /goform/form2WizardStep4.
- CVE-2022-43001D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the pskValue parameter in the setSecurity function.
- CVE-2022-43002D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the wizardstep54_pskpwd parameter at /goform/form2WizardStep54.
- CVE-2022-43003D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the pskValue parameter in the setRepeaterSecurity function.
- CVE-2022-43774The HandlerPageP_KID class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that could allow an attacker to gain code execuDelta Electronics DIAEnergie
- CVE-2022-43775The HICT_Loop class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that could allow an attacker to gain code execution onDelta Electronics DIAEnergie
High 20
- CVE-2022-40238A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5CERT/CC VINCE - The Vulnerability Information and Coordinat…
- CVE-2022-20933Cisco Meraki MX and Z3 Teleworker Gateway VPN Denial of Service VulnerabilityCisco Meraki MX Firmware
- CVE-2022-20822Cisco Identity Services Engine Unauthorized File Access VulnerabilityCisco Identity Services Engine Software
- CVE-2022-31256sendmail: mail to root privilege escalation via sm-client.pre scriptopenSUSE Factory
- CVE-2022-3662Axiomatic Bento4 mp42hls Ap4Sample.h GetOffset use after freeAxiomatic Bento4
- CVE-2022-3664Axiomatic Bento4 avcinfo Ap4BitStream.cpp WriteBytes heap-based overflowAxiomatic Bento4
- CVE-2022-3665Axiomatic Bento4 avcinfo AvcInfo.cpp heap-based overflowAxiomatic Bento4
- CVE-2022-3666Axiomatic Bento4 mp42ts Ap4LinearReader.cpp Advance use after freeAxiomatic Bento4
- CVE-2022-3667Axiomatic Bento4 mp42aac Ap4ByteStream.cpp WritePartial heap-based overflowAxiomatic Bento4
- CVE-2022-3670Axiomatic Bento4 mp42hevc WriteSample heap-based overflowAxiomatic Bento4
- CVE-2022-3674SourceCodester Sanitization Management System missing authenticationSourceCodester Sanitization Management System
- CVE-2022-37202JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/advicefeedback/list
- CVE-2022-39286Execution with Unnecessary Privileges in JupyterAppjupyter_core · jupyter-core
- CVE-2022-39357Winter vulnerable to Prototype Pollution in Snowboard frameworkwintercms winter · wintercms/winter
- CVE-2022-39361Metabase vulnerable to Remote Code Execution via H2metabase
- CVE-2022-39362Metabase vulnerable to arbitrary SQL execution from queryhashmetabase
- CVE-2022-39944The Apache Linkis JDBC EngineConn module has a RCE VulnerabilityApache Software Foundation Apache Linkis · org.apache.linki…
- CVE-2022-42999D-Link DIR-816 A2 1.10 B05 was discovered to contain multiple command injection vulnerabilities via the admuser and admpass parameters at /g
- CVE-2022-43747baramundi Management Agent (bMA) in baramundi Management Suite (bMS) 2021 R1 and R2 and 2022 R1 allows remote code execution.
- CVE-2022-43766Apache IoTDB prior to 0.13.3 allows DoSApache Software Foundation Apache IoTDB · apache-iotdb +3
Medium, low and unrated 26
- CVE-2022-40703CWE-302 Authentication Bypass by Assumed-Immutable Data in AliveCor Kardia App version 5.17.1-754993421 and prior on Android allows an unaAliveCor Kardia App
- CVE-2022-20776Cisco TelePresence Collaboration Endpoint and RoomOS Software VulnerabilitiesCisco RoomOS Software
- CVE-2022-20959Cisco Identity Services Engine Cross-Site Scripting VulnerabilityCisco Identity Services Engine Software
- CVE-2022-20955Cisco TelePresence Collaboration Endpoint and RoomOS Software VulnerabilitiesCisco RoomOS Software
- CVE-2022-20954Cisco TelePresence Collaboration Endpoint and RoomOS Software VulnerabilitiesCisco RoomOS Software
- CVE-2022-20953Cisco TelePresence Collaboration Endpoint and RoomOS Software VulnerabilitiesCisco RoomOS Software
- CVE-2022-20811Cisco TelePresence Collaboration Endpoint and RoomOS Software VulnerabilitiesCisco RoomOS Software
- CVE-2022-43748Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file operation management in Synology PrestoSynology Presto File Server
- CVE-2022-43749Improper privilege management vulnerability in summary report management in Synology Presto File Server before 2.1.2-1601 allows remote authSynology Presto File Server
- CVE-2022-25849Cross-site Scripting (XSS)joyqi/hyper-down
- CVE-2022-3363Business Logic Errors in ikus060/rdiffwebikus060/rdiffweb · rdiffweb
- CVE-2022-3474Bazel leaks user credentials through the remote assets APIGoogle Bazel
- CVE-2022-3663Axiomatic Bento4 MP4fragment Ap4StsdAtom.cpp AP4_StsdAtom null pointer dereferenceAxiomatic Bento4
- CVE-2022-3668Axiomatic Bento4 mp4edit CreateAtomFromStream memory leakAxiomatic Bento4
- CVE-2022-3669Axiomatic Bento4 mp4edit Create memory leakAxiomatic Bento4
- CVE-2022-3671SourceCodester eLearning System manage.php sql injectionSourceCodester eLearning System
- CVE-2022-3672SourceCodester Sanitization Management System SystemSettings.php cross site scriptingSourceCodester Sanitization Management System
- CVE-2022-3673SourceCodester Sanitization Management System Master.php cross site scriptingSourceCodester Sanitization Management System
- CVE-2022-3704Ruby on Rails _table.html.erb cross site scriptingRuby on Rails
- CVE-2022-3705vim autocmd quickfix.c qf_update_buffer use after freevim
- CVE-2022-39348Twisted vulnerable to NameVirtualHost Host header injectiontwisted
- CVE-2022-39358Metabase vulnerable to circumvention of Locked parameter in Signed Embeddingmetabase
- CVE-2022-39359Metabase's GeoJSON validation doesn't prevent redirects to blocked URLsmetabase
- CVE-2022-39360Metabase SSO users able to circumvent IdP login by doing password resetmetabase
- CVE-2022-43750drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-space client to corrupt the monito
- CVE-2022-43776The url parameter of the /api/geojson endpoint in Metabase versions <44.5 can be used to perform Server Side Request Forgery attacks.Metabase