CVEs published September 29, 2022
34 CVEs were published on September 29, 2022: 7 critical, 17 high.
- Published
- 34
- Critical
- 7
- High
- 17
- Medium
- 10
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 16
Most affected products
- discourse
- 4
- MedData HBYS
- 2
- Anker Eufy Homebase · uClibC +1
- 1
- com.amazon.redshift:redshift-jdbc42
- 1
- feehi/feehicms
- 1
- github.com/dutchcoders/transfer.sh
- 1
- Google Chrome
- 1
- IBM Robotic Process Automation
- 1
- ikus060/rdiffweb · rdiffweb
- 1
- inventree/inventree · inventree
- 1
Critical 7
- CVE-2022-36066Discourse vulnerable to RCE via admins uploading maliciously zipped filediscourse
- CVE-2022-33880hms-staff.php in Projectworlds Hospital Management System Mini-Project through 2018-06-17 allows SQL injection via the type parameter.
- CVE-2022-39266isolated-vm has vulnerable CachedDataOptions in APIlaverdet isolated-vm · isolated-vm
- CVE-2022-40887SourceCodester Best Student Result Management System 1.0 is vulnerable to SQL Injection.
- CVE-2022-40475TOTOLINK A860R V4.1.2cu.5182_B20201027 was discovered to contain a command injection via the component /cgi-bin/downloadFile.cgi.
- CVE-2021-43362MedData HBYS 1.0 Remote SQL Injection VulnerabilityMedData HBYS
- CVE-2021-43361MedData HBYS 1.0 Remote SQL Injection VulnerabilityMedData HBYS
High 17
- CVE-2022-36068Discourse moderators can edit themes via the APIdiscourse
- CVE-2022-40472ZKTeco Xiamen Information Technology ZKBio Time 8.0.7 Build: 20220721.14829 was discovered to contain a CSV injection vulnerability.
- CVE-2022-29503A memory corruption vulnerability exists in the libpthread linuxthreads functionality of uClibC 0.9.33.2 and uClibC-ng 1.0.40.Anker Eufy Homebase · uClibC +1
- CVE-2022-38732SnapCenter versions prior to 4.7 shipped without Content Security Policy (CSP) implemented which could allow certain types of attacks that oSnapCenter
- CVE-2022-39254When matrix-nio receives forwarded room keys, the receiver doesn't check if it requested the key from the forwarderpoljar matrix-nio · matrix-nio
- CVE-2022-39252When matrix-rust-sdk recieves forwarded room keys, the reciever doesn't check if it requested the key from the forwardermatrix-org matrix-rust-sdk · matrix-sdk-crypto
- CVE-2022-40407A zip slip vulnerability in the file upload function of Chamilo v1.11 allows attackers to execute arbitrary code via a crafted Zip file.
- CVE-2022-40890A vulnerability in /src/amf/amf-context.c in Open5GS 2.4.10 and earlier leads to AMF denial of service.
- CVE-2022-40126A misconfiguration in the Service Mode profile directory of Clash for Windows v0.19.9 allows attackers to escalate privileges and execute ar
- CVE-2022-3355Cross-site Scripting (XSS) - Stored in inventree/inventreeinventree/inventree · inventree
- CVE-2019-5797Double free in DOMStorage in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2020-11015Device Authentication Vulnerability in thinx-device-api IoT Device Management Serversuculent thinx-device-api
- CVE-2022-40048Flatpress v1.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the Upload File function.
- CVE-2022-3352Use After Free in vim/vimvim/vim
- CVE-2022-39173In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake.
- CVE-2022-39250Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verificationmatrix-org matrix-js-sdk · matrix-js-sdk
- CVE-2022-41828In Amazon AWS Redshift JDBC Driver (aka amazon-redshift-jdbc-driver or redshift-jdbc42) before 2.1.0.8, the Object Factory does not check thcom.amazon.redshift:redshift-jdbc42
Medium, low and unrated 10
- CVE-2022-3364No limit in length of "Fullname" parameter results in DOS attack /memory corruption in ikus060/rdiffweb prior to 2.5.0a3 in ikus060/rdiffwebikus060/rdiffweb · rdiffweb
- CVE-2022-39232Discourse vulnerable to incomplete quote causing a topic to crash in the browserdiscourse
- CVE-2022-39226Discourse user profile location and website fields were not sufficiently length-limiteddiscourse
- CVE-2022-35137DGIOT Lightweight industrial IoT v4.5.4 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities.
- CVE-2022-40879kkFileView v4.1.0 is vulnerable to Cross Site Scripting (XSS) via the parameter 'errorMsg.'
- CVE-2022-39168IBM Robotic Process Automation Clients are vulnerable to proxy credentials being exposed in upgrade logs.IBM Robotic Process Automation
- CVE-2022-40931dutchcoders Transfer.sh 1.4.0 is vulnerable to Cross Site Scripting (XSS).github.com/dutchcoders/transfer.sh
- CVE-2022-40408FeehiCMS v2.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted payload injected into the Comment box undfeehi/feehicms
- CVE-2022-40363A buffer overflow in the component nfc_device_load_mifare_ul_data of Flipper Devices Inc., Flipper Zero before v0.65.2 allows attackers to c
- CVE-2022-35888Ampere Altra and Ampere Altra Max devices through 2022-07-15 allow attacks via Hertzbleed, which is a power side-channel attack that extract