CVEs published September 26, 2022
105 CVEs were published on September 26, 2022: 9 critical, 61 high. 4 are now in CISA KEV.
- Published
- 105
- Critical
- 9
- High
- 61
- Medium
- 34
- Low
- 0
- Unrated
- 1
- Now in CISA KEV
- 4
- Fix available
- 69
Most affected products
- Google Chrome
- 41
- ikus060/rdiffweb · rdiffweb
- 5
- centreon/centreon
- 2
- Certain HP inkjet printers, HP LaserJet Pro printers, HP Pa…
- 2
- WP Popup Builder – Popup Forms , Marketing PoPuP & Newslet…
- 2
- Bitcoin / Altcoin Faucet
- 1
- Bitcoin Satoshi Tools : Faucets, Visitor Rewarder, Satoshi…
- 1
- brettwooldridge NuProcess · com.zaxxer:nuprocess
- 1
- brokercap Bifrost · github.com/brokercap/Bifrost
- 1
- CM Download Manager
- 1
Critical 9
- CVE-2022-30004Sourcecodester Online Market Place Site v1.0 suffers from an unauthenticated blind SQL Injection Vulnerability allowing remote attackers to
- CVE-2022-40050ZFile v4.1.1 was discovered to contain an arbitrary file upload vulnerability via the component /file/upload/1.
- CVE-2022-3075Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer proGoogle Chrome
- CVE-2022-28722Certain HP Print Products are potentially vulnerable to Buffer Overflow.Certain HP inkjet printers, HP LaserJet Pro printers, HP Pa…
- CVE-2022-28721Certain HP Print Products are potentially vulnerable to Remote Code Execution.Certain HP inkjet printers, HP LaserJet Pro printers, HP Pa…
- CVE-2022-40485Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /package_detail.php.
- CVE-2022-40484Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the booking parameter at /admin/client_edit.php.
- CVE-2022-40483Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /wedding_details.php.
- CVE-2022-41352An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0.
High 61
- CVE-2022-40099Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_
- CVE-2022-40098Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_
- CVE-2022-40097Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_
- CVE-2022-22058Memory corruption due to use after free issue in kernel while processing ION handles in Snapdragon Auto, Snapdragon Compute, Snapdragon ConnQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2022-40043Centreon v20.10.18 was discovered to contain a SQL injection vulnerability via the esc_name (Escalation Name) parameter at Configuration/Notcentreon/centreon
- CVE-2021-28052Hitachi Content Platform Information Disclosure VulnerabilityHitachi Vantara Hitachi Content Platform
- CVE-2022-3071Use after free in Tab Strip in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to eGoogle Chrome
- CVE-2022-3058Use after free in Sign-In Flow in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific Google Chrome
- CVE-2022-3055Use after free in Passwords in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI Google Chrome
- CVE-2022-3052Heap buffer overflow in Window Manager in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced Google Chrome
- CVE-2022-3051Heap buffer overflow in Exosphere in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a useGoogle Chrome
- CVE-2022-3050Heap buffer overflow in WebUI in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage Google Chrome
- CVE-2022-3049Use after free in SplitScreen in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user toGoogle Chrome
- CVE-2022-3046Use after free in Browser Tag in Google Chrome prior to 105.0.5195.52 allowed an attacker who convinced a user to install a malicious extensGoogle Chrome
- CVE-2022-3045Insufficient validation of untrusted input in V8 in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heGoogle Chrome
- CVE-2022-3043Heap buffer overflow in Screen Capture in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker who convinced a user tGoogle Chrome
- CVE-2022-3042Use after free in PhoneHub in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corrupGoogle Chrome
- CVE-2022-3041Use after free in WebSQL in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2022-3039Use after free in WebSQL in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2022-3040Use after free in Layout in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2022-3038Use after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption vGoogle Chrome
- CVE-2022-2998Use after free in Browser Creation in Google Chrome prior to 104.0.5112.101 allowed a remote attacker who had convinced a user to engage in Google Chrome
- CVE-2022-2859Use after free in Chrome OS Shell in Google Chrome prior to 104.0.5112.101 allowed a remote attacker who convinced a user to engage in speciGoogle Chrome
- CVE-2022-2858Use after free in Sign-In Flow in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption viaGoogle Chrome
- CVE-2022-2857Use after free in Blink in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2022-2855Use after free in ANGLE in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2022-2854Use after free in SwiftShader in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via Google Chrome
- CVE-2022-40784Unlimited strcpy on user input when setting a locale file leads to stack buffer overflow in mIPC camera firmware 5.3.1.2003161406.
- CVE-2022-40785Unsanitized input when setting a locale file leads to shell injection in mIPC camera firmware 5.3.1.2003161406.
- CVE-2022-3103off-by-one in io_uring module.Linux
- CVE-2022-39245Mist vulnerable to user providing a Sudo binary for authentication checksmakedeb mist
- CVE-2022-3204NRDelegation AttackNLnet Labs Unbound
- CVE-2022-39243NuProcess vulnerable to command-line injection through insertion of NUL character(s)brettwooldridge NuProcess · com.zaxxer:nuprocess
- CVE-2022-39219Bifrost users using basic authntication can bypass write permission limitbrokercap Bifrost · github.com/brokercap/Bifrost
- CVE-2022-40404Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/select.php.
- CVE-2022-40403Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/feature_edit.php.
- CVE-2022-40402Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the booking parameter at /admin/client_assign.php.
- CVE-2022-3119OAuth client Single Sign On for WordPress < 3.0.4 - Unauthenticated Settings Update to Authentication BypassOAuth client Single Sign On for WordPress
- CVE-2022-3076CM Download Manager < 2.8.6 - Admin+ Arbitrary File UploadCM Download Manager
- CVE-2022-2987Ldap WP Login / Active Directory Integration < 3.0.2 - Unauthenticated Settings Update to Auth BypassLdap WP Login / Active Directory Integration
- CVE-2022-2903NinjaForms < 3.6.13 - Admin+ PHP Objection InjectionNinja Forms Contact Form – The Drag and Drop Form Builder f…
- CVE-2022-2352Post SMTP < 2.1.7 - Admin+ Blind SSRFPost SMTP Mailer/Email Log
- CVE-2021-24890Scripts Organizer < 3.0 - Unauthenticated Arbitrary File Uploadscripts-organizer
- CVE-2022-40927Online Leave Management System v1.0 is vulnerable to SQL Injection via /leave_system/classes/Master.php?f=delete_designation.
- CVE-2022-40926Online Leave Management System v1.0 is vulnerable to SQL Injection via /leave_system/classes/Master.php?f=delete_leave_type.
- CVE-2022-40928Online Leave Management System v1.0 is vulnerable to SQL Injection via /leave_system/classes/Master.php?f=delete_application.
- CVE-2022-40925Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "save_event" file of the "Events" m
- CVE-2022-40924Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "save_animal" file of the "Animals"
- CVE-2022-36159Contec FXA3200 version 1.13 and under were discovered to contain a hard coded hash password for root stored in the component /etc/shadow.
- CVE-2022-36158Contec FXA3200 version 1.13.00 and under suffers from Insecure Permissions in the Wireless LAN Manager interface which allows malicious acto
- CVE-2022-21797Arbitrary Code Executionjoblib
- CVE-2022-21169Prototype Pollutionexpress-xss-sanitizer
- CVE-2022-41347An issue was discovered in Zimbra Collaboration (ZCS) 8.8.x and 9.x (e.g., 8.8.15).
- CVE-2022-2852Use after free in FedCM in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2022-2853Heap buffer overflow in Downloads in Google Chrome on Android prior to 104.0.5112.101 allowed a remote attacker who had compromised the rendGoogle Chrome
- CVE-2022-3195Out of bounds write in Storage in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to perform an out of bounds memory write vGoogle Chrome
- CVE-2022-3196Use after free in PDF in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafteGoogle Chrome
- CVE-2022-3197Use after free in PDF in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafteGoogle Chrome
- CVE-2022-3198Use after free in PDF in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafteGoogle Chrome
- CVE-2022-3199Use after free in Frames in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a craGoogle Chrome
- CVE-2022-3200Heap buffer overflow in Internals in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption Google Chrome
Medium, low and unrated 35
- CVE-2022-3298Allocation of Resources Without Limits or Throttling in ikus060/rdiffwebikus060/rdiffweb · rdiffweb
- CVE-2022-3290Improper Handling of Length Parameter Inconsistency in ikus060/rdiffwebikus060/rdiffweb · rdiffweb
- CVE-2022-30003Sourcecodester Online Market Place Site 1.0 is vulnerable to Cross Site Scripting (XSS), allowing attackers to register as a Seller then cre
- CVE-2022-3272Improper Handling of Length Parameter Inconsistency in ikus060/rdiffwebikus060/rdiffweb · rdiffweb
- CVE-2022-40044Centreon v20.10.18 was discovered to contain a cross-site scripting (XSS) vulnerability via the esc_name (Escalation Name) parameter at Confcentreon/centreon
- CVE-2022-3056Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to bypass conteGoogle Chrome
- CVE-2022-3057Inappropriate implementation in iframe Sandbox in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to leak cross-origin data vGoogle Chrome
- CVE-2022-3054Insufficient policy enforcement in DevTools in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap coGoogle Chrome
- CVE-2022-3053Inappropriate implementation in Pointer Lock in Google Chrome on Mac prior to 105.0.5195.52 allowed a remote attacker to restrict user navigGoogle Chrome
- CVE-2022-3047Insufficient policy enforcement in Extensions API in Google Chrome prior to 105.0.5195.52 allowed an attacker who convinced a user to instalGoogle Chrome
- CVE-2022-3048Inappropriate implementation in Chrome OS lockscreen in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a local attacker to bypassGoogle Chrome
- CVE-2022-3044Inappropriate implementation in Site Isolation in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who had compromised the renGoogle Chrome
- CVE-2022-2861Inappropriate implementation in Extensions API in Google Chrome prior to 104.0.5112.101 allowed an attacker who convinced a user to install Google Chrome
- CVE-2022-2860Insufficient policy enforcement in Cookies in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to bypass cookie prefix restriGoogle Chrome
- CVE-2022-2856Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 104.0.5112.101 allowed a remote attacker to arbitGoogle Chrome
- CVE-2021-41437An HTTP response splitting attack in web application in ASUS RT-AX88U before v3.0.0.4.388.20558 allows an attacker to craft a specific URL t
- CVE-2022-3299Open5GS AMF client.c denial of serviceOpen5GS
- CVE-2022-3135SEO Smart Links <= 3.0.1 - Admin+ Stored Cross-Site ScriptingSEO Smart Links
- CVE-2022-3098Login Block IPs <= 1.0.0 - Arbitrary Setting Update via CSRFLogin Block IPs
- CVE-2022-3074Slider Hero < 8.4.4 - Admin+ Stored Cross-Site ScriptingSlider Hero with Animation, Video Background
- CVE-2022-3070Generate PDF using Contact Form 7 < 3.6 - Admin+ Stored Cross-Site ScriptingGenerate PDF using Contact Form
- CVE-2022-3062Simple File List < 4.4.12 - Reflected Cross-Site ScriptingSimple File List
- CVE-2022-3069Wordlift < 3.37.2 - Admin+ Stored Cross-Site ScriptingWordLift – AI powered SEO – Schema
- CVE-2022-3025Bitcoin / Altcoin Faucet <= 1.6.0 - Settings Update to Stored XSS via CSRFBitcoin / Altcoin Faucet
- CVE-2022-2926Download Manager < 3.2.55 - Admin+ Arbitrary File/Folder Access via Path TraversalDownload Manager
- CVE-2022-2405WP Popup Builder < 1.3.0 - Subscriber+ Arbitrary Popup DeletionWP Popup Builder – Popup Forms , Marketing PoPuP & Newslet…
- CVE-2022-2404WP Popup Builder < 1.2.9 - Reflected Cross-Site ScriptingWP Popup Builder – Popup Forms , Marketing PoPuP & Newslet…
- CVE-2022-1755SVG Support < 2.5 - Author+ Stored Cross-Site ScriptingSVG Support
- CVE-2022-1613Restricted Site Access < 7.3.2 - Access Bypass via IP SpoofingRestricted Site Access
- CVE-2022-3295Allocation of Resources Without Limits or Throttling in ikus060/rdiffwebikus060/rdiffweb · rdiffweb
- CVE-2022-3301Improper Cleanup on Thrown Exception in ikus060/rdiffwebikus060/rdiffweb · rdiffweb
- CVE-2022-38970ieGeek IG20 hipcam RealServer V1.0 is vulnerable to Incorrect Access Control.
- CVE-2022-38553Academy Learning Management System before v5.9.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Sear
- CVE-2022-3024Simple Bitcoin Faucets <= 1.7.0 - Unauthorised AJAX Call to Stored XSSBitcoin Satoshi Tools : Faucets, Visitor Rewarder, Satoshi…
- CVE-2022-3201Insufficient validation of untrusted input in DevTools in Google Chrome on Chrome OS prior to 105.0.5195.125 allowed an attacker who convincGoogle Chrome