Skip to content
OpenAdvisories

Archive

9 September 2022

Vulnerabilities first published on this day (UTC), newest first.

← August 2022 2022 / September /9 October 2022 →
  1. 170
  2. 277
  3. 31
  4. 42
  5. 539
  6. 6157
  7. 764
  8. 858
  9. 9130
  10. 10 
  11. 119
  12. 1249
  13. 13201
  14. 1449
  15. 1589
  16. 16266
  17. 175
  18. 187
  19. 19122
  20. 2096
  21. 2196
  22. 2258
  23. 23203
  24. 247
  25. 253
  26. 26105
  27. 2733
  28. 2874
  29. 2935
  30. 3069
All Critical High Medium Low Exploited only Public exploit

69 results · Clear filters · Feed

  • Medium 5.5
    CVE-2022-39845

    Improper validation of integrity check vulnerability in Samsung Kies prior to version 2.6.4.22074 allows local attacker…

    Samsung Mobile Samsung Kies
  • Medium 6.2
    CVE-2022-38701

    IPC in communication subsystem has a heap overflow vulnerability. Local attackers can trigger a heap overflow and get network sensitive information.

    OpenHarmony-v3.1.2 and prior versions have a heap overflow vulnerability. Local attackers can trigger a heap overflow and get network sensitive information.

    OpenHarmony OpenHarmony
  • Medium 4.8
    CVE-2022-35275

    WordPress Advanced Order Export For WooCommerce plugin <= 3.3.1 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

    Authenticated (shop manager+) Reflected Cross-Site Scripting (XSS) vulnerability in AlgolPlus Advanced Order Export For WooCommerce plugin <= 3.3.1 at WordPress.

    Algolplus Advanced Order Export For WooCommerce (WordPress plugin) Web / CMS
  • Medium 6.2
    CVE-2022-38081

    Tokensync in security subsystem has a permission bypass vulnerability. LAN attackers can bypass the distributed permission control.To take advantage of this weakness, attackers need another vulnerability to obtain system.

    OpenHarmony-v3.1.2 and prior versions have a permission bypass vulnerability. LAN attackers can bypass the distributed permission control.To take advantage of this weakness, attackers need another vulnerability to obtain system.

    OpenHarmony OpenHarmony
  • Medium 6.2
    CVE-2022-38064

    windowmanager in window subsystem has a permission bypass vulnerability. Local attackers can bypass permission control and get sensitive information.

    OpenHarmony-v3.1.2 and prior versions have a permission bypass vulnerability. Local attackers can bypass permission control and get sensitive information.

    OpenHarmony OpenHarmony
  • Medium 5.4
    CVE-2022-35277

    WordPress GetResponse plugin <= 5.5.20 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in GetResponse plugin <= 5.5.20 at WordPress.

    GetResponse GetResponse for WordPress (WordPress plugin) Web / CMS
  • Medium 6.5
    CVE-2022-38067

    WordPress Event Calendar – Calendar plugin <= 1.4.6 - Unauthenticated Event Deletion vulnerability

    Unauthenticated Event Deletion vulnerability in Totalsoft Event Calendar – Calendar plugin <= 1.4.6 at WordPress.

    Total-Soft Event Calendar – Calendar (WordPress plugin) Web / CMS
  • Medium 6.5
    CVE-2022-36793

    WordPress WP Shop plugin <= 3.9.6 - Unauthenticated Plugin Settings Change & Data Deletion vulnerabilities

    Unauthenticated Plugin Settings Change & Data Deletion vulnerabilities in WP Shop plugin <= 3.9.6 at WordPress.

    WPShop.ru WP Shop (WordPress plugin) Web / CMS
  • Medium 4.8
    CVE-2022-37412

    WordPress Better Delete Revision plugin <= 1.6.1 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

    Authenticated (admin+) Reflected Cross-Site Scripting (XSS) vulnerability in Galerio & Urda's Better Delete Revision plugin <= 1.6.1 at WordPress.

    Galerio & Urda Better Delete Revision (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-37411

    WordPress Captcha Code plugin <= 2.7 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Vinoj Cardoza's Captcha Code plugin <= 2.7 at WordPress.

    Vinoj Cardoza Captcha Code (WordPress plugin) Web / CMS
  • Medium 4.3
    CVE-2022-37405

    WordPress Better Font Awesome plugin <= 2.0.1 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Mickey Kay's Better Font Awesome plugin <= 2.0.1 at WordPress.

    Mickey Kay Better Font Awesome (WordPress plugin) Web / CMS
  • Medium 4.8
    CVE-2022-37404

    WordPress add2fav plugin <= 1.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

    Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Christian Salazar's add2fav plugin <= 1.0 at WordPress.

    Christian Salazar add2fav (WordPress plugin) Web / CMS
  • Medium 4.8
    CVE-2022-37403

    WordPress Add User Role plugin <= 0.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

    Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Nikhil Vaghela's Add User Role plugin <= 0.0.1 at WordPress.

    Nikhil Vaghela Add User Role (WordPress plugin) Web / CMS
  • Medium 4.3
    CVE-2022-38058

    WordPress WP Shamsi plugin <= 4.1.1 - Authenticated Plugin Setting change vulnerability

    Authenticated (subscriber+) Plugin Setting change vulnerability in WP Shamsi plugin <= 4.1.1 at WordPress.

    wpvar.com WP Shamsi (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-38093

    WordPress All in One SEO plugin <= 4.2.3.1 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities

    Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in All in One SEO plugin <= 4.2.3.1 at WordPress.

    All in One SEO Team All in One SEO (WordPress plugin) Web / CMS
  • Medium 6.8
    CVE-2022-36376

    WordPress Rank Math SEO plugin <= 1.0.95 - Server-Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Rank Math SEO plugin <= 1.0.95 at WordPress.

    Rank Math Rank Math SEO (WordPress plugin) rankmath/seo-by-rank-math Web / CMS Packagist
  • Medium 4.8
    CVE-2022-36356

    WordPress Culture Object plugin <= 4.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

    Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Liam Gladdy / Thirty8 Digital Culture Object plugin <= 4.0.1 at WordPress.

    Liam Gladdy / Thirty8 Digital Culture Object (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-40191

    WordPress Contact Form By Mega Forms plugin <= 1.2.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

    Authenticated (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in Ali Khallad's Contact Form By Mega Forms plugin <= 1.2.4 at WordPress.

    Ali Khallad Contact Form By Mega Forms (WordPress plugin) Web / CMS
  • Medium 4.8
    CVE-2022-35725

    WordPress wp-forecast plugin <= 7.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

    Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Hans Matzen's wp-forecast plugin <= 7.5 at WordPress.

    Hans Matzen wp-forecast (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-38070

    WordPress Pop-up plugin <= 1.1.5 - Privilege Escalation vulnerability

    Privilege Escalation (subscriber+) vulnerability in Pop-up plugin <= 1.1.5 at WordPress.

    Pop-ups Pop-up (WordPress plugin) Web / CMS
  • Medium 4.8
    CVE-2022-38068

    WordPress Export Post Info plugin <= 1.1.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

    Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Apasionados Export Post Info plugin <= 1.1.0 at WordPress.

    apasionados Export Post Info (WordPress plugin) Web / CMS
  • Medium 4.3
    CVE-2022-36422

    WP-PostRatings plugin <= 1.89 - Rating increase/decrease via race condition

    Rating increase/decrease via race condition in Lester 'GaMerZ' Chan WP-PostRatings plugin <= 1.89 at WordPress.

    Lester 'GaMerZ' Chan WP-PostRatings (WordPress plugin) Web / CMS
  • Medium 6.3
    CVE-2022-38457

    There is an UAF vulnerability in vmwgfx driver

    A use-after-free(UAF) vulnerability was found in function 'vmw_cmd_res_check' in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in Linux kernel's vmwgfx driver with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the…

    Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 6.3
    CVE-2022-38096

    There is a NULL pointer vulnerability in vmwgfx driver

    A NULL pointer dereference vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system t…

    Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 6.3
    CVE-2022-40133

    There is an UAF vulnerability in vmwgfx driver

    A use-after-free(UAF) vulnerability was found in function 'vmw_execbuf_tie_context' in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in Linux kernel's vmwgfx driver with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account …

    Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2022-38059

    WordPress Access Code Feeder plugin <= 1.0.3 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Alexey Trofimov's Access Code Feeder plugin <= 1.0.3 at WordPress.

    Alexey Trofimov Access Code Feeder (WordPress plugin) Web / CMS
  • Medium 6.3
    CVE-2022-36280

    There is an out-of-bounds write vulnerability in vmwgfx driver

    An out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_kms.c in GPU component in the Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the…

    Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 6.2
    CVE-2020-10735

    A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text")…

    python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Wolfi
  • Medium 5.7
    CVE-2022-36087

    OAuthLib vulnerable DoS when attacker provides malicious IPV6 URI

    OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing malicious redirect uri can cause denial of service. An attacker can also leverage usage of `uri_validate` functions…

    oauthlib oauthlib oauthlib python-oauthlib Debian Ubuntu PyPI