Skip to content
OpenAdvisories

Archive

September 2022

Vulnerabilities first published in this month (UTC), newest first.

← August 2022 2022 / September October 2022 →
  1. 170
  2. 277
  3. 31
  4. 42
  5. 539
  6. 6157
  7. 764
  8. 858
  9. 9130
  10. 10 
  11. 119
  12. 1249
  13. 13201
  14. 1449
  15. 1589
  16. 16266
  17. 175
  18. 187
  19. 19122
  20. 2096
  21. 2196
  22. 2258
  23. 23203
  24. 247
  25. 253
  26. 26105
  27. 2733
  28. 2874
  29. 2935
  30. 3069
All Critical High Medium Low Exploited only Public exploit

17 results · Clear filters · Feed

  • High 7.8
    CVE-2022-20818 Public exploit

    Cisco SD-WAN Software Privilege Escalation Vulnerabilities

    Multiple vulnerabilities in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. These vulnerabilities are due to improper access controls on commands within the application CLI. An attacker could exploit …

    Cisco Cisco SD-WAN Solution Network devices
  • High 7.8
    CVE-2022-40126 Public exploit

    A misconfiguration in the Service Mode profile directory of Clash for Windows v0.19.9 allows attackers to escalate priv…

  • High 7.5
    CVE-2019-5797 Public exploit

    Double free in DOMStorage in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap …

    Google Chrome chromium chromium-browser Browsers Debian Ubuntu
  • High 8.8
    CVE-2022-41828 Public exploit

    com.amazon.redshift:redshift-jdbc42 vulnerable to remote command execution

    In Amazon AWS Redshift JDBC Driver (aka amazon-redshift-jdbc-driver or redshift-jdbc42) before 2.1.0.8, the Object Factory does not check the class type when instantiating an object from a class name.

    com.amazon.redshift:redshift-jdbc42 Maven
  • High 8.8
    CVE-2022-37209 Public exploit

    JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filter…

  • High 7.5
    CVE-2022-41343 Public exploit

    Dompdf allows remote file inclusion because URI validation failure does not halt font registration

    registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-face rule.

    dompdf/dompdf Packagist
  • High 8.8
    CVE-2022-22629 Public exploit

    A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.3, Safari…

    Apple watchOS tvOS Safari Browsers Debian Ubuntu Alpine
  • High 7.5
    CVE-2022-40146 Public exploit

    Jar url should be blocked by DefaultScriptSecurity

    Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14.

    Apache Software Foundation Apache XML Graphics batik batik Debian Ubuntu Maven
  • High 8.8
    CVE-2022-37205 Public exploit

    JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filter…

  • High 8.8
    CVE-2022-38577 Public exploit

    ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page. This vulnerability …

  • High 8.8
    CVE-2022-2333 Public exploit

    Honeywell SoftMaster Uncontrolled Search Path Element

    If an attacker manages to trick a valid user into loading a malicious DLL, the attacker may be able to achieve code execution in Honeywell SoftMaster version 4.51 application’s context and permissions.

    Honeywell SoftMaster ICS / OT
  • High 7.8
    CVE-2022-37969 Exploited · Ransomware Public exploit EPSS 28%

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV Sep 14, 2022
  • High 8.8
    CVE-2022-35841 Public exploit

    Windows Enterprise App Management Service Remote Code Execution Vulnerability

    Windows Enterprise App Management Service Remote Code Execution Vulnerability

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  • High 8.1
    CVE-2022-33679 Public exploit EPSS 12%

    Windows Kerberos Elevation of Privilege Vulnerability

    Windows Kerberos Elevation of Privilege Vulnerability

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows Server 2022 Windows
  • High 7.3
    CVE-2022-25765 Public exploit EPSS 43%

    Command Injection

    The package pdfkit from 0.0.0 are vulnerable to Command Injection where the URL is not properly sanitized.

    pdfkit RubyGems
  • High 7.5
    CVE-2022-35513 Public exploit

    Blink1Control2 uses weak password encryption

    The Blink1Control2 application <= 2.2.7 uses weak password encryption and an insecure method of storage.

    Blink1Control2 npm
  • High 7.8
    CVE-2022-36271 Public exploit

    Outbyte PC Repair Installation File 1.7.112.7856 is vulnerable to Dll Hijacking. iertutil.dll is missing so an attacker…