CVEs published September 5, 2022
39 CVEs were published on September 5, 2022: 1 critical, 3 high.
- Published
- 39
- Critical
- 1
- High
- 3
- Medium
- 10
- Low
- 1
- Unrated
- 24
- Now in CISA KEV
- 0
- Fix available
- 17
Most affected products
- OTRS AG OTRS · OTRS AG ((OTRS)) Community Edition
- 3
- SnakeYAML · org.yaml:snakeyaml
- 3
- SourceCodester Clinics Patient Management System
- 2
- Visual Portfolio, Photo Gallery & Post Grid
- 2
- Apache Software Foundation Apache IoTDB · apache-iotdb +1
- 1
- Apache Software Foundation Apache IoTDB · org.apache.iotdb:…
- 1
- Bitdefender GravityZone Console On-Premise · Bitdefender Gr…
- 1
- Directorist – WordPress Business Directory Plugin with Clas…
- 1
- Fast Flow
- 1
- jgraph/drawio
- 1
Critical 1
High 3
- CVE-2022-2830Deserialization of Untrusted Data in GravityZone Console On-Premise (VA-10573)Bitdefender GravityZone Console On-Premise · Bitdefender Gr…
- CVE-2022-3008Command Injection on tinygltfsyoyo tinygltf
- CVE-2022-3120SourceCodester Clinics Patient Management System Login index.php sql injectionSourceCodester Clinics Patient Management System
Medium, low and unrated 35
- CVE-2022-38367The Netic User Export add-on before 2.0.6 for Atlassian Jira does not perform authorization checks.
- CVE-2021-28398A privileged attacker in GeoNetwork before 3.12.0 and 4.x before 4.0.4 can use the directory harvester before-script to execute arbitrary OS
- CVE-2022-39838Systematic FIX Adapter (ALFAFX) 2.4.0.25 13/09/2017 allows remote file inclusion via a UNC share pathname, and also allows absolute path tra
- CVE-2022-3122SourceCodester Clinics Patient Management System medicine_details.php sql injectionSourceCodester Clinics Patient Management System
- CVE-2022-3121SourceCodester Online Employee Leave Management System addemployee.php cross-site request forgerySourceCodester Online Employee Leave Management System
- CVE-2022-3127Cross-site Scripting (XSS) - Stored in jgraph/drawiojgraph/drawio
- CVE-2022-2775Fast Flow < 1.2.13 - Admin+ Stored Cross-Site ScriptingFast Flow
- CVE-2022-2657Multivendor Marketplace Solution for WooCommerce < 3.8.12 - Unauthorised AJAX CallsMultivendor Marketplace Solution for WooCommerce – WC Marke…
- CVE-2022-2565Best Payments Plugin for WP < 4.2.1 - Unauthenticated Stored Cross-Site ScriptingSimple Payment Donations & Subscriptions Plugin by Paymatti…
- CVE-2022-2597Visual Portfolio < 2.19.0 - Contributor+ CSS InjectionVisual Portfolio, Photo Gallery & Post Grid
- CVE-2022-2543Visual Portfolio < 2.18.0 - Unauthenticated CSS InjectionVisual Portfolio, Photo Gallery & Post Grid
- CVE-2022-2376Directorist < 7.3.1 - Unauthenticated Email Address DisclosureDirectorist – WordPress Business Directory Plugin with Clas…
- CVE-2022-2271WP Database Backup < 5.9 - Admin+ Stored Cross-Site ScriptingWP Database Backup
- CVE-2022-2083Simple Single Sign On <= 4.1.0 - Authentication BypassSimple Single Sign On
- CVE-2022-3123Cross-site Scripting (XSS) - Reflected in splitbrain/dokuwikisplitbrain/dokuwiki
- CVE-2022-38370No authorization of DatabaseConnectController in grafana-connector. Apache Software Foundation Apache IoTDB · org.apache.iotdb:…
- CVE-2022-38369Login check vulnerability by session IdApache Software Foundation Apache IoTDB · apache-iotdb +1
- CVE-2022-39051Perl Code execution in Template ToolkitOTRS AG OTRS · OTRS AG ((OTRS)) Community Edition
- CVE-2022-39050Possible XSS stored in customer informationOTRS AG OTRS · OTRS AG ((OTRS)) Community Edition
- CVE-2022-39049Possible XSS in Admin InterfaceOTRS AG OTRS · OTRS AG ((OTRS)) Community Edition
- CVE-2022-39843123elf Lotus 1-2-3 before 1.0.0rc3 for Linux, and Lotus 1-2-3 R3 for UNIX and other platforms through 9.8.2, allow attackers to execute arbi
- CVE-2022-39839Cotonti Siena 0.9.20 allows admins to conduct stored XSS attacks via a forum post.
- CVE-2022-39840Cotonti Siena 0.9.20 allows admins to conduct stored XSS attacks via a direct message (DM).
- CVE-2022-39831An issue was discovered in PSPP 1.6.2.
- CVE-2022-39832An issue was discovered in PSPP 1.6.2.
- CVE-2022-39828sign_pFwInfo in Samsung mTower through 0.3.0 has a missing check on the return value of EC_KEY_set_private_key, leading to a denial of servi
- CVE-2022-39829There is a NULL pointer dereference in aes256_encrypt in Samsung mTower through 0.3.0 due to a missing check on the return value of EVP_CIPH
- CVE-2022-39830sign_pFwInfo in Samsung mTower through 0.3.0 has a missing check on the return value of EC_KEY_set_public_key_affine_coordinates, leading to
- CVE-2022-39824Server-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to execute arbitrary JavaScript code from the server via
- CVE-2022-30331The User-Defined Functions (UDF) feature in TigerGraph 3.6.0 allows installation of a query (in the GSQL query language) without proper valipytigergraph
- CVE-2022-38749DoS in SnakeYAMLSnakeYAML · org.yaml:snakeyaml +6
- CVE-2022-38750DoS in SnakeYAMLSnakeYAML · org.yaml:snakeyaml
- CVE-2022-38751DoS in SnakeYAMLSnakeYAML · org.yaml:snakeyaml
- CVE-2022-38752DoS in SnakeYAMLSnakeYAML · org.yaml:snakeyaml
- CVE-2022-39842An issue was discovered in the Linux kernel before 5.19.