CVEs published September 14, 2022
49 CVEs were published on September 14, 2022: 3 critical, 5 high.
- Published
- 49
- Critical
- 3
- High
- 5
- Medium
- 15
- Low
- 1
- Unrated
- 25
- Now in CISA KEV
- 0
- Fix available
- 15
Most affected products
- glpi-project glpi
- 6
- Android
- 2
- Hitachi Energy MicroSCADA X SYS600
- 2
- Hitachi Energy MicroSCADA X SYS600 · Hitachi Energy MicroSC…
- 2
- rust-lang cargo · cargo
- 2
- feehi/cms
- 1
- github.com/ouqiang/gocron
- 1
- IBM Maximo Asset Management
- 1
- ionicabizau/parse-url · parse-url
- 1
- Kernel
- 1
Critical 3
- CVE-2022-35947SQL injection in GLPIglpi-project glpi
- CVE-2022-2900Server-Side Request Forgery (SSRF) in ionicabizau/parse-urlionicabizau/parse-url · parse-url
- CVE-2022-36436OSU Open Source Lab VNCAuthProxy through 1.1.1 is affected by an vncap/vnc/protocol.py VNCServerAuthenticator authentication-bypass vulnerabvncauthproxy
High 5
- CVE-2022-1778A vulnerability exists during the start of the affected SYS600, where an input validation flaw causes a buffer-overflow while reading a specific configuration file. Subsequently SYS600 will fail to start. The configuration file can only be accessed by ...Hitachi Energy MicroSCADA X SYS600
- CVE-2022-29922A vulnerability exists in the handling of a specially crafted IEC 61850 packet with a valid data item but with incorrect data type in the IEC 61850 OPC Server. The vulnerability may cause a denial-of-service on the IEC 61850 OPC Server part of the SYS ...Hitachi Energy MicroSCADA X SYS600 · Hitachi Energy MicroSC…
- CVE-2022-2277A vulnerability exists in the ICCP stack of the affected SYS600 versions due to validation flaw in the process that establishes the ICCP communication. The validation flaw will cause a denial-of-service when ICCP of SYS600 is request to forward any da ...Hitachi Energy MicroSCADA X SYS600
- CVE-2022-3212DoS in axum-core due to missing request size limittokio-rs axum-core · axum-core
- CVE-2022-40674libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.
Medium, low and unrated 41
- CVE-2020-36603The HoYoVerse (formerly miHoYo) Genshin Impact mhyprot2.sys 1.0.0.0 anti-cheat driver does not adequately restrict unprivileged function cal
- CVE-2022-38308TOTOLink A700RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the lang parameter in the function cst
- CVE-2022-37724Project Wonder WebObjects 1.0 through 5.4.3 is vulnerable to Arbitrary HTTP Header injection and URL- or Header-based XSS reflection in all wonder:wonder
- CVE-2022-38301Onedev v7.4.14 contains a path traversal vulnerability which allows attackers to access restricted files and directories via uploading a cra
- CVE-2022-3216Nintendo Game Boy Color Mobile Adapter GB Tetsuji memory corruptionNintendo Game Boy Color
- CVE-2022-40365Cross site scripting (XSS) vulnerability in ouqiang gocron through 1.5.3, allows attackers to execute arbitrary code via scope.row.hostname github.com/ouqiang/gocron
- CVE-2022-40438Buffer overflow vulnerability in function AP4_MemoryByteStream::WritePartial in mp42aac in Bento4 v1.6.0-639, allows attackers to cause a de
- CVE-2022-40439An memory leak issue was discovered in AP4_StdcFileByteStream::Create in mp42ts in Bento4 v1.6.0-639, allows attackers to cause a denial of
- CVE-2022-40476A null pointer dereference issue was discovered in fs/io_uring.c in the Linux kernel before 5.15.62.
- CVE-2022-36056 Vulnerabilities with blob verification in sigstore cosignsigstore cosign · github.com/sigstore/cosign
- CVE-2022-31187Stored Cross Site Scripting (XSS) through global search in GLPIglpi-project glpi
- CVE-2022-35946SQL injection through plugin controller in GLPIglpi-project glpi
- CVE-2022-36112Blind Server-Side Request Forgery (SSRF) in GLPIglpi-project glpi
- CVE-2022-35945Cross site scripting (XSS) via registration API in GLPIglpi-project glpi
- CVE-2022-31143Leak of sensitive information through login page error in GLPIglpi-project glpi
- CVE-2022-29492A vulnerability exists in the handling of a malformed IEC 104 TCP packet. Upon receiving a malformed IEC 104 TCP packet, the malformed packet is dropped, however the TCP connection is left open. This may cause a denial-of-service if the affected conne ...Hitachi Energy MicroSCADA X SYS600 · Hitachi Energy MicroSC…
- CVE-2022-0029Cortex XDR Agent: Improper Link Resolution Vulnerability When Generating a Tech Support FilePalo Alto Networks Cortex XDR Agent
- CVE-2021-38924IBM Maximo Asset Management 7.6.1.1 and 7.6.1.2 could allow a remote attacker to obtain sensitive information when a detailed technical erroIBM Maximo Asset Management
- CVE-2022-38796A Host Header Injection vulnerability in Feehi CMS 2.1.1 may allow an attacker to spoof a particular header.feehi/cms
- CVE-2022-22520User enumeration vulnerability in MB connect line and Helmholz productsMB connect line mymbCONNECT24 · MB connect line mbCONNEC… +2
- CVE-2022-40626Reflected XSS in the backurl parameter of Zabbix FrontendZabbix Frontend
- CVE-2022-40673KDiskMark before 3.1.0 lacks authorization checking for D-Bus methods such as Helper::flushPageCache.
- CVE-2022-37140PayMoney 3.3 is vulnerable to Client Side Remote Code Execution (RCE).
- CVE-2022-37138Loan Management System 1.0 is vulnerable to SQL Injection at the login page, which allows unauthorized users to login as Administrator after
- CVE-2022-37139Loan Management System version 1.0 suffers from a persistent cross site scripting vulnerability.
- CVE-2022-37137PayMoney 3.3 is vulnerable to Stored Cross-Site Scripting (XSS) during replying the ticket.
- CVE-2022-36668Garage Management System 1.0 is vulnerable to Stored Cross Site Scripting (XSS) on several parameters.
- CVE-2022-36667Garage Management System 1.0 is vulnerable to the Remote Code Execution (RCE) due to the lack of filtering from the file upload function.
- CVE-2022-36669Hospital Information System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.
- CVE-2022-34831An issue was discovered in Keyfactor PrimeKey EJBCA before 7.9.0, related to possible inconsistencies in DNS identifiers submitted in an ACM
- CVE-2020-19587Cross Site Scripting (XSS) vulnerability in configMap parameters in Yellowfin Business Intelligence 7.3 allows remote attackers to run arbit
- CVE-2020-19586Incorrect Access Control issue in Yellowfin Business Intelligence 7.3 allows remote attackers to escalate privilege via MIAdminStyles.i4 Adm
- CVE-2018-25047In Smarty before 3.1.47 and 4.x before 4.2.1, libs/plugins/function.mailto.php allows XSS.smarty/smarty
- CVE-2022-20231In smc_intc_request_fiq of arm_gic.c, there is a possible out of bounds write due to improper input validation.Android
- CVE-2022-20364In sysmmu_unmap of TBD, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2022-2977A flaw was found in the Linux kernel implementation of proxied virtualized TPM devices.Linux kernel
- CVE-2022-3202A NULL pointer dereference flaw in diFree in fs/jfs/inode.c in Journaled File System (JFS)in the Linux kernel.Kernel
- CVE-2022-36113Extracting malicious crates can corrupt arbitrary filesrust-lang cargo · cargo
- CVE-2022-36114Extracting malicious crates can fill the file systemrust-lang cargo · cargo
- CVE-2022-37661SmartRG SR506n 2.5.15 and SR510n 2.6.13 routers are vulnerable to Remote Code Execution (RCE) via the ping host feature.
- CVE-2022-40734UniSharp laravel-filemanager (aka Laravel Filemanager) before 2.6.4 allows download?working_dir=%2F..unisharp/laravel-filemanager