Skip to content
OpenAdvisories

Archive

8 September 2022

Vulnerabilities first published on this day (UTC), newest first.

← August 2022 2022 / September /8 October 2022 →
  1. 170
  2. 277
  3. 31
  4. 42
  5. 539
  6. 6157
  7. 764
  8. 858
  9. 9130
  10. 10 
  11. 119
  12. 1249
  13. 13201
  14. 1449
  15. 1589
  16. 16266
  17. 175
  18. 187
  19. 19122
  20. 2096
  21. 2196
  22. 2258
  23. 23203
  24. 247
  25. 253
  26. 26105
  27. 2733
  28. 2874
  29. 2935
  30. 3069
All Critical High Medium Low Exploited only Public exploit

58 results · Feed

  • Critical 10.0
    CVE-2022-27593 Exploited · Ransomware Scanner template EPSS 88%

    DeadBolt Ransomware

    An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the following versions: QT…

    QNAP Systems Photo Station
    KEV Sep 8, 2022
  • Medium 4.3
    CVE-2022-3138

    Cross-site Scripting (XSS) - Generic in jgraph/drawio

    Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0.

    jgraph jgraph/drawio
  • Medium 5.3
    CVE-2022-3148

    Cross-site Scripting (XSS) - Generic in jgraph/drawio

    Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0.

    jgraph jgraph/drawio
  • High 7.5
    CVE-2022-28220

    STARTTLS command injection in Apache JAMES

    Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. Fix of CVE-2021-38542, which solved similar problem fron Apache James 3.6.1, is subject to a parser differential and do not take into…

    Apache Software Foundation Apache James org.apache.james:james-server Maven
  • Unscored —
    CVE-2022-38400

    Mailform Pro CGI 4.3.1 and earlier allow a remote unauthenticated attacker to obtain the user input data by having a us…

    SYNCK GRAPHICA Mailform Pro CGI
  • Unscored —
    CVE-2022-38394

    Use of hard-coded credentials for the telnet server of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows …

    Allied Telesis K.K. CentreCOM AR260S V2
  • Unscored —
    CVE-2022-38399

    Missing protection mechanism for alternate hardware interface in SmaCam CS-QR10 all versions and SmaCam Night Vision CS…

    PLANEX COMMUNICATIONS SmaCam CS-QR10 and SmaCam Night Vision CS-QR20
  • Unscored —
    CVE-2022-38094

    OS command injection vulnerability in the telnet function of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 a…

    Allied Telesis K.K. CentreCOM AR260S V2
  • Unscored —
    CVE-2022-36403

    Untrusted search path vulnerability in the installer of Device Software Manager prior to Ver.2.20.3.0 allows an attacke…

    Ricoh Company Installer of Device Software Manager
  • Unscored —
    CVE-2022-35273

    OS command injection vulnerability in GUI setting page of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allo…

    Allied Telesis K.K. CentreCOM AR260S V2
  • Unscored —
    CVE-2022-34869

    Undocumented hidden command that can be executed from the telnet function of CentreCOM AR260S V2 firmware versions prio…

    Allied Telesis K.K. CentreCOM AR260S V2
  • Unscored —
    CVE-2022-33941

    PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability. Sending a specially crafted m…

    Alfasado PowerCMS XMLRPC API
  • Medium 5.6
    CVE-2022-25914

    Remote Code Execution (RCE)

    The package com.google.cloud.tools:jib-core before 0.22.0 are vulnerable to Remote Code Execution (RCE) via the isDockerInstalled function, due to attempting to execute input.

    com.google.cloud.tools:jib-core Maven
  • Medium 5.9
    CVE-2022-25897

    Denial of Service (DoS)

    The package org.eclipse.milo:sdk-server before 0.6.8 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False.

    org.eclipse.milo:sdk-server Maven
  • Unscored —
    CVE-2022-37146

    The PlexTrac platform prior to version 1.28.0 allows for username enumeration via HTTP response times on invalid login …

  • Unscored —
    CVE-2022-37145

    The PlexTrac platform prior to version 1.17.0 does not restrict excessive authentication attempts for accounts configur…

  • Unscored —
    CVE-2022-37144

    The PlexTrac platform prior to API version 1.17.0 does not restrict excessive MFA TOTP submission attempts. An unauthen…

  • Medium 6.1
    CVE-2022-3153

    NULL Pointer Dereference in vim/vim

    NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.

    vim vim/vim vim vim Debian Ubuntu Azure Linux