# CVEs published 2022-09-19

122 CVEs were published on September 19, 2022: 6 critical, 19 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2022-38550](https://cve.now/CVE-2022-38550.md): A stored cross-site scripting (XSS) vulnerability in the /weibo/list component of Jeesns v2.0.0 allows attackers to execute arbitrary web sc (CVSS 5.4)
- [CVE-2022-38545](https://cve.now/CVE-2022-38545.md): Valine v1.4.18 was discovered to contain a remote code execution (RCE) vulnerability which allows attackers to execute arbitrary code via a (no CVSS, valine)
- [CVE-2022-38532](https://cve.now/CVE-2022-38532.md): Micro-Star International Co., Ltd MSI Center 1.0.50.0 was discovered to contain a vulnerability in the component C\_Features of MSI.CentralSe (no CVSS)
- [CVE-2022-35070](https://cve.now/CVE-2022-35070.md): OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x65fc97. (no CVSS)
- [CVE-2022-35069](https://cve.now/CVE-2022-35069.md): OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b544e. (no CVSS)
- [CVE-2022-35068](https://cve.now/CVE-2022-35068.md): OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e420d. (CVSS 6.5)
- [CVE-2022-35067](https://cve.now/CVE-2022-35067.md): OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e41b0. (CVSS 6.5)
- [CVE-2022-35066](https://cve.now/CVE-2022-35066.md): OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e41b8. (CVSS 6.5)
- [CVE-2022-35065](https://cve.now/CVE-2022-35065.md): OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x65f724. (CVSS 6.5)
- [CVE-2022-35064](https://cve.now/CVE-2022-35064.md): OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x4adcdb in \_\_asan\_memset. (CVSS 6.5)
- [CVE-2022-35063](https://cve.now/CVE-2022-35063.md): OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e41a8. (CVSS 6.5)
- [CVE-2022-35062](https://cve.now/CVE-2022-35062.md): OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6c0bc3. (CVSS 6.5)
- [CVE-2022-35061](https://cve.now/CVE-2022-35061.md): OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e412a. (CVSS 6.5)
- [CVE-2022-35060](https://cve.now/CVE-2022-35060.md): OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6c0a32. (CVSS 6.5)
- [CVE-2022-38527](https://cve.now/CVE-2022-38527.md): UCMS v1.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Import function under the Site Management page. (CVSS 6.1)
- [CVE-2022-0143](https://cve.now/CVE-2022-0143.md): LDAP Connector: When startTLS is used then LDAP connector ignores the wrong password (CVSS 9.3, ForgeRock LDAP Connector)
- [CVE-2022-28321](https://cve.now/CVE-2022-28321.md): The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. (CVSS 9.8)
- [CVE-2022-38509](https://cve.now/CVE-2022-38509.md): Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the booking\_id parameter at /admin/budget.php. (CVSS 9.8)
- [CVE-2022-28204](https://cve.now/CVE-2022-28204.md): A denial-of-service issue was discovered in MediaWiki 1.37.x before 1.37.2. (CVSS 7.5)
- [CVE-2022-38351](https://cve.now/CVE-2022-38351.md): A vulnerability in Suprema BioStar (aka Bio Star) 2 v2.8.16 allows attackers to escalate privileges to System Administrator via a crafted PU (CVSS 8.8)
- [CVE-2022-2995](https://cve.now/CVE-2022-2995.md): Incorrect handling of the supplementary groups in the CRI-O container engine might lead to sensitive information disclosure or possible data (CVSS 7.1, cri-o · github.com/cri-o/cri-o)
- [CVE-2022-23766](https://cve.now/CVE-2022-23766.md): BigFileAgent arbitrary file execution vulnerability (CVSS 7.8, Bluetree Co. BigFileAgent)
- [CVE-2022-23767](https://cve.now/CVE-2022-23767.md): SecureGate authentication bypass vulnerability (CVSS 8.8, HANSSAK Co. SecureGate · HANSSAK Co. WebLink)
- [CVE-2022-23768](https://cve.now/CVE-2022-23768.md): Neo Information Sys. NIS-HAP11AC remote access and manipulation vulnerability (CVSS 8.8, Neo Information Systems Co. Home AP NIS-HAP11AC)
- [CVE-2022-29835](https://cve.now/CVE-2022-29835.md): WD Discovery's Use of Weak Hashing Algorithm for Code Signing (CVSS 5.3, Western Digital WD Discovery)
- [CVE-2022-38576](https://cve.now/CVE-2022-38576.md): Interview Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /interview/delete.php?action=dele (no CVSS)
- [CVE-2022-40980](https://cve.now/CVE-2022-40980.md): A potential unathenticated file deletion vulnerabilty on Trend Micro Mobile Security for Enterprise 9.8 SP5 could allow an attacker with acc (no CVSS, Trend Micro Mobile Security for Enterprise)
- [CVE-2022-40143](https://cve.now/CVE-2022-40143.md): A link following local privilege escalation vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service servers could allow (no CVSS, Trend Micro Apex One)
- [CVE-2022-40142](https://cve.now/CVE-2022-40142.md): A security link following local privilege escalation vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service agents coul (no CVSS, Trend Micro Apex One)
- [CVE-2022-40141](https://cve.now/CVE-2022-40141.md): A vulnerability in Trend Micro Apex One and Apex One as a Service could allow an attacker to intercept and decode certain communication stri (no CVSS, Trend Micro Apex One)
- [CVE-2022-40140](https://cve.now/CVE-2022-40140.md): An origin validation error vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to cause a denial-of (no CVSS, Trend Micro Apex One)
- [CVE-2022-40139](https://cve.now/CVE-2022-40139.md): Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients (CVSS 7.2, KEV, Trend Micro Apex One)
- [CVE-2022-38764](https://cve.now/CVE-2022-38764.md): A vulnerability on Trend Micro HouseCall version 1.62.1.1133 and below could allow a local attacker to escalate privlieges due to an overly (no CVSS, Trend Micro HouseCall)
- [CVE-2022-37348](https://cve.now/CVE-2022-37348.md): Trend Micro Security 2021 and 2022 (Consumer) is vulnerable to an Out-Of-Bounds Read Information Disclosure Vulnerability that could allow a (no CVSS, Trend Micro Security)
- [CVE-2022-37347](https://cve.now/CVE-2022-37347.md): Trend Micro Security 2021 and 2022 (Consumer) is vulnerable to an Out-Of-Bounds Read Information Disclosure Vulnerability that could allow a (CVSS 5.5, Trend Micro Security)
- [CVE-2022-34893](https://cve.now/CVE-2022-34893.md): Trend Micro Security 2022 (consumer) has a link following vulnerability where an attacker with lower privileges could manipulate a mountpoin (no CVSS, Trend Micro Security)
- [CVE-2022-3213](https://cve.now/CVE-2022-3213.md): A heap buffer overflow issue was found in ImageMagick. (no CVSS, ImageMagick)
- [CVE-2022-40608](https://cve.now/CVE-2022-40608.md): IBM Spectrum Protect Plus 10.1.6 through 10.1.11 Microsoft File Systems restore operation can download any file on the target machine by man (CVSS 5.9, IBM Spectrum Protect Plus)
- [CVE-2022-40234](https://cve.now/CVE-2022-40234.md): Versions of IBM Spectrum Protect Plus prior to 10.1.12 (excluding 10.1.12) include the private key information for a certificate inside the (CVSS 5.9, IBM Spectrum Protect Plus)
- [CVE-2022-3218](https://cve.now/CVE-2022-3218.md): Necta WiFi Mouse (Mouse Server) client-side authentication bypass (no CVSS, Necta WiFi Mouse)
- [CVE-2022-38333](https://cve.now/CVE-2022-38333.md): Openwrt before v21.02.3 and Openwrt v22.03.0-rc6 were discovered to contain two skip loops in the function header\_value(). (no CVSS)
- [CVE-2022-40978](https://cve.now/CVE-2022-40978.md): The installer of JetBrains IntelliJ IDEA before 2022.2.2 was vulnerable to EXE search order hijacking (CVSS 7.5, JetBrains IntelliJ IDEA)
- [CVE-2022-37700](https://cve.now/CVE-2022-37700.md): Zentao Demo15 is vulnerable to Directory Traversal. (no CVSS)
- [CVE-2022-40715](https://cve.now/CVE-2022-40715.md): An issue was discovered in NOKIA 1350OMS R14.2. (no CVSS)
- [CVE-2022-40714](https://cve.now/CVE-2022-40714.md): An issue was discovered in NOKIA 1350OMS R14.2. (no CVSS)
- [CVE-2022-40713](https://cve.now/CVE-2022-40713.md): An issue was discovered in NOKIA 1350OMS R14.2. (CVSS 6.5)
- [CVE-2022-40712](https://cve.now/CVE-2022-40712.md): An issue was discovered in NOKIA 1350OMS R14.2. (CVSS 6.1)
- [CVE-2022-38425](https://cve.now/CVE-2022-38425.md): Adobe Bridge DCM File Parsing Use-After-Free Information Disclosure Vulnerability (CVSS 5.5, Adobe Bridge)
- [CVE-2022-35708](https://cve.now/CVE-2022-35708.md): Adobe Bridge SGI File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Adobe Bridge)
- [CVE-2022-35706](https://cve.now/CVE-2022-35706.md): Adobe Bridge SVG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Adobe Bridge)
- [CVE-2022-35709](https://cve.now/CVE-2022-35709.md): Adobe Bridge DCM File Parsing Use-After-Free Information Disclosure Vulnerability (CVSS 5.5, Adobe Bridge)
- [CVE-2022-35704](https://cve.now/CVE-2022-35704.md): Adobe Bridge SVG File Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Bridge)
- [CVE-2022-35700](https://cve.now/CVE-2022-35700.md): Adobe Bridge SVG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Bridge)
- [CVE-2022-35702](https://cve.now/CVE-2022-35702.md): Adobe Bridge SVG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Bridge)
- [CVE-2022-35707](https://cve.now/CVE-2022-35707.md): Adobe Bridge SGI File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Bridge)
- [CVE-2022-35703](https://cve.now/CVE-2022-35703.md): Adobe Bridge SVG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Bridge)
- [CVE-2022-35705](https://cve.now/CVE-2022-35705.md): Adobe Bridge MP4 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Bridge)
- [CVE-2022-35699](https://cve.now/CVE-2022-35699.md): Adobe Bridge Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Bridge)
- [CVE-2022-35701](https://cve.now/CVE-2022-35701.md): Adobe Bridge SVG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Bridge)
- [CVE-2022-38577](https://cve.now/CVE-2022-38577.md): ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page. (CVSS 8.8)
- [CVE-2022-38887](https://cve.now/CVE-2022-38887.md): The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (CVSS 9.8)
- [CVE-2022-38886](https://cve.now/CVE-2022-38886.md): The d8s-xml for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (no CVSS)
- [CVE-2022-38885](https://cve.now/CVE-2022-38885.md): The d8s-netstrings for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (no CVSS)
- [CVE-2022-38884](https://cve.now/CVE-2022-38884.md): The d8s-grammars for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (no CVSS)
- [CVE-2022-38883](https://cve.now/CVE-2022-38883.md): The d8s-math for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (no CVSS)
- [CVE-2022-38882](https://cve.now/CVE-2022-38882.md): The d8s-json for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (no CVSS)
- [CVE-2022-38881](https://cve.now/CVE-2022-38881.md): The d8s-archives for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (no CVSS)
- [CVE-2022-37203](https://cve.now/CVE-2022-37203.md): JFinal CMS 5.1.0 is vulnerable to SQL Injection. (no CVSS)
- [CVE-2022-40432](https://cve.now/CVE-2022-40432.md): The d8s-strings for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (no CVSS)
- [CVE-2022-38618](https://cve.now/CVE-2022-38618.md): SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j\_id88, UserForm:j\_id90, and UserForm:j\_id (no CVSS)
- [CVE-2022-40430](https://cve.now/CVE-2022-40430.md): The d8s-utility for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (no CVSS)
- [CVE-2022-40428](https://cve.now/CVE-2022-40428.md): The d8s-mpeg for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (no CVSS)
- [CVE-2022-40426](https://cve.now/CVE-2022-40426.md): The d8s-asns for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (no CVSS)
- [CVE-2022-29908](https://cve.now/CVE-2022-29908.md): The folioupdate service in Fabasoft Cloud Enterprise Client 22.4.0043 allows Local Privilege Escalation. (no CVSS)
- [CVE-2022-40425](https://cve.now/CVE-2022-40425.md): The d8s-html for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (no CVSS)
- [CVE-2022-40812](https://cve.now/CVE-2022-40812.md): The d8s-pdfs for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (no CVSS)
- [CVE-2022-40431](https://cve.now/CVE-2022-40431.md): The d8s-pdfs for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (no CVSS)
- [CVE-2022-40429](https://cve.now/CVE-2022-40429.md): The d8s-ip-addresses for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (no CVSS)
- [CVE-2022-40810](https://cve.now/CVE-2022-40810.md): The d8s-ip-addresses for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (no CVSS)
- [CVE-2022-40809](https://cve.now/CVE-2022-40809.md): The d8s-dicts for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (no CVSS)
- [CVE-2022-40808](https://cve.now/CVE-2022-40808.md): The d8s-dates for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (no CVSS)
- [CVE-2022-40807](https://cve.now/CVE-2022-40807.md): The d8s-domains for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (no CVSS)
- [CVE-2022-40427](https://cve.now/CVE-2022-40427.md): The d8s-domains for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (no CVSS)
- [CVE-2022-40806](https://cve.now/CVE-2022-40806.md): The d8s-uuids for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (no CVSS)
- [CVE-2022-40811](https://cve.now/CVE-2022-40811.md): The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (no CVSS)
- [CVE-2022-40805](https://cve.now/CVE-2022-40805.md): The d8s-urls for python 0.1.0, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (no CVSS)
- [CVE-2022-40424](https://cve.now/CVE-2022-40424.md): The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (no CVSS)
- [CVE-2022-40067](https://cve.now/CVE-2022-40067.md): Tenda AC21 V 16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, function: formSetVirtualSer. (no CVSS)
- [CVE-2022-40068](https://cve.now/CVE-2022-40068.md): Tenda AC21 V16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, function: formSetQosBand. (no CVSS)
- [CVE-2022-40069](https://cve.now/CVE-2022-40069.md): \]Tenda AC21 V 16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, function: fromSetSysTime. (no CVSS)
- [CVE-2022-40070](https://cve.now/CVE-2022-40070.md): Tenda AC21 V 16.03.08.15 is vulnerable to Buffer Overflow via bin/httpd, function: formSetFirewallCfg. (no CVSS)
- [CVE-2022-40071](https://cve.now/CVE-2022-40071.md): Tenda AC21 V 16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, formSetDeviceName. (no CVSS)
- [CVE-2022-40072](https://cve.now/CVE-2022-40072.md): Tenda AC21 V 16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, function: setSmartPowerManagement. (no CVSS)
- [CVE-2022-40073](https://cve.now/CVE-2022-40073.md): Tenda AC21 V 16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, saveParentControlInfo. (no CVSS)
- [CVE-2022-40074](https://cve.now/CVE-2022-40074.md): Tenda AC21 V 16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, setSchedWifi. (no CVSS)
- [CVE-2022-40075](https://cve.now/CVE-2022-40075.md): Tenda AC21 V 16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, form\_fast\_setting\_wifi\_set. (no CVSS)
- [CVE-2022-40076](https://cve.now/CVE-2022-40076.md): Tenda AC21 V16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, function: fromSetWifiGusetBasic. (no CVSS)
- [CVE-2022-3021](https://cve.now/CVE-2022-3021.md): Slickr Flickr \<= 2.8.1 - Admin+ Stored Cross-Site Scripting (no CVSS, Slickr Flickr)
- [CVE-2022-3036](https://cve.now/CVE-2022-3036.md): Gettext override translations \< 2.0.0 - Admin+ Stored Cross-Site Scripting (no CVSS, Gettext override translations)
- [CVE-2022-2958](https://cve.now/CVE-2022-2958.md): BadgeOS \< 3.7.1.3 - Subscriber+ SQLi (no CVSS, BadgeOS)
- [CVE-2022-2754](https://cve.now/CVE-2022-2754.md): Ketchup Restaurant Reservations \<= 1.0.0 - Unauthenticated Blind SQLi (no CVSS, Ketchup Restaurant Reservations)
- [CVE-2022-2753](https://cve.now/CVE-2022-2753.md): Ketchup Restaurant Reservations \<= 1.0.0 - Unauthenticated Stored XSS (no CVSS, Ketchup Restaurant Reservations)
- [CVE-2022-2710](https://cve.now/CVE-2022-2710.md): Scroll To Top \< 1.4.1 - Admin+ Stored Cross-Site Scripting (no CVSS, Scroll To Top)
- [CVE-2022-2709](https://cve.now/CVE-2022-2709.md): Float to Top Button \<= 2.3.6 - Admin+ Stored Cross-Site Scripting (no CVSS, Float to Top Button)
- [CVE-2022-2567](https://cve.now/CVE-2022-2567.md): Form Builder CP \< 1.2.32 - Admin+ Stored Cross-Site Scripting (no CVSS, Form Builder CP)
- [CVE-2022-1591](https://cve.now/CVE-2022-1591.md): WordPress Ping Optimizer \< 2.35.1.3.0 - Arbitrary Settings Update via CSRF (no CVSS, WordPress Ping Optimizer)
- [CVE-2022-1580](https://cve.now/CVE-2022-1580.md): Site Offline \< 1.5.3 - Access Bypass (no CVSS, Site Offline Or Coming Soon Or Maintenance Mode)
- [CVE-2022-38880](https://cve.now/CVE-2022-38880.md): The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. (no CVSS)
- [CVE-2022-38617](https://cve.now/CVE-2022-38617.md): SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the voiceAudit:j\_id97 parameter at /SVFE2/pages/audit/v (no CVSS)
- [CVE-2022-40778](https://cve.now/CVE-2022-40778.md): A stored Cross-Site Scripting (XSS) vulnerability in OPSWAT MetaDefender ICAP Server before 4.13.0 allows attackers to execute arbitrary Jav (no CVSS)
- [CVE-2022-28201](https://cve.now/CVE-2022-28201.md): An issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. (no CVSS)
- [CVE-2022-28203](https://cve.now/CVE-2022-28203.md): A denial-of-service issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. (no CVSS)
- [CVE-2022-2840](https://cve.now/CVE-2022-2840.md): Zephyr Project Manager \< 3.2.5 - Multiple Unauthenticated SQLi (no CVSS, Zephyr Project Manager)
- [CVE-2022-3141](https://cve.now/CVE-2022-3141.md): Translatepress Multilinugal \< 2.3.3 - Admin+ SQLi (no CVSS, Translate Multilingual sites – TranslatePress)
- [CVE-2022-3142](https://cve.now/CVE-2022-3142.md): NEX-Forms \< 7.9.7 - Authenticated SQLi (no CVSS, NEX-Forms – Ultimate Form Builder – Contact forms and much…)
- [CVE-2022-3239](https://cve.now/CVE-2022-3239.md): A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers em28xx\_usb\_probe() for the Empia 28xx based (no CVSS, Kernel)
- [CVE-2022-35914](https://cve.now/CVE-2022-35914.md): /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection. (CVSS 9.8, KEV)
- [CVE-2022-37032](https://cve.now/CVE-2022-37032.md): An out-of-bounds read in the BGP daemon of FRRouting FRR before 8.4 may lead to a segmentation fault and denial of service. (no CVSS)
- [CVE-2022-38339](https://cve.now/CVE-2022-38339.md): Safe Software FME Server v2021.2.5, v2022.0.0.2 and below contains a cross-site scripting (XSS) vulnerability which allows attackers to exec (CVSS 9.6)
- [CVE-2022-38341](https://cve.now/CVE-2022-38341.md): Safe Software FME Server v2021.2.5 and below does not employ server-side validation. (no CVSS)
- [CVE-2022-40144](https://cve.now/CVE-2022-40144.md): A vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service could allow an attacker to bypass the product's login authenti (no CVSS, Trend Micro Apex One)
- [CVE-2022-40468](https://cve.now/CVE-2022-40468.md): Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-09-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.