Skip to content
OpenAdvisories

Archive

September 2022

Vulnerabilities first published in this month (UTC), newest first.

← August 2022 2022 / September October 2022 →
  1. 170
  2. 277
  3. 31
  4. 42
  5. 539
  6. 6157
  7. 764
  8. 858
  9. 9130
  10. 10 
  11. 119
  12. 1249
  13. 13201
  14. 1449
  15. 1589
  16. 16266
  17. 175
  18. 187
  19. 19122
  20. 2096
  21. 2196
  22. 2258
  23. 23203
  24. 247
  25. 253
  26. 26105
  27. 2733
  28. 2874
  29. 2935
  30. 3069
All Critical High Medium Low Exploited only Public exploit

16 results · Clear filters · Feed

  • Medium 6.1
    CVE-2022-35155 Public exploit

    Bus Pass Management System v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the …

  • Medium 5.5
    CVE-2022-40363 Public exploit

    A buffer overflow in the component nfc_device_load_mifare_ul_data of Flipper Devices Inc., Flipper Zero before v0.65.2 …

  • Medium 6.5
    CVE-2022-31629 Public exploit EPSS 50%

    $_COOKIE names string replacement (. -> _): cookie integrity vulnerabilities

    In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications.

    PHP Group PHP php5 php7.0 Debian Ubuntu Alpine
  • Medium 6.1
    CVE-2022-38553 Public exploit

    Academy Learning Management System before v5.9.1 was discovered to contain a reflected cross-site scripting (XSS) vulne…

  • Medium 6.7
    CVE-2022-32832 Public exploit

    The issue was addressed with improved memory handling. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 1…

    Apple macOS watchOS tvOS macOS
  • Medium 6.1
    CVE-2022-39197 Exploited Public exploit EPSS 44%

    An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote at…

    KEV Mar 30, 2023
  • Medium 4.7
    CVE-2022-29800 Public exploit

    A time-of-check-time-of-use (TOCTOU) race condition vulnerability was found in networkd-dispatcher. This flaw exists be…

    networkd-dispatcher networkd-dispatcher Debian Ubuntu
  • Medium 5.5
    CVE-2022-29799 Public exploit EPSS 12%

    A vulnerability was found in networkd-dispatcher. This flaw exists because no functions are sanitized by the Operationa…

    networkd-dispatcher networkd-dispatcher Debian Ubuntu
  • Medium 5.5
    CVE-2022-41218 Public exploit

    In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused by refcount ra…

    linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  • Medium 5.5
    CVE-2022-32883 Public exploit

    A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS…

    Apple macOS iOS macOS iOS
  • Medium 6.5
    CVE-2020-36603 Public exploit

    The HoYoVerse (formerly miHoYo) Genshin Impact mhyprot2.sys 1.0.0.0 anti-cheat driver does not adequately restrict unpr…

  • Medium 6.4
    CVE-2022-40635 Public exploit

    Improper Control of Dynamically-Managed Code Resources in Crafter Studio

    Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass.

    Crafter Software Crafter CMS org.craftercms:craftercms Maven
  • Medium 6.4
    CVE-2022-40634 Public exploit

    Improper Control of Dynamically-Managed Code Resources in Crafter Studio

    Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker SSTI.

    Crafter Software Crafter CMS org.craftercms:crafter-studio Maven
  • Medium 6.5
    CVE-2022-36779 Public exploit

    PROSCEND - PROSCEND / ADVICE .Ltd - G/5G Industrial Cellular Router (with GPS)4 Unauthenticated OS Command Injection

    PROSCEND - PROSCEND / ADVICE .Ltd - G/5G Industrial Cellular Router (with GPS)4 Unauthenticated OS Command Injection Proscend M330-w / M33-W5 / M350-5G / M350-W5G / M350-6 / M350-W6 / M301-G / M301-GW ADVICE ICR 111WG / https://www.proscend.com/en/category/in…

    PROSCEND ADVICE ICR 111WG PROSCEND M330-w / M330-W5 PROSCEND M301-G / M301-GW
  • Medium 5.3
    CVE-2022-26049 Public exploit

    Arbitrary File Write via Archive Extraction (Zip Slip)

    This affects the package com.diffplug.gradle:goomph before 3.37.2. It allows a malicious zip file to potentially break out of the expected destination directory, writing contents into arbitrary locations on the file system. Overwriting certain files/directori…

    com.diffplug.gradle:goomph Maven
  • Medium 5.5
    CVE-2022-2941 Public exploit

    WP-UserOnline <= 2.88.0 - Authenticated (Admin+) Stored Cross-Site Scripting

    The WP-UserOnline plugin for WordPress has multiple Stored Cross-Site Scripting vulnerabilities in versions up to, and including 2.88.0. This is due to the fact that all fields in the "Naming Conventions" section do not properly sanitize user input, nor escap…

    gamerz WP-UserOnline Web / CMS