CVEs published September 2, 2022
76 CVEs were published on September 2, 2022: 2 critical, 35 high.
- Published
- 76
- Critical
- 2
- High
- 35
- Medium
- 9
- Low
- 0
- Unrated
- 30
- Now in CISA KEV
- 0
- Fix available
- 11
Most affected products
- Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- 15
- Qualcomm Snapdragon Auto
- 8
- Apache Software Foundation Apache OFBiz
- 5
- Dell PowerScale OneFS
- 3
- Qualcomm Snapdragon Connectivity, Snapdragon Mobile
- 3
- Apache Software Foundation Apache Airflow · apache-airflow
- 2
- Qualcomm Snapdragon Connectivity, Snapdragon Industrial IOT…
- 2
- Avaya IP Office
- 1
- Dell Command Update
- 1
- drakkan sftpgo · github.com/drakkan/sftpgo/v2 +1
- 1
Critical 2
- CVE-2022-22096Memory corruption in Bluetooth HOST due to stack-based buffer overflow when when extracting data using command length parameter in SnapdragoQualcomm Snapdragon Connectivity, Snapdragon Mobile
- CVE-2021-35122Non-secure region can try modifying RG permissions of IO space xPUs due to improper input validation in Snapdragon Auto, Snapdragon Compute,Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
High 35
- CVE-2022-31196Server-Side Request Forgery (SSRF) vulnerability in Databasirvran-dev databasir
- CVE-2022-34382Dell Command Update, Dell Update and Alienware Update versions prior to 4.6.0 contains a Local Privilege Escalation Vulnerability in the cusDell Command Update
- CVE-2022-34371Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.19, 9.2.1.12, 9.3.0.6, and 9.4.0.3, contain an unprotected transport of credDell PowerScale OneFS
- CVE-2022-34369Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.20, 9.2.1.13, 9.3.0.6, and 9.4.0.3 , contain an insertion of sensitive inforDell PowerScale OneFS
- CVE-2022-36071Recovery codes abuse in SFTPGodrakkan sftpgo · github.com/drakkan/sftpgo/v2 +1
- CVE-2022-36076Account takeover via SSO plugins in NodeBBNodeBB
- CVE-2022-36078Slice Memory Allocation with Excessive Size Value in binarygagliardetto binary · github.com/gagliardetto/binary
- CVE-2022-25668Memory corruption in video driver due to double free while parsing ASF clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-25680Memory corruption in multimedia due to buffer overflow while processing count variable from client in Snapdragon AutoQualcomm Snapdragon Auto
- CVE-2022-25659Memory corruption due to buffer overflow while parsing MKV clips with invalid bitmap size in Snapdragon Auto, Snapdragon Compute, SnapdragonQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-25658Memory corruption due to incorrect pointer arithmetic when attempting to change the endianness in video parser function in Snapdragon Auto, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-25657Memory corruption due to buffer overflow occurs while processing invalid MKV clip which has invalid seek header in Snapdragon Auto, SnapdragQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-22106Memory corruption in multimedia due to improper length check while copying the data in Snapdragon AutoQualcomm Snapdragon Auto
- CVE-2022-22102Memory corruption in multimedia due to incorrect type conversion while adding data in Snapdragon AutoQualcomm Snapdragon Auto
- CVE-2022-22104Memory corruption in multimedia due to improper check on the messages received.Qualcomm Snapdragon Auto
- CVE-2022-22100Memory corruption in multimedia due to improper check on received export descriptors in Snapdragon AutoQualcomm Snapdragon Auto
- CVE-2022-22099Memory corruption in multimedia due to improper validation of array index in Snapdragon AutoQualcomm Snapdragon Auto
- CVE-2022-22098Memory corruption in multimedia driver due to untrusted pointer dereference while reading data from socket in Snapdragon AutoQualcomm Snapdragon Auto
- CVE-2022-22097Memory corruption in graphic driver due to use after free while calling multiple threads application to driver.Qualcomm Snapdragon Consumer IOT
- CVE-2022-22080Improper validation of backend id in PCM routing process can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon CoQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-22070Memory corruption in audio due to lack of check of invalid routing address into APR Routing table in Snapdragon Auto, Snapdragon Compute, SnQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-22069Devices with keyprotect off may store unencrypted keybox in RPMB and cause cryptographic issue in Snapdragon Auto, Snapdragon Compute, SnapdQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-22067Potential memory leak in modem during the processing of NSA RRC Reconfiguration with invalid Radio Bearer Config in Snapdragon Auto, SnapdraQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-22062An out-of-bounds read can occur while parsing a server certificate due to improper length check in Snapdragon Auto, Snapdragon Compute, SnapQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-22059Memory corruption due to out of bound read while parsing a video file in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, SnapdQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-22061Out of bounds writing is possible while verifying device IDs due to improper length check before copying the data in Snapdragon Compute, SnaQualcomm Snapdragon Compute, Snapdragon Connectivity, Snapd…
- CVE-2021-35134Due to insufficient validation of ELF headers, an Incorrect Calculation of Buffer Size can occur in Boot leading to memory corruption in SnaQualcomm Snapdragon Connectivity, Snapdragon Industrial IOT…
- CVE-2021-35132Out of bound write in DSP service due to improper bound check for response buffer size in Snapdragon Auto, Snapdragon Compute, Snapdragon CoQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-35113Possible authentication bypass due to improper order of signature verification and hashing in the signature verification call in Snapdragon Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-35097Possible authentication bypass due to improper order of signature verification and hashing in the signature verification call in Snapdragon Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-25657Avaya IP Office Privilege Escalation VulnerabilityAvaya IP Office
- CVE-2022-31176Grafana Image Renderer leaking filesgrafana-image-renderer
- CVE-2022-39176BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate par
- CVE-2022-39177BlueZ before 5.59 allows physically proximate attackers to cause a denial of service because malformed and invalid capabilities can be proce
- CVE-2022-39189An issue was discovered the x86 KVM subsystem in the Linux kernel before 5.18.17.
Medium, low and unrated 39
- CVE-2022-36754Expense Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /Home/debit_credit_p.
- CVE-2020-29260libvncclient v0.9.13 was discovered to contain a memory leak via the function rfbClientCleanup().
- CVE-2022-36647PKUVCL davs2 v1.6.205 was discovered to contain a global buffer overflow via the function parse_sequence_header() at source/common/header.cc
- CVE-2022-36642A local file disclosure vulnerability in /appConfig/userDB.json of Telos Alliance Omnia MPX Node through 1.0.0-1.4.9 allows attackers to acc
- CVE-2022-36640influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated attackers to execute arbitrary
- CVE-2022-36639A stored cross-site scripting (XSS) vulnerability in /client.php of Garage Management System v1.0 allows attackers to execute arbitrary web
- CVE-2022-36638An access control issue in the component print.php of Garage Management System v1.0 allows unauthenticated attackers to access data for all
- CVE-2022-31152Synapse vulnerable to denial of service (DoS) due to incorrect application of event authorization rulesmatrix-org synapse · matrix-synapse
- CVE-2022-35933PrestaShop module Product Comments vulnerable to cross-site scripting (XSS)PrestaShop productcomments · prestashop/productcomments
- CVE-2022-3065Improper Access Control in jgraph/drawiojgraph/drawio
- CVE-2021-27693Server-side Request Forgery (SSRF) vulnerability in PublicCMS before 4.0.202011.b via /publiccms/admin/ueditor when the action is catchimage
- CVE-2022-34378Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.20, 9.2.1.13, 9.3.0.6, and 9.4.0.3, contain a relative path traversal vulnerDell PowerScale OneFS
- CVE-2022-22101Denial of service in multimedia due to uncontrolled resource consumption while parsing an incoming HAB message in Snapdragon AutoQualcomm Snapdragon Auto
- CVE-2021-35135A null pointer dereference may potentially occur during RSA key import in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, SnapQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-35133Use after free in the synx driver issue while performing other functions during multiple invocation of synx release calls in Snapdragon ConnQualcomm Snapdragon Connectivity, Snapdragon Industrial IOT…
- CVE-2021-35109Possible address manipulation from APP-NS while APP-S is configuring an RG where it tries to merge the address ranges in Snapdragon ConnectiQualcomm Snapdragon Connectivity, Snapdragon Mobile
- CVE-2021-35108Improper checking of AP-S lock bit while verifying the secure resource group permissions can lead to non secure read and write access in SnaQualcomm Snapdragon Connectivity, Snapdragon Mobile
- CVE-2022-37458Discourse through 2.8.7 allows admins to send invitations to arbitrary email addresses at an unlimited rate.
- CVE-2021-44718wolfSSL through 5.0.0 allows an attacker to cause a denial of service and infinite loop in the client component by sending crafted traffic f
- CVE-2022-38054Session FixationApache Software Foundation Apache Airflow · apache-airflow
- CVE-2022-38170Overly permissive umask for daemonsApache Software Foundation Apache Airflow · apache-airflow
- CVE-2022-29158Regular Expression Denial of Service (ReDoS) vulnerability in Apache OFBizApache Software Foundation Apache OFBiz
- CVE-2022-29063Java Deserialization via RMI Connection from the Solr plugin of Apache OFBizApache Software Foundation Apache OFBiz
- CVE-2022-25813Server-Side Template Injection affecting the ecommerce plugin of Apache OFBizApache Software Foundation Apache OFBiz
- CVE-2022-25371Unauth Path Traversal with file corruption affecting the Birt plugin of Apache OFBizApache Software Foundation Apache OFBiz
- CVE-2022-25370Unauth Stored XSS vulnerability in the Birt plugin of Apache OFBizApache Software Foundation Apache OFBiz
- CVE-2022-39194An issue was discovered in the MediaWiki through 1.38.2.
- CVE-2022-36637Garage Management System v1.0 was discovered to contain a persistent cross-site scripting (XSS) vulnerability via the brand_name parameter a
- CVE-2022-36636Garage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /print.php.
- CVE-2022-36609Clinic's Patient Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /pms/update_patient.
- CVE-2022-37679Miniblog.Core v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /blog/edit.
- CVE-2022-36600BlogEngine v3.3.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /blogengine/api/posts.
- CVE-2022-36594Mapper v4.0.0 to v4.2.0 was discovered to contain a SQL injection vulnerability via the ids parameter at the selectByIds function.
- CVE-2022-36593kkFileView v4.0.0 was discovered to contain an arbitrary file deletion vulnerability via the fileName parameter at /controller/FileControlle
- CVE-2022-36759Online Food Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the component /dishes.php?res_id=.
- CVE-2022-39170libdwarf 0.4.1 has a double free in _dwarf_exec_frame_instr in dwarf_frame.c.
- CVE-2020-22669Modsecurity owasp-modsecurity-crs 3.2.0 (Paranoia level at PL1) has a SQL injection bypass vulnerability.
- CVE-2022-39188An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19.
- CVE-2022-39190An issue was discovered in net/netfilter/nf_tables_api.c in the Linux kernel before 5.19.6.