CVEs published October 31, 2022
90 CVEs were published on October 31, 2022: 20 critical, 31 high.
- Published
- 90
- Critical
- 20
- High
- 31
- Medium
- 37
- Low
- 1
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 24
Most affected products
- PHP Point of Sale
- 10
- Delta Electronics InfraSuite Device Master
- 9
- e-Excellence U-Office Force
- 7
- Forma LMS
- 6
- M-Files Hubshare
- 4
- Axiomatic Bento4
- 2
- Newspaper
- 2
- processwire/processwire
- 2
- Rock Convert
- 2
- Schoolbox Pty Schoolbox
- 2
Critical 20
- CVE-2022-40287Stored cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC via user profile data fields.PHP Point of Sale
- CVE-2022-40296Server-side request forgery (SSRF) in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.PHP Point of Sale
- CVE-2022-40289Stored cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC via file upload and download functionality.PHP Point of Sale
- CVE-2022-40293Session fixation in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.PHP Point of Sale
- CVE-2022-40288Stored cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC via messaging functionalityPHP Point of Sale
- CVE-2022-41681File Upload vulnerability in Forma LMSForma LMS
- CVE-2022-42925Unrestricted Upload of File with Dangerous Type in Forma LMSForma LMS
- CVE-2022-41688 Delta Electronics InfraSuite Device Master versions 00.00.01a and prior lack proper authentication for functions that create and modify useDelta Electronics InfraSuite Device Master
- CVE-2022-40202 The database backup function in Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior lacks proper authentication.Delta Electronics InfraSuite Device Master
- CVE-2022-41772 Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior mishandle .ZIP archives containing characters used in path traversaDelta Electronics InfraSuite Device Master
- CVE-2022-41657 Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior allow attacker provided data already serialized into memory to be uDelta Electronics InfraSuite Device Master
- CVE-2022-38142 Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize user-supplied data provided through the Device-Gateway Delta Electronics InfraSuite Device Master
- CVE-2022-40741SOFTNEXT TECHNOLOGIES CORP. Mail SQR Expert - Command InjectionSOFTNEXT TECHNOLOGIES Mail SQR Expert
- CVE-2020-21016D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary code as root via HNAP1/control/SetGuestWLanSettings.
- CVE-2021-40241xfig 3.2.7 is vulnerable to Buffer Overflow.
- CVE-2022-27583A remote unprivileged attacker can interact with the configuration interface of a Flexi-Compact FLX3-CPUC1 or FLX3-CPUC2 running an affectedSICK FlexiCompact
- CVE-2022-31692Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or includSpring by VMware · org.springframework.security:spring-secu…
- CVE-2022-3254AWP Classifieds Plugin < 4.3 - Unauthenticated SQLiWordPress Classifieds Plugin – Ad Directory & Listings by A…
- CVE-2022-37623Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the shimPath variable browserify-shim
- CVE-2022-40471Remote Code Execution in Clinic's Patient Management System v 1.0 allows Attacker to Upload arbitrary php webshell via profile picture uploa
High 31
- CVE-2022-40190SAUTER Controls moduWeb firmware version 2.7.1 is vulnerable to reflective cross-site scripting (XSS).SAUTER Controls moduWeb
- CVE-2022-39018Broken access controls on PDFtron data in M-Files HubshareM-Files Hubshare
- CVE-2022-40294CSV Injection in PHP Point of Sale version 19.0, by PHP Point of Sale, LLCPHP Point of Sale
- CVE-2022-39017XSS in all comments fields in M-Files HubshareM-Files Hubshare
- CVE-2022-3059SQL injection in Schoolbox version 21.0.2, by Schoolbox Pty LtdSchoolbox Pty Schoolbox
- CVE-2022-40291Cross-site request forgery (CSRF) in PHP Point of Sale version 19.0, by PHP Point of Sale, LLCPHP Point of Sale
- CVE-2022-39016Javascript injection in PDFtron in M-Files HubshareM-Files Hubshare
- CVE-2022-39020Cross-site scripting in Schoolbox version 21.0.2, by Schoolbox Pty LtdSchoolbox Pty Schoolbox
- CVE-2022-42924SQL injection in Forma LMSForma LMS
- CVE-2022-41680SQL Injection in Forma LMSForma LMS
- CVE-2022-42923SQL injection in Forma LMSForma LMS
- CVE-2022-41629 Delta Electronics InfraSuite Device Master versions 00.00.01a and prior allow unauthenticated users to access the aprunning endpoint, whichDelta Electronics InfraSuite Device Master
- CVE-2022-28763Improper URL parsing in Zoom ClientsZoom Video Communications Zoom Client for Meetings · Zoo… +1
- CVE-2022-41776 Delta Electronics InfraSuite Device Master versions 00.00.01a and prior allow unauthenticated users to trigger the WriteConfiguration methoDelta Electronics InfraSuite Device Master
- CVE-2022-41644 Delta Electronics InfraSuite Device Master versions 00.00.01a and prior lacks authentication for a function that changes group privilegesDelta Electronics InfraSuite Device Master
- CVE-2022-41779 Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize network packets without proper verification.Delta Electronics InfraSuite Device Master
- CVE-2022-2741can: denial-of-service can be triggered by a crafted CAN framezephyrproject-rtos zephyr
- CVE-2021-40661A remote, unauthenticated, directory traversal vulnerability was identified within the web interface used by IND780 Advanced Weighing Termin
- CVE-2022-31690Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escSpring Security · org.springframework.security:spring-secur…
- CVE-2022-3334Easy WP SMTP < 1.5.0 - Admin+ PHP Objection InjectionEasy WP SMTP
- CVE-2022-3357Smart Slider 3 < 3.5.1.11 - PHP Object InjectionSmart Slider
- CVE-2022-3360LearnPress < 4.1.7.2 - Unauthenticated PHP Object Injection via REST APILearnPress – WordPress LMS Plugin
- CVE-2022-3366PublishPress Capabilities < 2.5.2 - Admin+ PHP Objection InjectionPublishPress Capabilities – User Role Access, Editor Permis…
- CVE-2022-3374Ocean Extra < 2.0.5 - Admin+ PHP Objection InjectionOcean Extra
- CVE-2022-3380Customizer Export/Import < 0.9.5 - Admin+ PHP Objection InjectionCustomizer Export/Import
- CVE-2022-37620A Regular Expression Denial of Service (ReDoS) flaw was found in kangax html-minifier 4.0.0 because of the reCustomIgnore regular expressionhtml-minifier
- CVE-2022-3765Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaqthorsten/phpmyfaq
- CVE-2022-3766Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaqthorsten/phpmyfaq
- CVE-2022-39294(DoS) Denial of Service from unchecked request length in conduit-hyperconduit-rust conduit-hyper · conduit-hyper
- CVE-2022-40617strongSwan before 5.9.8 allows remote attackers to cause a denial of service in the revocation plugin by sending a crafted end-entity (and i
- CVE-2022-43752Oracle Solaris version 10 1/13, when using the Common Desktop Environment (CDE), is vulnerable to a privilege escalation vulnerability.
Medium, low and unrated 39
- CVE-2021-27784HCL Launch container images may contain non-unique https certificates and database encryption keyHCL Software HCL Launch
- CVE-2022-39019Broken access controls on PDFtron WebviewerUI in M-Files HubshareM-Files Hubshare
- CVE-2022-40290Reflected cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.PHP Point of Sale
- CVE-2022-40295Authenticated sensitive information disclosure in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.PHP Point of Sale
- CVE-2022-40292Unauthenticated username enumeration in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.PHP Point of Sale
- CVE-2022-41679Cross-site scripting in Forma LMS versionForma LMS
- CVE-2022-40742SOFTNEXT TECHNOLOGIES CORP. Mail SQR Expert - Local File InclusionSOFTNEXT TECHNOLOGIES Mail SQR Expert
- CVE-2022-40739Ragic, Inc. Ragic - Reflected XSSRagic
- CVE-2022-39027e-Excellence Inc. U-Office Force - Stored XSSe-Excellence U-Office Force
- CVE-2022-39026e-Excellence Inc. U-Office Force - Stored XSSe-Excellence U-Office Force
- CVE-2022-39025e-Excellence Inc. U-Office Force - Reflected XSSe-Excellence U-Office Force
- CVE-2022-39024e-Excellence Inc. U-Office Force - Reflected XSSe-Excellence U-Office Force
- CVE-2022-39023e-Excellence Inc. U-Office Force - Path Traversale-Excellence U-Office Force
- CVE-2022-39022e-Excellence Inc. U-Office Force - Path Traversale-Excellence U-Office Force
- CVE-2022-39021e-Excellence Inc. U-Office Force - Open Redirecte-Excellence U-Office Force
- CVE-2022-2167Newspaper < 12 - Reflected Cross-Site ScriptingNewspaper
- CVE-2022-2190Envira Gallery Lite < 1.8.4.7 - Reflected Cross-Site ScriptingGallery Plugin for WordPress – Envira Photo Gallery
- CVE-2022-2627Newspaper < 12 - Reflected Cross-Site ScriptingNewspaper
- CVE-2022-3096WP Total Hacks <= 4.7.2 - Subscriber+ Arbitrary Options Update to Stored XSSWP Total Hacks
- CVE-2022-3237WP Contact Slider < 2.4.8 - Admin+ Stored Cross-Site ScriptingWP Contact Slider
- CVE-2022-3408WP Word Count <= 3.2.3 - Admin+ Stored Cross-Site ScriptingWP Word Count
- CVE-2022-3419Automatic User Roles Switcher < 1.1.2 - Subscriber+ Privilege EscalationAutomatic User Roles Switcher
- CVE-2022-3420Official Integration for Billingo < 3.4.0 - ShopManager+ Stored XSSOfficial Integration for Billingo
- CVE-2022-3440Rock Convert < 2.6.0 - Reflected Cross-Site ScriptingRock Convert
- CVE-2022-3441Rock Convert < 2.11.0 - Admin+ Stored Cross-Site ScriptingRock Convert
- CVE-2022-3499An authenticated attacker could utilize the identical agent and cluster node linking keys to potentially allow for a scenario where unauthorTenable Nessus
- CVE-2022-3770Yunjing CMS upload_img.html unrestricted uploadYunjing CMS
- CVE-2022-3771easyii CMS File Upload Management Upload.php file unrestricted uploadeasyii CMS · noumo/easyii
- CVE-2022-3774SourceCodester Train Scheduler App resource injectionSourceCodester Train Scheduler App
- CVE-2022-3783node-red-dashboard ui_text Format ui-component-ctrl.js cross site scriptingnode-red-dashboard
- CVE-2022-3784Axiomatic Bento4 mp4hls Ap4Mp4AudioInfo.cpp ReadBits heap-based overflowAxiomatic Bento4
- CVE-2022-3785Axiomatic Bento4 Avcinfo SetDataSize heap-based overflowAxiomatic Bento4
- CVE-2022-40487ProcessWire v3.0.200 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the Search Users and Search Pages funprocesswire/processwire
- CVE-2022-40488ProcessWire v3.0.200 was discovered to contain a Cross-Site Request Forgery (CSRF).processwire/processwire
- CVE-2022-43148rtf2html v0.2.0 was discovered to contain a heap overflow in the component /rtf2html/./rtf_tools.h.
- CVE-2022-43151timg v1.4.4 was discovered to contain a memory leak via the function timg::QueryBackgroundColor() at /timg/src/term-query.cc.
- CVE-2022-43152tsMuxer v2.6.16 was discovered to contain a heap overflow via the function BitStreamWriter::flushBits() at /tsMuxer/bitStream.h.
- CVE-2022-44079pycdc commit 44a730f3a889503014fec94ae6e62d8401cb75e5 was discovered to contain a stack overflow via the component __sanitizer::StackDepotBa
- CVE-2022-44081Lodepng v20220717 was discovered to contain a segmentation fault via the function pngdetail.