# CVEs published 2022-09-09

130 CVEs were published on September 9, 2022: 1 critical, 8 high. Days are UTC.

- [CVE-2021-37819](https://cve.now/CVE-2021-37819.md): PDF Labs pdftk-java v3.2.3 was discovered to contain an infinite loop via the component /text/pdf/PdfReader.java. (no CVSS)
- [CVE-2022-40320](https://cve.now/CVE-2022-40320.md): cfg\_tilde\_expand in confuse.c in libConfuse 3.3 has a heap-based buffer over-read. (no CVSS)
- [CVE-2022-38638](https://cve.now/CVE-2022-38638.md): Casdoor v1.97.3 was discovered to contain an arbitrary file write vulnerability via the fullFilePath parameter at /api/upload-resource. (no CVSS, casdoor · github.com/casdoor/casdoor)
- [CVE-2022-36110](https://cve.now/CVE-2022-36110.md): Netmaker vulnerable to Insufficient Granularity of Access Control (CVSS 8.8, gravitl netmaker · github.com/gravitl/netmaker)
- [CVE-2022-31006](https://cve.now/CVE-2022-31006.md): Hyperledger Indy DOS vulnerability (CVSS 7.5, hyperledger indy-node · indy-node)
- [CVE-2022-38639](https://cve.now/CVE-2022-38639.md): A cross-site scripting (XSS) vulnerability in Markdown-Nice v1.8.22 allows attackers to execute arbitrary web scripts or HTML via a crafted (no CVSS, markdown-nice)
- [CVE-2021-44835](https://cve.now/CVE-2021-44835.md): An issue was discovered in Active Intelligent Visualization 5. (no CVSS)
- [CVE-2021-40648](https://cve.now/CVE-2021-40648.md): In man2html 1.6g, a filename can be created to overwrite the previous size parameter of the next chunk and the fd, bk, fd\_nextsize, bk\_nexts (no CVSS)
- [CVE-2021-40647](https://cve.now/CVE-2021-40647.md): In man2html 1.6g, a specific string being read in from a file will overwrite the size parameter in the top chunk of the heap. (no CVSS)
- [CVE-2022-3133](https://cve.now/CVE-2022-3133.md): OS Command Injection in jgraph/drawio (CVSS 7.0, jgraph/drawio)
- [CVE-2022-36109](https://cve.now/CVE-2022-36109.md): Moby vulnerability relating to supplementary group permissions (CVSS 5.3, moby · github.com/docker/docker)
- [CVE-2022-40317](https://cve.now/CVE-2022-40317.md): OpenKM 6.3.11 allows stored XSS related to the javascript: substring in an A element. (no CVSS)
- [CVE-2022-39810](https://cve.now/CVE-2022-39810.md): An issue was discovered in WSO2 Enterprise Integrator 6.4.0. (no CVSS)
- [CVE-2022-39809](https://cve.now/CVE-2022-39809.md): An issue was discovered in WSO2 Enterprise Integrator 6.4.0. (no CVSS)
- [CVE-2022-38614](https://cve.now/CVE-2022-38614.md): An issue in the IGB Files and OutfileService features of SmartVista Cardgen v3.28.0 allows attackers to list and download arbitrary files vi (no CVSS)
- [CVE-2022-38615](https://cve.now/CVE-2022-38615.md): SmartVista SVFE2 v2.2.22 was discovered to contain multiple SQL injection vulnerabilities via the UserForm:j\_id88, UserForm:j\_id90, and User (no CVSS)
- [CVE-2022-34165](https://cve.now/CVE-2022-34165.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.9 are vulnerabl (CVSS 5.4, IBM WebSphere Application Server)
- [CVE-2022-28740](https://cve.now/CVE-2022-28740.md): aEnrich eHRD Learning Management Key Performance Indicator System 5+ exposes Sensitive Information to an Unauthorized Actor. (no CVSS)
- [CVE-2022-28742](https://cve.now/CVE-2022-28742.md): aEnrich eHRD Learning Management Key Performance Indicator System 5+ has Improper Access Control. (no CVSS)
- [CVE-2022-28741](https://cve.now/CVE-2022-28741.md): aEnrich a+HRD 5.x Learning Management Key Performance Indicator System has a local file inclusion (LFI) vulnerability that occurs due to mis (no CVSS)
- [CVE-2022-38613](https://cve.now/CVE-2022-38613.md): A Path Traversal vulnerability in SmartVista Cardgen v3.28.0 allows authenticated attackers to read arbitrary files in the system. (no CVSS)
- [CVE-2022-36617](https://cve.now/CVE-2022-36617.md): Arq Backup 7.19.5.0 and below stores backup encryption passwords using reversible encryption. (no CVSS)
- [CVE-2022-37335](https://cve.now/CVE-2022-37335.md): WordPress Word Search Puzzles game plugin \<= 2.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, WHA Word Search Puzzles game)
- [CVE-2022-37407](https://cve.now/CVE-2022-37407.md): WordPress Gallery PhotoBlocks plugin \<= 1.2.6 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities (CVSS 4.1, WPChill Gallery PhotoBlocks)
- [CVE-2022-26393](https://cve.now/CVE-2022-26393.md): Format String vulnerability (CVSS 5.0, Baxter Spectrum Wireless Battery Module)
- [CVE-2022-26390](https://cve.now/CVE-2022-26390.md): Unencrypted internal storage of security credentials (CVSS 4.2, Baxter Spectrum Wireless Battery Module)
- [CVE-2022-26392](https://cve.now/CVE-2022-26392.md): Format String vulnerability (CVSS 3.1, Baxter Spectrum Wireless Battery Module)
- [CVE-2022-26394](https://cve.now/CVE-2022-26394.md): Unauthenticated network reconfiguration via TCP/UDP (CVSS 5.5, Baxter Spectrum Wireless Battery Module)
- [CVE-2022-36851](https://cve.now/CVE-2022-36851.md): Improper access control vulnerability in Samsung pass prior to version 4.0.03.1 allow physical attackers to access data of Samsung pass on a (CVSS 3.9, Samsung Mobile Samsung pass)
- [CVE-2022-36855](https://cve.now/CVE-2022-36855.md): A use after free vulnerability in iva\_ctl driver prior to SMR Sep-2022 Release 1 allows attacker to cause memory access fault. (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2022-36864](https://cve.now/CVE-2022-36864.md): Improper access control and intent redirection in Samsung Email prior to 6.1.70.20 allows attacker to access specific formatted file and exe (CVSS 4.0, Samsung Mobile Samsung Email)
- [CVE-2022-36869](https://cve.now/CVE-2022-36869.md): Improper access control vulnerability in ContactsDumpActivity of?Contacts Provider prior to version 12.7.59 allows attacker to access the fi (CVSS 6.6, Samsung Mobile com.android.providers.contacts)
- [CVE-2022-36850](https://cve.now/CVE-2022-36850.md): Path traversal vulnerability in CallBGProvider prior to SMR Sep-2022 Release 1 allows attacker to overwrite arbitrary file with phone uid. (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2022-36857](https://cve.now/CVE-2022-36857.md): Improper Authorization vulnerability in Photo Editor prior to SMR Sep-2022 Release 1 allows physical attackers to read internal application (CVSS 1.9, Samsung Mobile Devices)
- [CVE-2022-36865](https://cve.now/CVE-2022-36865.md): Improper access control in Group Sharing prior to versions 13.0.6.15 in Android S(12), 13.0.6.14 in Android R(11) and below allows attackers (CVSS 4.0, Samsung Mobile Group Sharing)
- [CVE-2022-36866](https://cve.now/CVE-2022-36866.md): Improper access control vulnerability in Broadcaster in Group Sharing prior to versions 13.0.6.15 in Android S(12), 13.0.6.14 in Android R(1 (CVSS 4.0, Samsung Mobile Group Sharing)
- [CVE-2022-36867](https://cve.now/CVE-2022-36867.md): Improper access control vulnerability in Editor Lite prior to version 4.0.40.14 allows attackers to access sensitive information. (CVSS 5.9, Samsung Mobile Editor Lite)
- [CVE-2022-36852](https://cve.now/CVE-2022-36852.md): Improper Authorization vulnerability in Video Editor prior to SMR Sep-2022 Release 1 allows local attacker to access internal application da (CVSS 1.9, Samsung Mobile Devices)
- [CVE-2022-36853](https://cve.now/CVE-2022-36853.md): Intent redirection in Photo Editor prior to SMR Sep-2022 Release 1 allows attacker to get sensitive information. (CVSS 3.3, Samsung Mobile Devices)
- [CVE-2022-36856](https://cve.now/CVE-2022-36856.md): Improper access control vulnerability in Telecom application prior to SMR Sep-2022 Release 1 allows attacker to start emergency calls via un (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2022-36861](https://cve.now/CVE-2022-36861.md): Custom permission misuse vulnerability in SystemUI prior to SMR Sep-2022 Release 1 allows attacker to use some protected functions with Syst (CVSS 5.9, Samsung Mobile Devices)
- [CVE-2022-36848](https://cve.now/CVE-2022-36848.md): Improper Authorization vulnerability in setDualDARPolicyCmd prior to SMR Sep-2022 Release 1 allows local attackers to cause local permanent (CVSS 5.1, Samsung Mobile Devices)
- [CVE-2022-36872](https://cve.now/CVE-2022-36872.md): Pending Intent hijacking vulnerability in SpayNotification in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attack (CVSS 5.0, Samsung Mobile Samsung Pay)
- [CVE-2022-36870](https://cve.now/CVE-2022-36870.md): Pending Intent hijacking vulnerability in MTransferNotificationManager in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global a (CVSS 5.0, Samsung Mobile Samsung Pay)
- [CVE-2022-36871](https://cve.now/CVE-2022-36871.md): Pending Intent hijacking vulnerability in NotiCenterUtils in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attacke (CVSS 5.0, Samsung Mobile Samsung Pay)
- [CVE-2022-36873](https://cve.now/CVE-2022-36873.md): Improper restriction of broadcasting Intent in GalaxyStoreBridgePageLinker of?Waterplugin prior to version 2.2.11.22081151 leaks MAC address (CVSS 5.9, Samsung Mobile com.samsung.android.waterplugin)
- [CVE-2022-36854](https://cve.now/CVE-2022-36854.md): Out of bound read in libapexjni.media.samsung.so prior to SMR Sep-2022 Release 1 allows attacker access unauthorized information. (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2022-36858](https://cve.now/CVE-2022-36858.md): A heap-based overflow vulnerability in GetCorrectDbLanguageTypeEsPKc() function in libSDKRecognitionText.spensdk.samsung.so library prior to (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2022-36874](https://cve.now/CVE-2022-36874.md): Improper Handling of Insufficient Permissions or Privileges vulnerability in Waterplugin prior to 2.2.11.22040751 allows attacker to access (CVSS 5.9, Samsung Mobile Waterplugin)
- [CVE-2022-36875](https://cve.now/CVE-2022-36875.md): Improper restriction of broadcasting Intent in SaWebViewRelayActivity of?Waterplugin prior to version 2.2.11.22081151 allows attacker to acc (CVSS 6.6, Samsung Mobile com.samsung.android.waterplugin)
- [CVE-2022-36842](https://cve.now/CVE-2022-36842.md): A heap-based overflow vulnerability in prepareRecogLibrary function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-202 (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2022-36843](https://cve.now/CVE-2022-36843.md): A heap-based overflow vulnerability in MHW\_RECOG\_LIB\_INFO function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2022-36844](https://cve.now/CVE-2022-36844.md): A heap-based overflow vulnerability in HWR::EngJudgeModel::Construct() in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep- (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2022-36846](https://cve.now/CVE-2022-36846.md): A heap-based overflow vulnerability in ConstructDictionary function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-202 (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2022-36860](https://cve.now/CVE-2022-36860.md): A heap-based overflow vulnerability in LoadEnvironment function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 Re (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2022-36862](https://cve.now/CVE-2022-36862.md): A heap-based overflow vulnerability in HWR::EngineCJK::Impl::Construct() in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Se (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2022-36863](https://cve.now/CVE-2022-36863.md): A heap-based overflow vulnerability in GetCorrectDbLanguageTypeEsPKc function in libSDKRecognitionText.spensdk.samsung.so library prior to S (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2022-36841](https://cve.now/CVE-2022-36841.md): A heap-based overflow vulnerability in PrepareRecogLibrary\_Part function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Se (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2022-36845](https://cve.now/CVE-2022-36845.md): A heap-based overflow vulnerability in MHW\_RECOG\_LIB\_INFO function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2022-36847](https://cve.now/CVE-2022-36847.md): Use after free vulnerability in mtp\_send\_signal function of MTP driver prior to SMR Sep-2022 Release 1 allows attackers to perform malicious (CVSS 4.9, Samsung Mobile Devices)
- [CVE-2022-36849](https://cve.now/CVE-2022-36849.md): Use after free vulnerability in sdp\_mm\_set\_process\_sensitive function of sdpmm driver prior to SMR Sep-2022 Release 1 allows attackers to pe (CVSS 4.9, Samsung Mobile Devices)
- [CVE-2022-36859](https://cve.now/CVE-2022-36859.md): Improper input validation vulnerability in SmartTagPlugin prior to version 1.2.21-6 allows privileged attackers to trigger a XSS on a victim (CVSS 5.7, Samsung Mobile SmartTagPlugin)
- [CVE-2022-36876](https://cve.now/CVE-2022-36876.md): Improper authorization in UPI payment in Samsung Pass prior to version 4.0.04.10 allows physical attackers to access account list without au (CVSS 1.8, Samsung Mobile Samsung Pass)
- [CVE-2022-38701](https://cve.now/CVE-2022-38701.md): IPC in communication subsystem has a heap overflow vulnerability. Local attackers can trigger a heap overflow and get network sensitive information. (CVSS 6.2, OpenHarmony)
- [CVE-2022-36877](https://cve.now/CVE-2022-36877.md): Exposure of Sensitive Information in FaqSymptomCardViewModel in Samsung Members prior to versions 4.3.00.11 in Global and 14.0.02.4 in China (CVSS 2.8, Samsung Mobile Samsung Members)
- [CVE-2022-36878](https://cve.now/CVE-2022-36878.md): Exposure of Sensitive Information in Find My Mobile prior to version 7.2.25.14 allows local attacker to access IMEI via log. (CVSS 3.3, Samsung Mobile Find My Mobile)
- [CVE-2022-39844](https://cve.now/CVE-2022-39844.md): Improper validation of integrity check vulnerability in Smart Switch PC prior to version 4.3.22083 allows local attackers to delete arbitrar (CVSS 5.5, Samsung Mobile Smart Switch PC)
- [CVE-2022-39845](https://cve.now/CVE-2022-39845.md): Improper validation of integrity check vulnerability in Samsung Kies prior to version 2.6.4.22074 allows local attackers to delete arbitrary (CVSS 5.5, Samsung Mobile Samsung Kies)
- [CVE-2022-39846](https://cve.now/CVE-2022-39846.md): DLL hijacking vulnerability in Smart Switch PC prior to version 4.3.22083\_3 allows attacker to execute arbitrary code. (CVSS 6.2, Samsung Mobile Smart Switch PC)
- [CVE-2022-38081](https://cve.now/CVE-2022-38081.md): Tokensync in security subsystem has a permission bypass vulnerability. LAN attackers can bypass the distributed permission control.To take advantage of this weakness, attackers need another vulnerability to obtain system. (CVSS 6.2, OpenHarmony)
- [CVE-2022-38700](https://cve.now/CVE-2022-38700.md): multimedia subsystem has a permission bypass vulnerability. LAN attackers can bypass permission control and get control of camera service. (CVSS 8.8, OpenHarmony)
- [CVE-2022-38064](https://cve.now/CVE-2022-38064.md): windowmanager in window subsystem has a permission bypass vulnerability. Local attackers can bypass permission control and get sensitive information. (CVSS 6.2, OpenHarmony)
- [CVE-2022-36423](https://cve.now/CVE-2022-36423.md): Incorrect configuration of the cJSON library lead a Stack overflow vulnerability during recursive parsing. LAN attackers can lead a DoS attack to all network devices. (CVSS 7.4, OpenHarmony)
- [CVE-2022-35275](https://cve.now/CVE-2022-35275.md): WordPress Advanced Order Export For WooCommerce plugin \<= 3.3.1 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, AlgolPlus Advanced Order Export For WooCommerce)
- [CVE-2022-37411](https://cve.now/CVE-2022-37411.md): WordPress Captcha Code plugin \<= 2.7 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Vinoj Cardoza Captcha Code)
- [CVE-2022-35277](https://cve.now/CVE-2022-35277.md): WordPress GetResponse plugin \<= 5.5.20 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 5.4, GetResponse for WordPress)
- [CVE-2022-38067](https://cve.now/CVE-2022-38067.md): WordPress Event Calendar – Calendar plugin \<= 1.4.6 - Unauthenticated Event Deletion vulnerability (CVSS 6.5, Totalsoft Event Calendar – Calendar)
- [CVE-2022-37412](https://cve.now/CVE-2022-37412.md): WordPress Better Delete Revision plugin \<= 1.6.1 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, Galerio & Urda Better Delete Revision)
- [CVE-2022-36793](https://cve.now/CVE-2022-36793.md): WordPress WP Shop plugin \<= 3.9.6 - Unauthenticated Plugin Settings Change & Data Deletion vulnerabilities (CVSS 6.5, wp-shop.ru WP Shop)
- [CVE-2022-37404](https://cve.now/CVE-2022-37404.md): WordPress add2fav plugin \<= 1.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, Christian Salazar add2fav)
- [CVE-2022-37403](https://cve.now/CVE-2022-37403.md): WordPress Add User Role plugin \<= 0.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, Nikhil Vaghela Add User Role)
- [CVE-2022-37405](https://cve.now/CVE-2022-37405.md): WordPress Better Font Awesome plugin \<= 2.0.1 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Mickey Kay Better Font Awesome)
- [CVE-2022-3077](https://cve.now/CVE-2022-3077.md): A buffer overflow vulnerability was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way it handled the I2C\_SMBUS\_ (no CVSS, kernel)
- [CVE-2022-38058](https://cve.now/CVE-2022-38058.md): WordPress WP Shamsi plugin \<= 4.1.1 - Authenticated Plugin Setting change vulnerability (CVSS 4.3, wpvar.com WP Shamsi)
- [CVE-2022-38093](https://cve.now/CVE-2022-38093.md): WordPress All in One SEO plugin \<= 4.2.3.1 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities (CVSS 5.4, All in One SEO Team All in One SEO)
- [CVE-2022-38144](https://cve.now/CVE-2022-38144.md): WordPress wpForo Forum plugin \<= 2.0.5 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 8.8, gVectors Team wpForo Forum)
- [CVE-2022-40191](https://cve.now/CVE-2022-40191.md): WordPress Contact Form By Mega Forms plugin \<= 1.2.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 5.4, Ali Khallad Contact Form By Mega Forms)
- [CVE-2022-36356](https://cve.now/CVE-2022-36356.md): WordPress Culture Object plugin \<= 4.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, Liam Gladdy / Thirty8 Digital Culture Object)
- [CVE-2022-36376](https://cve.now/CVE-2022-36376.md): WordPress Rank Math SEO plugin \<= 1.0.95 - Server-Side Request Forgery (SSRF) vulnerability (CVSS 6.8, Rank Math SEO · rankmath/seo-by-rank-math)
- [CVE-2022-36422](https://cve.now/CVE-2022-36422.md): WP-PostRatings plugin \<= 1.89 - Rating increase/decrease via race condition (CVSS 4.3, Lester 'GaMerZ' Chan WP-PostRatings)
- [CVE-2022-35725](https://cve.now/CVE-2022-35725.md): WordPress wp-forecast plugin \<= 7.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, Hans Matzen wp-forecast)
- [CVE-2022-38070](https://cve.now/CVE-2022-38070.md): WordPress Pop-up plugin \<= 1.1.5 - Privilege Escalation vulnerability (CVSS 5.4, Pop-ups Pop-up)
- [CVE-2022-38068](https://cve.now/CVE-2022-38068.md): WordPress Export Post Info plugin \<= 1.1.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, Apasionados Export Post Info)
- [CVE-2022-40133](https://cve.now/CVE-2022-40133.md): There is an UAF vulnerability in vmwgfx driver (CVSS 6.3, Linux kernel)
- [CVE-2022-38457](https://cve.now/CVE-2022-38457.md): There is an UAF vulnerability in vmwgfx driver (CVSS 6.3, Linux kernel)
- [CVE-2022-38096](https://cve.now/CVE-2022-38096.md): There is a NULL pointer vulnerability in vmwgfx driver (CVSS 6.3, Linux kernel)
- [CVE-2022-3147](https://cve.now/CVE-2022-3147.md): Server-side Denial of Service while processing a specifically crafted JPEG file (CVSS 3.1, Mattermost)
- [CVE-2022-36280](https://cve.now/CVE-2022-36280.md): There is an out-of-bounds write vulnerability in vmwgfx driver (CVSS 6.3, Linux kernel)
- [CVE-2022-38059](https://cve.now/CVE-2022-38059.md): WordPress Access Code Feeder plugin \<= 1.0.3 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 5.5, Alexey Trofimov Access Code Feeder)
- [CVE-2022-39119](https://cve.now/CVE-2022-39119.md): In network service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-37299](https://cve.now/CVE-2022-37299.md): An issue was discovered in Shirne CMS 1.2.0. (no CVSS)
- [CVE-2022-38274](https://cve.now/CVE-2022-38274.md): JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/comment/list. (no CVSS)
- [CVE-2022-38273](https://cve.now/CVE-2022-38273.md): JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list\_approve. (no CVSS)
- [CVE-2022-38272](https://cve.now/CVE-2022-38272.md): JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list. (no CVSS)
- [CVE-2022-38275](https://cve.now/CVE-2022-38275.md): JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/contact/list. (no CVSS)
- [CVE-2022-38276](https://cve.now/CVE-2022-38276.md): JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/foldernotice/list. (no CVSS)
- [CVE-2022-38277](https://cve.now/CVE-2022-38277.md): JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/folderrollpicture/list. (no CVSS)
- [CVE-2022-38278](https://cve.now/CVE-2022-38278.md): JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/friendlylink/list. (no CVSS)
- [CVE-2022-38279](https://cve.now/CVE-2022-38279.md): JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/imagealbum/list. (no CVSS)
- [CVE-2022-38280](https://cve.now/CVE-2022-38280.md): JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/image/list. (no CVSS)
- [CVE-2022-38281](https://cve.now/CVE-2022-38281.md): JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/site/list. (no CVSS)
- [CVE-2022-38282](https://cve.now/CVE-2022-38282.md): JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/videoalbum/list. (no CVSS)
- [CVE-2022-38283](https://cve.now/CVE-2022-38283.md): JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/video/list. (no CVSS)
- [CVE-2022-38284](https://cve.now/CVE-2022-38284.md): JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/department/list. (no CVSS)
- [CVE-2022-38285](https://cve.now/CVE-2022-38285.md): JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/menu/list. (no CVSS)
- [CVE-2022-38286](https://cve.now/CVE-2022-38286.md): JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/role/list. (no CVSS)
- [CVE-2022-2528](https://cve.now/CVE-2022-2528.md): In affected versions of Octopus Deploy it is possible to upload a package to built-in feed with insufficient permissions after re-indexing p (no CVSS, Octopus Deploy Octopus Server)
- [CVE-2022-29061](https://cve.now/CVE-2022-29061.md): An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability \[CWE-78\] in Fortinet FortiSOAR b (CVSS 7.2, Fortinet FortiSOAR)
- [CVE-2022-2925](https://cve.now/CVE-2022-2925.md): Cross-site Scripting (XSS) - Stored in appwrite/appwrite (CVSS 9.0, appwrite/appwrite · appwrite/server-ce)
- [CVE-2022-25765](https://cve.now/CVE-2022-25765.md): Command Injection (CVSS 7.3, pdfkit)
- [CVE-2022-40305](https://cve.now/CVE-2022-40305.md): A Server-Side Request Forgery issue in Canto Cumulus through 11.1.3 allows attackers to enumerate the internal network, overload network res (no CVSS)
- [CVE-2022-40299](https://cve.now/CVE-2022-40299.md): In Singular before 4.3.1, a predictable /tmp pathname is used (e.g., by sdb.cc), which allows local users to gain the privileges of other us (no CVSS)
- [CVE-2020-10735](https://cve.now/CVE-2020-10735.md): A flaw was found in python. (CVSS 6.2, python · libpython +1)
- [CVE-2022-2526](https://cve.now/CVE-2022-2526.md): A use-after-free vulnerability was found in systemd. (no CVSS, systemd-resolved)
- [CVE-2022-2905](https://cve.now/CVE-2022-2905.md): An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the bpf\_tail\_call function with a key la (no CVSS, kernel)
- [CVE-2022-2964](https://cve.now/CVE-2022-2964.md): A flaw was found in the Linux kernel’s driver for the ASIX AX88179\_178A-based USB 2.0/3.0 Gigabit Ethernet Devices. (no CVSS, kernel)
- [CVE-2022-3169](https://cve.now/CVE-2022-3169.md): A flaw was found in the Linux kernel. (no CVSS, Kernel)
- [CVE-2022-36087](https://cve.now/CVE-2022-36087.md): OAuthLib vulnerable DoS when attacker provides malicious IPV6 URI (CVSS 5.7, oauthlib)
- [CVE-2022-38266](https://cve.now/CVE-2022-38266.md): An issue in the Leptonica linked library (v1.79.0) allows attackers to cause an arithmetic exception leading to a Denial of Service (DoS) vi (no CVSS)
- [CVE-2022-40307](https://cve.now/CVE-2022-40307.md): An issue was discovered in the Linux kernel through 5.19.8. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-09-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.