Skip to content
OpenAdvisories

Archive

23 September 2022

Vulnerabilities first published on this day (UTC), newest first.

← August 2022 2022 / September /23 October 2022 →
  1. 170
  2. 277
  3. 31
  4. 42
  5. 539
  6. 6157
  7. 764
  8. 858
  9. 9130
  10. 10 
  11. 119
  12. 1249
  13. 13201
  14. 1449
  15. 1589
  16. 16266
  17. 175
  18. 187
  19. 19122
  20. 2096
  21. 2196
  22. 2258
  23. 23203
  24. 247
  25. 253
  26. 26105
  27. 2733
  28. 2874
  29. 2935
  30. 3069
All Critical High Medium Low Exploited only Public exploit

203 results · Feed

  • Medium 4.3
    CVE-2022-38134

    WordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Authenticated Broken Access Control vulnerability

    Authenticated (subscriber+) Broken Access Control vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress.

    CusRev Customer Reviews for WooCommerce (WordPress plugin) Web / CMS
  • High —
    GHSA-28q9-9c3g-v3f9

    lakeFS vulnerable to authenticated users deleting files they are not authorized to delete

    ### Impact Authenticated users can send a request to delete-objects through the s3 gateway and delete files they are not authorized to delete. ### Patches lakeFS v0.82.0 and later ### Workarounds Drop specific request to the lakeFS listen port. Any request wi…

    github.com/treeverse/lakefs Go
  • Medium 4.3
    CVE-2022-38470

    WordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress.

    CusRev Customer Reviews for WooCommerce (WordPress plugin) Web / CMS
  • Critical 9.8
    CVE-2022-2070 Public exploit

    Grandstream GSD3710 Stack-based Buffer Overflow

    In Grandstream GSD3710 in its 1.0.11.13 version, it's possible to overflow the stack since it doesn't check the param length before using the sscanf instruction. Because of that, an attacker could create a socket and connect with a remote IP:port by opening a…

    Grandstream Grandstream GSD3710
  • Critical 9.8
    CVE-2022-2025 Public exploit

    Grandstream GSD3710 Stack-based Buffer Overflow

    an attacker with knowledge of user/pass of Grandstream GSD3710 in its 1.0.11.13 version, could overflow the stack since it doesn't check the param length before use the strcopy instruction. The explotation of this vulnerability may lead an attacker to execute…

    Grandstream Grandstream GSD3710
  • Medium 5.3
    CVE-2022-40194

    WordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Sensitive Information Disclosure vulnerability

    Unauthenticated Sensitive Information Disclosure vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress

    CusRev Customer Reviews for WooCommerce (WordPress plugin) Web / CMS
  • Medium 6.3
    CVE-2021-45035

    Velneo vClient Improper authentication

    Velneo vClient on its 28.1.3 version, does not correctly check the certificate of authenticity by default. This could allow an attacker that has access to the network to perform a MITM attack in order to obtain the user´s credentials.

    Velneo Velneo vClient
  • Medium 6.2
    CVE-2022-38061

    WordPress Export Post Info plugin <= 1.2.0 - Authenticated CSV Injection vulnerability

    Authenticated (author+) CSV Injection vulnerability in Export Post Info plugin <= 1.2.0 at WordPress.

    apasionados Export Post Info (WordPress plugin) Web / CMS
  • Medium 4.8
    CVE-2022-40672

    WordPress CPO Shortcodes plugin <= 1.5.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

    Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CPO Shortcodes plugin <= 1.5.0 at WordPress.

    WP Chill CPO Shortcodes (WordPress plugin) Web / CMS
  • High 7.2
    CVE-2022-40861

    Tenda AC18 router V15.03.05.19 contains a stack overflow vulnerability in the formSetQosBand->FUN_0007db78 function wit…

  • Medium 4.8
    CVE-2022-40195

    WordPress PCA Predict plugin <= 1.0.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

    Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PCA Predict plugin <= 1.0.3 at WordPress.

    PCA Predict PCA Predict (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-38085

    WordPress Read more By Adam plugin <= 1.1.8 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Read more By Adam plugin <= 1.1.8 at WordPress.

    Adam Skaat Read more By Adam (WordPress plugin) Web / CMS
  • Medium 4.8
    CVE-2022-37342

    WordPress Add Shortcodes Actions And Filters plugin <= 2.0.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

    Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability Add Shortcodes Actions And Filters plugin <= 2.0.9 at WordPress.

    Michael Simpson Add Shortcodes Actions And Filters (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-36388

    WordPress YDS Support Ticket System plugin <= 1.0 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in YDS Support Ticket System plugin <= 1.0 at WordPress.

    Ydesignservices YDS Support Ticket System (WordPress plugin) Web / CMS
  • Medium 6.1
    CVE-2022-40193

    WordPress Awesome Filterable Portfolio plugin <= 1.9.7 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

    Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in Awesome Filterable Portfolio plugin <= 1.9.7 at WordPress.

    BriniA Awesome Filterable Portfolio (WordPress plugin) Web / CMS
  • Critical 9.8
    CVE-2022-40855 EPSS 14%

    Tenda W20E router V15.11.0.6 contains a stack overflow in the function formSetPortMapping with post request 'goform/set…

  • Medium 6.5
    CVE-2022-35238

    WordPress Awesome Filterable Portfolio plugin <= 1.9.7 - Unauthenticated Plugin Settings Change vulnerability

    Unauthenticated Plugin Settings Change vulnerability in Awesome Filterable Portfolio plugin <= 1.9.7 at WordPress.

    BriniA Awesome Filterable Portfolio (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-38460

    WordPress NOTICE BOARD plugin <= 1.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

    Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in NOTICE BOARD plugin <= 1.1 at WordPress.

    Jitendriya Tripathy NOTICE BOARD (WordPress plugin) Web / CMS
  • Critical 9.8
    CVE-2022-40866

    Tenda W20E router V15.11.0.6 (US_W20EV4.0br_V15.11.0.6(1068_1546_841)_CN_TDC) contains a stack overflow vulnerability i…

  • Critical 9.8
    CVE-2022-40867

    Tenda W20E router V15.11.0.6 (US_W20EV4.0br_V15.11.0.6(1068_1546_841)_CN_TDC) contains a stack overflow vulnerability i…

  • Low 3.4
    CVE-2022-37328

    WordPress History Timeline plugin <= 1.0.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

    Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in Themes Awesome History Timeline plugin <= 1.0.5 at WordPress.

    Themes Awesome History Timeline (WordPress plugin) Web / CMS
  • Critical 9.8
    CVE-2022-40868

    Tenda W20E router V15.11.0.6 (US_W20EV4.0br_V15.11.0.6(1068_1546_841)_CN_TDC) contains a stack overflow vulnerability i…

  • Medium 5.4
    CVE-2022-36791

    WordPress Torro Forms plugin <= 1.0.16 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

    Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Awesome UG Torro Forms plugin <= 1.0.16 at WordPress.

    Awesome UG Torro Forms (WordPress plugin) Web / CMS
  • Medium 4.3
    CVE-2022-40310

    WordPress Rate my Post – WP Rating System plugin <= 3.3.4 - Race Condition vulnerability

    Authenticated (subscriber+) Race Condition vulnerability in Rate my Post – WP Rating System plugin <= 3.3.4 at WordPress allows attackers to increase/decrease votes.

    Blaz K. Rate my Post – WP Rating System (WordPress plugin) Web / CMS
  • Medium 4.3
    CVE-2022-40671

    WordPress Rate my Post – WP Rating System plugin <= 3.3.4 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Rate my Post – WP Rating System plugin <= 3.3.4 at WordPress.

    Blaz K. Rate my Post – WP Rating System (WordPress plugin) Web / CMS
  • Critical 9.8
    CVE-2022-40854

    Tenda AC18 router contained a stack overflow vulnerability in /goform/fast_setting_wifi_set

  • Low 3.1
    CVE-2022-3257

    Server-side Denial of Service while processing a specifically crafted GIF file

    Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows authenticated users to cause resource exhaustion while processing the file, resulting in server-side Den…

    Mattermost Mattermost github.com/mattermost/mattermost-server/v6 Go
  • Critical 9.1
    CVE-2022-23144

    There is a broken access control vulnerability in ZTE ZXvSTB product. Due to improper permission control, attackers cou…

  • Critical 9.8
    CVE-2022-40851

    Tenda AC15 V15.03.05.19 contained a stack overflow via the function fromAddressNat.

  • High 7.8
    CVE-2022-27492

    An integer underflow in WhatsApp could have caused remote code execution when receiving a crafted video file.

    Meta WhatsApp Business for iOS WhatsApp for Android WhatsApp for iOS Android iOS
  • Critical 9.8
    CVE-2022-40853

    Tenda AC15 router V15.03.05.19 contains a stack overflow via the list parameter at /goform/fast_setting_wifi_set

  • Medium 4.4
    CVE-2022-3144

    Wordfence Security – Firewall & Malware Scan <= 7.6.0 - Authenticated (Admin+) Stored Cross-Site Scripting

    The Wordfence Security – Firewall & Malware Scan plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 7.6.0 via a setting on the options page due to insufficient escaping on the stored value. This makes it possible…

    mmaunder Wordfence Security – Firewall, Malware Scan, and Login Security Web / CMS
  • Medium 6.4
    CVE-2022-2937

    Image Hover Effects Ultimate <= 9.7.3 - Authenticated Stored Cross-Site Scripting via Title & Description

    The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title & Description values that can be added to an Image Hover in versions up to, and including, 9.7.3 due to insufficient input sanitization and output…

    biplob018 Image Hover Effects Ultimate Web / CMS
  • Low 3.4
    CVE-2022-38703

    WordPress Button Plugin MaxButtons plugin <= 9.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

    Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Max Foundry Button Plugin MaxButtons plugin <= 9.2 at WordPress

    Max Foundry WordPress Button Plugin MaxButtons (WordPress plugin) Web / CMS
  • Medium 4.1
    CVE-2022-40213

    WordPress GS Testimonial Slider plugin <= 1.9.6 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities

    Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in GS Testimonial Slider plugin <= 1.9.6 at WordPress.

    GS Plugins GS Testimonial Slider (WordPress plugin) Web / CMS
  • Critical 9.8
    CVE-2022-40860

    Tenda AC15 router V15.03.05.19 contains a stack overflow vulnerability in the function formSetQosBand->FUN_0007dd20 wit…

  • High 7.2
    CVE-2022-40093

    Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parame…

  • High 7.2
    CVE-2022-40092

    Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parame…

  • High 7.2
    CVE-2022-40091

    Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parame…

  • Critical 9.8
    CVE-2022-40862

    Tenda AC15 and AC18 router V15.03.05.19 contains stack overflow vulnerability in the function fromNatStaticSetting with…