Skip to content
OpenAdvisories

Archive

October 2022

Vulnerabilities first published in this month (UTC), newest first.

← September 2022 2022 / October November 2022 →
  1. 11
  2. 22
  3. 350
  4. 4 
  5. 5 
  6. 669
  7. 7117
  8. 83
  9. 95
  10. 1051
  11. 11269
  12. 1271
  13. 1364
  14. 14186
  15. 154
  16. 167
  17. 17123
  18. 18160
  19. 19128
  20. 2035
  21. 2159
  22. 221
  23. 23 
  24. 2437
  25. 25123
  26. 2656
  27. 2757
  28. 2884
  29. 2910
  30. 303
  31. 3190
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • Critical 9.8
    CVE-2022-31692 Public exploit

    Spring Security authorization rules can be bypassed via forward or include dispatcher types

    Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: The application expe…

    libspring-java org.springframework.security:spring-security-core Ubuntu Maven
  • Critical 9.8
    CVE-2022-40471 Public exploit EPSS 28%

    Remote Code Execution in Clinic's Patient Management System v 1.0 allows Attacker to Upload arbitrary php webshell via …

  • Critical 9.8
    CVE-2022-38580 Public exploit EPSS 16%

    Skipper vulnerable to SSRF via X-Skipper-Proxy

    Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF).

    github.com/zalando/skipper Go
  • Critical 9.8
    CVE-2022-37298 Public exploit

    Shinken Solutions Shinken Monitoring vulnerable to Incorrect Access Control

    Shinken Solutions Shinken Monitoring Version 2.4.3 affected is vulnerable to Incorrect Access Control. The SafeUnpickler class found in shinken/safepickle.py implements a weak authentication scheme when unserializing objects passed from monitoring nodes to th…

    shinken PyPI
  • Critical 9.8
    CVE-2016-20017 Exploited Public exploit EPSS 66%

    D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as…

    KEV Jan 8, 2024
  • Critical 9.8
    CVE-2016-20016 Public exploit EPSS 86%

    MVPower CCTV DVR models, including TV-7104HE 1.8.4 115215B9 and TV7108HE, contain a web shell that is accessible via a …

  • Critical 9.8
    CVE-2022-40684 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 a…

    Fortinet Fortinet FortiOS, FortiProxy, FortiSwitchManager Network devices
    KEV Oct 11, 2022
  • Critical 9.8
    CVE-2022-21587 Exploited · Ransomware Public exploit Scanner template EPSS 98%

    Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload).…

    Oracle Web Applications Desktop Integrator
    KEV Feb 2, 2023
  • Critical 9.9
    CVE-2022-2992 Public exploit EPSS 86%

    A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allow…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Critical 9.9
    CVE-2022-2884 Public exploit EPSS 76%

    A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Critical 10.0
    CVE-2022-35698 Public exploit EPSS 15%

    Adobe Commerce Stored XSS Arbitrary code execution

    Adobe Commerce versions 2.4.4-p1 (and earlier) and 2.4.5 (and earlier) are affected by a Stored Cross-site Scripting vulnerability. Exploitation of this issue does not require user interaction and could result in a post-authentication arbitrary code execution.

    Adobe Magento Commerce magento/community-edition magento/project-community-edition Web / CMS Packagist
  • Critical 9.8
    CVE-2022-42889 Public exploit EPSS 100%

    Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults

    Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.String…

    Apache Software Foundation Apache Commons Text com.guicedee.services:commons-text commons-text Debian Ubuntu Maven