CVEs published September 28, 2022
73 CVEs were published on September 28, 2022: 11 critical, 20 high.
- Published
- 73
- Critical
- 11
- High
- 20
- Medium
- 31
- Low
- 8
- Unrated
- 3
- Now in CISA KEV
- 0
- Fix available
- 35
Most affected products
- Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller · C…
- 11
- Smart eVision Information Technology Smart eVision
- 7
- Trend Micro Deep Security
- 4
- Dell Networking OS10
- 3
- matrix-org matrix-js-sdk · matrix-js-sdk
- 3
- bytebase · github.com/bytebase/bytebase
- 2
- ikus060/rdiffweb · rdiffweb
- 2
- matrix-org matrix-android-sdk2 · org.matrix.android:matrix-…
- 2
- matrix-org matrix-ios-sdk
- 2
- PHP Group PHP
- 2
Critical 11
- CVE-2022-40942Tenda TX3 US_TX3V1.0br_V16.03.13.11 is vulnerable to stack overflow via compare_parentcontrol_time.
- CVE-2022-28814Path traversal in Carlo Gavazzi UWP 3.0 could lead to full device accessCarlo Gavazzi UWP 3.0 Monitoring Gateway and Controller · C…
- CVE-2022-28812Use of Hard-coded Credentials in UWP3.0 allows SuperUser authentication bypass in Car Park Server.Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller · C…
- CVE-2022-28811Possible command injection in Car Park Server in Carlo Gavazzi UWP3.0Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller · C…
- CVE-2022-22526Missing authentication for API in Carlo Gavazzi UWP 3.0 Car Park ServerCarlo Gavazzi UWP 3.0 Monitoring Gateway and Controller · C…
- CVE-2022-22524SQL-injection in Carlo Gavazzi UWP 3.0 allows for full database accessCarlo Gavazzi UWP 3.0 Monitoring Gateway and Controller · C…
- CVE-2022-22522Hard-coded credentials in Carlo Gavazzi UWP3.0 allows for authentication bypass and full control of the deviceCarlo Gavazzi UWP 3.0 Monitoring Gateway and Controller · C…
- CVE-2022-40083Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component.github.com/labstack/echo/v4
- CVE-2022-30935An authorization bypass in b2evolution allows remote, unauthenticated attackers to predict password reset tokens for any user through the us
- CVE-2022-39033Smart eVision - Path Traversal -1Smart eVision Information Technology Smart eVision
- CVE-2022-40929XXL-JOB 2.2.0 has a Command execution vulnerability in background tasks.com.xuxueli:xxl-job-core
High 20
- CVE-2022-39257Matrix iOS SDK vulnerable to impersonation via forwarded Megolm sessionsmatrix-org matrix-ios-sdk
- CVE-2022-39255Matrix iOS SDK vulnerable ton Olm/Megolm protocol confusionmatrix-org matrix-ios-sdk
- CVE-2022-34424Networking OS10, versions 10.5.1.x, 10.5.2.x, and 10.5.3.x contain a vulnerability that could allow an attacker to cause a system crash by rDell Networking OS10
- CVE-2022-39248matrix-android-sdk2 vulnerable to Olm/Megolm protocol confusionmatrix-org matrix-android-sdk2 · org.matrix.android:matrix-…
- CVE-2022-39246matrix-android-sdk2 vulnerable to impersonation via forwarded Megolm sessionsmatrix-org matrix-android-sdk2 · org.matrix.android:matrix-…
- CVE-2022-3215NIOHTTP1 and projects using it for generating HTTP responses can be subject to a HTTP Response Injection attack.Swift Project SwiftNIO
- CVE-2022-36448An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5.
- CVE-2022-22525Command injection in restore function of Carlo Gavazzi UWP3.0 allows for command injectionCarlo Gavazzi UWP 3.0 Monitoring Gateway and Controller · C…
- CVE-2022-22523Carlo Gavazzi UWP 3.0 WebApp allows for authentication bypassCarlo Gavazzi UWP 3.0 Monitoring Gateway and Controller · C…
- CVE-2022-40082Hertz v0.3.0 ws discovered to contain a path traversal vulnerability via the normalizePath function.github.com/cloudwego/hertz
- CVE-2022-40486TP Link Archer AX10 V1 Firmware Version 1.3.1 Build 20220401 Rel.
- CVE-2022-32168notepad-plus-plus - DLL Hijackingnotepad-plus-plus
- CVE-2022-39032Smart eVision - Improper Privilege ManagementSmart eVision Information Technology Smart eVision
- CVE-2022-39030Smart eVision - Exposure of Sensitive Information to an Unauthorized Actor -2Smart eVision Information Technology Smart eVision
- CVE-2022-1270In GraphicsMagick, a heap buffer overflow was found when parsing MIFF.GraphicsMagick
- CVE-2022-28813SQL-injection in Car Park Server 3.0 allows for full database access.Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller · C…
- CVE-2022-39249Matrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessionsmatrix-org matrix-js-sdk · matrix-js-sdk
- CVE-2022-39251Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusionmatrix-org matrix-js-sdk · matrix-js-sdk
- CVE-2022-39261Twig may load a template outside a configured directory when using the filesystem loadertwigphp Twig · drupal/core +1
- CVE-2022-39264nheko vulnerable to secret poisoning using MITM on secret requests by the homeserverNheko-Reborn nheko
Medium, low and unrated 42
- CVE-2022-3326Weak Password Requirements in ikus060/rdiffwebikus060/rdiffweb · rdiffweb
- CVE-2022-31629$_COOKIE names string replacement (. -> _): cookie integrity vulnerabilitiesPHP Group PHP
- CVE-2022-31628phar wrapper can occur dos when using quine gzip filePHP Group PHP
- CVE-2022-40710A link following vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows could allow a local attacTrend Micro Deep Security
- CVE-2022-40709An Out-of-bounds read vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows could allow a local Trend Micro Deep Security
- CVE-2022-40708An Out-of-bounds read vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows could allow a local Trend Micro Deep Security
- CVE-2022-40707An Out-of-bounds read vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows could allow a local Trend Micro Deep Security
- CVE-2022-39263NextAuth.js Upstash Adapter missing token verificationnextauthjs next-auth · @next-auth/upstash-redis-adapter
- CVE-2022-34394Dell OS10, version 10.5.3.4, contains an Improper Certificate Validation vulnerability in Support Assist.Dell Networking OS10
- CVE-2022-29089Dell Networking OS10, versions prior to October 2021 with Smart Fabric Services enabled, contains an information disclosure vulnerability.Dell Networking OS10
- CVE-2022-3292Use of Cache Containing Sensitive Information in ikus060/rdiffwebikus060/rdiffweb · rdiffweb
- CVE-2022-23716A flaw was discovered in ECE before 3.1.1 that could lead to the disclosure of the SAML signing private key used for the RBAC features, in dElastic Cloud Enterprise
- CVE-2022-36781ConnectWise - ScreenConnect Session Code BypassConnectWise ScreenConnect
- CVE-2022-3287When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without pfwupd
- CVE-2022-3193An HTML injection/reflected Cross-site scripting (XSS) vulnerability was found in the ovirt-engine.ovirt-engine
- CVE-2021-41434A stored Cross-Site Scripting (XSS) vulnerability exists in version 1.0 of the Expense Management System application that allows for arbitra
- CVE-2022-38934readelf in ToaruOS 2.0.1 has some arbitrary address read vulnerabilities when parsing a crafted ELF file.
- CVE-2022-36771IBM QRadar User Behavior Analytics could allow an authenticated user to obtain sensitive information from that they should not have access tIBM QRadar User Behavior Analytics
- CVE-2022-35722IBM Jazz for Service Management is vulnerable to stored cross-site scripting.IBM Jazz for Service Management
- CVE-2022-35282IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to server-side request forgery (SSRF).IBM WebSphere Application Server
- CVE-2022-22387IBM Application Gateway is vulnerable to cross-site scripting.IBM Application Gateway
- CVE-2022-3354Open5GS UDP Packet ogs-tlv-msg.c denial of serviceOpen5GS
- CVE-2022-40912ETAP Lighting International NV ETAP Safety Manager 1.0.0.32 is vulnerable to Cross Site Scripting (XSS).
- CVE-2022-28816Reflected XSS in Carlo Gavazzi UWP 3.0Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller · C…
- CVE-2022-28815SQL-Injection in Carlo Gavazzi UWP 3.0 Sentilo Proxy Carlo Gavazzi UWP 3.0 Monitoring Gateway and Controller · C…
- CVE-2022-3349Sony PS4/PS5 exFAT UVFAT_readupcasetable heap-based overflowSony PS4 · Sony PS5
- CVE-2022-32169bytebase - Improper Authorizationbytebase · github.com/bytebase/bytebase
- CVE-2022-32170bytebase - Improper Authorizationbytebase · github.com/bytebase/bytebase
- CVE-2022-32166ovs - buffer over-readovs
- CVE-2022-3348Exposure of Sensitive Information to an Unauthorized Actor in tooljet/tooljettooljet/tooljet
- CVE-2022-3333Zephyr Project Manager REST Call cross site scriptingZephyr Project Manager
- CVE-2022-3332SourceCodester Food Ordering Management System POST Parameter router.php sql injectionSourceCodester Food Ordering Management System
- CVE-2022-39054COWELL INFORMATION SYSTEM CO., LTD. enterprise travel management system - Reflected XSSCOWELL INFORMATION SYSTEM CO. enterprise travel management…
- CVE-2022-39053HEIMAVISTA INC. Rpage - Reflected XSSHEIMAVISTA Rpage
- CVE-2022-39035Smart eVision - Stored XSSSmart eVision Information Technology Smart eVision
- CVE-2022-39034Smart eVision - Path Traversal -2Smart eVision Information Technology Smart eVision
- CVE-2022-39031Smart eVision - Exposure of Sensitive Information to an Unauthorized Actor -3Smart eVision Information Technology Smart eVision
- CVE-2022-39029Smart eVision - Exposure of Sensitive Information to an Unauthorized Actor -1Smart eVision Information Technology Smart eVision
- CVE-2022-38699ASUS Armoury Crate Service - Arbitrary File Creation via Elevation of Privilege FlawASUS Armoury Crate Service
- CVE-2021-43980Apache Tomcat: Information disclosureApache Software Foundation Apache Tomcat · org.apache.tomca…
- CVE-2022-2760In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have access to view in an erroOctopus Deploy Octopus Server
- CVE-2022-39236Matrix Javascript SDK improper beacon events can cause availability issuesmatrix-org matrix-js-sdk · matrix-js-sdk