CISA Bulletins - Vulnerability Summary for the Week of September 26, 2022

CISA · Oct 5, 2022

Original release date: October 3, 2022 | Last revised: October 5, 2022

High Vulnerabilities

Primary Vendor -- Product	Description	Published	CVSS Score	Source & Patch Info
acer -- altos_t110_f3	There is a stack buffer overflow vulnerability, which could lead to arbitrary code execution in UEFI DXE driver on some Acer products. An attack could exploit this vulnerability to escalate privilege from ring 3 to ring 0, and hijack control flow during UEFI DXE execution. This affects Altos T110 F3 firmware version <= P13 (latest) and AP130 F2 firmware version <= P04 (latest) and Aspire 1600X firmware version <= P11.A3L (latest) and Aspire 1602M firmware version <= P11.A3L (latest) and Aspire 7600U firmware version <= P11.A4 (latest) and Aspire MC605 firmware version <= P11.A4L (latest) and Aspire TC-105 firmware version <= P12.B0L (latest) and Aspire TC-120 firmware version <= P11-A4 (latest) and Aspire U5-620 firmware version <= P11.A1 (latest) and Aspire X1935 firmware version <= P11.A3L (latest) and Aspire X3475 firmware version <= P11.A3L (latest) and Aspire X3995 firmware version <= P11.A3L (latest) and Aspire XC100 firmware version <= P11.B3 (latest) and Aspire XC600 firmware version <= P11.A4 (latest) and Aspire Z3-615 firmware version <= P11.A2L (latest) and Veriton E430G firmware version <= P21.A1 (latest) and Veriton B630_49 firmware version <= AAP02SR (latest) and Veriton E430 firmware version <= P11.A4 (latest) and Veriton M2110G firmware version <= P21.A3 (latest) and Veriton M2120G fir.	2022-09-23	7.8	CVE-2022-30426 MISC MISC MISC
advantech -- iview	An SQL injection vulnerability in Advantech iView 5.7.04.6469. The specific flaw exists within the ConfigurationServlet endpoint, which listens on TCP port 8080 by default. An unauthenticated remote attacker can craft a special column_value parameter in the setConfiguration action to bypass checks in com.imc.iview.utils.CUtils.checkSQLInjection() to perform SQL injection. For example, the attacker can exploit the vulnerability to retrieve the iView admin password.	2022-09-27	7.5	CVE-2022-3323 MISC
apache -- pinot	In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support. In order to avoid this, we disabled the groovy function support by default from Pinot release 0.11.0. See https://docs.pinot.apache.org/basics/releases/0.11.0	2022-09-23	9.8	CVE-2022-26112 CONFIRM
apple -- ipad_os	An out-of-bounds read was addressed with improved input validation. This issue is fixed in iCloud for Windows 11.4, iOS 14.0 and iPadOS 14.0, watchOS 7.0, tvOS 14.0, iCloud for Windows 7.21, iTunes for Windows 12.10.9. Processing a maliciously crafted tiff file may lead to a denial-of-service or potentially disclose memory contents.	2022-09-23	7.1	CVE-2020-36521 MISC MISC MISC MISC MISC MISC
apple -- iphone_os	A type confusion issue was addressed with improved state handling. This issue is fixed in watchOS 8.7, tvOS 15.6, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. An app may be able to execute arbitrary code with kernel privileges.	2022-09-23	7.8	CVE-2022-32814 MISC MISC MISC MISC
apple -- iphone_os	A memory corruption issue was addressed with improved state management. This issue is fixed in tvOS 15.5, watchOS 8.6, iOS 15.5 and iPadOS 15.5, macOS Monterey 12.4, Safari 15.5. Processing maliciously crafted web content may lead to code execution.	2022-09-23	8.8	CVE-2022-26700 MISC MISC MISC MISC MISC
apple -- iphone_os	A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.3, iOS 15.4 and iPadOS 15.4, tvOS 15.4, Safari 15.4. Processing maliciously crafted web content may lead to arbitrary code execution.	2022-09-23	8.8	CVE-2022-22624 MISC MISC MISC MISC
apple -- macos	An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in Security Update 2022-005 Catalina, macOS Monterey 12.5. An app may be able to gain elevated privileges.	2022-09-23	7.8	CVE-2022-32842 MISC MISC
apple -- macos	A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.5. An app may be able to execute arbitrary code with kernel privileges.	2022-09-23	7.8	CVE-2022-32796 MISC
apple -- macos	An authorization issue was addressed with improved state management. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11.6.8, watchOS 8.7, tvOS 15.6, macOS Monterey 12.5, Security Update 2022-005 Catalina. An app may be able to gain root privileges.	2022-09-23	7.8	CVE-2022-32826 MISC MISC MISC MISC MISC MISC
apple -- macos	An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.5. An app may be able to gain elevated privileges.	2022-09-23	7.8	CVE-2022-32798 MISC
apple -- macos	A logic issue was addressed with improved state management. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11.6.8, watchOS 8.7, tvOS 15.6, macOS Monterey 12.5, Security Update 2022-005 Catalina. An app may be able to gain root privileges.	2022-09-23	7.8	CVE-2022-32819 MISC MISC MISC MISC MISC MISC
apple -- macos	This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.5. An app may be able to gain root privileges.	2022-09-23	7.8	CVE-2022-32801 MISC
apple -- macos	This issue was addressed with improved checks. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. An app may be able to execute arbitrary code with kernel privileges.	2022-09-23	7.8	CVE-2022-32829 MISC MISC
apple -- macos	The issue was addressed with improved memory handling. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11.6.8, watchOS 8.7, tvOS 15.6, macOS Monterey 12.5, Security Update 2022-005 Catalina. An app with root privileges may be able to execute arbitrary code with kernel privileges.	2022-09-23	7.8	CVE-2022-32815 MISC MISC MISC MISC MISC MISC
apple -- macos	This issue was addressed with improved checks. This issue is fixed in watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. An app may be able to break out of its sandbox.	2022-09-23	10	CVE-2022-32845 MISC MISC MISC
apple -- macos	This issue was addressed with improved checks. This issue is fixed in tvOS 15.5, watchOS 8.6, iOS 15.5 and iPadOS 15.5, macOS Monterey 12.4, macOS Big Sur 11.6.6, Security Update 2022-004 Catalina. A remote user may be able to cause a denial-of-service.	2022-09-23	7.5	CVE-2022-32790 MISC MISC MISC MISC MISC MISC
apple -- macos	An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 15.6 and iPadOS 15.6, watchOS 8.7, tvOS 15.6, macOS Monterey 12.5, Safari 15.6. Processing maliciously crafted web content may lead to arbitrary code execution.	2022-09-23	8.8	CVE-2022-32792 MISC MISC MISC MISC MISC
apple -- macos	An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11.6.8, watchOS 8.7, tvOS 15.6, macOS Monterey 12.5, Security Update 2022-005 Catalina. An app may be able to execute arbitrary code with kernel privileges.	2022-09-23	7.8	CVE-2022-32820 MISC MISC MISC MISC MISC MISC
apple -- macos	A memory corruption issue was addressed with improved validation. This issue is fixed in watchOS 8.7, tvOS 15.6, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. An app may be able to execute arbitrary code with kernel privileges.	2022-09-23	7.8	CVE-2022-32821 MISC MISC MISC MISC
apple -- macos	An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.5. Processing a maliciously crafted AppleScript binary may result in unexpected termination or disclosure of process memory.	2022-09-23	7.1	CVE-2022-32852 MISC
apple -- macos	An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in Security Update 2022-005 Catalina, macOS Big Sur 11.6.8, macOS Monterey 12.5. Processing a maliciously crafted AppleScript binary may result in unexpected termination or disclosure of process memory.	2022-09-23	7.1	CVE-2022-32851 MISC MISC MISC
apple -- macos	An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Security Update 2022-005 Catalina, macOS Big Sur 11.6.8, macOS Monterey 12.5. Processing a maliciously crafted AppleScript binary may result in unexpected termination or disclosure of process memory.	2022-09-23	7.1	CVE-2022-32831 MISC MISC MISC
apple -- macos	An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in Security Update 2022-005 Catalina, macOS Big Sur 11.6.8, macOS Monterey 12.5. Processing a maliciously crafted Postscript file may result in unexpected app termination or disclosure of process memory.	2022-09-23	7.1	CVE-2022-32843 MISC MISC MISC
apple -- macos	A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.3, Safari 15.4, watchOS 8.5, iTunes 12.12.3 for Windows, iOS 15.4 and iPadOS 15.4, tvOS 15.4. Processing maliciously crafted web content may lead to arbitrary code execution.	2022-09-23	8.8	CVE-2022-22629 MISC MISC MISC MISC MISC MISC
apple -- macos	An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11.6.8, watchOS 8.7, tvOS 15.6, macOS Monterey 12.5, Security Update 2022-005 Catalina. Processing maliciously crafted web content may lead to arbitrary code execution.	2022-09-23	8.8	CVE-2022-32787 MISC MISC MISC MISC MISC MISC
apple -- macos	This issue was addressed with improved checks. This issue is fixed in Security Update 2022-005 Catalina, macOS Big Sur 11.6.8, macOS Monterey 12.5. Processing a maliciously crafted AppleScript binary may result in unexpected termination or disclosure of process memory.	2022-09-23	7.1	CVE-2022-32797 MISC MISC MISC
apple -- macos	This issue was addressed with improved checks. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11.6.8, watchOS 8.7, tvOS 15.6, macOS Monterey 12.5, Security Update 2022-005 Catalina. A remote user may be able to cause unexpected system termination or corrupt kernel memory.	2022-09-23	9.1	CVE-2022-32847 MISC MISC MISC MISC MISC MISC
apple -- macos	This issue was addressed with improved file handling. This issue is fixed in Security Update 2022-005 Catalina, macOS Big Sur 11.6.8, macOS Monterey 12.5. An app may be able to overwrite arbitrary files.	2022-09-23	7.1	CVE-2022-32807 MISC MISC MISC
apple -- macos	An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in Security Update 2022-005 Catalina, macOS Big Sur 11.6.8, macOS Monterey 12.5. Processing a maliciously crafted AppleScript binary may result in unexpected termination or disclosure of process memory.	2022-09-23	7.1	CVE-2022-32853 MISC MISC MISC
apple -- swiftnio	NIOHTTP1 and projects using it for generating HTTP responses can be subject to a HTTP Response Injection attack. This occurs when a HTTP/1.1 server accepts user generated input from an incoming request and reflects it into a HTTP/1.1 response header in some form. A malicious user can add newlines to their input (usually in encoded form) and "inject" those newlines into the returned HTTP response. This capability allows users to work around security headers and HTTP/1.1 framing headers by injecting entirely false responses or other new headers. The injected false responses may also be treated as the response to subsequent requests, which can lead to XSS, cache poisoning, and a number of other flaws. This issue was resolved by adding validation to the HTTPHeaders type, ensuring that there's no whitespace incorrectly present in the HTTP headers provided by users. As the existing API surface is non-failable, all invalid characters are replaced by linear whitespace.	2022-09-28	7.5	CVE-2022-3215 MISC
apple -- tvos	A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.3, Safari 15.4, watchOS 8.5, iOS 15.4 and iPadOS 15.4, tvOS 15.4. Processing maliciously crafted web content may lead to code execution.	2022-09-23	8.8	CVE-2022-22610 MISC MISC MISC MISC MISC
apple -- tvos	A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.3, Safari 15.4, watchOS 8.5, iOS 15.4 and iPadOS 15.4, tvOS 15.4. A malicious website may cause unexpected cross-origin behavior.	2022-09-23	8.8	CVE-2022-22637 MISC MISC MISC MISC MISC
apple -- tvos	A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.3, Safari 15.4, watchOS 8.5, iOS 15.4 and iPadOS 15.4, tvOS 15.4. Processing maliciously crafted web content may lead to arbitrary code execution.	2022-09-23	8.8	CVE-2022-22628 MISC MISC MISC MISC MISC
arvados -- arvados	Arvados is an open source platform for managing and analyzing biomedical big data. In versions prior to 2.4.3, when using Portable Authentication Modules (PAM) for user authentication, if a user presented valid credentials but the account is disabled or otherwise not allowed to access the host (such as an expired password), it would still be accepted for access to Arvados. Other authentication methods (LDAP, OpenID Connect) supported by Arvados are not affected by this flaw. This issue is patched in version 2.4.3. Workaround for this issue is to migrate to a different authentication method supported by Arvados, such as LDAP.	2022-09-23	8.8	CVE-2022-39238 CONFIRM
b2evolution -- b2evolution	An authorization bypass in b2evolution allows remote, unauthenticated attackers to predict password reset tokens for any user through the use of a bad randomness function. This allows the attacker to get valid sessions for arbitrary users, and optionally reset their password. Tested and confirmed in a default installation of version 7.2.3. Earlier versions are affected, possibly earlier major versions as well.	2022-09-28	9.1	CVE-2022-30935 MISC MISC MISC
centreon -- centreon	Centreon v20.10.18 was discovered to contain a SQL injection vulnerability via the esc_name (Escalation Name) parameter at Configuration/Notifications/Escalations.	2022-09-26	8.8	CVE-2022-40043 MISC MISC
checkpoint -- zonealarm	Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. This occurs because of weak permissions for the %PROGRAMDATA%\CheckPoint\ZoneAlarm\Data\Updates directory, and a self-protection driver bypass that allows creation of a junction directory. This can be leveraged to perform an arbitrary file move as NT AUTHORITY\SYSTEM.	2022-09-27	8.8	CVE-2022-41604 MISC MISC MISC
cloudbase -- open_vswitch	In ovs versions v0.90.0 through v2.5.0 are vulnerable to heap buffer over-read in flow.c. An unsafe comparison of “minimasks” function could lead access to an unmapped region of memory. This vulnerability is capable of crashing the software, memory modification, and possible remote execution.	2022-09-28	8.8	CVE-2022-32166 MISC MISC
cloudwego -- hertz	Hertz v0.3.0 ws discovered to contain a path traversal vulnerability via the normalizePath function.	2022-09-28	7.5	CVE-2022-40082 MISC MISC
dell -- smartfabric_os10	Networking OS10, versions 10.5.1.x, 10.5.2.x, and 10.5.3.x contain a vulnerability that could allow an attacker to cause a system crash by running particular security scans.	2022-09-28	7.5	CVE-2022-34424 MISC
denx -- u-boot	There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DFU download setup packets, and it does not verify that the transfer direction corresponds to the specified command. Consequently, if a physical attacker crafts a USB DFU download setup packet with a `wLength` greater than 4096 bytes, they can write beyond the heap-allocated request buffer.	2022-09-23	7.1	CVE-2022-2347 MISC
dompdf -- dompdf	registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-face rule.	2022-09-25	7.5	CVE-2022-41343 MISC MISC MISC
ec-cube -- product_image_bulk_upload	EC-CUBE plugin 'Product Image Bulk Upload Plugin' 1.0.0 and 4.1.0 contains an insufficient verification vulnerability when uploading files. Exploiting this vulnerability allows a remote unauthenticated attacker to upload arbitrary files other than image files. If a user with an administrative privilege of EC-CUBE where the vulnerable plugin is installed is led to upload a specially crafted file, an arbitrary script may be executed on the system.	2022-09-27	9.8	CVE-2022-37346 MISC MISC
exam_reviewer_management -- exam_reviewer_management	In Exam Reviewer Management System 1.0, an authenticated attacker can upload a web-shell php file in profile page to achieve Remote Code Execution (RCE).	2022-09-27	8.8	CVE-2022-40878 MISC
exam_reviewer_management -- exam_reviewer_management	Exam Reviewer Management System 1.0 is vulnerable to SQL Injection via the ‘id’ parameter.	2022-09-27	9.8	CVE-2022-40877 MISC
eyesofnetwork -- eyesofnetwork	An issue was discovered in EyesOfNetwork (EON) through 5.3.11. Local file inclusion can occur.	2022-09-27	9.8	CVE-2022-41571 MISC
eyesofnetwork -- eyesofnetwork	An issue was discovered in EyesOfNetwork (EON) through 5.3.11. Unauthenticated SQL injection can occur.	2022-09-27	9.8	CVE-2022-41570 MISC
ffmpeg -- ffmpeg	A heap out-of-bounds memory write exists in FFMPEG since version 5.1. The size calculation in `build_open_gop_key_points()` goes through all entries in the loop and adds `sc->ctts_data.count` to `sc->sample_offsets_count`. This can lead to an integer overflow resulting in a small allocation with `av_calloc()`. An attacker can cause remote code execution via a malicious mp4 file. We recommend upgrading past commit c953baa084607dd1d84c3bfcce3cf6a87c3e6e05

[TD]
2022-09-23
[/TD]
[TD]
7.8
[/TD]
[TD]CVE-2022-2566
MISC[/TD]

[TR]
[TD]
flatpress -- flatpress
[/TD]
[TD]
Flatpress v1.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the Upload File function.
[/TD]
[TD]
2022-09-29
[/TD]
[TD]
7.2
[/TD]
[TD]CVE-2022-40048
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
food_ordering_management_system -- food_ordering_management_system
[/TD]
[TD]
A vulnerability classified as critical has been found in SourceCodester Food Ordering Management System. This affects an unknown part of the file router.php of the component POST Parameter Handler. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-209583.
[/TD]
[TD]
2022-09-28
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-3332
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
gavazziautomation -- cpy_car_park_server
[/TD]
[TD]
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could utilize an improper input validation on an API-submitted parameter to execute arbitrary OS commands.
[/TD]
[TD]
2022-09-28
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-28811
CONFIRM[/TD]
[/TR]
[TR]
[TD]
gavazziautomation -- cpy_car_park_server
[/TD]
[TD]
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of hard-coded credentials to gain SuperUser access to the device.
[/TD]
[TD]
2022-09-28
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-28812
CONFIRM[/TD]
[/TR]
[TR]
[TD]
gavazziautomation -- cpy_car_park_server
[/TD]
[TD]
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of hard-coded credentials to gain full access to the device.
[/TD]
[TD]
2022-09-28
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-22522
CONFIRM[/TD]
[/TR]
[TR]
[TD]
gavazziautomation -- cpy_car_park_server
[/TD]
[TD]
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a missing authentication allows for full access via API.
[/TD]
[TD]
2022-09-28
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-22526
CONFIRM[/TD]
[/TR]
[TR]
[TD]
gavazziautomation -- cpy_car_park_server
[/TD]
[TD]
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an unauthenticated remote attacker could utilize a SQL-Injection vulnerability to gain full database access, modify users and stop services .
[/TD]
[TD]
2022-09-28
[/TD]
[TD]
9.4
[/TD]
[TD]CVE-2022-22524
CONFIRM[/TD]
[/TR]
[TR]
[TD]
gavazziautomation -- cpy_car_park_server
[/TD]
[TD]
An improper authentication vulnerability exists in the Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 Web-App which allows an authentication bypass to the context of an unauthorised user if free-access is disabled.
[/TD]
[TD]
2022-09-28
[/TD]
[TD]
7.5
[/TD]
[TD]CVE-2022-22523
CONFIRM[/TD]
[/TR]
[TR]
[TD]
gavazziautomation -- cpy_car_park_server
[/TD]
[TD]
Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 was discovered to be vulnerable to a relative path traversal vulnerability which enables remote attackers to read arbitrary files and gain full control of the device.
[/TD]
[TD]
2022-09-28
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-28814
CONFIRM[/TD]
[/TR]
[TR]
[TD]
gavazziautomation -- cpy_car_park_server
[/TD]
[TD]
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an remote attacker with admin rights could execute arbitrary commands due to missing input sanitization in the backup restore function
[/TD]
[TD]
2022-09-28
[/TD]
[TD]
7.2
[/TD]
[TD]CVE-2022-22525
CONFIRM[/TD]
[/TR]
[TR]
[TD]
google -- chrome
[/TD]
[TD]
Insufficient validation of untrusted input in V8 in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-3045
MISC
MISC
GENTOO
FEDORA[/TD]
[/TR]
[TR]
[TD]
google -- chrome
[/TD]
[TD]
Out of bounds write in Storage in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-3195
MISC
MISC
GENTOO
FEDORA[/TD]
[/TR]
[TR]
[TD]
google -- chrome
[/TD]
[TD]
Use after free in Frames in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-3199
MISC
MISC
GENTOO
FEDORA[/TD]
[/TR]
[TR]
[TD]
google -- chrome
[/TD]
[TD]
Use after free in SplitScreen in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-3049
MISC
MISC
GENTOO
FEDORA[/TD]
[/TR]
[TR]
[TD]
google -- chrome
[/TD]
[TD]
Heap buffer overflow in Exosphere in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interactions.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-3051
MISC
MISC
GENTOO
FEDORA[/TD]
[/TR]
[TR]
[TD]
google -- chrome
[/TD]
[TD]
Heap buffer overflow in Screen Capture in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-3043
MISC
MISC
GENTOO
FEDORA[/TD]
[/TR]
[TR]
[TD]
google -- chrome
[/TD]
[TD]
Use after free in PhoneHub in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-3042
MISC
MISC
GENTOO
FEDORA[/TD]
[/TR]
[TR]
[TD]
google -- chrome
[/TD]
[TD]
Use after free in Browser Tag in Google Chrome prior to 105.0.5195.52 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-3046
MISC
MISC
GENTOO
FEDORA[/TD]
[/TR]
[TR]
[TD]
google -- chrome
[/TD]
[TD]
Use after free in PDF in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-3197
MISC
MISC
GENTOO
FEDORA[/TD]
[/TR]
[TR]
[TD]
google -- chrome
[/TD]
[TD]
Use after free in Layout in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-3040
MISC
MISC
GENTOO
FEDORA[/TD]
[/TR]
[TR]
[TD]
google -- chrome
[/TD]
[TD]
Use after free in Passwords in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-3055
MISC
MISC
GENTOO
FEDORA[/TD]
[/TR]
[TR]
[TD]
google -- chrome
[/TD]
[TD]
Use after free in PDF in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-3196
MISC
MISC
GENTOO
FEDORA[/TD]
[/TR]
[TR]
[TD]
google -- chrome
[/TD]
[TD]
Heap buffer overflow in Window Manager in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interactions.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-3052
MISC
MISC
GENTOO
FEDORA[/TD]
[/TR]
[TR]
[TD]
google -- chrome
[/TD]
[TD]
Use after free in Sign-In Flow in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interaction.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-3058
MISC
MISC
GENTOO
FEDORA[/TD]
[/TR]
[TR]
[TD]
google -- chrome
[/TD]
[TD]
Heap buffer overflow in WebUI in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interactions.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-3050
MISC
MISC
GENTOO
FEDORA[/TD]
[/TR]
[TR]
[TD]
google -- chrome
[/TD]
[TD]
Use after free in Browser Creation in Google Chrome prior to 104.0.5112.101 allowed a remote attacker who had convinced a user to engage in a specific UI interaction to potentially exploit heap corruption via a crafted HTML page.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-2998
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
google -- chrome
[/TD]
[TD]
Heap buffer overflow in Internals in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-3200
MISC
MISC
GENTOO
FEDORA[/TD]
[/TR]
[TR]
[TD]
google -- chrome
[/TD]
[TD]
Use after free in FedCM in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-2852
MISC
MISC
FEDORA[/TD]
[/TR]
[TR]
[TD]
google -- chrome
[/TD]
[TD]
Use after free in PDF in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-3198
MISC
MISC
GENTOO
FEDORA[/TD]
[/TR]
[TR]
[TD]
google -- chrome
[/TD]
[TD]
Heap buffer overflow in Downloads in Google Chrome on Android prior to 104.0.5112.101 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-2853
MISC
MISC
FEDORA[/TD]
[/TR]
[TR]
[TD]
google -- chrome
[/TD]
[TD]
Use after free in WebSQL in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-3039
MISC
MISC
GENTOO
FEDORA[/TD]
[/TR]
[TR]
[TD]
google -- chrome
[/TD]
[TD]
Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
9.6
[/TD]
[TD]CVE-2022-3075
MISC
MISC
GENTOO
FEDORA[/TD]
[/TR]
[TR]
[TD]
google -- chrome
[/TD]
[TD]
Use after free in Chrome OS Shell in Google Chrome prior to 104.0.5112.101 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via specific UI interactions.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-2859
MISC
MISC
FEDORA[/TD]
[/TR]
[TR]
[TD]
google -- chrome
[/TD]
[TD]
Double free in DOMStorage in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
[/TD]
[TD]
2022-09-29
[/TD]
[TD]
7.5
[/TD]
[TD]CVE-2019-5797
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
google -- chrome
[/TD]
[TD]
Use after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-3038
MISC
MISC
GENTOO
FEDORA[/TD]
[/TR]
[TR]
[TD]
google -- chrome
[/TD]
[TD]
Use after free in WebSQL in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-3041
MISC
MISC
GENTOO
FEDORA[/TD]
[/TR]
[TR]
[TD]
google -- chrome
[/TD]
[TD]
Use after free in SwiftShader in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-2854
MISC
MISC
FEDORA[/TD]
[/TR]
[TR]
[TD]
google -- chrome
[/TD]
[TD]
Use after free in ANGLE in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-2855
MISC
MISC
FEDORA[/TD]
[/TR]
[TR]
[TD]
google -- chrome
[/TD]
[TD]
Use after free in Blink in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-2857
MISC
MISC
FEDORA[/TD]
[/TR]
[TR]
[TD]
google -- chrome
[/TD]
[TD]
Use after free in Tab Strip in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interaction.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-3071
MISC
MISC
GENTOO
FEDORA[/TD]
[/TR]
[TR]
[TD]
google -- chrome
[/TD]
[TD]
Use after free in Sign-In Flow in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via specific UI interaction.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-2858
MISC
MISC
FEDORA[/TD]
[/TR]
[TR]
[TD]
grandstream -- gds3710
[/TD]
[TD]
an attacker with knowledge of user/pass of Grandstream GSD3710 in its 1.0.11.13 version, could overflow the stack since it doesn't check the param length before use the strcopy instruction. The explotation of this vulnerability may lead an attacker to execute a shell with full access.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-2025
CONFIRM[/TD]
[/TR]
[TR]
[TD]
grandstream -- gds3710
[/TD]
[TD]
In Grandstream GSD3710 in its 1.0.11.13 version, it's possible to overflow the stack since it doesn't check the param length before using the sscanf instruction. Because of that, an attacker could create a socket and connect with a remote IPort by opening a shell and getting full access to the system. The exploit affects daemons dbmng and logsrv that are running on ports 8000 and 8001 by default.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-2070
CONFIRM[/TD]
[/TR]
[TR]
[TD]
graphicsmagick -- graphicsmagick
[/TD]
[TD]
In GraphicsMagick, a heap buffer overflow was found when parsing MIFF.
[/TD]
[TD]
2022-09-28
[/TD]
[TD]
7.8
[/TD]
[TD]CVE-2022-1270
MISC
GENTOO[/TD]
[/TR]
[TR]
[TD]
hapijs -- hoek
[/TD]
[TD]
hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
8.1
[/TD]
[TD]CVE-2020-36604
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
ibm -- sterling_partner_engagement_manager
[/TD]
[TD]
IBM Sterling Partner Engagement Manager 6.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 230017.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
7.1
[/TD]
[TD]CVE-2022-34348
CONFIRM
XF[/TD]
[/TR]
[TR]
[TD]
ibm -- websphere_mq
[/TD]
[TD]
IBM WebSphere MQ 7.1 is vulnerable to a denial of service, caused by an error when handling user ids. A remote attacker could exploit this vulnerability to bypass the security configuration setup on a SVRCONN channel and flood the queue manager.
[/TD]
[TD]
2022-09-29
[/TD]
[TD]
7.5
[/TD]
[TD]CVE-2012-2201
XF[/TD]
[/TR]
[TR]
[TD]
ikus-soft -- rdiffweb
[/TD]
[TD]
Session Fixation in GitHub repository ikus060/rdiffweb prior to 2.4.7.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-3269
CONFIRM
MISC[/TD]
[/TR]
[TR]
[TD]
ikus-soft -- rdiffweb
[/TD]
[TD]
Improper Handling of Length Parameter Inconsistency in GitHub repository ikus060/rdiffweb prior to 2.4.8.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
7.5
[/TD]
[TD]CVE-2022-3290
CONFIRM
MISC[/TD]
[/TR]
[TR]
[TD]
ikus-soft -- rdiffweb
[/TD]
[TD]
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.4.8.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
7.5
[/TD]
[TD]CVE-2022-3295
CONFIRM
MISC[/TD]
[/TR]
[TR]
[TD]
ikus-soft -- rdiffweb
[/TD]
[TD]
Improper Handling of Length Parameter Inconsistency in GitHub repository ikus060/rdiffweb prior to 2.4.8.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
7.5
[/TD]
[TD]CVE-2022-3272
MISC
CONFIRM[/TD]
[/TR]
[TR]
[TD]
ikus-soft -- rdiffweb
[/TD]
[TD]
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.4.8.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
7.5
[/TD]
[TD]CVE-2022-3298
CONFIRM
MISC[/TD]
[/TR]
[TR]
[TD]
insyde -- insydeh2o
[/TD]
[TD]
An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An SMM callout vulnerability in the SMM driver FwBlockServiceSmm, creating SMM, leads to arbitrary code execution. An attacker can replace the pointer to the UEFI boot service GetVariable with a pointer to malware, and then generate a software SMI.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
8.2
[/TD]
[TD]CVE-2022-36338
MISC
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
insyde -- insydeh2o
[/TD]
[TD]
An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. There is an SMM memory corruption vulnerability in the Software SMI handler in the PnpSmm driver.
[/TD]
[TD]
2022-09-28
[/TD]
[TD]
8.2
[/TD]
[TD]CVE-2022-36448
MISC
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
insyde -- insydeh2o
[/TD]
[TD]
An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An SMM memory corruption vulnerability in the FvbServicesRuntimeDxe driver allows an attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
8.2
[/TD]
[TD]CVE-2022-35893
MISC
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
jflyfox -- jfinal_cms
[/TD]
[TD]
JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection.
[/TD]
[TD]
2022-09-27
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-37209
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
joblib -- joblib
[/TD]
[TD]
The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-21797
CONFIRM
CONFIRM
CONFIRM
CONFIRM[/TD]
[/TR]
[TR]
[TD]
kovidgoyal -- kitty
[/TD]
[TD]
In Kitty before 0.26.2, insufficient validation in the desktop notification escape sequence can lead to arbitrary code execution. The user must display attacker-controlled content in the terminal, then click on a notification popup.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
7.8
[/TD]
[TD]CVE-2022-41322
MISC
MISC
MISC
MISC
GENTOO
FEDORA
FEDORA[/TD]
[/TR]
[TR]
[TD]
labstack -- echo
[/TD]
[TD]
Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by attackers to cause a Server-Side Request Forgery (SSRF).
[/TD]
[TD]
2022-09-28
[/TD]
[TD]
9.6
[/TD]
[TD]CVE-2022-40083
MISC[/TD]
[/TR]
[TR]
[TD]
lcnet -- smart_evision
[/TD]
[TD]
Smart eVision has an improper privilege management vulnerability. A remote attacker with general user privilege can exploit this vulnerability to escalate to administrator privilege, and then perform arbitrary system command or disrupt service.
[/TD]
[TD]
2022-09-28
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-39032
MISC[/TD]
[/TR]
[TR]
[TD]
lcnet -- smart_evision
[/TD]
[TD]
smart eVision has inadequate authorization for system information query function. An unauthenticated remote attacker, who is not explicitly authorized to access the information, can access sensitive information.
[/TD]
[TD]
2022-09-28
[/TD]
[TD]
7.5
[/TD]
[TD]CVE-2022-39030
MISC[/TD]
[/TR]
[TR]
[TD]
lcnet -- smart_evision
[/TD]
[TD]
Smart eVision’s file acquisition function has a path traversal vulnerability due to insufficient filtering for special characters in the URL parameter. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication, access restricted paths to download and delete arbitrary system files to disrupt service.
[/TD]
[TD]
2022-09-28
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-39033
MISC[/TD]
[/TR]
[TR]
[TD]
linux -- linux
[/TD]
[TD]
off-by-one in io_uring module.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
7.8
[/TD]
[TD]CVE-2022-3103
MISC[/TD]
[/TR]
[TR]
[TD]
linuxfoundation -- besu
[/TD]
[TD]
Besu is a Java-based Ethereum client. In versions newer than 22.1.3 and prior to 22.7.1, Besu is subject to an Incorrect Conversion between Numeric Types. An error in 32 bit signed and unsigned types in the calculation of available gas in the CALL operations (including DELEGATECALL) results in incorrect gas being passed into called contracts and incorrect gas being returned after call execution. Where the amount of gas makes a difference in the success or failure, or if the gas is a negative 64 bit value, the execution will result in a different state root than expected, resulting in a consensus failure in networks with multiple EVM implementations. In networks with a single EVM implementation this can be used to execute with significantly more gas than then transaction requested, possibly exceeding gas limitations. This issue is patched in version 22.7.1. As a workaround, reverting to version 22.1.3 or earlier will prevent incorrect execution.
[/TD]
[TD]
2022-09-24
[/TD]
[TD]
9.1
[/TD]
[TD]CVE-2022-36025
CONFIRM[/TD]
[/TR]
[TR]
[TD]
linuxfoundation -- fabric
[/TD]
[TD]
A vulnerability exists in Hyperledger Fabric <2.4 could allow an attacker to construct a non-validated request that could cause a denial of service attack.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
7.5
[/TD]
[TD]CVE-2022-35253
MISC
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
mailcow -- mailcow
[/TD]
[TD]
mailcow is a mailserver suite. A vulnerability innversions prior to 2022-09 allows an attacker to craft a custom Swagger API template to spoof Authorize links. This could redirect a victim to an attacker controller place to steal Swagger authorization credentials or create a phishing page to steal other information. The issue has been fixed with the 2022-09 mailcow Mootember Update. As a workaround, one may delete the Swapper API Documentation from their e-mail server.
[/TD]
[TD]
2022-09-27
[/TD]
[TD]
8.2
[/TD]
[TD]CVE-2022-39258
MISC
CONFIRM[/TD]
[/TR]
[TR]
[TD]
makedeb -- mist
[/TD]
[TD]
Mist is the command-line interface for the makedeb Package Repository. Prior to version 0.9.5, a user-provided `sudo` binary via the `PATH` variable can allow a local user to run arbitrary commands on the user's system with root permissions. Versions 0.9.5 and later contain a patch. No known workarounds exist.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
7.8
[/TD]
[TD]CVE-2022-39245
CONFIRM
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
matrix -- javascript_sdk
[/TD]
[TD]
Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this may be missing in others. This attack is possible due to the matrix-js-sdk implementing a too permissive key forwarding strategy on the receiving end. Starting with version 19.7.0, the default policy for accepting key forwards has been made more strict in the matrix-js-sdk. matrix-js-sdk will now only accept forwarded keys in response to previously issued requests and only from own, verified devices. The SDK now sets a `trusted` flag on the decrypted message upon decryption, based on whether the key used to decrypt the message was received from a trusted source. Clients need to ensure that messages decrypted with a key with `trusted = false` are decorated appropriately, for example, by showing a warning for such messages. This attack requires coordination between a malicious homeserver and an attacker, and those who trust your homeservers do not need a workaround.
[/TD]
[TD]
2022-09-28
[/TD]
[TD]
7.5
[/TD]
[TD]CVE-2022-39249
MISC
CONFIRM
MISC
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
matrix -- javascript_sdk
[/TD]
[TD]
Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Additionally, a sophisticated attacker cooperating with a malicious homeserver could employ this vulnerability to perform a targeted attack in order to send fake to-device messages appearing to originate from another user. This can allow, for example, to inject the key backup secret during a self-verification, to make a targeted device start using a malicious key backup spoofed by the homeserver. These attacks are possible due to a protocol confusion vulnerability that accepts to-device messages encrypted with Megolm instead of Olm. Starting with version 19.7.0, matrix-js-sdk has been modified to only accept Olm-encrypted to-device messages. Out of caution, several other checks have been audited or added. This attack requires coordination between a malicious home server and an attacker, so those who trust their home servers do not need a workaround.
[/TD]
[TD]
2022-09-28
[/TD]
[TD]
7.5
[/TD]
[TD]CVE-2022-39251
MISC
MISC
MISC
CONFIRM[/TD]
[/TR]
[TR]
[TD]
matrix -- software_development_kit
[/TD]
[TD]
Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this may be missing in others. This attack is possible due to the matrix-ios-sdk implementing a too permissive key forwarding strategy. The default policy for accepting key forwards has been made more strict in the matrix-ios-sdk version 0.23.19. matrix-ios-sdk will now only accept forwarded keys in response to previously issued requests and only from own, verified devices. The SDK now sets a `trusted` flag on the decrypted message upon decryption, based on whether the key used to decrypt the message was received from a trusted source. Clients need to ensure that messages decrypted with a key with `trusted = false` are decorated appropriately (for example, by showing a warning for such messages). This attack requires coordination between a malicious home server and an attacker, so those who trust their home servers do not need a workaround.
[/TD]
[TD]
2022-09-28
[/TD]
[TD]
7.5
[/TD]
[TD]CVE-2022-39257
MISC
CONFIRM
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
matrix -- software_development_kit
[/TD]
[TD]
Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Additionally, a sophisticated attacker cooperating with a malicious homeserver could employ this vulnerability to perform a targeted attack in order to send fake to-device messages appearing to originate from another user. This can allow, for example, to inject the key backup secret during a self-verification, to make a targeted device start using a malicious key backup spoofed by the homeserver. These attacks are possible due to a protocol confusion vulnerability that accepts to-device messages encrypted with Megolm instead of Olm. matrix-ios-sdk version 0.23.19 has been modified to only accept Olm-encrypted to-device messages. Out of caution, several other checks have been audited or added. This attack requires coordination between a malicious home server and an attacker, so those who trust their home servers do not need a workaround. To avoid malicious backup attacks, one should not verify one's new logins using emoji/QR verifications methods until patched.
[/TD]
[TD]
2022-09-28
[/TD]
[TD]
7.5
[/TD]
[TD]CVE-2022-39255
MISC
CONFIRM
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
matrix -- software_development_kit
[/TD]
[TD]
matrix-android-sdk2 is the Matrix SDK for Android. Prior to version 1.5.1, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Additionally, a sophisticated attacker cooperating with a malicious homeserver could employ this vulnerability to perform a targeted attack in order to send fake to-device messages appearing to originate from another user. This can allow, for example, to inject the key backup secret during a self-verification, to make a targeted device start using a malicious key backup spoofed by the homeserver. matrix-android-sdk2 would then additionally sign such a key backup with its device key, spilling trust over to other devices trusting the matrix-android-sdk2 device. These attacks are possible due to a protocol confusion vulnerability that accepts to-device messages encrypted with Megolm instead of Olm. matrix-android-sdk2 version 1.5.1 has been modified to only accept Olm-encrypted to-device messages and to stop signing backups on a successful decryption. Out of caution, several other checks have been audited or added. This attack requires coordination between a malicious home server and an attacker, so those who trust their home servers do not need a workaround.
[/TD]
[TD]
2022-09-28
[/TD]
[TD]
7.5
[/TD]
[TD]CVE-2022-39248
MISC
MISC
CONFIRM
MISC[/TD]
[/TR]
[TR]
[TD]
measuresoft -- scadapro_server
[/TD]
[TD]
The security descriptor of Measuresoft ScadaPro Server version 6.7 has inconsistent permissions, which could allow a local user with limited privileges to modify the service binary path and start malicious commands with SYSTEM privileges.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
7.8
[/TD]
[TD]CVE-2022-3263
CONFIRM[/TD]
[/TR]
[TR]
[TD]
metersphere -- metersphere
[/TD]
[TD]
An arbitrary file upload vulnerability was found in Metersphere v1.15.4. Unauthenticated users can upload any file to arbitrary directory, where attackers can write a cron job to execute commands.
[/TD]
[TD]
2022-09-29
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2021-45790
MISC[/TD]
[/TR]
[TR]
[TD]
metersphere -- metersphere
[/TD]
[TD]
Time-based SQL Injection vulnerabilities were found in Metersphere v1.15.4 via the "orders" parameter.
[/TD]
[TD]
2022-09-29
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2021-45788
MISC[/TD]
[/TR]
[TR]
[TD]
mipcm -- mipc_camera
[/TD]
[TD]
Unsanitized input when setting a locale file leads to shell injection in mIPC camera firmware 5.3.1.2003161406. This allows an attacker to gain remote code execution on cameras running the firmware when a victim logs into a specially crafted mobile app.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-40785
MISC[/TD]
[/TR]
[TR]
[TD]
mipcm -- mipc_camera
[/TD]
[TD]
Unlimited strcpy on user input when setting a locale file leads to stack buffer overflow in mIPC camera firmware 5.3.1.2003161406.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-40784
MISC[/TD]
[/TR]
[TR]
[TD]
mz-automation -- libiec61850
[/TD]
[TD]
MZ Automation's libIEC61850 (versions 1.4 and prior; version 1.5 prior to commit a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e) is vulnerable to a stack-based buffer overflow, which could allow an attacker to crash the device or remotely execute arbitrary code.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-2972
MISC[/TD]
[/TR]
[TR]
[TD]
mz-automation -- libiec61850
[/TD]
[TD]
MZ Automation's libIEC61850 (versions 1.4 and prior; version 1.5 prior to commit a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e) accesses a resource using an incompatible type, which could allow an attacker to crash the server with a malicious payload.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
7.5
[/TD]
[TD]CVE-2022-2971
MISC[/TD]
[/TR]
[TR]
[TD]
mz-automation -- libiec61850
[/TD]
[TD]
MZ Automation's libIEC61850 (versions 1.4 and prior; version 1.5 prior to commit a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e) does not sanitize input before memcpy is used, which could allow an attacker to crash the device or remotely execute arbitrary code.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-2970
MISC[/TD]
[/TR]
[TR]
[TD]
mz-automation -- libiec61850
[/TD]
[TD]
MZ Automation's libIEC61850 (versions 1.4 and prior; version 1.5 prior to commit a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e) uses a NULL pointer in certain situations. which could allow an attacker to crash the server.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
7.5
[/TD]
[TD]CVE-2022-2973
MISC[/TD]
[/TR]
[TR]
[TD]
nepxion -- discovery
[/TD]
[TD]
Nepxion Discovery is a solution for Spring Cloud. Discover is vulnerable to SpEL Injection in discovery-commons. DiscoveryExpressionResolver’s eval method is evaluating expression with a StandardEvaluationContext, allowing the expression to reach and interact with Java classes such as java.lang.Runtime, leading to Remote Code Execution. There is no patch available for this issue at time of publication. There are no known workarounds.
[/TD]
[TD]
2022-09-24
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-23463
MISC[/TD]
[/TR]
[TR]
[TD]
nepxion -- discovery
[/TD]
[TD]
Nepxion Discovery is a solution for Spring Cloud. Discovery is vulnerable to a potential Server-Side Request Forgery (SSRF). RouterResourceImpl uses RestTemplate’s getForEntity to retrieve the contents of a URL containing user-controlled input, potentially resulting in Information Disclosure. There is no patch available for this issue at time of publication. There are no known workarounds.
[/TD]
[TD]
2022-09-24
[/TD]
[TD]
7.5
[/TD]
[TD]CVE-2022-23464
MISC[/TD]
[/TR]
[TR]
[TD]
next-auth -- nextauth
[/TD]
[TD]
`@next-auth/upstash-redis-adapter` is the Upstash Redis adapter for NextAuth.js, which provides authentication for Next.js. Applications that use `next-auth` Email Provider and `@next-auth/upstash-redis-adapter` before v3.0.2 are affected by this vulnerability. The Upstash Redis adapter implementation did not check for both the identifier (email) and the token, but only checking for the identifier when verifying the token in the email callback flow. An attacker who knows about the victim's email could easily sign in as the victim, given the attacker also knows about the verification token's expired duration. The vulnerability is patched in v3.0.2. A workaround is available. Using Advanced Initialization, developers can check the requests and compare the query's token and identifier before proceeding.
[/TD]
[TD]
2022-09-28
[/TD]
[TD]
8.1
[/TD]
[TD]CVE-2022-39263
CONFIRM
MISC[/TD]
[/TR]
[TR]
[TD]
nic -- knot_resolver
[/TD]
[TD]
Knot Resolver before 5.5.3 allows remote attackers to cause a denial of service (CPU consumption) because of algorithmic complexity. During an attack, an authoritative server must return large NS sets or address sets.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
7.5
[/TD]
[TD]CVE-2022-40188
CONFIRM
FEDORA
FEDORA
FEDORA[/TD]
[/TR]
[TR]
[TD]
nlnetlabs -- unbound
[/TD]
[TD]
A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolving software. The NRDelegation Attack works by having a malicious delegation with a considerable number of non responsive nameservers. The attack starts by querying a resolver for a record that relies on those unresponsive nameservers. The attack can cause a resolver to spend a lot of time/resources resolving records under a malicious delegation point where a considerable number of unresponsive NS records reside. It can trigger high CPU usage in some resolver implementations that continually look in the cache for resolved NS records in that delegation. This can lead to degraded performance and eventually denial of service in orchestrated attacks. Unbound does not suffer from high CPU usage, but resources are still needed for resolving the malicious delegation. Unbound will keep trying to resolve the record until hard limits are reached. Based on the nature of the attack and the replies, different limits could be reached. From version 1.16.3 on, Unbound introduces fixes for better performance when under load, by cutting opportunistic queries for nameserver discovery and DNSKEY prefetching and limiting the number of times a delegation point can issue a cache lookup for missing records.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
7.5
[/TD]
[TD]CVE-2022-3204
CONFIRM
FEDORA[/TD]
[/TR]
[TR]
[TD]
notepad-plus-plus -- notepad-plus-plus
[/TD]
[TD]
Notepad++ versions 8.4.1 and before are vulnerable to DLL hijacking where an attacker can replace the vulnerable dll (UxTheme.dll) with his own dll and run arbitrary code in the context of Notepad++.
[/TD]
[TD]
2022-09-28
[/TD]
[TD]
7.8
[/TD]
[TD]CVE-2022-32168
CONFIRM
MISC[/TD]
[/TR]
[TR]
[TD]
nuprocess -- nuprocess
[/TD]
[TD]
NuProcess is an external process execution implementation for Java. In all the versions of NuProcess where it forks processes by using the JVM's Java_java_lang_UNIXProcess_forkAndExec method (1.2.0+), attackers can use NUL characters in their strings to perform command line injection. Java's ProcessBuilder isn't vulnerable because of a check in ProcessBuilder.start. NuProcess is missing that check. This vulnerability can only be exploited to inject command line arguments on Linux. Version 2.0.5 contains a patch. As a workaround, users of the library can sanitize command strings to remove NUL characters prior to passing them to NuProcess for execution.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-39243
MISC
CONFIRM
MISC[/TD]
[/TR]
[TR]
[TD]
online_banking_system -- online_banking_system
[/TD]
[TD]
Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the cust_id parameter at /net-banking/send_funds_action.php.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-40118
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
online_banking_system -- online_banking_system
[/TD]
[TD]
Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the cust_id parameter at /net-banking/delete_beneficiary.php.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-40115
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
online_banking_system -- online_banking_system
[/TD]
[TD]
Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the search parameter at /net-banking/beneficiary.php.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-40116
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
online_banking_system -- online_banking_system
[/TD]
[TD]
Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the search_term parameter at /net-banking/customer_transactions.php.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-40120
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
online_banking_system -- online_banking_system
[/TD]
[TD]
Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the cust_id parameter at /net-banking/edit_customer.php.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-40114
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
online_banking_system -- online_banking_system
[/TD]
[TD]
Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the search_term parameter at /net-banking/transactions.php.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-40119
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
online_banking_system -- online_banking_system
[/TD]
[TD]
Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the cust_id parameter at /net-banking/delete_customer.php.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-40117
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
online_banking_system -- online_banking_system
[/TD]
[TD]
Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the search parameter at /net-banking/manage_customers.php.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-40121
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
online_banking_system -- online_banking_system
[/TD]
[TD]
Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the cust_id parameter at /net-banking/edit_customer_action.php.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-40122
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
online_banking_system -- online_banking_system
[/TD]
[TD]
Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the cust_id parameter at /net-banking/send_funds.php.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-40113
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
online_leave_management_system -- online_leave_management_system
[/TD]
[TD]
Online Leave Management System v1.0 is vulnerable to SQL Injection via /leave_system/classes/Master.php?f=delete_application.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
7.2
[/TD]
[TD]CVE-2022-40928
MISC[/TD]
[/TR]
[TR]
[TD]
online_leave_management_system -- online_leave_management_system
[/TD]
[TD]
Online Leave Management System v1.0 is vulnerable to SQL Injection via /leave_system/classes/Master.php?f=delete_designation.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
7.2
[/TD]
[TD]CVE-2022-40927
MISC[/TD]
[/TR]
[TR]
[TD]
online_leave_management_system -- online_leave_management_system
[/TD]
[TD]
Online Leave Management System v1.0 is vulnerable to SQL Injection via /leave_system/classes/Master.php?f=delete_leave_type.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
7.2
[/TD]
[TD]CVE-2022-40926
MISC[/TD]
[/TR]
[TR]
[TD]
online_market_place_site -- online_market_place_site
[/TD]
[TD]
Sourcecodester Online Market Place Site v1.0 suffers from an unauthenticated blind SQL Injection Vulnerability allowing remote attackers to dump the SQL database via time-based SQL injection..
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-30004
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
online_tours_travels_management_system -- online_tours_travels_management_system
[/TD]
[TD]
Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_currency.php.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
7.2
[/TD]
[TD]CVE-2022-40097
MISC[/TD]
[/TR]
[TR]
[TD]
online_tours_travels_management_system -- online_tours_travels_management_system
[/TD]
[TD]
Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_expense_category.php.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
7.2
[/TD]
[TD]CVE-2022-40099
MISC[/TD]
[/TR]
[TR]
[TD]
online_tours_travels_management_system -- online_tours_travels_management_system
[/TD]
[TD]
Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_booking.php.
[/TD]
[TD]
2022-09-27
[/TD]
[TD]
7.2
[/TD]
[TD]CVE-2022-40354
MISC[/TD]
[/TR]
[TR]
[TD]
online_tours_travels_management_system -- online_tours_travels_management_system
[/TD]
[TD]
Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/up_booking.php.
[/TD]
[TD]
2022-09-27
[/TD]
[TD]
7.2
[/TD]
[TD]CVE-2022-40353
MISC[/TD]
[/TR]
[TR]
[TD]
online_tours_travels_management_system -- online_tours_travels_management_system
[/TD]
[TD]
Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_expense.php.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
7.2
[/TD]
[TD]CVE-2022-40098
MISC[/TD]
[/TR]
[TR]
[TD]
online_tours_travels_management_system -- online_tours_travels_management_system
[/TD]
[TD]
Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_traveller.php.
[/TD]
[TD]
2022-09-27
[/TD]
[TD]
7.2
[/TD]
[TD]CVE-2022-40352
MISC[/TD]
[/TR]
[TR]
[TD]
open5gs -- open5gs
[/TD]
[TD]
A vulnerability has been found in Open5GS up to 2.4.10 and classified as problematic. This vulnerability affects unknown code in the library lib/core/ogs-tlv-msg.c of the component UDP Packet Handler. The manipulation leads to denial of service. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-209686 is the identifier assigned to this vulnerability.
[/TD]
[TD]
2022-09-28
[/TD]
[TD]
7.5
[/TD]
[TD]CVE-2022-3354
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
orckestra -- c1_cms
[/TD]
[TD]
Orckestra C1 CMS is a .NET based Web Content Management System. A vulnerability in versions prior to 6.13 allows remote attackers to execute arbitrary code on affected installations of Orckestra C1 CMS. Authentication is required to exploit this vulnerability. The authenticated user may perform the actions unknowingly by visiting a specially crafted site. This issue is patched in C1 CMS v6.13. There are no known workarounds.
[/TD]
[TD]
2022-09-27
[/TD]
[TD]
8
[/TD]
[TD]CVE-2022-39256
MISC
MISC
CONFIRM[/TD]
[/TR]
[TR]
[TD]
pbc -- pbc
[/TD]
[TD]
An issue has been found in PBC through 2022-8-27. A SEGV issue detected in the function pbc_wmessage_integer in src/wmessage.c:137.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
7.5
[/TD]
[TD]CVE-2022-38936
MISC[/TD]
[/TR]
[TR]
[TD]
python-jwt -- python-jwt
[/TD]
[TD]
python-jwt is a module for generating and verifying JSON Web Tokens. Versions prior to 3.3.4 are subject to Authentication Bypass by Spoofing, resulting in identity spoofing, session hijacking or authentication bypass. An attacker who obtains a JWT can arbitrarily forge its contents without knowing the secret key. Depending on the application, this may for example enable the attacker to spoof other user's identities, hijack their sessions, or bypass authentication. Users should upgrade to version 3.3.4. There are no known workarounds.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
9.1
[/TD]
[TD]CVE-2022-39227
MISC
CONFIRM
MISC[/TD]
[/TR]
[TR]
[TD]
qualcomm -- apq8009
[/TD]
[TD]
Memory corruption due to use after free issue in kernel while processing ION handles in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
7.8
[/TD]
[TD]CVE-2022-22058
CONFIRM[/TD]
[/TR]
[TR]
[TD]
realtek -- rtl8195am
[/TD]
[TD]
On Realtek RTL8195AM devices before 284241d70308ff2519e40afd7b284ba892c730a3, the timer task can be locked when there are frequent and continuous Wi-Fi connection failures for the Soft AP mode.
[/TD]
[TD]
2022-09-27
[/TD]
[TD]
7.5
[/TD]
[TD]CVE-2022-34326
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
redis -- redis
[/TD]
[TD]
Redis is an in-memory database that persists on disk. Versions 7.0.0 and above, prior to 7.0.5 are vulnerable to an Integer Overflow. Executing an `XAUTOCLAIM` command on a stream key in a specific state, with a specially crafted `COUNT` argument may cause an integer overflow, a subsequent heap overflow, and potentially lead to remote code execution. This has been patched in Redis version 7.0.5. No known workarounds exist.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-35951
CONFIRM
FEDORA
GENTOO[/TD]
[/TR]
[TR]
[TD]
resumes_management_and_job_application_website_application -- resumes_management_and_job_application_website_application
[/TD]
[TD]
SQL Injection vulnerability exists in version 1.0 of the Resumes Management and Job Application Website application login form by EGavilan Media that allows authentication bypass through login.php.
[/TD]
[TD]
2022-09-27
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2021-41433
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
rocket.chat -- rocket.chat
[/TD]
[TD]
A improper authentication vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 that allowed two factor authentication can be bypassed when telling the server to use CAS during login.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-35248
MISC[/TD]
[/TR]
[TR]
[TD]
rocket.chat -- rocket.chat
[/TD]
[TD]
A SQL injection vulnerability exists in Rocket.Chat <v3.18.6, <v4.4.4 and <v4.7.3 which can allow an attacker to retrieve a reset password token through or a 2fa secret.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-32211
MISC[/TD]
[/TR]
[TR]
[TD]
rockwellautomation -- thinmanager
[/TD]
[TD]
Rockwell Automation ThinManager ThinServer versions 11.0.0 - 13.0.0 is vulnerable to a heap-based buffer overflow. An attacker could send a specifically crafted TFTP or HTTPS request, causing a heap-based buffer overflow that crashes the ThinServer process. If successfully exploited, this could expose the server to arbitrary remote code execution.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-38742
MISC[/TD]
[/TR]
[TR]
[TD]
samsung -- tizenrt
[/TD]
[TD]
An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). l2_packet_receive_timeout in wpa_supplicant/src/l2_packet/l2_packet_pcap.c has a missing check on the return value of pcap_dispatch, leading to a denial of service (malfunction).
[/TD]
[TD]
2022-09-29
[/TD]
[TD]
7.5
[/TD]
[TD]CVE-2022-40279
MISC
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
samsung -- tizenrt
[/TD]
[TD]
An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). createDB in security/provisioning/src/provisioningdatabasemanager.c has a missing sqlite3_free after sqlite3_exec, leading to a denial of service.
[/TD]
[TD]
2022-09-29
[/TD]
[TD]
7.5
[/TD]
[TD]CVE-2022-40278
MISC
MISC
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
scala-lang -- scala
[/TD]
[TD]
Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with LazyList object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-36944
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
secp256k1-js_project -- secp256k1-js
[/TD]
[TD]
The secp256k1-js package before 1.1.0 for Node.js implements ECDSA without required r and s validation, leading to signature forgery.
[/TD]
[TD]
2022-09-24
[/TD]
[TD]
7.5
[/TD]
[TD]CVE-2022-41340
MISC
MISC
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
sophos -- firewall
[/TD]
[TD]
A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-3236
CONFIRM[/TD]
[/TR]
[TR]
[TD]
strapi -- strapi
[/TD]
[TD]
Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses.
[/TD]
[TD]
2022-09-27
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-31367
MISC
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
symfony -- twig
[/TD]
[TD]
Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the `source` or `include` statement to read arbitrary files from outside the templates' directory when using a namespace like `@somewhere/../some.file`. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading.
[/TD]
[TD]
2022-09-28
[/TD]
[TD]
7.5
[/TD]
[TD]CVE-2022-39261
MISC
CONFIRM
CONFIRM[/TD]
[/TR]
[TR]
[TD]
tacitine -- en6200-prime_quad-35
[/TD]
[TD]
This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 (inclusive), due to improper session management in the Tacitine Firewall web-based management interface. An unauthenticated remote attacker could exploit this vulnerability by sending a specially crafted http request on the targeted device. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to perform session fixation on the targeted device.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-40630
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
tacitine -- en6200-prime_quad-35
[/TD]
[TD]
This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 (inclusive), due to improper control of code generation in the Tacitine Firewall web-based management interface. An unauthenticated remote attacker could exploit this vulnerability by sending a specially crafted http request on the targeted device. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary commands on the targeted device.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-40628
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
tacitine -- en6200-prime_quad-35
[/TD]
[TD]
This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 (inclusive), due to insecure design in the Tacitine Firewall web-based management interface. An unauthenticated remote attacker could exploit this vulnerability by sending a specially crafted http request on the targeted device. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to view sensitive information on the targeted device.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
7.5
[/TD]
[TD]CVE-2022-40629
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
tenda -- ac18
[/TD]
[TD]
Tenda AC18 router V15.03.05.19 contains a stack overflow vulnerability in the formSetQosBand->FUN_0007db78 function with the request /goform/SetNetControlList/
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
7.2
[/TD]
[TD]CVE-2022-40861
MISC[/TD]
[/TR]
[TR]
[TD]
tenda -- ac18
[/TD]
[TD]
Tenda AC18 router contained a stack overflow vulnerability in /goform/fast_setting_wifi_set
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-40854
MISC[/TD]
[/TR]
[TR]
[TD]
tenda -- i9
[/TD]
[TD]
Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the set_local_time function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
7.5
[/TD]
[TD]CVE-2022-40106
MISC[/TD]
[/TR]
[TR]
[TD]
tenda -- i9
[/TD]
[TD]
Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formexeCommand function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
7.5
[/TD]
[TD]CVE-2022-40107
MISC[/TD]
[/TR]
[TR]
[TD]
tenda -- i9
[/TD]
[TD]
Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formWifiMacFilterGet function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
7.5
[/TD]
[TD]CVE-2022-40105
MISC[/TD]
[/TR]
[TR]
[TD]
tenda -- i9
[/TD]
[TD]
Tenda i9 v1.0.0.8(3828) was discovered to contain a command injection vulnerability via the FormexeCommand function.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-40100
MISC[/TD]
[/TR]
[TR]
[TD]
tenda -- i9
[/TD]
[TD]
Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formwrlSSIDset function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
7.5
[/TD]
[TD]CVE-2022-40102
MISC[/TD]
[/TR]
[TR]
[TD]
tenda -- i9
[/TD]
[TD]
Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formWifiMacFilterSet function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
7.5
[/TD]
[TD]CVE-2022-40101
MISC[/TD]
[/TR]
[TR]
[TD]
tenda -- i9
[/TD]
[TD]
Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formwrlSSIDget function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
7.5
[/TD]
[TD]CVE-2022-40104
MISC[/TD]
[/TR]
[TR]
[TD]
tenda -- tx3
[/TD]
[TD]
Tenda TX3 US_TX3V1.0br_V16.03.13.11 is vulnerable to stack overflow via compare_parentcontrol_time.
[/TD]
[TD]
2022-09-28
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-40942
MISC[/TD]
[/TR]
[TR]
[TD]
tenda -- w20e
[/TD]
[TD]
Tenda W20E router V15.11.0.6 (US_W20EV4.0br_V15.11.0.6(1068_1546_841)_CN_TDC) contains a stack overflow vulnerability in the function formSetDebugCfg with request /goform/setDebugCfg/
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-40866
MISC[/TD]
[/TR]
[TR]
[TD]
tenda -- w20e
[/TD]
[TD]
Tenda W20E router V15.11.0.6 (US_W20EV4.0br_V15.11.0.6(1068_1546_841)_CN_TDC) contains a stack overflow vulnerability in the function formIPMacBindDel with the request /goform/delIpMacBind/
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-40867
MISC[/TD]
[/TR]
[TR]
[TD]
tenda -- w20e
[/TD]
[TD]
Tenda W20E router V15.11.0.6 (US_W20EV4.0br_V15.11.0.6(1068_1546_841)_CN_TDC) contains a stack overflow vulnerability in the function formDelDhcpRule with the request /goform/delDhcpRules/
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-40868
MISC[/TD]
[/TR]
[TR]
[TD]
tenda -- w20e
[/TD]
[TD]
Tenda W20E router V15.11.0.6 contains a stack overflow in the function formSetPortMapping with post request 'goform/setPortMapping/'. This vulnerability allows attackers to cause a Denial of Service (DoS) or Remote Code Execution (RCE) via the portMappingServer, portMappingProtocol, portMappingWan, porMappingtInternal, and portMappingExternal parameters.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-40855
MISC[/TD]
[/TR]
[TR]
[TD]
toaruos -- toaruos
[/TD]
[TD]
readelf in ToaruOS 2.0.1 has a global overflow allowing RCE when parsing a crafted ELF file.
[/TD]
[TD]
2022-09-27
[/TD]
[TD]
7.8
[/TD]
[TD]CVE-2022-38932
MISC[/TD]
[/TR]
[TR]
[TD]
tp-link -- archer_ax10_v1
[/TD]
[TD]
TP Link Archer AX10 V1 Firmware Version 1.3.1 Build 20220401 Rel. 57450(5553) was discovered to allow authenticated attackers to execute arbitrary code via a crafted backup file.
[/TD]
[TD]
2022-09-28
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-40486
MISC
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
trendmicro -- deep_security
[/TD]
[TD]
A link following vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
[/TD]
[TD]
2022-09-28
[/TD]
[TD]
7.8
[/TD]
[TD]CVE-2022-40710
N/A
N/A[/TD]
[/TR]
[TR]
[TD]
trudesk_project -- trudesk
[/TD]
[TD]
The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request in GitHub repository polonel/trudesk prior to 1.2.2. This can lead to Denial of service.
[/TD]
[TD]
2022-09-29
[/TD]
[TD]
7.5
[/TD]
[TD]CVE-2022-1718
CONFIRM
MISC[/TD]
[/TR]
[TR]
[TD]
ui -- desktop
[/TD]
[TD]
A local privilege escalation vulnerability in UI Desktop for Windows (Version 0.55.1.2 and earlier) allows a malicious actor with local access to a Windows device with UI Desktop to run arbitrary commands as SYSTEM.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
7.8
[/TD]
[TD]CVE-2022-35257
MISC[/TD]
[/TR]
[TR]
[TD]
vim -- vim
[/TD]
[TD]
Use After Free in GitHub repository vim/vim prior to 9.0.0614.
[/TD]
[TD]
2022-09-29
[/TD]
[TD]
7.8
[/TD]
[TD]CVE-2022-3352
CONFIRM
MISC[/TD]
[/TR]
[TR]
[TD]
vim -- vim
[/TD]
[TD]
Use After Free in GitHub repository vim/vim prior to 9.0.0579.
[/TD]
[TD]
2022-09-25
[/TD]
[TD]
7.8
[/TD]
[TD]CVE-2022-3297
MISC
CONFIRM[/TD]
[/TR]
[TR]
[TD]
vim -- vim
[/TD]
[TD]
Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0577.
[/TD]
[TD]
2022-09-25
[/TD]
[TD]
7.8
[/TD]
[TD]CVE-2022-3296
MISC
CONFIRM[/TD]
[/TR]
[TR]
[TD]
vim -- vim
[/TD]
[TD]
Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0598.
[/TD]
[TD]
2022-09-27
[/TD]
[TD]
7.8
[/TD]
[TD]CVE-2022-3324
CONFIRM
MISC[/TD]
[/TR]
[TR]
[TD]
wayland -- wayland
[/TD]
[TD]
An internal reference count is held on the buffer pool, incremented every time a new buffer is created from the pool. The reference count is maintained as an int; on LP64 systems this can cause the reference count to overflow if the client creates a large number of wl_shm buffer objects, or if it can coerce the server to create a large number of external references to the buffer storage. With the reference count overflowing, a use-after-free can be constructed on the wl_shm_pool tracking structure, where values may be incremented or decremented; it may also be possible to construct a limited oracle to leak 4 bytes of server-side memory to the attacking client at a time.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2021-3782
MISC[/TD]
[/TR]
[TR]
[TD]
wazuh -- wazuh
[/TD]
[TD]
Wazuh v3.6.1 - v3.13.5, v4.0.0 - v4.2.7, and v4.3.0 - v4.3.7 were discovered to contain an authenticated remote code execution (RCE) vulnerability via the Active Response endpoint.
[/TD]
[TD]
2022-09-28
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-40497
MISC[/TD]
[/TR]
[TR]
[TD]
wedding_planner -- wedding_planner
[/TD]
[TD]
Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /wedding_details.php.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-40483
MISC[/TD]
[/TR]
[TR]
[TD]
wedding_planner -- wedding_planner
[/TD]
[TD]
Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /package_detail.php.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-40485
MISC[/TD]
[/TR]
[TR]
[TD]
wedding_planner -- wedding_planner
[/TD]
[TD]
Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/feature_edit.php.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
7.2
[/TD]
[TD]CVE-2022-40403
MISC[/TD]
[/TR]
[TR]
[TD]
wedding_planner -- wedding_planner
[/TD]
[TD]
Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the booking parameter at /admin/client_edit.php.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-40484
MISC[/TD]
[/TR]
[TR]
[TD]
wedding_planner -- wedding_planner
[/TD]
[TD]
Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the booking parameter at /admin/client_assign.php.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-40402
MISC[/TD]
[/TR]
[TR]
[TD]
wedding_planner -- wedding_planner
[/TD]
[TD]
Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/select.php.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-40404
MISC[/TD]
[/TR]
[TR]
[TD]
wordpress -- wordpress
[/TD]
[TD]
The Scripts Organizer WordPress plugin before 3.0 does not have capability and CSRF checks in the saveScript AJAX action, available to both unauthenticated and authenticated users, and does not validate user input in any way, which could allow unauthenticated users to put arbitrary PHP code in a file
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2021-24890
MISC
CONFIRM[/TD]
[/TR]
[TR]
[TD]
wordpress -- wordpress
[/TD]
[TD]
Cross-Site Request Forgery (CSRF) vulnerability in Read more By Adam plugin <= 1.1.8 at WordPress.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-38085
CONFIRM
CONFIRM[/TD]
[/TR]
[TR]
[TD]
wordpress -- wordpress
[/TD]
[TD]
Authenticated (subscriber+) Broken Access Control vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-38134
CONFIRM
CONFIRM[/TD]
[/TR]
[TR]
[TD]
wordpress -- wordpress
[/TD]
[TD]
The Post SMTP Mailer/Email Log WordPress plugin before 2.1.7 does not have proper authorisation in some AJAX actions, which could allow high privilege users such as admin to perform blind SSRF on multisite installations for example.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
7.2
[/TD]
[TD]CVE-2022-2352
MISC[/TD]
[/TR]
[TR]
[TD]
wordpress -- wordpress
[/TD]
[TD]
The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
7.2
[/TD]
[TD]CVE-2022-2903
MISC[/TD]
[/TR]
[TR]
[TD]
wordpress -- wordpress
[/TD]
[TD]
The Ldap WP Login / Active Directory Integration WordPress plugin before 3.0.2 does not have any authorisation and CSRF checks when updating it's settings (which are hooked to the init action), allowing unauthenticated attackers to update them. Attackers could set their own LDAP server to be used to authenticated users, therefore bypassing the current authentication
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
7.5
[/TD]
[TD]CVE-2022-2987
MISC[/TD]
[/TR]
[TR]
[TD]
wordpress -- wordpress
[/TD]
[TD]
Cross-Site Request Forgery (CSRF) vulnerability Backup Scheduler plugin <= 1.5.13 at WordPress.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-38079
CONFIRM
CONFIRM[/TD]
[/TR]
[TR]
[TD]
wordpress -- wordpress
[/TD]
[TD]
The CM Download Manager WordPress plugin before 2.8.6 allows high privilege users such as admin to upload arbitrary files by setting the any extension via the plugin's setting, which could be used by admins of multisite blog to upload PHP files for example.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
7.2
[/TD]
[TD]CVE-2022-3076
MISC[/TD]
[/TR]
[TR]
[TD]
wordpress -- wordpress
[/TD]
[TD]
Unauthenticated Sensitive Information Disclosure vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
7.5
[/TD]
[TD]CVE-2022-40194
CONFIRM
CONFIRM[/TD]
[/TR]
[TR]
[TD]
wordpress -- wordpress
[/TD]
[TD]
Cross-Site Request Forgery (CSRF) vulnerability in Kraken.io Image Optimizer plugin <= 2.6.5 at WordPress.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-38454
CONFIRM
CONFIRM[/TD]
[/TR]
[TR]
[TD]
wordpress -- wordpress
[/TD]
[TD]
Cross-Site Request Forgery (CSRF) vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
8.8
[/TD]
[TD]CVE-2022-38470
CONFIRM
CONFIRM[/TD]
[/TR]
[TR]
[TD]
wordpress -- wordpress
[/TD]
[TD]
The OAuth client Single Sign On WordPress plugin before 3.0.4 does not have authorisation and CSRF when updating its settings, which could allow unauthenticated attackers to update them and change the OAuth endpoints to ones they controls, allowing them to then be authenticated as admin if they know the correct email address
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
7.5
[/TD]
[TD]CVE-2022-3119
MISC[/TD]
[/TR]
[TR]
[TD]
xpdfreader -- xpdf
[/TD]
[TD]
There is a use-after-free issue in JBIG2Stream::close() located in JBIG2Stream.cc in Xpdf 4.04. It can be triggered by sending a crafted PDF file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service or possibly have unspecified other impact.
[/TD]
[TD]
2022-09-29
[/TD]
[TD]
7.8
[/TD]
[TD]CVE-2022-38222
MISC[/TD]
[/TR]
[TR]
[TD]
xuxueli -- xxl-job
[/TD]
[TD]
XXL-JOB 2.2.0 has a Command execution vulnerability in background tasks.
[/TD]
[TD]
2022-09-28
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-40929
MISC[/TD]
[/TR]
[TR]
[TD]
zfile -- zfile
[/TD]
[TD]
ZFile v4.1.1 was discovered to contain an arbitrary file upload vulnerability via the component /file/upload/1.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-40050
MISC[/TD]
[/TR]
[TR]
[TD]
zimbra -- collaboration
[/TD]
[TD]
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.x and 9.x (e.g., 8.8.15). The Sudo configuration permits the zimbra user to execute the NGINX binary as root with arbitrary parameters. As part of its intended functionality, NGINX can load a user-defined configuration file, which includes plugins in the form of .so files, which also execute as root.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
7.8
[/TD]
[TD]CVE-2022-41347
MISC
MISC
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
zimbra -- collaboration
[/TD]
[TD]
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavisd via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavisd automatically prefers it over cpio.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2022-41352
MISC
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
zoo_management_system -- zoo_management_system
[/TD]
[TD]
Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "save_event" file of the "Events" module in the background management system.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
7.2
[/TD]
[TD]CVE-2022-40925
MISC[/TD]
[/TR]
[TR]
[TD]
zoo_management_system -- zoo_management_system
[/TD]
[TD]
Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "save_animal" file of the "Animals" module in the background management system.
[/TD]
[TD]
2022-09-26
[/TD]
[TD]
7.2
[/TD]
[TD]CVE-2022-40924
MISC[/TD]
[/TR]
[TR]
[TD]
zte -- zxa10_b76hv3
[/TD]
[TD]
There is a broken access control vulnerability in ZTE ZXvSTB product. Due to improper permission control, attackers could use this vulnerability to delete the default application type, which affects normal use of system.
[/TD]
[TD]
2022-09-23
[/TD]
[TD]
9.1
[/TD]
[TD]CVE-2022-23144
MISC[/TD]
[/TR]
[TR]
[TD]
zyxel -- cloudcnm_secumanager
[/TD]
[TD]
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded OAUTH_SECRET_KEY in /opt/axess/etc/default/axess.
[/TD]
[TD]
2022-09-29
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2020-15331
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
zyxel -- cloudcnm_secumanager
[/TD]
[TD]
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded opt/axess/AXAssets/default_axess/axess/TR69/Handlers/turbolink/sshkeys/id_rsa SSH key.
[/TD]
[TD]
2022-09-29
[/TD]
[TD]
7.5
[/TD]
[TD]CVE-2020-15340
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
zyxel -- cloudcnm_secumanager
[/TD]
[TD]
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated update_all_realm_license API.
[/TD]
[TD]
2022-09-29
[/TD]
[TD]
7.5
[/TD]
[TD]CVE-2020-15341
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
zyxel -- cloudcnm_secumanager
[/TD]
[TD]
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the q6xV4aW8bQ4cfD-b password for the axiros account.
[/TD]
[TD]
2022-09-29
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2020-15347
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
zyxel -- cloudcnm_secumanager
[/TD]
[TD]
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak /opt/axess/etc/default/axess permissions.
[/TD]
[TD]
2022-09-29
[/TD]
[TD]
9.8
[/TD]
[TD]CVE-2020-15332
MISC
MISC[/TD]
[/TR]
[TR]
[TD]
zyxel -- cloudcnm_secumanager
[/TD]
[TD]
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 uses ZODB storage without authentication.
[/TD]
[TD]
2022-09-29
[/TD]
[TD]
7.5
[/TD]
[TD]CVE-2020-15327
MISC
MISC[/TD]
[/TR]

Back to top

Medium Vulnerabilities

Primary
Vendor -- Product Description Published CVSS Score Source & Patch Info
10up -- restricted_site_access
The Restricted Site Access WordPress plugin before 7.3.2 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations in certain situations.
2022-09-26
5.3
CVE-2022-1613
MISC
3d_tag_cloud_project -- 3d_tag_cloud
Multiple Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in 3D Tag Cloud plugin <= 3.8 at WordPress.
2022-09-23
6.1
CVE-2022-36417
CONFIRM
CONFIRM
add_shortcodes_actions_and_filters_project -- add_shortcodes_actions_and_filters
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability Add Shortcodes Actions And Filters plugin <= 2.0.9 at WordPress.
2022-09-23
4.8
CVE-2022-37342
CONFIRM
CONFIRM
adobe -- download_manager
The Download Manager WordPress plugin before 3.2.55 does not validate one of its settings, which could allow high privilege users such as admin to list and read arbitrary files and folders outside of the blog directory
2022-09-26
4.9
CVE-2022-2926
MISC
adobe -- experience_manager
Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Exploitation of this issue requires low-privilege access to AEM.
2022-09-23
5.4
CVE-2022-38438
MISC
adobe -- experience_manager
Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Exploitation of this issue requires low-privilege access to AEM.
2022-09-23
5.4
CVE-2022-38439
MISC
adobe -- experience_manager

Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Exploitation of this issue requires low-privilege access to AEM.
2022-09-30
5.4
CVE-2022-28851
MISC
ajaxplorer -- ajaxplorer
An issue was discovered in AjaXplorer 4.2.3, allows attackers to cause cross site scripting vulnerabilities via a crafted svg file upload.
2022-09-23
5.4
CVE-2022-40358
MISC
MISC
algolplus -- advanced_dynamic_pricing_for_woocommerce
Cross-Site Request Forgery (CSRF) vulnerability in AlgolPlus Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.3 at WordPress.
2022-09-23
4.3
CVE-2022-38095
CONFIRM
CONFIRM
amazon -- fhir-works-on-aws-authz-smart
fhir-works-on-aws-authz-smart is an implementation of the authorization interface from the FHIR Works interface. Versions 3.1.1 and 3.1.2 are subject to Exposure of Sensitive Information to an Unauthorized Actor. This issue allows a client of the API to retrieve more information than the client’s OAuth scope permits when making “search-type” requests. This issue would not allow a client to retrieve information about individuals other than those the client was already authorized to access. Users of fhir-works-on-aws-authz-smart 3.1.1 or 3.1.2 should upgrade to version 3.1.3 or higher immediately. Versions 3.1.0 and below are unaffected. There is no workaround for this issue.
2022-09-23
6.5
CVE-2022-39230
CONFIRM
apache -- pulsar
TLS hostname verification cannot be enabled in the Pulsar Broker's Java Client, the Pulsar Broker's Java Admin Client, the Pulsar WebSocket Proxy's Java Client, and the Pulsar Proxy's Admin Client leaving intra-cluster connections and geo-replication connections vulnerable to man in the middle attacks, which could leak credentials, configuration data, message data, and any other data sent by these clients. The vulnerability is for both the pulsar+ssl protocol and HTTPS. An attacker can only take advantage of this vulnerability by taking control of a machine 'between' the client and the server. The attacker must then actively manipulate traffic to perform the attack by providing the client with a cryptographically valid certificate for an unrelated host. This issue affects Apache Pulsar Broker, Proxy, and WebSocket Proxy versions 2.7.0 to 2.7.4; 2.8.0 to 2.8.3; 2.9.0 to 2.9.2; 2.10.0; 2.6.4 and earlier.
2022-09-23
5.9
CVE-2022-33682
MISC
apache -- pulsar
Delayed TLS hostname verification in the Pulsar Java Client and the Pulsar Proxy make each client vulnerable to a man in the middle attack. Connections from the Pulsar Java Client to the Pulsar Broker/Proxy and connections from the Pulsar Proxy to the Pulsar Broker are vulnerable. Authentication data is sent before verifying the server’s TLS certificate matches the hostname, which means authentication data could be exposed to an attacker. An attacker can only take advantage of this vulnerability by taking control of a machine 'between' the client and the server. The attacker must then actively manipulate traffic to perform the attack by providing the client with a cryptographically valid certificate for an unrelated host. Because the client sends authentication data before performing hostname verification, an attacker could gain access to the client’s authentication data. The client eventually closes the connection when it verifies the hostname and identifies the targeted hostname does not match a hostname on the certificate. Because the client eventually closes the connection, the value of the intercepted authentication data depends on the authentication method used by the client. Token based authentication and username/password authentication methods are vulnerable because the authentication data can be used to impersonate the client in a separate session. This issue affects Apache Pulsar Java Client versions 2.7.0 to 2.7.4; 2.8.0 to 2.8.3; 2.9.0 to 2.9.2; 2.10.0; 2.6.4 and earlier.
2022-09-23
5.9
CVE-2022-33681
MISC
apache -- pulsar
Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer TLS certificates, even when tlsAllowInsecureConnection is disabled via configuration. The Pulsar Admin Client's intra-cluster and geo-replication HTTPS connections are vulnerable to man in the middle attacks, which could leak authentication data, configuration data, and any other data sent by these clients. An attacker can only take advantage of this vulnerability by taking control of a machine 'between' the client and the server. The attacker must then actively manipulate traffic to perform the attack. This issue affects Apache Pulsar Broker and Proxy versions 2.7.0 to 2.7.4; 2.8.0 to 2.8.3; 2.9.0 to 2.9.2; 2.10.0; 2.6.4 and earlier.
2022-09-23
5.9
CVE-2022-33683
MISC
apache -- tomcat
The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client.
2022-09-28
5.3
CVE-2021-43980
MISC
MLIST
apasionados -- export_post_info
Authenticated (author+) CSV Injection vulnerability in Export Post Info plugin <= 1.2.0 at WordPress.
2022-09-23
5.7
CVE-2022-38061
CONFIRM
CONFIRM
apple -- macos
A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11.6.8, watchOS 8.7, tvOS 15.6, macOS Monterey 12.5, Security Update 2022-005 Catalina. An app may be able to leak sensitive user information.
2022-09-23
5.5
CVE-2022-32823
MISC
MISC
MISC
MISC
MISC
MISC
apple -- macos
This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.4, iOS 15.5 and iPadOS 15.5, Security Update 2022-005 Catalina, macOS Big Sur 11.6.8. An app with root privileges may be able to access private information.
2022-09-23
4.4
CVE-2022-32781
MISC
MISC
MISC
MISC
apple -- macos
A logic issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.5. An app may be able to bypass Privacy preferences.
2022-09-23
5.5
CVE-2022-32789
MISC
apple -- macos
This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.4. An app with root privileges may be able to access private information.
2022-09-23
4.4
CVE-2022-32782
MISC
apple -- macos
An issue in the handling of environment variables was addressed with improved validation. This issue is fixed in Security Update 2022-005 Catalina, macOS Big Sur 11.6.8, macOS Monterey 12.5. An app may be able to modify protected parts of the file system.
2022-09-23
5.5
CVE-2022-32786
MISC
MISC
MISC
apple -- macos
A logic issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.4. An app may gain unauthorized access to Bluetooth.
2022-09-23
5.5
CVE-2022-32783
MISC
apple -- macos
An out-of-bounds read issue was addressed with improved bounds checking. This issue is fixed in Security Update 2022-005 Catalina, macOS Monterey 12.5. A user in a privileged network position may be able to leak sensitive information.
2022-09-23
5.9
CVE-2022-32799
MISC
MISC
apple -- macos
An out-of-bounds read issue was addressed with improved bounds checking. This issue is fixed in watchOS 8.7, tvOS 15.6, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. An app may be able to disclose kernel memory.
2022-09-23
5.5
CVE-2022-32817
MISC
MISC
MISC
MISC
apple -- macos
The issue was addressed with improved handling of caches. This issue is fixed in Security Update 2022-005 Catalina, macOS Big Sur 11.6.8, macOS Monterey 12.5. An app may be able to access sensitive user information.
2022-09-23
5.5
CVE-2022-32805
MISC
MISC
MISC
apple -- macos
A null pointer dereference was addressed with improved validation. This issue is fixed in iOS 15.6 and iPadOS 15.6, Security Update 2022-005 Catalina, macOS Big Sur 11.6.8, macOS Monterey 12.5. Processing an image may lead to a denial-of-service.
2022-09-23
5.5
CVE-2022-32785
MISC
MISC
MISC
MISC
apple -- macos
An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11.6.8, tvOS 15.6, macOS Monterey 12.5, Security Update 2022-005 Catalina. An app may be able to access sensitive user information.
2022-09-23
5.5
CVE-2022-32849
MISC
MISC
MISC
MISC
MISC
apple -- macos
This issue was addressed with improved checks. This issue is fixed in Security Update 2022-005 Catalina, macOS Big Sur 11.6.8, macOS Monterey 12.5. An app may be able to modify protected parts of the file system.
2022-09-23
5.5
CVE-2022-32800
MISC
MISC
MISC
apple -- macos
A logic issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.6.8, macOS Monterey 12.5. An app may be able to capture a user’s screen.
2022-09-23
5.5
CVE-2022-32848
MISC
MISC
apple -- macos
The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.5. An app may be able to leak sensitive kernel state.
2022-09-23
5.5
CVE-2022-32818
MISC
apple -- macos
The issue was addressed with improved memory handling. This issue is fixed in watchOS 8.7, tvOS 15.6, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. Processing a maliciously crafted image may result in disclosure of process memory.
2022-09-23
5.5
CVE-2022-32841
MISC
MISC
MISC
MISC
apple -- macos
An issue in the handling of environment variables was addressed with improved validation. This issue is fixed in macOS Monterey 12.4. A user may be able to view sensitive user information.
2022-09-23
5.5
CVE-2022-26707
MISC
apple -- macos
The issue was addressed with improved memory handling. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11.6.8, watchOS 8.7, tvOS 15.6, macOS Monterey 12.5, Security Update 2022-005 Catalina. An app with root privileges may be able to execute arbitrary code with kernel privileges.
2022-09-23
6.7
CVE-2022-32832
MISC
MISC
MISC
MISC
MISC
MISC
apple -- macos
The issue was addressed with improved UI handling. This issue is fixed in watchOS 8.7, tvOS 15.6, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. Visiting a website that frames malicious content may lead to UI spoofing.
2022-09-23
6.5
CVE-2022-32816
MISC
MISC
MISC
MISC
apple -- macos
The issue was addressed with improved memory handling. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11.6.8, watchOS 8.7, tvOS 15.6, macOS Monterey 12.5. An app may be able to disclose kernel memory.
2022-09-23
5.5
CVE-2022-32825
MISC
MISC
MISC
MISC
MISC
apple -- macos
The issue was addressed with improved memory handling. This issue is fixed in iOS 15.6 and iPadOS 15.6, tvOS 15.6, macOS Monterey 12.5. An app may be able to disclose kernel memory.
2022-09-23
5.5
CVE-2022-32828
MISC
MISC
MISC
asus -- armoury_crate_service
Armoury Crate Service’s logging function has insufficient validation to check if the log file is a symbolic link. A physical attacker with general user privilege can modify the log file property to a symbolic link that points to arbitrary system file, causing the logging function to overwrite the system file and disrupt the system.
2022-09-28
5.9
CVE-2022-38699
MISC
asus -- rt-ax88u_firmware
An HTTP response splitting attack in web application in ASUS RT-AX88U before v3.0.0.4.388.20558 allows an attacker to craft a specific URL that if an authenticated victim visits it, the URL will give access to the cloud storage of the attacker.
2022-09-26
6.5
CVE-2021-41437
MISC
CONFIRM
bitcoin\/altcoin_faucet_project -- bitcoin\/altcoin_faucet
The Bitcoin / Altcoin Faucet WordPress plugin through 1.6.0 does not have any CSRF check when saving its settings, allowing attacker to make a logged in admin change them via a CSRF attack. Furthermore, due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues
2022-09-26
5.4
CVE-2022-3025
MISC
blazzdev -- rate_my_post_-_wp_rating_system
Cross-Site Request Forgery (CSRF) vulnerability in Rate my Post – WP Rating System plugin <= 3.3.4 at WordPress.
2022-09-23
4.3
CVE-2022-40671
CONFIRM
CONFIRM
blossomthemes -- blossom_recipe_maker
Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in Blossom Recipe Maker plugin <= 1.0.7 at WordPress.
2022-09-23
5.4
CVE-2022-37338
CONFIRM
CONFIRM
bytebase -- bytebase

The “Bytebase” application does not restrict low privilege user to access admin “projects“ for which an unauthorized user can view the “projects“ created by “Admin” and the affected endpoint is “/api/project?user=${userId}”.
2022-09-28
4.3
CVE-2022-32170
MISC
MISC
bytebase -- bytebase

The “Bytebase” application does not restrict low privilege user to access “admin issues“ for which an unauthorized user can view the “OPEN” and “CLOSED” issues by “Admin” and the affected endpoint is “/issue”.
2022-09-28
4.3
CVE-2022-32169
MISC
MISC
castos -- seriously_simple_podcasting
Cross-Site Request Forgery (CSRF) vulnerability in Seriously Simple Podcasting plugin <= 2.16.0 at WordPress, leading to plugin settings change.
2022-09-23
4.3
CVE-2022-40132
CONFIRM
CONFIRM
centreon -- centreon
Centreon v20.10.18 was discovered to contain a cross-site scripting (XSS) vulnerability via the esc_name (Escalation Name) parameter at Configuration/Notifications/Escalations. This vulnerability allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.
2022-09-26
5.4
CVE-2022-40044
MISC
MISC
clogica -- seo_redirection
Cross-Site Request Forgery (CSRF) vulnerability in SEO Redirection plugin <= 8.9 at WordPress, leading to deletion of 404 errors and redirection history.
2022-09-23
4.3
CVE-2022-38704
CONFIRM
CONFIRM
connectwise -- connectwise
WiseConnect - ScreenConnect Session Code Bypass. An attacker would have to use a proxy to monitor the traffic, and perform a brute force on the session code in order to get in. Sensitive data about the company , get in a session.
2022-09-28
5.3
CVE-2022-36781
MISC
cowell_enterprise_travel_management_system_project -- cowell_enterprise_travel_management_system
Cowell enterprise travel management system has insufficient filtering for special characters within web URL. An unauthenticated remote attacker can inject JavaScript and perform XSS (Reflected Cross-Site Scripting) attack.
2022-09-28
6.1
CVE-2022-39054
MISC
creativeitem -- academy_learning_management_system
Academy Learning Management System before v5.9.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Search parameter.
2022-09-26
6.1
CVE-2022-38553
MISC
MISC
MISC
MISC
MISC
dell -- smartfabric_os10
Dell Networking OS10, versions prior to October 2021 with Smart Fabric Services enabled, contains an information disclosure vulnerability. A remote, unauthenticated attacker could potentially exploit this vulnerability by reverse engineering to retrieve sensitive information and access the REST API with admin privileges.
2022-09-28
4.9
CVE-2022-29089
MISC
ec-cube -- ec-cube
DOM-based cross-site scripting vulnerability in EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote attacker to inject an arbitrary script by having an administrative user of the product to visit a specially crafted page.
2022-09-27
5.4
CVE-2022-38975
MISC
MISC
elastic -- elastic_cloud_enterprise
A flaw was discovered in ECE before 3.1.1 that could lead to the disclosure of the SAML signing private key used for the RBAC features, in deployment logs in the Logging and Monitoring cluster.
2022-09-28
5.3
CVE-2022-23716
MISC
MISC
etaplighting -- etap_safety_manager
ETAP Lighting International NV ETAP Safety Manager 1.0.0.32 is vulnerable to Cross Site Scripting (XSS). Input passed to the GET parameter 'action' is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML/JS code in a user's browser session in context of an affected site.
2022-09-28
6.1
CVE-2022-40912
MISC
expense_management_system_project -- expense_management_system
A stored Cross-Site Scripting (XSS) vulnerability exists in version 1.0 of the Expense Management System application that allows for arbitrary execution of JavaScript commands through index.php.
2022-09-28
5.4
CVE-2021-41434
MISC
MISC
express_xss_sanitizer_project -- express_xss_sanitizer
The package express-xss-sanitizer before 1.1.3 are vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitization.
2022-09-26
6.1
CVE-2022-21169
CONFIRM
CONFIRM
CONFIRM
CONFIRM
f-secure -- internet_gatekeeper
A Denial-of-Service vulnerability was discovered in the F-Secure and WithSecure products where aerdl.so/aerdl.dll may go into an infinite loop when unpacking PE files. It is possible that this can crash the scanning engine
2022-09-23
5.5
CVE-2022-28886
MISC
MISC
fullworksplugins -- meet_my_team
Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Meet My Team plugin <= 2.0.5 at WordPress.
2022-09-23
5.4
CVE-2022-37339
CONFIRM
CONFIRM
fusionpbx -- fusionpbx
An issue was discovered in FusionPBX before 4.5.30. The log_viewer.php Log View page allows an authenticated user to choose an arbitrary filename for download (i.e., not necessarily freeswitch.log in the intended directory).
2022-09-29
6.5
CVE-2021-43403
MISC
fwupd -- fwupd
When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file.
2022-09-28
6.5
CVE-2022-3287
MISC
gajim -- gajim
An issue was discovered in Gajim through 1.4.7. The vulnerability allows attackers, via crafted XML stanzas, to correct messages that were not sent by them. The attacker needs to be part of the group chat or single chat. The fixed version is 1.5.0.
2022-09-27
5.3
CVE-2022-39835
MISC
MISC
gavazziautomation -- cpy_car_park_server
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 the Sentilo Proxy is prone to reflected XSS which only affects the Sentilo service.
2022-09-28
6.1
CVE-2022-28816
CONFIRM
gavazziautomation -- cpy_car_park_server
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of an SQL-injection to gain access to a volatile temporary database with the current states of the device.
2022-09-28
5.3
CVE-2022-28813
CONFIRM
glfusion -- glfusion
glFusion CMS v1.7.9 is affected by a reflected Cross Site Scripting (XSS) vulnerability. The value of the title request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. This input was echoed unmodified in the application's response.
2022-09-29
6.1
CVE-2021-45843
MISC
google -- chrome
Inappropriate implementation in Site Isolation in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.
2022-09-26
6.5
CVE-2022-3044
MISC
MISC
GENTOO
FEDORA
google -- chrome
Insufficient validation of untrusted input in DevTools in Google Chrome on Chrome OS prior to 105.0.5195.125 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted HTML page.
2022-09-26
5.4
CVE-2022-3201
MISC
MISC
GENTOO
DEBIAN
FEDORA
google -- chrome
Inappropriate implementation in Chrome OS lockscreen in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a local attacker to bypass lockscreen navigation restrictions via physical access to the device.
2022-09-26
6.8
CVE-2022-3048
MISC
MISC
GENTOO
FEDORA
google -- chrome
Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to bypass content security policy via a crafted HTML page.
2022-09-26
6.5
CVE-2022-3056
MISC
MISC
GENTOO
FEDORA
google -- chrome
Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 104.0.5112.101 allowed a remote attacker to arbitrarily browse to a malicious website via a crafted HTML page.
2022-09-26
6.5
CVE-2022-2856
MISC
MISC
FEDORA
google -- chrome
Insufficient policy enforcement in Extensions API in Google Chrome prior to 105.0.5195.52 allowed an attacker who convinced a user to install a malicious extension to bypass downloads policy via a crafted HTML page.
2022-09-26
6.5
CVE-2022-3047
MISC
MISC
GENTOO
FEDORA
google -- chrome
Insufficient policy enforcement in DevTools in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
2022-09-26
6.5
CVE-2022-3054
MISC
MISC
GENTOO
FEDORA
google -- chrome
Insufficient policy enforcement in Cookies in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to bypass cookie prefix restrictions via a crafted HTML page.
2022-09-26
6.5
CVE-2022-2860
MISC
MISC
FEDORA
google -- chrome
Inappropriate implementation in Extensions API in Google Chrome prior to 104.0.5112.101 allowed an attacker who convinced a user to install a malicious extension to inject arbitrary scripts into WebUI via a crafted HTML page.
2022-09-26
6.5
CVE-2022-2861
MISC
MISC
FEDORA
google -- chrome
Inappropriate implementation in iframe Sandbox in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
2022-09-26
6.5
CVE-2022-3057
MISC
MISC
GENTOO
FEDORA
google -- chrome
Inappropriate implementation in Pointer Lock in Google Chrome on Mac prior to 105.0.5195.52 allowed a remote attacker to restrict user navigation via a crafted HTML page.
2022-09-26
4.3
CVE-2022-3053
MISC
MISC
GENTOO
FEDORA
gunkastudios -- login_block_ips
The Login Block IPs WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
2022-09-26
4.3
CVE-2022-3098
MISC
hashicorp -- consul
HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint, enabling leverage of privileged access to bypass service mesh intentions. Fixed in 1.11.9, 1.12.5, and 1.13.2."
2022-09-23
6.5
CVE-2022-40716
MISC
MISC
heimavista -- dark_horse_rpage
Heimavista Rpage has insufficient filtering for platform web URL. An unauthenticated remote attacker can inject JavaScript and perform XSS (Reflected Cross-Site Scripting) attack.
2022-09-28
6.1
CVE-2022-39053
MISC
hitach -- vantara
A tenant administrator Hitachi Content Platform (HCP) may modify the configuration in another tenant without authorization, potentially allowing unauthorized access to data in the other tenant. Also, a tenant user (non-administrator) may view configuration in another tenant without authorization. This issue affects: Hitachi Vantara Hitachi Content Platform versions prior to 8.3.7; 9.0.0 versions prior to 9.2.3.
2022-09-26
4.9
CVE-2021-28052
MISC
MISC
ibm -- application_gateway
IBM Application Gateway is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 221965.
2022-09-28
5.4
CVE-2022-22387
XF
CONFIRM
ibm -- common_cryptographic_architecture
IBM Common Cryptographic Architecture (CCA 5.x MTM for 4767 and CCA 7.x MTM for 4769) could allow a local user to cause a denial of service due to improper input validation. IBM X-Force ID: 223596.
2022-09-23
5.5
CVE-2022-22423
XF
CONFIRM
ibm -- infosphere_information_server
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 236586.
2022-09-23
5.4
CVE-2022-40748
XF
CONFIRM
ibm -- infosphere_information_server
IBM InfoSphere Information Server 8.1, 8.5, and 8,7 could allow a remote authenticated attacker to obtain sensitive information, caused by improper restrictions on directories. An attacker could exploit this vulnerability via the DataStage application to load or import content functionality to view arbitrary files on the system.
2022-09-29
6.5
CVE-2012-4818
MISC
XF
ibm -- java_sdk
IBM Java Security Components in IBM SDK, Java Technology Edition 8 before SR1 FP10, 7 R1 before SR3 FP10, 7 before SR9 FP10, 6 R1 before SR8 FP7, 6 before SR16 FP7, and 5.0 before SR16 FP13 stores plaintext information in memory dumps, which allows local users to obtain sensitive information by reading a file.
2022-09-29
5.5
CVE-2015-1931
MISC
MISC
MISC
MISC
MISC
MISC
MISC
MISC
MISC
MISC
ibm -- jazz_for_service_management
IBM Jazz for Service Management is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 231381.
2022-09-28
5.4
CVE-2022-35722
CONFIRM
XF
ibm -- jazz_for_service_management
IBM Jazz for Service Management 1.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 231380.
2022-09-23
5.4
CVE-2022-35721
CONFIRM
XF
ibm -- qradar_user_behavior_analytics
IBM QRadar User Behavior Analytics could allow an authenticated user to obtain sensitive information from that they should not have access to. IBM X-Force ID: 232791.
2022-09-28
6.5
CVE-2022-36771
XF
CONFIRM
ibm -- rational_asset_manager
IBM Rational Asset Manager 7.5 could allow a remote attacker to bypass security restrictions. An attacker could exploit this vulnerability using the UID parameter to modify another user's preferences.
2022-09-29
4.3
CVE-2011-4820
XF
ibm -- rational_change
IBM Rational Change 5.3 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using the SUPP_TEMPLATE_FLAG parameter in a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
2022-09-29
6.1
CVE-2012-2160
MISC
XF
ibm -- websphere_application_server
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, an attacker with local network access could exploit this vulnerability to obtain sensitive data.
2022-09-28
6.5
CVE-2022-35282
XF
CONFIRM
iegeek -- ig20_firmware
ieGeek IG20 hipcam RealServer V1.0 is vulnerable to Incorrect Access Control. The algorithm used to generate device IDs (UIDs) for devices that utilize Shenzhen Yunni Technology iLnkP2P suffers from a predictability flaw that allows remote attackers to establish direct connections to arbitrary devices.
2022-09-26
6.5
CVE-2022-38970
MISC
ikus-soft -- rdiffweb
Use of Cache Containing Sensitive Information in GitHub repository ikus060/rdiffweb prior to 2.4.8.
2022-09-28
4.6
CVE-2022-3292
CONFIRM
MISC
inventree_project -- inventree
Cross-site Scripting (XSS) - Stored in GitHub repository inventree/inventree prior to 0.8.3.
2022-09-29
5.4
CVE-2022-3355
CONFIRM
MISC
iris -- isams
ISAMS 22.2.3.2 is prone to stored Cross-site Scripting (XSS) attack on the title field for groups, allowing an attacker to store a JavaScript payload that will be executed when another user uses the application.
2022-09-27
5.4
CVE-2022-37028
MISC
MISC
ivanti -- endpoint_manager
The “LANDesk(R) Management Agent” service exposes a socket and once connected, it is possible to launch commands only for signed executables. This is a security bug that allows a limited user to get escalated admin privileges on their system.
2022-09-23
6.7
CVE-2022-30121
MISC
jetbrains -- teamcity
In JetBrains TeamCity before 2022.04.4 environmental variables of "password" type could be logged when using custom Perforce executable
2022-09-23
5.3
CVE-2022-40979
MISC
kfm_project -- kfm
Cross site scripting (XSS) vulnerability in kfm through 1.4.7 via crafted GET request to /kfm/index.php.
2022-09-23
6.1
CVE-2022-40359
MISC
MISC
lcnet -- smart_evision
Smart eVision has inadequate authorization for the database query function. A remote attacker with general user privilege, who is not explicitly authorized to access the information, can access sensitive information.
2022-09-28
6.5
CVE-2022-39029
MISC
lcnet -- smart_evision
Smart eVision has a path traversal vulnerability in the Report API function due to insufficient filtering for special characters in URLs. A remote attacker with general user privilege can exploit this vulnerability to bypass authentication, access restricted paths and download system files.
2022-09-28
6.5
CVE-2022-39034
MISC
lcnet -- smart_evision
Smart eVision has insufficient authorization for task acquisition function. An unauthorized remote attacker can exploit this vulnerability to acquire the Session IDs of other general users only.
2022-09-28
5.3
CVE-2022-39031
MISC
lcnet -- smart_evision
Smart eVision has insufficient filtering for special characters in the POST Data parameter in the specific function. An unauthenticated remote attacker can inject JavaScript to perform XSS (Stored Cross-Site Scripting) attack.
2022-09-28
5.4
CVE-2022-39035
MISC
linux -- linux_kernel
A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or member of the audio group) could use this flaw to crash the system, resulting in a denial of service condition
2022-09-27
4.7
CVE-2022-3303
MISC
MISC
linux -- linux_kernel
There exists an arbitrary memory read within the Linux Kernel BPF - Constants provided to fill pointers in structs passed in to bpf_sys_bpf are not verified and can point anywhere, including memory not owned by BPF. An attacker with CAP_BPF can arbitrarily read memory from anywhere on the system. We recommend upgrading past commit 86f44fcec22c
2022-09-23
5.5
CVE-2022-2785
CONFIRM
CONFIRM
mailoptin -- mailoptin
Unauthenticated Optin Campaign Cache Deletion vulnerability in MailOptin plugin <= 1.2.49.0 at WordPress.
2022-09-23
5.3
CVE-2022-36340
CONFIRM
CONFIRM
matrix -- javascript_sdk
Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Starting with version 17.1.0-rc.1, improperly formed beacon events can disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer. This is patched in matrix-js-sdk v19.7.0. Redacting applicable events, waiting for the sync processor to store data, and restarting the client are possible workarounds. Alternatively, redacting the applicable events and clearing all storage will fix the further perceived issues. Downgrading to an unaffected version, noting that such a version may be subject to other vulnerabilities, will additionally resolve the issue.
2022-09-28
5.3
CVE-2022-39236
MISC
MISC
MISC
CONFIRM
matrix -- software_development_kit
matrix-android-sdk2 is the Matrix SDK for Android. Prior to version 1.5.1, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this may be missing in others. This attack is possible due to the key forwarding strategy implemented in the matrix-android-sdk2 that is too permissive. Starting with version 1.5.1, the default policy for accepting key forwards has been made more strict in the matrix-android-sdk2. The matrix-android-sdk2 will now only accept forwarded keys in response to previously issued requests and only from own, verified devices. The SDK now sets a `trusted` flag on the decrypted message upon decryption, based on whether the key used to decrypt the message was received from a trusted source. Clients need to ensure that messages decrypted with a key with `trusted = false` are decorated appropriately (for example, by showing a warning for such messages). As a workaroubnd, current users of the SDK can disable key forwarding in their forks using `CryptoService#enableKeyGossiping(enable: Boolean)`.
2022-09-28
5.3
CVE-2022-39246
MISC
CONFIRM
MISC
MISC
mattermost -- mattermost_server
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows authenticated users to cause resource exhaustion while processing the file, resulting in server-side Denial of Service.
2022-09-23
6.5
CVE-2022-3257
MISC
MISC
mediawiki -- mediawiki
An issue was discovered in the GlobalWatchlist extension in MediaWiki through 1.36.2. The rev-deleted-user and ntimes messages were not properly escaped and allowed for users to inject HTML and JavaScript.
2022-09-29
6.1
CVE-2021-42046
MISC
MISC
MISC
mediawiki -- mediawiki
An issue was discovered in the Growth extension in MediaWiki through 1.36.2. Any admin can add arbitrary JavaScript code to the Newcomer home page footer, which can be executed by viewers with zero edits.
2022-09-29
4.8
CVE-2021-42048
MISC
MISC
mediawiki -- mediawiki
An issue was discovered in the Translate extension in MediaWiki through 1.36.2. Oversighters cannot undo revisions or oversight on pages where they suppressed information (such as PII). This allows oversighters to whitewash revisions.
2022-09-29
6.5
CVE-2021-42049
MISC
MISC
mediawiki -- mediawiki
An issue was discovered in the Growth extension in MediaWiki through 1.36.2. On any Wiki with the Mentor Dashboard feature enabled, users can login with a mentor account and trigger an XSS payload (such as alert) via Growthexperiments-mentor-dashboard-mentee-overview-no-js-fallback.
2022-09-29
5.4
CVE-2021-42047
MISC
MISC
metersphere -- metersphere
An arbitrary file read vulnerability was found in Metersphere v1.15.4, where authenticated users can read any file on the server via the file download function.
2022-09-29
6.5
CVE-2021-45789
MISC
mygraph_project -- mygraph
MyGraph is a permission management system. Versions prior to 1.0.4 are vulnerable to a storage XSS vulnerability leading to Remote Code Execution. This issue is patched in version 1.0.4. There is no known workaround.
2022-09-24
5.4
CVE-2022-39240
CONFIRM
nheko_project -- nheko
nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting malicious secrets, which could lead to man-in-the-middle attacks. Users can upgrade to version 0.10.2 to protect against this issue. As a workaround, one may apply the patch manually, avoid doing verifications of one's own devices, and/or avoid pressing the request button in the settings menu.
2022-09-28
5.9
CVE-2022-39264
CONFIRM
MISC
MISC
FEDORA
notice_board_project -- notice_board
Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in NOTICE BOARD plugin <= 1.1 at WordPress.
2022-09-23
5.4
CVE-2022-38460
CONFIRM
CONFIRM
nuxtjs -- netlify-ipx
netlify-ipx is an on-Demand image optimization for Netlify using ipx. In versions prior to 1.2.3, an attacker can bypass the source image domain allowlist by sending specially crafted headers, causing the handler to load and return arbitrary images. Because the response is cached globally, this image will then be served to visitors without requiring those headers to be set. XSS can be achieved by requesting a malicious SVG with embedded scripts, which would then be served from the site domain. Note that this does not apply to images loaded in `<img>` tags, as scripts do not execute in this context. The image URL can be set in the header independently of the request URL, meaning any site images that have not previously been cached can have their cache poisoned. This problem has been fixed in version 1.2.3. As a workaround, cached content can be cleared by re-deploying the site.
2022-09-23
5.4
CVE-2022-39239
CONFIRM
octopus -- octopus_server
In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have access to view in an error message when a resource is part of another Space.
2022-09-28
4.3
CVE-2022-2760
MISC
online_market_place_site_project -- online_market_place_site
Sourcecodester Online Market Place Site 1.0 is vulnerable to Cross Site Scripting (XSS), allowing attackers to register as a Seller then create new products containing XSS payloads in the 'Product Title' and 'Short Description' fields.
2022-09-26
5.4
CVE-2022-30003
MISC
MISC
ovirt -- ovirt-engine
An HTML injection/reflected Cross-site scripting (XSS) vulnerability was found in the ovirt-engine. A parameter "error_description" fails to sanitize the entry, allowing the vulnerability to trigger on the Windows Service Accounts home pages.
2022-09-28
6.1
CVE-2022-3193
MISC
oxilab -- image_hover_effects_ultimate
The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title & Description values that can be added to an Image Hover in versions up to, and including, 9.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, the plugin only allows administrators access to edit Image Hovers, however, if a site admin makes the plugin's features available to lower privileged users through the 'Who Can Edit?' setting then this can be exploited by those users.
2022-09-23
5.4
CVE-2022-2937
MISC
MISC
parity -- frontier
Frontier is an Ethereum compatibility layer for Substrate. Prior to commit d3beddc6911a559a3ecc9b3f08e153dbe37a8658, the worst case weight was always accounted as the block weight for all cases. In case of large EVM gas refunds, this can lead to block spamming attacks -- the adversary can construct blocks with transactions that have large amount of refunds or unused gases with reverts, and as a result inflate up the chain gas prices. The impact of this issue is limited in that the spamming attack would still be costly for any adversary, and it has no ability to alter any chain state. This issue has been patched in commit d3beddc6911a559a3ecc9b3f08e153dbe37a8658. There are no known workarounds.
2022-09-24
5.3
CVE-2022-39242
MISC
CONFIRM
php -- php
In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications.
2022-09-28
6.5
CVE-2022-31629
MISC
php -- php
In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.
2022-09-28
5.5
CVE-2022-31628
MISC
quantumcloud -- slider_hero
The Slider Hero WordPress plugin before 8.4.4 does not escape the slider Name, which could allow high-privileged users to perform Cross-Site Scripting attacks.
2022-09-26
4.8
CVE-2022-3074
MISC
rocket.chat -- rocket.chat
A cleartext storage of sensitive information exists in Rocket.Chat <v4.6.4 due to Oauth token being leaked in plaintext in Rocket.chat logs.
2022-09-23
5.3
CVE-2022-32217
MISC
rocket.chat -- rocket.chat
An improper authentication vulnerability exists in Rocket.Chat Mobile App <4.14.1.22788 that allowed an attacker with physical access to a mobile device to bypass local authentication (PIN code).
2022-09-23
6.8
CVE-2022-30124
MISC
rocket.chat -- rocket.chat
An information disclosure vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 due to the actionLinkHandler method was found to allow Message ID Enumeration with Regex MongoDB queries.
2022-09-23
4.3
CVE-2022-32218
MISC
rocket.chat -- rocket.chat
An information disclosure vulnerability exists in Rocket.Chat <v4.7.5 which allowed the "users.list" REST endpoint gets a query parameter from JSON and runs Users.find(queryFromClientSide). This means virtually any authenticated user can access any data (except password hashes) of any user authenticated.
2022-09-23
4.3
CVE-2022-32219
MISC
rocket.chat -- rocket.chat
An information disclosure vulnerability exists in Rocket.Chat <v5 due to the getUserMentionsByChannel meteor server method discloses messages from private channels and direct messages regardless of the users access permission to the room.
2022-09-23
6.5
CVE-2022-32220
MISC
rocket.chat -- rocket.chat
An improper access control vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 due to input data in the getUsersOfRoom Meteor server method is not type validated, so that MongoDB query operator objects are accepted by the server, so that instead of a matching rid String a$regex query can be executed, bypassing the room access permission check for every but the first matching room.
2022-09-23
4.3
CVE-2022-32226
MISC
rocket.chat -- rocket.chat
An information disclosure vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 since the getReadReceipts Meteor server method does not properly filter user inputs that are passed to MongoDB queries, allowing $regex queries to enumerate arbitrary Message IDs.
2022-09-23
4.3
CVE-2022-32228
MISC
rocket.chat -- rocket.chat
A cleartext transmission of sensitive information exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 relating to Oauth tokens by having the permission "view-full-other-user-info", this could cause an oauth token leak in the product.
2022-09-23
6.5
CVE-2022-32227
MISC
rocket.chat -- rocket.chat
A cross-site scripting vulnerability exists in Rocket.chat <v5 due to style injection in the complete chat window, an adversary is able to manipulate not only the style of it, but will also be able to block functionality as well as hijacking the content of targeted users. Hence the payloads are stored in messages, it is a persistent attack vector, which will trigger as soon as the message gets viewed.
2022-09-23
5.4
CVE-2022-35251
MISC
rocket.chat -- rocket.chat
A information disclosure vulnerability exists in Rockert.Chat <v5 due to /api/v1/chat.getThreadsList lack of sanitization of user inputs and can therefore leak private thread messages to unauthorized users via Mongo DB injection.
2022-09-23
4.3
CVE-2022-32229
MISC
rocket.chat -- rocket.chat
A privilege escalation vulnerability exists in Rocket.chat <v5 which made it possible to elevate privileges for any authenticated user to view Direct messages without appropriate permissions.
2022-09-23
4.3
CVE-2022-35250
MISC
rocket.chat -- rocket.chat
A information disclosure vulnerability exists in Rocket.Chat <v5 where the getUserMentionsByChannel meteor server method discloses messages from private channels and direct messages regardless of the users access permission to the room.
2022-09-23
4.3
CVE-2022-35249
MISC
rocket.chat -- rocket.chat
A information disclosure vulnerability exists in Rocket.chat <v5, <v4.8.2 and <v4.7.5 where the lack of ACL checks in the getRoomRoles Meteor method leak channel members with special roles to unauthorized clients.
2022-09-23
4.3
CVE-2022-35247
MISC
rocket.chat -- rocket.chat
A NoSQL-Injection information disclosure vulnerability vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 in the getS3FileUrl Meteor server method that can disclose arbitrary file upload URLs to users that should not be able to access.
2022-09-23
4.3
CVE-2022-35246
MISC
seo_smart_links_project -- seo_smart_links
The SEO Smart Links WordPress plugin through 3.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
2022-09-26
4.8
CVE-2022-3135
MISC
simple_bitcoin_faucets_project -- simple_bitcoin_faucets
The Simple Bitcoin Faucets WordPress plugin through 1.7.0 does not have any authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscribers to call it and add/delete/edit Bonds. Furthermore, due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues
2022-09-26
5.4
CVE-2022-3024
MISC
simplefilelist -- simple-file-list
The Simple File List WordPress plugin before 4.4.12 does not escape parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting
2022-09-26
6.1
CVE-2022-3062
MISC
sony -- playstation_4_firmware
A vulnerability was found in Sony PS4 and PS5. It has been classified as critical. This affects the function UVFAT_readupcasetable of the component exFAT Handler. The manipulation of the argument dataLength leads to heap-based buffer overflow. It is possible to launch the attack on the physical device. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-209679.
2022-09-28
6.8
CVE-2022-3349
MISC
MISC
svg_support_wordpress -- svg_support
The SVG Support WordPress plugin before 2.5 does not properly handle SVG added via an URL, which could allow users with a role as low as author to perform Cross-Site Scripting attacks
2022-09-26
5.4
CVE-2022-1755
MISC
swftools -- swftools
SWFTools commit 772e55a2 was discovered to contain a stack overflow via ImageStream::getPixel(unsigned char*) at /xpdf/Stream.cc.
2022-09-23
5.5
CVE-2022-35099
MISC
MISC
swftools -- swftools
SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via draw_stroke at /gfxpoly/stroke.c.
2022-09-23
5.5
CVE-2022-35096
MISC
MISC
swftools -- swftools
SWFTools commit 772e55a2 was discovered to contain a segmentation violation via FoFiTrueType::writeTTF at /xpdf/FoFiTrueType.cc.
2022-09-23
5.5
CVE-2022-35097
MISC
MISC
swftools -- swftools
SWFTools commit 772e55a2 was discovered to contain a floating point exception (FPE) via DCTStream::readMCURow() at /xpdf/Stream.cc.ow()
2022-09-23
5.5
CVE-2022-35091
MISC
MISC
swftools -- swftools
SWFTools commit 772e55a2 was discovered to contain a segmentation violation via convert_gfxline at /gfxpoly/convert.c.
2022-09-23
5.5
CVE-2022-35092
MISC
MISC
swftools -- swftools
SWFTools commit 772e55a2 was discovered to contain a global buffer overflow via DCTStream::transformDataUnit at /xpdf/Stream.cc.
2022-09-23
5.5
CVE-2022-35093
MISC
MISC
swftools -- swftools
SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via DCTStream::readHuffSym(DCTHuffTable*) at /xpdf/Stream.cc.
2022-09-23
5.5
CVE-2022-35094
MISC
MISC
swftools -- swftools
SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via GfxICCBasedColorSpace::getDefaultColor(GfxColor*) at /xpdf/GfxState.cc.
2022-09-23
5.5
CVE-2022-35098
MISC
MISC
swftools -- swftools
SWFTools commit 772e55a2 was discovered to contain a segmentation violation via InfoOutputDev::type3D1 at /pdf/InfoOutputDev.cc.
2022-09-23
5.5
CVE-2022-35095
MISC
MISC
tabs_project -- tabs
Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in Tabs plugin <= 3.7.1 at WordPress.
2022-09-23
5.4
CVE-2022-40215
CONFIRM
CONFIRM
tenda -- i9_firmware
Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formSetAutoPing function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string.
2022-09-23
5.5
CVE-2022-40103
MISC
themehunk -- wp_popup_builder
The WP Popup Builder WordPress plugin through 1.2.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
2022-09-26
6.1
CVE-2022-2404
MISC
themehunk -- wp_popup_builder
The WP Popup Builder WordPress plugin through 1.2.8 does not have authorisation and CSRF check in an AJAX action, allowing any authenticated users, such as subscribers to delete arbitrary Popup
2022-09-26
4.3
CVE-2022-2405
MISC
tooljet -- tooljet
Just like in the previous report, an attacker could steal the account of different users. But in this case, it's a little bit more specific, because it is needed to be an editor in the same app as the victim.
2022-09-28
4.9
CVE-2022-3348
CONFIRM
MISC
trudesk_project -- trudesk
Reflected XSS on ticket filter function in GitHub repository polonel/trudesk prior to 1.2.2. This vulnerability is capable of executing a malicious javascript code in web page
2022-09-29
5.4
CVE-2022-1719
CONFIRM
MISC
velneo -- vclient
Velneo vClient on its 28.1.3 version, does not correctly check the certificate of authenticity by default. This could allow an attacker that has access to the network to perform a MITM attack in order to obtain the user´s credentials.
2022-09-23
5.9
CVE-2021-45035
CONFIRM
CONFIRM
MISC
MISC
veritas -- system_recovery
Veritas System Recovery (VSR) versions 18 and 21 store a network destination password in the Windows registry during configuration of the backup configuration. This vulnerability could provide a Windows user (who has sufficient privileges) to access a network file system that they were not authorized to access.
2022-09-23
6.5
CVE-2022-41320
MISC
vim -- vim
NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4959.
2022-09-29
5.5
CVE-2022-1725
CONFIRM
MISC
vim -- vim
NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0552.
2022-09-23
5.5
CVE-2022-3278
MISC
CONFIRM
vtiger -- vtiger_crm
Vtiger CRM v7.4.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the e-mail template modules.
2022-09-27
5.4
CVE-2022-38335
MISC
MISC
MISC
webhelpagency -- wha_crossword
Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WHA Crossword plugin <= 1.1.10 at WordPress.
2022-09-23
5.4
CVE-2022-37330
CONFIRM
CONFIRM
wordlift -- wordlift
The WordLift WordPress plugin before 3.37.2 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
2022-09-26
4.8
CVE-2022-3069
MISC
wpchill -- cpo_shortcodes
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CPO Shortcodes plugin <= 1.5.0 at WordPress.
2022-09-23
4.8
CVE-2022-40672
CONFIRM
CONFIRM
xbifrost -- bifrost
Bifrost is a middleware package which can synchronize MySQL/MariaDB binlog data to other types of databases. Versions 1.8.6-release and prior are vulnerable to authentication bypass when using HTTP basic authentication. This may allow group members who only have read permissions to write requests when they are normally forbidden from doing so. Version 1.8.7-release contains a patch. There are currently no known workarounds.
2022-09-26
6.5
CVE-2022-39219
MISC
MISC
CONFIRM
xdsoft -- jodit_editor
Jodit Editor is a WYSIWYG editor written in pure TypeScript without the use of additional libraries. Jodit Editor is vulnerable to XSS attacks when pasting specially constructed input. This issue has not been fully patched. There are no known workarounds.
2022-09-24
6.1
CVE-2022-23461
CONFIRM
zammad -- zammad
Zammad 5.2.1 has a fine-grained permission model that allows to configure read-only access to tickets. However, agents were still wrongly able to perform some operations on such tickets, like adding and removing links, tags. and related answers. This issue has been fixed in 5.2.2.
2022-09-27
4.3
CVE-2022-40817
MISC
zammad -- zammad
Zammad 5.2.1 is vulnerable to Incorrect Access Control. Zammad's asset handling mechanism has logic to ensure that customer users are not able to see personal information of other users. This logic was not effective when used through a web socket connection, so that a logged-in attacker would be able to fetch personal data of other users by querying the Zammad API. This issue is fixed in , 5.2.2.
2022-09-27
6.5
CVE-2022-40816
MISC
zealousweb -- generate_pdf_using_contact_form_7
The Generate PDF WordPress plugin before 3.6 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
2022-09-26
4.8
CVE-2022-3070
MISC
zephyr-one -- zephyr_project_manager
A vulnerability, which was classified as problematic, was found in Zephyr Project Manager up to 3.2.4. Affected is an unknown function of the file /v1/tasks/create/ of the component REST Call Handler. The manipulation of the argument onanimationstart leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 3.2.5 is able to address this issue. It is recommended to upgrade the affected component. VDB-209370 is the identifier assigned to this vulnerability.
2022-09-28
5.4
CVE-2022-3333
MISC
MISC
zyxel -- cloudcnm_secumanager
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a "Use of GET Request Method With Sensitive Query Strings" issue for /registerCpe requests.
2022-09-29
5.3
CVE-2020-15337
MISC
MISC
zyxel -- cloudcnm_secumanager
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak Data.fs permissions.
2022-09-29
5.3
CVE-2020-15329
MISC
MISC
zyxel -- cloudcnm_secumanager
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded APP_KEY in /opt/axess/etc/default/axess.
2022-09-29
5.3
CVE-2020-15330
MISC
MISC
zyxel -- cloudcnm_secumanager
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded certificate for Ejabberd in ejabberd.pem.
2022-09-29
5.3
CVE-2020-15326
MISC
MISC
zyxel -- cloudcnm_secumanager
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded Erlang cookie for ejabberd replication.
2022-09-29
5.3
CVE-2020-15325
MISC
MISC
zyxel -- cloudcnm_secumanager
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows escape-sequence injection into the /var/log/axxmpp.log file.
2022-09-29
5.3
CVE-2020-15334
MISC
MISC
zyxel -- cloudcnm_secumanager
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows live/CPEManager/AXCampaignManager/handle_campaign_script_link?script_name= XSS.
2022-09-29
6.1
CVE-2020-15339
MISC
MISC
zyxel -- cloudcnm_secumanager
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a "Use of GET Request Method With Sensitive Query Strings" issue for /cnr requests.
2022-09-29
5.3
CVE-2020-15338
MISC
MISC
zyxel -- cloudcnm_secumanager
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows attackers to discover accounts via MySQL "select * from Administrator_users" and "select * from Users_users" requests.
2022-09-29
5.3
CVE-2020-15333
MISC
MISC
zyxel -- cloudcnm_secumanager
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zy_install_user_key API.
2022-09-29
5.3
CVE-2020-15343
MISC
MISC
zyxel -- cloudcnm_secumanager
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zy_get_user_id_and_key API.
2022-09-29
5.3
CVE-2020-15344
MISC
MISC
zyxel -- cloudcnm_secumanager
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zy_get_instances_for_update API.
2022-09-29
5.3
CVE-2020-15345
MISC
MISC
zyxel -- cloudcnm_secumanager
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a /live/GLOBALS API with the CLOUDCNM key.
2022-09-29
5.3
CVE-2020-15346
MISC
MISC
zyxel -- cloudcnm_secumanager
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated zy_install_user API.
2022-09-29
5.3
CVE-2020-15342
MISC
MISC
zyxel -- cloudcnm_secumanager
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak /opt/axess/var/blobstorage/ permissions.
2022-09-29
5.3
CVE-2020-15328
MISC
MISC

Back to top

Low Vulnerabilities

Primary
Vendor -- Product Description Published CVSS Score Source & Patch Info
blazzdev -- rate_my_post_-_wp_rating_system
Authenticated (subscriber+) Race Condition vulnerability in Rate my Post – WP Rating System plugin <= 3.3.4 at WordPress allows attackers to increase/decrease votes.
2022-09-23
3.1
CVE-2022-40310
CONFIRM
CONFIRM
dell -- smartfabric_os10
Dell OS10, version 10.5.3.4, contains an Improper Certificate Validation vulnerability in Support Assist. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to unauthorized access to limited switch configuration data. The vulnerability could be leveraged by attackers to conduct man-in-the-middle attacks to gain access to the Support Assist information.
2022-09-28
3.7
CVE-2022-34394
MISC
ec-cube -- ec-cube
Directory traversal vulnerability in EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p4 ) and EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote authenticated attacker with an administrative privilege to obtain the product's directory structure information.
2022-09-27
2.7
CVE-2022-40199
MISC
MISC
gavazziautomation -- cpy_car_park_server
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 the Sentilo Proxy server was discovered to contain a SQL injection vulnerability allowing an attacker to query other tables of the Sentilo service.
2022-09-28
2.7
CVE-2022-28815
CONFIRM
haxx -- curl
When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings.
2022-09-23
3.7
CVE-2022-35252
MISC
CONFIRM
ikus-soft -- rdiffweb
Improper Cleanup on Thrown Exception in GitHub repository ikus060/rdiffweb prior to 2.4.8.
2022-09-26
2.4
CVE-2022-3301
CONFIRM
MISC
parseplatform -- parse-server
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 4.10.16, or from 5.0.0 to 5.2.6, validation of the authentication adapter app ID for _Facebook_ and _Spotify_ may be circumvented. Configurations which allow users to authenticate using the Parse Server authentication adapter where `appIds` is set as a string instead of an array of strings authenticate requests from an app with a different app ID than the one specified in the `appIds` configuration. For this vulnerability to be exploited, an attacker needs to be assigned an app ID by the authentication provider which is a sub-set of the server-side configured app ID. This issue is patched in versions 4.10.16 and 5.2.7. There are no known workarounds.
2022-09-23
3.7
CVE-2022-39231
CONFIRM
parseplatform -- parse-server
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 4.10.15, or 5.0.0 and above prior to 5.2.6, a user can write to the session object of another user if the session object ID is known. For example, an attacker can assign the session object to their own user by writing to the `user` field and then read any custom fields of that session object. Note that assigning a session to another user does not usually change the privileges of either of the two users, and a user cannot assign their own session to another user. This issue is patched in version 4.10.15 and above, and 5.2.6 and above. To mitigate this issue in unpatched versions add a `beforeSave` trigger to the `_Session` class and prevent writing if the requesting user is different from the user in the session object.
2022-09-23
3.1
CVE-2022-39225
CONFIRM
toaruos -- toaruos
readelf in ToaruOS 2.0.1 has some arbitrary address read vulnerabilities when parsing a crafted ELF file.
2022-09-28
3.3
CVE-2022-38934
MISC
trendmicro -- deep_security
An Out-of-bounds read vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows could allow a local attacker to disclose sensitive information on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit these vulnerabilities. This vulnerability is similar to, but not identical to CVE-2022-40708.
2022-09-28
3.3
CVE-2022-40707
N/A
N/A
trendmicro -- deep_security
An Out-of-bounds read vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows could allow a local attacker to disclose sensitive information on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit these vulnerabilities. This vulnerability is similar to, but not identical to CVE-2022-40707.
2022-09-28
3.3
CVE-2022-40708
N/A
N/A
trendmicro -- deep_security
An Out-of-bounds read vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows could allow a local attacker to disclose sensitive information on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit these vulnerabilities. This vulnerability is similar to, but not identical to CVE-2022-40707 and 40708.
2022-09-28
3.3
CVE-2022-40709
N/A
N/A

Back to top

Severity Not Yet Assigned

Primary
Vendor -- Product Description Published CVSS Score Source & Patch Info
actian -- zen
If folder security is misconfigured for Actian Zen PSQL BEFORE Patch Update 1 for Zen 15 SP1 (v15.11.005), Patch Update 4 for Zen 15 (v15.01.017), or Patch Update 5 for Zen 14 SP2 (v14.21.022), it can allow an attacker (with file read/write access) to remove specific security files in order to reset the master password and gain access to the database.
2022-09-30
not yet calculated
CVE-2022-40756
MISC
MISC
amazon -- redshift

In Amazon AWS Redshift JDBC Driver (aka amazon-redshift-jdbc-driver or redshift-jdbc42) before 2.1.0.8, the Object Factory does not check the class type when instantiating an object from a class name.
2022-09-29
not yet calculated
CVE-2022-41828
MISC
ampere -- altra_and_altra_max

Ampere Altra and Ampere Altra Max devices through 2022-07-15 allow attacks via Hertzbleed, which is a power side-channel attack that extracts secret information from the CPU by correlating the power consumption with data being processed on the system.
2022-09-29
not yet calculated
CVE-2022-35888
MISC
MISC
applock -- applock

AppLock version 7.9.29 allows an attacker with physical access to the device to bypass biometric authentication. This is possible because the application did not correctly implement fingerprint validations.
2022-09-30
not yet calculated
CVE-2022-1959
MISC
MISC
bento4 -- bento4

An issue was discovered in Bento4 1.6.0-639. A memory leak exists in AP4_StdcFileByteStream::Create(AP4_FileByteStream*, char const*, AP4_FileByteStream::Mode, AP4_ByteStream*&) in System/StdC/Ap4StdCFileByteStream.cpp.
2022-09-30
not yet calculated
CVE-2022-41847
MISC
MISC
MISC
bento4 -- bento4

An issue was discovered in Bento4 through 1.6.0-639. A NULL pointer dereference occurs in AP4_File:arseStream in Core/Ap4File.cpp, which is called from AP4_File::AP4_File.
2022-09-30
not yet calculated
CVE-2022-41841
MISC
bento4 -- bento4

An issue was discovered in Bento4 1.6.0-639. There ie excessive memory consumption in the function AP4_Array<AP4_ElstEntry>::EnsureCapacity in Core/Ap4Array.h.
2022-09-30
not yet calculated
CVE-2022-41845
MISC
MISC
bento4 -- bento4

An issue was discovered in Bento4 1.6.0-639. There ie excessive memory consumption in the function AP4_DataBuffer::ReallocateBuffer in Core/Ap4DataBuffer.cpp.
2022-09-30
not yet calculated
CVE-2022-41846
MISC
MISC
bigbluebutton -- bigbluebutton
In BigBlueButton before 2.2.7, lockSettingsProps.disablePrivateChat does not apply to already opened chats. This occurs in bigbluebutton-html5/imports/ui/components/chat/service.js.
2022-09-29
not yet calculated
CVE-2020-27601
MISC
MISC
bigbluebutton -- bigbluebutton

BigBlueButton before 2.2.7 does not have a protection mechanism for separator injection in meetingId, userId, and authToken.
2022-09-29
not yet calculated
CVE-2020-27602
MISC
MISC
bigprof -- online_invoicing_system

BigProf Online Invoicing System before 2.9 suffers from an unauthenticated SQL Injection found in /membership_passwordReset.php (the endpoint that is responsible for issuing self-service password resets). An unauthenticated attacker is able to send a request containing a crafted payload that can result in sensitive information being extracted from the database, eventually leading into an application takeover. This vulnerability was introduced as a result of the developer trying to roll their own sanitization implementation in order to allow the application to be used in legacy environments.
2022-09-29
not yet calculated
CVE-2020-35674
MISC
bigprof -- online_invoicing_system

BigProf Online Invoicing System before 3.0 offers a functionality that allows an administrator to move the records of members across groups. The applicable endpoint (admin/pageTransferOwnership.php) lacks CSRF protection, resulting in an attacker being able to escalate their privileges to Administrator and effectively taking over the application.
2022-09-29
not yet calculated
CVE-2020-35675
MISC
MISC
billing_system_project -- billing_system_project

Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinventory/editcategory.php.
2022-09-30
not yet calculated
CVE-2022-41440
MISC
billing_system_project -- billing_system_project

Billing System Project v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /php_action/createProduct.php.
2022-09-30
not yet calculated
CVE-2022-41437
MISC
billing_system_project -- billing_system_project

Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinventory/edituser.php.
2022-09-30
not yet calculated
CVE-2022-41439
MISC
bosch -- videojet_decoder
Information Disclosure in Operator Client application in BVMS 10.1.1, 11.0 and 11.1.0 and VIDEOJET Decoder VJD-7513 versions 10.23 and 10.30 allows man-in-the-middle attacker to compromise confidential video stream. This is only applicable for UDP encryption when target system contains cameras with platform CPP13 or CPP14 and firmware version 8.x.
2022-09-30
not yet calculated
CVE-2022-32540
CONFIRM
bus_pass_management_system -- bus_pass_management_system

Bus Pass Management System 1.0 was discovered to contain a SQL Injection vulnerability via the searchdata parameter at /buspassms/download-pass.php..
2022-09-30
not yet calculated
CVE-2022-35156
MISC
MISC
MISC
bus_pass_management_system -- bus_pass_management_system

Bus Pass Management System v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the searchdata parameter.
2022-09-30
not yet calculated
CVE-2022-35155
MISC
MISC
MISC
canon -- vitrea_view

Multiple cross-site scripting (XSS) vulnerabilities in Canon Medical Vitrea View 7.x before 7.7.6 allow remote attackers to inject arbitrary web script or HTML via (1) the input after the error subdirectory to the /vitrea-view/error/ subdirectory, or the (2) groupID, (3) offset, or (4) limit parameter to an Administrative Panel (Group and Users) page. There is a risk of an attacker retrieving patient information.
2022-09-30
not yet calculated
CVE-2022-37461
MISC
MISC
CONFIRM
chamilo -- chamilo

A zip slip vulnerability in the file upload function of Chamilo v1.11 allows attackers to execute arbitrary code via a crafted Zip file.
2022-09-29
not yet calculated
CVE-2022-40407
CONFIRM
MISC
MISC
chipolo -- chipolo

Chipolo ONE Bluetooth tracker (2020) Chipolo iOS app version 4.13.0 is vulnerable to Incorrect Access Control. Chipolo devices suffer from access revocation evasion attacks once the malicious sharee obtains the access credentials.
2022-09-27
not yet calculated
CVE-2022-37193
MISC
MISC
cisco -- aironet_access_point

A vulnerability in the 802.11 association frame validation of Cisco Catalyst 9100 Series Access Points (APs) could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient input validation of certain parameters within association request frames received by the AP. An attacker could exploit this vulnerability by sending a crafted 802.11 association request to a nearby device. An exploit could allow the attacker to unexpectedly reload the device, resulting in a DoS condition.
2022-09-30
not yet calculated
CVE-2022-20945
CISCO
cisco -- ios_xe
A vulnerability in the processing of Control and Provisioning of Wireless Access Points (CAPWAP) Mobility messages in Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a logic error and improper management of resources related to the handling of CAPWAP Mobility messages. An attacker could exploit this vulnerability by sending crafted CAPWAP Mobility packets to an affected device. A successful exploit could allow the attacker to exhaust resources on the affected device. This would cause the device to reload, resulting in a DoS condition.
2022-09-30
not yet calculated
CVE-2022-20856
CISCO
cisco -- ios_xe
A vulnerability in the self-healing functionality of Cisco IOS XE Software for Embedded Wireless Controllers on Catalyst Access Points could allow an authenticated, local attacker to escape the restricted controller shell and execute arbitrary commands on the underlying operating system of the access point. This vulnerability is due to improper checks throughout the restart of certain system processes. An attacker could exploit this vulnerability by logging on to an affected device and executing certain CLI commands. A successful exploit could allow the attacker to execute arbitrary commands on the underlying OS as root. To successfully exploit this vulnerability, an attacker would need valid credentials for a privilege level 15 user of the wireless controller.
2022-09-30
not yet calculated
CVE-2022-20855
CISCO
cisco -- ios_xe

A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to perform an injection attack against an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI API. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges. To exploit this vulnerability, an attacker must have valid Administrator privileges on the affected device.
2022-09-30
not yet calculated
CVE-2022-20851
CISCO
cisco -- multiple_products
A vulnerability in the smart card login authentication of Cisco Duo for macOS could allow an unauthenticated attacker with physical access to bypass authentication. This vulnerability exists because the assigned user of a smart card is not properly matched with the authenticating user. An attacker could exploit this vulnerability by configuring a smart card login to bypass Duo authentication. A successful exploit could allow the attacker to use any personal identity verification (PIV) smart card for authentication, even if the smart card is not assigned to the authenticating user.
2022-09-30
not yet calculated
CVE-2022-20662
CISCO
cisco -- multiple_products
A vulnerability in the client forwarding code of multiple Cisco Access Points (APs) could allow an unauthenticated, adjacent attacker to inject packets from the native VLAN to clients within nonnative VLANs on an affected device. This vulnerability is due to a logic error on the AP that forwards packets that are destined to a wireless client if they are received on the native VLAN. An attacker could exploit this vulnerability by obtaining access to the native VLAN and directing traffic directly to the client through their MAC/IP combination. A successful exploit could allow the attacker to bypass VLAN separation and potentially also bypass any Layer 3 protection mechanisms that are deployed.
2022-09-30
not yet calculated
CVE-2022-20728
CISCO
cisco -- multiple_products
A vulnerability in the Simple Network Management Protocol (SNMP) of Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family could allow an authenticated, remote attacker to access sensitive information. This vulnerability is due to insufficient restrictions that allow a sensitive configuration detail to be disclosed. An attacker could exploit this vulnerability by retrieving data through SNMP read-only community access. A successful exploit could allow the attacker to view Service Set Identifier (SSID) preshared keys (PSKs) that are configured on the affected device.
2022-09-30
not yet calculated
CVE-2022-20810
CISCO
cisco -- multiple_products

A vulnerability in the UDP processing functionality of Cisco IOS XE Software for Embedded Wireless Controllers on Catalyst 9100 Series Access Points could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due to the improper processing of UDP datagrams. An attacker could exploit this vulnerability by sending malicious UDP datagrams to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.
2022-09-30
not yet calculated
CVE-2022-20848
CISCO
cisco -- multiple_products

A vulnerability in authentication mechanism of Cisco Software-Defined Application Visibility and Control (SD-AVC) on Cisco vManage could allow an unauthenticated, remote attacker to access the GUI of Cisco SD-AVC using a default static username and password combination. This vulnerability exists because the GUI is accessible on self-managed cloud installations or local server installations of Cisco vManage. An attacker could exploit this vulnerability by accessing the exposed GUI of Cisco SD-AVC. A successful exploit could allow the attacker to view managed device names, SD-AVC logs, and SD-AVC DNS server IP addresses.
2022-09-30
not yet calculated
CVE-2022-20844
CISCO
cisco -- multiple_products

Multiple vulnerabilities in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. These vulnerabilities are due to improper access controls on commands within the application CLI. An attacker could exploit these vulnerabilities by running a malicious command on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user.
2022-09-30
not yet calculated
CVE-2022-20775
CISCO
cisco -- multiple_products

A vulnerability in the DHCP processing functionality of Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due to the improper processing of DHCP messages. An attacker could exploit this vulnerability by sending malicious DHCP messages to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.
2022-09-30
not yet calculated
CVE-2022-20847
CISCO
cisco -- multiple_products

Multiple vulnerabilities in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. These vulnerabilities are due to improper access controls on commands within the application CLI. An attacker could exploit these vulnerabilities by running a malicious command on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user.
2022-09-30
not yet calculated
CVE-2022-20818
CISCO
cisco -- multiple_products

A vulnerability in the authentication functionality of Cisco Wireless LAN Controller (WLC) AireOS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient error validation. An attacker could exploit this vulnerability by sending crafted packets to an affected device. A successful exploit could allow the attacker to cause the wireless LAN controller to crash, resulting in a DoS condition. Note: This vulnerability affects only devices that have Federal Information Processing Standards (FIPS) mode enabled.
2022-09-30
not yet calculated
CVE-2022-20769
CISCO
cisco -- multiple_products

Layer 2 network filtering capabilities such as IPv6 RA guard or ARP inspection can be bypassed using combinations of VLAN 0 headers and LLC/SNAP headers.
2022-09-27
not yet calculated
CVE-2021-27853
CONFIRM
CONFIRM
CONFIRM
CISCO
cisco -- multiple_products

Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using combinations of VLAN 0 headers, LLC/SNAP headers, and converting frames from Ethernet to Wifi and its reverse.
2022-09-27
not yet calculated
CVE-2021-27854
CONFIRM
CONFIRM
CONFIRM
cisco -- multiple_products

Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using LLC/SNAP headers with invalid length (and optionally VLAN0 headers)
2022-09-27
not yet calculated
CVE-2021-27861
CONFIRM
CONFIRM
CONFIRM
cisco -- multiple_products

Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using LLC/SNAP headers with invalid length and Ethernet to Wifi frame conversion (and optionally VLAN0 headers).
2022-09-27
not yet calculated
CVE-2021-27862
CONFIRM
CONFIRM
cisco -- multiple_products

A vulnerability in the processing of malformed Common Industrial Protocol (CIP) packets that are sent to Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to unexpectedly reload, resulting in a denial of service (DoS) condition. This vulnerability is due to insufficient input validation during processing of CIP packets. An attacker could exploit this vulnerability by sending a malformed CIP packet to an affected device. A successful exploit could allow the attacker to cause the affected device to unexpectedly reload, resulting in a DoS condition.
2022-09-30
not yet calculated
CVE-2022-20919
CISCO
cisco -- sd-wan_ solution

A vulnerability in the CLI of stand-alone Cisco IOS XE SD-WAN Software and Cisco SD-WAN Software could allow an authenticated, local attacker to delete arbitrary files from the file system of an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by injecting arbitrary file path information when using commands in the CLI of an affected device. A successful exploit could allow the attacker to delete arbitrary files from the file system of the affected device.
2022-09-30
not yet calculated
CVE-2022-20850
CISCO
cisco -- sd-wan_ solution

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to overwrite and possibly corrupt files on an affected system. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by injecting arbitrary commands that are executed as the root user account. A successful exploit could allow the attacker to overwrite arbitrary system files, which could result in a denial of service (DoS) condition.
2022-09-30
not yet calculated
CVE-2022-20930
CISCO
contec -- fxa3200

Contec FXA3200 version 1.13.00 and under suffers from Insecure Permissions in the Wireless LAN Manager interface which allows malicious actors to execute Linux commands with root privilege via a hidden web page (/usr/www/ja/mnt_cmd.cgi).
2022-09-26
not yet calculated
CVE-2022-36158
MISC
MISC
MISC
MISC
contec -- fxa3200

Contec FXA3200 version 1.13 and under were discovered to contain a hard coded hash password for root stored in the component /etc/shadow. As the password strength is weak, it can be cracked in few minutes. Through this credential, a malicious actor can access the Wireless LAN Manager interface and open the telnet port then sniff the traffic or inject any malware.
2022-09-26
not yet calculated
CVE-2022-36159
MISC
MISC
MISC
MISC
css-what -- css-what

The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of insecure regular expression in the re_attr variable of index.js. The exploitation of this vulnerability could be triggered via the parse function.
2022-09-30
not yet calculated
CVE-2022-21222
CONFIRM
CONFIRM
dell -- hybrid_client

Dell Hybrid Client below 1.8 version contains a Zip Slip Vulnerability in UI. A guest privilege attacker could potentially exploit this vulnerability, leading to system files modification.
2022-09-30
not yet calculated
CVE-2022-34429
MISC
dell -- hybrid_client

Dell Hybrid Client prior to version 1.8 contains a Regular Expression Denial of Service Vulnerability in the UI. An adversary with WMS group admin access could potentially exploit this vulnerability, leading to temporary denial-of-service.
2022-09-30
not yet calculated
CVE-2022-34428
MISC
dfsms -- dairy_farm_shop_management_system
Dairy Farm Shop Management System 1.0 is vulnerable to SQL Injection via bwdate-report-ds.php file.
2022-09-30
not yet calculated
CVE-2022-40943
MISC
MISC
dfsms -- dairy_farm_shop_management_system
Dairy Farm Shop Management System 1.0 is vulnerable to SQL Injection via sales-report-ds.php file.
2022-09-30
not yet calculated
CVE-2022-40944
MISC
MISC
MISC
dgiot_lightweight -- dgiot_lightweight

DGIOT Lightweight industrial IoT v4.5.4 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities.
2022-09-29
not yet calculated
CVE-2022-35137
MISC
MISC
discourse -- discourse

Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` branches, a moderator can create new and edit existing themes by using the API when they should not be able to do so. The problem is patched in version 2.8.9 on the `stable` branch and version 2.9.0.beta10 on the `beta` and `tests-passed` branches. There are no known workarounds.
2022-09-29
not yet calculated
CVE-2022-36068
MISC
MISC
CONFIRM
discourse -- discourse

Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` branches, admins can upload a maliciously crafted Zip or Gzip Tar archive to write files at arbitrary locations and trigger remote code execution. The problem is patched in version 2.8.9 on the `stable` branch and version 2.9.0.beta10 on the `beta` and `tests-passed` branches. There are no known workarounds.
2022-09-29
not yet calculated
CVE-2022-36066
MISC
CONFIRM
MISC
discourse -- discourse

Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` branches, a malicious actor can add large payloads of text into the Location and Website fields of a user profile, which causes issues for other users when loading that profile. A fix to limit the length of user input for these fields is included in version 2.8.9 on the `stable` branch and version 2.9.0.beta10 on the `beta` and `tests-passed` branches. There are no known workarounds.
2022-09-29
not yet calculated
CVE-2022-39226
CONFIRM
MISC
MISC
discourse -- discourse

Discourse is an open source discussion platform. Starting with version 2.9.0.beta5 and prior to version 2.9.0.beta10, an incomplete quote can generate a JavaScript error which will crash the current page in the browser in some cases. Version 2.9.0.beta10 added a fix and tests to ensure incomplete quotes won't break the app. As a workaround, the quote can be fixed via the rails console.
2022-09-29
not yet calculated
CVE-2022-39232
MISC
CONFIRM
MISC
dnnsoftware -- dnn.platform

Relative Path Traversal in GitHub repository dnnsoftware/dnn.platform prior to 9.11.0.
2022-09-30
not yet calculated
CVE-2022-2922
MISC
CONFIRM
flipper_devices_inc -- flipper_zero

A buffer overflow in the component nfc_device_load_mifare_ul_data of Flipper Devices Inc., Flipper Zero before v0.65.2 allows attackers to cause a Denial of Service (DoS) via a crafted NFC file.
2022-09-29
not yet calculated
CVE-2022-40363
MISC
MISC
gridea -- gridea

Gridea version 0.9.3 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Gridea. This is possible because the application has the 'nodeIntegration' option enabled.
2022-09-30
not yet calculated
CVE-2022-40274
MISC
MISC
hospital_management_system -- mini-project

hms-staff.php in Projectworlds Hospital Management System Mini-Project through 2018-06-17 allows SQL injection via the type parameter.
2022-09-29
not yet calculated
CVE-2022-33880
MISC
hp -- print_products
Certain HP Print Products are potentially vulnerable to Remote Code Execution.
2022-09-26
not yet calculated
CVE-2022-28721
MISC
hp -- print_products

Certain HP Print Products are potentially vulnerable to Buffer Overflow.
2022-09-26
not yet calculated
CVE-2022-28722
MISC
htmly -- htmly

Directory Traversal vulnerability in htmly before 2.8.1 allows remote attackers to perform arbitrary file deletions via modified file parameter.
2022-09-30
not yet calculated
CVE-2021-33354
MISC
ibm -- robotic_process_automation_clients

IBM Robotic Process Automation Clients are vulnerable to proxy credentials being exposed in upgrade logs. IBM X-Force ID: 235422.
2022-09-29
not yet calculated
CVE-2022-39168
XF
CONFIRM
ikus060 -- rdiffweb
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3.
2022-09-30
not yet calculated
CVE-2022-3371
CONFIRM
MISC
ikus060 -- rdiffweb
Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.9.
2022-09-29
not yet calculated
CVE-2022-3326
CONFIRM
MISC
ikus060 -- rdiffweb

Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3.
2022-09-29
not yet calculated
CVE-2022-3364
CONFIRM
MISC
innovaphone -- innovaphone
AP Manager in Innovaphone before 13r2 Service Release 17 allows command injection via a modified service ID during app upload.
2022-09-30
not yet calculated
CVE-2022-41870
MISC
joplin -- joplin

Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before passing them to the 'shell.openExternal' function.
2022-09-30
not yet calculated
CVE-2022-40277
MISC
MISC
kekingcn -- kkfileview

kkFileView v4.1.0 is vulnerable to Cross Site Scripting (XSS) via the parameter 'errorMsg.'
2022-09-29
not yet calculated
CVE-2022-40879
MISC
leryx-longsoft -- clash_for_windows
A misconfiguration in the Service Mode profile directory of Clash for Windows v0.19.9 allows attackers to escalate privileges and execute arbitrary commands when Service Mode is activated.
2022-09-29
not yet calculated
CVE-2022-40126
MISC
lief -- lief

A vulnerability in the LIEF::MachO::SegmentCommand::virtual_address function of LIEF v0.12.1 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted MachO file.
2022-09-30
not yet calculated
CVE-2022-40923
MISC
linux -- kernel
drivers/video/fbdev/smscufx.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically proximate attacker removes a USB device while calling open(), aka a race condition between ufx_ops_open and ufx_usb_disconnect.
2022-09-30
not yet calculated
CVE-2022-41849
MISC
linux -- kernel

drivers/char/pcmcia/synclink_cs.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling ioctl, aka a race condition between mgslpc_ioctl and mgslpc_detach.
2022-09-30
not yet calculated
CVE-2022-41848
MISC
MISC
linux -- kernel

roccat_report_event in drivers/hid/hid-roccat.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free in certain situations where a report is received while copying a report->value is in progress.
2022-09-30
not yet calculated
CVE-2022-41850
MISC
matrix -- javascript_sdk
Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, injecting its own cross-signing user identity in place of one of the users’ identities. This would lead to the other device trusting/verifying the user identity under the control of the homeserver instead of the intended one. The vulnerability is a bug in the matrix-js-sdk, caused by checking and signing user identities and devices in two separate steps, and inadequately fixing the keys to be signed between those steps. Even though the attack is partly made possible due to the design decision of treating cross-signing user identities as Matrix devices on the server side (with their device ID set to the public part of the user identity key), no other examined implementations were vulnerable. Starting with version 19.7.0, the matrix-js-sdk has been modified to double check that the key signed is the one that was verified instead of just referencing the key by ID. An additional check has been made to report an error when one of the device ID matches a cross-signing key. As this attack requires coordination between a malicious homeserver and an attacker, those who trust their homeservers do not need a particular workaround.
2022-09-29
not yet calculated
CVE-2022-39250
MISC
MISC
MISC
CONFIRM
matrix -- nio

matrix-nio is a Python Matrix client library, designed according to sans I/O principles. Prior to version 0.20, when a users requests a room key from their devices, the software correctly remember the request. Once they receive a forwarded room key, they accept it without checking who the room key came from. This allows homeservers to try to insert room keys of questionable validity, potentially mounting an impersonation attack. Version 0.20 fixes the issue.
2022-09-29
not yet calculated
CVE-2022-39254
CONFIRM
MISC
matrix -- rust-sdk

matrix-rust-sdk is an implementation of a Matrix client-server library in Rust, and matrix-sdk-crypto is the Matrix encryption library. Prior to version 0.6, when a user requests a room key from their devices, the software correctly remembers the request. When the user receives a forwarded room key, the software accepts it without checking who the room key came from. This allows homeservers to try to insert room keys of questionable validity, potentially mounting an impersonation attack. Version 0.6 fixes this issue.
2022-09-29
not yet calculated
CVE-2022-39252
CONFIRM
MISC
MISC
MISC
mediawiki -- securepoll
An issue was discovered in SecurePoll in the Growth extension in MediaWiki through 1.36.2. Simple polls allow users to create alerts by changing their User-Agent HTTP header and submitting a vote.
2022-09-29
not yet calculated
CVE-2021-42045
MISC
MISC
mojoportal -- mojoportal

mojoPortal v2.7 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted PNG file.
2022-09-30
not yet calculated
CVE-2022-40341
MISC
MISC
moodle -- moodle
Insufficient capability checks made it possible for teachers to download users outside of their courses.
2022-09-29
not yet calculated
CVE-2021-40692
MISC
moodle -- moodle

It was possible for a student to view their quiz grade before it had been released, using a quiz web service.
2022-09-29
not yet calculated
CVE-2021-40695
MISC
moodle -- moodle

An authentication bypass risk was identified in the external database authentication functionality, due to a type juggling vulnerability.
2022-09-29
not yet calculated
CVE-2021-40693
MISC
moodle -- moodle

The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers about attempts/users in groups they should not have access to.
2022-09-30
not yet calculated
CVE-2022-40316
MISC
MISC
moodle -- moodle

Insufficient escaping of the LaTeX preamble made it possible for site administrators to read files available to the HTTP server system account.
2022-09-29
not yet calculated
CVE-2021-40694
MISC
moodle -- moodle

A limited SQL injection risk was identified in the "browse list of users" site administration page.
2022-09-30
not yet calculated
CVE-2022-40315
MISC
MISC
moodle -- moodle

A remote code execution risk when restoring backup files originating from Moodle 1.9 was identified.
2022-09-30
not yet calculated
CVE-2022-40314
MISC
MISC
moodle -- mustache_templates

Recursive rendering of Mustache template helpers containing user input could, in some cases, result in an XSS risk or a page failing to load.
2022-09-30
not yet calculated
CVE-2022-40313
MISC
MISC
netapp -- snapcenter

SnapCenter versions prior to 4.7 shipped without Content Security Policy (CSP) implemented which could allow certain types of attacks that otherwise would be prevented.
2022-09-29
not yet calculated
CVE-2022-38732
MISC
nodejs -- isolated-vm

isolated-vm is a library for nodejs which gives the user access to v8's Isolate interface. In versions 4.3.6 and prior, if the untrusted v8 cached data is passed to the API through CachedDataOptions, attackers can bypass the sandbox and run arbitrary code in the nodejs process. As of time of publication, there are no known fixed versions or workarounds.
2022-09-29
not yet calculated
CVE-2022-39266
CONFIRM
octopus -- deploy

In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes.
2022-09-30
not yet calculated
CVE-2022-2778
MISC
open5gs -- open5gs

A vulnerability in /src/amf/amf-context.c in Open5GS 2.4.10 and earlier leads to AMF denial of service.
2022-09-29
not yet calculated
CVE-2022-40890
MISC
open5gs -- open5gs

A vulnerability was found in Open5GS up to 2.4.10. It has been declared as problematic. Affected by this vulnerability is an unknown functionality in the library lib/sbi/client.c of the component AMF. The manipulation leads to denial of service. The attack can be launched remotely. The name of the patch is 724fa568435dae45ef0c3a48b2aabde052afae88. It is recommended to apply a patch to fix this issue. The identifier VDB-209545 was assigned to this vulnerability.
2022-09-26
not yet calculated
CVE-2022-3299
MISC
MISC
MISC
orchest -- orchest

### Impact In a CSRF attack, an innocent end user is tricked by an attacker into submitting a web request that they did not intend. This may cause actions to be performed on the website that can include inadvertent client or server data leakage, change of session state, or manipulation of an end user's account. ### Patch Upgrade to v2022.09.10 to patch this vulnerability. ### Workarounds Rebuild and redeploy the Orchest `auth-server` with this commit: https://github.com/orchest/orchest/commit/c2587a963cca742c4a2503bce4cfb4161bf64c2d ### References https://en.wikipedia.org/wiki/Cross-site_request_forgery https://cwe.mitre.org/data/definitions/352.html ### For more information If you have any questions or comments about this advisory: * Open an issue in https://github.com/orchest/orchest * Email us at [email protected]
2022-09-30
not yet calculated
CVE-2022-39268
MISC
MISC
MISC
CONFIRM
pingidentity -- pingcentral
PingCentral versions prior to listed versions expose Spring Boot actuator endpoints that with administrative authentication return large amounts of sensitive environmental and application information.
2022-09-30
not yet calculated
CVE-2022-23726
MISC
CONFIRM
pulse_secure -- pulse_connect_secure_vpn_server

Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS socket. This body ends up prefixing the next HTTP request sent down that connection, this means when someone loads website attacker may be able to make browser issue a POST to the application, enabling XSS.
2022-09-30
not yet calculated
CVE-2022-21826
MISC
qemu_and_redhat --multiple_products

QEMU before 2.0.0 block drivers for CLOOP, QCOW2 version 2 and various other image formats are vulnerable to potential memory corruptions, integer/buffer overflows or crash caused by missing input validations which could allow a remote user to execute arbitrary code on the host with the privileges of the QEMU process.
2022-09-29
not yet calculated
CVE-2014-0144
MISC
MISC
MISC
MISC
MISC
MISC
MISC
MISC
MISC
MISC
MISC
MISC
MISC
MISC
MISC
qemu_and_redhat --multiple_products

Qemu before 1.6.2 block diver for the various disk image formats used by Bochs and for the QCOW version 2 format, are vulnerable to a possible crash caused by signed data types or a logic error while creating QCOW2 snapshots, which leads to incorrectly calling update_refcount() routine.
2022-09-29
not yet calculated
CVE-2014-0147
MISC
MISC
MISC
MISC
MISC
MISC
qemu_and_redhat --multiple_products

Qemu before 2.0 block driver for Hyper-V VHDX Images is vulnerable to infinite loops and other potential issues when calculating BAT entries, due to missing bounds checks for block_size and logical_sector_size variables. These are used to derive other fields like 'sectors_per_block' etc. A user able to alter the Qemu disk image could ise this flaw to crash the Qemu instance resulting in DoS.
2022-09-29
not yet calculated
CVE-2014-0148
MISC
MISC
MISC
MISC
MISC
MISC
react-native-reanimated -- react-native-reanimated

The package react-native-reanimated before 3.0.0-rc.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper usage of regular expression in the parser of Colors.js.
2022-09-30
not yet calculated
CVE-2022-24373
CONFIRM
CONFIRM
CONFIRM
CONFIRM
realvnc -- vnc_server

RealVNC VNC Server before 6.11.0 and VNC Viewer before 6.22.826 on Windows allow local privilege escalation via MSI installer Repair mode.
2022-09-30
not yet calculated
CVE-2022-41975
MISC
ruby -- ruby

An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby. In Psych::Emitter start_document function heap buffer "head" allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow.
2022-09-29
not yet calculated
CVE-2016-2338
MLIST
MISC
sflow -- decode_package

sflow decode package does not employ sufficient packet sanitisation which can lead to a denial of service attack. Attackers can craft malformed packets causing the process to consume large amounts of memory resulting in a denial of service.
2022-09-30
not yet calculated
CVE-2022-2529
MISC
shibboleth -- multiple_products

A session hijack risk was identified in the Shibboleth authentication plugin.
2022-09-29
not yet calculated
CVE-2021-40691
MISC
solarwinds -- orion
Insufficient sanitization of inputs in QoE application input field could lead to stored and Dom based XSS attack. This issue is fixed and released in SolarWinds Platform (2022.3.0).
2022-09-30
not yet calculated
CVE-2022-36965
CONFIRM
CONFIRM
solarwinds -- orion
A vulnerable component of Orion Platform was vulnerable to SQL Injection, an authenticated attacker could leverage this for privilege escalation or remote code execution.
2022-09-30
not yet calculated
CVE-2022-36961
MISC
MISC
sonicjs -- sonicjs

SonicJS through 0.6.0 allows file overwrite. It has the following mutations that are used for updating files: fileCreate and fileUpdate. Both of these mutations can be called without any authentication to overwrite any files on a SonicJS application, leading to Arbitrary File Write and Delete.
2022-10-01
not yet calculated
CVE-2022-42002
MISC
MISC
sourcecodester -- best_student_result_management_system

SourceCodester Best Student Result Management System 1.0 is vulnerable to SQL Injection.
2022-09-29
not yet calculated
CVE-2022-40887
MISC
totolink -- a860r

TOTOLINK A860R V4.1.2cu.5182_B20201027 was discovered to contain a command injection via the component /cgi-bin/downloadFile.cgi.
2022-09-29
not yet calculated
CVE-2022-40475
MISC
transfer.sh -- transfer.sh

dutchcoders Transfer.sh 1.4.0 is vulnerable to Cross Site Scripting (XSS).
2022-09-29
not yet calculated
CVE-2022-40931
MISC
MISC
uclibc -- uclibc-ng

A memory corruption vulnerability exists in the libpthread linuxthreads functionality of uClibC 0.9.33.2 and uClibC-ng 1.0.40. Thread allocation can lead to memory corruption. An attacker can create threads to trigger this vulnerability.
2022-09-29
not yet calculated
CVE-2022-29503
MISC

western_digital_and_sandisk -- multiple_products

A stack-based buffer overflow vulnerability was found on Western Digital My Cloud Home, My Cloud Home Duo, and SanDisk ibi that could allow an attacker accessing the system locally to read information from /etc/version file. This vulnerability can only be exploited by chaining it with another issue. If an attacker is able to carry out a remote code execution attack, they can gain access to the vulnerable file, due to the presence of insecure functions in code. User interaction is required for exploitation. Exploiting the vulnerability could result in exposure of information, ability to modify files, memory access errors, or system crashes.
2022-09-27
not yet calculated
CVE-2022-23006
MISC
wolfssl -- wolfssl

In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake. This occurs when an attacker supposedly resumes a previous TLS session. During the resumption Client Hello a Hello Retry Request must be triggered. Both Client Hellos are required to contain a list of duplicate cipher suites to trigger the buffer overflow. In total, two Client Hellos have to be sent: one in the resumed session, and a second one as a response to a Hello Retry Request message.
2022-09-29
not yet calculated
CVE-2022-39173
MISC
MISC
wordpress -- wordpress
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Comment Guestbook plugin <= 0.8.0 at WordPress.
2022-09-30
not yet calculated
CVE-2021-36830
CONFIRM
CONFIRM
wordpress -- wordpress

Insecure direct object references (IDOR) vulnerability in ExpressTech Quiz And Survey Master plugin <= 7.3.4 at WordPress allows attackers to change the content of the quiz.
2022-09-30
not yet calculated
CVE-2021-36865
CONFIRM
CONFIRM
wordpress -- wordpress

Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Booking Ultra Pro plugin <= 1.1.4 at WordPress.
2022-09-30
not yet calculated
CVE-2021-36855
CONFIRM
CONFIRM
wordpress -- wordpress

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Booking Ultra Pro plugin <= 1.1.4 at WordPress.
2022-09-30
not yet calculated
CVE-2021-36854
CONFIRM
CONFIRM
wordpress -- wordpress

Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Social Media Follow Buttons Bar plugin <= 4.73 at WordPress.
2022-09-30
not yet calculated
CVE-2021-36839
CONFIRM
CONFIRM
xpdf -- xpdf_reader

An issue was discovered in Xpdf 4.04. There is a crash in gfseek(_IO_FILE*, long, int) in goo/gfile.cc.
2022-09-30
not yet calculated
CVE-2022-41842
MISC
MISC
xpdf -- xpdf_reader

An issue was discovered in Xpdf 4.04. There is a crash in convertToType0 in fofi/FoFiType1C.cc, a different vulnerability than CVE-2022-38928.
2022-09-30
not yet calculated
CVE-2022-41843
MISC
MISC
xpdf -- xpdf_reader

An issue was discovered in Xpdf 4.04. There is a crash in XRef::fetch(int, int, Object*, int) in xpdf/XRef.cc, a different vulnerability than CVE-2018-16369 and CVE-2019-16088.
2022-09-30
not yet calculated
CVE-2022-41844
MISC
MISC
MISC
yii -- feehicms

FeehiCMS v2.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted payload injected into the Comment box under the Single Page module.
2022-09-29
not yet calculated
CVE-2022-40408
MISC
zkteco -- zkbio_time
ZKTeco Xiamen Information Technology ZKBio Time 8.0.7 Build: 20220721.14829 was discovered to contain a CSV injection vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted payload injected into the Content text field of the Add New Message module.
2022-09-29
not yet calculated
CVE-2022-40472
MISC

Back to top

This product is provided subject to this Notification and this Privacy & Use policy.

Continue reading...

Primary Vendor -- Product	Description	Published	CVSS Score	Source & Patch Info
blazzdev -- rate_my_post_-_wp_rating_system	Authenticated (subscriber+) Race Condition vulnerability in Rate my Post – WP Rating System plugin <= 3.3.4 at WordPress allows attackers to increase/decrease votes.	2022-09-23	3.1	CVE-2022-40310 CONFIRM CONFIRM
dell -- smartfabric_os10	Dell OS10, version 10.5.3.4, contains an Improper Certificate Validation vulnerability in Support Assist. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to unauthorized access to limited switch configuration data. The vulnerability could be leveraged by attackers to conduct man-in-the-middle attacks to gain access to the Support Assist information.	2022-09-28	3.7	CVE-2022-34394 MISC
ec-cube -- ec-cube	Directory traversal vulnerability in EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p4 ) and EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote authenticated attacker with an administrative privilege to obtain the product's directory structure information.	2022-09-27	2.7	CVE-2022-40199 MISC MISC
gavazziautomation -- cpy_car_park_server	In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 the Sentilo Proxy server was discovered to contain a SQL injection vulnerability allowing an attacker to query other tables of the Sentilo service.	2022-09-28	2.7	CVE-2022-28815 CONFIRM
haxx -- curl	When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings.	2022-09-23	3.7	CVE-2022-35252 MISC CONFIRM
ikus-soft -- rdiffweb	Improper Cleanup on Thrown Exception in GitHub repository ikus060/rdiffweb prior to 2.4.8.	2022-09-26	2.4	CVE-2022-3301 CONFIRM MISC
parseplatform -- parse-server	Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 4.10.16, or from 5.0.0 to 5.2.6, validation of the authentication adapter app ID for _Facebook_ and _Spotify_ may be circumvented. Configurations which allow users to authenticate using the Parse Server authentication adapter where `appIds` is set as a string instead of an array of strings authenticate requests from an app with a different app ID than the one specified in the `appIds` configuration. For this vulnerability to be exploited, an attacker needs to be assigned an app ID by the authentication provider which is a sub-set of the server-side configured app ID. This issue is patched in versions 4.10.16 and 5.2.7. There are no known workarounds.	2022-09-23	3.7	CVE-2022-39231 CONFIRM
parseplatform -- parse-server	Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 4.10.15, or 5.0.0 and above prior to 5.2.6, a user can write to the session object of another user if the session object ID is known. For example, an attacker can assign the session object to their own user by writing to the `user` field and then read any custom fields of that session object. Note that assigning a session to another user does not usually change the privileges of either of the two users, and a user cannot assign their own session to another user. This issue is patched in version 4.10.15 and above, and 5.2.6 and above. To mitigate this issue in unpatched versions add a `beforeSave` trigger to the `_Session` class and prevent writing if the requesting user is different from the user in the session object.	2022-09-23	3.1	CVE-2022-39225 CONFIRM
toaruos -- toaruos	readelf in ToaruOS 2.0.1 has some arbitrary address read vulnerabilities when parsing a crafted ELF file.	2022-09-28	3.3	CVE-2022-38934 MISC
trendmicro -- deep_security	An Out-of-bounds read vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows could allow a local attacker to disclose sensitive information on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit these vulnerabilities. This vulnerability is similar to, but not identical to CVE-2022-40708.	2022-09-28	3.3	CVE-2022-40707 N/A N/A
trendmicro -- deep_security	An Out-of-bounds read vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows could allow a local attacker to disclose sensitive information on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit these vulnerabilities. This vulnerability is similar to, but not identical to CVE-2022-40707.	2022-09-28	3.3	CVE-2022-40708 N/A N/A
trendmicro -- deep_security	An Out-of-bounds read vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows could allow a local attacker to disclose sensitive information on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit these vulnerabilities. This vulnerability is similar to, but not identical to CVE-2022-40707 and 40708.	2022-09-28	3.3	CVE-2022-40709 N/A N/A

CISA Bulletins - Vulnerability Summary for the Week of September 26, 2022

CISA

Guest

High Vulnerabilities​

Medium Vulnerabilities​

Low Vulnerabilities​

Severity Not Yet Assigned​

High Vulnerabilities

Medium Vulnerabilities

Low Vulnerabilities

Severity Not Yet Assigned