# CVEs published 2022-10-27

57 CVEs were published on October 27, 2022: 7 critical, 26 high. Days are UTC.

- [CVE-2022-3377](https://cve.now/CVE-2022-3377.md): Horner Automation's Cscape version 9.90 SP 6 and prior does not properly validate user-supplied data. (CVSS 7.8, Horner Automation Cscape)
- [CVE-2022-3378](https://cve.now/CVE-2022-3378.md): Horner Automation's Cscape version 9.90 SP 7 and prior does not properly validate user-supplied data. (CVSS 7.8, Horner Automation Cscape)
- [CVE-2022-3379](https://cve.now/CVE-2022-3379.md): Horner Automation's Cscape version 9.90 SP7 and prior does not properly validate user-supplied data. (CVSS 7.8, Horner Automation Cscape)
- [CVE-2022-3387](https://cve.now/CVE-2022-3387.md): Advantech R-SeeNet Versions 2.4.19 and prior are vulnerable to path traversal attacks. (CVSS 6.5, Advantech R-SeeNet)
- [CVE-2022-3386](https://cve.now/CVE-2022-3386.md): Advantech R-SeeNet Versions 2.4.17 and prior are vulnerable to a stack-based buffer overflow. (CVSS 9.8, Advantech R-SeeNet)
- [CVE-2022-3385](https://cve.now/CVE-2022-3385.md): Advantech R-SeeNet Versions 2.4.17 and prior are vulnerable to a stack-based buffer overflow. (CVSS 9.8, Advantech R-SeeNet)
- [CVE-2022-41702](https://cve.now/CVE-2022-41702.md): Delta Electronics DIAEnergie (CVSS 8.7, Delta Electronics DIAEnergie)
- [CVE-2022-41651](https://cve.now/CVE-2022-41651.md): Delta Electronics DIAEnergie (CVSS 8.7, Delta Electronics DIAEnergie)
- [CVE-2022-41133](https://cve.now/CVE-2022-41133.md): Delta Electronics DIAEnergie (CVSS 8.8, Delta Electronics DIAEnergie)
- [CVE-2022-41773](https://cve.now/CVE-2022-41773.md): Delta Electronics DIAEnergie (CVSS 8.8, Delta Electronics DIAEnergie)
- [CVE-2022-41701](https://cve.now/CVE-2022-41701.md): Delta Electronics DIAEnergie (CVSS 8.7, Delta Electronics DIAEnergie)
- [CVE-2022-40967](https://cve.now/CVE-2022-40967.md): Delta Electronics DIAEnergie (CVSS 8.8, Delta Electronics DIAEnergie)
- [CVE-2022-41555](https://cve.now/CVE-2022-41555.md): Delta Electronics DIAEnergie (CVSS 8.7, Delta Electronics DIAEnergie)
- [CVE-2022-40965](https://cve.now/CVE-2022-40965.md): Delta Electronics DIAEnergie (CVSS 8.7, Delta Electronics DIAEnergie)
- [CVE-2022-41627](https://cve.now/CVE-2022-41627.md): The physical IoT device of the AliveCor's KardiaMobile, a smartphone-based personal electrocardiogram (EKG) has no encryption for its data- (CVSS 4.8, AliveCor KardiaMobile)
- [CVE-2022-0074](https://cve.now/CVE-2022-0074.md): Privilege Escalation in OpenLiteSpeed Web Server (CVSS 8.8, LiteSpeed Technologies OpenLiteSpeed Web Server · LiteSpeed…)
- [CVE-2022-0073](https://cve.now/CVE-2022-0073.md): Authenticated Remote Code Execution in OpenLiteSpeed Web Server (CVSS 8.8, LiteSpeed Technologies OpenLiteSpeed Web Server · LiteSpeed…)
- [CVE-2022-0072](https://cve.now/CVE-2022-0072.md): Directory Traversal in OpenLiteSpeed Web Server (CVSS 5.8, LiteSpeed Technologies OpenLiteSpeed Web Server · LiteSpeed…)
- [CVE-2022-24669](https://cve.now/CVE-2022-24669.md): Anonymous users can register / de-register for configuration change notifications (CVSS 6.5, ForgeRock Access Management)
- [CVE-2022-24670](https://cve.now/CVE-2022-24670.md): Any user can run unrestricted LDAP queries against a configuration endpoint (CVSS 7.1, ForgeRock Access Management)
- [CVE-2022-41996](https://cve.now/CVE-2022-41996.md): WordPress Avada premium theme \<= 7.8.1 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 8.8, ThemeFusion Avada)
- [CVE-2022-38744](https://cve.now/CVE-2022-38744.md): FactoryTalk Alarm and Events Server Vulnerable to Denial-Of-Service Attack (CVSS 7.5, Rockwell Automation FactoryTalk Alarm and Events Server)
- [CVE-2022-3409](https://cve.now/CVE-2022-3409.md): Unauthenticated out of bounds stack write in bmcweb (CVSS 8.2, OpenBMC Project OpenBMC)
- [CVE-2022-2809](https://cve.now/CVE-2022-2809.md): Unauthenticated out of bounds heap write in bmcweb (CVSS 8.2, OpenBMC Project OpenBMC)
- [CVE-2021-45476](https://cve.now/CVE-2021-45476.md): Information disclosure in Yordam Library Information Document Automation Program (CVSS 4.7, Yordam Informatics Systems Yordam Library Information Docum…)
- [CVE-2021-45475](https://cve.now/CVE-2021-45475.md): Information disclosure in Yordam Library Information Document Automation Program (CVSS 5.3, Yordam Informatics Systems Yordam Library Information Docum…)
- [CVE-2022-25918](https://cve.now/CVE-2022-25918.md): Regular Expression Denial of Service (ReDoS) (CVSS 5.3, shescape)
- [CVE-2022-2508](https://cve.now/CVE-2022-2508.md): In affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user does not have access to (CVSS 5.3, Octopus Deploy Octopus Server)
- [CVE-2022-3095](https://cve.now/CVE-2022-3095.md): Incorrect parsing of the backslash characters in Dart library (CVSS 9.8, Google Dart)
- [CVE-2022-31898](https://cve.now/CVE-2022-31898.md): gl-inet GL-MT300N-V2 Mango v3.212 and GL-AX1800 Flint v3.214 were discovered to contain multiple command injection vulnerabilities via the p (CVSS 6.8)
- [CVE-2022-32407](https://cve.now/CVE-2022-32407.md): Softr v2.0 was discovered to contain a Cross-Site Scripting (XSS) vulnerability via the First Name parameter under the Create A New Account (CVSS 6.1)
- [CVE-2022-36182](https://cve.now/CVE-2022-36182.md): Hashicorp Boundary v0.8.0 is vulnerable to Clickjacking which allow for the interception of login credentials, re-direction of users to mali (CVSS 6.1, github.com/hashicorp/boundary)
- [CVE-2022-3714](https://cve.now/CVE-2022-3714.md): SourceCodester Online Medicine Ordering System sql injection (CVSS 5.0, SourceCodester Online Medicine Ordering System)
- [CVE-2022-3716](https://cve.now/CVE-2022-3716.md): SourceCodester Online Medicine Ordering System cross site scripting (CVSS 3.5, SourceCodester Online Medicine Ordering System)
- [CVE-2022-3725](https://cve.now/CVE-2022-3725.md): Crash in the OPUS protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial of service via packet injection or crafted capture file (CVSS 6.3, Wireshark Foundation Wireshark)
- [CVE-2022-39329](https://cve.now/CVE-2022-39329.md): Profile of disabled user stays accessible (CVSS 3.5, nextcloud security-advisories)
- [CVE-2022-39330](https://cve.now/CVE-2022-39330.md): Database resource exhaustion for logged-in users via sharee recommendations with circles (CVSS 4.8, nextcloud security-advisories)
- [CVE-2022-39364](https://cve.now/CVE-2022-39364.md): Exception logging in Sharepoint app reveals clear-text connection details (CVSS 4.0, nextcloud security-advisories)
- [CVE-2022-39365](https://cve.now/CVE-2022-39365.md): RCE vulnerability in Pimcore/Mail & Dynamic Text Layout (CVSS 9.8, pimcore · pimcore/pimcore)
- [CVE-2022-39976](https://cve.now/CVE-2022-39976.md): School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /modules/ (CVSS 9.8)
- [CVE-2022-39977](https://cve.now/CVE-2022-39977.md): Online Pet Shop We App v1.0 was discovered to contain an arbitrary file upload vulnerability via the Editing function in the User module. (CVSS 7.2)
- [CVE-2022-39978](https://cve.now/CVE-2022-39978.md): Online Pet Shop We App v1.0 was discovered to contain an arbitrary file upload vulnerability via the Editing function in the Product List mo (CVSS 7.2)
- [CVE-2022-40183](https://cve.now/CVE-2022-40183.md): Reflected Cross Site Scripting (XSS) in VIDEOJET multi 4000 (CVSS 5.8, Bosch VIDEOJET multi)
- [CVE-2022-40184](https://cve.now/CVE-2022-40184.md): Stored Cross Site Scripting (XSS) in VIDEOJET multi 4000 (CVSS 5.1, Bosch VIDEOJET multi)
- [CVE-2022-40874](https://cve.now/CVE-2022-40874.md): Tenda AX1803 v1.0.0.1 was discovered to contain a heap overflow vulnerability in the GetParentControlInfo function, which can cause a denial (CVSS 7.5)
- [CVE-2022-40875](https://cve.now/CVE-2022-40875.md): Tenda AX1803 v1.0.0.1 was discovered to contain a heap overflow in the function GetParentControlInfo. (CVSS 7.5)
- [CVE-2022-40876](https://cve.now/CVE-2022-40876.md): In Tenda ax1803 v1.0.0.1, the http requests handled by the fromAdvSetMacMtuWan functions, wanSpeed, cloneType, mac, can cause a stack overfl (CVSS 9.8)
- [CVE-2022-42054](https://cve.now/CVE-2022-42054.md): Multiple stored cross-site scripting (XSS) vulnerabilities in GL.iNet GoodCloud IoT Device Management System Version 1.00.220412.00 allow at (CVSS 5.4)
- [CVE-2022-42055](https://cve.now/CVE-2022-42055.md): Multiple command injection vulnerabilities in GL.iNet GoodCloud IoT Device Management System Version 1.00.220412.00 via the ping and tracero (CVSS 6.5)
- [CVE-2022-42991](https://cve.now/CVE-2022-42991.md): A stored cross-site scripting (XSS) vulnerability in Simple Online Public Access Catalog v1.0 allows attackers to execute arbitrary web scri (CVSS 5.4)
- [CVE-2022-42992](https://cve.now/CVE-2022-42992.md): Multiple stored cross-site scripting (XSS) vulnerabilities in Train Scheduler App v1.0 allow attackers to execute arbitrary web scripts or H (CVSS 5.4)
- [CVE-2022-42993](https://cve.now/CVE-2022-42993.md): Password Storage Application v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Setup page. (CVSS 5.4)
- [CVE-2022-43340](https://cve.now/CVE-2022-43340.md): A Cross-Site Request Forgery (CSRF) in dzzoffice 2.02.1\_SC\_UTF8 allows attackers to arbitrarily create user accounts and grant Administrator (CVSS 8.8)
- [CVE-2022-43364](https://cve.now/CVE-2022-43364.md): An access control issue in the password reset page of IP-COM EW9 V15.11.0.14(9732) allows unauthenticated attackers to arbitrarily change th (CVSS 7.5)
- [CVE-2022-43365](https://cve.now/CVE-2022-43365.md): IP-COM EW9 V15.11.0.14(9732) was discovered to contain a buffer overflow in the formSetDebugCfg function. (CVSS 7.5)
- [CVE-2022-43366](https://cve.now/CVE-2022-43366.md): IP-COM EW9 V15.11.0.14(9732) allows unauthenticated attackers to access sensitive information via the checkLoginUser, ate, telnet, version, (CVSS 7.5)
- [CVE-2022-43367](https://cve.now/CVE-2022-43367.md): IP-COM EW9 V15.11.0.14(9732) was discovered to contain a command injection vulnerability in the formSetDebugCfg function. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-10-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.