CVEs published September 6, 2022
157 CVEs were published on September 6, 2022: 6 critical, 38 high.
- Published
- 157
- Critical
- 6
- High
- 38
- Medium
- 42
- Low
- 2
- Unrated
- 69
- Now in CISA KEV
- 0
- Fix available
- 23
Most affected products
- Aruba CX 6200F Switch Series; Aruba 6300 Switch Series; Aru…
- 12
- MediaTek MT6833, MT6853, MT6855, MT6873, MT6877, MT6879, MT…
- 6
- rizinorg rizin
- 6
- Dell CPG BIOS
- 4
- justinbusa Beaver Builder – WordPress Page Builder
- 4
- Cognex 3D-A1000 Dimensioning System
- 3
- dcooney Ajax Load More – Infinite Scroll, Load More, & Lazy…
- 3
- Fortinet FortiOS
- 3
- Fortinet FortiSOAR
- 3
- fribidi
- 3
Critical 6
- CVE-2022-1368Cognex 3D-A1000 Dimensioning System Missing Authentication for Critical FunctionCognex 3D-A1000 Dimensioning System
- CVE-2022-1525Cognex 3D-A1000 Dimensioning System Client-Side Enforcement of Server-Side SecurityCognex 3D-A1000 Dimensioning System
- CVE-2022-31860An issue was discovered in OpenRemote through 1.0.4 allows attackers to execute arbitrary code via a crafted Groovy rule.
- CVE-2022-34882Information Exposure Vulnerability in RAID Manager Storage Replication AdapterHitachi RAID Manager Storage Replication Adapter
- CVE-2022-34747A format string vulnerability in Zyxel NAS326 firmware versions prior to V5.21(AAZF.12)C0 could allow an attacker to achieve unauthorized reZyxel NAS326 firmware
- CVE-2022-36067vm2 vulnerable to Sandbox Escape before v3.9.11patriksimek vm2 · vm2
High 38
- CVE-2022-36427WordPress About Rentals plugin <= 1.5 - Missing Access Control vulnerabilityAbout Rentals. About Rentals
- CVE-2022-37344WordPress Accommodation System plugin <= 1.0.1 - Missing Access Control vulnerabilityPHP Crafts Accommodation System
- CVE-2022-36387WordPress About Me plugin <= 1.0.12 - Broken Access Control vulnerabilityAlessio Caiazza About Me
- CVE-2022-36065GrowthBook account creation and file upload vulnerability in self-hosted configurationsgrowthbook
- CVE-2022-26861Dell BIOS versions contain an Insecure Automated Optimization vulnerability.Dell CPG BIOS
- CVE-2022-26860Dell BIOS versions contain a stack-based buffer overflow vulnerability.Dell CPG BIOS
- CVE-2022-36058elrond-go MultiESDTNFTTransfer call on a SC address with missing function nameElrondNetwork elrond-go · github.com/ElrondNetwork/elrond-go
- CVE-2022-36039Out-of-bounds write when parsing DEX files in Rizinrizinorg rizin
- CVE-2022-36038CircuitVerse potential RCE vulnerability via Oj.loadCircuitVerse
- CVE-2022-32264sys/netinet/tcp_timer.h in FreeBSD before 7.0 contains a denial-of-service (DoS) vulnerability due to improper handling of TSopt on TCP conn
- CVE-2022-2718JoomSport – for Sports: Team & League, Football, Hockey & more <= 5.2.5 - Authenticated (Admin+) SQL Injection via orderbybeardev JoomSport – for Sports: Team & League, Football, Ho…
- CVE-2022-2540Link Optimizer Lite <= 1.4.5 - Cross-Site Request Forgery to Cross-Site Scriptingadambard Link Optimizer Lite
- CVE-2022-2541uContext for Amazon <= 3.9.1 - Cross-Site Request Forgery to Cross-Site Scriptinggcornelisse uContext for Amazon
- CVE-2022-2542uContext for Clickbank <= 3.9.1 - Cross-Site Request Forgery to Cross-Site Scriptinggcornelisse uContext for Clickbank
- CVE-2022-2633The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'dplugins360 All-in-One Video Gallery
- CVE-2022-2717JoomSport – for Sports: Team & League, Football, Hockey & more <= 5.2.5 - Authentciated (Admin+) SQL Injection via orderbybeardev JoomSport – for Sports: Team & League, Football, Ho…
- CVE-2022-2518Stockists Manager for Woocommerce <= 1.0.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scriptingdholovnia Stockists Manager for Woocommerce
- CVE-2022-2434String Locator <= 2.5.0 - Cross-Site Request Forgery to PHAR Deserializationinstawp String locator
- CVE-2022-2436Download Manager <= 3.2.49 - Authenticated (Contributor+) PHAR Deserializationcodename065 Download Manager
- CVE-2022-2438Broken Link Checker <= 1.11.16 - Authenticated (Admin+) PHAR Deserializationwpmudev Broken Link Checker
- CVE-2022-2442Migration, Backup, Staging – WPvivid <= 0.9.74 - Authenticated (Admin+) PHAR Deserializationwpvividplugins WPvivid — Backup, Migration & Staging
- CVE-2022-2431Download Manager <= 3.2.50 - Authenticated (Contributor+) Arbitrary File Deletiondownload-manager Download Manager
- CVE-2022-2432Ecwid Ecommerce Shopping Cart <= 6.10.23 - Cross-Site Request Forgery to Settings/Options UpdateEcwid Ecommerce Shopping Cart
- CVE-2022-2433WordPress Infinite Scroll – Ajax Load More <= 5.5.3 - Cross-Site Request Forgery to PHAR Deserializationdcooney Ajax Load More – Infinite Scroll, Load More, & Lazy…
- CVE-2022-2233Banner Cycler <= 1.4 - Cross-Site Request Forgery to Cross-Site Scriptingjkriddle Banner Cycler
- CVE-2022-34867WordPress WP Libre Form 2 plugin <= 2.0.8 - Unauthenticated Sensitive Information Disclosure vulnerabilityLibreform WP Libre Form · libreform/libreform
- CVE-2022-31020Remote code execution in Indy's NODE_UPGRADE transactionhyperledger indy-node · indy-node
- CVE-2022-30298An improper privilege management vulnerability [CWE-269] in Fortinet FortiSOAR before 7.2.1 allows a GUI user who has already found a way toFortinet FortiSOAR
- CVE-2022-29058An improper neutralization of special elements [CWE-89] used in an OS command vulnerability [CWE-78] in the command line interpreter of FortFortinet FortiAP, FortiAP-S, FortiAP-W2, FortiAP-U
- CVE-2022-2714Improper Handling of Length Parameter Inconsistency in francoisjacquet/rosariosisfrancoisjacquet/rosariosis
- CVE-2022-2901Improper Authorization in chatwoot/chatwootchatwoot/chatwoot
- CVE-2022-34883OS Command Injection Vulnerability in RAID Manager Storage Replication AdapterHitachi RAID Manager Storage Replication Adapter
- CVE-2022-3134Use After Free in vim/vimvim/vim
- CVE-2022-36040Rizin Out-of-bounds Write vulnerability in pyc/marshal.crizinorg rizin
- CVE-2022-36041Rizin Out-of-bounds Write vulnerability in Mach-O binary pluginrizinorg rizin
- CVE-2022-36042Rizin Out-of-bounds Write vulnerability in dyld cache binary pluginrizinorg rizin
- CVE-2022-36043Rizin Double Free in bobj.c when using qnx binary pluginrizinorg rizin
- CVE-2022-36044Rizin Out-of-bounds Write vulnerability in Lua binary pluginrizinorg rizin
Medium, low and unrated 113
- CVE-2022-1522Cognex 3D-A1000 Dimensioning System Improper Output Neutralization for LogsCognex 3D-A1000 Dimensioning System
- CVE-2022-38529tinyexr commit 0647fb3 was discovered to contain a heap-buffer overflow via the component rleUncompress.
- CVE-2022-38528Open Asset Import Library (assimp) commit 3c253ca was discovered to contain a segmentation violation via the component Assimp::XFileImporter
- CVE-2022-35913Samourai Wallet Stonewallx2 0.99.98e allows a denial of service via a P2P coinjoin.
- CVE-2022-36064Shescape Inefficient Regular Expression Complexity vulnerabilityericcornelissen shescape
- CVE-2022-36072SilverwareGames.io used == for hashing instead of ===mesosoi silverwaregames-io-issue-tracker
- CVE-2022-36663Gluu Oxauth before v4.4.1 allows attackers to execute blind SSRF (Server-Side Request Forgery) attacks via a crafted request_uri parameter.org.gluu:oxauth-common
- CVE-2022-36061Elrond go can execute on same context checks in VMElrondNetwork elrond-go · github.com/ElrondNetwork/elrond-go
- CVE-2022-38176An issue was discovered in YSoft SAFEQ 6 before 6.0.72.
- CVE-2022-26859Dell BIOS contains a race condition vulnerability.Dell CPG BIOS
- CVE-2022-26858Dell BIOS versions contain an Improper Authentication vulnerability.Dell CPG BIOS
- CVE-2022-37253Persistent cross-site scripting (XSS) in Crime Reporting System 1.0 allows a remote attacker to introduce arbitary Javascript via manipulati
- CVE-2022-36057Discourse-Chat Cross-Site Scripting issue for channel names and descriptionsdiscourse-chat
- CVE-2022-37185SQL injection vulnerability exists in the school information query interface (repschoolproj.php) of the EMS 6.2 system of the Office of the
- CVE-2022-31791WatchGuard Firebox and XTM appliances allow a local attacker (that has already obtained shell access) to elevate their privileges and execut
- CVE-2022-31792A stored cross-site scripting (XSS) vulnerability exists in the management web interface of WatchGuard Firebox and XTM appliances.
- CVE-2022-36032ReactPHP's HTTP server parses encoded cookie names so malicious `__Host-` and `__Secure-` cookies can be sentreactphp http · react/http
- CVE-2022-31789An integer overflow in WatchGuard Firebox and XTM appliances allows an unauthenticated remote attacker to trigger a buffer overflow and pote
- CVE-2022-35931Nextcloud Password Policy's generated passwords are not fully validated by HIBPValidatornextcloud security-advisories
- CVE-2020-21516There is an arbitrary file upload vulnerability in FeehiCMS 2.0.8 at the head image upload, that allows attackers to execute relevant PHP cofeehi/cms
- CVE-2022-36670PCProtect Endpoint prior to v5.17.470 for Microsoft Windows lacks tamper protection, allowing authenticated attackers with Administrator pri
- CVE-2022-37771IObit Malware Fighter v9.2 for Microsoft Windows lacks tamper protection, allowing authenticated attackers with Administrator privileges to
- CVE-2022-31790WatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to retrieve sensitive authentication server settings by sendi
- CVE-2022-27664In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang durigolang.org/x/net · golang.org/x/net/http2 +1
- CVE-2022-26468In preloader (usb), there is a possible out of bounds write due to a missing bounds check.MediaTek MT6735, MT6739, MT6761, MT6763, MT6765, MT6768, MT…
- CVE-2022-26469In MtkEmail, there is a possible escalation of privilege due to fragment injection.MediaTek MT6580, MT6735, MT6737, MT6739, MT6761, MT6765, MT…
- CVE-2022-26470In aie, there is a possible out of bounds write due to an incorrect bounds check.MediaTek MT6879, MT6895, MT6983, MT8321, MT8385, MT8765, MT…
- CVE-2022-26462In vow, there is a possible out of bounds read due to an incorrect bounds check.MediaTek MT6833, MT6853, MT6855, MT6873, MT6877, MT6879, MT…
- CVE-2022-26463In vow, there is a possible out of bounds read due to an incorrect bounds check.MediaTek MT6833, MT6853, MT6855, MT6873, MT6877, MT6879, MT…
- CVE-2022-26464In vow, there is a possible out of bounds write due to an incorrect bounds check.MediaTek MT6833, MT6853, MT6855, MT6873, MT6877, MT6879, MT…
- CVE-2022-26465In audio ipi, there is a possible out of bounds write due to an incorrect bounds check.MediaTek MT6779, MT6781, MT6785, MT6853, MT6853T, MT6873, M…
- CVE-2022-26466In audio ipi, there is a possible out of bounds write due to an integer overflow.MediaTek MT6779, MT6781, MT6785, MT6853, MT6853T, MT6873, M…
- CVE-2022-26467In rpmb, there is a possible out of bounds write due to an incorrect bounds check.MediaTek MT6580, MT6735, MT6737, MT6739, MT6753, MT6761, MT…
- CVE-2022-26457In vow, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6769, MT6781, MT6785, MT6833, MT6855, MT6877, MT…
- CVE-2022-26458In vow, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6853, MT6855, MT6873, MT6877, MT6883, MT6885, MT…
- CVE-2022-26459In vow, there is a possible out of bounds read due to an integer overflow.MediaTek MT6833, MT6853, MT6855, MT6873, MT6877, MT6879, MT…
- CVE-2022-26460In vow, there is a possible out of bounds write due to an incorrect bounds check.MediaTek MT6833, MT6853, MT6855, MT6873, MT6877, MT6879, MT…
- CVE-2022-26461In vow, there is a possible undefined behavior due to an API misuse.MediaTek MT6833, MT6853, MT6855, MT6873, MT6877, MT6879, MT…
- CVE-2022-26451In ged, there is a possible use after free due to improper locking.MediaTek MT6789, MT6855, MT6879, MT6895, MT6983, MT8168, MT…
- CVE-2022-26453In teei, there is a possible memory corruption due to a use after free.MediaTek MT6761, MT6765, MT6768, MT6771, MT6779, MT6781, MT…
- CVE-2022-26454In teei, there is a possible memory corruption due to an integer overflow.MediaTek MT6761, MT6765, MT6768, MT6771, MT6779, MT6781, MT…
- CVE-2022-26455In gz, there is a possible memory corruption due to incorrect error handling.MediaTek MT6789, MT6855, MT6879, MT6895, MT6983
- CVE-2022-26456In vow, there is a possible information disclosure due to a symbolic link following.MediaTek MT6769, MT6781, MT6785, MT6789, MT6833, MT6853, MT…
- CVE-2022-26447In BT firmware, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6580, MT6735, MT6737, MT6739, MT6750S, MT6753, M…
- CVE-2022-26448In apusys, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6853T, MT6873, MT6875, MT6877, MT6883, MT6885, M…
- CVE-2022-26449In apusys, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6879, MT6895, MT6983
- CVE-2022-26450In apusys, there is a possible use after free due to a race condition.MediaTek MT6879, MT6895, MT6983
- CVE-2022-28884Denial-of-Service (DoS) VulnerabilityAll F-Secure and WithSecure Endpoint Protection products fo…
- CVE-2022-2943WordPress Infinite Scroll – Ajax Load More <= 5.5.3 - Authenticated (Admin+) Arbitrary File Readdcooney Ajax Load More – Infinite Scroll, Load More, & Lazy…
- CVE-2022-3026WP Users Exporter <= 1.4.2 - CSV Injectionleogermani WP Users Exporter
- CVE-2022-2935Image Hover Effects Ultimate <= 9.7.3 - Authenticated Stored Cross-Site Scripting via Media URLbiplob018 Image Hover Effects Ultimate
- CVE-2022-2939WP Cerber Security <= 9.0 - User Enumeration Bypassgioni WP Cerber Security, Anti-spam & Malware Scan
- CVE-2022-2945WordPress Infinite Scroll – Ajax Load More <= 5.5.3 - Directory Traversaldcooney Ajax Load More – Infinite Scroll, Load More, & Lazy…
- CVE-2022-2716Beaver Builder – WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via Text Editorjustinbusa Beaver Builder – WordPress Page Builder
- CVE-2022-2934Beaver Builder – WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via Image URLjustinbusa Beaver Builder – WordPress Page Builder
- CVE-2022-2936Image Hover Effects Ultimate <= 9.7.3 - Authenticated Stored Cross-Site Scripting via Video Linkbiplob018 Image Hover Effects Ultimate
- CVE-2022-2941WP-UserOnline <= 2.88.0 - Authenticated (Admin+) Stored Cross-Site Scriptinggamerz WP-UserOnline
- CVE-2022-2695Beaver Builder – WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via 'caption'justinbusa Beaver Builder – WordPress Page Builder
- CVE-2022-2461Transposh WordPress Translation <= 1.0.9.6 - Unauthorized Settings Changeoferwald Transposh WordPress Translation
- CVE-2022-2473WP-UserOnline <= 2.87.6 - Authenticated (Admin+) Stored Cross-Site Scriptinggamerz WP-UserOnline
- CVE-2022-2515Simple Banner <= 2.11.0 - Authenticated Stored Cross-Site Scriptingrpetersen29 Simple Banner – Easily add multiple Banners/Bar…
- CVE-2022-2516Visual Composer Website Builder <= 45.0 - Authenticated Stored Cross-Site Scripting via 'Title'visualcomposer Visual Composer Website Builder, Landing Pag…
- CVE-2022-2517Beaver Builder – WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via Caption - On Hoverjustinbusa Beaver Builder – WordPress Page Builder
- CVE-2022-2462Transposh WordPress Translation <= 1.0.9.6 - Sensitive Information Disclosureoferwald Transposh WordPress Translation
- CVE-2022-2429Ultimate SMS Notifications for WooCommerce <= 1.4.1 - CSV Injectionhomescript Ultimate SMS Notifications for WooCommerce
- CVE-2022-2430Visual Composer Website Builder <= 45.0 - Authenticated Stored Cross-Site Scripting via 'Text Block'visualcomposer Visual Composer Website Builder, Landing Pag…
- CVE-2022-1628Simple SEO <= 1.7.91 - Authenticated (Contributor+) Stored Cross-Site Scriptingcoleds Simple SEO
- CVE-2022-23688Multiple vulnerabilities exist in the processing of packet data by the LLDP service of AOS-CX.Aruba CX 6200F Switch Series; Aruba 6300 Switch Series; Aru…
- CVE-2022-23689Multiple vulnerabilities exist in the processing of packet data by the LLDP service of AOS-CX.Aruba CX 6200F Switch Series; Aruba 6300 Switch Series; Aru…
- CVE-2022-23690A vulnerability in the web-based management interface of AOS-CX could allow a remote unauthenticated attacker to fingerprint the exact versiAruba CX 6200F Switch Series; Aruba 6300 Switch Series; Aru…
- CVE-2022-23691A vulnerability exists in certain AOS-CX switch models which could allow an attacker with access to the recovery console to bypass normal auAruba CX 6200F Switch Series; Aruba 6300 Switch Series; Aru…
- CVE-2022-34656WordPress Poll, Survey, Questionnaire and Voting system plugin <= 1.7.4 - Authenticated Cross-Site Scripting (XSS) vulnerabilitywpdevart Poll, Survey, Questionnaire and Voting system
- CVE-2022-36425WordPress Beaver Builder plugin <= 2.5.4.3 - Broken Access Control vulnerabilityThe Beaver Builder Team Beaver Builder – WordPress Page Bui…
- CVE-2022-33177WordPress Booking Calendar plugin <= 9.2.1 - Cross-Site Request Forgery (CSRF) vulnerabiulityWPdevelop/Oplugins Booking Calendar
- CVE-2022-23686Multiple vulnerabilities exist in the processing of packet data by the LLDP service of AOS-CX.Aruba CX 6200F Switch Series; Aruba 6300 Switch Series; Aru…
- CVE-2022-23687Multiple vulnerabilities exist in the processing of packet data by the LLDP service of AOS-CX.Aruba CX 6200F Switch Series; Aruba 6300 Switch Series; Aru…
- CVE-2022-23680AOS-CX lacks Anti-CSRF protections in place for state-changing operations.Aruba CX 6200F Switch Series; Aruba 6300 Switch Series; Aru…
- CVE-2022-23681Multiple vulnerabilities exist in the AOS-CX command line interface that could lead to authenticated command injection.Aruba CX 6200F Switch Series; Aruba 6300 Switch Series; Aru…
- CVE-2022-23682Multiple vulnerabilities exist in the AOS-CX command line interface that could lead to authenticated command injection.Aruba CX 6200F Switch Series; Aruba 6300 Switch Series; Aru…
- CVE-2022-23683Authenticated command injection vulnerabilities exist in the AOS-CX Network Analytics Engine via NAE scripts.Aruba CX 6200F Switch Series; Aruba 6300 Switch Series; Aru…
- CVE-2022-23684A vulnerability in the web-based management interface of AOS-CX could allow a remote authenticated user with read-only privileges to escalatAruba CX 6200F Switch Series; Aruba 6300 Switch Series; Aru…
- CVE-2022-23451An authorization flaw was found in openstack-barbican.openstack/barbican · barbican
- CVE-2022-23678A vulnerability in the Aruba Virtual Intranet Access (VIA) client for Microsoft Windows operating system client communications that could alAruba Virtual Intranet Access
- CVE-2022-23679AOS-CX lacks Anti-CSRF protections in place for state-changing operations.Aruba CX 6200F Switch Series; Aruba 6300 Switch Series; Aru…
- CVE-2022-25308A stack-based buffer overflow flaw was found in the Fribidi package.fribidi
- CVE-2022-25309A heap-based buffer overflow flaw was found in the Fribidi package and affects the fribidi_cap_rtl_to_unicode() function of the fribidi-charfribidi
- CVE-2022-25310A segmentation fault (SEGV) flaw was found in the Fribidi package and affects the fribidi_remove_bidi_marks() function of the lib/fribidi.c fribidi
- CVE-2021-36829WordPress Launcher: Coming Soon & Maintenance Mode plugin <= 1.0.11 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityMyThemeShop Launcher: Coming Soon & Maintenance Mode
- CVE-2022-2402Stack Overflow in ESET Endpoint Encryption and ESET Full Disk Encryption for WindowsESET, spol. s r.o. ESET Endpoint Encryption · ESET, spol. s…
- CVE-2022-2735A vulnerability was found in the PCS project.ClusterLabs/pcs
- CVE-2022-28885Denial-of-Service (DoS) VulnerabilityWithSecure F-Secure Linux Security 64 F-Secure Atlant
- CVE-2022-1697Okta Active Directory Agent versions 3.8.0 through 3.11.0 installed the Okta AD Agent Update Service using an unquoted path.Okta Active Directory Agent
- CVE-2021-43565The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server.golang.org/x/crypto
- CVE-2022-40112TOTOLINK A3002R TOTOLINK-A3002R-He-V1.1.1-B20200824.0128 is vulnerable Buffer Overflow via the hostname parameter in binary /bin/boa.
- CVE-2022-40111In TOTOLINK A3002R TOTOLINK-A3002R-He-V1.1.1-B20200824.0128 in the shadow.sample file, root is hardcoded in the firmware.
- CVE-2022-40110TOTOLINK A3002R TOTOLINK-A3002R-He-V1.1.1-B20200824.0128 is vulnerable to Buffer Overflow via /bin/boa.
- CVE-2022-36584In Tenda G3 US_G3V3.0br_V15.11.0.6(7663)_EN_TDE, the getsinglepppuser function has a buffer overflow caused by sscanf.
- CVE-2022-40109TOTOLINK A3002R TOTOLINK-A3002R-He-V1.1.1-B20200824.0128 is vulnerable to Insecure Permissions via binary /bin/boa.
- CVE-2022-37842In TOTOLINK A860R V4.1.2cu.5182_B20201027, the parameters in infostat.cgi are not filtered, causing a buffer overflow vulnerability.
- CVE-2022-37840In TOTOLINK A860R V4.1.2cu.5182_B20201027, the main function in downloadfile.cgi has a buffer overflow vulnerability.
- CVE-2022-37841In TOTOLINK A860R V4.1.2cu.5182_B20201027 there is a hard coded password for root in /etc/shadow.sample.
- CVE-2022-37839TOTOLINK A860R V4.1.2cu.5182_B20201027 is vulnerable to Buffer Overflow via Cstecgi.cgi.
- CVE-2022-37843In TOTOLINK A860R V4.1.2cu.5182_B20201027 in cstecgi.cgi, the acquired parameters are directly put into the system for execution without fil
- CVE-2022-35847An improper neutralization of special elements used in a template engine vulnerability [CWE-1336] in FortiSOAR management interface 7.2.0, 7Fortinet FortiSOAR
- CVE-2021-43080An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS version 7.2.0, version 6.4.0 through 6.4.9,Fortinet FortiOS
- CVE-2021-43076An improper privilege management vulnerability [CWE-269] in FortiADC versions 6.2.1 and below, 6.1.5 and below, 6.0.4 and below, 5.4.5 and bFortinet FortiADC
- CVE-2022-26114An improper neutralization of input during web page generation vulnerability [CWE-79] in the Webmail of FortiMail before 7.2.0 may allow an Fortinet FortiMail
- CVE-2022-29062Multiple relative path traversal vulnerabilities [CWE-23] in Fortinet FortiSOAR before 7.2.1 allows an authenticated attacker to write to thFortinet FortiSOAR
- CVE-2022-29053A missing cryptographic steps vulnerability [CWE-325] in the functions that encrypt the keytab files in FortiOS version 7.2.0, 7.0.0 throughFortinet FortiOS
- CVE-2022-27491A improper verification of source of a communication channel in Fortinet FortiOS with IPS engine version 7.201 through 7.214, 7.001 through Fortinet FortiOS
- CVE-2022-32277Squiz Matrix CMS 6.20 is vulnerable to an Insecure Direct Object Reference caused by failure to correctly validate authorization when submit
- CVE-2022-38131RStudio Connect prior to 2023.01.0 is affected by an Open Redirect issue.RStudio Connect
- CVE-2022-38530GPAC v2.1-DEV-rev232-gfcaa01ebb-master was discovered to contain a stack overflow when processing ISOM_IOD.