CVEs published September 1, 2022
69 CVEs were published on September 1, 2022: 3 critical, 2 high.
- Published
- 69
- Critical
- 3
- High
- 2
- Medium
- 14
- Low
- 0
- Unrated
- 50
- Now in CISA KEV
- 0
- Fix available
- 15
Most affected products
- IBM Cognos Analytics
- 7
- LibRaw
- 6
- contiki-ng
- 3
- Openshift
- 3
- Dell CloudLink
- 2
- kernel
- 2
- Kernel
- 2
- Linux kernel
- 2
- podman
- 2
- sqlite
- 2
Critical 3
- CVE-2022-34380Dell CloudLink 7.1.3 and all earlier versions contain an Authentication Bypass Using an Alternate Path or Channel Vulnerability.Dell CloudLink
- CVE-2022-34379Dell EMC CloudLink 7.1.2 and all prior versions contain an Authentication Bypass Vulnerability.Dell CloudLink
- CVE-2022-34372Dell PowerProtect Cyber Recovery versions before 19.11.0.2 contain an authentication bypass vulnerability.Dell Cyber Recovery
High 2
Medium, low and unrated 64
- CVE-2022-23452An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container.openstack/barbican · barbican
- CVE-2022-3078An issue was discovered in the Linux kernel through 5.16-rc6.Kernel
- CVE-2022-2739The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory included an incorrect version of podman podman
- CVE-2022-2738The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory included an incorrect version of podman podman
- CVE-2022-2639An integer coercion error was found in the openvswitch kernel module.kernel
- CVE-2022-2447A flaw was found in Keystone.openstack-keystone
- CVE-2022-2403A credentials leak was found in the OpenShift Container Platform.Openshift
- CVE-2022-36622Samsung Electronics mTower v0.3.0 and earlier was discovered to contain a NULL pointer dereference via the function TEE_GetObjectInfo1.
- CVE-2022-36621Samsung Electronics mTower v0.3.0 and earlier was discovered to contain a NULL pointer dereference via the function TEE_AllocateTransientObj
- CVE-2022-2308A flaw was found in vDPA with VDUSE backend.Linux kernel
- CVE-2022-2806It was found that the ovirt-log-collector/sosreport collects the RHV admin password unfiltered.ovirt-log-collector · sosreport
- CVE-2022-2256A Stored Cross-site scripting (XSS) vulnerability was found in keycloak as shipped in Red Hat Single Sign-On 7.keycloak · org.keycloak:keycloak-parent
- CVE-2022-2238A vulnerability was found in the search-api container in Red Hat Advanced Cluster Management for Kubernetes when a query in the search filteRed Hat Advanced Cluster Management for Kubernetes
- CVE-2022-1902A flaw was found in the Red Hat Advanced Cluster Security for Kubernetes.Red Hat Advanced Cluster Security for Kubernetes
- CVE-2022-1677In OpenShift Container Platform, a user with permissions to create or modify Routes can craft a payload that inserts a malformed entry into Openshift
- CVE-2022-36604An access control issue in Canaan Avalon ASIC Miner 2020.3.30 and below allows unauthenticated attackers to arbitrarily change user password
- CVE-2022-36603InnoSilicon T3T+ t2t+_soc_20190911_151433.swu was discovered to contain a remote code execution (RCE) vulnerability in the checkUrl function
- CVE-2022-36601The Eclipse TCF debug interface in JasMiner-X4-Server-20220621-090907 and below is open on port 1534.
- CVE-2022-36602InnoSilicon A10 a10_20200924_120556 was discovered to contain a remote code execution (RCE) vulnerability in the setPlatformAPI function.
- CVE-2022-30614IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to a denial of service via email flooding caused by sending a specially-crafteIBM Cognos Analytics
- CVE-2021-39045IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a local attacker to obtain information due to the autocomplete feature on passwoIBM Cognos Analytics
- CVE-2021-39009IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 stores user credentials in plain clear text which can be read by a local privileged user.IBM Cognos Analytics
- CVE-2021-29823IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicioIBM Cognos Analytics
- CVE-2021-20468IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicioIBM Cognos Analytics
- CVE-2020-4301IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicioIBM Cognos Analytics
- CVE-2020-27784A vulnerability was found in the Linux kernel, where accessing a deallocated instance in printer_ioctl() printer_ioctl() tries to access of kernel
- CVE-2020-35533In LibRaw, an out-of-bounds read vulnerability exists within the "LibRaw::adobe_copy_pixel()" function (libraw\src\decoders\dng.cpp) when reLibRaw
- CVE-2020-35534In LibRaw, there is a memory corruption vulnerability within the "crxFreeSubbandData()" function (libraw\src\decoders\crx.cpp) when processiLibRaw
- CVE-2020-35535In LibRaw, there is an out-of-bounds read vulnerability within the "LibRaw::parseSonySRF()" function (libraw\src\metadata\sony.cpp) when proLibRaw
- CVE-2020-35530In LibRaw, there is an out-of-bounds write vulnerability within the "new_node()" function (libraw\src\x3f\x3f_utils_patched.cpp) that can beLibRaw
- CVE-2020-35531In LibRaw, an out-of-bounds read vulnerability exists within the get_huffman_diff() function (libraw\src\x3f\x3f_utils_patched.cpp) when reaLibRaw
- CVE-2020-35532In LibRaw, an out-of-bounds read vulnerability exists within the "simple_decode_row()" function (libraw\src\x3f\x3f_utils_patched.cpp) whichLibRaw
- CVE-2022-36583DedeCMS V5.7.97 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities at /dede/co_do.php via the dopost, rpok, and a
- CVE-2021-45027An arbitrary file download vulnerability in Oliver v5 Library Server Versions < 5.00.008.053 via the FileServlet function allows for arbitra
- CVE-2022-36796WordPress CallRail Phone Call Tracking plugin <= 0.4.9 - Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS)CallRail Phone Call Tracking
- CVE-2022-36373WordPress MP3 jPlayer plugin <= 2.7.3 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilitiesSimon Ward MP3-jPlayer
- CVE-2022-36355WordPress Easy Org Chart plugin <= 3.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityPluginlySpeaking Easy Org Chart
- CVE-2022-28199NVIDIA’s distribution of the Data Plane Development Kit (MLNX_DPDK) contains a vulnerability in the network stack, where error recovery is nNVIDIA FLARE
- CVE-2022-37435Apache ShenYu Admin Improper Privilege ManagementApache Software Foundation Apache ShenYu · org.apache.sheny…
- CVE-2022-38790Weave GitOps Enterprise before 0.9.0-rc.5 has a cross-site scripting (XSS) bug allowing a malicious user to inject a javascript: link in the
- CVE-2022-36055Denial of service in Helmhelm · helm.sh/helm/v3
- CVE-2022-36054Out-of-bounds write when decompressing 6LoWPAN payload in Contiki-NGcontiki-ng
- CVE-2022-36052Out-of-bounds read when decompressing UDP headercontiki-ng
- CVE-2022-36053Out-of-bounds read in the uIP buffer modulecontiki-ng
- CVE-2022-36449An issue was discovered in the Arm Mali GPU Kernel Driver.
- CVE-2022-36676Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /categories/view_category
- CVE-2022-36675Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /schedules/manage_schedul
- CVE-2022-36674Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /schedules/view_schedule.
- CVE-2022-36672Novel-Plus v3.6.2 was discovered to contain a hard-coded JWT key located in the project config file.
- CVE-2022-36671Novel-Plus v3.6.2 was discovered to contain an arbitrary file download vulnerability via the background file download API.
- CVE-2022-36130HashiCorp Boundary up to 0.10.1 did not properly perform data integrity checks to ensure the resources were associated with the correct scop
- CVE-2020-35525In SQlite 3.31.1, a potential null pointer derreference was found in the INTERSEC query processing.sqlite
- CVE-2020-35527In SQLite 3.31.1, there is an out of bounds access problem through ALTER TABLE for views that have a nested FROM clause.sqlite
- CVE-2021-3826Heap/stack buffer overflow in the dlang_lname function in d-demangle.c in libiberty allows attackers to potentially cause a denial of servicgcc
- CVE-2022-1615In Samba, GnuTLS gnutls_rnd() can fail and give predictable random values.Samba
- CVE-2022-1632An Improper Certificate Validation attack was found in Openshift.Openshift
- CVE-2022-1729A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged user to gain root privileges.linux kernel
- CVE-2022-2319A flaw was found in the Xorg-x11-server.xorg-x11-server
- CVE-2022-2320A flaw was found in the Xorg-x11-server.xorg-x11-server
- CVE-2022-2663An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and incorrectly matches the message.Linux kernel
- CVE-2022-2764A flaw was found in Undertow.undertow
- CVE-2022-2996A flaw was found in the python-scciclient when making an HTTPS connection to a server where the server's certificate would not be verified.python-scciclient
- CVE-2022-3061Found Linux Kernel flaw in the i740 driver.Kernel
- CVE-2022-32743Samba does not validate the Validated-DNS-Host-Name right for the dNSHostName attribute which could permit unprivileged users to write it.samba