CVEs published September 22, 2022
58 CVEs were published on September 22, 2022: 7 critical, 17 high. 1 is now in CISA KEV.
- Published
- 58
- Critical
- 7
- High
- 17
- Medium
- 30
- Low
- 1
- Unrated
- 3
- Now in CISA KEV
- 1
- Fix available
- 18
Most affected products
- Apache Software Foundation Apache XML Graphics · org.apa… +1
- 2
- ikus060/rdiffweb · rdiffweb
- 2
- Apache Software Foundation Apache SOAP · soap:soap
- 1
- Apache Software Foundation Apache XML Graphics · org.apache…
- 1
- com.liferay:com.liferay.fragment.renderer.collection.filter…
- 1
- com.liferay:com.liferay.headless.discovery.web
- 1
- com.liferay:com.liferay.translation.web · com.liferay.porta…
- 1
- com.liferay.portal:release.portal.bom · com.liferay.port… +1
- 1
- github.com/hashicorp/vault
- 1
- Google protobuf-cpp · Google protobuf-python +1
- 1
Critical 7
- CVE-2022-3857310-Strike Network Inventory Explorer v9.3 was discovered to contain a buffer overflow via the Add Computers function.
- CVE-2022-36934An integer overflow in WhatsApp could result in remote code execution in an established video call.Meta WhatsApp for iOS · Meta WhatsApp Business for iOS +2
- CVE-2022-40089A remote file inclusion (RFI) vulnerability in Simple College Website v1.0 allows attackers to execute arbitrary code via a crafted PHP file
- CVE-2022-40087Simple College Website v1.0 was discovered to contain an arbitrary file write vulnerability via the function file_put_contents().
- CVE-2022-31937Netgear N300 wireless router wnr2000v4-V1.0.0.70 was discovered to contain a stack overflow via strcpy in uhttpd.
- CVE-2022-3268Weak Password Requirements in ikus060/minarcaikus060/minarca
- CVE-2022-40186An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3.github.com/hashicorp/vault
High 17
- CVE-2022-40298Crestron AirMedia for Windows before 5.5.1.84 has insecure inherited permissions, which leads to a privilege escalation vulnerability found
- CVE-2022-30426There is a stack buffer overflow vulnerability, which could lead to arbitrary code execution in UEFI DXE driver on some Acer products.
- CVE-2022-37234Netgear Nighthawk AC1900 Smart WiFi Dual Band Gigabit Router R7000-V1.0.11.134_10.2.119 is vulnerable to Buffer Overflow via the wl binary i
- CVE-2022-3274Cross-Site Request Forgery (CSRF) on user's settings in GitHub repository ikus060/rdiffweb prior to 2.4.6. in ikus060/rdiffwebikus060/rdiffweb · rdiffweb
- CVE-2022-34026ICEcoder v8.1 allows attackers to execute a directory traversal.icecoder/icecoder
- CVE-2022-40935Online Pet Shop We App v1.0 is vulnerable to SQL Injection via /pet_shop/classes/Master.php?f=delete_category,id.
- CVE-2022-40934Online Pet Shop We App v1.0 is vulnerable to SQL injection via /pet_shop/classes/Master.php?f=delete_sub_category,id
- CVE-2022-40933Online Pet Shop We App v1.0 by oretnom23 is vulnerable to SQL injection via /pet_shop/classes/Master.php?f=delete_order,id.
- CVE-2022-40932In Zoo Management System v1.0, there is an arbitrary file upload vulnerability in the picture upload point of the "gallery" file of the "Gal
- CVE-2022-35408An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5.
- CVE-2022-40447ZZCMS 2022 was discovered to contain a SQL injection vulnerability via the keyword parameter at /admin/baojia_list.php.
- CVE-2022-40446ZZCMS 2022 was discovered to contain a SQL injection vulnerability via the component /admin/sendmailto.php?tomail=&groupid=.
- CVE-2022-40705Apache SOAP: XML External Entity Injection (XXE) allows unauthenticated users to read arbitrary files via HTTPApache Software Foundation Apache SOAP · soap:soap
- CVE-2022-28981Path traversal vulnerability in the Hypermedia REST APIs module in Liferay Portal 7.4.0 through 7.4.2 allows remote attackers to access filecom.liferay:com.liferay.headless.discovery.web
- CVE-2022-1941Out of Memory issue in ProtocolBuffers for cpp and pythonGoogle protobuf-cpp · Google protobuf-python +1
- CVE-2022-3256Use After Free in vim/vimvim/vim
- CVE-2022-36062Grafana folders admin only permission privilege escalationgrafana · github.com/grafana/grafana
Medium, low and unrated 34
- CVE-2022-23458Toast UI Grid vulnerable to Cross-site scriptingnhn tui.grid · tui-grid
- CVE-2022-40088Simple College Website v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /college_websit
- CVE-2021-27774An injection vulnerability affects HCL Digital ExperienceHCL Software HCL Digital Experience
- CVE-2022-35894An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5.
- CVE-2022-35039OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e20a0.
- CVE-2022-35038OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b064d.
- CVE-2022-35037OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6adb1e.
- CVE-2022-35036OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e1fc8.
- CVE-2022-35035OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b559f.
- CVE-2022-35034OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e7e3d.
- CVE-2022-35032OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x6b6a8f.
- CVE-2022-35031OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x703969.
- CVE-2022-35030OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fe954.
- CVE-2022-35029OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x6babea.
- CVE-2022-35028OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fbbb6.
- CVE-2022-35027OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fe9a7.
- CVE-2022-35026OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fbc0b.
- CVE-2022-35025OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x5266a8.
- CVE-2022-35024OTFCC commit 617837b was discovered to contain a segmentation violation via /multiarch/memmove-vec-unaligned-erms.S.
- CVE-2022-35023OTFCC commit 617837b was discovered to contain a segmentation violation via /lib/x86_64-linux-gnu/libc.so.6+0xbb384.
- CVE-2022-35022OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x6badae.
- CVE-2022-35021OTFCC commit 617837b was discovered to contain a global buffer overflow via /release-x64/otfccdump+0x718693.
- CVE-2021-39190SCCM plugin for GLPI vulnerable to Exposure of Sensitive Information to an Unauthorized ActorpluginsGLPI sccm
- CVE-2022-40444ZZCMS 2022 was discovered to contain a full path disclosure vulnerability via the page /admin/index.PHP? _server.
- CVE-2022-40443An absolute path traversal vulnerability in ZZCMS 2022 allows attackers to obtain sensitive information via a crafted GET request sent to /o
- CVE-2022-3267Cross-Site Request Forgery (CSRF) in ikus060/rdiffwebikus060/rdiffweb · rdiffweb
- CVE-2022-2266Reflected XSS University Library Automation SystemYordam Bilgi Teknolojileri
- CVE-2022-39197An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTM
- CVE-2022-38512The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not check permissions befcom.liferay:com.liferay.translation.web · com.liferay.porta…
- CVE-2022-28980Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal v7.4.3.4 and Liferay DXP v7.4 GA allows attackers to execute arbitrarycom.liferay:com.liferay.fragment.renderer.collection.filter…
- CVE-2022-28977HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 com.liferay.portal:release.portal.bom · com.liferay.port… +1
- CVE-2022-38398Server-Side Request Forgery Information Disclosure VulnerabilityApache Software Foundation Apache XML Graphics · org.apa… +1
- CVE-2022-38648PDFTranscoder does not block external resourcesApache Software Foundation Apache XML Graphics · org.apa… +1
- CVE-2022-40146Jar url should be blocked by DefaultScriptSecurityApache Software Foundation Apache XML Graphics · org.apache…