# CVEs published 2022-09-13

201 CVEs were published on September 13, 2022: 7 critical, 68 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2022-38305](https://cve.now/CVE-2022-38305.md): AeroCMS v0.0.1 was discovered to contain an arbitrary file upload vulnerability via the component /admin/profile.php. (no CVSS)
- [CVE-2022-38771](https://cve.now/CVE-2022-38771.md): The mobile application in Transtek Mojodat FAM (Fixed Asset Management) 2.4.6 allows remote attackers to send SCRIPT tags as injected input (no CVSS)
- [CVE-2022-38770](https://cve.now/CVE-2022-38770.md): The mobile application in Transtek Mojodat FAM (Fixed Asset Management) 2.4.6 allows remote attackers to fetch other users' data upon a succ (no CVSS)
- [CVE-2022-38769](https://cve.now/CVE-2022-38769.md): The mobile application in Transtek Mojodat FAM (Fixed Asset Management) 2.4.6 allows remote attackers to fetch cleartext passwords upon a su (no CVSS)
- [CVE-2022-38768](https://cve.now/CVE-2022-38768.md): The mobile application in Transtek Mojodat FAM (Fixed Asset Management) 2.4.6 allows remote attackers to bypass authorization. (no CVSS)
- [CVE-2022-37191](https://cve.now/CVE-2022-37191.md): The component "cuppa/api/index.php" of CuppaCMS v1.0 is Vulnerable to LFI. (no CVSS)
- [CVE-2022-37190](https://cve.now/CVE-2022-37190.md): CuppaCMS 1.0 is vulnerable to Remote Code Execution (RCE). (no CVSS)
- [CVE-2022-31322](https://cve.now/CVE-2022-31322.md): Penta Security Systems Inc WAPPLES v6.0 r3 4.10-hotfix1 allows attackers to escalate privileges via overwriting files using SUID flagged exe (no CVSS)
- [CVE-2022-31324](https://cve.now/CVE-2022-31324.md): An arbitrary file download vulnerability in the downloadAction() function of Penta Security Systems Inc WAPPLES v6.0 r3 4.10-hotfix1 allows (no CVSS)
- [CVE-2022-35413](https://cve.now/CVE-2022-35413.md): WAPPLES through 6.0 has a hardcoded systemi account. (no CVSS)
- [CVE-2022-35582](https://cve.now/CVE-2022-35582.md): Penta Security Systems Inc WAPPLES 4.0.\*, 5.0.0.\*, 5.0.12.\* are vulnerable to Incorrect Access Control. (no CVSS)
- [CVE-2022-31861](https://cve.now/CVE-2022-31861.md): Cross site Scripting (XSS) in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being sent to the audit logs. (no CVSS)
- [CVE-2022-34101](https://cve.now/CVE-2022-34101.md): A vulnerability was discovered in the Crestron AirMedia Windows Application, version 4.3.1.39, in which a user can place a malicious DLL in (no CVSS)
- [CVE-2022-34102](https://cve.now/CVE-2022-34102.md): Insufficient access control vulnerability was discovered in the Crestron AirMedia Windows Application, version 4.3.1.39, in which a user can (no CVSS)
- [CVE-2022-38633](https://cve.now/CVE-2022-38633.md): Genymotion Desktop v3.2.1 was discovered to contain a DLL hijacking vulnerability which allows attackers to escalate privileges and execute (no CVSS)
- [CVE-2021-36568](https://cve.now/CVE-2021-36568.md): In certain Moodle products after creating a course, it is possible to add in a arbitrary "Topic" a resource, in this case a "Database" with (no CVSS, moodle/moodle)
- [CVE-2022-36768](https://cve.now/CVE-2022-36768.md): IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout command to obtain roo (CVSS 8.4, IBM AIX · IBM VIOS)
- [CVE-2022-35637](https://cve.now/CVE-2022-35637.md): IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a denial of service after entering a malformed SQL stat (CVSS 6.5, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2022-34356](https://cve.now/CVE-2022-34356.md): IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to obtain root priv (CVSS 8.4, IBM VIOS · IBM AIX)
- [CVE-2022-34336](https://cve.now/CVE-2022-34336.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. (CVSS 5.4, IBM WebSphere Application Server)
- [CVE-2022-22483](https://cve.now/CVE-2022-22483.md): IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to an information disclosure in some scenarios due to unau (CVSS 6.5, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2022-22330](https://cve.now/CVE-2022-22330.md): IBM Control Desk 7.6.1 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. (CVSS 3.7, IBM Control Desk)
- [CVE-2022-22329](https://cve.now/CVE-2022-22329.md): IBM Control Desk 7.6.1 does not set the secure attribute on authorization tokens or session cookies. (CVSS 4.3, IBM Control Desk)
- [CVE-2022-39814](https://cve.now/CVE-2022-39814.md): In NOKIA 1350 OMS R14.2, an Open Redirect vulnerability occurs is the login page via next HTTP GET parameter. (no CVSS)
- [CVE-2022-39815](https://cve.now/CVE-2022-39815.md): In NOKIA 1350 OMS R14.2, multiple OS Command Injection vulnerabilities occurs. (no CVSS)
- [CVE-2022-39816](https://cve.now/CVE-2022-39816.md): In NOKIA 1350 OMS R14.2, Insufficiently Protected Credentials (cleartext administrator password) occur in the edit configuration page. (no CVSS)
- [CVE-2022-39817](https://cve.now/CVE-2022-39817.md): In NOKIA 1350 OMS R14.2, multiple SQL Injection vulnerabilities occurs. (no CVSS)
- [CVE-2022-39819](https://cve.now/CVE-2022-39819.md): In NOKIA 1350 OMS R14.2, multiple OS Command Injection vulnerabilities occurs. (no CVSS)
- [CVE-2022-38637](https://cve.now/CVE-2022-38637.md): Hospital Management System v1.0 was discovered to contain multiple SQL injection vulnerabilities via the Username and Password parameters on (no CVSS)
- [CVE-2022-39821](https://cve.now/CVE-2022-39821.md): In NOKIA 1350 OMS R14.2, an Insertion of Sensitive Information into an Application Log File vulnerability occurs. (no CVSS)
- [CVE-2022-40623](https://cve.now/CVE-2022-40623.md): WAVLINK Quantum D4G (WN531G3) CSRF (no CVSS, WAVLINK WN531G3)
- [CVE-2022-40622](https://cve.now/CVE-2022-40622.md): WAVLINK Quantum D4G (WN531G3) Session Management by IP Address (no CVSS, WAVLINK WN531G3)
- [CVE-2022-40621](https://cve.now/CVE-2022-40621.md): WAVLINK Quantum D4G (WN531G3) Pass-The-Hash (no CVSS, WAVLINK WN531G3)
- [CVE-2022-38497](https://cve.now/CVE-2022-38497.md): LIEF commit 365a16a was discovered to contain a segmentation violation via the component CoreFile.tcc:69. (no CVSS, lief)
- [CVE-2022-38496](https://cve.now/CVE-2022-38496.md): LIEF commit 365a16a was discovered to contain a reachable assertion abort via the component BinaryStream.hpp. (no CVSS, lief)
- [CVE-2022-38495](https://cve.now/CVE-2022-38495.md): LIEF commit 365a16a was discovered to contain a heap-buffer overflow via the function print\_binary at /c/macho\_reader.c. (no CVSS, lief)
- [CVE-2022-38307](https://cve.now/CVE-2022-38307.md): LIEF commit 5d1d643 was discovered to contain a segmentation violation via the function LIEF::MachO::SegmentCommand::file\_offset() at /MachO (no CVSS, lief)
- [CVE-2022-38306](https://cve.now/CVE-2022-38306.md): LIEF commit 5d1d643 was discovered to contain a heap-buffer overflow in the component /core/CorePrPsInfo.tcc. (no CVSS, lief)
- [CVE-2022-32555](https://cve.now/CVE-2022-32555.md): Unisys Data Exchange Management Studio before 6.0.IC2 and 7.x before 7.0.IC1 doesn't have an Anti-CSRF token to authenticate the POST reques (CVSS 8.8)
- [CVE-2022-3182](https://cve.now/CVE-2022-3182.md): Improper Access Control vulnerability in the Duo SMS two-factor of Devolutions Remote Desktop Manager 2022.2.14 and earlier allows attackers (no CVSS, Devolutions Remote Desktop Manager)
- [CVE-2022-32244](https://cve.now/CVE-2022-32244.md): Under certain conditions an attacker authenticated as a CMS administrator access the BOE Commentary database and retrieve (non-personal) sys (no CVSS, SAP SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2022-3205](https://cve.now/CVE-2022-3205.md): Controller: cross site scripting in automation controller ui (CVSS 4.6, Red Hat Ansible Automation Platform)
- [CVE-2022-2962](https://cve.now/CVE-2022-2962.md): A DMA reentrancy issue was found in the Tulip device emulation in QEMU. (CVSS 7.8, QEMU)
- [CVE-2022-20399](https://cve.now/CVE-2022-20399.md): In the SEPolicy configuration of system apps, there is a possible access to the 'ip' utility due to an insecure default value. (no CVSS, Android)
- [CVE-2022-20398](https://cve.now/CVE-2022-20398.md): In addOrUpdateNetwork of WifiServiceImpl.java, there is a possible way for a guest user to configure Wi-Fi due to a permissions bypass. (no CVSS, Android)
- [CVE-2022-20396](https://cve.now/CVE-2022-20396.md): In SettingsActivity.java, there is a possible way to make a device discoverable over Bluetooth, without permission or user interaction, due (no CVSS, Android)
- [CVE-2022-20395](https://cve.now/CVE-2022-20395.md): In checkAccess of MediaProvider.java, there is a possible file deletion due to a path traversal error. (no CVSS, Android)
- [CVE-2022-20393](https://cve.now/CVE-2022-20393.md): In extract3GPPGlobalDescriptions of TextDescriptions.cpp, there is a possible out of bounds read due to an integer overflow. (no CVSS, Android)
- [CVE-2022-20392](https://cve.now/CVE-2022-20392.md): In declareDuplicatePermission of ParsedPermissionUtils.java, there is a possible way to obtain a dangerous permission without user consent d (CVSS 7.8, Android)
- [CVE-2022-20391](https://cve.now/CVE-2022-20391.md): Summary:Product: AndroidVersions: Android SoCAndroid ID: A-238257000 (no CVSS, Android)
- [CVE-2022-20390](https://cve.now/CVE-2022-20390.md): Summary:Product: AndroidVersions: Android SoCAndroid ID: A-238257002 (no CVSS, Android)
- [CVE-2022-20389](https://cve.now/CVE-2022-20389.md): Summary:Product: AndroidVersions: Android SoCAndroid ID: A-238257004 (CVSS 9.8, Android)
- [CVE-2022-20388](https://cve.now/CVE-2022-20388.md): Summary:Product: AndroidVersions: Android SoCAndroid ID: A-238227323 (CVSS 9.8, Android)
- [CVE-2022-20387](https://cve.now/CVE-2022-20387.md): Summary:Product: AndroidVersions: Android SoCAndroid ID: A-238227324 (no CVSS, Android)
- [CVE-2022-20386](https://cve.now/CVE-2022-20386.md): Summary:Product: AndroidVersions: Android SoCAndroid ID: A-238227328 (no CVSS, Android)
- [CVE-2022-20385](https://cve.now/CVE-2022-20385.md): a function called 'nla\_parse', do not check the len of para, it will check nla\_type (which can be controlled by userspace) with 'maxtype' (i (no CVSS, Android)
- [CVE-2021-0943](https://cve.now/CVE-2021-0943.md): In MMU\_MapPages of TBD, there is a possible out of bounds write due to improper input validation. (no CVSS, Android)
- [CVE-2021-0942](https://cve.now/CVE-2021-0942.md): The path in this case is a little bit convoluted. (no CVSS, Android)
- [CVE-2021-0871](https://cve.now/CVE-2021-0871.md): In PVRSRVBridgePMRPDumpSymbolicAddr of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could (no CVSS, Android)
- [CVE-2021-0697](https://cve.now/CVE-2021-0697.md): In PVRSRVRGXSubmitTransferKM of rgxtransfer.c, there is a possible user after free due to a race condition. (no CVSS, Android)
- [CVE-2022-39206](https://cve.now/CVE-2022-39206.md): CI/CD Docker Escape in OneDev (CVSS 9.9, theonedev onedev)
- [CVE-2022-39207](https://cve.now/CVE-2022-39207.md): Persistent XSS in OneDev (CVSS 5.4, theonedev onedev)
- [CVE-2022-39208](https://cve.now/CVE-2022-39208.md): Git Repository Disclosure in Onedev (CVSS 7.5, theonedev onedev)
- [CVE-2022-38020](https://cve.now/CVE-2022-38020.md): Visual Studio Code Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Visual Studio Code)
- [CVE-2022-38019](https://cve.now/CVE-2022-38019.md): AV1 Video Extension Remote Code Execution Vulnerability (CVSS 7.8, Microsoft AV1 Video Extension)
- [CVE-2022-38012](https://cve.now/CVE-2022-38012.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 7.7, Microsoft Edge)
- [CVE-2022-38010](https://cve.now/CVE-2022-38010.md): Microsoft Office Visio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise +2)
- [CVE-2022-38011](https://cve.now/CVE-2022-38011.md): Raw Image Extension Remote Code Execution Vulnerability (CVSS 7.3, Microsoft Raw Image Extension)
- [CVE-2022-38009](https://cve.now/CVE-2022-38009.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2022-38008](https://cve.now/CVE-2022-38008.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2022-38007](https://cve.now/CVE-2022-38007.md): Azure Guest Configuration and Azure Arc-enabled servers Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Azure Guest Configuration · Microsoft Azure ARC)
- [CVE-2022-38006](https://cve.now/CVE-2022-38006.md): Windows Graphics Component Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2022-38005](https://cve.now/CVE-2022-38005.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-38004](https://cve.now/CVE-2022-38004.md): Windows Fax Service Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-37969](https://cve.now/CVE-2022-37969.md): Windows Common Log File System Driver Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2022-37963](https://cve.now/CVE-2022-37963.md): Microsoft Office Visio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise)
- [CVE-2022-37964](https://cve.now/CVE-2022-37964.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-37962](https://cve.now/CVE-2022-37962.md): Microsoft PowerPoint Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise)
- [CVE-2022-37961](https://cve.now/CVE-2022-37961.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2022-37959](https://cve.now/CVE-2022-37959.md): Network Device Enrollment Service (NDES) Security Feature Bypass Vulnerability (CVSS 6.5, Microsoft Windows Server)
- [CVE-2022-37958](https://cve.now/CVE-2022-37958.md): SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2022-37957](https://cve.now/CVE-2022-37957.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-37955](https://cve.now/CVE-2022-37955.md): Windows Group Policy Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-37954](https://cve.now/CVE-2022-37954.md): DirectX Graphics Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-35841](https://cve.now/CVE-2022-35841.md): Windows Enterprise App Management Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-35838](https://cve.now/CVE-2022-35838.md): HTTP V3 Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows Server · Microsoft Windows)
- [CVE-2022-35840](https://cve.now/CVE-2022-35840.md): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-35836](https://cve.now/CVE-2022-35836.md): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-35835](https://cve.now/CVE-2022-35835.md): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-35834](https://cve.now/CVE-2022-35834.md): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-35833](https://cve.now/CVE-2022-35833.md): Windows Secure Channel Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2022-35832](https://cve.now/CVE-2022-35832.md): Windows Event Tracing Denial of Service Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2022-35831](https://cve.now/CVE-2022-35831.md): Windows Remote Access Connection Manager Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2022-35828](https://cve.now/CVE-2022-35828.md): Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Defender for Endpoint for Mac)
- [CVE-2022-35830](https://cve.now/CVE-2022-35830.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows Server)
- [CVE-2022-35805](https://cve.now/CVE-2022-35805.md): Microsoft Dynamics CRM (on-premises) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Dynamics CRM (on-premises))
- [CVE-2022-35803](https://cve.now/CVE-2022-35803.md): Windows Common Log File System Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-34734](https://cve.now/CVE-2022-34734.md): Microsoft ODBC Driver Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-34733](https://cve.now/CVE-2022-34733.md): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-34732](https://cve.now/CVE-2022-34732.md): Microsoft ODBC Driver Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-34731](https://cve.now/CVE-2022-34731.md): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-34730](https://cve.now/CVE-2022-34730.md): Microsoft ODBC Driver Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-34729](https://cve.now/CVE-2022-34729.md): Windows GDI Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-34728](https://cve.now/CVE-2022-34728.md): Windows Graphics Component Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2022-34726](https://cve.now/CVE-2022-34726.md): Microsoft ODBC Driver Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-34727](https://cve.now/CVE-2022-34727.md): Microsoft ODBC Driver Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-34725](https://cve.now/CVE-2022-34725.md): Windows ALPC Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2022-34724](https://cve.now/CVE-2022-34724.md): Windows DNS Server Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows Server)
- [CVE-2022-34723](https://cve.now/CVE-2022-34723.md): Windows DPAPI (Data Protection Application Programming Interface) Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2022-34722](https://cve.now/CVE-2022-34722.md): Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows)
- [CVE-2022-34721](https://cve.now/CVE-2022-34721.md): Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows)
- [CVE-2022-34720](https://cve.now/CVE-2022-34720.md): Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2022-34719](https://cve.now/CVE-2022-34719.md): Windows Distributed File System (DFS) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-34718](https://cve.now/CVE-2022-34718.md): Windows TCP/IP Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows)
- [CVE-2022-34700](https://cve.now/CVE-2022-34700.md): Microsoft Dynamics CRM (on-premises) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Dynamics CRM (on-premises))
- [CVE-2022-33679](https://cve.now/CVE-2022-33679.md): Windows Kerberos Elevation of Privilege Vulnerability (CVSS 8.1, Microsoft Windows Server)
- [CVE-2022-33647](https://cve.now/CVE-2022-33647.md): Windows Kerberos Elevation of Privilege Vulnerability (CVSS 8.1, Microsoft Windows Server)
- [CVE-2022-30200](https://cve.now/CVE-2022-30200.md): Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-30196](https://cve.now/CVE-2022-30196.md): Windows Secure Channel Denial of Service Vulnerability (CVSS 8.2, Microsoft Windows)
- [CVE-2022-30170](https://cve.now/CVE-2022-30170.md): Windows Credential Roaming Service Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Windows Server 2022, 23H2 Edition · Microsoft Win…)
- [CVE-2022-26929](https://cve.now/CVE-2022-26929.md): .NET Framework Remote Code Execution Vulnerability (CVSS 7.8, Microsoft .NET Framework 3.5 AND · Microsoft .NET Framework)
- [CVE-2022-26928](https://cve.now/CVE-2022-26928.md): Windows Photo Import API Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2022-39205](https://cve.now/CVE-2022-39205.md): Access Control Bypass in Onedev (CVSS 9.0, theonedev onedev)
- [CVE-2022-40635](https://cve.now/CVE-2022-40635.md): Improper Control of Dynamically-Managed Code Resources in Crafter Studio (CVSS 6.4, Crafter Software Crafter CMS · org.craftercms:craftercms)
- [CVE-2022-40634](https://cve.now/CVE-2022-40634.md): Improper Control of Dynamically-Managed Code Resources in Crafter Studio (CVSS 6.4, Crafter Software Crafter CMS · org.craftercms:crafter-studio)
- [CVE-2022-39203](https://cve.now/CVE-2022-39203.md): Parsing issue in matrix-org/node-irc leading to room takeovers (CVSS 8.8, matrix-org matrix-appservice-irc · matrix-appservice-irc)
- [CVE-2022-34100](https://cve.now/CVE-2022-34100.md): A vulnerability was discovered in the Crestron AirMedia Windows Application, version 4.3.1.39, in which a low-privileged user can gain a SYS (no CVSS)
- [CVE-2022-39202](https://cve.now/CVE-2022-39202.md): IRC mode parameter confusion in matrix-appservice-irc (CVSS 4.3, matrix-org matrix-appservice-irc · matrix-appservice-irc)
- [CVE-2022-36105](https://cve.now/CVE-2022-36105.md): User Enumeration via Response Timing in TYPO3 (CVSS 5.3, typo3 · typo3/cms-core +1)
- [CVE-2022-36106](https://cve.now/CVE-2022-36106.md): Missing check for expiration time of password reset token in TYPO3 (CVSS 5.4, typo3 · typo3/cms-core +1)
- [CVE-2022-36107](https://cve.now/CVE-2022-36107.md): Stored Cross-Site Scripting via FileDumpController (CVSS 6.5, typo3 · typo3/cms-core +1)
- [CVE-2022-36104](https://cve.now/CVE-2022-36104.md): Denial of Service via Page Error Handling in TYPO3/cms (CVSS 5.9, typo3 · typo3/cms-core +1)
- [CVE-2022-36108](https://cve.now/CVE-2022-36108.md): Cross-Site Scripting in typo3/cms-core (CVSS 6.5, typo3 · typo3/cms-core +1)
- [CVE-2022-32190](https://cve.now/CVE-2022-32190.md): Failure to strip relative path components in net/url (no CVSS, Go standard library net/url · stdlib)
- [CVE-2022-36103](https://cve.now/CVE-2022-36103.md): Talos worker join token can be used to get elevated access level to the Talos API (CVSS 7.2, siderolabs talos · github.com/talos-systems/talos)
- [CVE-2022-36020](https://cve.now/CVE-2022-36020.md): Bypass of Cross-Site Scripting Protection in typo3/html-sanitizer (CVSS 6.1, TYPO3 html-sanitizer · typo3/html-sanitizer +2)
- [CVE-2022-3179](https://cve.now/CVE-2022-3179.md): Weak Password Requirements in ikus060/rdiffweb (CVSS 7.1, ikus060/rdiffweb · rdiffweb)
- [CVE-2022-39014](https://cve.now/CVE-2022-39014.md): Under certain conditions SAP BusinessObjects Business Intelligence Platform Central Management Console (CMC) - version 430, allows an attack (no CVSS, SAP SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2022-39801](https://cve.now/CVE-2022-39801.md): SAP GRC Access control Emergency Access Management allows an authenticated attacker to access a Firefighter session even after it is closed (CVSS 7.5, SAP SE SAP GRC Access Control Emergency Access Management)
- [CVE-2022-39799](https://cve.now/CVE-2022-39799.md): An attacker with no prior authentication could craft and send malicious script to SAP GUI for HTML within Fiori Launchpad, resulting in refl (CVSS 6.1, SAP SE SAP NetWeaver AS ABAP)
- [CVE-2022-35298](https://cve.now/CVE-2022-35298.md): SAP NetWeaver Enterprise Portal (KMC) - version 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (no CVSS, SAP SE SAP NetWeaver Enterprise Portal)
- [CVE-2022-35294](https://cve.now/CVE-2022-35294.md): An attacker with basic business user privileges could craft and upload a malicious file to SAP NetWeaver Application Server ABAP, which is t (no CVSS, SAP SE SAP NetWeaver AS ABAP)
- [CVE-2022-35292](https://cve.now/CVE-2022-35292.md): In SAP Business One application when a service is created, the executable path contains spaces and isn’t enclosed within quotes, leading to (no CVSS, SAP SE SAP Business One)
- [CVE-2022-3170](https://cve.now/CVE-2022-3170.md): An out-of-bounds access issue was found in the Linux kernel sound subsystem. (no CVSS, kernel)
- [CVE-2022-3029](https://cve.now/CVE-2022-3029.md): Fatal error on incorrect base64 data in RRDP (no CVSS, NLnet Labs Routinator · routinator)
- [CVE-2022-36782](https://cve.now/CVE-2022-36782.md): Pal Electronics Systems - Pal Gate Authorization Errors (CVSS 5.9, Pal Electronics Systems Pal Gate)
- [CVE-2022-36778](https://cve.now/CVE-2022-36778.md): Synel - eHarmony Stored XSS (CVSS 6.5, Synel eHarmony)
- [CVE-2022-36780](https://cve.now/CVE-2022-36780.md): Avdor CIS - crystal quality Credentials Management Errors (CVSS 4.9, Avdor CIS crystal quality)
- [CVE-2022-36779](https://cve.now/CVE-2022-36779.md): PROSCEND - PROSCEND / ADVICE .Ltd - G/5G Industrial Cellular Router (with GPS)4 Unauthenticated OS Command Injection (CVSS 6.5, PROSCEND M330-w / M330-W5 · PROSCEND M350-5G / M350-W5G… +2)
- [CVE-2022-38453](https://cve.now/CVE-2022-38453.md): Contec Health CMS8000 (CVSS 3.0, Contec Health CMS8000 CONTEC ICU CCU Vital Signs Patient Mo…)
- [CVE-2022-3027](https://cve.now/CVE-2022-3027.md): Contec Health CMS8000 (CVSS 5.7, Contec Health CMS8000 CONTEC ICU CCU Vital Signs Patient Mo…)
- [CVE-2022-38069](https://cve.now/CVE-2022-38069.md): Contec Health CMS8000 (CVSS 4.3, Contec Health CMS8000 CONTEC ICU CCU Vital Signs Patient Mo…)
- [CVE-2022-38100](https://cve.now/CVE-2022-38100.md): Contec Health CMS8000 (CVSS 7.5, Contec Health CMS8000 CONTEC ICU CCU Vital Signs Patient Mo…)
- [CVE-2022-36385](https://cve.now/CVE-2022-36385.md): Contec Health CMS8000 (CVSS 6.8, Contec Health CMS8000 CONTEC ICU CCU Vital Signs Patient Mo…)
- [CVE-2022-1602](https://cve.now/CVE-2022-1602.md): A potential security vulnerability has been identified in HP ThinPro 7.2 Service Pack 8 (SP8). (no CVSS, HP ThinPro OS)
- [CVE-2022-38542](https://cve.now/CVE-2022-38542.md): Archery v1.4.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the ThreadIDs parameter in the kill\_session interface. (no CVSS)
- [CVE-2022-38539](https://cve.now/CVE-2022-38539.md): Archery v1.7.5 to v1.8.5 was discovered to contain a SQL injection vulnerability via the where parameter at /archive/apply. (no CVSS)
- [CVE-2022-38139](https://cve.now/CVE-2022-38139.md): WordPress RD Station plugin \<= 5.2.0 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities (CVSS 5.4, RD Station)
- [CVE-2022-2990](https://cve.now/CVE-2022-2990.md): An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or poss (no CVSS, buildah · github.com/containers/buildah)
- [CVE-2022-2989](https://cve.now/CVE-2022-2989.md): An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possi (CVSS 7.1, podman · github.com/containers/podman/v4 +1)
- [CVE-2022-1278](https://cve.now/CVE-2022-1278.md): A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain. (no CVSS, WildFly · org.wildfly.bom:wildfly)
- [CVE-2022-38616](https://cve.now/CVE-2022-38616.md): SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j\_id90 parameter at /feegroups/tgrt\_group. (no CVSS)
- [CVE-2022-39156](https://cve.now/CVE-2022-39156.md): A vulnerability has been identified in Parasolid V33.1 (All versions \< V33.1.262), Parasolid V33.1 (All versions \>= V33.1.262 \< V33.1.263), (no CVSS, Siemens Parasolid · Siemens Simcenter Femap)
- [CVE-2022-39154](https://cve.now/CVE-2022-39154.md): A vulnerability has been identified in Parasolid V33.1 (All versions \< V33.1.262), Parasolid V33.1 (All versions \>= V33.1.262 \< V33.1.263), (no CVSS, Siemens Parasolid · Siemens Simcenter Femap)
- [CVE-2022-39155](https://cve.now/CVE-2022-39155.md): A vulnerability has been identified in Parasolid V33.1 (All versions \< V33.1.262), Parasolid V33.1 (All versions \>= V33.1.262 \< V33.1.263), (no CVSS, Siemens Parasolid · Siemens Simcenter Femap)
- [CVE-2022-39153](https://cve.now/CVE-2022-39153.md): A vulnerability has been identified in Parasolid V33.1 (All versions \< V33.1.262), Parasolid V33.1 (All versions \>= V33.1.262 \< V33.1.263), (no CVSS, Siemens Parasolid · Siemens Simcenter Femap)
- [CVE-2022-39152](https://cve.now/CVE-2022-39152.md): A vulnerability has been identified in Parasolid V33.1 (All versions \< V33.1.262), Parasolid V33.1 (All versions \>= V33.1.262 \< V33.1.263), (no CVSS, Siemens Parasolid · Siemens Simcenter Femap)
- [CVE-2022-39151](https://cve.now/CVE-2022-39151.md): A vulnerability has been identified in Parasolid V33.1 (All versions \< V33.1.262), Parasolid V33.1 (All versions \>= V33.1.262 \< V33.1.263), (CVSS 7.8, Siemens Parasolid · Siemens Simcenter Femap)
- [CVE-2022-39150](https://cve.now/CVE-2022-39150.md): A vulnerability has been identified in Parasolid V33.1 (All versions \< V33.1.262), Parasolid V33.1 (All versions \>= V33.1.262 \< V33.1.263), (no CVSS, Siemens Parasolid · Siemens Simcenter Femap)
- [CVE-2022-39148](https://cve.now/CVE-2022-39148.md): A vulnerability has been identified in Parasolid V33.1 (All versions \< V33.1.262), Parasolid V33.1 (All versions \>= V33.1.262 \< V33.1.263), (no CVSS, Siemens Parasolid · Siemens Simcenter Femap)
- [CVE-2022-39149](https://cve.now/CVE-2022-39149.md): A vulnerability has been identified in Parasolid V33.1 (All versions \< V33.1.262), Parasolid V33.1 (All versions \>= V33.1.262 \< V33.1.263), (no CVSS, Siemens Parasolid · Siemens Simcenter Femap)
- [CVE-2022-39147](https://cve.now/CVE-2022-39147.md): A vulnerability has been identified in Parasolid V33.1 (All versions \< V33.1.262), Parasolid V33.1 (All versions \>= V33.1.262 \< V33.1.263), (no CVSS, Siemens Parasolid · Siemens Simcenter Femap)
- [CVE-2022-39146](https://cve.now/CVE-2022-39146.md): A vulnerability has been identified in Parasolid V33.1 (All versions \< V33.1.262), Parasolid V33.1 (All versions \>= V33.1.262 \< V33.1.263), (no CVSS, Siemens Parasolid · Siemens Simcenter Femap)
- [CVE-2022-39145](https://cve.now/CVE-2022-39145.md): A vulnerability has been identified in Parasolid V33.1 (All versions \< V33.1.262), Parasolid V33.1 (All versions \>= V33.1.262 \< V33.1.263), (no CVSS, Siemens Parasolid · Siemens Simcenter Femap)
- [CVE-2022-39144](https://cve.now/CVE-2022-39144.md): A vulnerability has been identified in Parasolid V33.1 (All versions \< V33.1.262), Parasolid V33.1 (All versions \>= V33.1.262 \< V33.1.263), (no CVSS, Siemens Parasolid · Siemens Simcenter Femap)
- [CVE-2022-39143](https://cve.now/CVE-2022-39143.md): A vulnerability has been identified in Parasolid V33.1 (All versions \< V33.1.262), Parasolid V33.1 (All versions \>= V33.1.262 \< V33.1.263), (no CVSS, Siemens Parasolid · Siemens Simcenter Femap)
- [CVE-2022-39142](https://cve.now/CVE-2022-39142.md): A vulnerability has been identified in Parasolid V33.1 (All versions \< V33.1.262), Parasolid V33.1 (All versions \>= V33.1.262 \< V33.1.263), (no CVSS, Siemens Parasolid · Siemens Simcenter Femap)
- [CVE-2022-39141](https://cve.now/CVE-2022-39141.md): A vulnerability has been identified in Parasolid V33.1 (All versions \< V33.1.262), Parasolid V34.0 (All versions \< V34.0.252), Parasolid V34 (no CVSS, Siemens Parasolid · Siemens Simcenter Femap)
- [CVE-2022-39139](https://cve.now/CVE-2022-39139.md): A vulnerability has been identified in Parasolid V33.1 (All versions \< V33.1.262), Parasolid V34.0 (All versions \< V34.0.252), Parasolid V34 (no CVSS, Siemens Parasolid · Siemens Simcenter Femap)
- [CVE-2022-39140](https://cve.now/CVE-2022-39140.md): A vulnerability has been identified in Parasolid V33.1 (All versions \< V33.1.262), Parasolid V34.0 (All versions \< V34.0.252), Parasolid V34 (no CVSS, Siemens Parasolid · Siemens Simcenter Femap)
- [CVE-2022-39138](https://cve.now/CVE-2022-39138.md): A vulnerability has been identified in Parasolid V33.1 (All versions \< V33.1.262), Parasolid V34.0 (All versions \< V34.0.252), Parasolid V34 (no CVSS, Siemens Parasolid · Siemens Simcenter Femap)
- [CVE-2022-39137](https://cve.now/CVE-2022-39137.md): A vulnerability has been identified in Parasolid V33.1 (All versions \< V33.1.262), Parasolid V34.0 (All versions \< V34.0.252), Parasolid V34 (no CVSS, Siemens Parasolid · Siemens Simcenter Femap)
- [CVE-2022-38466](https://cve.now/CVE-2022-38466.md): A vulnerability has been identified in CoreShield One-Way Gateway (OWG) Software (All versions \< V2.2). (no CVSS, Siemens CoreShield One-Way Gateway (OWG) Software)
- [CVE-2022-37302](https://cve.now/CVE-2022-37302.md): A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a crash of the Cont (CVSS 5.5, Schneider Electric EcoStruxure Control Expert)
- [CVE-2022-3174](https://cve.now/CVE-2022-3174.md): Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in ikus060/rdiffweb (CVSS 7.5, ikus060/rdiffweb · rdiffweb)
- [CVE-2022-3175](https://cve.now/CVE-2022-3175.md): Missing Custom Error Page in ikus060/rdiffweb (CVSS 5.3, ikus060/rdiffweb · rdiffweb)
- [CVE-2022-3190](https://cve.now/CVE-2022-3190.md): Infinite loop in the F5 Ethernet Trailer protocol dissector in Wireshark 3.6.0 to 3.6.7 and 3.4.0 to 3.4.15 allows denial of service via pac (CVSS 6.3, SharkFest Foundation Wireshark)
- [CVE-2022-35295](https://cve.now/CVE-2022-35295.md): In SAP Host Agent (SAPOSCOL) - version 7.22, an attacker may use files created by saposcol to escalate privileges for themselves. (no CVSS, SAP SE SAP Host Agent)
- [CVE-2022-35823](https://cve.now/CVE-2022-35823.md): Microsoft SharePoint Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2022-35837](https://cve.now/CVE-2022-35837.md): Windows Graphics Component Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2022-37011](https://cve.now/CVE-2022-37011.md): A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions \< V1.17.0), Mendix SAML (Mendix 8 compatible) (All ve (no CVSS, Siemens Mendix SAML)
- [CVE-2022-37703](https://cve.now/CVE-2022-37703.md): In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. (no CVSS)
- [CVE-2022-37956](https://cve.now/CVE-2022-37956.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-38013](https://cve.now/CVE-2022-38013.md): .NET Core and Visual Studio Denial of Service Vulnerability (CVSS 7.5, Microsoft Visual Studio 2022 for Mac · Microsoft Visual… +14)
- [CVE-2022-38329](https://cve.now/CVE-2022-38329.md): A CSRF vulnerability in Shopxian CMS 3.0.0 could allow an unauthenticated, remote attacker to craft a malicious link, potentially causing th (no CVSS)
- [CVE-2022-38342](https://cve.now/CVE-2022-38342.md): Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a XML External Entity (XXE) vulnerability which allows a (CVSS 8.5)
- [CVE-2022-38537](https://cve.now/CVE-2022-38537.md): Archery v1.4.5 to v1.8.5 was discovered to contain multiple SQL injection vulnerabilities via the start\_file, end\_file, start\_time, and stop (no CVSS)
- [CVE-2022-38538](https://cve.now/CVE-2022-38538.md): Archery v1.7.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the checksum parameter in the report module. (no CVSS)
- [CVE-2022-38540](https://cve.now/CVE-2022-38540.md): Archery v1.4.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the ThreadIDs parameter in the create\_kill\_session inte (no CVSS)
- [CVE-2022-38541](https://cve.now/CVE-2022-38541.md): Archery v1.8.3 to v1.8.5 was discovered to contain multiple SQL injection vulnerabilities via the start\_time and stop\_time parameters in the (no CVSS)
- [CVE-2022-39158](https://cve.now/CVE-2022-39158.md): A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, (CVSS 5.3, Siemens RUGGEDCOM i800 · Siemens RUGGEDCOM i800NC +140)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-09-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.