# CVEs published 2022-09-26

105 CVEs were published on September 26, 2022: 9 critical, 61 high. 4 are now in CISA KEV. Days are UTC.

- [CVE-2022-3298](https://cve.now/CVE-2022-3298.md): Allocation of Resources Without Limits or Throttling in ikus060/rdiffweb (CVSS 5.3, ikus060/rdiffweb · rdiffweb)
- [CVE-2022-40099](https://cve.now/CVE-2022-40099.md): Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update\_ (CVSS 7.2)
- [CVE-2022-40098](https://cve.now/CVE-2022-40098.md): Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update\_ (CVSS 7.2)
- [CVE-2022-40097](https://cve.now/CVE-2022-40097.md): Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update\_ (CVSS 7.2)
- [CVE-2022-30004](https://cve.now/CVE-2022-30004.md): Sourcecodester Online Market Place Site v1.0 suffers from an unauthenticated blind SQL Injection Vulnerability allowing remote attackers to (CVSS 9.8)
- [CVE-2022-40050](https://cve.now/CVE-2022-40050.md): ZFile v4.1.1 was discovered to contain an arbitrary file upload vulnerability via the component /file/upload/1. (CVSS 9.8)
- [CVE-2022-3290](https://cve.now/CVE-2022-3290.md): Improper Handling of Length Parameter Inconsistency in ikus060/rdiffweb (CVSS 5.7, ikus060/rdiffweb · rdiffweb)
- [CVE-2022-30003](https://cve.now/CVE-2022-30003.md): Sourcecodester Online Market Place Site 1.0 is vulnerable to Cross Site Scripting (XSS), allowing attackers to register as a Seller then cre (CVSS 5.4)
- [CVE-2022-3272](https://cve.now/CVE-2022-3272.md): Improper Handling of Length Parameter Inconsistency in ikus060/rdiffweb (CVSS 5.3, ikus060/rdiffweb · rdiffweb)
- [CVE-2022-22058](https://cve.now/CVE-2022-22058.md): Memory corruption due to use after free issue in kernel while processing ION handles in Snapdragon Auto, Snapdragon Compute, Snapdragon Conn (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2022-40044](https://cve.now/CVE-2022-40044.md): Centreon v20.10.18 was discovered to contain a cross-site scripting (XSS) vulnerability via the esc\_name (Escalation Name) parameter at Conf (CVSS 5.4, centreon/centreon)
- [CVE-2022-40043](https://cve.now/CVE-2022-40043.md): Centreon v20.10.18 was discovered to contain a SQL injection vulnerability via the esc\_name (Escalation Name) parameter at Configuration/Not (CVSS 8.8, centreon/centreon)
- [CVE-2021-28052](https://cve.now/CVE-2021-28052.md): Hitachi Content Platform Information Disclosure Vulnerability (CVSS 7.5, Hitachi Vantara Hitachi Content Platform)
- [CVE-2022-3075](https://cve.now/CVE-2022-3075.md): Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer pro (CVSS 9.6, KEV, Google Chrome)
- [CVE-2022-3071](https://cve.now/CVE-2022-3071.md): Use after free in Tab Strip in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to e (CVSS 8.8, Google Chrome)
- [CVE-2022-3058](https://cve.now/CVE-2022-3058.md): Use after free in Sign-In Flow in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific (CVSS 8.8, Google Chrome)
- [CVE-2022-3056](https://cve.now/CVE-2022-3056.md): Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to bypass conte (CVSS 6.5, Google Chrome)
- [CVE-2022-3057](https://cve.now/CVE-2022-3057.md): Inappropriate implementation in iframe Sandbox in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to leak cross-origin data v (CVSS 6.5, Google Chrome)
- [CVE-2022-3055](https://cve.now/CVE-2022-3055.md): Use after free in Passwords in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI (CVSS 8.8, Google Chrome)
- [CVE-2022-3054](https://cve.now/CVE-2022-3054.md): Insufficient policy enforcement in DevTools in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap co (CVSS 6.5, Google Chrome)
- [CVE-2022-3053](https://cve.now/CVE-2022-3053.md): Inappropriate implementation in Pointer Lock in Google Chrome on Mac prior to 105.0.5195.52 allowed a remote attacker to restrict user navig (CVSS 4.3, Google Chrome)
- [CVE-2022-3052](https://cve.now/CVE-2022-3052.md): Heap buffer overflow in Window Manager in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced (CVSS 8.8, Google Chrome)
- [CVE-2022-3051](https://cve.now/CVE-2022-3051.md): Heap buffer overflow in Exosphere in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a use (CVSS 8.8, Google Chrome)
- [CVE-2022-3050](https://cve.now/CVE-2022-3050.md): Heap buffer overflow in WebUI in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage (CVSS 8.8, Google Chrome)
- [CVE-2022-3049](https://cve.now/CVE-2022-3049.md): Use after free in SplitScreen in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to (CVSS 8.8, Google Chrome)
- [CVE-2022-3047](https://cve.now/CVE-2022-3047.md): Insufficient policy enforcement in Extensions API in Google Chrome prior to 105.0.5195.52 allowed an attacker who convinced a user to instal (CVSS 6.5, Google Chrome)
- [CVE-2022-3048](https://cve.now/CVE-2022-3048.md): Inappropriate implementation in Chrome OS lockscreen in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a local attacker to bypass (CVSS 6.8, Google Chrome)
- [CVE-2022-3046](https://cve.now/CVE-2022-3046.md): Use after free in Browser Tag in Google Chrome prior to 105.0.5195.52 allowed an attacker who convinced a user to install a malicious extens (CVSS 8.8, Google Chrome)
- [CVE-2022-3045](https://cve.now/CVE-2022-3045.md): Insufficient validation of untrusted input in V8 in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit he (CVSS 8.8, Google Chrome)
- [CVE-2022-3044](https://cve.now/CVE-2022-3044.md): Inappropriate implementation in Site Isolation in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who had compromised the ren (CVSS 6.5, Google Chrome)
- [CVE-2022-3043](https://cve.now/CVE-2022-3043.md): Heap buffer overflow in Screen Capture in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker who convinced a user t (CVSS 8.8, Google Chrome)
- [CVE-2022-3042](https://cve.now/CVE-2022-3042.md): Use after free in PhoneHub in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corrup (CVSS 8.8, Google Chrome)
- [CVE-2022-3041](https://cve.now/CVE-2022-3041.md): Use after free in WebSQL in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a craf (CVSS 8.8, Google Chrome)
- [CVE-2022-3039](https://cve.now/CVE-2022-3039.md): Use after free in WebSQL in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a craf (CVSS 8.8, Google Chrome)
- [CVE-2022-3040](https://cve.now/CVE-2022-3040.md): Use after free in Layout in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a craf (CVSS 8.8, Google Chrome)
- [CVE-2022-3038](https://cve.now/CVE-2022-3038.md): Use after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption v (CVSS 8.8, KEV, Google Chrome)
- [CVE-2022-2998](https://cve.now/CVE-2022-2998.md): Use after free in Browser Creation in Google Chrome prior to 104.0.5112.101 allowed a remote attacker who had convinced a user to engage in (CVSS 8.8, Google Chrome)
- [CVE-2022-2861](https://cve.now/CVE-2022-2861.md): Inappropriate implementation in Extensions API in Google Chrome prior to 104.0.5112.101 allowed an attacker who convinced a user to install (CVSS 6.5, Google Chrome)
- [CVE-2022-2860](https://cve.now/CVE-2022-2860.md): Insufficient policy enforcement in Cookies in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to bypass cookie prefix restri (CVSS 6.5, Google Chrome)
- [CVE-2022-2859](https://cve.now/CVE-2022-2859.md): Use after free in Chrome OS Shell in Google Chrome prior to 104.0.5112.101 allowed a remote attacker who convinced a user to engage in speci (CVSS 8.8, Google Chrome)
- [CVE-2022-2858](https://cve.now/CVE-2022-2858.md): Use after free in Sign-In Flow in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via (CVSS 8.8, Google Chrome)
- [CVE-2022-2857](https://cve.now/CVE-2022-2857.md): Use after free in Blink in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via a craf (CVSS 8.8, Google Chrome)
- [CVE-2022-2855](https://cve.now/CVE-2022-2855.md): Use after free in ANGLE in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via a craf (CVSS 8.8, Google Chrome)
- [CVE-2022-2856](https://cve.now/CVE-2022-2856.md): Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 104.0.5112.101 allowed a remote attacker to arbit (CVSS 6.5, KEV, Google Chrome)
- [CVE-2022-2854](https://cve.now/CVE-2022-2854.md): Use after free in SwiftShader in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via (CVSS 8.8, Google Chrome)
- [CVE-2022-40784](https://cve.now/CVE-2022-40784.md): Unlimited strcpy on user input when setting a locale file leads to stack buffer overflow in mIPC camera firmware 5.3.1.2003161406. (CVSS 8.8)
- [CVE-2022-40785](https://cve.now/CVE-2022-40785.md): Unsanitized input when setting a locale file leads to shell injection in mIPC camera firmware 5.3.1.2003161406. (CVSS 8.8)
- [CVE-2022-28722](https://cve.now/CVE-2022-28722.md): Certain HP Print Products are potentially vulnerable to Buffer Overflow. (CVSS 9.8, Certain HP inkjet printers, HP LaserJet Pro printers, HP Pa…)
- [CVE-2022-28721](https://cve.now/CVE-2022-28721.md): Certain HP Print Products are potentially vulnerable to Remote Code Execution. (CVSS 9.8, Certain HP inkjet printers, HP LaserJet Pro printers, HP Pa…)
- [CVE-2022-3103](https://cve.now/CVE-2022-3103.md): off-by-one in io\_uring module. (CVSS 7.8, Linux)
- [CVE-2022-39245](https://cve.now/CVE-2022-39245.md): Mist vulnerable to user providing a Sudo binary for authentication checks (CVSS 8.4, makedeb mist)
- [CVE-2022-3204](https://cve.now/CVE-2022-3204.md): NRDelegation Attack (CVSS 7.5, NLnet Labs Unbound)
- [CVE-2022-39243](https://cve.now/CVE-2022-39243.md): NuProcess vulnerable to command-line injection through insertion of NUL character(s) (CVSS 8.4, brettwooldridge NuProcess · com.zaxxer:nuprocess)
- [CVE-2021-41437](https://cve.now/CVE-2021-41437.md): An HTTP response splitting attack in web application in ASUS RT-AX88U before v3.0.0.4.388.20558 allows an attacker to craft a specific URL t (CVSS 6.5)
- [CVE-2022-39219](https://cve.now/CVE-2022-39219.md): Bifrost users using basic authntication can bypass write permission limit (CVSS 8.5, brokercap Bifrost · github.com/brokercap/Bifrost)
- [CVE-2022-40485](https://cve.now/CVE-2022-40485.md): Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /package\_detail.php. (CVSS 9.8)
- [CVE-2022-40484](https://cve.now/CVE-2022-40484.md): Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the booking parameter at /admin/client\_edit.php. (CVSS 9.8)
- [CVE-2022-40483](https://cve.now/CVE-2022-40483.md): Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /wedding\_details.php. (CVSS 9.8)
- [CVE-2022-40404](https://cve.now/CVE-2022-40404.md): Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/select.php. (CVSS 8.8)
- [CVE-2022-40403](https://cve.now/CVE-2022-40403.md): Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/feature\_edit.php. (CVSS 7.2)
- [CVE-2022-40402](https://cve.now/CVE-2022-40402.md): Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the booking parameter at /admin/client\_assign.php. (CVSS 8.8)
- [CVE-2022-3299](https://cve.now/CVE-2022-3299.md): Open5GS AMF client.c denial of service (CVSS 4.3, Open5GS)
- [CVE-2022-3135](https://cve.now/CVE-2022-3135.md): SEO Smart Links \<= 3.0.1 - Admin+ Stored Cross-Site Scripting (CVSS 4.8, SEO Smart Links)
- [CVE-2022-3119](https://cve.now/CVE-2022-3119.md): OAuth client Single Sign On for WordPress \< 3.0.4 - Unauthenticated Settings Update to Authentication Bypass (CVSS 7.5, OAuth client Single Sign On for WordPress)
- [CVE-2022-3098](https://cve.now/CVE-2022-3098.md): Login Block IPs \<= 1.0.0 - Arbitrary Setting Update via CSRF (CVSS 4.3, Login Block IPs)
- [CVE-2022-3076](https://cve.now/CVE-2022-3076.md): CM Download Manager \< 2.8.6 - Admin+ Arbitrary File Upload (CVSS 7.2, CM Download Manager)
- [CVE-2022-3074](https://cve.now/CVE-2022-3074.md): Slider Hero \< 8.4.4 - Admin+ Stored Cross-Site Scripting (CVSS 4.8, Slider Hero with Animation, Video Background)
- [CVE-2022-3070](https://cve.now/CVE-2022-3070.md): Generate PDF using Contact Form 7 \< 3.6 - Admin+ Stored Cross-Site Scripting (CVSS 4.8, Generate PDF using Contact Form)
- [CVE-2022-3062](https://cve.now/CVE-2022-3062.md): Simple File List \< 4.4.12 - Reflected Cross-Site Scripting (CVSS 6.1, Simple File List)
- [CVE-2022-3069](https://cve.now/CVE-2022-3069.md): Wordlift \< 3.37.2 - Admin+ Stored Cross-Site Scripting (CVSS 4.8, WordLift – AI powered SEO – Schema)
- [CVE-2022-3025](https://cve.now/CVE-2022-3025.md): Bitcoin / Altcoin Faucet \<= 1.6.0 - Settings Update to Stored XSS via CSRF (CVSS 5.4, Bitcoin / Altcoin Faucet)
- [CVE-2022-2987](https://cve.now/CVE-2022-2987.md): Ldap WP Login / Active Directory Integration \< 3.0.2 - Unauthenticated Settings Update to Auth Bypass (CVSS 7.5, Ldap WP Login / Active Directory Integration)
- [CVE-2022-2926](https://cve.now/CVE-2022-2926.md): Download Manager \< 3.2.55 - Admin+ Arbitrary File/Folder Access via Path Traversal (CVSS 4.9, Download Manager)
- [CVE-2022-2405](https://cve.now/CVE-2022-2405.md): WP Popup Builder \< 1.3.0 - Subscriber+ Arbitrary Popup Deletion (CVSS 4.3, WP Popup Builder – Popup Forms , Marketing PoPuP & Newslet…)
- [CVE-2022-2903](https://cve.now/CVE-2022-2903.md): NinjaForms \< 3.6.13 - Admin+ PHP Objection Injection (CVSS 7.2, Ninja Forms Contact Form – The Drag and Drop Form Builder f…)
- [CVE-2022-2404](https://cve.now/CVE-2022-2404.md): WP Popup Builder \< 1.2.9 - Reflected Cross-Site Scripting (CVSS 6.1, WP Popup Builder – Popup Forms , Marketing PoPuP & Newslet…)
- [CVE-2022-2352](https://cve.now/CVE-2022-2352.md): Post SMTP \< 2.1.7 - Admin+ Blind SSRF (CVSS 7.2, Post SMTP Mailer/Email Log)
- [CVE-2022-1755](https://cve.now/CVE-2022-1755.md): SVG Support \< 2.5 - Author+ Stored Cross-Site Scripting (CVSS 5.4, SVG Support)
- [CVE-2022-1613](https://cve.now/CVE-2022-1613.md): Restricted Site Access \< 7.3.2 - Access Bypass via IP Spoofing (CVSS 5.3, Restricted Site Access)
- [CVE-2021-24890](https://cve.now/CVE-2021-24890.md): Scripts Organizer \< 3.0 - Unauthenticated Arbitrary File Upload (CVSS 8.8, scripts-organizer)
- [CVE-2022-40927](https://cve.now/CVE-2022-40927.md): Online Leave Management System v1.0 is vulnerable to SQL Injection via /leave\_system/classes/Master.php?f=delete\_designation. (CVSS 7.2)
- [CVE-2022-40926](https://cve.now/CVE-2022-40926.md): Online Leave Management System v1.0 is vulnerable to SQL Injection via /leave\_system/classes/Master.php?f=delete\_leave\_type. (CVSS 7.2)
- [CVE-2022-3295](https://cve.now/CVE-2022-3295.md): Allocation of Resources Without Limits or Throttling in ikus060/rdiffweb (CVSS 5.3, ikus060/rdiffweb · rdiffweb)
- [CVE-2022-40928](https://cve.now/CVE-2022-40928.md): Online Leave Management System v1.0 is vulnerable to SQL Injection via /leave\_system/classes/Master.php?f=delete\_application. (CVSS 7.2)
- [CVE-2022-40925](https://cve.now/CVE-2022-40925.md): Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "save\_event" file of the "Events" m (CVSS 7.2)
- [CVE-2022-40924](https://cve.now/CVE-2022-40924.md): Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "save\_animal" file of the "Animals" (CVSS 7.2)
- [CVE-2022-3301](https://cve.now/CVE-2022-3301.md): Improper Cleanup on Thrown Exception in ikus060/rdiffweb (CVSS 4.3, ikus060/rdiffweb · rdiffweb)
- [CVE-2022-38970](https://cve.now/CVE-2022-38970.md): ieGeek IG20 hipcam RealServer V1.0 is vulnerable to Incorrect Access Control. (CVSS 6.5)
- [CVE-2022-36159](https://cve.now/CVE-2022-36159.md): Contec FXA3200 version 1.13 and under were discovered to contain a hard coded hash password for root stored in the component /etc/shadow. (CVSS 8.8)
- [CVE-2022-36158](https://cve.now/CVE-2022-36158.md): Contec FXA3200 version 1.13.00 and under suffers from Insecure Permissions in the Wireless LAN Manager interface which allows malicious acto (CVSS 8.8)
- [CVE-2022-38553](https://cve.now/CVE-2022-38553.md): Academy Learning Management System before v5.9.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Sear (CVSS 6.1)
- [CVE-2022-21797](https://cve.now/CVE-2022-21797.md): Arbitrary Code Execution (CVSS 7.3, joblib)
- [CVE-2022-21169](https://cve.now/CVE-2022-21169.md): Prototype Pollution (CVSS 7.3, express-xss-sanitizer)
- [CVE-2022-41347](https://cve.now/CVE-2022-41347.md): An issue was discovered in Zimbra Collaboration (ZCS) 8.8.x and 9.x (e.g., 8.8.15). (CVSS 7.8)
- [CVE-2022-2852](https://cve.now/CVE-2022-2852.md): Use after free in FedCM in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via a craf (CVSS 8.8, Google Chrome)
- [CVE-2022-2853](https://cve.now/CVE-2022-2853.md): Heap buffer overflow in Downloads in Google Chrome on Android prior to 104.0.5112.101 allowed a remote attacker who had compromised the rend (CVSS 8.8, Google Chrome)
- [CVE-2022-3024](https://cve.now/CVE-2022-3024.md): Simple Bitcoin Faucets \<= 1.7.0 - Unauthorised AJAX Call to Stored XSS (CVSS 5.4, Bitcoin Satoshi Tools : Faucets, Visitor Rewarder, Satoshi…)
- [CVE-2022-3195](https://cve.now/CVE-2022-3195.md): Out of bounds write in Storage in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to perform an out of bounds memory write v (CVSS 8.8, Google Chrome)
- [CVE-2022-3196](https://cve.now/CVE-2022-3196.md): Use after free in PDF in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafte (CVSS 8.8, Google Chrome)
- [CVE-2022-3197](https://cve.now/CVE-2022-3197.md): Use after free in PDF in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafte (CVSS 8.8, Google Chrome)
- [CVE-2022-3198](https://cve.now/CVE-2022-3198.md): Use after free in PDF in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafte (CVSS 8.8, Google Chrome)
- [CVE-2022-3199](https://cve.now/CVE-2022-3199.md): Use after free in Frames in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a cra (CVSS 8.8, Google Chrome)
- [CVE-2022-3200](https://cve.now/CVE-2022-3200.md): Heap buffer overflow in Internals in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption (CVSS 8.8, Google Chrome)
- [CVE-2022-3201](https://cve.now/CVE-2022-3201.md): Insufficient validation of untrusted input in DevTools in Google Chrome on Chrome OS prior to 105.0.5195.125 allowed an attacker who convinc (no CVSS, Google Chrome)
- [CVE-2022-41352](https://cve.now/CVE-2022-41352.md): An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. (CVSS 9.8, KEV)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-09-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.