CVEs published September 7, 2022
61 CVEs were published on September 7, 2022: 6 critical, 17 high.
- Published
- 61
- Critical
- 6
- High
- 17
- Medium
- 10
- Low
- 0
- Unrated
- 28
- Now in CISA KEV
- 0
- Fix available
- 23
Most affected products
- SUSE Rancher · github.com/rancher/rancher
- 3
- codeprojects Online Driving School
- 2
- Linbreux wikmd
- 2
- python-poetry poetry · poetry
- 2
- activitywatch
- 1
- Blink1Control2
- 1
- fluxcd flux2 · github.com/fluxcd/helm-controller +1
- 1
- gocd
- 1
- kubevela
- 1
- mako
- 1
Critical 6
- CVE-2022-36587In Tenda G3 US_G3V3.0br_V15.11.0.6(7663)_EN_TDE, there is a buffer overflow vulnerability caused by sprintf in function in the httpd binary.
- CVE-2022-36660xhyve commit dfbe09b was discovered to contain a stack buffer overflow via the component pci_vtrnd_notify().
- CVE-2022-3152Unverified Password Change in phpfusion/phpfusionphpfusion/phpfusion
- CVE-2022-31247Rancher: Downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB)SUSE Rancher · github.com/rancher/rancher
- CVE-2021-36783Rancher: Failure to properly sanitize credentials in cluster template answersSUSE Rancher · github.com/rancher/rancher
- CVE-2021-36782Rancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io objectSUSE Rancher · github.com/rancher/rancher
High 17
- CVE-2022-36089VelaUX APIServer vulnerable to Authentication Bypass by Capture-replaykubevela
- CVE-2022-36086linked_list_allocator vulnerable to out-of-bound writes on `Heap` initialization and `Heap::extend`rust-osdev linked-list-allocator · linked_list_allocator
- CVE-2022-36081Wikmd vulnerable to Local File Enumeration when accessing /listLinbreux wikmd
- CVE-2022-36079Parse Server vulnerable to brute force guessing of user sensitive data via search patternsparse-community parse-server · parse-server
- CVE-2022-36049Flux2 Helm Controller denial of servicefluxcd flux2 · github.com/fluxcd/helm-controller +1
- CVE-2022-3130codeprojects Online Driving School login.php sql injectioncodeprojects Online Driving School
- CVE-2022-36073RubyGems allows creation of users with arbitrary unverified emailsrubygems.org
- CVE-2022-36069Poetry Argument Injection vulnerability can lead to local Code Executionpython-poetry poetry · poetry
- CVE-2022-36070Poetry's Untrusted Search Path can lead to Local Code Execution on Windowspython-poetry poetry · poetry
- CVE-2022-1807Multiple SQLi vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 18.Sophos Firewall
- CVE-2022-31414D-Link DIR-1960 firmware DIR-1960_A1_1.11 was discovered to contain a buffer overflow via srtcat in prog.cgi.
- CVE-2022-37780Phicomm FIR151B A2, FIR302E A2, FIR300B A2, FIR303B A2 routers V3.0.1.17 were discovered to contain a remote command execution (RCE) vulnera
- CVE-2022-31166XWiki.WebHome vulnerable to Improper Privilege Management in XWiki resolving groupsxwiki-platform · org.xwiki.platform:xwiki-platform-oldcore
- CVE-2022-31167XWiki Platform Security Parent POM vulnerable to overwriting of security rules of a page with a final page having the same referencexwiki-platform · org.xwiki.platform:xwiki-platform-security
- CVE-2022-31149ActivityWatch vulnerable to DNS rebinding attackactivitywatch
- CVE-2022-36271Outbyte PC Repair Installation File 1.7.112.7856 is vulnerable to Dll Hijacking.
- CVE-2022-37108An injection vulnerability in the syslog-ng configuration wizard in Securonix Snypr 6.4 allows an application user with the "Manage Ingester
Medium, low and unrated 38
- CVE-2021-34236Buffer Overflow in Netgear R8000 Router with firmware v1.0.4.56 allows remote attackers to execute arbitrary code or cause a denial-of-servi
- CVE-2022-36586In Tenda G3 US_G3V3.0br_V15.11.0.6(7663)_EN_TDE, there is a buffer overflow vulnerability caused by strcpy in function 0x869f4 in the httpd
- CVE-2022-36588In D-Link DAP1650 v1.04 firmware, the fileaccess.cgi program in the firmware has a buffer overflow vulnerability caused by strncpy.
- CVE-2022-37779Phicomm FIR151B A2, FIR302E A2, FIR300B A2, FIR303B A2 routers V3.0.1.17 were discovered to contain a remote command execution (RCE) vulnera
- CVE-2022-38531FPT G-97RG6M R4.2.98.035 and G-97RG3 R4.2.43.078 are vulnerable to Remote Command Execution in the ping function.
- CVE-2022-37777Phicomm FIR151B A2, FIR302E A2, FIR300B A2, FIR303B A2 routers 3.0.1.17 and earlier were discovered to contain a remote command execution (R
- CVE-2022-37778Phicomm FIR151B A2, FIR302E A2, FIR300B A2, FIR303B A2 routers V3.0.1.17 were discovered to contain a remote command execution (RCE) vulnera
- CVE-2022-36585In Tenda G3 US_G3V3.0br_V15.11.0.6(7663)_EN_TDE, in httpd binary, the addDhcpRule function has a buffer overflow caused by sscanf.
- CVE-2022-36088GoCD Windows installations outside default location inadequately restrict installation file permissionsgocd
- CVE-2022-36083JOSE vulnerable to resource exhaustion via specifically crafted JWEpanva jose · jose +3
- CVE-2022-36082mangadex-downloader vulnerable to unauthorized file readingmansuf mangadex-downloader · mangadex-downloader
- CVE-2020-19914Cross Site Scripting (XSS) in xiunobbs 4.0.4 allows remote attackers to execute arbitrary web script or HTML via the attachment upload funct
- CVE-2022-38247Nagios XI v5.8.6 was discovered to contain a cross-site scripting (XSS) vulnerability via the System Settings page under the Admin panel.
- CVE-2022-38248Nagios XI before v5.8.7 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities at auditlog.php.
- CVE-2022-38249Nagios XI v5.8.6 was discovered to contain a cross-site scripting (XSS) vulnerability via the MTR component in version 1.0.4.
- CVE-2022-38250Nagios XI v5.8.6 was discovered to contain a SQL injection vulnerability via the mib_name parameter at the Manage MIBs page.
- CVE-2022-38251Nagios XI v5.8.6 was discovered to contain a cross-site scripting (XSS) vulnerability via the System Performance Settings page under the Adm
- CVE-2022-38254Nagios XI before v5.8.7 was discovered to contain a cross-site scripting (XSS) vulnerability via the ajax.php script in CCM 3.1.5.
- CVE-2022-36080Wikmd Cross-site Scripting vulnerabilityLinbreux wikmd
- CVE-2022-3129codeprojects Online Driving School registration.php unrestricted uploadcodeprojects Online Driving School
- CVE-2022-38313Tenda AC18 router v15.03.05.19 and v15.03.05.05 was discovered to contain a stack overflow via the time parameter at /goform/saveParentContr
- CVE-2022-38312Tenda AC18 router v15.03.05.19 and v15.03.05.05 was discovered to contain a stack overflow via the list parameter at /goform/SetIpMacBind.
- CVE-2022-38311Tenda AC18 router v15.03.05.19 and v15.03.05.05 was discovered to contain a stack overflow via the time parameter at /goform/PowerSaveSet.
- CVE-2022-38310Tenda AC18 router v15.03.05.19 and v15.03.05.05 was discovered to contain a stack overflow via the list parameter at /goform/SetStaticRouteC
- CVE-2022-38309Tenda AC18 router v15.03.05.19 and v15.03.05.05 was discovered to contain a stack overflow via the list parameter at /goform/SetVirtualServe
- CVE-2022-38314Tenda AC18 router v15.03.05.19 and v15.03.05.05 was discovered to contain a stack overflow via the urls parameter at /goform/saveParentContr
- CVE-2022-30078NETGEAR R6200_V2 firmware versions through R6200v2-V1.0.3.12_10.1.11 and R6300_V2 firmware versions through R6300v2-V1.0.4.52_10.0.93 allow
- CVE-2022-30312The Trend Controls IC protocol through 2022-05-06 allows Cleartext Transmission of Sensitive Information.
- CVE-2022-36661xhyve commit dfbe09b was discovered to contain a NULL pointer dereference via the component vi_pci_read().
- CVE-2022-36659xhyve commit dfbe09b was discovered to contain a NULL pointer dereference via the component vi_pci_write().
- CVE-2022-36539WeDayCare B.V Ouderapp before v1.1.22 allows attackers to alter the ID value within intercepted calls to gain access to data of other parent
- CVE-2022-37731ftcms 2.1 poster.PHP has a XSS vulnerability.
- CVE-2022-37730In ftcms 2.1, there is a Cross Site Request Forgery (CSRF) vulnerability in the PHP page, which causes the attacker to forge a link to trick
- CVE-2022-35513The Blink1Control2 application <= 2.2.7 uses weak password encryption and an insecure method of storage.Blink1Control2
- CVE-2022-37189DDMAL MEI2Volpiano 0.8.2 is vulnerable to XML External Entity (XXE), leading to a Denial of Service.mei2volpiano
- CVE-2022-31251slurm: %post for slurm-testsuite operates as root in user owned directoryopenSUSE Factory
- CVE-2022-21950canna: unsafe handling of /tmp/.iroha_unix directoryopenSUSE Backports SLE-15-SP3 · openSUSE Backports SLE-15-S…
- CVE-2022-40023Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse.mako