CVEs published October 29, 2022
10 CVEs were published on October 29, 2022: 1 critical, 4 high.
- Published
- 10
- Critical
- 1
- High
- 4
- Medium
- 2
- Low
- 0
- Unrated
- 3
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- thorsten/phpmyfaq
- 1
- virtualbmc · sushy-tools
- 1
Critical 1
High 4
- CVE-2022-3754Weak Password Requirements in thorsten/phpmyfaqthorsten/phpmyfaq
- CVE-2022-42915curl before 7.86.0 has a double free.
- CVE-2022-42916In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP.
- CVE-2022-44019In Total.js 4 before 0e5ace7, /api/common/ping can achieve remote command execution via shell metacharacters in the host parameter.
Medium, low and unrated 5
- CVE-2022-41973multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with CVE-2022-41974.
- CVE-2022-41974multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-202
- CVE-2022-44020An issue was discovered in OpenStack Sushy-Tools through 0.21.0 and VirtualBMC through 2.2.2.virtualbmc · sushy-tools
- CVE-2022-44022PwnDoc through 0.5.3 might allow remote attackers to identify valid user account names by leveraging response timings for authentication att
- CVE-2022-44023PwnDoc through 0.5.3 might allow remote attackers to identify disabled user account names by leveraging response messages for authentication