CVEs published in October 2022
2,275 vulnerabilities, 287 critical, 9 exploited.
- abode systems, inc. iota all-in-one security kit, goabode iota all-in-one security kit firmware +1 moreA hard-coded password vulnerability exists in the telnet functionality of Abode Systems, Inc....9.8 Critical
- abode systems, inc. iota all-in-one security kit, goabode iota all-in-one security kit firmware +1 moreAn OS command injection vulnerability exists in the console_main_loop :sys functionality of Abode...8.1 High
- abode systems, inc. iota all-in-one security kit, goabode iota all-in-one security kit firmware +1 moreAn authentication bypass vulnerability exists in the web interface /action/factory* functionality...8.6 High
- abode systems, inc. iota all-in-one security kit, goabode iota all-in-one security kit firmware +1 moreAn information disclosure vulnerability exists in the XFINDER functionality of Abode Systems, Inc...4.7 Medium
- abode systems, inc. iota all-in-one security kit, goabode iota all-in-one security kit firmware +1 moreAn OS command injection vulnerability exists in the web interface util_set_serial_mac...10.0 Critical
- abode systems, inc. iota all-in-one security kit, goabode iota all-in-one security kit firmware +1 moreAn authentication bypass vulnerability exists in the GHOME control functionality of Abode Systems...9.8 Critical
- abode systems, inc. iota all-in-one security kit, goabode iota all-in-one security kit firmware +1 moreAn os command injection vulnerability exists in the web interface util_set_abode_code...8.0 High
- esri arcgis serverBUG-000150540 - Reflected XSS vulnerability in ArcGIS Server6.1 Medium
- esri arcgis serverBUG-000150537 - ArcGIS Server has a local file inclusion (LFI) vulnerability6.5 Medium
- esri arcgis serverBUG-000148347 Unvalidated redirect issues in ArcGIS Server.6.1 Medium
- esri arcgis serverBUG-000146513 - Reflected XSS vulnerability in ArcGIS Server6.1 Medium
- esri arcgis serverBUG-000144172 - Remote file download issue in ArcGIS Server6.1 Medium
- esri arcgis serverBUG-000142376 - Reflected Cross-Site Scripting (XSS) vulnerability in ArcGIS Server.6.1 Medium
- synology diskstation manager (dsm), diskstation manager +1 moreServer-Side Request Forgery (SSRF) vulnerability in Package Center functionality in Synology...4.1 Medium
- synology diskstation manager (dsm), diskstation manager +1 moreMissing authentication for critical function vulnerability in iSCSI management functionality in...7.4 High
- algosec fireflow, fireflow a32.0, fireflow a32.10 +1 more +3 moreAlgoSec – FireFlow Reflected Cross-Site-Scripting (RXSS)6.5 Medium
librawOSS-FuzzHeap-buffer-overflow in LibRaw::kodak_rgb_load_rawNo scoregstreamerOSS-FuzzHeap-buffer-overflow in parse_subripNo scorelibblurayDebianlibbluray - bugfix updateNo score- oracle mysql, oracle corporation mysql server +1 moreVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). ...4.9 Medium
- apache batik, apache software foundation xml graphics, debian linux +2 moreApache Batik prior to 1.16 allows RCE via scripting7.5 High
- uasoft badasoBadaso vulnerable to Remote Code Execution via malicious file upload9.8 Critical
- apache batik, apache software foundation xml graphics, debian linux +2 moreApache Batik prior to 1.16 allows RCE when loading untrusted SVG input7.5 High
- evm project evmevm has incorrect is_static parameter for custom stateful precompiles5.9 Medium
- dependencytrack dependency-trackDependency-Track vulnerable to logging of API keys in clear text when handling API requests using keys with insufficient permissions4.4 Medium
- dependencytrack frontend, owasp dependency-track frontend +1 more@dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via Vulnerability Details5.4 Medium
- tasksTasks.org vulnerable to data exfiltration by malicous app or adb5.5 Medium
- flipped-aurora gin-vue-adminGin-vue-admin arbitrary file upload vulnerability caused by path traversal9.8 Critical
- openfgaOpenFGA Authorization Bypass5.9 Medium
- openfgaOpenFGA Authorization Bypass5.9 Medium
- openfgaOpenFGA Information Disclosure5.3 Medium
- azure azure-cli, microsoft azure command-line interface +1 moreImproper Control of Generation of Code ('Code Injection') in Azure CLI8.1 High
- actions runnerGitHub Actions Runner vulnerable to Docker Command Escaping8.8 High
- free5gcFree5gc v3.2.1 is vulnerable to Information disclosure.7.5 High
- arm bifrost gpu kernel driver, mali graphics processing unit (gpu), midgard gpu kernel driver +1 more +3 moreAn Arm product family through 2022-08-12 mail GPU kernel driver allows non-privileged users to...8.8 High
- withsecure f-secure policy managerReflected cross-site scripting (XSS) vulnerabilities in WithSecure through 2022-08-10) exists...6.1 Medium
- mitel micollabA vulnerability in the MiCollab Client API of Mitel MiCollab through 9.5.0.101 could allow an...6.5 Medium
- mitel micollabA vulnerability in the MiCollab Client API of Mitel MiCollab 9.1.3 through 9.5.0.101 could allow...8.8 High
- mitel micollabA vulnerability in the web conferencing component of Mitel MiCollab through 9.5.0.101 could allow...9.8 Critical
- mitel micollabA vulnerability in the MiCollab Client server component of Mitel MiCollab through 9.5.0.101 could...8.8 High
- pulpproject pulp ansible, redhat ansible automation platform, satellite +1 more +3 morePlaintext storage of tokens in pulp_ansible5.5 Medium
- paessler prtg network monitorPRTG Network Monitor through 22.2.77.2204 does not prevent custom input for a device’s icon,...5.3 Medium
- webmin userminUsermin through 1.850 allows a remote authenticated user to execute OS commands via command...8.8 High
- apache geodeApache Geode stored Cross-Site Scripting (XSS) via data injection vulnerability in Pulse web application5.4 Medium
- soflyy wp all export, unknown wp all export pro +1 moreWP All Export Pro < 1.7.9 - Authenticated SQLi8.8 High
- soflyy wp all export, unknown wp all export pro +1 moreWP All Export Pro < 1.7.9 - Authenticated Code Injection7.2 High
- bestwebsoft post to csv, unknown post to csv by bestwebsoft +1 morePost to CSV by BestWebSoft <= 1.4.0 - Author+ CSV Injection9.8 Critical
- unknown wp humans.txt, wp humans.txt project humans.txt +1 moreWP Humans.txt <= 1.0.6 - Admin+ Stored Cross-Site Scripting4.8 Medium
- retain live chat, unknown retain live chat +1 moreRetain Live Chat <= 0.1 - Admin+ Stored Cross-Site Scripting4.8 Medium
- tech-banker contact bank, unknown contact bank – contact form builder for wordpress +1 moreContact Bank <= 3.0.30 - Admin+ Stored Cross-Site Scripting4.8 Medium
- Show moreLoading…