# CVEs published 2022-09-22

58 CVEs were published on September 22, 2022: 7 critical, 17 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2022-40298](https://cve.now/CVE-2022-40298.md): Crestron AirMedia for Windows before 5.5.1.84 has insecure inherited permissions, which leads to a privilege escalation vulnerability found (CVSS 8.8)
- [CVE-2022-38573](https://cve.now/CVE-2022-38573.md): 10-Strike Network Inventory Explorer v9.3 was discovered to contain a buffer overflow via the Add Computers function. (CVSS 9.8)
- [CVE-2022-30426](https://cve.now/CVE-2022-30426.md): There is a stack buffer overflow vulnerability, which could lead to arbitrary code execution in UEFI DXE driver on some Acer products. (CVSS 7.8)
- [CVE-2022-23458](https://cve.now/CVE-2022-23458.md): Toast UI Grid vulnerable to Cross-site scripting (CVSS 6.1, nhn tui.grid · tui-grid)
- [CVE-2022-36934](https://cve.now/CVE-2022-36934.md): An integer overflow in WhatsApp could result in remote code execution in an established video call. (CVSS 9.8, Meta WhatsApp for iOS · Meta WhatsApp Business for iOS +2)
- [CVE-2022-40089](https://cve.now/CVE-2022-40089.md): A remote file inclusion (RFI) vulnerability in Simple College Website v1.0 allows attackers to execute arbitrary code via a crafted PHP file (CVSS 9.8)
- [CVE-2022-40088](https://cve.now/CVE-2022-40088.md): Simple College Website v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /college\_websit (CVSS 6.1)
- [CVE-2022-40087](https://cve.now/CVE-2022-40087.md): Simple College Website v1.0 was discovered to contain an arbitrary file write vulnerability via the function file\_put\_contents(). (CVSS 9.8)
- [CVE-2022-31937](https://cve.now/CVE-2022-31937.md): Netgear N300 wireless router wnr2000v4-V1.0.0.70 was discovered to contain a stack overflow via strcpy in uhttpd. (CVSS 9.8)
- [CVE-2021-27774](https://cve.now/CVE-2021-27774.md): An injection vulnerability affects HCL Digital Experience (CVSS 3.1, HCL Software HCL Digital Experience)
- [CVE-2022-37234](https://cve.now/CVE-2022-37234.md): Netgear Nighthawk AC1900 Smart WiFi Dual Band Gigabit Router R7000-V1.0.11.134\_10.2.119 is vulnerable to Buffer Overflow via the wl binary i (CVSS 7.8)
- [CVE-2022-3274](https://cve.now/CVE-2022-3274.md): Cross-Site Request Forgery (CSRF) on user's settings in GitHub repository ikus060/rdiffweb prior to 2.4.6. in ikus060/rdiffweb (CVSS 7.0, ikus060/rdiffweb · rdiffweb)
- [CVE-2022-35894](https://cve.now/CVE-2022-35894.md): An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. (CVSS 6.0)
- [CVE-2022-34026](https://cve.now/CVE-2022-34026.md): ICEcoder v8.1 allows attackers to execute a directory traversal. (CVSS 7.5, icecoder/icecoder)
- [CVE-2022-35039](https://cve.now/CVE-2022-35039.md): OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e20a0. (CVSS 6.5)
- [CVE-2022-35038](https://cve.now/CVE-2022-35038.md): OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b064d. (CVSS 6.5)
- [CVE-2022-35037](https://cve.now/CVE-2022-35037.md): OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6adb1e. (CVSS 6.5)
- [CVE-2022-35036](https://cve.now/CVE-2022-35036.md): OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e1fc8. (CVSS 6.5)
- [CVE-2022-35035](https://cve.now/CVE-2022-35035.md): OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b559f. (CVSS 6.5)
- [CVE-2022-35034](https://cve.now/CVE-2022-35034.md): OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e7e3d. (CVSS 6.5)
- [CVE-2022-35032](https://cve.now/CVE-2022-35032.md): OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x6b6a8f. (CVSS 6.5)
- [CVE-2022-35031](https://cve.now/CVE-2022-35031.md): OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x703969. (CVSS 6.5)
- [CVE-2022-35030](https://cve.now/CVE-2022-35030.md): OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fe954. (CVSS 6.5)
- [CVE-2022-35029](https://cve.now/CVE-2022-35029.md): OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x6babea. (CVSS 6.5)
- [CVE-2022-35028](https://cve.now/CVE-2022-35028.md): OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fbbb6. (CVSS 6.5)
- [CVE-2022-35027](https://cve.now/CVE-2022-35027.md): OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fe9a7. (CVSS 6.5)
- [CVE-2022-35026](https://cve.now/CVE-2022-35026.md): OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fbc0b. (CVSS 6.5)
- [CVE-2022-35025](https://cve.now/CVE-2022-35025.md): OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x5266a8. (CVSS 6.5)
- [CVE-2022-35024](https://cve.now/CVE-2022-35024.md): OTFCC commit 617837b was discovered to contain a segmentation violation via /multiarch/memmove-vec-unaligned-erms.S. (CVSS 6.5)
- [CVE-2022-35023](https://cve.now/CVE-2022-35023.md): OTFCC commit 617837b was discovered to contain a segmentation violation via /lib/x86\_64-linux-gnu/libc.so.6+0xbb384. (CVSS 6.5)
- [CVE-2022-35022](https://cve.now/CVE-2022-35022.md): OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x6badae. (CVSS 6.5)
- [CVE-2022-35021](https://cve.now/CVE-2022-35021.md): OTFCC commit 617837b was discovered to contain a global buffer overflow via /release-x64/otfccdump+0x718693. (CVSS 6.5)
- [CVE-2021-39190](https://cve.now/CVE-2021-39190.md): SCCM plugin for GLPI vulnerable to Exposure of Sensitive Information to an Unauthorized Actor (CVSS 5.3, pluginsGLPI sccm)
- [CVE-2022-40935](https://cve.now/CVE-2022-40935.md): Online Pet Shop We App v1.0 is vulnerable to SQL Injection via /pet\_shop/classes/Master.php?f=delete\_category,id. (CVSS 7.2)
- [CVE-2022-40934](https://cve.now/CVE-2022-40934.md): Online Pet Shop We App v1.0 is vulnerable to SQL injection via /pet\_shop/classes/Master.php?f=delete\_sub\_category,id (CVSS 7.2)
- [CVE-2022-40933](https://cve.now/CVE-2022-40933.md): Online Pet Shop We App v1.0 by oretnom23 is vulnerable to SQL injection via /pet\_shop/classes/Master.php?f=delete\_order,id. (CVSS 7.2)
- [CVE-2022-40932](https://cve.now/CVE-2022-40932.md): In Zoo Management System v1.0, there is an arbitrary file upload vulnerability in the picture upload point of the "gallery" file of the "Gal (CVSS 7.2)
- [CVE-2022-35408](https://cve.now/CVE-2022-35408.md): An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. (CVSS 8.2)
- [CVE-2022-40447](https://cve.now/CVE-2022-40447.md): ZZCMS 2022 was discovered to contain a SQL injection vulnerability via the keyword parameter at /admin/baojia\_list.php. (CVSS 7.2)
- [CVE-2022-40446](https://cve.now/CVE-2022-40446.md): ZZCMS 2022 was discovered to contain a SQL injection vulnerability via the component /admin/sendmailto.php?tomail=&groupid=. (CVSS 7.2)
- [CVE-2022-40444](https://cve.now/CVE-2022-40444.md): ZZCMS 2022 was discovered to contain a full path disclosure vulnerability via the page /admin/index.PHP? \_server. (CVSS 5.3)
- [CVE-2022-40443](https://cve.now/CVE-2022-40443.md): An absolute path traversal vulnerability in ZZCMS 2022 allows attackers to obtain sensitive information via a crafted GET request sent to /o (CVSS 5.3)
- [CVE-2022-3267](https://cve.now/CVE-2022-3267.md): Cross-Site Request Forgery (CSRF) in ikus060/rdiffweb (CVSS 6.8, ikus060/rdiffweb · rdiffweb)
- [CVE-2022-3268](https://cve.now/CVE-2022-3268.md): Weak Password Requirements in ikus060/minarca (CVSS 9.8, ikus060/minarca)
- [CVE-2022-2266](https://cve.now/CVE-2022-2266.md): Reflected XSS University Library Automation System (CVSS 6.1, Yordam Bilgi Teknolojileri)
- [CVE-2022-40705](https://cve.now/CVE-2022-40705.md): Apache SOAP: XML External Entity Injection (XXE) allows unauthenticated users to read arbitrary files via HTTP (CVSS 7.5, Apache Software Foundation Apache SOAP · soap:soap)
- [CVE-2022-39197](https://cve.now/CVE-2022-39197.md): An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTM (CVSS 6.1, KEV)
- [CVE-2022-38512](https://cve.now/CVE-2022-38512.md): The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not check permissions bef (CVSS 6.5, com.liferay:com.liferay.translation.web · com.liferay.porta…)
- [CVE-2022-28980](https://cve.now/CVE-2022-28980.md): Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal v7.4.3.4 and Liferay DXP v7.4 GA allows attackers to execute arbitrary (CVSS 6.1, com.liferay:com.liferay.fragment.renderer.collection.filter…)
- [CVE-2022-28981](https://cve.now/CVE-2022-28981.md): Path traversal vulnerability in the Hypermedia REST APIs module in Liferay Portal 7.4.0 through 7.4.2 allows remote attackers to access file (CVSS 7.5, com.liferay:com.liferay.headless.discovery.web)
- [CVE-2022-28977](https://cve.now/CVE-2022-28977.md): HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 (CVSS 6.1, com.liferay.portal:release.portal.bom · com.liferay.port… +1)
- [CVE-2022-1941](https://cve.now/CVE-2022-1941.md): Out of Memory issue in ProtocolBuffers for cpp and python (CVSS 7.5, Google protobuf-cpp · Google protobuf-python +1)
- [CVE-2022-3256](https://cve.now/CVE-2022-3256.md): Use After Free in vim/vim (CVSS 7.8, vim/vim)
- [CVE-2022-36062](https://cve.now/CVE-2022-36062.md): Grafana folders admin only permission privilege escalation (CVSS 7.6, grafana · github.com/grafana/grafana)
- [CVE-2022-38398](https://cve.now/CVE-2022-38398.md): Server-Side Request Forgery Information Disclosure Vulnerability (no CVSS, Apache Software Foundation Apache XML Graphics · org.apa… +1)
- [CVE-2022-38648](https://cve.now/CVE-2022-38648.md): PDFTranscoder does not block external resources (no CVSS, Apache Software Foundation Apache XML Graphics · org.apa… +1)
- [CVE-2022-40146](https://cve.now/CVE-2022-40146.md): Jar url should be blocked by DefaultScriptSecurity (no CVSS, Apache Software Foundation Apache XML Graphics · org.apache…)
- [CVE-2022-40186](https://cve.now/CVE-2022-40186.md): An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3. (CVSS 9.1, github.com/hashicorp/vault)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-09-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.