Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: October 2022

65 records · 8 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2022-41040
    95Now

    Microsoft Exchange Server Elevation of Privilege Vulnerability

    HighCVSS 8.8KEVWeaponizedEPSS 99%

    microsoft · exchange serverOct 2, 2022

  • CVE-2022-41082
    92Now

    Microsoft Exchange Server Remote Code Execution Vulnerability

    HighCVSS 8.0KEVWeaponizedEPSS 99%

    microsoft · exchange serverOct 2, 2022

  • CVE-2022-31680
    46Plan

    The vCenter Server contains an unsafe deserialisation vulnerability in the PSC (Platform services controller).

    CriticalCVSS 9.1No exploitEPSS 33%

    vmware · vcenter serverOct 7, 2022

  • CVE-2022-36635
    40Plan

    ZKteco ZKBioSecurity V5000 4.1.3 was discovered to contain a SQL injection vulnerability via the component /baseOpLog.do.

    HighCVSS 8.8No exploitEPSS 17%

    zkteco · zkbiosecurity v5000Oct 7, 2022

  • CVE-2022-39288
    48Plan

    Denial of service in Fastify via Content-Type header

    HighCVSS 7.5No exploitEPSS 59%

    fastify · fastifyOct 10, 2022

  • CVE-2022-32174
    53Plan

    In Gogs, versions v0.6.5 through v0.12.10 are vulnerable to Stored Cross-Site Scripting (XSS) that leads to an account takeover.

    CriticalCVSS 9.0No exploitEPSS 58%

    gogs · gogsOct 11, 2022

  • CVE-2022-3358
    31Monitor

    Using a Custom Cipher with NID_undef may lead to NULL encryption

    HighCVSS 7.5WeaponizedEPSS 4%

    openssl · opensslOct 11, 2022

  • CVE-2022-34689
    41Plan

    Windows CryptoAPI Spoofing Vulnerability

    HighCVSS 7.5No exploitEPSS 37%

    microsoft · windows 10Oct 11, 2022

  • CVE-2022-35829
    25Monitor

    Service Fabric Explorer Spoofing Vulnerability

    MediumCVSS 4.8No exploitEPSS 18%

    microsoft · azure service fabricOct 11, 2022

  • CVE-2022-37974
    37Monitor

    Windows Mixed Reality Developer Tools Information Disclosure Vulnerability

    MediumCVSS 6.5No exploitEPSS 36%

    microsoft · windows 10Oct 11, 2022

  • CVE-2022-37985
    34Monitor

    Windows Graphics Component Information Disclosure Vulnerability

    MediumCVSS 5.5No exploitEPSS 38%

    microsoft · windows 10Oct 11, 2022

  • CVE-2022-38028
    65This week

    Windows Print Spooler Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 14%

    microsoft · windows 10 1507Oct 11, 2022

  • CVE-2022-38044
    48Plan

    Windows CD-ROM File System Driver Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 56%

    microsoft · windows 10Oct 11, 2022

  • CVE-2022-38053
    58Plan

    Microsoft SharePoint Server Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 76%

    microsoft · sharepoint enterprise serverOct 11, 2022

  • CVE-2022-41033
    62This week

    Windows COM+ Event System Service Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 1%

    microsoft · windows 10 1507Oct 11, 2022

  • CVE-2022-41034
    51Plan

    Visual Studio Code Remote Code Execution Vulnerability

    HighCVSS 7.8WeaponizedEPSS 67%

    microsoft · visual studio codeOct 11, 2022

  • CVE-2022-40871
    49Plan

    Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection.

    CriticalCVSS 9.8No exploitEPSS 33%

    dolibarr · dolibarr erp\/crmOct 12, 2022

  • CVE-2022-42897
    39Monitor

    Array Networks AG/vxAG with ArrayOS AG before 9.4.0.469 allows unauthenticated command injection that leads to privilege escalation and cont

    CriticalCVSS 9.8No exploitEPSS 1%

    arraynetworks · arrayos agOct 12, 2022

  • CVE-2022-24697
    64This week

    Apache Kylin prior to 4.0.2 allows command injection when the configuration overwrites function overwrites system parameters

    CriticalCVSS 9.8No exploitEPSS 84%

    apache · kylinOct 13, 2022

  • CVE-2022-42889
    69This week

    Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults

    CriticalCVSS 9.8WeaponizedEPSS 99%

    apache · commons textOct 13, 2022

  • CVE-2022-35690
    61This week

    Adobe ColdFusion ODBC Agent Stack-based Buffer Overflow Remote Code Execution Vulnerability

    CriticalCVSS 9.8No exploitEPSS 72%

    adobe · coldfusionOct 14, 2022

  • CVE-2022-35698
    25Monitor

    Adobe Commerce Stored XSS Arbitrary code execution

    MediumCVSS 5.4Proof of conceptEPSS 14%

    adobe · commerceOct 14, 2022

  • CVE-2022-35710
    52Plan

    Adobe ColdFusion ODBC Server Stack-based Buffer Overflow Remote Code Execution Vulnerability

    CriticalCVSS 9.8No exploitEPSS 43%

    adobe · coldfusionOct 14, 2022

  • CVE-2022-35711
    61This week

    Adobe ColdFusion ODBC Server Heap-based Buffer Overflow Remote Code Execution Vulnerability

    CriticalCVSS 9.8No exploitEPSS 73%

    adobe · coldfusionOct 14, 2022

  • CVE-2022-35712
    50Plan

    Adobe ColdFusion ODBC Agent Heap-based Buffer Overflow Remote Code Execution Vulnerability

    CriticalCVSS 9.8No exploitEPSS 37%

    adobe · coldfusionOct 14, 2022

  • CVE-2022-38418
    63This week

    Adobe ColdFusion Application Server Directory Traversal Remote Code Execution Vulnerability

    CriticalCVSS 9.8No exploitEPSS 80%

    adobe · coldfusionOct 14, 2022

  • CVE-2022-38419
    46Plan

    Adobe ColdFusion Solr Service XML External Entity Processing Arbitrary file system read

    HighCVSS 7.5No exploitEPSS 53%

    adobe · coldfusionOct 14, 2022

  • CVE-2022-38420
    43Plan

    Adobe ColdFusion Use of Hard-coded Credentials Application denial-of-service

    HighCVSS 7.5No exploitEPSS 44%

    adobe · coldfusionOct 14, 2022

  • CVE-2022-38421
    52Plan

    Adobe ColdFusion Application Server Directory Traversal Remote Code Execution Vulnerability

    HighCVSS 7.2No exploitEPSS 79%

    adobe · coldfusionOct 14, 2022

  • CVE-2022-38422
    43Plan

    Adobe ColdFusion Application Server Directory Traversal Information Disclosure Vulnerability

    HighCVSS 7.5No exploitEPSS 44%

    adobe · coldfusionOct 14, 2022

  • CVE-2022-38423
    33Monitor

    Adobe ColdFusion Application Server Directory Traversal Information Disclosure Vulnerability

    MediumCVSS 4.9No exploitEPSS 45%

    adobe · coldfusionOct 14, 2022

  • CVE-2022-38424
    42Plan

    Adobe ColdFusion Application Server Directory Traversal Arbitrary file system write

    HighCVSS 7.2No exploitEPSS 45%

    adobe · coldfusionOct 14, 2022

  • CVE-2022-42340
    40Plan

    Adobe ColdFusion Improper Input Validation Arbitrary file system read

    HighCVSS 7.5No exploitEPSS 34%

    adobe · coldfusionOct 14, 2022

  • CVE-2022-42341
    41Plan

    Adobe ColdFusion Improper Restriction of XML External Entity Reference Arbitrary file system read

    HighCVSS 7.5No exploitEPSS 36%

    adobe · coldfusionOct 14, 2022

  • CVE-2022-2884
    62This week

    A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an auth

    CriticalCVSS 9.9Proof of conceptEPSS 75%

    gitlab · gitlabOct 17, 2022

  • CVE-2022-2992
    65This week

    A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated us

    CriticalCVSS 9.9WeaponizedEPSS 86%

    gitlab · gitlabOct 17, 2022

  • CVE-2022-3552
    41Plan

    Unrestricted Upload of File with Dangerous Type in boxbilling/boxbilling

    HighCVSS 7.2Proof of conceptEPSS 44%

    boxbilling · boxbillingOct 17, 2022

  • CVE-2022-3569
    31Monitor

    Due to an issue with incorrect sudo permissions, Zimbra Collaboration Suite (ZCS) suffers from a local privilege escalation issue in version

    HighCVSS 7.8WeaponizedEPSS 0%

    synacor · zimbra collaboration suiteOct 17, 2022

  • CVE-2022-40684
    99Now

    An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    fortinet · fortiproxyOct 18, 2022

  • CVE-2022-41544
    43Plan

    GetSimple CMS v3.3.16 was discovered to contain a remote code execution (RCE) vulnerability via the edited_file parameter in admin/theme-edi

    CriticalCVSS 9.8Proof of conceptEPSS 14%

    get-simple · getsimple cmsOct 18, 2022

  • CVE-2022-21587
    99Now

    Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload).

    CriticalCVSS 9.8KEVWeaponizedEPSS 98%

    oracle · e-business suiteOct 18, 2022

  • CVE-2022-39428
    50Plan

    Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload).

    CriticalCVSS 9.8No exploitEPSS 37%

    oracle · web applications desktop integratorOct 18, 2022

  • CVE-2016-20016
    65This week

    MVPower CCTV DVR models, including TV-7104HE 1.8.4 115215B9 and TV7108HE, contain a web shell that is accessible via a /shell URI.

    CriticalCVSS 9.8WeaponizedEPSS 86%

    mvpower · tv-7104he firmwareOct 19, 2022

  • CVE-2016-20017
    89Now

    D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wil

    CriticalCVSS 9.8KEVWeaponizedEPSS 66%

    dlink · dsl-2750b firmwareOct 19, 2022

  • CVE-2022-42233
    52Plan

    Tenda 11N with firmware version V5.07.33_cn suffers from an Authentication Bypass vulnerability.

    CriticalCVSS 9.8Proof of conceptEPSS 43%

    tenda · 11n firmwareOct 20, 2022

  • CVE-2022-36957
    32Monitor

    SolarWinds Platform Deserialization of Untrusted Data

    HighCVSS 7.2No exploitEPSS 14%

    solarwinds · orion platformOct 20, 2022

  • CVE-2022-36958
    59Plan

    SolarWinds Platform Deserialization of Untrusted Data

    HighCVSS 8.8No exploitEPSS 81%

    solarwinds · orion platformOct 20, 2022

  • CVE-2022-38108
    48Plan

    SolarWinds Platform Deserialization of Untrusted Data

    HighCVSS 7.2WeaponizedEPSS 65%

    solarwinds · orion platformOct 20, 2022

  • CVE-2022-38580
    43Plan

    Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF).

    CriticalCVSS 9.8Proof of conceptEPSS 11%

    zalando · skipperOct 25, 2022

  • CVE-2022-41704
    31Monitor

    Apache Batik prior to 1.16 allows RCE when loading untrusted SVG input

    HighCVSS 7.5No exploitEPSS 2%

    apache · batikOct 25, 2022

  • CVE-2022-38181
    69This week

    The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled.

    HighCVSS 8.8KEVWeaponizedEPSS 14%

    arm · bifrost gpu kernel driverOct 25, 2022

  • CVE-2022-20811
    28Monitor

    Cisco TelePresence Collaboration Endpoint and RoomOS Software Vulnerabilities

    HighCVSS 7.2No exploitEPSS 0%

    cisco · telepresence collaboration endpointOct 26, 2022

  • CVE-2022-43775
    45Plan

    The HICT_Loop class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that could allow an attacker to gain code execution on

    CriticalCVSS 9.8No exploitEPSS 20%

    deltaww · diaenergieOct 26, 2022

  • CVE-2022-31898
    32Monitor

    gl-inet GL-MT300N-V2 Mango v3.212 and GL-AX1800 Flint v3.214 were discovered to contain multiple command injection vulnerabilities via the p

    MediumCVSS 6.8Proof of conceptEPSS 15%

    gl-inet · gl-mt300n-v2 firmwareOct 27, 2022

  • CVE-2022-3387
    25Monitor

    Advantech R-SeeNet Versions 2.4.19 and prior are vulnerable to path traversal attacks.

    MediumCVSS 5.3No exploitEPSS 13%

    advantech · r-seenetOct 27, 2022

  • CVE-2022-40965
    24Monitor

    Delta Electronics DIAEnergie

    MediumCVSS 5.4No exploitEPSS 11%

    deltaww · diaenergieOct 27, 2022

  • CVE-2022-41133
    43Plan

    Delta Electronics DIAEnergie

    HighCVSS 8.8No exploitEPSS 26%

    deltaww · diaenergieOct 27, 2022

  • CVE-2022-41555
    24Monitor

    Delta Electronics DIAEnergie

    MediumCVSS 5.4No exploitEPSS 11%

    deltaww · diaenergieOct 27, 2022

  • CVE-2022-41651
    24Monitor

    Delta Electronics DIAEnergie

    MediumCVSS 5.4No exploitEPSS 11%

    deltaww · diaenergieOct 27, 2022

  • CVE-2022-41701
    24Monitor

    Delta Electronics DIAEnergie

    MediumCVSS 5.4No exploitEPSS 11%

    deltaww · diaenergieOct 27, 2022

  • CVE-2022-41702
    24Monitor

    Delta Electronics DIAEnergie

    MediumCVSS 5.4No exploitEPSS 11%

    deltaww · diaenergieOct 27, 2022

  • CVE-2022-40471
    46Plan

    Remote Code Execution in Clinic's Patient Management System v 1.0 allows Attacker to Upload arbitrary php webshell via profile picture uploa

    CriticalCVSS 9.8WeaponizedEPSS 22%

    oretnom23 · clinic\'s patient management systemOct 31, 2022

  • CVE-2022-38142
    44Plan

    Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize user-supplied data provided through the Device-Gateway

    CriticalCVSS 9.8No exploitEPSS 18%

    deltaww · infrasuite device masterOct 31, 2022

  • CVE-2022-41657
    45Plan

    Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior allow attacker provided data already serialized into memory to be u

    CriticalCVSS 9.8No exploitEPSS 20%

    deltaww · infrasuite device masterOct 31, 2022

  • CVE-2022-41772
    46Plan

    Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior mishandle .ZIP archives containing characters used in path traversa

    CriticalCVSS 9.8No exploitEPSS 24%

    deltaww · infrasuite device masterOct 31, 2022