# CVEs published 2022-09-08

58 CVEs were published on September 8, 2022: 5 critical, 10 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2022-40297](https://cve.now/CVE-2022-40297.md): UBports Ubuntu Touch 16.04 allows the screen-unlock passcode to be used for a privileged shell via Sudo. (no CVSS)
- [CVE-2019-25076](https://cve.now/CVE-2019-25076.md): The TSS (Tuple Space Search) algorithm in Open vSwitch 2.x through 2.17.2 and 3.0.0 allows remote attackers to cause a denial of service (de (no CVSS)
- [CVE-2022-36084](https://cve.now/CVE-2022-36084.md): cruddl vulnerable to AQL injection through flexSearch (CVSS 9.9, AEB-labs cruddl · cruddl)
- [CVE-2022-36100](https://cve.now/CVE-2022-36100.md): XWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval Injection (CVSS 9.9, xwiki-platform · org.xwiki.platform:xwiki-platform-tag-ui +1)
- [CVE-2022-40280](https://cve.now/CVE-2022-40280.md): An issue was discovered in Samsung TizenRT through 3.0\_GBM (and 3.1\_PRE). (no CVSS)
- [CVE-2022-40278](https://cve.now/CVE-2022-40278.md): An issue was discovered in Samsung TizenRT through 3.0\_GBM (and 3.1\_PRE). (no CVSS)
- [CVE-2022-40279](https://cve.now/CVE-2022-40279.md): An issue was discovered in Samsung TizenRT through 3.0\_GBM (and 3.1\_PRE). (no CVSS)
- [CVE-2022-40281](https://cve.now/CVE-2022-40281.md): An issue was discovered in Samsung TizenRT through 3.0\_GBM (and 3.1\_PRE). (no CVSS)
- [CVE-2022-38269](https://cve.now/CVE-2022-38269.md): School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the component /modules/modstu (no CVSS)
- [CVE-2022-38268](https://cve.now/CVE-2022-38268.md): School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the component /modules/autonu (no CVSS)
- [CVE-2022-38267](https://cve.now/CVE-2022-38267.md): School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the component /modules/user/i (no CVSS)
- [CVE-2022-36098](https://cve.now/CVE-2022-36098.md): XWiki Platform Mentions UI vulnerable to Cross-site Scripting (CVSS 8.9, xwiki-platform · org.xwiki.platform:xwiki-platform-mentions…)
- [CVE-2022-36099](https://cve.now/CVE-2022-36099.md): XWiki Platform Wiki UI Main Wiki Eval Injection vulnerability (CVSS 9.9, xwiki-platform · org.xwiki.platform:xwiki-platform-wiki-ui-…)
- [CVE-2022-36097](https://cve.now/CVE-2022-36097.md): XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment form (CVSS 8.9, xwiki-platform · org.xwiki.platform:xwiki-platform-attachme…)
- [CVE-2022-36096](https://cve.now/CVE-2022-36096.md): XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments list (CVSS 8.9, xwiki-platform · org.xwiki.platform:xwiki-platform-index-ui)
- [CVE-2022-36095](https://cve.now/CVE-2022-36095.md): XWiki Cross-Site Request Forgery (CSRF) for actions on tags (CVSS 4.3, xwiki-platform · org.xwiki.platform:xwiki-platform-web-temp…)
- [CVE-2022-38265](https://cve.now/CVE-2022-38265.md): Apartment Visitor Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter at /avms/edit-apar (no CVSS)
- [CVE-2022-36094](https://cve.now/CVE-2022-36094.md): XWiki Platform Web Parent POM vulnerable to XSS in the attachment history (CVSS 8.9, xwiki-platform · org.xwiki.platform:xwiki-platform-web)
- [CVE-2022-3167](https://cve.now/CVE-2022-3167.md): Improper Restriction of Rendered UI Layers or Frames in ikus060/rdiffweb (CVSS 10.0, ikus060/rdiffweb · rdiffweb)
- [CVE-2022-38258](https://cve.now/CVE-2022-38258.md): A local file inclusion (LFI) vulnerability in D-Link DIR 819 v1.06 allows attackers to cause a Denial of Service (DoS) or access sensitive s (no CVSS)
- [CVE-2022-38256](https://cve.now/CVE-2022-38256.md): TastyIgniter v3.5.0 was discovered to contain a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scr (no CVSS)
- [CVE-2022-36093](https://cve.now/CVE-2022-36093.md): XWiki Platform Web Templates vulnerable to Unauthorized User Registration Through the Distribution Wizard (CVSS 8.5, xwiki-platform · org.xwiki.platform:xwiki-platform-web-t… +1)
- [CVE-2022-36092](https://cve.now/CVE-2022-36092.md): XWiki Platform Old Core vulnerable to Authentication Bypass Using the Login Action (CVSS 7.5, xwiki-platform · org.xwiki.platform:xwiki-platform-oldcore)
- [CVE-2022-38260](https://cve.now/CVE-2022-38260.md): Interview Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /interview/delete.php?action=ques (no CVSS)
- [CVE-2022-36091](https://cve.now/CVE-2022-36091.md): XWiki Platform Web Templates vulnerable to Missing Authorization and Exposure of Private Personal Information to an Unauthorized Actor (CVSS 7.5, xwiki-platform · org.xwiki.platform:xwiki-platform-web-t… +1)
- [CVE-2022-22314](https://cve.now/CVE-2022-22314.md): IBM Planning Analytics Local 2.0 allows web pages to be stored locally which can be read by another user on the system. (CVSS 4.0, IBM Planning Analytics Workspace)
- [CVE-2022-38255](https://cve.now/CVE-2022-38255.md): Interview Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /interview/editQuestion.php (no CVSS)
- [CVE-2022-27969](https://cve.now/CVE-2022-27969.md): Cynet 360 Web Portal before v4.5 was discovered to allow attackers to access a list of decoy users via a crafted GET request sent to /WebApp (no CVSS)
- [CVE-2022-27968](https://cve.now/CVE-2022-27968.md): Cynet 360 Web Portal before v4.5 was discovered to allow attackers to access a list of monitored files and profiles via a crafted GET reques (no CVSS)
- [CVE-2022-27967](https://cve.now/CVE-2022-27967.md): Cynet 360 Web Portal before v4.5 was discovered to allow attackers to access a list of excluded files and profiles via a crafted GET request (no CVSS)
- [CVE-2022-37857](https://cve.now/CVE-2022-37857.md): bilde2910 Hauk v1.6.1 requires a hardcoded password which by default is blank. (no CVSS)
- [CVE-2022-37164](https://cve.now/CVE-2022-37164.md): Inoda OnTrack v3.4 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brut (no CVSS)
- [CVE-2022-37163](https://cve.now/CVE-2022-37163.md): Bminusl IHateToBudget v1.5.7 employs a weak password policy which allows attackers to potentially gain unauthorized access to the applicatio (no CVSS)
- [CVE-2022-36090](https://cve.now/CVE-2022-36090.md): org.xwiki.platform:xwiki-platform-oldcore Improper Authorization check for inactive users (CVSS 8.1, xwiki-platform · org.xwiki.platform:xwiki-platform-oldcore)
- [CVE-2022-36085](https://cve.now/CVE-2022-36085.md): OPA Compiler: Bypass of WithUnsafeBuiltins using \`with\` keyword to mock functions (CVSS 7.4, open-policy-agent opa · github.com/open-policy-agent/opa)
- [CVE-2022-36736](https://cve.now/CVE-2022-36736.md): Jitsi-2.10.5550 was discovered to contain a vulnerability in its web UI which allows attackers to perform a clickjacking attack via a crafte (no CVSS)
- [CVE-2022-20696](https://cve.now/CVE-2022-20696.md): Cisco SD-WAN vManage Software Unauthenticated Access to Messaging Services Vulnerability (CVSS 7.5, Cisco SD-WAN vManage)
- [CVE-2022-20863](https://cve.now/CVE-2022-20863.md): Cisco Webex Meetings App Character Interface Manipulation Vulnerability (CVSS 4.3, Cisco Webex Meetings Desktop App)
- [CVE-2022-20923](https://cve.now/CVE-2022-20923.md): Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers IPSec VPN Server Authentication Bypass Vulnerability (CVSS 4.0, Cisco Small Business RV Series Router Firmware)
- [CVE-2022-30079](https://cve.now/CVE-2022-30079.md): Command injection vulnerability was discovered in Netgear R6200 v2 firmware through R6200v2-V1.0.3.12 via binary /sbin/acos\_service that cou (no CVSS)
- [CVE-2022-27593](https://cve.now/CVE-2022-27593.md): DeadBolt Ransomware (CVSS 10.0, KEV, QNAP Systems Photo Station)
- [CVE-2022-3138](https://cve.now/CVE-2022-3138.md): Cross-site Scripting (XSS) - Generic in jgraph/drawio (CVSS 4.3, jgraph/drawio)
- [CVE-2022-3148](https://cve.now/CVE-2022-3148.md): Cross-site Scripting (XSS) - Generic in jgraph/drawio (CVSS 5.3, jgraph/drawio)
- [CVE-2022-28220](https://cve.now/CVE-2022-28220.md): STARTTLS command injection in Apache JAMES (no CVSS, Apache Software Foundation Apache James · org.apache.james:…)
- [CVE-2022-38400](https://cve.now/CVE-2022-38400.md): Mailform Pro CGI 4.3.1 and earlier allow a remote unauthenticated attacker to obtain the user input data by having a use of the product to a (no CVSS, SYNCK GRAPHICA Mailform Pro CGI)
- [CVE-2022-38394](https://cve.now/CVE-2022-38394.md): Use of hard-coded credentials for the telnet server of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote unauthentica (no CVSS, Allied Telesis K.K. CentreCOM AR260S)
- [CVE-2022-38399](https://cve.now/CVE-2022-38399.md): Missing protection mechanism for alternate hardware interface in SmaCam CS-QR10 all versions and SmaCam Night Vision CS-QR20 all versions al (no CVSS, PLANEX COMMUNICATIONS SmaCam CS-QR10 and SmaCam Night Visio…)
- [CVE-2022-38094](https://cve.now/CVE-2022-38094.md): OS command injection vulnerability in the telnet function of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote authen (no CVSS, Allied Telesis K.K. CentreCOM AR260S)
- [CVE-2022-36403](https://cve.now/CVE-2022-36403.md): Untrusted search path vulnerability in the installer of Device Software Manager prior to Ver.2.20.3.0 allows an attacker to gain privileges (no CVSS, RICOH COMPANY Installer of Device Software Manager)
- [CVE-2022-35273](https://cve.now/CVE-2022-35273.md): OS command injection vulnerability in GUI setting page of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote authentic (no CVSS, Allied Telesis K.K. CentreCOM AR260S)
- [CVE-2022-34869](https://cve.now/CVE-2022-34869.md): Undocumented hidden command that can be executed from the telnet function of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows (no CVSS, Allied Telesis K.K. CentreCOM AR260S)
- [CVE-2022-33941](https://cve.now/CVE-2022-33941.md): PowerCMS XMLRPC API provided by Alfasado Inc. (no CVSS, Alfasado PowerCMS XMLRPC API)
- [CVE-2022-25914](https://cve.now/CVE-2022-25914.md): Remote Code Execution (RCE) (CVSS 5.6, com.google.cloud.tools:jib-core)
- [CVE-2022-25897](https://cve.now/CVE-2022-25897.md): Denial of Service (DoS) (CVSS 5.9, org.eclipse.milo:sdk-server)
- [CVE-2022-37146](https://cve.now/CVE-2022-37146.md): The PlexTrac platform prior to version 1.28.0 allows for username enumeration via HTTP response times on invalid login attempts for users co (no CVSS)
- [CVE-2022-37145](https://cve.now/CVE-2022-37145.md): The PlexTrac platform prior to version 1.17.0 does not restrict excessive authentication attempts for accounts configured to use the PlexTra (no CVSS)
- [CVE-2022-37144](https://cve.now/CVE-2022-37144.md): The PlexTrac platform prior to API version 1.17.0 does not restrict excessive MFA TOTP submission attempts. (no CVSS)
- [CVE-2022-3153](https://cve.now/CVE-2022-3153.md): NULL Pointer Dereference in vim/vim (CVSS 6.1, vim/vim)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-09-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.