CVEs published in October 2022
2,275 vulnerabilities, 287 critical, 9 exploited.
- bosch videojet multi 4000, videojet multi 4000 firmware +1 moreStored Cross Site Scripting (XSS) in VIDEOJET multi 40005.1 Medium
- bosch videojet multi 4000, videojet multi 4000 firmware +1 moreReflected Cross Site Scripting (XSS) in VIDEOJET multi 40005.8 Medium
- online pet shop we app project pet shop we appOnline Pet Shop We App v1.0 was discovered to contain an arbitrary file upload vulnerability via...7.2 High
- online pet shop we app project pet shop we appOnline Pet Shop We App v1.0 was discovered to contain an arbitrary file upload vulnerability via...7.2 High
- school activity updates with sms notification project activity updates with sms notificationSchool Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection...9.8 Critical
- pimcoreRCE vulnerability in Pimcore/Mail & Dynamic Text Layout9.8 Critical
- nextcloud enterprise server, server, kiteworks security-advisories +2 moreException logging in Sharepoint app reveals clear-text connection details4.0 Medium
- nextcloud enterprise server, server, kiteworks security-advisories +2 moreDatabase resource exhaustion for logged-in users via sharee recommendations with circles4.8 Medium
- nextcloud enterprise server, server, kiteworks security-advisories +2 moreProfile of disabled user stays accessible3.5 Low
- wireshark, fedoraproject fedora +1 moreCrash in the OPUS protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial of service via...6.3 Medium
- oretnom23 online medicine ordering systemSourceCodester Online Medicine Ordering System cross site scripting3.5 Low
- oretnom23 online medicine ordering systemSourceCodester Online Medicine Ordering System sql injection5.0 Medium
- hashicorp boundaryHashicorp Boundary vulnerable to clickjacking6.1 Medium
- samba, fedoraproject fedora +1 moreCVE-2022-3437 affecting package samba 4.12.5-76.5 Medium
- softrSoftr v2.0 was discovered to contain a Cross-Site Scripting (XSS) vulnerability via the First...6.1 Medium
- gl-inet gl-ax1800 firmware, gl-mt300n-v2 firmware +1 moregl-inet GL-MT300N-V2 Mango v3.212 and GL-AX1800 Flint v3.214 were discovered to contain multiple...6.8 Medium
- flutter, google llc dart, dart software development kit +2 moreIncorrect parsing of the backslash characters in Dart library9.8 Critical
- octopus serverIn affected versions of Octopus Server it is possible to reveal the existence of resources in a...5.3 Medium
- samba, fedoraproject fedora +1 moreA flaw was found in samba. A race condition in the password lockout code may lead to the risk of...5.9 Medium
- alivecor kardia, kardia app +1 moreCWE-302 Authentication Bypass by Assumed-Immutable Data in AliveCor Kardia App version 5.17.1...5.2 Medium
container-suseconnectopenSUSESecurity update for container-suseconnectNo score- cert vince, cert/cc vince - the vulnerability information and coordination environment +1 moreA Remote Code Injection vulnerability exists in CERT software prior to version 1.50.58.8 High
- cisco roomos software, roomos, telepresence collaboration endpoint +2 moreCisco TelePresence Collaboration Endpoint and RoomOS Software Vulnerabilities5.5 Medium
- cisco identity services engine, identity services engine software +1 moreCisco Identity Services Engine Cross-Site Scripting Vulnerability6.1 Medium
- cisco roomos software, roomos, telepresence collaboration endpoint +2 moreCisco TelePresence Collaboration Endpoint and RoomOS Software Vulnerabilities5.5 Medium
- cisco roomos software, roomos, telepresence collaboration endpoint +2 moreCisco TelePresence Collaboration Endpoint and RoomOS Software Vulnerabilities5.5 Medium
- cisco roomos software, roomos, telepresence collaboration endpoint +2 moreCisco TelePresence Collaboration Endpoint and RoomOS Software Vulnerabilities5.5 Medium
- cisco meraki mx firmware, meraki mx100 firmware, meraki mx105 firmware +21 more +23 moreCisco Meraki MX and Z3 Teleworker Gateway VPN Denial of Service Vulnerability8.6 High
- cisco identity services engine, identity services engine software +1 moreCisco Identity Services Engine Unauthorized File Access Vulnerability7.1 High
- cisco roomos software, roomos, telepresence collaboration endpoint +2 moreCisco TelePresence Collaboration Endpoint and RoomOS Software Vulnerabilities5.5 Medium
- synology presto file serverImproper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in...5.8 Medium
- synology presto file serverImproper privilege management vulnerability in summary report management in Synology Presto File...4.3 Medium
- opensuse factory, suse opensuse factory +1 moresendmail: mail to root privilege escalation via sm-client.pre script7.7 High
- haxx curl, apple macos, netapp clustered data ontap +8 more +10 morecurl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095...6.5 Medium
- haxx curl, apple macos, fedoraproject fedora +4 more +6 moreIn curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using...7.5 High
- haxx curl, apple macos, fedoraproject fedora +9 more +11 morecurl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a...8.1 High
- haxx curl, apple macos, debian linux +9 more +11 moreWhen doing HTTP(S) transfers, libcurl might erroneously use the read callback (...9.8 Critical
- hyperdown project hyperdownCross-site Scripting (XSS)5.4 Medium
ghostscriptOSS-FuzzStack-use-after-return in gs_type2_interpretNo scorejackson-databindOSS-FuzzSecurity exception in jaz.Zer.<clinit>No scorewordpressDebianwordpress - security updateNo scorelibdatetime-timezone-perlDebianlibdatetime-timezone-perl - new timezone databaseNo scoretzdataDebiantzdata - new timezone databaseNo score- google chromeInappropriate implementation in Autofill in Google Chrome prior to 107.0.5304.62 allowed a remote...5.4 Medium
- google chromeInappropriate implementation in XML in Google Chrome prior to 107.0.5304.62 allowed a remote...6.3 Medium
- google chromeInappropriate implementation in iFrame Sandbox in Google Chrome prior to 107.0.5304.62 allowed a...4.3 Medium
- metabaseThe url parameter of the /api/geojson endpoint in Metabase versions <44.5 can be used to perform...6.5 Medium
- deltaww diaenergieThe HICT_Loop class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that could...9.8 Critical
- deltaww diaenergieThe HandlerPageP_KID class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that...9.8 Critical
- apache iotdbApache IoTDB prior to 0.13.3 allows DoS7.5 High
- Show moreLoading…