CVEs published in September 2022
3,650 vulnerabilities, 294 critical, 12 exploited.
- vim, vim vim/vim, debian linux +1 more +3 moreUse After Free in vim/vim7.8 High
- netic user export for jiraThe Netic User Export add-on before 2.0.6 for Atlassian Jira does not perform authorization...5.3 Medium
- osgeo geonetworkA privileged attacker in GeoNetwork before 3.12.0 and 4.x before 4.0.4 can use the directory harvester before-script to execute arbitrary OS commands remotely on the hosting infrastructure. A User Adm…7.2 High
- systematicalpha systematic fix adapter firmwareSystematic FIX Adapter (ALFAFX) 2.4.0.25 13/09/2017 allows remote file inclusion via a UNC share...8.6 High
- port389 389-ds-base, debian linux, fedoraproject fedora +2 more +4 moreA flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an...6.5 Medium
- sourcecodester clinics patient management system, oretnom23 clinic\'s patient management system +1 moreSourceCodester Clinics Patient Management System medicine_details.php sql injection6.3 Medium
- online employee leave management system project employee leave management system, sourcecodester online employee leave management system +1 moreSourceCodester Online Employee Leave Management System addemployee.php cross-site request forgery4.3 Medium
- diagrams drawio, jgraph jgraph/drawio +1 moreCross-site Scripting (XSS) - Stored in jgraph/drawio5.5 Medium
- fastflow fast flow, fastflow +1 moreFast Flow < 1.2.13 - Admin+ Stored Cross-Site Scripting5.5 Medium
- unknown multivendor marketplace solution for woocommerce – wc marketplace, wc-marketplace multivendor marketplace solution for woocommerce - wc marketplace +1 moreMultivendor Marketplace Solution for WooCommerce < 3.8.12 - Unauthorised AJAX Calls4.3 Medium
- nk visual portfolio, photo gallery & post grid, visualportfolio visual portfolio\, photo gallery \& post grid +1 moreVisual Portfolio < 2.19.0 - Contributor+ CSS Injection5.4 Medium
- paymattic simple payment donations \& subscriptions, unknown simple payment donations & subscriptions plugin by paymattic – best payments plugin for wp +1 moreBest Payments Plugin for WP < 4.2.1 - Unauthenticated Stored Cross-Site Scripting7.2 High
- nk visual portfolio, photo gallery & post grid, visualportfolio visual portfolio\, photo gallery \& post grid +1 moreVisual Portfolio < 2.18.0 - Unauthenticated CSS Injection6.1 Medium
- wpwax directorist, unknown directorist – wordpress business directory plugin with classified ads listings +1 moreDirectorist < 7.3.1 - Unauthenticated Email Address Disclosure5.3 Medium
- unknown wp database backupWP Database Backup < 5.9 - Admin+ Stored Cross-Site Scripting4.8 Medium
- simple sign on project sign on, unknown simple single sign on +1 moreSimple Single Sign On <= 4.1.0 - Authentication Bypass7.5 High
- bitdefender gravityzone, gravityzone cloud console, gravityzone console on-premise +2 moreDeserialization of Untrusted Data in GravityZone Console On-Premise (VA-10573)8.8 High
- dokuwiki, splitbrain splitbrain/dokuwiki, fedoraproject fedora +2 moreCross-site Scripting (XSS) - Reflected in splitbrain/dokuwiki5.4 Medium
- apache iotdbNo authorization of DatabaseConnectController in grafana-connector.7.5 High
- apache iotdbLogin check vulnerability by session Id8.8 High
- syoyo tinygltf, debian linux +1 moreCommand Injection on tinygltf8.1 High
- sourcecodester clinics patient management system, oretnom23 clinic\'s patient management system +1 moreSourceCodester Clinics Patient Management System Login index.php sql injection7.3 High
- otrs, otrs ag ((otrs)) community edition +1 morePerl Code execution in Template Toolkit6.8 Medium
- otrs, otrs ag ((otrs)) community edition +1 morePossible XSS stored in customer information4.6 Medium
- otrs, otrs ag ((otrs)) community edition +1 morePossible XSS in Admin Interface3.5 Low
- lotus 1-2-3 project 1-2-3123elf Lotus 1-2-3 before 1.0.0rc3 for Linux, and Lotus 1-2-3 R3 for UNIX and other platforms through 9.8.2, allow attackers to execute arbitrary code via a crafted worksheet. This occurs because of a…7.8 High
- cotonti sienaCotonti Siena 0.9.20 allows admins to conduct stored XSS attacks via a forum post.4.8 Medium
- cotonti sienaCotonti Siena 0.9.20 allows admins to conduct stored XSS attacks via a direct message (DM).4.8 Medium
- gnu pspp, fedoraproject fedora +1 moreAn issue was discovered in PSPP 1.6.2. There is a heap-based buffer overflow at the function...7.8 High
- gnu pspp, fedoraproject fedora +1 moreAn issue was discovered in PSPP 1.6.2. There is a heap-based buffer overflow at the function...7.8 High
- samsung mtowersign_pFwInfo in Samsung mTower through 0.3.0 has a missing check on the return value of...7.5 High
- samsung mtowerThere is a NULL pointer dereference in aes256_encrypt in Samsung mTower through 0.3.0 due to a...7.5 High
- samsung mtowersign_pFwInfo in Samsung mTower through 0.3.0 has a missing check on the return value of...7.5 High
- appsmithServer-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to execute...8.9 High
lcmsOSS-FuzzHeap-buffer-overflow in _cmsMAT3perNo scorewolfsslOSS-FuzzStack-buffer-overflow in wc_Shake256_FinalNo scorewolfsslOSS-FuzzNegative-size-param in wc_Sha3_256_FinalNo score- debian linux, linux kernel +1 moreAn issue was discovered in the Linux kernel before 5.19. In pxa3xx_gcu_write in drivers/video...6.1 Medium
- snakeyamlDoS in SnakeYAML6.5 Medium
- snakeyaml, debian linux +1 moreDoS in SnakeYAML6.5 Medium
- snakeyaml, debian linux +1 moreDoS in SnakeYAML6.5 Medium
- snakeyaml, debian linux +1 moreDoS in SnakeYAML6.5 Medium
- netgate pfblockerngpfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as...9.8 Critical
- tigergraph** DISPUTED ** The User-Defined Functions (UDF) feature in TigerGraph 3.6.0 allows installation...8.8 High
- google chrome, fedoraproject fedora, google chromium mojo +2 moreInsufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote...9.6 Critical
- erp system project project system project, sourcecodehero erp system project +1 moreSourcecodehero ERP System Project processlogin.php sql injection7.3 High
suricataOSS-FuzzHeap-buffer-overflow in DetectGetLastSMFromMpmListsNo scorelibjxlOSS-FuzzHeap-buffer-overflow in jxl::N_AVX2::BlendingStage::ProcessPaddingRowNo scoresystemdOSS-FuzzUse-of-uninitialized-value in json_buildvNo scorefluent-bitOSS-FuzzHeap-use-after-free in mk_event_timeout_destroyNo score- Show moreLoading…