Skip to content
OpenAdvisories

Archive

September 2022

Vulnerabilities first published in this month (UTC), newest first.

← August 2022 2022 / September October 2022 →
  1. 170
  2. 277
  3. 31
  4. 42
  5. 539
  6. 6157
  7. 764
  8. 858
  9. 9130
  10. 10 
  11. 119
  12. 1249
  13. 13201
  14. 1449
  15. 1589
  16. 16266
  17. 175
  18. 187
  19. 19122
  20. 2096
  21. 2196
  22. 2258
  23. 23203
  24. 247
  25. 253
  26. 26105
  27. 2733
  28. 2874
  29. 2935
  30. 3069
All Critical High Medium Low Exploited only Public exploit

692 results · Clear filters · Feed

  • Medium 4.3
    CVE-2022-35246

    A NoSQL-Injection information disclosure vulnerability vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 in …

  • Medium 4.3
    CVE-2022-28886

    Denial-of-Service (DoS) Vulnerability

    A Denial-of-Service vulnerability was discovered in the F-Secure and WithSecure products where aerdl.so/aerdl.dll may go into an infinite loop when unpacking PE files. It is possible that this can crash the scanning engine

    F-Secure and WithSecure All F-Secure and WithSecure Endpoint Protection products for Windows running 32 bit operating system. F-Secure Linux Security 32 F-Secure Internet Gatekeeper Linux Windows
  • Medium 5.4
    CVE-2022-38439

    AEM Reflected XSS Arbitrary code execution

    Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be execute…

    Adobe Experience Manager
  • Medium 5.4
    CVE-2022-38438

    AEM Reflected XSS Arbitrary code execution

    Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be execute…

    Adobe Experience Manager
  • Medium 6.5
    CVE-2022-40630

    Improper Session Management Vulnerability in Tacitine Firewall

    This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 (inclusive), due to improper session management in the Tacitine Firewall web-based management interface. An unauthenticate…

    Tacitine Firewall
  • Medium 6.4
    CVE-2022-35721

    IBM Jazz for Service Management 1.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to …

    IBM Jazz for Service Management
  • Medium 5.4
    CVE-2022-40748

    IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed …

    IBM InfoSphere Information Server
  • Medium 6.5
    CVE-2022-22423

    IBM Common Cryptographic Architecture (CCA 5.x MTM for 4767 and CCA 7.x MTM for 4769) could allow a local user to cause…

    IBM CCA for MTM 4767
  • Medium 6.1
    CVE-2022-40359 Scanner template

    Cross site scripting (XSS) vulnerability in kfm through 1.4.7 via crafted GET request to /kfm/index.php.

  • Medium 5.4
    CVE-2022-40358

    An issue was discovered in AjaXplorer 4.2.3, allows attackers to cause cross site scripting vulnerabilities via a craft…

  • Medium 5.5
    CVE-2022-35099

    SWFTools commit 772e55a2 was discovered to contain a stack overflow via ImageStream::getPixel(unsigned char*) at /xpdf/…

    swftools Ubuntu
  • Medium 5.5
    CVE-2022-35098

    SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via GfxICCBasedColorSpace::getDefaultColor(Gf…

    swftools Ubuntu
  • Medium 5.5
    CVE-2022-35097

    SWFTools commit 772e55a2 was discovered to contain a segmentation violation via FoFiTrueType::writeTTF at /xpdf/FoFiTru…

    swftools Ubuntu
  • Medium 5.5
    CVE-2022-35096

    SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via draw_stroke at /gfxpoly/stroke.c.

    swftools Ubuntu
  • Medium 5.5
    CVE-2022-35095

    SWFTools commit 772e55a2 was discovered to contain a segmentation violation via InfoOutputDev::type3D1 at /pdf/InfoOutp…

    swftools Ubuntu
  • Medium 5.5
    CVE-2022-35094

    SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via DCTStream::readHuffSym(DCTHuffTable*) at …

    swftools Ubuntu
  • Medium 5.5
    CVE-2022-35093

    SWFTools commit 772e55a2 was discovered to contain a global buffer overflow via DCTStream::transformDataUnit at /xpdf/S…

    swftools Ubuntu
  • Medium 5.5
    CVE-2022-35092

    SWFTools commit 772e55a2 was discovered to contain a segmentation violation via convert_gfxline at /gfxpoly/convert.c.

    swftools Ubuntu
  • Medium 5.5
    CVE-2022-35091

    SWFTools commit 772e55a2 was discovered to contain a floating point exception (FPE) via DCTStream::readMCURow() at /xpd…

    swftools Ubuntu
  • Medium 6.6
    CVE-2021-3782

    An internal reference count is held on the buffer pool, incremented every time a new buffer is created from the pool. T…

    wayland wayland wayland Debian Ubuntu Azure Linux
  • Medium 6.1
    CVE-2022-36417

    WordPress 3D Tag Cloud plugin <= 3.8 - Multiple Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability

    Multiple Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in 3D Tag Cloud plugin <= 3.8 at WordPress.

    Vinoj Cardoza 3D Tag Cloud (WordPress plugin) Web / CMS
  • Medium 4.3
    CVE-2022-38134

    WordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Authenticated Broken Access Control vulnerability

    Authenticated (subscriber+) Broken Access Control vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress.

    CusRev Customer Reviews for WooCommerce (WordPress plugin) Web / CMS
  • Medium 4.3
    CVE-2022-38470

    WordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress.

    CusRev Customer Reviews for WooCommerce (WordPress plugin) Web / CMS
  • Medium 5.3
    CVE-2022-40194

    WordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Sensitive Information Disclosure vulnerability

    Unauthenticated Sensitive Information Disclosure vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress

    CusRev Customer Reviews for WooCommerce (WordPress plugin) Web / CMS
  • Medium 6.3
    CVE-2021-45035

    Velneo vClient Improper authentication

    Velneo vClient on its 28.1.3 version, does not correctly check the certificate of authenticity by default. This could allow an attacker that has access to the network to perform a MITM attack in order to obtain the user´s credentials.

    Velneo Velneo vClient
  • Medium 6.2
    CVE-2022-38061

    WordPress Export Post Info plugin <= 1.2.0 - Authenticated CSV Injection vulnerability

    Authenticated (author+) CSV Injection vulnerability in Export Post Info plugin <= 1.2.0 at WordPress.

    apasionados Export Post Info (WordPress plugin) Web / CMS
  • Medium 4.8
    CVE-2022-40672

    WordPress CPO Shortcodes plugin <= 1.5.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

    Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CPO Shortcodes plugin <= 1.5.0 at WordPress.

    WP Chill CPO Shortcodes (WordPress plugin) Web / CMS
  • Medium 4.8
    CVE-2022-40195

    WordPress PCA Predict plugin <= 1.0.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

    Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PCA Predict plugin <= 1.0.3 at WordPress.

    PCA Predict PCA Predict (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-38085

    WordPress Read more By Adam plugin <= 1.1.8 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Read more By Adam plugin <= 1.1.8 at WordPress.

    Adam Skaat Read more By Adam (WordPress plugin) Web / CMS
  • Medium 4.8
    CVE-2022-37342

    WordPress Add Shortcodes Actions And Filters plugin <= 2.0.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

    Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability Add Shortcodes Actions And Filters plugin <= 2.0.9 at WordPress.

    Michael Simpson Add Shortcodes Actions And Filters (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-36388

    WordPress YDS Support Ticket System plugin <= 1.0 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in YDS Support Ticket System plugin <= 1.0 at WordPress.

    Ydesignservices YDS Support Ticket System (WordPress plugin) Web / CMS
  • Medium 6.1
    CVE-2022-40193

    WordPress Awesome Filterable Portfolio plugin <= 1.9.7 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

    Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in Awesome Filterable Portfolio plugin <= 1.9.7 at WordPress.

    BriniA Awesome Filterable Portfolio (WordPress plugin) Web / CMS
  • Medium 6.5
    CVE-2022-35238

    WordPress Awesome Filterable Portfolio plugin <= 1.9.7 - Unauthenticated Plugin Settings Change vulnerability

    Unauthenticated Plugin Settings Change vulnerability in Awesome Filterable Portfolio plugin <= 1.9.7 at WordPress.

    BriniA Awesome Filterable Portfolio (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-38460

    WordPress NOTICE BOARD plugin <= 1.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

    Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in NOTICE BOARD plugin <= 1.1 at WordPress.

    Jitendriya Tripathy NOTICE BOARD (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-36791

    WordPress Torro Forms plugin <= 1.0.16 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

    Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Awesome UG Torro Forms plugin <= 1.0.16 at WordPress.

    Awesome UG Torro Forms (WordPress plugin) Web / CMS
  • Medium 4.3
    CVE-2022-40310

    WordPress Rate my Post – WP Rating System plugin <= 3.3.4 - Race Condition vulnerability

    Authenticated (subscriber+) Race Condition vulnerability in Rate my Post – WP Rating System plugin <= 3.3.4 at WordPress allows attackers to increase/decrease votes.

    Blaz K. Rate my Post – WP Rating System (WordPress plugin) Web / CMS
  • Medium 4.3
    CVE-2022-40671

    WordPress Rate my Post – WP Rating System plugin <= 3.3.4 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Rate my Post – WP Rating System plugin <= 3.3.4 at WordPress.

    Blaz K. Rate my Post – WP Rating System (WordPress plugin) Web / CMS
  • Medium 4.4
    CVE-2022-3144

    Wordfence Security – Firewall & Malware Scan <= 7.6.0 - Authenticated (Admin+) Stored Cross-Site Scripting

    The Wordfence Security – Firewall & Malware Scan plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 7.6.0 via a setting on the options page due to insufficient escaping on the stored value. This makes it possible…

    mmaunder Wordfence Security – Firewall, Malware Scan, and Login Security Web / CMS
  • Medium 6.4
    CVE-2022-2937

    Image Hover Effects Ultimate <= 9.7.3 - Authenticated Stored Cross-Site Scripting via Title & Description

    The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title & Description values that can be added to an Image Hover in versions up to, and including, 9.7.3 due to insufficient input sanitization and output…

    biplob018 Image Hover Effects Ultimate Web / CMS
  • Medium 4.1
    CVE-2022-40213

    WordPress GS Testimonial Slider plugin <= 1.9.6 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities

    Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in GS Testimonial Slider plugin <= 1.9.6 at WordPress.

    GS Plugins GS Testimonial Slider (WordPress plugin) Web / CMS