CVEs published September 27, 2022
33 CVEs were published on September 27, 2022: 6 critical, 14 high.
- Published
- 33
- Critical
- 6
- High
- 14
- Medium
- 11
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- IEEE · draft-ietf-v6ops-ra-guard +1
- 2
- Advantech iView
- 1
- EC-CUBE CO. EC-CUBE 3 series and EC-CUBE 4 series · ec-cube…
- 1
- EC-CUBE CO. EC-CUBE 4 series · ec-cube/ec-cube
- 1
- EC-CUBE CO. Product Image Bulk Upload Plugin
- 1
- IEEE · draft-ietf-v6ops-ra-guard-08
- 1
- IETF P802.1Q · draft-ietf-v6ops-ra-guard +1
- 1
- Linux kernel
- 1
- mailcow-dockerized
- 1
- Orckestra C1-CMS-Foundation · CompositeC1.Core
- 1
Critical 6
- CVE-2021-41433SQL Injection vulnerability exists in version 1.0 of the Resumes Management and Job Application Website application login form by EGavilan M
- CVE-2022-40877Exam Reviewer Management System 1.0 is vulnerable to SQL Injection via the ‘id’ parameter.
- CVE-2022-39256Orckestra C1 CMS's deserialization of untrusted data allows for arbitrary code execution.Orckestra C1-CMS-Foundation · CompositeC1.Core
- CVE-2022-37346EC-CUBE plugin 'Product Image Bulk Upload Plugin' 1.0.0 and 4.1.0 contains an insufficient verification vulnerability when uploading files.EC-CUBE CO. Product Image Bulk Upload Plugin
- CVE-2022-41571An issue was discovered in EyesOfNetwork (EON) through 5.3.11.
- CVE-2022-41570An issue was discovered in EyesOfNetwork (EON) through 5.3.11.
High 14
- CVE-2022-40497Wazuh v3.6.1 - v3.13.5, v4.0.0 - v4.2.7, and v4.3.0 - v4.3.7 were discovered to contain an authenticated remote code execution (RCE) vulnera
- CVE-2022-38932readelf in ToaruOS 2.0.1 has a global overflow allowing RCE when parsing a crafted ELF file.
- CVE-2022-40878In Exam Reviewer Management System 1.0, an authenticated attacker can upload a web-shell php file in profile page to achieve Remote Code Exe
- CVE-2022-39258mailcow-dockerized critical information misrepresentation can lead to phishing attacks through Swagger UImailcow-dockerized
- CVE-2022-3323An SQL injection vulnerability in Advantech iView 5.7.04.6469.Advantech iView
- CVE-2022-40354Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_
- CVE-2022-40353Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/up_book
- CVE-2022-40352Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_
- CVE-2022-37209JFinal CMS 5.1.0 is affected by: SQL Injection.
- CVE-2022-31367Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses.strapi · @strapi/strapi
- CVE-2022-37193Chipolo ONE Bluetooth tracker (2020) Chipolo iOS app version 4.13.0 is vulnerable to Incorrect Access Control.
- CVE-2022-41604Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges.
- CVE-2022-3324Stack-based Buffer Overflow in vim/vimvim/vim
- CVE-2022-34326In ambiot amb1_sdk (aka SDK for Ameba1) before 2022-06-20 on Realtek RTL8195AM devices before 284241d70308ff2519e40afd7b284ba892c730a3, the
Medium, low and unrated 13
- CVE-2021-27862L2 network filtering bypass using stacked VLAN0 and LLC/SNAP headers with an invalid length during Ethernet to Wifi frame translationIEEE · draft-ietf-v6ops-ra-guard-08
- CVE-2021-27861L2 network filtering bypass using stacked VLAN0 and LLC/SNAP headers with invalid lengthsIEEE · draft-ietf-v6ops-ra-guard +1
- CVE-2021-27854L2 network filtering bypass using stacked VLAN0, LLC/SNAP headers, and Ethernet to Wifi frame translationIETF P802.1Q · draft-ietf-v6ops-ra-guard +1
- CVE-2022-39835An issue was discovered in Gajim through 1.4.7.
- CVE-2021-27853L2 network filtering can be bypassed using stacked VLAN0 and LLC/SNAP headersIEEE · draft-ietf-v6ops-ra-guard +1
- CVE-2022-37028ISAMS 22.2.3.2 is prone to stored Cross-site Scripting (XSS) attack on the title field for groups, allowing an attacker to store a JavaScrip
- CVE-2022-38335Vtiger CRM v7.4.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the e-mail template modules.
- CVE-2022-40816Zammad 5.2.1 is vulnerable to Incorrect Access Control.
- CVE-2022-40817Zammad 5.2.1 has a fine-grained permission model that allows to configure read-only access to tickets.
- CVE-2022-23006Buffer Overflow Vulnerability in Western Digital My Cloud Home Products and SanDisk ibiWestern Digital My Cloud Home · SanDisk ibi
- CVE-2022-40199Directory traversal vulnerability in EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p4 ) and EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a rEC-CUBE CO. EC-CUBE 3 series and EC-CUBE 4 series · ec-cube…
- CVE-2022-38975DOM-based cross-site scripting vulnerability in EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote attacker to inject an arbitrary scEC-CUBE CO. EC-CUBE 4 series · ec-cube/ec-cube
- CVE-2022-3303A race condition flaw was found in the Linux kernel sound subsystem due to improper locking.Linux kernel