CVEs published September 8, 2022
58 CVEs were published on September 8, 2022: 5 critical, 10 high. 1 is now in CISA KEV.
- Published
- 58
- Critical
- 5
- High
- 10
- Medium
- 9
- Low
- 0
- Unrated
- 34
- Now in CISA KEV
- 1
- Fix available
- 21
Most affected products
- Allied Telesis K.K. CentreCOM AR260S
- 4
- jgraph/drawio
- 2
- xwiki-platform · org.xwiki.platform:xwiki-platform-oldcore
- 2
- xwiki-platform · org.xwiki.platform:xwiki-platform-web-t… +1
- 2
- AEB-labs cruddl · cruddl
- 1
- Alfasado PowerCMS XMLRPC API
- 1
- Apache Software Foundation Apache James · org.apache.james:…
- 1
- Cisco SD-WAN vManage
- 1
- Cisco Small Business RV Series Router Firmware
- 1
- Cisco Webex Meetings Desktop App
- 1
Critical 5
- CVE-2022-36084cruddl vulnerable to AQL injection through flexSearchAEB-labs cruddl · cruddl
- CVE-2022-36100XWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval Injectionxwiki-platform · org.xwiki.platform:xwiki-platform-tag-ui +1
- CVE-2022-36099XWiki Platform Wiki UI Main Wiki Eval Injection vulnerabilityxwiki-platform · org.xwiki.platform:xwiki-platform-wiki-ui-…
- CVE-2022-3167Improper Restriction of Rendered UI Layers or Frames in ikus060/rdiffwebikus060/rdiffweb · rdiffweb
- CVE-2022-27593DeadBolt RansomwareQNAP Systems Photo Station
High 10
- CVE-2022-36098XWiki Platform Mentions UI vulnerable to Cross-site Scriptingxwiki-platform · org.xwiki.platform:xwiki-platform-mentions…
- CVE-2022-36097XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment formxwiki-platform · org.xwiki.platform:xwiki-platform-attachme…
- CVE-2022-36096XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments listxwiki-platform · org.xwiki.platform:xwiki-platform-index-ui
- CVE-2022-36094XWiki Platform Web Parent POM vulnerable to XSS in the attachment historyxwiki-platform · org.xwiki.platform:xwiki-platform-web
- CVE-2022-36093XWiki Platform Web Templates vulnerable to Unauthorized User Registration Through the Distribution Wizardxwiki-platform · org.xwiki.platform:xwiki-platform-web-t… +1
- CVE-2022-36092XWiki Platform Old Core vulnerable to Authentication Bypass Using the Login Actionxwiki-platform · org.xwiki.platform:xwiki-platform-oldcore
- CVE-2022-36091XWiki Platform Web Templates vulnerable to Missing Authorization and Exposure of Private Personal Information to an Unauthorized Actorxwiki-platform · org.xwiki.platform:xwiki-platform-web-t… +1
- CVE-2022-36090org.xwiki.platform:xwiki-platform-oldcore Improper Authorization check for inactive usersxwiki-platform · org.xwiki.platform:xwiki-platform-oldcore
- CVE-2022-36085OPA Compiler: Bypass of WithUnsafeBuiltins using `with` keyword to mock functionsopen-policy-agent opa · github.com/open-policy-agent/opa
- CVE-2022-20696Cisco SD-WAN vManage Software Unauthenticated Access to Messaging Services VulnerabilityCisco SD-WAN vManage
Medium, low and unrated 43
- CVE-2022-40297UBports Ubuntu Touch 16.04 allows the screen-unlock passcode to be used for a privileged shell via Sudo.
- CVE-2019-25076The TSS (Tuple Space Search) algorithm in Open vSwitch 2.x through 2.17.2 and 3.0.0 allows remote attackers to cause a denial of service (de
- CVE-2022-40280An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE).
- CVE-2022-40278An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE).
- CVE-2022-40279An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE).
- CVE-2022-40281An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE).
- CVE-2022-38269School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the component /modules/modstu
- CVE-2022-38268School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the component /modules/autonu
- CVE-2022-38267School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the component /modules/user/i
- CVE-2022-36095XWiki Cross-Site Request Forgery (CSRF) for actions on tagsxwiki-platform · org.xwiki.platform:xwiki-platform-web-temp…
- CVE-2022-38265Apartment Visitor Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter at /avms/edit-apar
- CVE-2022-38258A local file inclusion (LFI) vulnerability in D-Link DIR 819 v1.06 allows attackers to cause a Denial of Service (DoS) or access sensitive s
- CVE-2022-38256TastyIgniter v3.5.0 was discovered to contain a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scr
- CVE-2022-38260Interview Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /interview/delete.php?action=ques
- CVE-2022-22314IBM Planning Analytics Local 2.0 allows web pages to be stored locally which can be read by another user on the system.IBM Planning Analytics Workspace
- CVE-2022-38255Interview Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /interview/editQuestion.php
- CVE-2022-27969Cynet 360 Web Portal before v4.5 was discovered to allow attackers to access a list of decoy users via a crafted GET request sent to /WebApp
- CVE-2022-27968Cynet 360 Web Portal before v4.5 was discovered to allow attackers to access a list of monitored files and profiles via a crafted GET reques
- CVE-2022-27967Cynet 360 Web Portal before v4.5 was discovered to allow attackers to access a list of excluded files and profiles via a crafted GET request
- CVE-2022-37857bilde2910 Hauk v1.6.1 requires a hardcoded password which by default is blank.
- CVE-2022-37164Inoda OnTrack v3.4 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brut
- CVE-2022-37163Bminusl IHateToBudget v1.5.7 employs a weak password policy which allows attackers to potentially gain unauthorized access to the applicatio
- CVE-2022-36736Jitsi-2.10.5550 was discovered to contain a vulnerability in its web UI which allows attackers to perform a clickjacking attack via a crafte
- CVE-2022-20863Cisco Webex Meetings App Character Interface Manipulation VulnerabilityCisco Webex Meetings Desktop App
- CVE-2022-20923Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers IPSec VPN Server Authentication Bypass VulnerabilityCisco Small Business RV Series Router Firmware
- CVE-2022-30079Command injection vulnerability was discovered in Netgear R6200 v2 firmware through R6200v2-V1.0.3.12 via binary /sbin/acos_service that cou
- CVE-2022-3138Cross-site Scripting (XSS) - Generic in jgraph/drawiojgraph/drawio
- CVE-2022-3148Cross-site Scripting (XSS) - Generic in jgraph/drawiojgraph/drawio
- CVE-2022-28220STARTTLS command injection in Apache JAMESApache Software Foundation Apache James · org.apache.james:…
- CVE-2022-38400Mailform Pro CGI 4.3.1 and earlier allow a remote unauthenticated attacker to obtain the user input data by having a use of the product to aSYNCK GRAPHICA Mailform Pro CGI
- CVE-2022-38394Use of hard-coded credentials for the telnet server of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote unauthenticaAllied Telesis K.K. CentreCOM AR260S
- CVE-2022-38399Missing protection mechanism for alternate hardware interface in SmaCam CS-QR10 all versions and SmaCam Night Vision CS-QR20 all versions alPLANEX COMMUNICATIONS SmaCam CS-QR10 and SmaCam Night Visio…
- CVE-2022-38094OS command injection vulnerability in the telnet function of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote authenAllied Telesis K.K. CentreCOM AR260S
- CVE-2022-36403Untrusted search path vulnerability in the installer of Device Software Manager prior to Ver.2.20.3.0 allows an attacker to gain privileges RICOH COMPANY Installer of Device Software Manager
- CVE-2022-35273OS command injection vulnerability in GUI setting page of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote authenticAllied Telesis K.K. CentreCOM AR260S
- CVE-2022-34869Undocumented hidden command that can be executed from the telnet function of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allowsAllied Telesis K.K. CentreCOM AR260S
- CVE-2022-33941PowerCMS XMLRPC API provided by Alfasado Inc.Alfasado PowerCMS XMLRPC API
- CVE-2022-25914Remote Code Execution (RCE)com.google.cloud.tools:jib-core
- CVE-2022-25897Denial of Service (DoS)org.eclipse.milo:sdk-server
- CVE-2022-37146The PlexTrac platform prior to version 1.28.0 allows for username enumeration via HTTP response times on invalid login attempts for users co
- CVE-2022-37145The PlexTrac platform prior to version 1.17.0 does not restrict excessive authentication attempts for accounts configured to use the PlexTra
- CVE-2022-37144The PlexTrac platform prior to API version 1.17.0 does not restrict excessive MFA TOTP submission attempts.
- CVE-2022-3153NULL Pointer Dereference in vim/vimvim/vim