CVEs published September 30, 2022
68 CVEs were published on September 30, 2022: 6 critical, 25 high. 1 is now in CISA KEV.
- Published
- 68
- Critical
- 6
- High
- 25
- Medium
- 32
- Low
- 1
- Unrated
- 4
- Now in CISA KEV
- 1
- Fix available
- 15
Most affected products
- Cisco IOS XE Software
- 6
- moodle · moodle/moodle
- 4
- Booking Ultra Pro
- 2
- Cisco Aironet Access Point Software
- 2
- Cisco SD-WAN Solution
- 2
- Cisco SD-WAN vManage
- 2
- Dell Hybrid Client
- 2
- SolarWinds Orion Platform
- 2
- Adobe Experience Manager
- 1
- AppLock - Fingerprint
- 1
Critical 6
- CVE-2022-40943Dairy Farm Shop Management System 1.0 is vulnerable to SQL Injection via bwdate-report-ds.php file.
- CVE-2022-35156Bus Pass Management System 1.0 was discovered to contain a SQL Injection vulnerability via the searchdata parameter at /buspassms/download-p
- CVE-2022-40944Dairy Farm Shop Management System 1.0 is vulnerable to SQL Injection via sales-report-ds.php file.
- CVE-2022-40315A limited SQL injection risk was identified in the "browse list of users" site administration page.moodle · moodle/moodle
- CVE-2022-40314A remote code execution risk when restoring backup files originating from Moodle 1.9 was identified.moodle · moodle/moodle
- CVE-2022-2778In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes.Octopus Deploy Octopus Server
High 25
- CVE-2022-39268orchest vulnerable to cross-site request forgery that allows control of a user instanceorchest
- CVE-2022-20945Cisco Catalyst 9100 Series Access Points Association Request Denial of Service VulnerabilityCisco Aironet Access Point Software
- CVE-2022-20919Cisco IOS and IOS XE Software Common Industrial Protocol Request Denial of Service VulnerabilityCisco IOS
- CVE-2022-40341mojoPortal v2.7 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a craf
- CVE-2022-20856Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family CAPWAP Mobility Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2022-20855Cisco IOS XE Software for Embedded Wireless Controllers on Catalyst Access Points Privilege Escalation VulnerabilityCisco IOS XE Software
- CVE-2022-20848Cisco IOS XE Software for Embedded Wireless Controllers on Catalyst 9100 Series Access Points UDP Processing Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2022-20847Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family DHCP Processing Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2022-20818Cisco SD-WAN Software Privilege Escalation VulnerabilitiesCisco SD-WAN Solution
- CVE-2022-20775Cisco SD-WAN Software Privilege Escalation VulnerabilityCisco Catalyst SD-WAN · Cisco SD-WAN vContainer +2
- CVE-2022-20769Cisco Wireless LAN Controller AireOS Software FIPS Mode Denial of Service VulnerabilityCisco Wireless LAN Controller
- CVE-2022-40756If folder security is misconfigured for Actian Zen PSQL BEFORE Patch Update 1 for Zen 15 SP1 (v15.11.005), Patch Update 4 for Zen 15 (v15.01
- CVE-2022-41975RealVNC VNC Server before 6.11.0 and VNC Viewer before 6.22.826 on Windows allow local privilege escalation via MSI installer Repair mode.
- CVE-2021-33354Directory Traversal vulnerability in htmly before 2.8.1 allows remote attackers to perform arbitrary file deletions via modified file parame
- CVE-2022-32540Information Disclosure in Operator Client application in BVMS 10.1.1, 11.0 and 11.1.0 and VIDEOJET Decoder VJD-7513 versions 10.23 and 10.30Bosch BVMS · Bosch VJD-7513
- CVE-2022-40313Recursive rendering of Mustache template helpers containing user input could, in some cases, result in an XSS risk or a page failing to loadmoodle · moodle/moodle
- CVE-2022-41870AP Manager in Innovaphone before 13r2 Service Release 17 allows command injection via a modified service ID during app upload.
- CVE-2022-40277Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdJoplin
- CVE-2022-40274Gridea version 0.9.3 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown fiGridea
- CVE-2022-36961Orion Platform SQL Injection Privilege Escalation VulnerabilitySolarWinds Orion Platform
- CVE-2022-41440Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinventory/editcategory.php.
- CVE-2022-41439Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinventory/edituser.php.
- CVE-2022-41437Billing System Project v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /php_action/createProduc
- CVE-2022-3371No limit in length of "Token name" parameter results in DOS attack /memory corruption in ikus060/rdiffweb prior to 2.5.0a3 in ikus060/rdiffwebikus060/rdiffweb · rdiffweb
- CVE-2022-2529Multiple DoS Attack Vectors in sflow packet handlingCloudflare goflow · github.com/cloudflare/goflow +1
Medium, low and unrated 37
- CVE-2022-42002SonicJS through 0.6.0 allows file overwrite.
- CVE-2022-34429Dell Hybrid Client below 1.8 version contains a Zip Slip Vulnerability in UI.Dell Hybrid Client
- CVE-2022-34428Dell Hybrid Client prior to version 1.8 contains a Regular Expression Denial of Service Vulnerability in the UI.Dell Hybrid Client
- CVE-2021-36865WordPress Quiz And Survey Master plugin <= 7.3.4 - Insecure direct object references (IDOR) vulnerabilityExpressTech Quiz And Survey Master
- CVE-2022-20930Cisco SD-WAN Software Arbitrary File Corruption VulnerabilityCisco SD-WAN vManage
- CVE-2022-20851Cisco IOS XE Software Web UI Command Injection VulnerabilityCisco IOS XE Software
- CVE-2022-20850Cisco SD-WAN Arbitrary File Deletion VulnerabilityCisco SD-WAN Solution
- CVE-2022-20844Cisco Software-Defined Application Visibility and Control on Cisco vManage Static Username and Password VulnerabilityCisco SD-WAN vManage
- CVE-2022-20810Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family SNMP Information Disclosure VulnerabilityCisco IOS XE Software
- CVE-2022-20728Cisco Access Points VLAN Bypass from Native VLAN VulnerabilityCisco Aironet Access Point Software
- CVE-2022-20662Cisco Duo for macOS Authentication Bypass VulnerabilityCisco Duo
- CVE-2022-40923A vulnerability in the LIEF::MachO::SegmentCommand::virtual_address function of LIEF v0.12.1 allows attackers to cause a denial of service (lief
- CVE-2022-35155Bus Pass Management System v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the searchdata parameter.
- CVE-2022-28851AEM Reflected XSS Arbitrary code executionAdobe Experience Manager
- CVE-2021-36855WordPress Booking Ultra Pro plugin <= 1.1.4 - Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerabilityBooking Ultra Pro
- CVE-2021-36854WordPress Booking Ultra Pro plugin <= 1.1.4 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilitiesBooking Ultra Pro
- CVE-2022-36965Stored and DOM XSS in QoE Applications: Orion PlatformSolarWinds Orion Platform
- CVE-2022-40316The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers abmoodle · moodle/moodle
- CVE-2022-21826Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request,Pulse Connect Secure VPN Server
- CVE-2022-1959AppLock version 7.9.29 allows an attacker with physical access to the device to bypass biometric authentication.AppLock - Fingerprint
- CVE-2021-36830WordPress Comment Guestbook plugin <= 0.8.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilitymibuthu Comment Guestbook
- CVE-2021-36839WordPress Social Media Follow Buttons Bar plugin <= 4.73 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilitySpace X-Chimp Social Media Follow Buttons Bar
- CVE-2022-23726PingCentral versions prior to listed versions expose Spring Boot actuator endpoints that with administrative authentication return large amoPing Identity PingCentral
- CVE-2022-37461Multiple cross-site scripting (XSS) vulnerabilities in Canon Medical Vitrea View 7.x before 7.7.6 allow remote attackers to inject arbitrary
- CVE-2022-2922Relative Path Traversal in dnnsoftware/dnn.platformdnnsoftware/dnn.platform · DotNetNuke.Core +1
- CVE-2022-41848drivers/char/pcmcia/synclink_cs.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically prox
- CVE-2022-21222Regular Expression Denial of Service (ReDoS)css-what
- CVE-2022-24373Regular Expression Denial of Service (ReDoS)react-native-reanimated
- CVE-2022-41845An issue was discovered in Bento4 1.6.0-639.
- CVE-2022-41846An issue was discovered in Bento4 1.6.0-639.
- CVE-2022-41847An issue was discovered in Bento4 1.6.0-639.
- CVE-2022-41841An issue was discovered in Bento4 through 1.6.0-639.
- CVE-2022-41842An issue was discovered in Xpdf 4.04.
- CVE-2022-41843An issue was discovered in Xpdf 4.04.
- CVE-2022-41844An issue was discovered in Xpdf 4.04.
- CVE-2022-41849drivers/video/fbdev/smscufx.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically proximat
- CVE-2022-41850roccat_report_event in drivers/hid/hid-roccat.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free in cer