CVEs published in October 2022
2,275 vulnerabilities, 287 critical, 9 exploited.
- lodev lodepngLodepng v20220717 was discovered to contain a segmentation fault via the function pngdetail.5.5 Medium
- pycdc project pycdcpycdc commit 44a730f3a889503014fec94ae6e62d8401cb75e5 was discovered to contain a stack overflow...5.5 Medium
- common desktop environment project common desktop environment** UNSUPPORTED WHEN ASSIGNED ** Oracle Solaris version 10 1/13, when using the Common Desktop...7.8 High
- tsmuxer project tsmuxertsMuxer v2.6.16 was discovered to contain a heap overflow via the function BitStreamWriter:...5.5 Medium
- hzeller timgtimg v1.4.4 was discovered to contain a memory leak via the function timg::QueryBackgroundColor()...5.5 Medium
- rtf2html project rtf2htmlrtf2html v0.2.0 was discovered to contain a heap overflow in the component /rtf2html/./rtf_tools.h.5.5 Medium
- processwireProcessWire vulnerable to Cross-Site Request Forgery6.5 Medium
- processwireProcessWire vulnerable to Cross-site Scripting6.1 Medium
- oretnom23 clinic\'s patient management systemRemote Code Execution in Clinic's Patient Management System v 1.0 allows Attacker to Upload...9.8 Critical
- tuxera ntfs-3g, debian linux, fedoraproject fedora +2 moreImportant: virt:rhel and virt-devel:rhel security and bug fix update7.8 High
- axiomatic bento4Axiomatic Bento4 Avcinfo SetDataSize heap-based overflow6.3 Medium
- axiomatic bento4Axiomatic Bento4 mp4hls Ap4Mp4AudioInfo.cpp ReadBits heap-based overflow6.3 Medium
- nodered node-red-dashboardnode-red-dashboard ui_text Format ui-component-ctrl.js cross site scripting3.5 Low
- sourcecodester train scheduler app, train scheduler app project scheduler app +1 moreSourceCodester Train Scheduler App resource injection5.4 Medium
- easyii cms, easyiicms +1 moreeasyii CMS File Upload Management Upload.php file unrestricted upload6.3 Medium
- statamic cms, xjyunjing yunjing content management system +1 moreYunjing CMS upload_img.html unrestricted upload6.3 Medium
- phpmyfaq, thorsten thorsten/phpmyfaq +1 moreCross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq7.3 High
- phpmyfaq, thorsten thorsten/phpmyfaq +1 moreCross-site Scripting (XSS) - Stored in thorsten/phpmyfaq8.2 High
- browserify-shim project browserify-shimthlorenz browserify-shim vulnerable to prototype pollution9.8 Critical
- kangax html-minifier, terser html-minifier-terser +1 morekangax html-minifier REDoS vulnerability7.5 High
- linux kernel, redhat enterprise linux +1 moreA double-free memory flaw was found in the Linux kernel. The Intel GVT-g graphics driver triggers...5.5 Medium
- linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +1 moreA buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver. This issue...6.6 Medium
- tenable nessus, tenable, inc. tenable nessus +1 moreAn authenticated attacker could utilize the identical agent and cluster node linking keys to...6.5 Medium
- rock content convert, rockcontent rock convert +1 moreRock Convert < 2.11.0 - Admin+ Stored Cross-Site Scripting4.8 Medium
- rock content convert, rockcontent rock convert +1 moreRock Convert < 2.6.0 - Reflected Cross-Site Scripting6.1 Medium
- billingo official integration for billingo, official integration for billingo project integration for billingo +1 moreOfficial Integration for Billingo < 3.4.0 - ShopManager+ Stored XSS4.8 Medium
- addify automatic user roles switcherAutomatic User Roles Switcher < 1.1.2 - Subscriber+ Privilege Escalation6.5 Medium
- redlettuce wp word countWP Word Count <= 3.2.3 - Admin+ Stored Cross-Site Scripting4.8 Medium
- unknown customizer export/import, fastlinemedia customizer export\/import +1 moreCustomizer Export/Import < 0.9.5 - Admin+ PHP Objection Injection7.2 High
- oceanwp ocean extraOcean Extra < 2.0.5 - Admin+ PHP Objection Injection7.2 High
- publishpress capabilities, unknown publishpress capabilities pro, publishpress capabilities – user role access, editor permissions, admin menus +2 morePublishPress Capabilities < 2.5.2 - Admin+ PHP Objection Injection7.2 High
- thimpress learnpress, learnpress – wordpress lms plugin +1 moreLearnPress < 4.1.7.2 - Unauthenticated PHP Object Injection via REST API8.1 High
- nextendweb smart slider 3Smart Slider 3 < 3.5.1.11 - PHP Object Injection8.8 High
- unknown easy wp smtpEasy WP SMTP < 1.5.0 - Admin+ PHP Objection Injection7.2 High
- strategy11 awp classifieds, unknown wordpress classifieds plugin – ad directory & listings by awp classifieds +1 moreAWP Classifieds Plugin < 4.3 - Unauthenticated SQLi9.8 Critical
- unknown wp contact sliderWP Contact Slider < 2.4.8 - Admin+ Stored Cross-Site Scripting4.8 Medium
- vmware spring security, netapp active iq unified manager +1 moreSpring Security authorization rules can be bypassed via forward or include dispatcher types9.8 Critical
- spring security, vmware spring security, netapp active iq unified manager +2 morespring-security-oauth2-client vulnerable to Privilege Escalation8.1 High
- phpOOB read due to insufficient input validation in imageloadfont()6.5 Medium
- unknown wp total hacks, wp total hacks project total hacks +1 moreWP Total Hacks <= 4.7.2 - Subscriber+ Arbitrary Options Update to Stored XSS5.4 Medium
- sick flx3-cpuc1 firmware, flx3-cpuc2 firmware +1 moreA remote unprivileged attacker can interact with the configuration interface of a Flexi-Compact...9.1 Critical
- tagdiv newspaperNewspaper < 12 - Reflected Cross-Site Scripting6.1 Medium
- enviragallery envira gallery, smub gallery plugin for wordpress – envira photo gallery +1 moreEnvira Gallery Lite < 1.8.4.7 - Reflected Cross-Site Scripting6.1 Medium
- tagdiv newspaperNewspaper < 12 - Reflected Cross-Site Scripting6.1 Medium
- mt ind780 firmwareA remote, unauthenticated, directory traversal vulnerability was identified within the web...7.5 High
- xfig project xfigxfig 3.2.7 is vulnerable to Buffer Overflow.9.8 Critical
- dlink dir-846 firmwareD-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary code as...9.8 Critical
cactiopenSUSE,cacti-spineopenSUSE +1 moreSecurity update for cacti, cacti-spineNo score- conduit-hyper project conduit-hyper(DoS) Denial of Service from unchecked request length in conduit-hyper7.5 High
distro-info-dataDebiandistro-info-data - database updateNo score- Show moreLoading…