Skip to content
OpenAdvisories

Archive

9 September 2022

Vulnerabilities first published on this day (UTC), newest first.

← August 2022 2022 / September /9 October 2022 →
  1. 170
  2. 277
  3. 31
  4. 42
  5. 539
  6. 6157
  7. 764
  8. 858
  9. 9130
  10. 10 
  11. 119
  12. 1249
  13. 13201
  14. 1449
  15. 1589
  16. 16266
  17. 175
  18. 187
  19. 19122
  20. 2096
  21. 2196
  22. 2258
  23. 23203
  24. 247
  25. 253
  26. 26105
  27. 2733
  28. 2874
  29. 2935
  30. 3069
All Critical High Medium Low Exploited only Public exploit

130 results · Feed

  • Medium 4.3
    CVE-2022-37405

    WordPress Better Font Awesome plugin <= 2.0.1 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Mickey Kay's Better Font Awesome plugin <= 2.0.1 at WordPress.

    Mickey Kay Better Font Awesome (WordPress plugin) Web / CMS
  • Medium 4.8
    CVE-2022-37404

    WordPress add2fav plugin <= 1.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

    Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Christian Salazar's add2fav plugin <= 1.0 at WordPress.

    Christian Salazar add2fav (WordPress plugin) Web / CMS
  • Medium 4.8
    CVE-2022-37403

    WordPress Add User Role plugin <= 0.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

    Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Nikhil Vaghela's Add User Role plugin <= 0.0.1 at WordPress.

    Nikhil Vaghela Add User Role (WordPress plugin) Web / CMS
  • High 8.8
    CVE-2022-38144

    WordPress wpForo Forum plugin <= 2.0.5 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 at WordPress.

    gVectors Team wpForo Forum (WordPress plugin) Web / CMS
  • Medium 4.3
    CVE-2022-38058

    WordPress WP Shamsi plugin <= 4.1.1 - Authenticated Plugin Setting change vulnerability

    Authenticated (subscriber+) Plugin Setting change vulnerability in WP Shamsi plugin <= 4.1.1 at WordPress.

    wpvar.com WP Shamsi (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-38093

    WordPress All in One SEO plugin <= 4.2.3.1 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities

    Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in All in One SEO plugin <= 4.2.3.1 at WordPress.

    All in One SEO Team All in One SEO (WordPress plugin) Web / CMS
  • Medium 6.8
    CVE-2022-36376

    WordPress Rank Math SEO plugin <= 1.0.95 - Server-Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Rank Math SEO plugin <= 1.0.95 at WordPress.

    Rank Math Rank Math SEO (WordPress plugin) rankmath/seo-by-rank-math Web / CMS Packagist
  • Medium 4.8
    CVE-2022-36356

    WordPress Culture Object plugin <= 4.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

    Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Liam Gladdy / Thirty8 Digital Culture Object plugin <= 4.0.1 at WordPress.

    Liam Gladdy / Thirty8 Digital Culture Object (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-40191

    WordPress Contact Form By Mega Forms plugin <= 1.2.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

    Authenticated (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in Ali Khallad's Contact Form By Mega Forms plugin <= 1.2.4 at WordPress.

    Ali Khallad Contact Form By Mega Forms (WordPress plugin) Web / CMS
  • Medium 4.8
    CVE-2022-35725

    WordPress wp-forecast plugin <= 7.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

    Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Hans Matzen's wp-forecast plugin <= 7.5 at WordPress.

    Hans Matzen wp-forecast (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-38070

    WordPress Pop-up plugin <= 1.1.5 - Privilege Escalation vulnerability

    Privilege Escalation (subscriber+) vulnerability in Pop-up plugin <= 1.1.5 at WordPress.

    Pop-ups Pop-up (WordPress plugin) Web / CMS
  • Medium 4.8
    CVE-2022-38068

    WordPress Export Post Info plugin <= 1.1.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

    Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Apasionados Export Post Info plugin <= 1.1.0 at WordPress.

    apasionados Export Post Info (WordPress plugin) Web / CMS
  • Medium 4.3
    CVE-2022-36422

    WP-PostRatings plugin <= 1.89 - Rating increase/decrease via race condition

    Rating increase/decrease via race condition in Lester 'GaMerZ' Chan WP-PostRatings plugin <= 1.89 at WordPress.

    Lester 'GaMerZ' Chan WP-PostRatings (WordPress plugin) Web / CMS
  • Medium 6.3
    CVE-2022-38457

    There is an UAF vulnerability in vmwgfx driver

    A use-after-free(UAF) vulnerability was found in function 'vmw_cmd_res_check' in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in Linux kernel's vmwgfx driver with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the…

    Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 6.3
    CVE-2022-38096

    There is a NULL pointer vulnerability in vmwgfx driver

    A NULL pointer dereference vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system t…

    Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Low 3.1
    CVE-2022-3147

    Server-side Denial of Service while processing a specifically crafted JPEG file

    Mattermost version 7.0.x and earlier fails to sufficiently limit the in-memory sizes of concurrently uploaded JPEG images, which allows authenticated users to cause resource exhaustion on specific system configurations, resulting in server-side Denial of Serv…

    Mattermost Mattermost
  • Medium 6.3
    CVE-2022-40133

    There is an UAF vulnerability in vmwgfx driver

    A use-after-free(UAF) vulnerability was found in function 'vmw_execbuf_tie_context' in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in Linux kernel's vmwgfx driver with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account …

    Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2022-38059

    WordPress Access Code Feeder plugin <= 1.0.3 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Alexey Trofimov's Access Code Feeder plugin <= 1.0.3 at WordPress.

    Alexey Trofimov Access Code Feeder (WordPress plugin) Web / CMS
  • Medium 6.3
    CVE-2022-36280

    There is an out-of-bounds write vulnerability in vmwgfx driver

    An out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_kms.c in GPU component in the Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the…

    Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-39119

    In network service, there is a missing permission check. This could lead to local escalation of privilege with no addit…

    Unisoc (Shanghai) Technologies SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
  • Unscored —
    CVE-2022-37299 Scanner template

    An issue was discovered in Shirne CMS 1.2.0. There is a Path Traversal vulnerability which could cause arbitrary file r…

  • Unscored —
    CVE-2022-38274

    JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/comment/list.

  • Unscored —
    CVE-2022-38273

    JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list_approve.

  • Unscored —
    CVE-2022-38272

    JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list.

  • Unscored —
    CVE-2022-38275

    JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/contact/list.

  • Unscored —
    CVE-2022-38276

    JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/foldernotice/list.

  • Unscored —
    CVE-2022-38277

    JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/folderrollpicture/list.

  • Unscored —
    CVE-2022-38278

    JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/friendlylink/list.

  • Unscored —
    CVE-2022-38279

    JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/imagealbum/list.

  • Unscored —
    CVE-2022-38280

    JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/image/list.

  • Unscored —
    CVE-2022-38281

    JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/site/list.

  • Unscored —
    CVE-2022-38282

    JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/videoalbum/list.

  • Unscored —
    CVE-2022-38283

    JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/video/list.

  • Unscored —
    CVE-2022-38284

    JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/department/list.

  • Unscored —
    CVE-2022-38285

    JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/menu/list.

  • Unscored —
    CVE-2022-38286

    JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/role/list.

  • Unscored —
    CVE-2022-2528

    In affected versions of Octopus Deploy it is possible to upload a package to built-in feed with insufficient permission…

    Octopus Deploy Octopus Server
  • High 7.2
    CVE-2022-29061

    An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in…

    Fortinet Fortinet FortiSOAR Network devices
  • Critical 9.0
    CVE-2022-2925

    Cross-site Scripting (XSS) - Stored in appwrite/appwrite

    Cross-site Scripting (XSS) - Stored in GitHub repository appwrite/appwrite prior to 1.0.0-RC1.

    appwrite appwrite/appwrite appwrite/server-ce Packagist
  • High 7.3
    CVE-2022-25765 Public exploit EPSS 43%

    Command Injection

    The package pdfkit from 0.0.0 are vulnerable to Command Injection where the URL is not properly sanitized.

    pdfkit RubyGems