CVEs published October 27, 2022
57 CVEs were published on October 27, 2022: 7 critical, 26 high.
- Published
- 57
- Critical
- 7
- High
- 26
- Medium
- 22
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 25
Most affected products
- Delta Electronics DIAEnergie
- 8
- Advantech R-SeeNet
- 3
- Horner Automation Cscape
- 3
- LiteSpeed Technologies OpenLiteSpeed Web Server · LiteSpeed…
- 3
- nextcloud security-advisories
- 3
- Bosch VIDEOJET multi
- 2
- ForgeRock Access Management
- 2
- OpenBMC Project OpenBMC
- 2
- SourceCodester Online Medicine Ordering System
- 2
- Yordam Informatics Systems Yordam Library Information Docum…
- 2
Critical 7
- CVE-2022-3386 Advantech R-SeeNet Versions 2.4.17 and prior are vulnerable to a stack-based buffer overflow.Advantech R-SeeNet
- CVE-2022-3385 Advantech R-SeeNet Versions 2.4.17 and prior are vulnerable to a stack-based buffer overflow.Advantech R-SeeNet
- CVE-2022-3095Incorrect parsing of the backslash characters in Dart libraryGoogle Dart
- CVE-2022-39365RCE vulnerability in Pimcore/Mail & Dynamic Text Layoutpimcore · pimcore/pimcore
- CVE-2022-39976School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /modules/
- CVE-2022-40876In Tenda ax1803 v1.0.0.1, the http requests handled by the fromAdvSetMacMtuWan functions, wanSpeed, cloneType, mac, can cause a stack overfl
- CVE-2022-43367IP-COM EW9 V15.11.0.14(9732) was discovered to contain a command injection vulnerability in the formSetDebugCfg function.
High 26
- CVE-2022-3377Horner Automation's Cscape version 9.90 SP 6 and prior does not properly validate user-supplied data.Horner Automation Cscape
- CVE-2022-3378 Horner Automation's Cscape version 9.90 SP 7 and prior does not properly validate user-supplied data.Horner Automation Cscape
- CVE-2022-3379 Horner Automation's Cscape version 9.90 SP7 and prior does not properly validate user-supplied data.Horner Automation Cscape
- CVE-2022-41702Delta Electronics DIAEnergieDelta Electronics DIAEnergie
- CVE-2022-41651Delta Electronics DIAEnergieDelta Electronics DIAEnergie
- CVE-2022-41133Delta Electronics DIAEnergieDelta Electronics DIAEnergie
- CVE-2022-41773Delta Electronics DIAEnergieDelta Electronics DIAEnergie
- CVE-2022-41701Delta Electronics DIAEnergieDelta Electronics DIAEnergie
- CVE-2022-40967Delta Electronics DIAEnergieDelta Electronics DIAEnergie
- CVE-2022-41555Delta Electronics DIAEnergieDelta Electronics DIAEnergie
- CVE-2022-40965Delta Electronics DIAEnergieDelta Electronics DIAEnergie
- CVE-2022-0074Privilege Escalation in OpenLiteSpeed Web ServerLiteSpeed Technologies OpenLiteSpeed Web Server · LiteSpeed…
- CVE-2022-0073Authenticated Remote Code Execution in OpenLiteSpeed Web ServerLiteSpeed Technologies OpenLiteSpeed Web Server · LiteSpeed…
- CVE-2022-24670Any user can run unrestricted LDAP queries against a configuration endpointForgeRock Access Management
- CVE-2022-41996WordPress Avada premium theme <= 7.8.1 - Cross-Site Request Forgery (CSRF) vulnerabilityThemeFusion Avada
- CVE-2022-38744FactoryTalk Alarm and Events Server Vulnerable to Denial-Of-Service AttackRockwell Automation FactoryTalk Alarm and Events Server
- CVE-2022-3409Unauthenticated out of bounds stack write in bmcwebOpenBMC Project OpenBMC
- CVE-2022-2809Unauthenticated out of bounds heap write in bmcwebOpenBMC Project OpenBMC
- CVE-2022-39977Online Pet Shop We App v1.0 was discovered to contain an arbitrary file upload vulnerability via the Editing function in the User module.
- CVE-2022-39978Online Pet Shop We App v1.0 was discovered to contain an arbitrary file upload vulnerability via the Editing function in the Product List mo
- CVE-2022-40874Tenda AX1803 v1.0.0.1 was discovered to contain a heap overflow vulnerability in the GetParentControlInfo function, which can cause a denial
- CVE-2022-40875Tenda AX1803 v1.0.0.1 was discovered to contain a heap overflow in the function GetParentControlInfo.
- CVE-2022-43340A Cross-Site Request Forgery (CSRF) in dzzoffice 2.02.1_SC_UTF8 allows attackers to arbitrarily create user accounts and grant Administrator
- CVE-2022-43364An access control issue in the password reset page of IP-COM EW9 V15.11.0.14(9732) allows unauthenticated attackers to arbitrarily change th
- CVE-2022-43365IP-COM EW9 V15.11.0.14(9732) was discovered to contain a buffer overflow in the formSetDebugCfg function.
- CVE-2022-43366IP-COM EW9 V15.11.0.14(9732) allows unauthenticated attackers to access sensitive information via the checkLoginUser, ate, telnet, version,
Medium, low and unrated 24
- CVE-2022-3387 Advantech R-SeeNet Versions 2.4.19 and prior are vulnerable to path traversal attacks.Advantech R-SeeNet
- CVE-2022-41627 The physical IoT device of the AliveCor's KardiaMobile, a smartphone-based personal electrocardiogram (EKG) has no encryption for its data-AliveCor KardiaMobile
- CVE-2022-0072Directory Traversal in OpenLiteSpeed Web ServerLiteSpeed Technologies OpenLiteSpeed Web Server · LiteSpeed…
- CVE-2022-24669Anonymous users can register / de-register for configuration change notificationsForgeRock Access Management
- CVE-2021-45476Information disclosure in Yordam Library Information Document Automation ProgramYordam Informatics Systems Yordam Library Information Docum…
- CVE-2021-45475Information disclosure in Yordam Library Information Document Automation ProgramYordam Informatics Systems Yordam Library Information Docum…
- CVE-2022-25918Regular Expression Denial of Service (ReDoS)shescape
- CVE-2022-2508In affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user does not have access to Octopus Deploy Octopus Server
- CVE-2022-31898gl-inet GL-MT300N-V2 Mango v3.212 and GL-AX1800 Flint v3.214 were discovered to contain multiple command injection vulnerabilities via the p
- CVE-2022-32407Softr v2.0 was discovered to contain a Cross-Site Scripting (XSS) vulnerability via the First Name parameter under the Create A New Account
- CVE-2022-36182Hashicorp Boundary v0.8.0 is vulnerable to Clickjacking which allow for the interception of login credentials, re-direction of users to maligithub.com/hashicorp/boundary
- CVE-2022-3714SourceCodester Online Medicine Ordering System sql injectionSourceCodester Online Medicine Ordering System
- CVE-2022-3716SourceCodester Online Medicine Ordering System cross site scriptingSourceCodester Online Medicine Ordering System
- CVE-2022-3725Crash in the OPUS protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial of service via packet injection or crafted capture fileWireshark Foundation Wireshark
- CVE-2022-39329Profile of disabled user stays accessiblenextcloud security-advisories
- CVE-2022-39330Database resource exhaustion for logged-in users via sharee recommendations with circlesnextcloud security-advisories
- CVE-2022-39364Exception logging in Sharepoint app reveals clear-text connection detailsnextcloud security-advisories
- CVE-2022-40183Reflected Cross Site Scripting (XSS) in VIDEOJET multi 4000Bosch VIDEOJET multi
- CVE-2022-40184Stored Cross Site Scripting (XSS) in VIDEOJET multi 4000Bosch VIDEOJET multi
- CVE-2022-42054Multiple stored cross-site scripting (XSS) vulnerabilities in GL.iNet GoodCloud IoT Device Management System Version 1.00.220412.00 allow at
- CVE-2022-42055Multiple command injection vulnerabilities in GL.iNet GoodCloud IoT Device Management System Version 1.00.220412.00 via the ping and tracero
- CVE-2022-42991A stored cross-site scripting (XSS) vulnerability in Simple Online Public Access Catalog v1.0 allows attackers to execute arbitrary web scri
- CVE-2022-42992Multiple stored cross-site scripting (XSS) vulnerabilities in Train Scheduler App v1.0 allow attackers to execute arbitrary web scripts or H
- CVE-2022-42993Password Storage Application v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Setup page.