CVEs published September 21, 2022
92 CVEs were published on September 21, 2022: 11 critical, 30 high.
- Published
- 92
- Critical
- 11
- High
- 30
- Medium
- 47
- Low
- 3
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 30
Most affected products
- ISC BIND9
- 6
- keylime
- 6
- Jenkins project Jenkins CONS3RT Plugin · org.jenkins-ci.plu…
- 4
- Jenkins project Jenkins Build-Publisher Plugin · org.jenkin…
- 3
- Jenkins project Jenkins DotCi Plugin · com.groupon.jenkins-…
- 3
- Jenkins project Jenkins NS-ND Integration Performance Publi…
- 3
- octoprint/octoprint · octoprint
- 3
- Apache Software Foundation Apache Airflow · apache-airflow
- 2
- ikus060/rdiffweb · rdiffweb
- 2
- Jenkins project Jenkins BigPanda Notifier Plugin · org.jenk…
- 2
Critical 11
- CVE-2022-36386WordPress Import any XML or CSV File to WordPress plugin <= 3.6.7 - Authenticated Arbitrary Code Execution vulnerabilitySoflyy Import any XML or CSV File to WordPress
- CVE-2021-43310A vulnerability in Keylime before 6.3.0 allows an attacker to craft a request to the agent that resets the U and V keys as if the agent werekeylime
- CVE-2022-40030SourceCodester Simple Task Managing System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at changeSt
- CVE-2022-41241Jenkins RQM Plugin 2.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins project Jenkins RQM Plugin · net.praqma:rqm-plugin
- CVE-2022-41238A missing permission check in Jenkins DotCi Plugin 2.40.00 and earlier allows unauthenticated attackers to trigger builds of jobs correspondJenkins project Jenkins DotCi Plugin · com.groupon.jenkins-…
- CVE-2022-41237Jenkins DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a Jenkins project Jenkins DotCi Plugin · com.groupon.jenkins-…
- CVE-2022-41226Jenkins Compuware Common Configuration Plugin 1.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attaJenkins project Jenkins Compuware Common Configuration Plug…
- CVE-2022-0495SQL Injection in KOHAParantez Teknoloji
- CVE-2022-2315SQL Injection in Database Accreditation SystemDatabase Software
- CVE-2022-41220md2roff 1.9 has a stack-based buffer overflow via a Markdown file, a different vulnerability than CVE-2022-34913.
- CVE-2022-37026In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-cert
High 30
- CVE-2022-39224Arbitrary shell execution when extracting or listing files contained in a malicious rpm.jordansissel ruby-arr-pm · arr-pm
- CVE-2022-35895An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5.
- CVE-2022-28802Code by Zapier before 2022-08-17 allowed intra-account privilege escalation that included execution of Python or JavaScript code.
- CVE-2022-23952In Keylime before 6.3.0, current keylime installer installs the keylime.conf file, which can contain sensitive data, as world-readable.keylime
- CVE-2022-23950In Keylime before 6.3.0, Revocation Notifier uses a fixed /tmp path for UNIX domain socket which can allow unprivileged users a method to prkeylime
- CVE-2022-23949In Keylime before 6.3.0, unsanitized UUIDs can be passed by a rogue agent and can lead to log spoofing on the verifier and registrar.keylime
- CVE-2022-23948A flaw was found in Keylime before 6.3.0.keylime
- CVE-2022-30578TIBCO EBX Add-ons Stored XSS vulnerabilityTIBCO Software TIBCO EBX Add-ons
- CVE-2022-30577TIBCO EBX Stored XSS vulnerabilityTIBCO Software TIBCO EBX
- CVE-2022-40026SourceCodester Simple Task Managing System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at board.ph
- CVE-2022-3251Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in ikus060/minarcaikus060/minarca
- CVE-2022-37027Ahsay AhsayCBS 9.1.4.0 allows an authenticated system user to inject arbitrary Java JVM options.
- CVE-2022-41253A cross-site request forgery (CSRF) vulnerability in Jenkins CONS3RT Plugin 1.0.0 and earlier allows attackers to connect to an attacker-speJenkins project Jenkins CONS3RT Plugin · org.jenkins-ci.plu…
- CVE-2022-41249A cross-site request forgery (CSRF) vulnerability in Jenkins SCM HttpClient Plugin 1.5 and earlier allows attackers to connect to an attackeJenkins project Jenkins SCM HttpClient Plugin · com.meowlom…
- CVE-2022-41244Jenkins View26 Test-Reporting Plugin 1.0.7 and earlier does not perform hostname validation when connecting to the configured View26 server Jenkins project Jenkins View26 Test-Reporting Plugin · org.…
- CVE-2022-41245A cross-site request forgery (CSRF) vulnerability in Jenkins Worksoft Execution Manager Plugin 10.0.3.503 and earlier allows attackers to coJenkins project Jenkins Worksoft Execution Manager Plugin ·…
- CVE-2022-41243Jenkins SmallTest Plugin 1.0.4 and earlier does not perform hostname validation when connecting to the configured View26 server that could bJenkins project Jenkins SmallTest Plugin · com.smalltest:sm…
- CVE-2022-41236A cross-site request forgery (CSRF) vulnerability in Jenkins Security Inspector Plugin 117.v6eecc36919c2 and earlier allows attackers to repJenkins project Jenkins Security Inspector Plugin · org.jen…
- CVE-2022-41234Jenkins Rundeck Plugin 3.6.11 and earlier does not protect access to the /plugin/rundeck/webhook/ endpoint, allowing users with Overall/ReadJenkins project Jenkins Rundeck Plugin · org.jenkins-ci.plu…
- CVE-2022-41232A cross-site request forgery (CSRF) vulnerability in Jenkins Build-Publisher Plugin 1.22 and earlier allows attackers to replace any config.Jenkins project Jenkins Build-Publisher Plugin · org.jenkin…
- CVE-2022-41228A missing permission check in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attackers with Overall/ReaJenkins project Jenkins NS-ND Integration Performance Publi…
- CVE-2022-41227A cross-site request forgery (CSRF) vulnerability in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attJenkins project Jenkins NS-ND Integration Performance Publi…
- CVE-2022-2265Path traversal in Identity and Directory Management SystemÇekino Bilgi Teknolojileri
- CVE-2022-38928XPDF 4.04 is vulnerable to Null Pointer Dereference in FoFiType1C.cc:2393.
- CVE-2022-3080BIND 9 resolvers configured to answer from stale cache with zero stale-answer-client-timeout may terminate unexpectedlyISC BIND9
- CVE-2022-38178Memory leaks in EdDSA DNSSEC verification codeISC BIND9
- CVE-2022-38177Memory leak in ECDSA DNSSEC verification codeISC BIND9
- CVE-2022-2906Memory leaks in code handling Diffie-Hellman key exchange via TKEY RRs (OpenSSL 3.0.0+ only)ISC BIND9
- CVE-2022-40604Format String VulnerabilityApache Software Foundation Apache Airflow · apache-airflow
- CVE-2022-41222mm/mremap.c in the Linux kernel before 5.13.3 has a use-after-free via a stale TLB because an rmap lock is not held during a PUD move.:linux_kernel:
Medium, low and unrated 51
- CVE-2022-28982A cross-site scripting (XSS) vulnerability in Liferay Portal v7.3.3 through v7.4.2 and Liferay DXP v7.3 before service pack 3 allows attackecom.liferay:com.liferay.asset.taglib
- CVE-2022-28978Stored cross-site scripting (XSS) vulnerability in the Site module's user membership administration page in Liferay Portal 7.0.1 through 7.4com.liferay:com.liferay.site.memberships.web · com.liferay.…
- CVE-2022-39975The Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update 10, and 7.4 before update 35 does not check com.liferay.portal:release.portal.bom
- CVE-2022-35896An issue SMM memory leak vulnerability in SMM driver (SMRAM was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5.
- CVE-2022-28979Liferay Portal v7.1.0 through v7.4.2 and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was discocom.liferay:com.liferay.portal.search.web · com.liferay.por…
- CVE-2022-3233Cross-Site Request Forgery (CSRF) in ikus060/rdiffwebikus060/rdiffweb · rdiffweb
- CVE-2022-40217WordPress WPide plugin <= 2.6 - Authenticated Arbitrary File Edit/Upload vulnerabilityXplodedThemes WPIDE – File Manager & Code Editor
- CVE-2022-38073WordPress Awesome Support plugin <= 6.0.7 - Multiple Authenticated Persistent XSS (Additional Interested Parties)Awesome Support Team Awesome Support · awesome-support/awes…
- CVE-2022-36365WordPress WHA Crossword plugin <= 1.1.10 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilitiesWHA Crossword
- CVE-2022-36383WordPress Word Search Puzzles game plugin <= 2.0.1 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilitiesWHA Word Search Puzzles game
- CVE-2022-36390WordPress Event Calendar – Calendar plugin <= 1.4.6 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilityTotalsoft Event Calendar – Calendar
- CVE-2022-40219WordPress FavIcon Switcher plugin <= 1.2.11 - Cross-Site Request Forgery (CSRF) vulnerabilitySedLex FavIcon Switcher
- CVE-2022-3252Improper detection of complete HTTP body decompression SwiftNIO Extras provides a pair of helpers for transparently decompressing received HSwift Project SwiftNIO Extras
- CVE-2022-23951In Keylime before 6.3.0, quote responses from the agent can contain possibly untrusted ZIP data which can lead to zip bombs.keylime
- CVE-2022-29800A time-of-check-time-of-use (TOCTOU) race condition vulnerability was found in networkd-dispatcher.networkd-dispatcher
- CVE-2022-29799A vulnerability was found in networkd-dispatcher.networkd-dispatcher
- CVE-2022-35621Access control vulnerability in Evoh NFT EvohClaimable contract with sha256 hash code fa2084d5abca91a62ed1d2f1cad3ec318e6a9a2d7f1510a00d8987
- CVE-2022-31679Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.5.5, 3.7.0 - 3.7.2, and older unsupSpring Data REST · org.springframework.data:spring-data-res…
- CVE-2022-40029SourceCodester Simple Task Managing System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component newPr
- CVE-2022-40028SourceCodester Simple Task Managing System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component newPr
- CVE-2022-40027SourceCodester Simple Task Managing System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component newTa
- CVE-2022-3250Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in ikus060/rdiffwebikus060/rdiffweb · rdiffweb
- CVE-2022-40616IBM Maximo Asset Management 7.6.1.1, 7.6.1.2, and 7.6.1.3 could allow a user to bypass authentication and obtain sensitive information or peIBM Maximo Asset Management
- CVE-2022-41255Jenkins CONS3RT Plugin 1.0.0 and earlier stores Cons3rt API token unencrypted in job config.xml files on the Jenkins controller where it canJenkins project Jenkins CONS3RT Plugin · org.jenkins-ci.plu…
- CVE-2022-41254Missing permission checks in Jenkins CONS3RT Plugin 1.0.0 and earlier allow attackers with Overall/Read permission to connect to an attackerJenkins project Jenkins CONS3RT Plugin · org.jenkins-ci.plu…
- CVE-2022-41252Missing permission checks in Jenkins CONS3RT Plugin 1.0.0 and earlier allows users with Overall/Read permission to enumerate credentials ID Jenkins project Jenkins CONS3RT Plugin · org.jenkins-ci.plu…
- CVE-2022-41250A missing permission check in Jenkins SCM HttpClient Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an aJenkins project Jenkins SCM HttpClient Plugin · com.meowlom…
- CVE-2022-41251A missing permission check in Jenkins Apprenda Plugin 2.2.0 and earlier allows users with Overall/Read permission to enumerate credentials IJenkins project Jenkins Apprenda Plugin · org.jenkins-ci.pl…
- CVE-2022-41248Jenkins BigPanda Notifier Plugin 1.4.0 and earlier does not mask the BigPanda API key on the global configuration form, increasing the potenJenkins project Jenkins BigPanda Notifier Plugin · org.jenk…
- CVE-2022-41247Jenkins BigPanda Notifier Plugin 1.4.0 and earlier stores the BigPanda API key unencrypted in its global configuration file on the Jenkins cJenkins project Jenkins BigPanda Notifier Plugin · org.jenk…
- CVE-2022-41246A missing permission check in Jenkins Worksoft Execution Manager Plugin 10.0.3.503 and earlier allows attackers with Overall/Read permissionJenkins project Jenkins Worksoft Execution Manager Plugin ·…
- CVE-2022-41242A missing permission check in Jenkins extreme-feedback Plugin 1.7 and earlier allows attackers with Overall/Read permission to discover infoJenkins project Jenkins extreme-feedback Plugin · org.jenki…
- CVE-2022-41240Jenkins Walti Plugin 1.0.1 and earlier does not escape the information provided by the Walti API, resulting in a stored cross-site scriptingJenkins project Jenkins Walti Plugin · org.jenkins-ci.plugi…
- CVE-2022-41239Jenkins DotCi Plugin 2.40.00 and earlier does not escape the GitHub user name parameter provided to commit notifications when displaying theJenkins project Jenkins DotCi Plugin · com.groupon.jenkins-…
- CVE-2022-41235Jenkins WildFly Deployer Plugin 1.0.2 and earlier implements functionality that allows agent processes to read arbitrary files on the JenkinJenkins project Jenkins WildFly Deployer Plugin · org.jenki…
- CVE-2022-41233Jenkins Rundeck Plugin 3.6.11 and earlier does not perform Run/Artifacts permission checks in multiple HTTP endpoints, allowing attackers wiJenkins project Jenkins Rundeck Plugin · org.jenkins-ci.plu…
- CVE-2022-41230Jenkins Build-Publisher Plugin 1.22 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/ReaJenkins project Jenkins Build-Publisher Plugin · org.jenkin…
- CVE-2022-41231Jenkins Build-Publisher Plugin 1.22 and earlier allows attackers with Item/Configure permission to create or replace any config.xml file on Jenkins project Jenkins Build-Publisher Plugin · org.jenkin…
- CVE-2022-41229Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.134 and earlier does not escape configuration options of the Execute NetStorm/NJenkins project Jenkins NS-ND Integration Performance Publi…
- CVE-2022-41225Jenkins Anchore Container Image Scanner Plugin 1.0.24 and earlier does not escape content provided by the Anchore engine API, resulting in aJenkins project Jenkins Anchore Container Image Scanner Plu…
- CVE-2022-41224Jenkins 2.367 through 2.369 (both inclusive) does not escape tooltips of the l:helpIcon UI component used for some help icons on the JenkinsJenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2019-5641Rapid7 InsightVM Information Disclosure after LogoutRapid7 InsightVM
- CVE-2022-37246Craft CMS 4.2.0.1 is affected by Cross Site Scripting (XSS) in the file src/web/assets/cp/src/js/BaseElementSelectInput.js and in specific ocraftcms/cms
- CVE-2022-3255Cross-site Scripting (XSS) - Reflected in pimcore/pimcorepimcore/pimcore
- CVE-2022-3068Improper Privilege Management in octoprint/octoprintoctoprint/octoprint · octoprint
- CVE-2022-2888Insufficient Session Expiration in octoprint/octoprintoctoprint/octoprint · octoprint
- CVE-2022-2881Buffer overread in statistics channel codeISC BIND9
- CVE-2022-2795Processing large delegations may severely degrade resolver performanceISC BIND9
- CVE-2022-2872Unrestricted Upload of File with Dangerous Type in octoprint/octoprintoctoprint/octoprint · octoprint
- CVE-2022-40754Open RedirectApache Software Foundation Apache Airflow · apache-airflow
- CVE-2022-41218In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused by refcount races, affecting dvb_de