# CVEs published 2022-09-27 33 CVEs were published on September 27, 2022: 6 critical, 14 high. Days are UTC. - [CVE-2022-40497](https://cve.now/CVE-2022-40497.md): Wazuh v3.6.1 - v3.13.5, v4.0.0 - v4.2.7, and v4.3.0 - v4.3.7 were discovered to contain an authenticated remote code execution (RCE) vulnera (CVSS 8.8) - [CVE-2021-41433](https://cve.now/CVE-2021-41433.md): SQL Injection vulnerability exists in version 1.0 of the Resumes Management and Job Application Website application login form by EGavilan M (CVSS 9.8) - [CVE-2021-27862](https://cve.now/CVE-2021-27862.md): L2 network filtering bypass using stacked VLAN0 and LLC/SNAP headers with an invalid length during Ethernet to Wifi frame translation (CVSS 4.7, IEEE · draft-ietf-v6ops-ra-guard-08) - [CVE-2021-27861](https://cve.now/CVE-2021-27861.md): L2 network filtering bypass using stacked VLAN0 and LLC/SNAP headers with invalid lengths (CVSS 4.7, IEEE · draft-ietf-v6ops-ra-guard +1) - [CVE-2021-27854](https://cve.now/CVE-2021-27854.md): L2 network filtering bypass using stacked VLAN0, LLC/SNAP headers, and Ethernet to Wifi frame translation (CVSS 4.7, IETF P802.1Q · draft-ietf-v6ops-ra-guard +1) - [CVE-2022-39835](https://cve.now/CVE-2022-39835.md): An issue was discovered in Gajim through 1.4.7. (CVSS 5.3) - [CVE-2021-27853](https://cve.now/CVE-2021-27853.md): L2 network filtering can be bypassed using stacked VLAN0 and LLC/SNAP headers (CVSS 4.7, IEEE · draft-ietf-v6ops-ra-guard +1) - [CVE-2022-38932](https://cve.now/CVE-2022-38932.md): readelf in ToaruOS 2.0.1 has a global overflow allowing RCE when parsing a crafted ELF file. (CVSS 8.4) - [CVE-2022-37028](https://cve.now/CVE-2022-37028.md): ISAMS 22.2.3.2 is prone to stored Cross-site Scripting (XSS) attack on the title field for groups, allowing an attacker to store a JavaScrip (CVSS 5.4) - [CVE-2022-38335](https://cve.now/CVE-2022-38335.md): Vtiger CRM v7.4.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the e-mail template modules. (CVSS 5.4) - [CVE-2022-40877](https://cve.now/CVE-2022-40877.md): Exam Reviewer Management System 1.0 is vulnerable to SQL Injection via the ‘id’ parameter. (CVSS 9.8) - [CVE-2022-40878](https://cve.now/CVE-2022-40878.md): In Exam Reviewer Management System 1.0, an authenticated attacker can upload a web-shell php file in profile page to achieve Remote Code Exe (CVSS 8.8) - [CVE-2022-40816](https://cve.now/CVE-2022-40816.md): Zammad 5.2.1 is vulnerable to Incorrect Access Control. (CVSS 6.5) - [CVE-2022-40817](https://cve.now/CVE-2022-40817.md): Zammad 5.2.1 has a fine-grained permission model that allows to configure read-only access to tickets. (CVSS 4.3) - [CVE-2022-39258](https://cve.now/CVE-2022-39258.md): mailcow-dockerized critical information misrepresentation can lead to phishing attacks through Swagger UI (CVSS 8.1, mailcow-dockerized) - [CVE-2022-39256](https://cve.now/CVE-2022-39256.md): Orckestra C1 CMS's deserialization of untrusted data allows for arbitrary code execution. (CVSS 9.0, Orckestra C1-CMS-Foundation · CompositeC1.Core) - [CVE-2022-23006](https://cve.now/CVE-2022-23006.md): Buffer Overflow Vulnerability in Western Digital My Cloud Home Products and SanDisk ibi (CVSS 1.8, Western Digital My Cloud Home · SanDisk ibi) - [CVE-2022-3323](https://cve.now/CVE-2022-3323.md): An SQL injection vulnerability in Advantech iView 5.7.04.6469. (CVSS 7.5, Advantech iView) - [CVE-2022-40354](https://cve.now/CVE-2022-40354.md): Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update\_ (CVSS 7.2) - [CVE-2022-40353](https://cve.now/CVE-2022-40353.md): Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/up\_book (CVSS 7.2) - [CVE-2022-40352](https://cve.now/CVE-2022-40352.md): Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update\_ (CVSS 7.2) - [CVE-2022-37209](https://cve.now/CVE-2022-37209.md): JFinal CMS 5.1.0 is affected by: SQL Injection. (CVSS 8.8) - [CVE-2022-31367](https://cve.now/CVE-2022-31367.md): Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses. (CVSS 8.8, strapi · @strapi/strapi) - [CVE-2022-37193](https://cve.now/CVE-2022-37193.md): Chipolo ONE Bluetooth tracker (2020) Chipolo iOS app version 4.13.0 is vulnerable to Incorrect Access Control. (CVSS 7.4) - [CVE-2022-41604](https://cve.now/CVE-2022-41604.md): Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. (CVSS 8.8) - [CVE-2022-40199](https://cve.now/CVE-2022-40199.md): Directory traversal vulnerability in EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p4 ) and EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a r (CVSS 2.7, EC-CUBE CO. EC-CUBE 3 series and EC-CUBE 4 series · ec-cube…) - [CVE-2022-38975](https://cve.now/CVE-2022-38975.md): DOM-based cross-site scripting vulnerability in EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote attacker to inject an arbitrary sc (CVSS 5.4, EC-CUBE CO. EC-CUBE 4 series · ec-cube/ec-cube) - [CVE-2022-37346](https://cve.now/CVE-2022-37346.md): EC-CUBE plugin 'Product Image Bulk Upload Plugin' 1.0.0 and 4.1.0 contains an insufficient verification vulnerability when uploading files. (CVSS 9.8, EC-CUBE CO. Product Image Bulk Upload Plugin) - [CVE-2022-41571](https://cve.now/CVE-2022-41571.md): An issue was discovered in EyesOfNetwork (EON) through 5.3.11. (CVSS 9.8) - [CVE-2022-41570](https://cve.now/CVE-2022-41570.md): An issue was discovered in EyesOfNetwork (EON) through 5.3.11. (CVSS 9.8) - [CVE-2022-3303](https://cve.now/CVE-2022-3303.md): A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. (CVSS 4.7, Linux kernel) - [CVE-2022-3324](https://cve.now/CVE-2022-3324.md): Stack-based Buffer Overflow in vim/vim (CVSS 7.8, vim/vim) - [CVE-2022-34326](https://cve.now/CVE-2022-34326.md): In ambiot amb1\_sdk (aka SDK for Ameba1) before 2022-06-20 on Realtek RTL8195AM devices before 284241d70308ff2519e40afd7b284ba892c730a3, the (CVSS 7.5) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2022-09-27 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.