CVEs published in September 2022
3,650 vulnerabilities, 294 critical, 12 exploited.
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP Vulnerable to XSS in the Portal Search Module6.1 Medium
autogluon-multimodalPyPIautogluon.multimodal vulnerable to unsafe YAML deserializationNo score- netlify netlify-ipxnefly-ipx subject to Server-Side Request Forgery and Stored Cross-Site Scripting via Cache Poisoning and Improper Host Validation6.1 Medium
- parse-community parse-serverParse Server subject to Improper Authentication allowing Auth adapter app ID validation to be circumvented3.7 Low
- amazon fhir-works-on-aws-authz-smartSecurity issue in fhir-works-on-aws-authz-smart6.5 Medium
- insyde insydeh2oAn issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. The FwBlockSericceSmm...8.2 High
- zapier code by zapierCode by Zapier before 2022-08-17 allowed intra-account privilege escalation that included...9.9 Critical
- ikus-soft rdiffweb, ikus060 ikus060/rdiffweb +1 moreCross-Site Request Forgery (CSRF) in ikus060/rdiffweb4.3 Medium
- xplodedthemes wpide, wpide – file manager & code editor (wordpress plugin) +1 moreWordPress WPide plugin <= 2.6 - Authenticated Arbitrary File Edit/Upload vulnerability6.5 Medium
- getawesomesupport awesome support, awesome support team support (wordpress plugin) +1 moreWordPress Awesome Support plugin <= 6.0.7 - Multiple Authenticated Persistent XSS (Additional Interested Parties)5.4 Medium
- webhelpagency wha crossword, wha crossword (wordpress plugin) +1 moreWordPress WHA Crossword plugin <= 1.1.10 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities5.4 Medium
- webhelpagency wha wordsearch, wha word search puzzles game (wordpress plugin) +1 moreWordPress Word Search Puzzles game plugin <= 2.0.1 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities5.4 Medium
- total-soft event calendar, totalsoft event calendar – calendar (wordpress plugin) +1 moreWordPress Event Calendar – Calendar plugin <= 1.4.6 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability4.1 Medium
- soflyy import any xml or csv file to wordpress (wordpress plugin), wp all import +1 moreWordPress Import any XML or CSV File to WordPress plugin <= 3.6.7 - Authenticated Arbitrary Code Execution vulnerability9.1 Critical
- sedlex favicon switcher (wordpress plugin), favicon-switcher +1 moreWordPress FavIcon Switcher plugin <= 1.2.11 - Cross-Site Request Forgery (CSRF) vulnerability5.4 Medium
- swift project swiftnio extras, apple swift-nio-extras +1 moreSwiftNIO Extras vulnerable to improper detection of complete HTTP body decompression7.5 High
- parse-community parse-serverParse Server subject to Incorrect Resource Transfer Between Spheres4.3 Medium
- keylimekeylime-agent-6.3.0-1.1 on GA media7.5 High
- keylimekeylime-agent-6.3.0-1.1 on GA media5.5 Medium
- keylimekeylime-agent-6.3.0-1.1 on GA media7.5 High
- keylimekeylime-agent-6.3.0-1.1 on GA media7.5 High
- keylimekeylime-agent-6.3.0-1.1 on GA media9.8 Critical
- keylimekeylime-agent-6.3.0-1.1 on GA media7.5 High
commonmarkerRubyGemsUnbounded resource exhaustion in cmark-gfm autolink extension may lead to denial of serviceNo score- mozilla firefox, firefox esr, thunderbird +2 moreMozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the...8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreConcurrent use of the URL parser with non-UTF-8 data was not thread-safe. This could lead to a...6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreDuring iframe navigation, certain pages did not have their FeaturePolicy fully initialized...6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreBy injecting a cookie with certain special characters, an attacker on a shared subdomain which is...6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreWhen injecting an HTML base element, some requests would ignore the CSP's base-uri settings and...6.1 Medium
- evohclaimable project evohclaimableAccess control vulnerability in Evoh NFT EvohClaimable contract with sha256 hash code...5.3 Medium
- tibco ebx add-onsTIBCO EBX Add-ons Stored XSS vulnerability8.0 High
- tibco ebxTIBCO EBX Stored XSS vulnerability8.0 High
- vmware spring data restSpring Data REST can expose hidden entity attributes3.7 Low
- simple task managing system project task managing systemSourceCodester Simple Task Managing System v1.0 was discovered to contain a SQL injection...9.8 Critical
- simple task managing system project task managing systemSourceCodester Simple Task Managing System v1.0 was discovered to contain a cross-site scripting ...4.8 Medium
- simple task managing system project task managing systemSourceCodester Simple Task Managing System v1.0 was discovered to contain a cross-site scripting ...4.8 Medium
- simple task managing system project task managing systemSourceCodester Simple Task Managing System v1.0 was discovered to contain a cross-site scripting ...6.1 Medium
- simple task managing system project task managing systemSourceCodester Simple Task Managing System v1.0 was discovered to contain a SQL injection...7.2 High
- jordansissel ruby-arr-pmArbitrary shell execution when extracting or listing files contained in a malicious rpm.7.0 High
jwcryptoPyPI,python-jwcryptoopenEuler +1 morejwcrypto token substitution can lead to authentication bypass6.8 Medium- ikus-soft rdiffweb, ikus060 ikus060/rdiffweb +1 moreSensitive Cookie in HTTPS Session Without 'Secure' Attribute in ikus060/rdiffweb4.9 Medium
- ikus-soft minarca, ikus060 ikus060/minarca +1 moreSensitive Cookie in HTTPS Session Without 'Secure' Attribute in ikus060/minarca7.5 High
- ahsay cloud backup suiteAhsay AhsayCBS 9.1.4.0 allows an authenticated system user to inject arbitrary Java JVM options....7.2 High
- ibm maximo asset managementIBM Maximo Asset Management 7.6.1.1, 7.6.1.2, and 7.6.1.3 could allow a user to bypass...6.5 Medium
- jenkins cons3rt, jenkins project cons3rt plugin +1 moreAPI token stored in plain text by Jenkins CONS3RT Plugin6.5 Medium
- jenkins cons3rt, jenkins project cons3rt plugin +1 moreMissing permission checks in Jenkins CONS3RT Plugin allow capturing credentials6.5 Medium
- jenkins cons3rt, jenkins project cons3rt plugin +1 moreCSRF vulnerability in Jenkins CONS3RT Plugin allow capturing credentials8.8 High
- jenkins cons3rt, jenkins project cons3rt plugin +1 moreMissing permission checks in Jenkins CONS3RT Plugin allow enumerating credentials IDs4.3 Medium
- jenkins apprenda, jenkins project apprenda plugin +1 moreJenkins Apprenda Plugin has Missing Authorization vulnerability4.3 Medium
- jenkins scm httpclient, jenkins project scm httpclient plugin +1 moreMissing permission check in Jenkins SCM HttpClient Plugin allow capturing credentials6.5 Medium
- Show moreLoading…