# CVEs published 2022-10-26

56 CVEs were published on October 26, 2022: 10 critical, 20 high. Days are UTC.

- [CVE-2022-40703](https://cve.now/CVE-2022-40703.md): CWE-302 Authentication Bypass by Assumed-Immutable Data in AliveCor Kardia App version 5.17.1-754993421 and prior on Android allows an una (CVSS 5.2, AliveCor Kardia App)
- [CVE-2022-40238](https://cve.now/CVE-2022-40238.md): A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5 (CVSS 8.8, CERT/CC VINCE - The Vulnerability Information and Coordinat…)
- [CVE-2022-20776](https://cve.now/CVE-2022-20776.md): Cisco TelePresence Collaboration Endpoint and RoomOS Software Vulnerabilities (CVSS 5.5, Cisco RoomOS Software)
- [CVE-2022-20959](https://cve.now/CVE-2022-20959.md): Cisco Identity Services Engine Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Identity Services Engine Software)
- [CVE-2022-20955](https://cve.now/CVE-2022-20955.md): Cisco TelePresence Collaboration Endpoint and RoomOS Software Vulnerabilities (CVSS 5.5, Cisco RoomOS Software)
- [CVE-2022-20954](https://cve.now/CVE-2022-20954.md): Cisco TelePresence Collaboration Endpoint and RoomOS Software Vulnerabilities (CVSS 5.5, Cisco RoomOS Software)
- [CVE-2022-20953](https://cve.now/CVE-2022-20953.md): Cisco TelePresence Collaboration Endpoint and RoomOS Software Vulnerabilities (CVSS 5.5, Cisco RoomOS Software)
- [CVE-2022-20933](https://cve.now/CVE-2022-20933.md): Cisco Meraki MX and Z3 Teleworker Gateway VPN Denial of Service Vulnerability (CVSS 8.6, Cisco Meraki MX Firmware)
- [CVE-2022-20822](https://cve.now/CVE-2022-20822.md): Cisco Identity Services Engine Unauthorized File Access Vulnerability (CVSS 7.1, Cisco Identity Services Engine Software)
- [CVE-2022-20811](https://cve.now/CVE-2022-20811.md): Cisco TelePresence Collaboration Endpoint and RoomOS Software Vulnerabilities (CVSS 5.5, Cisco RoomOS Software)
- [CVE-2022-43748](https://cve.now/CVE-2022-43748.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file operation management in Synology Presto (CVSS 5.8, Synology Presto File Server)
- [CVE-2022-43749](https://cve.now/CVE-2022-43749.md): Improper privilege management vulnerability in summary report management in Synology Presto File Server before 2.1.2-1601 allows remote auth (CVSS 4.3, Synology Presto File Server)
- [CVE-2022-31256](https://cve.now/CVE-2022-31256.md): sendmail: mail to root privilege escalation via sm-client.pre script (CVSS 7.7, openSUSE Factory)
- [CVE-2022-25849](https://cve.now/CVE-2022-25849.md): Cross-site Scripting (XSS) (CVSS 5.4, joyqi/hyper-down)
- [CVE-2022-2782](https://cve.now/CVE-2022-2782.md): In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the session (CVSS 9.1, Octopus Deploy Octopus Server)
- [CVE-2022-3363](https://cve.now/CVE-2022-3363.md): Business Logic Errors in ikus060/rdiffweb (CVSS 2.8, ikus060/rdiffweb · rdiffweb)
- [CVE-2022-3474](https://cve.now/CVE-2022-3474.md): Bazel leaks user credentials through the remote assets API (CVSS 5.1, Google Bazel)
- [CVE-2022-3662](https://cve.now/CVE-2022-3662.md): Axiomatic Bento4 mp42hls Ap4Sample.h GetOffset use after free (CVSS 7.3, Axiomatic Bento4)
- [CVE-2022-3663](https://cve.now/CVE-2022-3663.md): Axiomatic Bento4 MP4fragment Ap4StsdAtom.cpp AP4\_StsdAtom null pointer dereference (CVSS 5.3, Axiomatic Bento4)
- [CVE-2022-3664](https://cve.now/CVE-2022-3664.md): Axiomatic Bento4 avcinfo Ap4BitStream.cpp WriteBytes heap-based overflow (CVSS 7.3, Axiomatic Bento4)
- [CVE-2022-3665](https://cve.now/CVE-2022-3665.md): Axiomatic Bento4 avcinfo AvcInfo.cpp heap-based overflow (CVSS 7.3, Axiomatic Bento4)
- [CVE-2022-3666](https://cve.now/CVE-2022-3666.md): Axiomatic Bento4 mp42ts Ap4LinearReader.cpp Advance use after free (CVSS 7.3, Axiomatic Bento4)
- [CVE-2022-3667](https://cve.now/CVE-2022-3667.md): Axiomatic Bento4 mp42aac Ap4ByteStream.cpp WritePartial heap-based overflow (CVSS 7.3, Axiomatic Bento4)
- [CVE-2022-3668](https://cve.now/CVE-2022-3668.md): Axiomatic Bento4 mp4edit CreateAtomFromStream memory leak (CVSS 5.3, Axiomatic Bento4)
- [CVE-2022-3669](https://cve.now/CVE-2022-3669.md): Axiomatic Bento4 mp4edit Create memory leak (CVSS 5.3, Axiomatic Bento4)
- [CVE-2022-3670](https://cve.now/CVE-2022-3670.md): Axiomatic Bento4 mp42hevc WriteSample heap-based overflow (CVSS 7.3, Axiomatic Bento4)
- [CVE-2022-3671](https://cve.now/CVE-2022-3671.md): SourceCodester eLearning System manage.php sql injection (CVSS 6.3, SourceCodester eLearning System)
- [CVE-2022-3672](https://cve.now/CVE-2022-3672.md): SourceCodester Sanitization Management System SystemSettings.php cross site scripting (CVSS 3.5, SourceCodester Sanitization Management System)
- [CVE-2022-3673](https://cve.now/CVE-2022-3673.md): SourceCodester Sanitization Management System Master.php cross site scripting (CVSS 3.5, SourceCodester Sanitization Management System)
- [CVE-2022-3674](https://cve.now/CVE-2022-3674.md): SourceCodester Sanitization Management System missing authentication (CVSS 7.3, SourceCodester Sanitization Management System)
- [CVE-2022-3704](https://cve.now/CVE-2022-3704.md): Ruby on Rails \_table.html.erb cross site scripting (CVSS 3.5, Ruby on Rails)
- [CVE-2022-3705](https://cve.now/CVE-2022-3705.md): vim autocmd quickfix.c qf\_update\_buffer use after free (CVSS 5.0, vim)
- [CVE-2022-37202](https://cve.now/CVE-2022-37202.md): JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/advicefeedback/list (CVSS 8.8)
- [CVE-2022-39286](https://cve.now/CVE-2022-39286.md): Execution with Unnecessary Privileges in JupyterApp (CVSS 8.8, jupyter\_core · jupyter-core)
- [CVE-2022-39348](https://cve.now/CVE-2022-39348.md): Twisted vulnerable to NameVirtualHost Host header injection (CVSS 5.4, twisted)
- [CVE-2022-39355](https://cve.now/CVE-2022-39355.md): Discourse Patreon vulnerable to improper validation of email during Patreon authentication (CVSS 9.1, discourse-patreon)
- [CVE-2022-39357](https://cve.now/CVE-2022-39357.md): Winter vulnerable to Prototype Pollution in Snowboard framework (CVSS 8.1, wintercms winter · wintercms/winter)
- [CVE-2022-39358](https://cve.now/CVE-2022-39358.md): Metabase vulnerable to circumvention of Locked parameter in Signed Embedding (CVSS 6.5, metabase)
- [CVE-2022-39359](https://cve.now/CVE-2022-39359.md): Metabase's GeoJSON validation doesn't prevent redirects to blocked URLs (CVSS 6.5, metabase)
- [CVE-2022-39360](https://cve.now/CVE-2022-39360.md): Metabase SSO users able to circumvent IdP login by doing password reset (CVSS 6.5, metabase)
- [CVE-2022-39361](https://cve.now/CVE-2022-39361.md): Metabase vulnerable to Remote Code Execution via H2 (CVSS 8.8, metabase)
- [CVE-2022-39362](https://cve.now/CVE-2022-39362.md): Metabase vulnerable to arbitrary SQL execution from queryhash (CVSS 8.8, metabase)
- [CVE-2022-39944](https://cve.now/CVE-2022-39944.md): The Apache Linkis JDBC EngineConn module has a RCE Vulnerability (CVSS 8.8, Apache Software Foundation Apache Linkis · org.apache.linki…)
- [CVE-2022-42468](https://cve.now/CVE-2022-42468.md): Apache Flume prior to 1.11.0 has an Improper Input Validation (JNDI Injection) in JMSSource (CVSS 9.8, Apache Software Foundation Apache Flume · org.apache.flume.…)
- [CVE-2022-42998](https://cve.now/CVE-2022-42998.md): D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the srcip parameter at /goform/form2IPQoSTcAdd. (CVSS 9.8)
- [CVE-2022-42999](https://cve.now/CVE-2022-42999.md): D-Link DIR-816 A2 1.10 B05 was discovered to contain multiple command injection vulnerabilities via the admuser and admpass parameters at /g (CVSS 7.5)
- [CVE-2022-43000](https://cve.now/CVE-2022-43000.md): D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the wizardstep4\_pskpwd parameter at /goform/form2WizardStep4. (CVSS 9.8)
- [CVE-2022-43001](https://cve.now/CVE-2022-43001.md): D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the pskValue parameter in the setSecurity function. (CVSS 9.8)
- [CVE-2022-43002](https://cve.now/CVE-2022-43002.md): D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the wizardstep54\_pskpwd parameter at /goform/form2WizardStep54. (CVSS 9.8)
- [CVE-2022-43003](https://cve.now/CVE-2022-43003.md): D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the pskValue parameter in the setRepeaterSecurity function. (CVSS 9.8)
- [CVE-2022-43747](https://cve.now/CVE-2022-43747.md): baramundi Management Agent (bMA) in baramundi Management Suite (bMS) 2021 R1 and R2 and 2022 R1 allows remote code execution. (CVSS 7.5)
- [CVE-2022-43750](https://cve.now/CVE-2022-43750.md): drivers/usb/mon/mon\_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-space client to corrupt the monito (CVSS 6.7)
- [CVE-2022-43766](https://cve.now/CVE-2022-43766.md): Apache IoTDB prior to 0.13.3 allows DoS (CVSS 7.5, Apache Software Foundation Apache IoTDB · apache-iotdb +3)
- [CVE-2022-43774](https://cve.now/CVE-2022-43774.md): The HandlerPageP\_KID class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that could allow an attacker to gain code execu (CVSS 9.8, Delta Electronics DIAEnergie)
- [CVE-2022-43775](https://cve.now/CVE-2022-43775.md): The HICT\_Loop class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that could allow an attacker to gain code execution on (CVSS 9.8, Delta Electronics DIAEnergie)
- [CVE-2022-43776](https://cve.now/CVE-2022-43776.md): The url parameter of the /api/geojson endpoint in Metabase versions \<44.5 can be used to perform Server Side Request Forgery attacks. (CVSS 6.5, Metabase)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-10-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.