Skip to content
OpenAdvisories

Archive

22 September 2022

Vulnerabilities first published on this day (UTC), newest first.

← August 2022 2022 / September /22 October 2022 →
  1. 170
  2. 277
  3. 31
  4. 42
  5. 539
  6. 6157
  7. 764
  8. 858
  9. 9130
  10. 10 
  11. 119
  12. 1249
  13. 13201
  14. 1449
  15. 1589
  16. 16266
  17. 175
  18. 187
  19. 19122
  20. 2096
  21. 2196
  22. 2258
  23. 23203
  24. 247
  25. 253
  26. 26105
  27. 2733
  28. 2874
  29. 2935
  30. 3069
All Critical High Medium Low Exploited only Public exploit

58 results · Feed

  • Medium 5.3
    CVE-2022-40444

    ZZCMS 2022 was discovered to contain a full path disclosure vulnerability via the page /admin/index.PHP? _server.

  • Medium 5.3
    CVE-2022-40443 Scanner template

    An absolute path traversal vulnerability in ZZCMS 2022 allows attackers to obtain sensitive information via a crafted G…

  • Medium 6.8
    CVE-2022-3267

    Cross-Site Request Forgery (CSRF) in ikus060/rdiffweb

    Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.6.

    ikus060 ikus060/rdiffweb rdiffweb PyPI
  • Critical 9.8
    CVE-2022-3268

    Weak Password Requirements in ikus060/minarca

    Weak Password Requirements in GitHub repository ikus060/minarca prior to 4.2.2.

    ikus060 ikus060/minarca
  • Medium 6.1
    CVE-2022-2266

    Reflected XSS University Library Automation System

    University Library Automation System developed by Yordam Bilgi Teknolojileri before version 19.2 has an unauthenticated Reflected XSS vulnerability. This has been fixed in the version 19.2

    Yordam Bilgi Teknolojileri Yordam Bilgi Teknolojileri
  • High 7.5
    CVE-2022-40705

    Apache SOAP: XML External Entity Injection (XXE) allows unauthenticated users to read arbitrary files via HTTP

    An Improper Restriction of XML External Entity Reference vulnerability in RPCRouterServlet of Apache SOAP allows an attacker to read arbitrary files over HTTP. This issue affects Apache SOAP version 2.2 and later versions. It is unknown whether previous versi…

    Apache Software Foundation Apache SOAP soap:soap Maven
  • Medium 6.1
    CVE-2022-39197 Exploited Public exploit EPSS 44%

    An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote at…

    KEV Mar 30, 2023
  • Medium 6.5
    CVE-2022-38512

    Liferay Portal and Liferay DXP Fails to Check Permissions in Translation Module

    The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not check permissions before allowing a user to export a web content for translation, allowing attackers to download a web content page's XLIFF …

    com.liferay.portal:release.dxp.bom com.liferay:com.liferay.translation.web Maven
  • Medium 6.1
    CVE-2022-28980

    Liferay Portal and Liferay DXP Vulnerable to XSS via the filter_ Prefix

    Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal v7.4.3.4 and Liferay DXP v7.4 GA allows attackers to execute arbitrary web scripts or HTML via parameters with the filter_ prefix.

    com.liferay.portal:release.dxp.bom com.liferay:com.liferay.fragment.renderer.collection.filter.impl Maven
  • High 7.5
    CVE-2022-28981

    Liferay Portal Path Traversal Vulnerability via the Hypermedia REST APIs Module

    Path traversal vulnerability in the Hypermedia REST APIs module in Liferay Portal 7.4.0 through 7.4.2 allows remote attackers to access files outside of com.liferay.headless.discovery.web/META-INF/resources via the `parameter` parameter.

    com.liferay:com.liferay.headless.discovery.web Maven
  • Medium 6.1
    CVE-2022-28977

    Liferay Portal and Liferay DXP HtmlUtil.escapeRedirect Can Be Circumvented

    HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, which allow…

    com.liferay.portal:release.portal.bom com.liferay.portal:release.dxp.bom com.liferay.portal:com.liferay.util.java Maven
  • High 7.5
    CVE-2022-1941

    Out of Memory issue in ProtocolBuffers for cpp and python

    A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 fo…

    Google protobuf-python protobuf-cpp mysql Debian Ubuntu Azure Linux PyPI
  • Medium 5.3
    CVE-2022-38648

    PDFTranscoder does not block external resources

    Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14.

    Apache Software Foundation Apache XML Graphics batik batik Debian Ubuntu Maven
  • Medium 5.3
    CVE-2022-38398

    Server-Side Request Forgery Information Disclosure Vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. This issue affects Apache XML Graphics Batik 1.14.

    Apache Software Foundation Apache XML Graphics batik batik Debian Ubuntu Maven
  • High 7.6
    CVE-2022-36062

    Grafana folders admin only permission privilege escalation

    Grafana is an open-source platform for monitoring and observability. In versions prior to 8.5.13, 9.0.9, and 9.1.6, Grafana is subject to Improper Preservation of Permissions resulting in privilege escalation on some folders where Admin is the only used permi…

    Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Alpine Go
  • High 7.8
    CVE-2022-3256

    Use After Free in vim/vim

    Use After Free in GitHub repository vim/vim prior to 9.0.0530.

    vim vim/vim vim vim Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2022-40146 Public exploit

    Jar url should be blocked by DefaultScriptSecurity

    Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14.

    Apache Software Foundation Apache XML Graphics batik batik Debian Ubuntu Maven
  • Critical 9.1
    CVE-2022-40186

    HashiCorp Vault vulnerable to incorrect metadata access

    An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3. A vulnerability in the Identity Engine was found where, in a deployment where an entity has multiple mount accessors with shared alias names, Vault may overwrite metadata to the wr…

    github.com/hashicorp/vault Go