# CVEs published 2022-10-31

90 CVEs were published on October 31, 2022: 20 critical, 31 high. Days are UTC.

- [CVE-2021-27784](https://cve.now/CVE-2021-27784.md): HCL Launch container images may contain non-unique https certificates and database encryption key (CVSS 5.9, HCL Software HCL Launch)
- [CVE-2022-40190](https://cve.now/CVE-2022-40190.md): SAUTER Controls moduWeb firmware version 2.7.1 is vulnerable to reflective cross-site scripting (XSS). (CVSS 8.8, SAUTER Controls moduWeb)
- [CVE-2022-39018](https://cve.now/CVE-2022-39018.md): Broken access controls on PDFtron data in M-Files Hubshare (CVSS 8.2, M-Files Hubshare)
- [CVE-2022-39019](https://cve.now/CVE-2022-39019.md): Broken access controls on PDFtron WebviewerUI in M-Files Hubshare (CVSS 6.3, M-Files Hubshare)
- [CVE-2022-40294](https://cve.now/CVE-2022-40294.md): CSV Injection in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC (CVSS 8.8, PHP Point of Sale)
- [CVE-2022-40290](https://cve.now/CVE-2022-40290.md): Reflected cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC. (CVSS 6.1, PHP Point of Sale)
- [CVE-2022-40295](https://cve.now/CVE-2022-40295.md): Authenticated sensitive information disclosure in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC. (no CVSS, PHP Point of Sale)
- [CVE-2022-40287](https://cve.now/CVE-2022-40287.md): Stored cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC via user profile data fields. (CVSS 9.0, PHP Point of Sale)
- [CVE-2022-40296](https://cve.now/CVE-2022-40296.md): Server-side request forgery (SSRF) in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC. (CVSS 9.8, PHP Point of Sale)
- [CVE-2022-40289](https://cve.now/CVE-2022-40289.md): Stored cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC via file upload and download functionality. (CVSS 9.0, PHP Point of Sale)
- [CVE-2022-39017](https://cve.now/CVE-2022-39017.md): XSS in all comments fields in M-Files Hubshare (CVSS 8.2, M-Files Hubshare)
- [CVE-2022-40292](https://cve.now/CVE-2022-40292.md): Unauthenticated username enumeration in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC. (CVSS 5.3, PHP Point of Sale)
- [CVE-2022-3059](https://cve.now/CVE-2022-3059.md): SQL injection in Schoolbox version 21.0.2, by Schoolbox Pty Ltd (CVSS 8.6, Schoolbox Pty Schoolbox)
- [CVE-2022-40291](https://cve.now/CVE-2022-40291.md): Cross-site request forgery (CSRF) in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC (CVSS 8.8, PHP Point of Sale)
- [CVE-2022-39016](https://cve.now/CVE-2022-39016.md): Javascript injection in PDFtron in M-Files Hubshare (CVSS 8.2, M-Files Hubshare)
- [CVE-2022-39020](https://cve.now/CVE-2022-39020.md): Cross-site scripting in Schoolbox version 21.0.2, by Schoolbox Pty Ltd (CVSS 7.6, Schoolbox Pty Schoolbox)
- [CVE-2022-40293](https://cve.now/CVE-2022-40293.md): Session fixation in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC. (CVSS 9.8, PHP Point of Sale)
- [CVE-2022-40288](https://cve.now/CVE-2022-40288.md): Stored cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC via messaging functionality (CVSS 9.0, PHP Point of Sale)
- [CVE-2022-41679](https://cve.now/CVE-2022-41679.md): Cross-site scripting in Forma LMS version (CVSS 4.7, Forma LMS)
- [CVE-2022-42924](https://cve.now/CVE-2022-42924.md): SQL injection in Forma LMS (CVSS 7.6, Forma LMS)
- [CVE-2022-41681](https://cve.now/CVE-2022-41681.md): File Upload vulnerability in Forma LMS (CVSS 9.9, Forma LMS)
- [CVE-2022-41680](https://cve.now/CVE-2022-41680.md): SQL Injection in Forma LMS (CVSS 7.6, Forma LMS)
- [CVE-2022-42925](https://cve.now/CVE-2022-42925.md): Unrestricted Upload of File with Dangerous Type in Forma LMS (CVSS 9.9, Forma LMS)
- [CVE-2022-42923](https://cve.now/CVE-2022-42923.md): SQL injection in Forma LMS (CVSS 8.3, Forma LMS)
- [CVE-2022-41629](https://cve.now/CVE-2022-41629.md): Delta Electronics InfraSuite Device Master versions 00.00.01a and prior allow unauthenticated users to access the aprunning endpoint, which (CVSS 7.5, Delta Electronics InfraSuite Device Master)
- [CVE-2022-28763](https://cve.now/CVE-2022-28763.md): Improper URL parsing in Zoom Clients (CVSS 8.8, Zoom Video Communications Zoom Client for Meetings · Zoo… +1)
- [CVE-2022-41776](https://cve.now/CVE-2022-41776.md): Delta Electronics InfraSuite Device Master versions 00.00.01a and prior allow unauthenticated users to trigger the WriteConfiguration metho (CVSS 7.5, Delta Electronics InfraSuite Device Master)
- [CVE-2022-41644](https://cve.now/CVE-2022-41644.md): Delta Electronics InfraSuite Device Master versions 00.00.01a and prior lacks authentication for a function that changes group privileges (CVSS 8.8, Delta Electronics InfraSuite Device Master)
- [CVE-2022-41688](https://cve.now/CVE-2022-41688.md): Delta Electronics InfraSuite Device Master versions 00.00.01a and prior lack proper authentication for functions that create and modify use (CVSS 9.8, Delta Electronics InfraSuite Device Master)
- [CVE-2022-40202](https://cve.now/CVE-2022-40202.md): The database backup function in Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior lacks proper authentication. (CVSS 9.8, Delta Electronics InfraSuite Device Master)
- [CVE-2022-41772](https://cve.now/CVE-2022-41772.md): Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior mishandle .ZIP archives containing characters used in path traversa (CVSS 9.8, Delta Electronics InfraSuite Device Master)
- [CVE-2022-41657](https://cve.now/CVE-2022-41657.md): Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior allow attacker provided data already serialized into memory to be u (CVSS 9.8, Delta Electronics InfraSuite Device Master)
- [CVE-2022-41779](https://cve.now/CVE-2022-41779.md): Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize network packets without proper verification. (CVSS 8.8, Delta Electronics InfraSuite Device Master)
- [CVE-2022-38142](https://cve.now/CVE-2022-38142.md): Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize user-supplied data provided through the Device-Gateway (CVSS 9.8, Delta Electronics InfraSuite Device Master)
- [CVE-2022-2741](https://cve.now/CVE-2022-2741.md): can: denial-of-service can be triggered by a crafted CAN frame (CVSS 8.2, zephyrproject-rtos zephyr)
- [CVE-2022-40742](https://cve.now/CVE-2022-40742.md): SOFTNEXT TECHNOLOGIES CORP. Mail SQR Expert - Local File Inclusion (CVSS 6.5, SOFTNEXT TECHNOLOGIES Mail SQR Expert)
- [CVE-2022-40741](https://cve.now/CVE-2022-40741.md): SOFTNEXT TECHNOLOGIES CORP. Mail SQR Expert - Command Injection (CVSS 9.8, SOFTNEXT TECHNOLOGIES Mail SQR Expert)
- [CVE-2022-40739](https://cve.now/CVE-2022-40739.md): Ragic, Inc. Ragic - Reflected XSS (CVSS 5.4, Ragic)
- [CVE-2022-39027](https://cve.now/CVE-2022-39027.md): e-Excellence Inc. U-Office Force - Stored XSS (CVSS 5.4, e-Excellence U-Office Force)
- [CVE-2022-39026](https://cve.now/CVE-2022-39026.md): e-Excellence Inc. U-Office Force - Stored XSS (CVSS 5.4, e-Excellence U-Office Force)
- [CVE-2022-39025](https://cve.now/CVE-2022-39025.md): e-Excellence Inc. U-Office Force - Reflected XSS (CVSS 6.1, e-Excellence U-Office Force)
- [CVE-2022-39024](https://cve.now/CVE-2022-39024.md): e-Excellence Inc. U-Office Force - Reflected XSS (CVSS 6.1, e-Excellence U-Office Force)
- [CVE-2022-39023](https://cve.now/CVE-2022-39023.md): e-Excellence Inc. U-Office Force - Path Traversal (CVSS 6.5, e-Excellence U-Office Force)
- [CVE-2022-39022](https://cve.now/CVE-2022-39022.md): e-Excellence Inc. U-Office Force - Path Traversal (CVSS 6.5, e-Excellence U-Office Force)
- [CVE-2022-39021](https://cve.now/CVE-2022-39021.md): e-Excellence Inc. U-Office Force - Open Redirect (CVSS 6.1, e-Excellence U-Office Force)
- [CVE-2020-21016](https://cve.now/CVE-2020-21016.md): D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary code as root via HNAP1/control/SetGuestWLanSettings. (CVSS 9.8)
- [CVE-2021-40241](https://cve.now/CVE-2021-40241.md): xfig 3.2.7 is vulnerable to Buffer Overflow. (CVSS 9.8)
- [CVE-2021-40661](https://cve.now/CVE-2021-40661.md): A remote, unauthenticated, directory traversal vulnerability was identified within the web interface used by IND780 Advanced Weighing Termin (CVSS 7.5)
- [CVE-2022-2167](https://cve.now/CVE-2022-2167.md): Newspaper \< 12 - Reflected Cross-Site Scripting (CVSS 6.1, Newspaper)
- [CVE-2022-2190](https://cve.now/CVE-2022-2190.md): Envira Gallery Lite \< 1.8.4.7 - Reflected Cross-Site Scripting (CVSS 6.1, Gallery Plugin for WordPress – Envira Photo Gallery)
- [CVE-2022-2627](https://cve.now/CVE-2022-2627.md): Newspaper \< 12 - Reflected Cross-Site Scripting (CVSS 6.1, Newspaper)
- [CVE-2022-27583](https://cve.now/CVE-2022-27583.md): A remote unprivileged attacker can interact with the configuration interface of a Flexi-Compact FLX3-CPUC1 or FLX3-CPUC2 running an affected (CVSS 9.1, SICK FlexiCompact)
- [CVE-2022-3096](https://cve.now/CVE-2022-3096.md): WP Total Hacks \<= 4.7.2 - Subscriber+ Arbitrary Options Update to Stored XSS (CVSS 5.4, WP Total Hacks)
- [CVE-2022-31690](https://cve.now/CVE-2022-31690.md): Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege esc (CVSS 8.1, Spring Security · org.springframework.security:spring-secur…)
- [CVE-2022-31692](https://cve.now/CVE-2022-31692.md): Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or includ (CVSS 9.8, Spring by VMware · org.springframework.security:spring-secu…)
- [CVE-2022-3237](https://cve.now/CVE-2022-3237.md): WP Contact Slider \< 2.4.8 - Admin+ Stored Cross-Site Scripting (CVSS 4.8, WP Contact Slider)
- [CVE-2022-3254](https://cve.now/CVE-2022-3254.md): AWP Classifieds Plugin \< 4.3 - Unauthenticated SQLi (CVSS 9.8, WordPress Classifieds Plugin – Ad Directory & Listings by A…)
- [CVE-2022-3334](https://cve.now/CVE-2022-3334.md): Easy WP SMTP \< 1.5.0 - Admin+ PHP Objection Injection (CVSS 7.2, Easy WP SMTP)
- [CVE-2022-3357](https://cve.now/CVE-2022-3357.md): Smart Slider 3 \< 3.5.1.11 - PHP Object Injection (CVSS 8.8, Smart Slider)
- [CVE-2022-3360](https://cve.now/CVE-2022-3360.md): LearnPress \< 4.1.7.2 - Unauthenticated PHP Object Injection via REST API (CVSS 8.1, LearnPress – WordPress LMS Plugin)
- [CVE-2022-3366](https://cve.now/CVE-2022-3366.md): PublishPress Capabilities \< 2.5.2 - Admin+ PHP Objection Injection (CVSS 7.2, PublishPress Capabilities – User Role Access, Editor Permis…)
- [CVE-2022-3374](https://cve.now/CVE-2022-3374.md): Ocean Extra \< 2.0.5 - Admin+ PHP Objection Injection (CVSS 7.2, Ocean Extra)
- [CVE-2022-3380](https://cve.now/CVE-2022-3380.md): Customizer Export/Import \< 0.9.5 - Admin+ PHP Objection Injection (CVSS 7.2, Customizer Export/Import)
- [CVE-2022-3408](https://cve.now/CVE-2022-3408.md): WP Word Count \<= 3.2.3 - Admin+ Stored Cross-Site Scripting (CVSS 4.8, WP Word Count)
- [CVE-2022-3419](https://cve.now/CVE-2022-3419.md): Automatic User Roles Switcher \< 1.1.2 - Subscriber+ Privilege Escalation (CVSS 6.5, Automatic User Roles Switcher)
- [CVE-2022-3420](https://cve.now/CVE-2022-3420.md): Official Integration for Billingo \< 3.4.0 - ShopManager+ Stored XSS (CVSS 4.8, Official Integration for Billingo)
- [CVE-2022-3440](https://cve.now/CVE-2022-3440.md): Rock Convert \< 2.6.0 - Reflected Cross-Site Scripting (CVSS 6.1, Rock Convert)
- [CVE-2022-3441](https://cve.now/CVE-2022-3441.md): Rock Convert \< 2.11.0 - Admin+ Stored Cross-Site Scripting (CVSS 4.8, Rock Convert)
- [CVE-2022-3499](https://cve.now/CVE-2022-3499.md): An authenticated attacker could utilize the identical agent and cluster node linking keys to potentially allow for a scenario where unauthor (CVSS 6.5, Tenable Nessus)
- [CVE-2022-37620](https://cve.now/CVE-2022-37620.md): A Regular Expression Denial of Service (ReDoS) flaw was found in kangax html-minifier 4.0.0 because of the reCustomIgnore regular expression (CVSS 7.5, html-minifier)
- [CVE-2022-37623](https://cve.now/CVE-2022-37623.md): Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the shimPath variable (CVSS 9.8, browserify-shim)
- [CVE-2022-3765](https://cve.now/CVE-2022-3765.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 8.2, thorsten/phpmyfaq)
- [CVE-2022-3766](https://cve.now/CVE-2022-3766.md): Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq (CVSS 7.3, thorsten/phpmyfaq)
- [CVE-2022-3770](https://cve.now/CVE-2022-3770.md): Yunjing CMS upload\_img.html unrestricted upload (CVSS 6.3, Yunjing CMS)
- [CVE-2022-3771](https://cve.now/CVE-2022-3771.md): easyii CMS File Upload Management Upload.php file unrestricted upload (CVSS 6.3, easyii CMS · noumo/easyii)
- [CVE-2022-3774](https://cve.now/CVE-2022-3774.md): SourceCodester Train Scheduler App resource injection (CVSS 5.4, SourceCodester Train Scheduler App)
- [CVE-2022-3783](https://cve.now/CVE-2022-3783.md): node-red-dashboard ui\_text Format ui-component-ctrl.js cross site scripting (CVSS 3.5, node-red-dashboard)
- [CVE-2022-3784](https://cve.now/CVE-2022-3784.md): Axiomatic Bento4 mp4hls Ap4Mp4AudioInfo.cpp ReadBits heap-based overflow (CVSS 6.3, Axiomatic Bento4)
- [CVE-2022-3785](https://cve.now/CVE-2022-3785.md): Axiomatic Bento4 Avcinfo SetDataSize heap-based overflow (CVSS 6.3, Axiomatic Bento4)
- [CVE-2022-39294](https://cve.now/CVE-2022-39294.md): (DoS) Denial of Service from unchecked request length in conduit-hyper (CVSS 7.5, conduit-rust conduit-hyper · conduit-hyper)
- [CVE-2022-40471](https://cve.now/CVE-2022-40471.md): Remote Code Execution in Clinic's Patient Management System v 1.0 allows Attacker to Upload arbitrary php webshell via profile picture uploa (CVSS 9.8)
- [CVE-2022-40487](https://cve.now/CVE-2022-40487.md): ProcessWire v3.0.200 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the Search Users and Search Pages fun (CVSS 6.1, processwire/processwire)
- [CVE-2022-40488](https://cve.now/CVE-2022-40488.md): ProcessWire v3.0.200 was discovered to contain a Cross-Site Request Forgery (CSRF). (CVSS 6.5, processwire/processwire)
- [CVE-2022-40617](https://cve.now/CVE-2022-40617.md): strongSwan before 5.9.8 allows remote attackers to cause a denial of service in the revocation plugin by sending a crafted end-entity (and i (CVSS 7.5)
- [CVE-2022-43148](https://cve.now/CVE-2022-43148.md): rtf2html v0.2.0 was discovered to contain a heap overflow in the component /rtf2html/./rtf\_tools.h. (CVSS 5.5)
- [CVE-2022-43151](https://cve.now/CVE-2022-43151.md): timg v1.4.4 was discovered to contain a memory leak via the function timg::QueryBackgroundColor() at /timg/src/term-query.cc. (CVSS 5.5)
- [CVE-2022-43152](https://cve.now/CVE-2022-43152.md): tsMuxer v2.6.16 was discovered to contain a heap overflow via the function BitStreamWriter::flushBits() at /tsMuxer/bitStream.h. (CVSS 5.5)
- [CVE-2022-43752](https://cve.now/CVE-2022-43752.md): Oracle Solaris version 10 1/13, when using the Common Desktop Environment (CDE), is vulnerable to a privilege escalation vulnerability. (CVSS 7.8)
- [CVE-2022-44079](https://cve.now/CVE-2022-44079.md): pycdc commit 44a730f3a889503014fec94ae6e62d8401cb75e5 was discovered to contain a stack overflow via the component \_\_sanitizer::StackDepotBa (CVSS 5.5)
- [CVE-2022-44081](https://cve.now/CVE-2022-44081.md): Lodepng v20220717 was discovered to contain a segmentation fault via the function pngdetail. (CVSS 5.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-10-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.