# CVEs published 2022-09-15

85 CVEs were published on September 15, 2022: 2 critical, 37 high. Days are UTC.

- [CVE-2022-36074](https://cve.now/CVE-2022-36074.md): Authentication headers exposed on by Nextcloud Server (CVSS 6.4, nextcloud security-advisories)
- [CVE-2022-27561](https://cve.now/CVE-2022-27561.md): HCL Traveler is susceptible to a Reflected Cross-Site Scripting vulnerability in the web admin (LotusTraveler.nsf) (CVSS 7.5, HCL Software HCL Traveler)
- [CVE-2022-36075](https://cve.now/CVE-2022-36075.md): File list exposure in Nextcloud Files Access Control (CVSS 2.6, nextcloud security-advisories)
- [CVE-2022-39213](https://cve.now/CVE-2022-39213.md): Out-of-bounds Read in go-cvss (CVSS 7.5, pandatix go-cvss · github.com/pandatix/go-cvss)
- [CVE-2022-39215](https://cve.now/CVE-2022-39215.md): The readDir Endpoint Scope can be Bypassed With Symbolic Links in Tauri (CVSS 8.3, tauri-apps tauri · tauri)
- [CVE-2022-29240](https://cve.now/CVE-2022-29240.md): Uninitialized memory read in LZ4 decompression leads to authentication bypass in Scylla (CVSS 8.1, scylladb scylla)
- [CVE-2022-38814](https://cve.now/CVE-2022-38814.md): A stored cross-site scripting (XSS) vulnerability in the auth\_settings component of FiberHome AN5506-02-B vRP2521 allows attackers to execut (no CVSS)
- [CVE-2022-38326](https://cve.now/CVE-2022-38326.md): Tenda AC15 WiFi Router V15.03.05.19\_multi and AC18 WiFi Router V15.03.05.19\_multi were discovered to contain a buffer overflow via the page (no CVSS)
- [CVE-2022-38325](https://cve.now/CVE-2022-38325.md): Tenda AC15 WiFi Router V15.03.05.19\_multi and AC18 WiFi Router V15.03.05.19\_multi were discovered to contain a buffer overflow via the fileP (no CVSS)
- [CVE-2022-37260](https://cve.now/CVE-2022-37260.md): A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the input variable in main.js. (no CVSS, steal)
- [CVE-2022-38535](https://cve.now/CVE-2022-38535.md): TOTOLINK-720R v4.1.5cu.374 was discovered to contain a remote code execution (RCE) vulnerability via the setTracerouteCfg function. (no CVSS)
- [CVE-2022-38534](https://cve.now/CVE-2022-38534.md): TOTOLINK-720R v4.1.5cu.374 was discovered to contain a remote code execution (RCE) vulnerability via the setdiagnosicfg function. (no CVSS)
- [CVE-2022-37861](https://cve.now/CVE-2022-37861.md): There is a remote code execution (RCE) vulnerability in Tenhot TWS-100 V4.0-201809201424 router device. (no CVSS)
- [CVE-2022-1798](https://cve.now/CVE-2022-1798.md): Path Traversal vulnerability in Kubevirt (CVSS 8.7, Google Kubevirt · kubevirt.io/kubevirt)
- [CVE-2022-37264](https://cve.now/CVE-2022-37264.md): Prototype pollution vulnerability in stealjs steal 2.2.4 via the optionName variable in main.js. (no CVSS, steal)
- [CVE-2022-37262](https://cve.now/CVE-2022-37262.md): A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the source and sourceWithComments variable in main. (no CVSS, steal)
- [CVE-2022-38890](https://cve.now/CVE-2022-38890.md): Nginx NJS v0.7.7 was discovered to contain a segmentation violation via njs\_utf8\_next at src/njs\_utf8.h (no CVSS)
- [CVE-2022-40663](https://cve.now/CVE-2022-40663.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of NIKON NIS-Elements Viewer 1.2100.1483.0. (CVSS 7.8, NIKON NIS-Elements Viewer)
- [CVE-2022-40662](https://cve.now/CVE-2022-40662.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of NIKON NIS-Elements Viewer 1.2100.1483.0. (CVSS 7.8, NIKON NIS-Elements Viewer)
- [CVE-2022-40661](https://cve.now/CVE-2022-40661.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of NIKON NIS-Elements Viewer 1.2100.1483.0. (CVSS 7.8, NIKON NIS-Elements Viewer)
- [CVE-2022-40660](https://cve.now/CVE-2022-40660.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of NIKON NIS-Elements Viewer 1.2100.1483.0. (CVSS 7.8, NIKON NIS-Elements Viewer)
- [CVE-2022-40659](https://cve.now/CVE-2022-40659.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of NIKON NIS-Elements Viewer 1.2100.1483.0. (CVSS 7.8, NIKON NIS-Elements Viewer)
- [CVE-2022-40658](https://cve.now/CVE-2022-40658.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of NIKON NIS-Elements Viewer 1.2100.1483.0. (CVSS 7.8, NIKON NIS-Elements Viewer)
- [CVE-2022-40657](https://cve.now/CVE-2022-40657.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of NIKON NIS-Elements Viewer 1.2100.1483.0. (CVSS 7.8, NIKON NIS-Elements Viewer)
- [CVE-2022-40655](https://cve.now/CVE-2022-40655.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of NIKON NIS-Elements Viewer 1.2100.1483.0. (CVSS 7.8, NIKON NIS-Elements Viewer)
- [CVE-2022-40656](https://cve.now/CVE-2022-40656.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of NIKON NIS-Elements Viewer 13.2.0.21165. (CVSS 7.8, NIKON NIS-Elements Viewer)
- [CVE-2022-40654](https://cve.now/CVE-2022-40654.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. (CVSS 7.8, Ansys SpaceClaim)
- [CVE-2022-40653](https://cve.now/CVE-2022-40653.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. (CVSS 7.8, Ansys SpaceClaim)
- [CVE-2022-40652](https://cve.now/CVE-2022-40652.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. (CVSS 7.8, Ansys SpaceClaim)
- [CVE-2022-40651](https://cve.now/CVE-2022-40651.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. (CVSS 7.8, Ansys SpaceClaim)
- [CVE-2022-40650](https://cve.now/CVE-2022-40650.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. (CVSS 7.8, Ansys SpaceClaim)
- [CVE-2022-40649](https://cve.now/CVE-2022-40649.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. (CVSS 7.8, Ansys SpaceClaim)
- [CVE-2022-40648](https://cve.now/CVE-2022-40648.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. (CVSS 7.8, Ansys SpaceClaim)
- [CVE-2022-40646](https://cve.now/CVE-2022-40646.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. (CVSS 7.8, Ansys SpaceClaim)
- [CVE-2022-40647](https://cve.now/CVE-2022-40647.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. (CVSS 7.8, Ansys SpaceClaim)
- [CVE-2022-40645](https://cve.now/CVE-2022-40645.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. (CVSS 7.8, Ansys SpaceClaim)
- [CVE-2022-40644](https://cve.now/CVE-2022-40644.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. (CVSS 7.8, Ansys SpaceClaim)
- [CVE-2022-40643](https://cve.now/CVE-2022-40643.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. (CVSS 7.8, Ansys SpaceClaim)
- [CVE-2022-40642](https://cve.now/CVE-2022-40642.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. (CVSS 7.8, Ansys SpaceClaim)
- [CVE-2022-40641](https://cve.now/CVE-2022-40641.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. (CVSS 7.8, Ansys SpaceClaim)
- [CVE-2022-40640](https://cve.now/CVE-2022-40640.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. (CVSS 7.8, Ansys SpaceClaim)
- [CVE-2022-40639](https://cve.now/CVE-2022-40639.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. (CVSS 7.8, Ansys SpaceClaim)
- [CVE-2022-40638](https://cve.now/CVE-2022-40638.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. (CVSS 7.8, Ansys SpaceClaim)
- [CVE-2022-40636](https://cve.now/CVE-2022-40636.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. (CVSS 7.0, Ansys SpaceClaim)
- [CVE-2022-40637](https://cve.now/CVE-2022-40637.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. (CVSS 7.0, Ansys SpaceClaim)
- [CVE-2022-38600](https://cve.now/CVE-2022-38600.md): Mplayer SVN-r38374-13.0.1 is vulnerable to Memory Leak via vf.c and vf\_vo.c. (no CVSS)
- [CVE-2022-37201](https://cve.now/CVE-2022-37201.md): JFinal CMS 5.1.0 is vulnerable to SQL Injection. (no CVSS)
- [CVE-2022-38853](https://cve.now/CVE-2022-38853.md): Certain The MPlayer Project products are vulnerable to Buffer Overflow via function asf\_init\_audio\_stream() of libmpdemux/asfheader.c. (no CVSS)
- [CVE-2022-38856](https://cve.now/CVE-2022-38856.md): Certain The MPlayer Project products are vulnerable to Buffer Overflow via function mov\_build\_index() of libmpdemux/demux\_mov.c. (no CVSS)
- [CVE-2022-3001](https://cve.now/CVE-2022-3001.md): Vulnerability in Milesight Video Management Systems (VMS) (CVSS 7.5, Milesight Video Management Systems)
- [CVE-2022-38862](https://cve.now/CVE-2022-38862.md): Certain The MPlayer Project products are vulnerable to Buffer Overflow via function play() of libaf/af.c:639. (no CVSS)
- [CVE-2022-37207](https://cve.now/CVE-2022-37207.md): JFinal CMS 5.1.0 is affected by: SQL Injection. (no CVSS)
- [CVE-2022-29649](https://cve.now/CVE-2022-29649.md): Qsmart Next v4.1.2 was discovered to contain a cross-site scripting (XSS) vulnerability. (no CVSS)
- [CVE-2022-40306](https://cve.now/CVE-2022-40306.md): The login form /Login in ECi Printanista Hub (formerly FMAudit Printscout) before 5.5.2 (July 2023) performs expensive RSA key-generation op (no CVSS)
- [CVE-2022-3211](https://cve.now/CVE-2022-3211.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 5.8, pimcore/pimcore)
- [CVE-2022-2472](https://cve.now/CVE-2022-2472.md): Improper Initialization vulnerability in local server authentication logic (CVSS 7.6, EZVIZ CS-C6N-A0-1C2WFR)
- [CVE-2022-2471](https://cve.now/CVE-2022-2471.md): Stack-Based Buffer Overflow Vulnerability in the EZVIZ Motion Detection component (CVSS 9.9, EZVIZ CS-CV248 · EZVIZ CS-C6N-A0-1C2WFR +3)
- [CVE-2021-44076](https://cve.now/CVE-2021-44076.md): An issue was discovered in CrushFTP 9. (no CVSS)
- [CVE-2022-37257](https://cve.now/CVE-2022-37257.md): Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the requestedVersion variable in npm (no CVSS, steal)
- [CVE-2022-37266](https://cve.now/CVE-2022-37266.md): Prototype pollution vulnerability in function extend in babel.js in stealjs steal 2.2.4 via the key variable in babel.js. (no CVSS, steal)
- [CVE-2022-38788](https://cve.now/CVE-2022-38788.md): An issue was discovered in Nokia FastMile 5G Receiver 5G14-B 1.2104.00.0281. (no CVSS)
- [CVE-2022-38789](https://cve.now/CVE-2022-38789.md): An issue was discovered in Airties Smart Wi-Fi before 2020-08-04. (no CVSS)
- [CVE-2022-3224](https://cve.now/CVE-2022-3224.md): Misinterpretation of Input in ionicabizau/parse-url (CVSS 9.4, ionicabizau/parse-url · parse-url)
- [CVE-2022-3221](https://cve.now/CVE-2022-3221.md): Cross-Site Request Forgery (CSRF) in ikus060/rdiffweb (CVSS 8.8, ikus060/rdiffweb · rdiffweb)
- [CVE-2022-31735](https://cve.now/CVE-2022-31735.md): OpenAM Consortium Edition version 14.0.0 provided by OpenAM Consortium contains an open redirect vulnerability (CWE-601). (no CVSS, OpenAM)
- [CVE-2022-40738](https://cve.now/CVE-2022-40738.md): An issue was discovered in Bento4 through 1.6.0-639. (no CVSS)
- [CVE-2022-40736](https://cve.now/CVE-2022-40736.md): An issue was discovered in Bento4 1.6.0-639. (no CVSS)
- [CVE-2022-40737](https://cve.now/CVE-2022-40737.md): An issue was discovered in Bento4 through 1.6.0-639. (no CVSS)
- [CVE-2022-38595](https://cve.now/CVE-2022-38595.md): Church Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/edit\_user.php. (no CVSS)
- [CVE-2022-38594](https://cve.now/CVE-2022-38594.md): Church Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/edit\_visitor.php. (no CVSS)
- [CVE-2022-38352](https://cve.now/CVE-2022-38352.md): ThinkPHP v6.0.13 was discovered to contain a deserialization vulnerability via the component League\\Flysystem\\Cached\\Storage\\Psr6Cache. (no CVSS, topthink/framework)
- [CVE-2022-38323](https://cve.now/CVE-2022-38323.md): Event Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /Royal\_Event/update\_image.ph (no CVSS)
- [CVE-2022-3222](https://cve.now/CVE-2022-3222.md): Uncontrolled Recursion in gpac/gpac (CVSS 5.3, gpac/gpac)
- [CVE-2022-38334](https://cve.now/CVE-2022-38334.md): XPDF v4.04 and earlier was discovered to contain a stack overflow via the function Catalog::countPageTree() at Catalog.cc. (no CVSS)
- [CVE-2022-38850](https://cve.now/CVE-2022-38850.md): The MPlayer Project mencoder SVN-r38374-13.0.1 is vulnerable to Divide By Zero via the function config () of llibmpcodecs/vf\_scale.c. (no CVSS)
- [CVE-2022-38851](https://cve.now/CVE-2022-38851.md): Certain The MPlayer Project products are vulnerable to Out-of-bounds Read via function read\_meta\_record() of mplayer/libmpdemux/asfheader.c. (no CVSS)
- [CVE-2022-38855](https://cve.now/CVE-2022-38855.md): Certain The MPlayer Project products are vulnerable to Buffer Overflow via function gen\_sh\_video () of mplayer/libmpdemux/demux\_mov.c. (no CVSS)
- [CVE-2022-38858](https://cve.now/CVE-2022-38858.md): Certain The MPlayer Project products are vulnerable to Buffer Overflow via function mov\_build\_index() of libmpdemux/demux\_mov.c. (no CVSS)
- [CVE-2022-38860](https://cve.now/CVE-2022-38860.md): Certain The MPlayer Project products are vulnerable to Divide By Zero via function demux\_open\_avi() of libmpdemux/demux\_avi.c which affects (no CVSS)
- [CVE-2022-38861](https://cve.now/CVE-2022-38861.md): The MPlayer Project mplayer SVN-r38374-13.0.1 is vulnerable to memory corruption via function free\_mp\_image() of libmpcodecs/mp\_image.c. (no CVSS)
- [CVE-2022-38863](https://cve.now/CVE-2022-38863.md): Certain The MPlayer Project products are vulnerable to Buffer Overflow via function mp\_getbits() of libmpdemux/mpeg\_hdr.c which affects menc (no CVSS)
- [CVE-2022-38864](https://cve.now/CVE-2022-38864.md): Certain The MPlayer Project products are vulnerable to Buffer Overflow via the function mp\_unescape03() of libmpdemux/mpeg\_hdr.c. (no CVSS)
- [CVE-2022-38865](https://cve.now/CVE-2022-38865.md): Certain The MPlayer Project products are vulnerable to Divide By Zero via the function demux\_avi\_read\_packet of libmpdemux/demux\_avi.c. (no CVSS)
- [CVE-2022-38866](https://cve.now/CVE-2022-38866.md): Certain The MPlayer Project products are vulnerable to Buffer Overflow via read\_avi\_header() of libmpdemux/aviheader.c . (no CVSS)
- [CVE-2022-39209](https://cve.now/CVE-2022-39209.md): Uncontrolled Resource Consumption in cmark-gfm (CVSS 7.5, github cmark-gfm)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-09-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.