# CVEs published 2022-10-29 10 CVEs were published on October 29, 2022: 1 critical, 4 high. Days are UTC. - [CVE-2021-42777](https://cve.now/CVE-2021-42777.md): Stimulsoft (aka Stimulsoft Reports) 2013.1.1600.0, when Compilation Mode is used, allows an attacker to execute arbitrary C# code on any mac (CVSS 9.8) - [CVE-2022-3754](https://cve.now/CVE-2022-3754.md): Weak Password Requirements in thorsten/phpmyfaq (CVSS 7.5, thorsten/phpmyfaq) - [CVE-2022-41973](https://cve.now/CVE-2022-41973.md): multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with CVE-2022-41974. (no CVSS) - [CVE-2022-41974](https://cve.now/CVE-2022-41974.md): multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-202 (no CVSS) - [CVE-2022-42915](https://cve.now/CVE-2022-42915.md): curl before 7.86.0 has a double free. (CVSS 8.1) - [CVE-2022-42916](https://cve.now/CVE-2022-42916.md): In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. (CVSS 7.5) - [CVE-2022-44019](https://cve.now/CVE-2022-44019.md): In Total.js 4 before 0e5ace7, /api/common/ping can achieve remote command execution via shell metacharacters in the host parameter. (CVSS 8.8) - [CVE-2022-44020](https://cve.now/CVE-2022-44020.md): An issue was discovered in OpenStack Sushy-Tools through 0.21.0 and VirtualBMC through 2.2.2. (CVSS 5.5, virtualbmc ยท sushy-tools) - [CVE-2022-44022](https://cve.now/CVE-2022-44022.md): PwnDoc through 0.5.3 might allow remote attackers to identify valid user account names by leveraging response timings for authentication att (CVSS 5.3) - [CVE-2022-44023](https://cve.now/CVE-2022-44023.md): PwnDoc through 0.5.3 might allow remote attackers to identify disabled user account names by leveraging response messages for authentication (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2022-10-29 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.