# CVEs published 2022-09-05 39 CVEs were published on September 5, 2022: 1 critical, 3 high. Days are UTC. - [CVE-2022-38367](https://cve.now/CVE-2022-38367.md): The Netic User Export add-on before 2.0.6 for Atlassian Jira does not perform authorization checks. (no CVSS) - [CVE-2021-28398](https://cve.now/CVE-2021-28398.md): A privileged attacker in GeoNetwork before 3.12.0 and 4.x before 4.0.4 can use the directory harvester before-script to execute arbitrary OS (no CVSS) - [CVE-2022-39838](https://cve.now/CVE-2022-39838.md): Systematic FIX Adapter (ALFAFX) 2.4.0.25 13/09/2017 allows remote file inclusion via a UNC share pathname, and also allows absolute path tra (no CVSS) - [CVE-2022-3122](https://cve.now/CVE-2022-3122.md): SourceCodester Clinics Patient Management System medicine\_details.php sql injection (CVSS 6.3, SourceCodester Clinics Patient Management System) - [CVE-2022-3121](https://cve.now/CVE-2022-3121.md): SourceCodester Online Employee Leave Management System addemployee.php cross-site request forgery (CVSS 4.3, SourceCodester Online Employee Leave Management System) - [CVE-2022-3127](https://cve.now/CVE-2022-3127.md): Cross-site Scripting (XSS) - Stored in jgraph/drawio (CVSS 5.5, jgraph/drawio) - [CVE-2022-2775](https://cve.now/CVE-2022-2775.md): Fast Flow \< 1.2.13 - Admin+ Stored Cross-Site Scripting (no CVSS, Fast Flow) - [CVE-2022-2657](https://cve.now/CVE-2022-2657.md): Multivendor Marketplace Solution for WooCommerce \< 3.8.12 - Unauthorised AJAX Calls (no CVSS, Multivendor Marketplace Solution for WooCommerce – WC Marke…) - [CVE-2022-2565](https://cve.now/CVE-2022-2565.md): Best Payments Plugin for WP \< 4.2.1 - Unauthenticated Stored Cross-Site Scripting (no CVSS, Simple Payment Donations & Subscriptions Plugin by Paymatti…) - [CVE-2022-2597](https://cve.now/CVE-2022-2597.md): Visual Portfolio \< 2.19.0 - Contributor+ CSS Injection (no CVSS, Visual Portfolio, Photo Gallery & Post Grid) - [CVE-2022-2543](https://cve.now/CVE-2022-2543.md): Visual Portfolio \< 2.18.0 - Unauthenticated CSS Injection (no CVSS, Visual Portfolio, Photo Gallery & Post Grid) - [CVE-2022-2376](https://cve.now/CVE-2022-2376.md): Directorist \< 7.3.1 - Unauthenticated Email Address Disclosure (no CVSS, Directorist – WordPress Business Directory Plugin with Clas…) - [CVE-2022-2271](https://cve.now/CVE-2022-2271.md): WP Database Backup \< 5.9 - Admin+ Stored Cross-Site Scripting (no CVSS, WP Database Backup) - [CVE-2022-2083](https://cve.now/CVE-2022-2083.md): Simple Single Sign On \<= 4.1.0 - Authentication Bypass (no CVSS, Simple Single Sign On) - [CVE-2022-2830](https://cve.now/CVE-2022-2830.md): Deserialization of Untrusted Data in GravityZone Console On-Premise (VA-10573) (CVSS 8.8, Bitdefender GravityZone Console On-Premise · Bitdefender Gr…) - [CVE-2022-3123](https://cve.now/CVE-2022-3123.md): Cross-site Scripting (XSS) - Reflected in splitbrain/dokuwiki (CVSS 5.4, splitbrain/dokuwiki) - [CVE-2022-38370](https://cve.now/CVE-2022-38370.md): No authorization of DatabaseConnectController in grafana-connector. (no CVSS, Apache Software Foundation Apache IoTDB · org.apache.iotdb:…) - [CVE-2022-38369](https://cve.now/CVE-2022-38369.md): Login check vulnerability by session Id (no CVSS, Apache Software Foundation Apache IoTDB · apache-iotdb +1) - [CVE-2022-3008](https://cve.now/CVE-2022-3008.md): Command Injection on tinygltf (CVSS 8.1, syoyo tinygltf) - [CVE-2022-3120](https://cve.now/CVE-2022-3120.md): SourceCodester Clinics Patient Management System Login index.php sql injection (CVSS 7.3, SourceCodester Clinics Patient Management System) - [CVE-2022-39051](https://cve.now/CVE-2022-39051.md): Perl Code execution in Template Toolkit (CVSS 6.8, OTRS AG OTRS · OTRS AG ((OTRS)) Community Edition) - [CVE-2022-39050](https://cve.now/CVE-2022-39050.md): Possible XSS stored in customer information (CVSS 4.6, OTRS AG OTRS · OTRS AG ((OTRS)) Community Edition) - [CVE-2022-39049](https://cve.now/CVE-2022-39049.md): Possible XSS in Admin Interface (CVSS 3.5, OTRS AG OTRS · OTRS AG ((OTRS)) Community Edition) - [CVE-2022-39843](https://cve.now/CVE-2022-39843.md): 123elf Lotus 1-2-3 before 1.0.0rc3 for Linux, and Lotus 1-2-3 R3 for UNIX and other platforms through 9.8.2, allow attackers to execute arbi (no CVSS) - [CVE-2022-39839](https://cve.now/CVE-2022-39839.md): Cotonti Siena 0.9.20 allows admins to conduct stored XSS attacks via a forum post. (no CVSS) - [CVE-2022-39840](https://cve.now/CVE-2022-39840.md): Cotonti Siena 0.9.20 allows admins to conduct stored XSS attacks via a direct message (DM). (no CVSS) - [CVE-2022-39831](https://cve.now/CVE-2022-39831.md): An issue was discovered in PSPP 1.6.2. (no CVSS) - [CVE-2022-39832](https://cve.now/CVE-2022-39832.md): An issue was discovered in PSPP 1.6.2. (no CVSS) - [CVE-2022-39828](https://cve.now/CVE-2022-39828.md): sign\_pFwInfo in Samsung mTower through 0.3.0 has a missing check on the return value of EC\_KEY\_set\_private\_key, leading to a denial of servi (no CVSS) - [CVE-2022-39829](https://cve.now/CVE-2022-39829.md): There is a NULL pointer dereference in aes256\_encrypt in Samsung mTower through 0.3.0 due to a missing check on the return value of EVP\_CIPH (no CVSS) - [CVE-2022-39830](https://cve.now/CVE-2022-39830.md): sign\_pFwInfo in Samsung mTower through 0.3.0 has a missing check on the return value of EC\_KEY\_set\_public\_key\_affine\_coordinates, leading to (no CVSS) - [CVE-2022-39824](https://cve.now/CVE-2022-39824.md): Server-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to execute arbitrary JavaScript code from the server via (no CVSS) - [CVE-2022-30331](https://cve.now/CVE-2022-30331.md): The User-Defined Functions (UDF) feature in TigerGraph 3.6.0 allows installation of a query (in the GSQL query language) without proper vali (no CVSS, pytigergraph) - [CVE-2022-31814](https://cve.now/CVE-2022-31814.md): pfSense pfBlockerNG through 2.1.4\_26 allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the HTTP H (CVSS 9.8) - [CVE-2022-38749](https://cve.now/CVE-2022-38749.md): DoS in SnakeYAML (CVSS 6.5, SnakeYAML · org.yaml:snakeyaml +6) - [CVE-2022-38750](https://cve.now/CVE-2022-38750.md): DoS in SnakeYAML (CVSS 6.5, SnakeYAML · org.yaml:snakeyaml) - [CVE-2022-38751](https://cve.now/CVE-2022-38751.md): DoS in SnakeYAML (CVSS 6.5, SnakeYAML · org.yaml:snakeyaml) - [CVE-2022-38752](https://cve.now/CVE-2022-38752.md): DoS in SnakeYAML (CVSS 6.5, SnakeYAML · org.yaml:snakeyaml) - [CVE-2022-39842](https://cve.now/CVE-2022-39842.md): An issue was discovered in the Linux kernel before 5.19. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2022-09-05 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.