CVEs published in September 2022
3,650 vulnerabilities, 294 critical, 12 exploited.
- matrix javascript sdk, matrix-org matrix-js-sdk +1 moreMatrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessions7.5 High
- matrix javascript sdk, matrix-org matrix-js-sdk +1 moreMatrix Javascript SDK improper beacon events can cause availability issues4.3 Medium
- google chromeInsufficient data validation in File System API in Google Chrome prior to 106.0.5249.62 allowed a...4.3 Medium
- google chromeInsufficient data validation in File System API in Google Chrome prior to 106.0.5249.62 allowed a...4.3 Medium
- google chromeUse after free in ChromeOS Notifications in Google Chrome on ChromeOS prior to 106.0.5249.62...4.3 Medium
- google chromeInsufficient validation of untrusted input in Intents in Google Chrome on Android prior to 106.0...4.3 Medium
- google chromeInsufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 106.0.5249...4.3 Medium
- google chromeType confusion in Blink in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to...8.8 High
- google chromeUse after free in logging in Google Chrome prior to 106.0.5249.62 allowed a remote attacker who...6.5 Medium
- google chromeIncorrect security UI in full screen in Google Chrome prior to 106.0.5249.62 allowed a remote...6.5 Medium
- google chromeInsufficient validation of untrusted input in VPN in Google Chrome on ChromeOS prior to 106.0...4.6 Medium
- google chromeUse after free in import in Google Chrome prior to 106.0.5249.62 allowed a remote attacker who...6.5 Medium
- google chromeInsufficient policy enforcement in custom tabs in Google Chrome on Android prior to 106.0.5249.62...6.5 Medium
- google chromeUse after free in assistant in Google Chrome on ChromeOS prior to 106.0.5249.62 allowed a remote...6.5 Medium
- google chromeInsufficient policy enforcement in developer tools in Google Chrome prior to 106.0.5249.62...7.4 High
- google chromeUse after free in media in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to...8.8 High
- google chromeUse after free in survey in Google Chrome on ChromeOS prior to 106.0.5249.62 allowed a remote...8.8 High
- google chromeUse after free in survey in Google Chrome on ChromeOS prior to 106.0.5249.62 allowed a remote...8.8 High
- google chromeUse after free in CSS in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to...8.8 High
- apple macosAn information disclosure issue was addressed by removing the vulnerable code. This issue is...5.3 Medium
- apple ipados, macos, safari +3 more +5 moreA correctness issue in the JIT was addressed with improved checks. This issue is fixed in tvOS 16...6.5 Medium
- apple ipados, macos, tvos +2 more +4 moreAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in...8.8 High
- carlo gavazzi cpy car park server, uwp 3.0 monitoring gateway and controller, uwp 3.0 monitoring gateway and controller – edp version +2 more +4 moreSQL-injection in Car Park Server 3.0 allows for full database access.7.5 High
- octopus serverIn affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the...4.3 Medium
- apache tomcat, debian linux +1 moreApache Tomcat: Information disclosure3.7 Low
- wazuhWazuh v3.6.1 - v3.13.5, v4.0.0 - v4.2.7, and v4.3.0 - v4.3.7 were discovered to contain an...8.8 High
- resumes management and job application website application project management and job application website applicationSQL Injection vulnerability exists in version 1.0 of the Resumes Management and Job Application...9.8 Critical
- ieee 802.2, ietf draft-ietf-v6ops-ra-guard-08, p802.1q +2 moreL2 network filtering bypass using stacked VLAN0 and LLC/SNAP headers with an invalid length during Ethernet to Wifi frame translation4.7 Medium
- ieee 802.2, ietf draft-ietf-v6ops-ra-guard, p802.1q +2 moreL2 network filtering bypass using stacked VLAN0 and LLC/SNAP headers with invalid lengths4.7 Medium
- ieee 802.2, ietf draft-ietf-v6ops-ra-guard, p802.1q +2 moreL2 network filtering bypass using stacked VLAN0, LLC/SNAP headers, and Ethernet to Wifi frame translation4.7 Medium
- gajimAn issue was discovered in Gajim through 1.4.7. The vulnerability allows attackers, via crafted...5.3 Medium
- cisco catalyst 6503-e firmware, catalyst 6504-e firmware, catalyst 6506-e firmware +94 more +96 moreL2 network filtering can be bypassed using stacked VLAN0 and LLC/SNAP headers4.7 Medium
- toaruosreadelf in ToaruOS 2.0.1 has a global overflow allowing RCE when parsing a crafted ELF file.7.8 High
- iris isamsISAMS 22.2.3.2 is prone to stored Cross-site Scripting (XSS) attack on the title field for groups...5.4 Medium
- vtiger crmVtiger CRM v7.4.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via...5.4 Medium
- exam reviewer management system project reviewer management systemExam Reviewer Management System 1.0 is vulnerable to SQL Injection via the ‘id’ parameter.9.8 Critical
- exam reviewer management system project reviewer management systemIn Exam Reviewer Management System 1.0, an authenticated attacker can upload a web-shell php file...8.8 High
- pyupio dparse, pyup dependency parser +1 moreRegular expression denial of service in dparse5.9 Medium
- zammadZammad 5.2.1 is vulnerable to Incorrect Access Control. Zammad's asset handling mechanism has...6.5 Medium
- zammadZammad 5.2.1 has a fine-grained permission model that allows to configure read-only access to...4.3 Medium
- mailcow mailcow-dockerized, mailcow\ +1 moremailcow-dockerized critical information misrepresentation can lead to phishing attacks through Swagger UI8.1 High
- orckestra c1 cms, c1-cms-foundation +1 moreOrckestra C1 CMS's deserialization of untrusted data allows for arbitrary code execution.9.0 Critical
- sandisk ibi, western digital my cloud home, my cloud home duo +3 more +5 moreBuffer Overflow Vulnerability in Western Digital My Cloud Home Products and SanDisk ibi1.8 Low
- advantech iviewAn SQL injection vulnerability in Advantech iView 5.7.04.6469. The specific flaw exists within...7.5 High
- online tours \& travels management system project tours \& travels management systemOnline Tours & Travels Management System v1.0 was discovered to contain a SQL injection...7.2 High
- online tours \& travels management system project tours \& travels management systemOnline Tours & Travels Management System v1.0 was discovered to contain a SQL injection...7.2 High
- online tours \& travels management system project tours \& travels management systemOnline Tours & Travels Management System v1.0 was discovered to contain a SQL injection...7.2 High
- jflyfox jfinal cmsJFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component,...8.8 High
- strapiStrapi mishandles hidden attributes within admin API responses8.8 High
- chipoloChipolo ONE Bluetooth tracker (2020) Chipolo iOS app version 4.13.0 is vulnerable to Incorrect...7.4 High
- Show moreLoading…