| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-40320 | Hig | 0.57 | 8.8 | 0.01 | Sep 9, 2022 | cfg_tilde_expand in confuse.c in libConfuse 3.3 has a heap-based buffer over-read. | ||
| CVE-2022-36110 | Hig | 0.50 | 8.8 | 0.01 | Sep 9, 2022 | Netmaker makes networks with WireGuard. Prior to version 0.15.1, Improper Authorization functions lead to non-privileged users running privileged API calls. If someone adds users to the Netmaker platform who do not have admin privileges, they can use their auth tokens to run… | ||
| CVE-2022-31006 | Hig | 0.42 | 7.5 | 0.01 | Sep 9, 2022 | indy-node is the server portion of Hyperledger Indy, a distributed ledger purpose-built for decentralized identity. In vulnerable versions of indy-node, an attacker can max out the number of client connections allowed by the ledger, leaving the ledger unable to be used for its… | ||
| CVE-2022-3133 | Hig | 0.51 | 7.8 | 0.01 | Sep 9, 2022 | OS Command Injection in GitHub repository jgraph/drawio prior to 20.3.0. | ||
| CVE-2022-38615 | Hig | 0.57 | 8.8 | 0.01 | Sep 9, 2022 | SmartVista SVFE2 v2.2.22 was discovered to contain multiple SQL injection vulnerabilities via the UserForm:j_id88, UserForm:j_id90, and UserForm:j_id92 parameters at /SVFE2/pages/feegroups/service_group.jsf. | ||
| CVE-2022-38614 | Hig | 0.49 | 7.5 | 0.01 | Sep 9, 2022 | An issue in the IGB Files and OutfileService features of SmartVista Cardgen v3.28.0 allows attackers to list and download arbitrary files via modifying the PATH parameter. | ||
| CVE-2022-28742 | Hig | 0.49 | 7.5 | 0.01 | Sep 9, 2022 | aEnrich eHRD Learning Management Key Performance Indicator System 5+ has Improper Access Control. The web application does not validate user session when accessing many application pages. This can allow an attacker to gain unauthenticated access to sensitive functionalities in… | ||
| CVE-2022-28741 | Hig | 0.53 | 8.1 | 0.01 | Sep 9, 2022 | aEnrich a+HRD 5.x Learning Management Key Performance Indicator System has a local file inclusion (LFI) vulnerability that occurs due to missing input validation in v5.x | ||
| CVE-2022-28740 | Hig | 0.49 | 7.5 | 0.01 | Sep 9, 2022 | aEnrich eHRD Learning Management Key Performance Indicator System 5+ exposes Sensitive Information to an Unauthorized Actor. | ||
| CVE-2022-39119 | Hig | 0.51 | 7.8 | 0.00 | Sep 9, 2022 | In network service, there is a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed | ||
| CVE-2022-38700 | Hig | 0.57 | 8.8 | 0.00 | Sep 9, 2022 | OpenHarmony-v3.1.1 and prior versions have a permission bypass vulnerability. LAN attackers can bypass permission control and get control of camera service. | ||
| CVE-2022-38144 | Hig | 0.57 | 8.8 | 0.01 | Sep 9, 2022 | Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 at WordPress. | ||
| CVE-2022-36423 | Hig | 0.48 | 7.4 | 0.00 | Sep 9, 2022 | OpenHarmony-v3.1.2 and prior versions have an incorrect configuration of the cJSON library, which leads a Stack overflow vulnerability during recursive parsing. LAN attackers can lead a DoS attack to all network devices. | ||
| CVE-2022-2964 | Hig | 0.51 | 7.8 | 0.00 | Sep 9, 2022 | A flaw was found in the Linux kernel’s driver for the ASIX AX88179_178A-based USB 2.0/3.0 Gigabit Ethernet Devices. The vulnerability contains multiple out-of-bounds reads and possible out-of-bounds writes. | ||
| CVE-2022-38286 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/role/list. | ||
| CVE-2022-38285 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/menu/list. | ||
| CVE-2022-38284 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/department/list. | ||
| CVE-2022-38283 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/video/list. | ||
| CVE-2022-38282 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/videoalbum/list. | ||
| CVE-2022-38281 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/site/list. | ||
| CVE-2022-38280 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/image/list. | ||
| CVE-2022-38279 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/imagealbum/list. | ||
| CVE-2022-38278 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/friendlylink/list. | ||
| CVE-2022-38277 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/folderrollpicture/list. | ||
| CVE-2022-38276 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/foldernotice/list. | ||
| CVE-2022-38275 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/contact/list. | ||
| CVE-2022-38274 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/comment/list. | ||
| CVE-2022-38273 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list_approve. | ||
| CVE-2022-38272 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list. | ||
| CVE-2020-10735 | Hig | 0.42 | 7.5 | 0.05 | Sep 9, 2022 | A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases… | ||
| CVE-2022-29061 | Hig | 0.47 | 7.2 | 0.02 | Sep 9, 2022 | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiSOAR before 7.2.1 allows an authenticated attacker to execute unauthorized code or commands via crafted HTTP GET requests. | ||
| CVE-2022-25765 | Hig | 0.03 | 7.3 | 0.42 | Sep 9, 2022 | The package pdfkit from 0.0.0 are vulnerable to Command Injection where the URL is not properly sanitized. | ||
| CVE-2022-40299 | Hig | 0.51 | 7.8 | 0.00 | Sep 9, 2022 | In Singular before 4.3.1, a predictable /tmp pathname is used (e.g., by sdb.cc), which allows local users to gain the privileges of other users via a procedure in a file under /tmp. NOTE: this CVE Record is about sdb.cc and similar files in the Singular interface that have… | ||
| CVE-2022-40297 | Hig | 0.51 | 7.8 | 0.00 | Sep 9, 2022 | UBports Ubuntu Touch 16.04 allows the screen-unlock passcode to be used for a privileged shell via Sudo. This passcode is only four digits, far below typical length/complexity for a user account's password. NOTE: a third party states "The described attack cannot be executed as… | ||
| CVE-2022-40281 | Hig | 0.49 | 7.5 | 0.01 | Sep 8, 2022 | An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). cyassl_connect_step2 in curl/vtls/cyassl.c has a missing X509_free after SSL_get_peer_certificate, leading to information disclosure. | ||
| CVE-2022-40280 | Hig | 0.49 | 7.5 | 0.01 | Sep 8, 2022 | An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). createDB in security/provisioning/src/provisioningdatabasemanager.c has a missing sqlite3_close after sqlite3_open_v2, leading to a denial of service. | ||
| CVE-2022-38269 | Hig | 0.47 | 7.2 | 0.01 | Sep 8, 2022 | School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the component /modules/modstudent/index.php?view=edit&id=. | ||
| CVE-2022-38268 | Hig | 0.47 | 7.2 | 0.01 | Sep 8, 2022 | School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the component /modules/autonumber/index.php?view=edit&id=. | ||
| CVE-2022-38267 | Hig | 0.47 | 7.2 | 0.01 | Sep 8, 2022 | School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the component /modules/user/index.php?view=edit&id=. | ||
| CVE-2022-38265 | Hig | 0.47 | 7.2 | 0.01 | Sep 8, 2022 | Apartment Visitor Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter at /avms/edit-apartment.php. | ||
| CVE-2022-36098 | Hig | 0.57 | 8.9 | 0.72 | Sep 8, 2022 | XWiki Platform Mentions UI is a user interface for mentioning users in wiki content for XWiki Platform, a generic wiki platform. Starting in version 12.5-rc-1 and prior to versions 13.10.6 and 14.4, it's possible to store Javascript or groovy scripts in a mention, macro anchor,… | ||
| CVE-2022-36097 | Hig | 0.56 | 8.9 | 0.58 | Sep 8, 2022 | XWiki Platform Attachment UI provides a macro to easily upload and select attachments for XWiki Platform, a generic wiki platform. Starting with version 14.0-rc-1 and prior to 14.4-rc-1, it's possible to store JavaScript in an attachment name, which will be executed by anyone… | ||
| CVE-2022-36096 | Hig | 0.56 | 8.9 | 0.60 | Sep 8, 2022 | The XWiki Platform Index UI is an Index of all pages, attachments, orphans and deleted pages and attachments for XWiki Platform, a generic wiki platform. Prior to versions 13.10.6 and 14.3, it's possible to store JavaScript which will be executed by anyone viewing the deleted… | ||
| CVE-2022-36094 | Hig | 0.56 | 8.9 | 0.65 | Sep 8, 2022 | XWiki Platform Web Parent POM contains Web resources for the XWiki platform, a generic wiki platform. Starting with version 1.0 and prior to versions 13.10.6 and 14.30-rc-1, it's possible to store JavaScript which will be executed by anyone viewing the history of an attachment… | ||
| CVE-2022-3167 | Hig | 0.50 | 8.8 | 0.01 | Sep 8, 2022 | Improper Restriction of Rendered UI Layers or Frames in GitHub repository ikus060/rdiffweb prior to 2.4.1. | ||
| CVE-2022-38258 | Hig | 0.53 | 8.1 | 0.02 | Sep 8, 2022 | A local file inclusion (LFI) vulnerability in D-Link DIR 819 v1.06 allows attackers to cause a Denial of Service (DoS) or access sensitive server information via manipulation of the getpage parameter in a crafted web request. | ||
| CVE-2022-36093 | Hig | 0.48 | 8.5 | 0.01 | Sep 8, 2022 | XWiki Platform Web Templates are templates for XWiki Platform, a generic wiki platform. By passing a template of the distribution wizard to the xpart template, user accounts can be created even when user registration is disabled. This also circumvents any email verification.… | ||
| CVE-2022-36092 | Hig | 0.42 | 7.5 | 0.01 | Sep 8, 2022 | XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Prior to versions 14.2 and 13.10.4, all rights checks that would normally prevent a user from viewing a document on a wiki can be bypassed using the login action and directly specified… | ||
| CVE-2022-38260 | Hig | 0.47 | 7.2 | 0.01 | Sep 8, 2022 | Interview Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /interview/delete.php?action=questiondelete&id=. | ||
| CVE-2022-38255 | Hig | 0.47 | 7.2 | 0.01 | Sep 8, 2022 | Interview Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /interview/editQuestion.php. |
- risk 0.57cvss 8.8epss 0.01
cfg_tilde_expand in confuse.c in libConfuse 3.3 has a heap-based buffer over-read.
- risk 0.50cvss 8.8epss 0.01
Netmaker makes networks with WireGuard. Prior to version 0.15.1, Improper Authorization functions lead to non-privileged users running privileged API calls. If someone adds users to the Netmaker platform who do not have admin privileges, they can use their auth tokens to run…
- risk 0.42cvss 7.5epss 0.01
indy-node is the server portion of Hyperledger Indy, a distributed ledger purpose-built for decentralized identity. In vulnerable versions of indy-node, an attacker can max out the number of client connections allowed by the ledger, leaving the ledger unable to be used for its…
- risk 0.51cvss 7.8epss 0.01
OS Command Injection in GitHub repository jgraph/drawio prior to 20.3.0.
- risk 0.57cvss 8.8epss 0.01
SmartVista SVFE2 v2.2.22 was discovered to contain multiple SQL injection vulnerabilities via the UserForm:j_id88, UserForm:j_id90, and UserForm:j_id92 parameters at /SVFE2/pages/feegroups/service_group.jsf.
- risk 0.49cvss 7.5epss 0.01
An issue in the IGB Files and OutfileService features of SmartVista Cardgen v3.28.0 allows attackers to list and download arbitrary files via modifying the PATH parameter.
- risk 0.49cvss 7.5epss 0.01
aEnrich eHRD Learning Management Key Performance Indicator System 5+ has Improper Access Control. The web application does not validate user session when accessing many application pages. This can allow an attacker to gain unauthenticated access to sensitive functionalities in…
- risk 0.53cvss 8.1epss 0.01
aEnrich a+HRD 5.x Learning Management Key Performance Indicator System has a local file inclusion (LFI) vulnerability that occurs due to missing input validation in v5.x
- risk 0.49cvss 7.5epss 0.01
aEnrich eHRD Learning Management Key Performance Indicator System 5+ exposes Sensitive Information to an Unauthorized Actor.
- risk 0.51cvss 7.8epss 0.00
In network service, there is a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed
- risk 0.57cvss 8.8epss 0.00
OpenHarmony-v3.1.1 and prior versions have a permission bypass vulnerability. LAN attackers can bypass permission control and get control of camera service.
- risk 0.57cvss 8.8epss 0.01
Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 at WordPress.
- risk 0.48cvss 7.4epss 0.00
OpenHarmony-v3.1.2 and prior versions have an incorrect configuration of the cJSON library, which leads a Stack overflow vulnerability during recursive parsing. LAN attackers can lead a DoS attack to all network devices.
- risk 0.51cvss 7.8epss 0.00
A flaw was found in the Linux kernel’s driver for the ASIX AX88179_178A-based USB 2.0/3.0 Gigabit Ethernet Devices. The vulnerability contains multiple out-of-bounds reads and possible out-of-bounds writes.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/role/list.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/menu/list.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/department/list.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/video/list.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/videoalbum/list.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/site/list.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/image/list.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/imagealbum/list.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/friendlylink/list.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/folderrollpicture/list.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/foldernotice/list.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/contact/list.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/comment/list.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list_approve.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list.
- risk 0.42cvss 7.5epss 0.05
A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases…
- risk 0.47cvss 7.2epss 0.02
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiSOAR before 7.2.1 allows an authenticated attacker to execute unauthorized code or commands via crafted HTTP GET requests.
- risk 0.03cvss 7.3epss 0.42
The package pdfkit from 0.0.0 are vulnerable to Command Injection where the URL is not properly sanitized.
- risk 0.51cvss 7.8epss 0.00
In Singular before 4.3.1, a predictable /tmp pathname is used (e.g., by sdb.cc), which allows local users to gain the privileges of other users via a procedure in a file under /tmp. NOTE: this CVE Record is about sdb.cc and similar files in the Singular interface that have…
- risk 0.51cvss 7.8epss 0.00
UBports Ubuntu Touch 16.04 allows the screen-unlock passcode to be used for a privileged shell via Sudo. This passcode is only four digits, far below typical length/complexity for a user account's password. NOTE: a third party states "The described attack cannot be executed as…
- risk 0.49cvss 7.5epss 0.01
An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). cyassl_connect_step2 in curl/vtls/cyassl.c has a missing X509_free after SSL_get_peer_certificate, leading to information disclosure.
- risk 0.49cvss 7.5epss 0.01
An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). createDB in security/provisioning/src/provisioningdatabasemanager.c has a missing sqlite3_close after sqlite3_open_v2, leading to a denial of service.
- risk 0.47cvss 7.2epss 0.01
School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the component /modules/modstudent/index.php?view=edit&id=.
- risk 0.47cvss 7.2epss 0.01
School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the component /modules/autonumber/index.php?view=edit&id=.
- risk 0.47cvss 7.2epss 0.01
School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the component /modules/user/index.php?view=edit&id=.
- risk 0.47cvss 7.2epss 0.01
Apartment Visitor Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter at /avms/edit-apartment.php.
- risk 0.57cvss 8.9epss 0.72
XWiki Platform Mentions UI is a user interface for mentioning users in wiki content for XWiki Platform, a generic wiki platform. Starting in version 12.5-rc-1 and prior to versions 13.10.6 and 14.4, it's possible to store Javascript or groovy scripts in a mention, macro anchor,…
- risk 0.56cvss 8.9epss 0.58
XWiki Platform Attachment UI provides a macro to easily upload and select attachments for XWiki Platform, a generic wiki platform. Starting with version 14.0-rc-1 and prior to 14.4-rc-1, it's possible to store JavaScript in an attachment name, which will be executed by anyone…
- risk 0.56cvss 8.9epss 0.60
The XWiki Platform Index UI is an Index of all pages, attachments, orphans and deleted pages and attachments for XWiki Platform, a generic wiki platform. Prior to versions 13.10.6 and 14.3, it's possible to store JavaScript which will be executed by anyone viewing the deleted…
- risk 0.56cvss 8.9epss 0.65
XWiki Platform Web Parent POM contains Web resources for the XWiki platform, a generic wiki platform. Starting with version 1.0 and prior to versions 13.10.6 and 14.30-rc-1, it's possible to store JavaScript which will be executed by anyone viewing the history of an attachment…
- risk 0.50cvss 8.8epss 0.01
Improper Restriction of Rendered UI Layers or Frames in GitHub repository ikus060/rdiffweb prior to 2.4.1.
- risk 0.53cvss 8.1epss 0.02
A local file inclusion (LFI) vulnerability in D-Link DIR 819 v1.06 allows attackers to cause a Denial of Service (DoS) or access sensitive server information via manipulation of the getpage parameter in a crafted web request.
- risk 0.48cvss 8.5epss 0.01
XWiki Platform Web Templates are templates for XWiki Platform, a generic wiki platform. By passing a template of the distribution wizard to the xpart template, user accounts can be created even when user registration is disabled. This also circumvents any email verification.…
- risk 0.42cvss 7.5epss 0.01
XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Prior to versions 14.2 and 13.10.4, all rights checks that would normally prevent a user from viewing a document on a wiki can be bypassed using the login action and directly specified…
- risk 0.47cvss 7.2epss 0.01
Interview Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /interview/delete.php?action=questiondelete&id=.
- risk 0.47cvss 7.2epss 0.01
Interview Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /interview/editQuestion.php.