CVEs published September 12, 2022
49 CVEs were published on September 12, 2022: 1 critical, 6 high.
- Published
- 49
- Critical
- 1
- High
- 6
- Medium
- 3
- Low
- 6
- Unrated
- 33
- Now in CISA KEV
- 0
- Fix available
- 14
Most affected products
- Dell CPG BIOS
- 7
- shopware · shopware/shopware
- 2
- ARK-Web co. A-Form
- 1
- com.graphql-java:graphql-java
- 1
- Dean Oakley Photospace Gallery
- 1
- Forcepoint Data Loss Prevention · Forcepoint One Endpoin… +3
- 1
- gpac/gpac
- 1
- Hitachi Energy MicroSCADA X SYS600
- 1
- io.pebbletemplates:pebble
- 1
- matrix-org dendrite · github.com/matrix-org/dendrite
- 1
Critical 1
High 6
- CVE-2022-39200Signature checks not applied to some retrieved missing eventsmatrix-org dendrite · github.com/matrix-org/dendrite
- CVE-2022-29490A vulnerability exists in the Workplace X WebUI in which an authenticated user is able to execute any MicroSCADA internal scripts irrespective of the authenticated user's role.Hitachi Energy MicroSCADA X SYS600
- CVE-2022-2979Omron CX-ProgrammerOmron CX-Programmer
- CVE-2022-31226Dell BIOS versions contain a Stack-based Buffer Overflow vulnerability.Dell CPG BIOS
- CVE-2022-1700Improper Restriction of XML External Entity Reference ('XXE') vulnerability in the Policy Engine of Forcepoint Data Loss Prevention (DLP), wForcepoint Data Loss Prevention · Forcepoint One Endpoin… +3
- CVE-2022-3178Buffer Over-read in gpac/gpacgpac/gpac
Medium, low and unrated 42
- CVE-2022-38304Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /maintenance/manage_leav
- CVE-2022-38303Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /employees/manage_leave_
- CVE-2022-38302Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /maintenance/manage_depa
- CVE-2022-38297UCMS v1.6.0 contains an authentication bypass vulnerability which is exploited via cookie poisoning.
- CVE-2022-38299An issue in the Elasticsearch plugin of Appsmith v1.7.11 allows attackers to connect disallowed hosts to the AWS/GCP internal metadata endpo
- CVE-2022-38298Appsmith v1.7.11 was discovered to allow attackers to execute an authenticated Server-Side Request Forgery (SSRF) via redirecting incoming r
- CVE-2022-35572On Linksys E5350 WiFi Router with firmware version 1.0.00.037 and lower, (and potentially other vendors/devices due to code reuse), the /Sys
- CVE-2022-36173FreshService macOS Agent < 4.4.0 and FreshServce Linux Agent < 3.4.0 are vulnerable to TLS Man-in-The-Middle via the FreshAgent client and s
- CVE-2022-36174FreshService Windows Agent < 2.11.0 and FreshService macOS Agent < 4.2.0 and FreshService Linux Agent < 3.3.0.
- CVE-2021-44425An issue was discovered in AnyDesk before 6.2.6 and 6.3.x before 6.3.3.
- CVE-2021-44426An issue was discovered in AnyDesk before 6.2.6 and 6.3.x before 6.3.5.
- CVE-2022-38296Cuppa CMS v1.0 was discovered to contain an arbitrary file upload vulnerability via the File Manager.
- CVE-2022-38295Cuppa CMS v1.0 was discovered to contain a cross-site scripting vulnerability at /table_manager/view/cu_user_groups.
- CVE-2022-38292SLiMS Senayan Library Management System v9.4.2 was discovered to contain multiple Server-Side Request Forgeries via the components /bibliogr
- CVE-2022-38291SLiMS Senayan Library Management System v9.4.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Search function.
- CVE-2022-38606Garage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /garage/editcategory.php.
- CVE-2022-38610Garage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /garage/editclient.php.
- CVE-2022-38605Church Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/edit_event.php.
- CVE-2022-36102Acess control list bypassed via crafted specific URLsshopware · shopware/shopware
- CVE-2022-36101Sensitive data in backend customer moduleshopware · shopware/shopware
- CVE-2022-38135WordPress Photospace Gallery plugin <= 2.3.5 - Broken Access Control vulnerabilityDean Oakley Photospace Gallery
- CVE-2022-31225Dell BIOS versions contain an Unchecked Return Value vulnerability.Dell CPG BIOS
- CVE-2022-31224Dell BIOS versions contain an Improper Protection Against Voltage and Clock Glitches vulnerability.Dell CPG BIOS
- CVE-2022-31223Dell BIOS versions contain an Improper Neutralization of Null Byte vulnerability.Dell CPG BIOS
- CVE-2022-31222Dell BIOS versions contain a Missing Release of Resource after Effective Lifetime vulnerability.Dell CPG BIOS
- CVE-2022-31221Dell BIOS versions contain an Information Exposure vulnerability.Dell CPG BIOS
- CVE-2022-31220Dell BIOS versions contain an Unchecked Return Value vulnerability.Dell CPG BIOS
- CVE-2022-37860The web configuration interface of the TP-Link M7350 V3 with firmware version 190531 is affected by a pre-authentication command injection v
- CVE-2022-37734graphql-java before19.0 is vulnerable to Denial of Service.com.graphql-java:graphql-java
- CVE-2022-37835Torguard VPN 4.8, has a vulnerability that allows an attacker to dump sensitive information, such as credentials and information about the s
- CVE-2022-34110An issue in Micro-Star International MSI Feature Navigator v1.0.1808.0901 allows attackers to download arbitrary files regardless of file ty
- CVE-2022-34109An issue in Micro-Star International MSI Feature Navigator v1.0.1808.0901 allows attackers to write arbitrary files to the directory \PromoP
- CVE-2022-34108An issue in the Feature Navigator of Micro-Star International MSI Feature Nagivator v1.0.1808.0901 allows attackers to cause a Denial of Ser
- CVE-2022-36259A SQL injection vulnerability in ConnectionFactory.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL
- CVE-2022-36258A SQL injection vulnerability in CustomerDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL comman
- CVE-2022-36257A SQL injection vulnerability in UserDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands v
- CVE-2022-36256A SQL injection vulnerability in Stocks.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands vi
- CVE-2022-36255A SQL injection vulnerability in SupplierDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL comman
- CVE-2022-36254Multiple persistent cross-site scripting (XSS) vulnerabilities in index.php in tramyardg Hotel Management System 1.0 allow remote attackers
- CVE-2022-38972Cross-site scripting vulnerability in Movable Type plugin A-Form versions prior to 4.1.1 (for Movable Type 7 Series) and versions prior to 3ARK-Web co. A-Form
- CVE-2022-37767Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok.io.pebbletemplates:pebble
- CVE-2022-37797In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received