Skip to content
OpenAdvisories

Archive

20 September 2022

Vulnerabilities first published on this day (UTC), newest first.

← August 2022 2022 / September /20 October 2022 →
  1. 170
  2. 277
  3. 31
  4. 42
  5. 539
  6. 6157
  7. 764
  8. 858
  9. 9130
  10. 10 
  11. 119
  12. 1249
  13. 13201
  14. 1449
  15. 1589
  16. 16266
  17. 175
  18. 187
  19. 19122
  20. 2096
  21. 2196
  22. 2258
  23. 23203
  24. 247
  25. 253
  26. 26105
  27. 2733
  28. 2874
  29. 2935
  30. 3069
All Critical High Medium Low Exploited only Public exploit

26 results · Clear filters · Feed

  • Medium 5.5
    CVE-2022-35085

    SWFTools commit 772e55a2 was discovered to contain a memory leak via /lib/mem.c.

    swftools Ubuntu
  • Medium 5.5
    CVE-2022-35086

    SWFTools commit 772e55a2 was discovered to contain a segmentation violation via /multiarch/memmove-vec-unaligned-erms.S.

    swftools Ubuntu
  • Medium 5.5
    CVE-2022-35087

    SWFTools commit 772e55a2 was discovered to contain a segmentation violation via MovieAddFrame at /src/gif2swf.c.

    swftools Ubuntu
  • Medium 5.5
    CVE-2022-35088

    SWFTools commit 772e55a2 was discovered to contain a heap buffer-overflow via getGifDelayTime at /home/bupt/Desktop/swf…

    swftools Ubuntu
  • Medium 5.5
    CVE-2022-35089

    SWFTools commit 772e55a2 was discovered to contain a heap-buffer-overflow via getTransparentColor at /home/bupt/Desktop…

    swftools Ubuntu
  • Medium 5.5
    CVE-2022-35090

    SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via __asan_memcpy at /asan/asan_interceptors_…

    swftools Ubuntu
  • Medium 6.1
    CVE-2022-39220

    XSS Vulnerabilities in WebClient

    SFTPGo is an SFTP server written in Go. Versions prior to 2.3.5 are subject to Cross-site scripting (XSS) vulnerabilities in the SFTPGo WebClient, allowing remote attackers to inject malicious code. This issue is patched in version 2.3.5. No known workarounds…

    drakkan sftpgo github.com/drakkan/sftpgo/v2 github.com/drakkan/sftpgo Go
  • Medium 6.5
    CVE-2022-32880

    This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.5. An app may be able t…

    Apple macOS macOS
  • Medium 5.3
    CVE-2022-32861

    A logic issue was addressed with improved state management. This issue is fixed in Safari 15.6, macOS Monterey 12.5. A …

    Apple macOS macOS
  • Medium 4.3
    CVE-2021-46835

    There is a traffic hijacking vulnerability in WS7200-10 11.0.2.13. Successful exploitation of this vulnerability can ca…

  • Medium 5.5
    CVE-2021-46834

    A permission bypass vulnerability in Huawei cross device task management could allow an attacker to access certain reso…

  • Medium 6.5
    CVE-2022-33735

    There is a password verification vulnerability in WS7200-10 11.0.2.13. Attackers on the LAN may use brute force crackin…

  • Medium 6.1
    CVE-2020-36602

    There is an out-of-bounds read and write vulnerability in some headset products. An unauthenticated attacker gets the d…

  • Medium 5.3
    CVE-2022-38956

    An exploitable firmware downgrade vulnerability was discovered on the Netgear WPN824EXT WiFi Range Extender. An attacke…

  • Medium 6.5
    CVE-2017-20147

    In the ebuild package through smokeping-2.7.3-r1 for SmokePing on Gentoo, the initscript uses a PID file that is writab…

    smokeping Ubuntu
  • Medium 5.4
    CVE-2022-32167

    Cloudreve - Stored XSS

    Cloudreve versions v1.0.0 through v3.5.3 are vulnerable to Stored Cross-Site Scripting (XSS), via the file upload functionality. A low privileged user will be able to share a file with an admin user, which could lead to privilege escalation.

    cloudreve cloudreve github.com/cloudreve/Cloudreve/v3 github.com/HFO4/cloudreve Go
  • Medium 5.3
    CVE-2021-33076

    Improper authentication in firmware for some Intel(R) SSD DC Products may allow an unauthenticated user to potentially …

  • Medium 4.1
    CVE-2021-33079

    Protection mechanism failure in firmware for some Intel(R) SSD DC Products may allow a privileged user to potentially e…

  • Medium 4.3
    CVE-2022-3245

    Code Injection in display of tag title on saving tags in microweber/microweber

    HTML injection attack is closely related to Cross-site Scripting (XSS). HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScript into the page. Both attacks exploit insufficient validation of user input.

    microweber microweber/microweber microweber/microweber Packagist
  • Medium 5.4
    CVE-2022-3005

    Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm

    Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.

    yetiforcecompany yetiforcecompany/yetiforcecrm yetiforce/yetiforce-crm Packagist
  • Medium 4.3
    CVE-2022-3242 Scanner template

    HTML code Injection in template search keyword in microweber/microweber

    Code Injection in GitHub repository microweber/microweber prior to 1.3.2.

    microweber microweber/microweber microweber/microweber Packagist
  • Medium 6.3
    CVE-2022-3004

    Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm

    Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.

    yetiforcecompany yetiforcecompany/yetiforcecrm yetiforce/yetiforce-crm Packagist
  • Medium 6.3
    CVE-2022-3000

    Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm

    Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.

    yetiforcecompany yetiforcecompany/yetiforcecrm yetiforce/yetiforce-crm Packagist
  • Medium 5.9
    CVE-2022-34746

    An insufficient entropy vulnerability caused by the improper use of randomness sources with low entropy for RSA key pai…

    Zyxel Zyxel GS1900 series firmware Network devices
  • Medium 6.6
    CVE-2022-35957

    Authentication Bypass in Grafana via auth proxy allowing escalation from admin to server admin

    Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full c…

    Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Alpine Go
  • Medium 5.5
    CVE-2022-32883 Public exploit

    A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS…

    Apple macOS iOS macOS iOS