# CVEs published 2022-09-24

7 CVEs were published on September 24, 2022: 2 critical, 1 high. Days are UTC.

- [CVE-2022-41340](https://cve.now/CVE-2022-41340.md): The secp256k1-js package before 1.1.0 for Node.js implements ECDSA without required r and s validation, leading to signature forgery. (CVSS 7.5, @lionello/secp256k1-js)
- [CVE-2022-23463](https://cve.now/CVE-2022-23463.md): SpEL Injection in Nepxion Discovery (CVSS 9.4, Nepxion Discover · com.nepxion:discovery)
- [CVE-2022-23464](https://cve.now/CVE-2022-23464.md): Potential Server Side Request Forgery (SSRF) in Nepxion Discovery (CVSS 4.3, Nepxion Discovery · com.nepxion:discovery)
- [CVE-2022-23461](https://cve.now/CVE-2022-23461.md): Cross-Site Scripting (XSS) in Jodit Editor (CVSS 5.4, xdan Jodit Editor · jodit)
- [CVE-2022-36025](https://cve.now/CVE-2022-36025.md): Incorrect Conversion between Numeric Types in Besu Ethereum Client (CVSS 9.1, hyperledger besu · org.hyperledger.besu:evm)
- [CVE-2022-39240](https://cve.now/CVE-2022-39240.md): Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in MyGraph (CVSS 5.4, renlm MyGraph)
- [CVE-2022-39242](https://cve.now/CVE-2022-39242.md): Incorrect Calculation in Frontier leads to inflated Ethereum chain gas prices (CVSS 5.3, paritytech frontier · pallet-ethereum)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-09-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.