CVEs published September 23, 2022
201 CVEs were published on September 23, 2022: 37 critical, 56 high. 1 is now in CISA KEV.
- Published
- 201
- Critical
- 37
- High
- 56
- Medium
- 100
- Low
- 6
- Unrated
- 2
- Now in CISA KEV
- 1
- Fix available
- 75
Most affected products
- Apple macOS
- 24
- Apple macOS · Apple tvOS +1
- 15
- Rocket.Chat
- 11
- Apple Safari · Apple tvOS +1
- 4
- MZ Automation libIEC61850
- 4
- Rocket.chat
- 4
- Apple macOS · Apple watchOS
- 3
- CusRev Customer Reviews for WooCommerce
- 3
- Tacitine Firewall
- 3
- Adobe Experience Manager
- 2
Critical 37
- CVE-2022-40122Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the cust_id parameter at /net-banking/edit_customer_a
- CVE-2022-40120Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the search_term parameter at /net-banking/customer_tr
- CVE-2022-40121Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the search parameter at /net-banking/manage_customers
- CVE-2022-40118Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the cust_id parameter at /net-banking/send_funds_acti
- CVE-2022-40119Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the search_term parameter at /net-banking/transaction
- CVE-2022-40116Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the search parameter at /net-banking/beneficiary.php.
- CVE-2022-40117Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the cust_id parameter at /net-banking/delete_customer
- CVE-2022-40115Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the cust_id parameter at /net-banking/delete_benefici
- CVE-2022-40114Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the cust_id parameter at /net-banking/edit_customer.p
- CVE-2022-40113Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the cust_id parameter at /net-banking/send_funds.php.
- CVE-2022-32845This issue was addressed with improved checks.Apple macOS · Apple watchOS
- CVE-2022-32847This issue was addressed with improved checks.Apple macOS · Apple tvOS +1
- CVE-2022-40100Tenda i9 v1.0.0.8(3828) was discovered to contain a command injection vulnerability via the FormexeCommand function.
- CVE-2022-40628Remote Code Execution Vulnerability in Tacitine FirewallTacitine Firewall
- CVE-2022-2970MZ Automation libIEC61850 Stack-Based Buffer OverflowMZ Automation libIEC61850
- CVE-2022-2972MZ Automation libIEC61850 Stack-Based Buffer OverflowMZ Automation libIEC61850
- CVE-2022-2070Grandstream GSD3710 Stack-based Buffer OverflowGrandstream GSD3710
- CVE-2022-2025Grandstream GSD3710 Stack-based Buffer OverflowGrandstream GSD3710
- CVE-2022-40855Tenda W20E router V15.11.0.6 contains a stack overflow in the function formSetPortMapping with post request 'goform/setPortMapping/'.
- CVE-2022-40866Tenda W20E router V15.11.0.6 (US_W20EV4.0br_V15.11.0.6(1068_1546_841)_CN_TDC) contains a stack overflow vulnerability in the function formSe
- CVE-2022-40867Tenda W20E router V15.11.0.6 (US_W20EV4.0br_V15.11.0.6(1068_1546_841)_CN_TDC) contains a stack overflow vulnerability in the function formIP
- CVE-2022-40868Tenda W20E router V15.11.0.6 (US_W20EV4.0br_V15.11.0.6(1068_1546_841)_CN_TDC) contains a stack overflow vulnerability in the function formDe
- CVE-2022-40854Tenda AC18 router contained a stack overflow vulnerability in /goform/fast_setting_wifi_set
- CVE-2022-23144There is a broken access control vulnerability in ZTE ZXvSTB product.ZXvSTB
- CVE-2022-40851Tenda AC15 V15.03.05.19 contained a stack overflow via the function fromAddressNat.
- CVE-2022-40853Tenda AC15 router V15.03.05.19 contains a stack overflow via the list parameter at /goform/fast_setting_wifi_set
- CVE-2022-40860Tenda AC15 router V15.03.05.19 contains a stack overflow vulnerability in the function formSetQosBand->FUN_0007dd20 with request /goform/Set
- CVE-2022-40862Tenda AC15 and AC18 router V15.03.05.19 contains stack overflow vulnerability in the function fromNatStaticSetting with the request /goform/
- CVE-2022-40864Tenda AC15 and AC18 routers V15.03.05.19 contain stack overflow vulnerabilities in the function setSmartPowerManagement with the request /go
- CVE-2022-40865Tenda AC15 and AC18 routers V15.03.05.19 contain heap overflow vulnerabilities in the function setSchedWifi with the request /goform/openSch
- CVE-2022-40869Tenda AC15 and AC18 routers V15.03.05.19 contain stack overflow vulnerabilities in the function fromDhcpListClient with a combined parameter
- CVE-2022-3236A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1Sophos Firewall
- CVE-2022-2566Heap-memory write in FFMPEGFFMPEG
- CVE-2022-26112Pinot query endpoint and the realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function supportApache Software Foundation Apache Pinot · org.apache.pinot:…
- CVE-2022-39227Python-jwt subject to Authentication Bypass by Spoofingdavedoesdev python-jwt · python-jwt
- CVE-2022-37235Netgear Nighthawk AC1900 Smart WiFi Dual Band Gigabit Router R7000-V1.0.11.134_10.2.119 is vulnerable to Buffer Overflow via the wl binary i
- CVE-2022-36944Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file.org.scala-lang:scala-library
High 56
- CVE-2022-22629A buffer overflow issue was addressed with improved memory handling.Apple Safari · Apple tvOS +1
- CVE-2022-32831An out-of-bounds read was addressed with improved bounds checking.Apple macOS
- CVE-2022-32851An out-of-bounds read issue was addressed with improved input validation.Apple macOS
- CVE-2022-32842An out-of-bounds read issue was addressed with improved input validation.Apple macOS
- CVE-2022-32819A logic issue was addressed with improved state management.Apple macOS · Apple tvOS +1
- CVE-2022-32821A memory corruption issue was addressed with improved validation.Apple macOS · Apple tvOS +1
- CVE-2022-32826An authorization issue was addressed with improved state management.Apple macOS · Apple tvOS +1
- CVE-2022-32829This issue was addressed with improved checks.Apple macOS
- CVE-2022-32807This issue was addressed with improved file handling.Apple macOS
- CVE-2022-32815The issue was addressed with improved memory handling.Apple macOS · Apple tvOS +1
- CVE-2022-32820An out-of-bounds write issue was addressed with improved input validation.Apple macOS · Apple tvOS +1
- CVE-2022-32801This issue was addressed with improved checks.Apple macOS
- CVE-2022-32843An out-of-bounds write issue was addressed with improved bounds checking.Apple macOS
- CVE-2022-32792An out-of-bounds write issue was addressed with improved input validation.Apple macOS · Apple tvOS +1
- CVE-2022-32797This issue was addressed with improved checks.Apple macOS
- CVE-2022-32798An out-of-bounds write issue was addressed with improved input validation.Apple macOS
- CVE-2022-32853An out-of-bounds read issue was addressed with improved input validation.Apple macOS
- CVE-2022-32796A memory corruption issue was addressed with improved state management.Apple macOS
- CVE-2022-32787An out-of-bounds write issue was addressed with improved bounds checking.Apple macOS · Apple tvOS +1
- CVE-2022-32790This issue was addressed with improved checks.Apple macOS · Apple watchOS
- CVE-2022-32852An out-of-bounds read issue was addressed with improved input validation.Apple macOS
- CVE-2020-36521An out-of-bounds read was addressed with improved input validation.Apple iTunes for Windows · Apple iOS and iPadOS +2
- CVE-2022-22628A use after free issue was addressed with improved memory management.Apple Safari · Apple tvOS +1
- CVE-2022-26700A memory corruption issue was addressed with improved state management.Apple macOS · Apple watchOS
- CVE-2022-22610A memory corruption issue was addressed with improved state management.Apple Safari · Apple tvOS +1
- CVE-2022-22624A use after free issue was addressed with improved memory management.Apple Safari · Apple tvOS
- CVE-2022-22637A logic issue was addressed with improved state management.Apple Safari · Apple tvOS +1
- CVE-2022-40106Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the set_local_time function.
- CVE-2022-40107Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formexeCommand function.
- CVE-2022-40105Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formWifiMacFilterGet function.
- CVE-2022-40104Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formwrlSSIDget function.
- CVE-2022-40102Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formwrlSSIDset function.
- CVE-2022-40101Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formWifiMacFilterSet function.
- CVE-2022-3263Measuresoft ScadaPro Server Improper Access ControlMeasuresoft ScadaPro Server
- CVE-2022-32211A SQL injection vulnerability exists in Rocket.Chat <v3.18.6, <v4.4.4 and <v4.7.3 which can allow an attacker to retrieve a reset password tRocket.Chat
- CVE-2022-35893An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5.
- CVE-2022-40629Sensitive Information Disclosure Vulnerability in Tacitine FirewallTacitine Firewall
- CVE-2022-34348IBM Sterling Partner Engagement Manager 6.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.IBM Partner Engagement Manager
- CVE-2022-36338An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5.
- CVE-2022-2971MZ Automation libIEC61850 Access of Resource Using Incompatible Type ('Type Confusion')MZ Automation libIEC61850
- CVE-2022-2973MZ Automation libIEC61850 NULL Pointer DereferenceMZ Automation libIEC61850
- CVE-2022-38742Rockwell Automation ThinManager Software Vulnerable to Arbitrary Code Execution and Denial-Of-Service AttackRockwell Automation ThinManager ThinServer
- CVE-2022-40861Tenda AC18 router V15.03.05.19 contains a stack overflow vulnerability in the formSetQosBand->FUN_0007db78 function with the request /goform
- CVE-2022-27492An integer underflow in WhatsApp could have caused remote code execution when receiving a crafted video file.Meta WhatsApp Business for iOS · Meta WhatsApp for iOS +2
- CVE-2022-40093Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /tour/admin/up
- CVE-2022-40092Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /tour/admin/up
- CVE-2022-40091Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /tour/admin/up
- CVE-2022-35257A local privilege escalation vulnerability in UI Desktop for Windows (Version 0.55.1.2 and earlier) allows a malicious actor with local acceUI Desktop for Windows
- CVE-2022-2347Unchecked Download size in UbootUboot
- CVE-2022-38936An issue has been found in PBC through 2022-8-27.
- CVE-2020-36604hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.@hapi/hoek · hoek
- CVE-2022-41322In Kitty before 0.26.2, insufficient validation in the desktop notification escape sequence can lead to arbitrary code execution.
- CVE-2021-41803HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage github.com/hashicorp/consul
- CVE-2022-32814A type confusion issue was addressed with improved state handling.Apple macOS · Apple tvOS +1
- CVE-2022-35951Redis subject to Integer Overflow leading to Remote Code Execution via Heap Overflowredis
- CVE-2022-40188Knot Resolver before 5.5.3 allows remote attackers to cause a denial of service (CPU consumption) because of algorithmic complexity.
Medium, low and unrated 108
- CVE-2022-32841The issue was addressed with improved memory handling.Apple macOS · Apple tvOS +1
- CVE-2022-32825The issue was addressed with improved memory handling.Apple macOS · Apple tvOS +1
- CVE-2022-32828The issue was addressed with improved memory handling.Apple macOS · Apple tvOS
- CVE-2022-32832The issue was addressed with improved memory handling.Apple macOS · Apple tvOS +1
- CVE-2022-32848A logic issue was addressed with improved checks.Apple macOS
- CVE-2022-32823A memory initialization issue was addressed with improved memory handling.Apple macOS · Apple tvOS +1
- CVE-2022-32816The issue was addressed with improved UI handling.Apple macOS · Apple tvOS +1
- CVE-2022-32817An out-of-bounds read issue was addressed with improved bounds checking.Apple macOS · Apple tvOS +1
- CVE-2022-32818The issue was addressed with improved memory handling.Apple macOS
- CVE-2022-32799An out-of-bounds read issue was addressed with improved bounds checking.Apple macOS
- CVE-2022-32800This issue was addressed with improved checks.Apple macOS
- CVE-2022-32805The issue was addressed with improved handling of caches.Apple macOS
- CVE-2022-32786An issue in the handling of environment variables was addressed with improved validation.Apple macOS
- CVE-2022-32789A logic issue was addressed with improved checks.Apple macOS
- CVE-2022-32783A logic issue was addressed with improved checks.Apple macOS
- CVE-2022-32781This issue was addressed by enabling hardened runtime.Apple macOS
- CVE-2022-32782This issue was addressed by enabling hardened runtime.Apple macOS
- CVE-2022-32785A null pointer dereference was addressed with improved validation.Apple macOS
- CVE-2022-26707An issue in the handling of environment variables was addressed with improved validation.Apple macOS
- CVE-2022-40103Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formSetAutoPing function.
- CVE-2022-38454WordPress Kraken.io Image Optimizer plugin <= 2.6.5 - Cross-Site Request Forgery (CSRF) vulnerabilityKarim Salman Kraken.io Image Optimizer
- CVE-2022-38079WordPress Backup Scheduler plugin <= 1.5.13 - Cross-Site Request Forgery (CSRF) vulnerabilitySedLex Backup Scheduler
- CVE-2022-40132WordPress Seriously Simple Podcasting plugin <= 2.16.0 - Cross-Site Request Forgery (CSRF) vulnerabilityCastos Seriously Simple Podcasting
- CVE-2022-38704WordPress SEO Redirection plugin <= 8.9 - Cross-Site Request Forgery (CSRF) vulnerabilityWP-buy SEO Redirection Plugin – 301 Redirect Manager
- CVE-2022-36340WordPress MailOptin plugin <= 1.2.49.0 - Unauthenticated Optin Campaign Cache Deletion vulnerabilityMailOptin Popup Builder Team MailOptin
- CVE-2022-30124An improper authentication vulnerability exists in Rocket.Chat Mobile App <4.14.1.22788 that allowed an attacker with physical access to a mRocket.Chat Mobile app
- CVE-2022-32217A cleartext storage of sensitive information exists in Rocket.Chat <v4.6.4 due to Oauth token being leaked in plaintext in Rocket.chat logs.Rocket.chat
- CVE-2022-32219An information disclosure vulnerability exists in Rocket.Chat <v4.7.5 which allowed the "users.list" REST endpoint gets a query parameter frRocket.Chat
- CVE-2022-32220An information disclosure vulnerability exists in Rocket.Chat <v5 due to the getUserMentionsByChannel meteor server method discloses messageRocket.Chat
- CVE-2022-32218An information disclosure vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 due to the actionLinkHandler method was found to alloRocket.chat
- CVE-2022-32226An improper access control vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 due to input data in the getUsersOfRoom Meteor serveRocket.Chat
- CVE-2022-32227A cleartext transmission of sensitive information exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 relating to Oauth tokens by having the permRocket.Chat
- CVE-2022-32228An information disclosure vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 since the getReadReceipts Meteor server method does nRocket.Chat
- CVE-2022-32229A information disclosure vulnerability exists in Rockert.Chat <v5 due to /api/v1/chat.getThreadsList lack of sanitization of user inputs andRocket.Chat
- CVE-2022-35247A information disclosure vulnerability exists in Rocket.chat <v5, <v4.8.2 and <v4.7.5 where the lack of ACL checks in the getRoomRoles MeteoRocket.Chat
- CVE-2022-35246A NoSQL-Injection information disclosure vulnerability vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 in the getS3FileUrl MeteRocket.Chat
- CVE-2022-35248A improper authentication vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 that allowed two factor authentication can be bypasseRocket.Chat
- CVE-2022-35249A information disclosure vulnerability exists in Rocket.Chat <v5 where the getUserMentionsByChannel meteor server method discloses messages Rocket.Chat
- CVE-2022-35250A privilege escalation vulnerability exists in Rocket.chat <v5 which made it possible to elevate privileges for any authenticated user to viRocket.chat
- CVE-2022-35251A cross-site scripting vulnerability exists in Rocket.chat <v5 due to style injection in the complete chat window, an adversary is able to mRocket.chat
- CVE-2022-28886Denial-of-Service (DoS) VulnerabilityAll F-Secure and WithSecure Endpoint Protection products fo…
- CVE-2022-38439AEM Reflected XSS Arbitrary code executionAdobe Experience Manager
- CVE-2022-38438AEM Reflected XSS Arbitrary code executionAdobe Experience Manager
- CVE-2022-40630Improper Session Management Vulnerability in Tacitine FirewallTacitine Firewall
- CVE-2022-40748IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting.IBM InfoSphere Information Server
- CVE-2022-35721IBM Jazz for Service Management 1.1.3 is vulnerable to stored cross-site scripting.IBM Jazz for Service Management
- CVE-2022-22423IBM Common Cryptographic Architecture (CCA 5.x MTM for 4767 and CCA 7.x MTM for 4769) could allow a local user to cause a denial of service IBM CCA for MTM
- CVE-2022-40359Cross site scripting (XSS) vulnerability in kfm through 1.4.7 via crafted GET request to /kfm/index.php.
- CVE-2022-40358An issue was discovered in AjaXplorer 4.2.3, allows attackers to cause cross site scripting vulnerabilities via a crafted svg file upload.
- CVE-2022-35099SWFTools commit 772e55a2 was discovered to contain a stack overflow via ImageStream::getPixel(unsigned char*) at /xpdf/Stream.cc.
- CVE-2022-35098SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via GfxICCBasedColorSpace::getDefaultColor(GfxColor*) at /xpdf/Gfx
- CVE-2022-35097SWFTools commit 772e55a2 was discovered to contain a segmentation violation via FoFiTrueType::writeTTF at /xpdf/FoFiTrueType.cc.
- CVE-2022-35096SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via draw_stroke at /gfxpoly/stroke.c.
- CVE-2022-35095SWFTools commit 772e55a2 was discovered to contain a segmentation violation via InfoOutputDev::type3D1 at /pdf/InfoOutputDev.cc.
- CVE-2022-35094SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via DCTStream::readHuffSym(DCTHuffTable*) at /xpdf/Stream.cc.
- CVE-2022-35093SWFTools commit 772e55a2 was discovered to contain a global buffer overflow via DCTStream::transformDataUnit at /xpdf/Stream.cc.
- CVE-2022-35092SWFTools commit 772e55a2 was discovered to contain a segmentation violation via convert_gfxline at /gfxpoly/convert.c.
- CVE-2022-35091SWFTools commit 772e55a2 was discovered to contain a floating point exception (FPE) via DCTStream::readMCURow() at /xpdf/Stream.cc.ow()
- CVE-2021-3782An internal reference count is held on the buffer pool, incremented every time a new buffer is created from the pool.wayland
- CVE-2022-40215WordPress Tabs plugin <= 3.7.1 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilitiesBiplob Adhikari Tabs
- CVE-2022-36417WordPress 3D Tag Cloud plugin <= 3.8 - Multiple Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerabilityVinoj Cardoza 3D Tag Cloud
- CVE-2022-38134WordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Authenticated Broken Access Control vulnerabilityCusRev Customer Reviews for WooCommerce
- CVE-2022-38470WordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Cross-Site Request Forgery (CSRF) vulnerabilityCusRev Customer Reviews for WooCommerce
- CVE-2022-40194WordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Sensitive Information Disclosure vulnerabilityCusRev Customer Reviews for WooCommerce
- CVE-2021-45035Velneo vClient Improper authenticationVelneo vClient
- CVE-2022-38061WordPress Export Post Info plugin <= 1.2.0 - Authenticated CSV Injection vulnerabilityApasionados Export Post Info
- CVE-2022-40672WordPress CPO Shortcodes plugin <= 1.5.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityWPChill CPO Shortcodes
- CVE-2022-40195WordPress PCA Predict plugin <= 1.0.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityPCA Predict
- CVE-2022-38085WordPress Read more By Adam plugin <= 1.1.8 - Cross-Site Request Forgery (CSRF) vulnerabilityAdam Skaat Read more By Adam
- CVE-2022-37342WordPress Add Shortcodes Actions And Filters plugin <= 2.0.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityMichael Simpson Add Shortcodes Actions And Filters
- CVE-2022-36388WordPress YDS Support Ticket System plugin <= 1.0 - Cross-Site Request Forgery (CSRF) vulnerabilityYdesignservices YDS Support Ticket System
- CVE-2022-40193WordPress Awesome Filterable Portfolio plugin <= 1.9.7 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerabilityBriniA Awesome Filterable Portfolio
- CVE-2022-35238WordPress Awesome Filterable Portfolio plugin <= 1.9.7 - Unauthenticated Plugin Settings Change vulnerabilityBriniA Awesome Filterable Portfolio
- CVE-2022-38460WordPress NOTICE BOARD plugin <= 1.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityJitendriya Tripathy NOTICE BOARD
- CVE-2022-37328WordPress History Timeline plugin <= 1.0.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityThemes Awesome History Timeline
- CVE-2022-36791WordPress Torro Forms plugin <= 1.0.16 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityAwesome UG Torro Forms
- CVE-2022-40310WordPress Rate my Post – WP Rating System plugin <= 3.3.4 - Race Condition vulnerabilityBlaz K. Rate my Post – WP Rating System
- CVE-2022-40671WordPress Rate my Post – WP Rating System plugin <= 3.3.4 - Cross-Site Request Forgery (CSRF) vulnerabilityBlaz K. Rate my Post – WP Rating System
- CVE-2022-3257Server-side Denial of Service while processing a specifically crafted GIF fileMattermost · github.com/mattermost/mattermost-server/v6
- CVE-2022-3144Wordfence Security – Firewall & Malware Scan <= 7.6.0 - Authenticated (Admin+) Stored Cross-Site Scriptingmmaunder Wordfence Security – Firewall, Malware Scan, and L…
- CVE-2022-2937Image Hover Effects Ultimate <= 9.7.3 - Authenticated Stored Cross-Site Scripting via Title & Descriptionbiplob018 Image Hover Effects Ultimate
- CVE-2022-38703WordPress Button Plugin MaxButtons plugin <= 9.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityMax Foundry WordPress Button Plugin MaxButtons
- CVE-2022-40213WordPress GS Testimonial Slider plugin <= 1.9.6 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilitiesGS Plugins GS Testimonial Slider
- CVE-2022-38095WordPress Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.3 - Cross-Site Request Forgery (CSRF) vulnerabilityAlgolPlus Advanced Dynamic Pricing for WooCommerce
- CVE-2022-36798WordPress Mega Addons For WPBakery Page Builder plugin <= 4.2.7 - Cross-Site Request Forgery (CSRF) vulnerabilityTopdigitaltrends Mega Addons For WPBakery Page Builder
- CVE-2022-37339WordPress Meet My Team plugin <= 2.0.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityFullworks Meet My Team
- CVE-2022-30121The “LANDesk(R) Management Agent” service exposes a socket and once connected, it is possible to launch commands only for signed executablesIvanti Endpoint Manager
- CVE-2022-37338WordPress Blossom Recipe Maker plugin <= 1.0.7 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilitiesBlossomthemes Blossom Recipe Maker
- CVE-2022-37330WordPress WHA Crossword plugin <= 1.1.10 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityWHA Crossword
- CVE-2022-2785Arbitrary Memory read in BPF Linux KernelLinux Kernel Kernel
- CVE-2022-40979In JetBrains TeamCity before 2022.04.4 environmental variables of "password" type could be logged when using custom Perforce executableJetBrains TeamCity
- CVE-2022-33683Disabled Certificate Validation makes Broker, Proxy Admin Clients vulnerable to MITM attack Apache Software Foundation Apache Pulsar · org.apache.pu… +1
- CVE-2022-33682Disabled Hostname Verification makes Brokers, Proxies vulnerable to MITM attackApache Software Foundation Apache Pulsar · org.apache.pu… +1
- CVE-2022-33681Improper Hostname Verification in Java Client and Proxy can expose authentication data via MITMApache Software Foundation Apache Pulsar · org.apache.pulsa…
- CVE-2022-24280Apache Pulsar Proxy target broker address isn't validatedApache Software Foundation Apache Pulsar · org.apache.pulsa…
- CVE-2022-3269Session Fixation in ikus060/rdiffwebikus060/rdiffweb · rdiffweb
- CVE-2022-39238Improper Authentication in Arvados when using PAM as identity providerarvados
- CVE-2022-39239nefly-ipx subject to Server-Side Request Forgery and Stored Cross-Site Scripting via Cache Poisoning and Improper Host Validationnetlify-ipx · @netlify/ipx
- CVE-2022-39231Parse Server subject to Improper Authentication allowing Auth adapter app ID validation to be circumventedparse-community parse-server · parse-server
- CVE-2022-39230Security issue in fhir-works-on-aws-authz-smartawslabs fhir-works-on-aws-authz-smart · fhir-works-on-aws-a…
- CVE-2022-39225Parse Server subject to Incorrect Resource Transfer Between Spheresparse-community parse-server · parse-server
- CVE-2022-41320Veritas System Recovery (VSR) versions 18 and 21 store a network destination password in the Windows registry during configuration of the ba
- CVE-2022-37232Netgear N300 wireless router wnr2000v4-V1.0.0.70 is vulnerable to Buffer Overflow via uhttpd.
- CVE-2022-3278NULL Pointer Dereference in vim/vimvim/vim
- CVE-2022-32849An information disclosure issue was addressed by removing the vulnerable code.Apple macOS · Apple tvOS
- CVE-2022-35252When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back thttps://github.com/curl/curl
- CVE-2022-40716HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPgithub.com/hashicorp/consul
- CVE-2022-41319A Reflected Cross-Site Scripting (XSS) vulnerability affects the Veritas Desktop Laptop Option (DLO) application login page (aka the DLOServ