Skip to content
OpenAdvisories

Archive

September 2022

Vulnerabilities first published in this month (UTC), newest first.

← August 2022 2022 / September October 2022 →
  1. 170
  2. 277
  3. 31
  4. 42
  5. 539
  6. 6157
  7. 764
  8. 858
  9. 9130
  10. 10 
  11. 119
  12. 1249
  13. 13201
  14. 1449
  15. 1589
  16. 16266
  17. 175
  18. 187
  19. 19122
  20. 2096
  21. 2196
  22. 2258
  23. 23203
  24. 247
  25. 253
  26. 26105
  27. 2733
  28. 2874
  29. 2935
  30. 3069
All Critical High Medium Low Exploited only Public exploit

15 results · Clear filters · Feed

  • Critical 9.8
    CVE-2022-41352 Exploited · Ransomware Public exploit Scanner template EPSS 95%

    An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through am…

    KEV Oct 20, 2022
  • Critical 9.8
    CVE-2022-2070 Public exploit

    Grandstream GSD3710 Stack-based Buffer Overflow

    In Grandstream GSD3710 in its 1.0.11.13 version, it's possible to overflow the stack since it doesn't check the param length before using the sscanf instruction. Because of that, an attacker could create a socket and connect with a remote IP:port by opening a…

    Grandstream Grandstream GSD3710
  • Critical 9.8
    CVE-2022-2025 Public exploit

    Grandstream GSD3710 Stack-based Buffer Overflow

    an attacker with knowledge of user/pass of Grandstream GSD3710 in its 1.0.11.13 version, could overflow the stack since it doesn't check the param length before use the strcopy instruction. The explotation of this vulnerability may lead an attacker to execute…

    Grandstream Grandstream GSD3710
  • Critical 9.1
    CVE-2022-39227 Public exploit

    Python-jwt subject to Authentication Bypass by Spoofing

    python-jwt is a module for generating and verifying JSON Web Tokens. Versions prior to 3.3.4 are subject to Authentication Bypass by Spoofing, resulting in identity spoofing, session hijacking or authentication bypass. An attacker who obtains a JWT can arbitr…

    davedoesdev python-jwt python-jwt python-jwt Azure Linux PyPI
  • Critical 9.8
    CVE-2022-36944 Public exploit EPSS 11%

    Scala subject to file deletion, code execution due to Java deserialization chain with LazyList object deserialization

    Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase conte…

    org.scala-lang:scala-library Maven
  • Critical 9.8
    CVE-2022-36934 Public exploit

    An integer overflow in WhatsApp could result in remote code execution in an established video call.

    Meta WhatsApp for iOS WhatsApp Business for Android WhatsApp Business for iOS Android iOS
  • Critical 9.8
    CVE-2022-41220 Public exploit

    md2roff 1.9 has a stack-based buffer overflow via a Markdown file, a different vulnerability than CVE-2022-34913. NOTE:…

  • Critical 9.8
    CVE-2022-37204 Public exploit

    Final CMS 5.1.0 is vulnerable to SQL Injection.

  • Critical 9.8
    CVE-2022-35914 Exploited Public exploit Scanner template EPSS 100%

    /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.

    KEV Mar 7, 2023
  • Critical 9.8
    CVE-2021-42949 Public exploit

    The component controlla_login function in HotelDruid Hotel Management Software v3.0.3 generates a predictable session t…

    hoteldruid hoteldruid Debian Ubuntu
  • Critical 9.8
    CVE-2022-34718 Public exploit EPSS 57%

    Windows TCP/IP Remote Code Execution Vulnerability

    Windows TCP/IP Remote Code Execution Vulnerability

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  • Critical 9.9
    CVE-2021-36782 Public exploit

    Rancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io object

    A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners, Project Members and User Base to use the Kubernetes API to retrieve plaintext version of sensitive data. This issu…

    SUSE Rancher github.com/rancher/rancher Go
  • Critical 9.8
    CVE-2022-36663 Public exploit

    Gluu Oxauth before v4.4.1 vulnerable to Server-Side Request Forgery attacks via a crafted request_uri parameter

    Gluu Oxauth before v4.4.1 allows attackers to execute blind SSRF (Server-Side Request Forgery) attacks via a crafted request_uri parameter.

    org.gluu:oxauth-common Maven
  • Critical 10.0
    CVE-2022-36067 Public exploit EPSS 48%

    vm2 vulnerable to Sandbox Escape before v3.9.11

    vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerabil…

    patriksimek vm2 vm2 npm
  • Critical 9.8
    CVE-2022-31814 Public exploit Scanner template EPSS 92%

    pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metacha…