CVEs published September 20, 2022
96 CVEs were published on September 20, 2022: 13 critical, 51 high. 1 is now in CISA KEV.
- Published
- 96
- Critical
- 13
- High
- 51
- Medium
- 26
- Low
- 1
- Unrated
- 5
- Now in CISA KEV
- 1
- Fix available
- 33
Most affected products
- Aruba ClearPass Policy Manager
- 14
- Apple iOS · Apple macOS
- 6
- AMI Aptio
- 5
- Apple macOS
- 5
- HPE Integrated Lights-Out
- 4
- OWASP ModSecurity Core Rule Set
- 4
- yetiforcecompany/yetiforcecrm · yetiforce/yetiforce-crm
- 4
- Apple iOS · Apple Safari
- 3
- Intel(R) SSD DC
- 3
- Apple iOS
- 2
Critical 13
- CVE-2022-38619SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j_id90 parameter at /SVFE2/pages/feegroups
- CVE-2022-32882This issue was addressed with improved checks.Apple macOS
- CVE-2022-32788A buffer overflow was addressed with improved bounds checking.Apple macOS · Apple tvOS +1
- CVE-2022-40357A security issue was discovered in Z-BlogPHP <= 1.7.2.
- CVE-2022-40009SWFTools commit 772e55a was discovered to contain a heap-use-after-free via the function grow_unicode at /lib/ttf.c.
- CVE-2022-40008SWFTools commit 772e55a was discovered to contain a heap-buffer overflow via the function readU8 at /lib/ttf.c.
- CVE-2022-37265Prototype pollution vulnerability in stealjs steal 2.2.4 via the alias variable in babel.js.steal
- CVE-2017-20148In the ebuild package through logcheck-1.3.23.ebuild for Logcheck on Gentoo, it is possible to achieve root privilege escalation from the lo
- CVE-2022-41138In Zutty before 0.13, DECRQSS in text written to the terminal can achieve arbitrary code execution.
- CVE-2022-37204Final CMS 5.1.0 is vulnerable to SQL Injection.
- CVE-2022-38916A file upload vulnerability exists in the storage feature of pagekit 1.0.18, which allows an attacker to upload malicious filespagekit/pagekit
- CVE-2022-2177SQL Injection in KayrasoftKayrasoft
- CVE-2022-38340Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a Path Traversal vulnerability via the component fmedata
High 51
- CVE-2022-39221Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') McWebserver Minecraft ModJ-onasJones McWebserver
- CVE-2022-32802A logic issue was addressed with improved checks.Apple macOS · Apple tvOS
- CVE-2022-26696This issue was addressed with improved environment sanitization.Apple macOS
- CVE-2022-23685A vulnerability in the ClearPass Policy Manager web-based management interface exists which exposes some endpoints to a lack of Cross-Site RAruba ClearPass Policy Manager
- CVE-2022-23692Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQAruba ClearPass Policy Manager
- CVE-2022-23693Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQAruba ClearPass Policy Manager
- CVE-2022-23695Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQAruba ClearPass Policy Manager
- CVE-2022-23694Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQAruba ClearPass Policy Manager
- CVE-2022-28637A local Denial of Service (DoS) and local arbitrary code execution vulnerability that could potentially lead to a loss of confidentiality, iHPE Integrated Lights-Out
- CVE-2022-28639A remote potential adjacent denial of service (DoS) and potential adjacent arbitrary code execution vulnerability that could potentially leaHPE Integrated Lights-Out
- CVE-2022-28638An isolated local disclosure of information and potential isolated local arbitrary code execution vulnerability that could potentially lead HPE Integrated Lights-Out
- CVE-2022-23696Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQAruba ClearPass Policy Manager
- CVE-2022-28640A potential local adjacent arbitrary code execution vulnerability that could potentially lead to a loss of confidentiality, integrity, and aHPE Integrated Lights-Out
- CVE-2022-37877A vulnerability in the ClearPass OnGuard macOS agent could allow malicious users on a macOS instance to elevate their user privileges.Aruba ClearPass Policy Manager
- CVE-2022-37880Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands onAruba ClearPass Policy Manager
- CVE-2022-38931A Server-Side Request Forgery (SSRF) in fetch_net_file_upload function of baijiacmsV4 v4.1.4 allows remote attackers to force the applicatio
- CVE-2022-37878Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands onAruba ClearPass Policy Manager
- CVE-2022-37879Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands onAruba ClearPass Policy Manager
- CVE-2022-37884A vulnerability exists in the ClearPass Policy Manager Guest User Interface that can allow an unauthenticated attacker to send specific operAruba ClearPass Policy Manager
- CVE-2022-37881Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands onAruba ClearPass Policy Manager
- CVE-2022-37882Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands onAruba ClearPass Policy Manager
- CVE-2022-37883Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands onAruba ClearPass Policy Manager
- CVE-2022-39218Random number seed fixed during compilationfastly js-compute-runtime · @fastly/js-compute
- CVE-2022-37395A Huawei device has an input verification vulnerability.CV81-WDM FW
- CVE-2022-30579TIBCO Spotfire Server Blind SSRF vulnerabilityTIBCO Software TIBCO Spotfire Analytics Platform for AWS Ma…
- CVE-2022-38955An exploitable firmware modification vulnerability was discovered on the Netgear WPN824EXT WiFi Range Extender.
- CVE-2022-37205JFinal CMS 5.1.0 is affected by: SQL Injection.
- CVE-2022-40262The arbitrary write vulnerability in S3Resume2Pei leads to arbitrary code execution during PEI phase.AMI Aptio
- CVE-2022-40261SMM memory corruption vulnerability in OverClockSmiHandler SMM driverAMI Aptio
- CVE-2022-40250Stack overflow vulnerability in SMI handler on SmmSmbiosElog.AMI Aptio
- CVE-2022-40246Arbitrary write vulnerability in SbPei module leads to arbitrary code execution during PEI phase.AMI Aptio
- CVE-2022-26873The stack buffer overflow vulnerability in PlatformInitAdvancedPreMem leads to arbitrary code execution during PEI phase.AMI Aptio
- CVE-2022-37259A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the string variable in babel.js.steal
- CVE-2022-39974WASM3 v0.5.0 was discovered to contain a segmentation fault via the component op_Select_i32_srs in wasm3/source/m3_exec.h.pywasm3 · wasm3
- CVE-2016-20015In the ebuild package through smokeping-2.7.3-r1 for SmokePing on Gentoo, the initscript allows the smokeping user to gain ownership of any
- CVE-2022-35196TestLink v1.9.20 was discovered to contain a Cross-Site Request Forgery (CSRF) via /lib/plan/planView.php.
- CVE-2021-33081Protection mechanism failure in firmware for some Intel(R) SSD DC Products may allow a privileged user to potentially enable information disIntel(R) SSD DC
- CVE-2022-40955Deserialization attack in Apache InLong prior to version 1.3.0 allows RCE via JDBCApache Software Foundation Apache InLong · org.apache.inlon…
- CVE-2022-3079Festo: CPX-CEC-C1 and CMXX, Missing Authentication for Critical Webpage FunctionFESTO Control block CPX-CEC-C1 · FESTO Control block CPX-CM…
- CVE-2022-34917Unauthenticated clients may cause OutOfMemoryError on Apache Kafka BrokersApache Software Foundation Apache Kafka · org.apache.kafka:…
- CVE-2022-2924Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrmyetiforcecompany/yetiforcecrm · yetiforce/yetiforce-crm
- CVE-2022-32886A buffer overflow issue was addressed with improved memory handling.Apple iOS · Apple Safari
- CVE-2022-32908A memory corruption issue was addressed with improved input validation.Apple iOS · Apple macOS
- CVE-2022-32911The issue was addressed with improved memory handling.Apple iOS · Apple macOS
- CVE-2022-32912An out-of-bounds read was addressed with improved bounds checking.Apple iOS · Apple Safari
- CVE-2022-32917The issue was addressed with improved bounds checks.Apple iOS · Apple macOS
- CVE-2022-37972Microsoft Endpoint Configuration Manager Spoofing VulnerabilityMicrosoft Endpoint Configuration Manager
- CVE-2022-39955Partial rule set bypass in OWASP ModSecurity Core Rule Set by submitting a specially crafted HTTP Content-Type headerOWASP ModSecurity Core Rule Set
- CVE-2022-39956Partial rule set bypass in OWASP ModSecurity Core Rule Set for HTTP multipart requests using character encoding in the Content-Type or Content-Transfer-Encoding headerOWASP ModSecurity Core Rule Set
- CVE-2022-39957Response body bypass in OWASP ModSecurity Core Rule Set via a specialy crafted charset in the HTTP Accept headerOWASP ModSecurity Core Rule Set
- CVE-2022-39958Response body bypass in OWASP ModSecurity Core Rule Set via repeated HTTP Range header submission with a small byte rangeOWASP ModSecurity Core Rule Set
Medium, low and unrated 32
- CVE-2022-35085SWFTools commit 772e55a2 was discovered to contain a memory leak via /lib/mem.c.
- CVE-2022-35086SWFTools commit 772e55a2 was discovered to contain a segmentation violation via /multiarch/memmove-vec-unaligned-erms.S.
- CVE-2022-35087SWFTools commit 772e55a2 was discovered to contain a segmentation violation via MovieAddFrame at /src/gif2swf.c.
- CVE-2022-35088SWFTools commit 772e55a2 was discovered to contain a heap buffer-overflow via getGifDelayTime at /home/bupt/Desktop/swftools/src/src/gif2swf
- CVE-2022-35089SWFTools commit 772e55a2 was discovered to contain a heap-buffer-overflow via getTransparentColor at /home/bupt/Desktop/swftools/src/gif2swf
- CVE-2022-35090SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via __asan_memcpy at /asan/asan_interceptors_memintrinsics.cpp:.
- CVE-2022-39220XSS Vulnerabilities in WebClientdrakkan sftpgo · github.com/drakkan/sftpgo +1
- CVE-2022-32880This issue was addressed by enabling hardened runtime.Apple macOS
- CVE-2022-32861A logic issue was addressed with improved state management.Apple macOS
- CVE-2021-46835There is a traffic hijacking vulnerability in WS7200-10 11.0.2.13.WS7200-10
- CVE-2021-46834A permission bypass vulnerability in Huawei cross device task management could allow an attacker to access certain resource in the attacked JAD-AL50
- CVE-2022-33735There is a password verification vulnerability in WS7200-10 11.0.2.13.WS7200-10
- CVE-2020-36602There is an out-of-bounds read and write vulnerability in some headset products.576up005 HOTA-CM-H-Shark-BD;577HOTA-CM-H-Shark-BD;581up-HOT…
- CVE-2022-38956An exploitable firmware downgrade vulnerability was discovered on the Netgear WPN824EXT WiFi Range Extender.
- CVE-2017-20147In the ebuild package through smokeping-2.7.3-r1 for SmokePing on Gentoo, the initscript uses a PID file that is writable by the smokeping u
- CVE-2022-32167Cloudreve - Stored XSSCloudreve · github.com/HFO4/cloudreve +1
- CVE-2021-33076Improper authentication in firmware for some Intel(R) SSD DC Products may allow an unauthenticated user to potentially enable escalation of Intel(R) SSD DC
- CVE-2021-33079Protection mechanism failure in firmware for some Intel(R) SSD DC Products may allow a privileged user to potentially enable information disIntel(R) SSD DC
- CVE-2022-3245 Code Injection in display of tag title on saving tags in microweber/microwebermicroweber/microweber
- CVE-2022-3005Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrmyetiforcecompany/yetiforcecrm · yetiforce/yetiforce-crm
- CVE-2022-3242HTML code Injection in template search keyword in microweber/microwebermicroweber/microweber
- CVE-2022-3004Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrmyetiforcecompany/yetiforcecrm · yetiforce/yetiforce-crm
- CVE-2022-3000Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrmyetiforcecompany/yetiforcecrm · yetiforce/yetiforce-crm
- CVE-2022-34746An insufficient entropy vulnerability caused by the improper use of randomness sources with low entropy for RSA key pair generation was founZyxel GS1900 series firmware
- CVE-2022-32795This issue was addressed with improved checks.Apple iOS
- CVE-2022-32854This issue was addressed with improved checks.Apple iOS · Apple macOS
- CVE-2022-32863A memory corruption issue was addressed with improved state management.Apple macOS
- CVE-2022-32864The issue was addressed with improved memory handling.Apple iOS · Apple macOS
- CVE-2022-32868A logic issue was addressed with improved state management.Apple iOS · Apple Safari
- CVE-2022-32872A logic issue was addressed with improved restrictions.Apple iOS
- CVE-2022-32883A logic issue was addressed with improved restrictions.Apple iOS · Apple macOS
- CVE-2022-35957Authentication Bypass in Grafana via auth proxy allowing escalation from admin to server admingrafana · github.com/grafana/grafana