CVEs published September 19, 2022
122 CVEs were published on September 19, 2022: 6 critical, 19 high. 2 are now in CISA KEV.
- Published
- 122
- Critical
- 6
- High
- 19
- Medium
- 19
- Low
- 0
- Unrated
- 78
- Now in CISA KEV
- 2
- Fix available
- 14
Most affected products
- Adobe Bridge
- 12
- Trend Micro Apex One
- 6
- Trend Micro Security
- 3
- IBM Spectrum Protect Plus
- 2
- Ketchup Restaurant Reservations
- 2
- BadgeOS
- 1
- Bluetree Co. BigFileAgent
- 1
- cri-o · github.com/cri-o/cri-o
- 1
- Float to Top Button
- 1
- ForgeRock LDAP Connector
- 1
Critical 6
- CVE-2022-0143LDAP Connector: When startTLS is used then LDAP connector ignores the wrong passwordForgeRock LDAP Connector
- CVE-2022-28321The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins.
- CVE-2022-38509Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the booking_id parameter at /admin/budget.php.
- CVE-2022-38887The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.
- CVE-2022-35914/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
- CVE-2022-38339Safe Software FME Server v2021.2.5, v2022.0.0.2 and below contains a cross-site scripting (XSS) vulnerability which allows attackers to exec
High 19
- CVE-2022-28204A denial-of-service issue was discovered in MediaWiki 1.37.x before 1.37.2.
- CVE-2022-38351A vulnerability in Suprema BioStar (aka Bio Star) 2 v2.8.16 allows attackers to escalate privileges to System Administrator via a crafted PU
- CVE-2022-2995Incorrect handling of the supplementary groups in the CRI-O container engine might lead to sensitive information disclosure or possible datacri-o · github.com/cri-o/cri-o
- CVE-2022-23766BigFileAgent arbitrary file execution vulnerabilityBluetree Co. BigFileAgent
- CVE-2022-23767SecureGate authentication bypass vulnerabilityHANSSAK Co. SecureGate · HANSSAK Co. WebLink
- CVE-2022-23768Neo Information Sys. NIS-HAP11AC remote access and manipulation vulnerabilityNeo Information Systems Co. Home AP NIS-HAP11AC
- CVE-2022-40139Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients Trend Micro Apex One
- CVE-2022-40978The installer of JetBrains IntelliJ IDEA before 2022.2.2 was vulnerable to EXE search order hijackingJetBrains IntelliJ IDEA
- CVE-2022-35708Adobe Bridge SGI File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityAdobe Bridge
- CVE-2022-35706Adobe Bridge SVG File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityAdobe Bridge
- CVE-2022-35704Adobe Bridge SVG File Parsing Use-After-Free Remote Code Execution VulnerabilityAdobe Bridge
- CVE-2022-35700Adobe Bridge SVG File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Bridge
- CVE-2022-35702Adobe Bridge SVG File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Bridge
- CVE-2022-35707Adobe Bridge SGI File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Bridge
- CVE-2022-35703Adobe Bridge SVG File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Bridge
- CVE-2022-35705Adobe Bridge MP4 File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Bridge
- CVE-2022-35699Adobe Bridge Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Bridge
- CVE-2022-35701Adobe Bridge SVG File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Bridge
- CVE-2022-38577ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page.
Medium, low and unrated 97
- CVE-2022-38550A stored cross-site scripting (XSS) vulnerability in the /weibo/list component of Jeesns v2.0.0 allows attackers to execute arbitrary web sc
- CVE-2022-38545Valine v1.4.18 was discovered to contain a remote code execution (RCE) vulnerability which allows attackers to execute arbitrary code via a valine
- CVE-2022-38532Micro-Star International Co., Ltd MSI Center 1.0.50.0 was discovered to contain a vulnerability in the component C_Features of MSI.CentralSe
- CVE-2022-35070OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x65fc97.
- CVE-2022-35069OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b544e.
- CVE-2022-35068OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e420d.
- CVE-2022-35067OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e41b0.
- CVE-2022-35066OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e41b8.
- CVE-2022-35065OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x65f724.
- CVE-2022-35064OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x4adcdb in __asan_memset.
- CVE-2022-35063OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e41a8.
- CVE-2022-35062OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6c0bc3.
- CVE-2022-35061OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e412a.
- CVE-2022-35060OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6c0a32.
- CVE-2022-38527UCMS v1.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Import function under the Site Management page.
- CVE-2022-29835WD Discovery's Use of Weak Hashing Algorithm for Code SigningWestern Digital WD Discovery
- CVE-2022-38576Interview Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /interview/delete.php?action=dele
- CVE-2022-40980A potential unathenticated file deletion vulnerabilty on Trend Micro Mobile Security for Enterprise 9.8 SP5 could allow an attacker with accTrend Micro Mobile Security for Enterprise
- CVE-2022-40143A link following local privilege escalation vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service servers could allow Trend Micro Apex One
- CVE-2022-40142A security link following local privilege escalation vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service agents coulTrend Micro Apex One
- CVE-2022-40141A vulnerability in Trend Micro Apex One and Apex One as a Service could allow an attacker to intercept and decode certain communication striTrend Micro Apex One
- CVE-2022-40140An origin validation error vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to cause a denial-ofTrend Micro Apex One
- CVE-2022-38764A vulnerability on Trend Micro HouseCall version 1.62.1.1133 and below could allow a local attacker to escalate privlieges due to an overly Trend Micro HouseCall
- CVE-2022-37348Trend Micro Security 2021 and 2022 (Consumer) is vulnerable to an Out-Of-Bounds Read Information Disclosure Vulnerability that could allow aTrend Micro Security
- CVE-2022-37347Trend Micro Security 2021 and 2022 (Consumer) is vulnerable to an Out-Of-Bounds Read Information Disclosure Vulnerability that could allow aTrend Micro Security
- CVE-2022-34893Trend Micro Security 2022 (consumer) has a link following vulnerability where an attacker with lower privileges could manipulate a mountpoinTrend Micro Security
- CVE-2022-3213A heap buffer overflow issue was found in ImageMagick.ImageMagick
- CVE-2022-40608IBM Spectrum Protect Plus 10.1.6 through 10.1.11 Microsoft File Systems restore operation can download any file on the target machine by manIBM Spectrum Protect Plus
- CVE-2022-40234Versions of IBM Spectrum Protect Plus prior to 10.1.12 (excluding 10.1.12) include the private key information for a certificate inside the IBM Spectrum Protect Plus
- CVE-2022-3218Necta WiFi Mouse (Mouse Server) client-side authentication bypassNecta WiFi Mouse
- CVE-2022-38333Openwrt before v21.02.3 and Openwrt v22.03.0-rc6 were discovered to contain two skip loops in the function header_value().
- CVE-2022-37700Zentao Demo15 is vulnerable to Directory Traversal.
- CVE-2022-40715An issue was discovered in NOKIA 1350OMS R14.2.
- CVE-2022-40714An issue was discovered in NOKIA 1350OMS R14.2.
- CVE-2022-40713An issue was discovered in NOKIA 1350OMS R14.2.
- CVE-2022-40712An issue was discovered in NOKIA 1350OMS R14.2.
- CVE-2022-38425Adobe Bridge DCM File Parsing Use-After-Free Information Disclosure VulnerabilityAdobe Bridge
- CVE-2022-35709Adobe Bridge DCM File Parsing Use-After-Free Information Disclosure VulnerabilityAdobe Bridge
- CVE-2022-38886The d8s-xml for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.
- CVE-2022-38885The d8s-netstrings for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.
- CVE-2022-38884The d8s-grammars for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.
- CVE-2022-38883The d8s-math for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.
- CVE-2022-38882The d8s-json for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.
- CVE-2022-38881The d8s-archives for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.
- CVE-2022-37203JFinal CMS 5.1.0 is vulnerable to SQL Injection.
- CVE-2022-40432The d8s-strings for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.
- CVE-2022-38618SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j_id88, UserForm:j_id90, and UserForm:j_id
- CVE-2022-40430The d8s-utility for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.
- CVE-2022-40428The d8s-mpeg for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.
- CVE-2022-40426The d8s-asns for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.
- CVE-2022-29908The folioupdate service in Fabasoft Cloud Enterprise Client 22.4.0043 allows Local Privilege Escalation.
- CVE-2022-40425The d8s-html for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.
- CVE-2022-40812The d8s-pdfs for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.
- CVE-2022-40431The d8s-pdfs for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.
- CVE-2022-40429The d8s-ip-addresses for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.
- CVE-2022-40810The d8s-ip-addresses for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.
- CVE-2022-40809The d8s-dicts for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.
- CVE-2022-40808The d8s-dates for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.
- CVE-2022-40807The d8s-domains for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.
- CVE-2022-40427The d8s-domains for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.
- CVE-2022-40806The d8s-uuids for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.
- CVE-2022-40811The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.
- CVE-2022-40805The d8s-urls for python 0.1.0, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.
- CVE-2022-40424The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.
- CVE-2022-40067Tenda AC21 V 16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, function: formSetVirtualSer.
- CVE-2022-40068Tenda AC21 V16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, function: formSetQosBand.
- CVE-2022-40069]Tenda AC21 V 16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, function: fromSetSysTime.
- CVE-2022-40070Tenda AC21 V 16.03.08.15 is vulnerable to Buffer Overflow via bin/httpd, function: formSetFirewallCfg.
- CVE-2022-40071Tenda AC21 V 16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, formSetDeviceName.
- CVE-2022-40072Tenda AC21 V 16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, function: setSmartPowerManagement.
- CVE-2022-40073Tenda AC21 V 16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, saveParentControlInfo.
- CVE-2022-40074Tenda AC21 V 16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, setSchedWifi.
- CVE-2022-40075Tenda AC21 V 16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, form_fast_setting_wifi_set.
- CVE-2022-40076Tenda AC21 V16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, function: fromSetWifiGusetBasic.
- CVE-2022-3021Slickr Flickr <= 2.8.1 - Admin+ Stored Cross-Site ScriptingSlickr Flickr
- CVE-2022-3036Gettext override translations < 2.0.0 - Admin+ Stored Cross-Site ScriptingGettext override translations
- CVE-2022-2958BadgeOS < 3.7.1.3 - Subscriber+ SQLiBadgeOS
- CVE-2022-2754Ketchup Restaurant Reservations <= 1.0.0 - Unauthenticated Blind SQLiKetchup Restaurant Reservations
- CVE-2022-2753Ketchup Restaurant Reservations <= 1.0.0 - Unauthenticated Stored XSSKetchup Restaurant Reservations
- CVE-2022-2710Scroll To Top < 1.4.1 - Admin+ Stored Cross-Site ScriptingScroll To Top
- CVE-2022-2709Float to Top Button <= 2.3.6 - Admin+ Stored Cross-Site ScriptingFloat to Top Button
- CVE-2022-2567Form Builder CP < 1.2.32 - Admin+ Stored Cross-Site ScriptingForm Builder CP
- CVE-2022-1591WordPress Ping Optimizer < 2.35.1.3.0 - Arbitrary Settings Update via CSRFWordPress Ping Optimizer
- CVE-2022-1580Site Offline < 1.5.3 - Access BypassSite Offline Or Coming Soon Or Maintenance Mode
- CVE-2022-38880The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.
- CVE-2022-38617SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the voiceAudit:j_id97 parameter at /SVFE2/pages/audit/v
- CVE-2022-40778A stored Cross-Site Scripting (XSS) vulnerability in OPSWAT MetaDefender ICAP Server before 4.13.0 allows attackers to execute arbitrary Jav
- CVE-2022-28201An issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2.
- CVE-2022-28203A denial-of-service issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2.
- CVE-2022-2840Zephyr Project Manager < 3.2.5 - Multiple Unauthenticated SQLiZephyr Project Manager
- CVE-2022-3141Translatepress Multilinugal < 2.3.3 - Admin+ SQLiTranslate Multilingual sites – TranslatePress
- CVE-2022-3142NEX-Forms < 7.9.7 - Authenticated SQLiNEX-Forms – Ultimate Form Builder – Contact forms and much…
- CVE-2022-3239A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers em28xx_usb_probe() for the Empia 28xx based Kernel
- CVE-2022-37032An out-of-bounds read in the BGP daemon of FRRouting FRR before 8.4 may lead to a segmentation fault and denial of service.
- CVE-2022-38341Safe Software FME Server v2021.2.5 and below does not employ server-side validation.
- CVE-2022-40144A vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service could allow an attacker to bypass the product's login authentiTrend Micro Apex One
- CVE-2022-40468Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used.