Skip to content
OpenAdvisories

Archive

11 September 2022

Vulnerabilities first published on this day (UTC), newest first.

← August 2022 2022 / September /11 October 2022 →
  1. 170
  2. 277
  3. 31
  4. 42
  5. 539
  6. 6157
  7. 764
  8. 858
  9. 9130
  10. 10 
  11. 119
  12. 1249
  13. 13201
  14. 1449
  15. 1589
  16. 16266
  17. 175
  18. 187
  19. 19122
  20. 2096
  21. 2196
  22. 2258
  23. 23203
  24. 247
  25. 253
  26. 26105
  27. 2733
  28. 2874
  29. 2935
  30. 3069
All Critical High Medium Low Exploited only Public exploit

9 results · Feed

  • Unscored —
    CVE-2022-37796

    In Simple Online Book Store System 1.0 in /admin_book.php the Title, Author, and Description parameters are vulnerable …

  • Unscored —
    CVE-2022-37794

    In Library Management System 1.0 the /card/in-card.php file id_no parameters are vulnerable to SQL injection.

  • Unscored —
    CVE-2022-40325

    SysAid Help Desk before 22.1.65 allows XSS via the Asset Dashboard, aka FR# 67262.

  • Unscored —
    CVE-2022-40324

    SysAid Help Desk before 22.1.65 allows XSS via the Linked SRs field, aka FR# 67258.

  • Unscored —
    CVE-2022-40323

    SysAid Help Desk before 22.1.65 allows XSS in the Password Services module, aka FR# 67241.

  • Unscored —
    CVE-2022-40322

    SysAid Help Desk before 22.1.65 allows XSS, aka FR# 66542 and 65579.

  • Medium 5.4
    CVE-2022-25295

    Open Redirect

    This affects the package github.com/gophish/gophish before 0.12.0. The Open Redirect vulnerability exists in the next query parameter. The application uses url.Parse(r.FormValue("next")) to extract path and eventually redirect user to a relative URL, but if n…

    github.com/gophish/gophish Go
  • Medium 5.3
    CVE-2022-26049 Public exploit

    Arbitrary File Write via Archive Extraction (Zip Slip)

    This affects the package com.diffplug.gradle:goomph before 3.37.2. It allows a malicious zip file to potentially break out of the expected destination directory, writing contents into arbitrary locations on the file system. Overwriting certain files/directori…

    com.diffplug.gradle:goomph Maven
  • Critical 9.8
    CVE-2022-39135

    Apache Calcite: potential XEE attacks

    Apache Calcite 1.22.0 introduced the SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM and EXTRACT_VALUE do not restrict XML External Entity references in their configuration, making them vulnerable to a potential XML External Entity (XXE) attack. Therefo…

    Apache Software Foundation Apache Calcite trino trino-plugin-opensearch Wolfi Maven