# CVEs published 2022-09-12

49 CVEs were published on September 12, 2022: 1 critical, 6 high. Days are UTC.

- [CVE-2022-38304](https://cve.now/CVE-2022-38304.md): Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /maintenance/manage\_leav (no CVSS)
- [CVE-2022-38303](https://cve.now/CVE-2022-38303.md): Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /employees/manage\_leave\_ (no CVSS)
- [CVE-2022-38302](https://cve.now/CVE-2022-38302.md): Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /maintenance/manage\_depa (no CVSS)
- [CVE-2022-38297](https://cve.now/CVE-2022-38297.md): UCMS v1.6.0 contains an authentication bypass vulnerability which is exploited via cookie poisoning. (no CVSS)
- [CVE-2022-38299](https://cve.now/CVE-2022-38299.md): An issue in the Elasticsearch plugin of Appsmith v1.7.11 allows attackers to connect disallowed hosts to the AWS/GCP internal metadata endpo (no CVSS)
- [CVE-2022-38298](https://cve.now/CVE-2022-38298.md): Appsmith v1.7.11 was discovered to allow attackers to execute an authenticated Server-Side Request Forgery (SSRF) via redirecting incoming r (no CVSS)
- [CVE-2022-35572](https://cve.now/CVE-2022-35572.md): On Linksys E5350 WiFi Router with firmware version 1.0.00.037 and lower, (and potentially other vendors/devices due to code reuse), the /Sys (no CVSS)
- [CVE-2022-36173](https://cve.now/CVE-2022-36173.md): FreshService macOS Agent \< 4.4.0 and FreshServce Linux Agent \< 3.4.0 are vulnerable to TLS Man-in-The-Middle via the FreshAgent client and s (no CVSS)
- [CVE-2022-36174](https://cve.now/CVE-2022-36174.md): FreshService Windows Agent \< 2.11.0 and FreshService macOS Agent \< 4.2.0 and FreshService Linux Agent \< 3.3.0. (no CVSS)
- [CVE-2021-44425](https://cve.now/CVE-2021-44425.md): An issue was discovered in AnyDesk before 6.2.6 and 6.3.x before 6.3.3. (no CVSS)
- [CVE-2021-44426](https://cve.now/CVE-2021-44426.md): An issue was discovered in AnyDesk before 6.2.6 and 6.3.x before 6.3.5. (no CVSS)
- [CVE-2022-38296](https://cve.now/CVE-2022-38296.md): Cuppa CMS v1.0 was discovered to contain an arbitrary file upload vulnerability via the File Manager. (no CVSS)
- [CVE-2022-38295](https://cve.now/CVE-2022-38295.md): Cuppa CMS v1.0 was discovered to contain a cross-site scripting vulnerability at /table\_manager/view/cu\_user\_groups. (no CVSS)
- [CVE-2022-38292](https://cve.now/CVE-2022-38292.md): SLiMS Senayan Library Management System v9.4.2 was discovered to contain multiple Server-Side Request Forgeries via the components /bibliogr (no CVSS)
- [CVE-2022-38291](https://cve.now/CVE-2022-38291.md): SLiMS Senayan Library Management System v9.4.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Search function. (no CVSS)
- [CVE-2022-39200](https://cve.now/CVE-2022-39200.md): Signature checks not applied to some retrieved missing events (CVSS 7.3, matrix-org dendrite · github.com/matrix-org/dendrite)
- [CVE-2022-38606](https://cve.now/CVE-2022-38606.md): Garage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /garage/editcategory.php. (no CVSS)
- [CVE-2022-38610](https://cve.now/CVE-2022-38610.md): Garage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /garage/editclient.php. (no CVSS)
- [CVE-2022-38605](https://cve.now/CVE-2022-38605.md): Church Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/edit\_event.php. (no CVSS)
- [CVE-2022-36102](https://cve.now/CVE-2022-36102.md): Acess control list bypassed via crafted specific URLs (CVSS 6.3, shopware · shopware/shopware)
- [CVE-2022-36101](https://cve.now/CVE-2022-36101.md): Sensitive data in backend customer module (CVSS 5.4, shopware · shopware/shopware)
- [CVE-2022-29490](https://cve.now/CVE-2022-29490.md): A vulnerability exists in the Workplace X WebUI in which an authenticated user is able to execute any MicroSCADA internal scripts irrespective of the authenticated user's role. (CVSS 8.5, Hitachi Energy MicroSCADA X SYS600)
- [CVE-2022-2979](https://cve.now/CVE-2022-2979.md): Omron CX-Programmer (CVSS 7.8, Omron CX-Programmer)
- [CVE-2022-38135](https://cve.now/CVE-2022-38135.md): WordPress Photospace Gallery plugin \<= 2.3.5 - Broken Access Control vulnerability (CVSS 5.4, Dean Oakley Photospace Gallery)
- [CVE-2022-31226](https://cve.now/CVE-2022-31226.md): Dell BIOS versions contain a Stack-based Buffer Overflow vulnerability. (CVSS 7.1, Dell CPG BIOS)
- [CVE-2022-31225](https://cve.now/CVE-2022-31225.md): Dell BIOS versions contain an Unchecked Return Value vulnerability. (CVSS 3.0, Dell CPG BIOS)
- [CVE-2022-31224](https://cve.now/CVE-2022-31224.md): Dell BIOS versions contain an Improper Protection Against Voltage and Clock Glitches vulnerability. (CVSS 2.0, Dell CPG BIOS)
- [CVE-2022-31223](https://cve.now/CVE-2022-31223.md): Dell BIOS versions contain an Improper Neutralization of Null Byte vulnerability. (CVSS 2.3, Dell CPG BIOS)
- [CVE-2022-31222](https://cve.now/CVE-2022-31222.md): Dell BIOS versions contain a Missing Release of Resource after Effective Lifetime vulnerability. (CVSS 2.3, Dell CPG BIOS)
- [CVE-2022-31221](https://cve.now/CVE-2022-31221.md): Dell BIOS versions contain an Information Exposure vulnerability. (CVSS 2.3, Dell CPG BIOS)
- [CVE-2022-31220](https://cve.now/CVE-2022-31220.md): Dell BIOS versions contain an Unchecked Return Value vulnerability. (CVSS 3.0, Dell CPG BIOS)
- [CVE-2022-1700](https://cve.now/CVE-2022-1700.md): Improper Restriction of XML External Entity Reference ('XXE') vulnerability in the Policy Engine of Forcepoint Data Loss Prevention (DLP), w (CVSS 7.5, Forcepoint Data Loss Prevention · Forcepoint One Endpoin… +3)
- [CVE-2022-37300](https://cve.now/CVE-2022-37300.md): A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists that could cause unauthorized access in read and wri (CVSS 9.8, Schneider Electric EcoStruxure Control Expert · Schneide… +2)
- [CVE-2022-37860](https://cve.now/CVE-2022-37860.md): The web configuration interface of the TP-Link M7350 V3 with firmware version 190531 is affected by a pre-authentication command injection v (no CVSS)
- [CVE-2022-3178](https://cve.now/CVE-2022-3178.md): Buffer Over-read in gpac/gpac (CVSS 7.8, gpac/gpac)
- [CVE-2022-37734](https://cve.now/CVE-2022-37734.md): graphql-java before19.0 is vulnerable to Denial of Service. (no CVSS, com.graphql-java:graphql-java)
- [CVE-2022-37835](https://cve.now/CVE-2022-37835.md): Torguard VPN 4.8, has a vulnerability that allows an attacker to dump sensitive information, such as credentials and information about the s (no CVSS)
- [CVE-2022-34110](https://cve.now/CVE-2022-34110.md): An issue in Micro-Star International MSI Feature Navigator v1.0.1808.0901 allows attackers to download arbitrary files regardless of file ty (no CVSS)
- [CVE-2022-34109](https://cve.now/CVE-2022-34109.md): An issue in Micro-Star International MSI Feature Navigator v1.0.1808.0901 allows attackers to write arbitrary files to the directory \\PromoP (no CVSS)
- [CVE-2022-34108](https://cve.now/CVE-2022-34108.md): An issue in the Feature Navigator of Micro-Star International MSI Feature Nagivator v1.0.1808.0901 allows attackers to cause a Denial of Ser (no CVSS)
- [CVE-2022-36259](https://cve.now/CVE-2022-36259.md): A SQL injection vulnerability in ConnectionFactory.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL (no CVSS)
- [CVE-2022-36258](https://cve.now/CVE-2022-36258.md): A SQL injection vulnerability in CustomerDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL comman (no CVSS)
- [CVE-2022-36257](https://cve.now/CVE-2022-36257.md): A SQL injection vulnerability in UserDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands v (no CVSS)
- [CVE-2022-36256](https://cve.now/CVE-2022-36256.md): A SQL injection vulnerability in Stocks.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands vi (no CVSS)
- [CVE-2022-36255](https://cve.now/CVE-2022-36255.md): A SQL injection vulnerability in SupplierDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL comman (no CVSS)
- [CVE-2022-36254](https://cve.now/CVE-2022-36254.md): Multiple persistent cross-site scripting (XSS) vulnerabilities in index.php in tramyardg Hotel Management System 1.0 allow remote attackers (no CVSS)
- [CVE-2022-38972](https://cve.now/CVE-2022-38972.md): Cross-site scripting vulnerability in Movable Type plugin A-Form versions prior to 4.1.1 (for Movable Type 7 Series) and versions prior to 3 (no CVSS, ARK-Web co. A-Form)
- [CVE-2022-37767](https://cve.now/CVE-2022-37767.md): Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok. (no CVSS, io.pebbletemplates:pebble)
- [CVE-2022-37797](https://cve.now/CVE-2022-37797.md): In lighttpd 1.4.65, mod\_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-09-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.