CVE-2022-3301: Improper Cleanup on Thrown Exception in ikus060/rdiffweb
Improper Cleanup on Thrown Exception in GitHub repository ikus060/rdiffweb prior to 2.4.8.
Published Sep 26, 2022 · Updated May 21, 2025
CVE archive
September 2022
Browse CVE records published in September 2022, with severity, affected products, CWE, KEV, and source-backed vulnerability context.
Showing 50 of 2323 matching CVEs · Page 18 of 47.
CVE-2022-40925: Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "s...
Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "save_event" file of the "Events" module in the background management system.
Published Sep 26, 2022 · Updated May 21, 2025
CVE-2022-40928: Online Leave Management System v1.0 is vulnerable to SQL Injection via /leave_system/classes/Master.php?f=d...
Online Leave Management System v1.0 is vulnerable to SQL Injection via /leave_system/classes/Master.php?f=delete_application.
Published Sep 26, 2022 · Updated May 21, 2025
CVE-2022-2926: Download Manager < 3.2.55 - Admin+ Arbitrary File/Folder Access via Path Traversal
The Download Manager WordPress plugin before 3.2.55 does not validate one of its settings, which could allow high privilege users such as admin to list and read arbitrary files and folders outside of the blog directory
Published Sep 26, 2022 · Updated May 21, 2025
CVE-2022-36158: Contec FXA3200 version 1.13.00 and under suffers from Insecure Permissions in the Wireless LAN Manager inte...
Contec FXA3200 version 1.13.00 and under suffers from Insecure Permissions in the Wireless LAN Manager interface which allows malicious actors to execute Linux commands with root privilege via a hidden web page (/usr/www/ja/mnt_cmd.cgi).
Published Sep 26, 2022 · Updated May 21, 2025
CVE-2022-3048: Inappropriate implementation in Chrome OS lockscreen in Google Chrome on Chrome OS prior to 105.0.5195.52 a...
Inappropriate implementation in Chrome OS lockscreen in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a local attacker to bypass lockscreen navigation restrictions via physical access to the device.
Published Sep 26, 2022 · Updated May 21, 2025
CVE-2022-3049: Use after free in SplitScreen in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote...
Use after free in SplitScreen in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page.
Published Sep 26, 2022 · Updated May 21, 2025
CVE-2022-3050: Heap buffer overflow in WebUI in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacke...
Heap buffer overflow in WebUI in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interactions.
Published Sep 26, 2022 · Updated May 21, 2025
CVE-2022-3051: Heap buffer overflow in Exosphere in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a re...
Heap buffer overflow in Exosphere in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interactions.
Published Sep 26, 2022 · Updated May 21, 2025
CVE-2022-3056: Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 105.0.5195.52 allowed...
Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to bypass content security policy via a crafted HTML page.
Published Sep 26, 2022 · Updated May 21, 2025
CVE-2022-3298: Allocation of Resources Without Limits or Throttling in ikus060/rdiffweb
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.4.8.
Published Sep 26, 2022 · Updated May 21, 2025
CVE-2022-34326: In ambiot amb1_sdk (aka SDK for Ameba1) before 2022-06-20 on Realtek RTL8195AM devices before 284241d70308f...
In ambiot amb1_sdk (aka SDK for Ameba1) before 2022-06-20 on Realtek RTL8195AM devices before 284241d70308ff2519e40afd7b284ba892c730a3, the timer task and RX task would be locked when there are frequent and continuous Wi-Fi connection (with four-way handshake) failures in Soft AP mode.
Published Sep 27, 2022 · Updated May 21, 2025
CVE-2022-3303: A race condition flaw was found in the Linux kernel sound subsystem due to improper locking.
A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or member of the audio group) could use this flaw to crash the system, resulting in a denial of service condition
Published Sep 27, 2022 · Updated May 21, 2025
CVE-2022-41570: An issue was discovered in EyesOfNetwork (EON) through 5.3.11.
An issue was discovered in EyesOfNetwork (EON) through 5.3.11. Unauthenticated SQL injection can occur.
Published Sep 27, 2022 · Updated May 21, 2025
CVE-2022-39835: An issue was discovered in Gajim through 1.4.7.
An issue was discovered in Gajim through 1.4.7. The vulnerability allows attackers, via crafted XML stanzas, to correct messages that were not sent by them. The attacker needs to be part of the group chat or single chat. The fixed version is 1.5.0.
Published Sep 27, 2022 · Updated May 21, 2025
CVE-2022-3057: Inappropriate implementation in iframe Sandbox in Google Chrome prior to 105.0.5195.52 allowed a remote att...
Inappropriate implementation in iframe Sandbox in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Published Sep 26, 2022 · Updated May 21, 2025
CVE-2022-3058: Use after free in Sign-In Flow in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who convin...
Use after free in Sign-In Flow in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interaction.
Published Sep 26, 2022 · Updated May 21, 2025
CVE-2022-3071: Use after free in Tab Strip in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote a...
Use after free in Tab Strip in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interaction.
Published Sep 26, 2022 · Updated May 21, 2025
CVE-2022-40043: Centreon v20.10.18 was discovered to contain a SQL injection vulnerability via the esc_name (Escalation Nam...
Centreon v20.10.18 was discovered to contain a SQL injection vulnerability via the esc_name (Escalation Name) parameter at Configuration/Notifications/Escalations.
Published Sep 26, 2022 · Updated May 21, 2025
CVE-2022-40044: Centreon v20.10.18 was discovered to contain a cross-site scripting (XSS) vulnerability via the esc_name (E...
Centreon v20.10.18 was discovered to contain a cross-site scripting (XSS) vulnerability via the esc_name (Escalation Name) parameter at Configuration/Notifications/Escalations. This vulnerability allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.
Published Sep 26, 2022 · Updated May 21, 2025
CVE-2022-22058: Memory corruption due to use after free issue in kernel while processing ION handles in Snapdragon Auto, Sn...
Memory corruption due to use after free issue in kernel while processing ION handles in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Published Sep 26, 2022 · Updated May 21, 2025
CVE-2022-3272: Improper Handling of Length Parameter Inconsistency in ikus060/rdiffweb
Improper Handling of Length Parameter Inconsistency in GitHub repository ikus060/rdiffweb prior to 2.4.8.
Published Sep 26, 2022 · Updated May 21, 2025
CVE-2022-30003: Sourcecodester Online Market Place Site 1.0 is vulnerable to Cross Site Scripting (XSS), allowing attackers...
Sourcecodester Online Market Place Site 1.0 is vulnerable to Cross Site Scripting (XSS), allowing attackers to register as a Seller then create new products containing XSS payloads in the 'Product Title' and 'Short Description' fields.
Published Sep 26, 2022 · Updated May 21, 2025
CVE-2022-40354: Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via t...
Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_booking.php.
Published Sep 27, 2022 · Updated May 21, 2025
CVE-2022-3323: An SQL injection vulnerability in Advantech iView 5.7.04.6469.
An SQL injection vulnerability in Advantech iView 5.7.04.6469. The specific flaw exists within the ConfigurationServlet endpoint, which listens on TCP port 8080 by default. An unauthenticated remote attacker can craft a special column_value parameter in the setConfiguration action to bypass checks in com.imc.iview.utils.CUtils.checkSQLInjection() to perform SQL injection. For example, the attacker can exploit the vulnerability to retrieve the iView admin password.
Published Sep 27, 2022 · Updated May 21, 2025
CVE-2022-23006: Buffer Overflow Vulnerability in Western Digital My Cloud Home Products and SanDisk ibi
A stack-based buffer overflow vulnerability was found on Western Digital My Cloud Home, My Cloud Home Duo, and SanDisk ibi that could allow an attacker accessing the system locally to read information from /etc/version file. This vulnerability can only be exploited by chaining it with another issue. If an attacker is able to carry out a remote code execution attack, they can gain access to the vulnerable file, due to the presence of insecure functions in code. User interaction is required for exploitation. Exploiting the vulnerability could result in exposure of information, ability to modify files, memory access errors, or system crashes.
Published Sep 27, 2022 · Updated May 21, 2025
CVE-2022-40817: Zammad 5.2.1 has a fine-grained permission model that allows to configure read-only access to tickets.
Zammad 5.2.1 has a fine-grained permission model that allows to configure read-only access to tickets. However, agents were still wrongly able to perform some operations on such tickets, like adding and removing links, tags. and related answers. This issue has been fixed in 5.2.2.
Published Sep 27, 2022 · Updated May 21, 2025
CVE-2022-40816: Zammad 5.2.1 is vulnerable to Incorrect Access Control.
Zammad 5.2.1 is vulnerable to Incorrect Access Control. Zammad's asset handling mechanism has logic to ensure that customer users are not able to see personal information of other users. This logic was not effective when used through a web socket connection, so that a logged-in attacker would be able to fetch personal data of other users by querying the Zammad API. This issue is fixed in , 5.2.2.
Published Sep 27, 2022 · Updated May 21, 2025
CVE-2022-40878: In Exam Reviewer Management System 1.0, an authenticated attacker can upload a web-shell php file in profil...
In Exam Reviewer Management System 1.0, an authenticated attacker can upload a web-shell php file in profile page to achieve Remote Code Execution (RCE).
Published Sep 27, 2022 · Updated May 21, 2025
CVE-2022-40877: Exam Reviewer Management System 1.0 is vulnerable to SQL Injection via the ‘id’ parameter.
Exam Reviewer Management System 1.0 is vulnerable to SQL Injection via the ‘id’ parameter.
Published Sep 27, 2022 · Updated May 21, 2025
CVE-2022-38932: readelf in ToaruOS 2.0.1 has a global overflow allowing RCE when parsing a crafted ELF file.
readelf in ToaruOS 2.0.1 has a global overflow allowing RCE when parsing a crafted ELF file.
Published Sep 27, 2022 · Updated May 21, 2025
CVE-2022-40497: Wazuh v3.6.1 - v3.13.5, v4.0.0 - v4.2.7, and v4.3.0 - v4.3.7 were discovered to contain an authenticated re...
Wazuh v3.6.1 - v3.13.5, v4.0.0 - v4.2.7, and v4.3.0 - v4.3.7 were discovered to contain an authenticated remote code execution (RCE) vulnerability via the Active Response endpoint.
Published Sep 27, 2022 · Updated May 21, 2025
CVE-2022-1270: In GraphicsMagick, a heap buffer overflow was found when parsing MIFF.
In GraphicsMagick, a heap buffer overflow was found when parsing MIFF.
Published Sep 28, 2022 · Updated May 21, 2025
CVE-2022-28813: SQL-injection in Car Park Server 3.0 allows for full database access.
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of an SQL-injection to gain access to a volatile temporary database with the current states of the device.
Published Sep 28, 2022 · Updated May 21, 2025
CVE-2022-2760: In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does n...
In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have access to view in an error message when a resource is part of another Space.
Published Sep 28, 2022 · Updated May 21, 2025
CVE-2022-39031: Smart eVision - Exposure of Sensitive Information to an Unauthorized Actor -3
Smart eVision has insufficient authorization for task acquisition function. An unauthorized remote attacker can exploit this vulnerability to acquire the Session IDs of other general users only.
Published Sep 28, 2022 · Updated May 21, 2025
CVE-2022-38335: Vtiger CRM v7.4.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the e-mai...
Vtiger CRM v7.4.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the e-mail template modules.
Published Sep 27, 2022 · Updated May 21, 2025
CVE-2022-40929: XXL-JOB 2.2.0 has a Command execution vulnerability in background tasks.
XXL-JOB 2.2.0 has a Command execution vulnerability in background tasks. NOTE: this is disputed because the issues/4929 report is about an intended and supported use case (running arbitrary Bash scripts on behalf of users).
Published Sep 28, 2022 · Updated May 21, 2025
CVE-2022-38699: ASUS Armoury Crate Service - Arbitrary File Creation via Elevation of Privilege Flaw
Armoury Crate Service’s logging function has insufficient validation to check if the log file is a symbolic link. A physical attacker with general user privilege can modify the log file property to a symbolic link that points to arbitrary system file, causing the logging function to overwrite the system file and disrupt the system.
Published Sep 28, 2022 · Updated May 21, 2025
CVE-2022-39029: Smart eVision - Exposure of Sensitive Information to an Unauthorized Actor -1
Smart eVision has inadequate authorization for the database query function. A remote attacker with general user privilege, who is not explicitly authorized to access the information, can access sensitive information.
Published Sep 28, 2022 · Updated May 21, 2025
CVE-2022-39030: Smart eVision - Exposure of Sensitive Information to an Unauthorized Actor -2
smart eVision has inadequate authorization for system information query function. An unauthenticated remote attacker, who is not explicitly authorized to access the information, can access sensitive information.
Published Sep 28, 2022 · Updated May 21, 2025
CVE-2022-39032: Smart eVision - Improper Privilege Management
Smart eVision has an improper privilege management vulnerability. A remote attacker with general user privilege can exploit this vulnerability to escalate to administrator privilege, and then perform arbitrary system command or disrupt service.
Published Sep 28, 2022 · Updated May 21, 2025
CVE-2022-39033: Smart eVision - Path Traversal -1
Smart eVision’s file acquisition function has a path traversal vulnerability due to insufficient filtering for special characters in the URL parameter. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication, access restricted paths to download and delete arbitrary system files to disrupt service.
Published Sep 28, 2022 · Updated May 21, 2025
CVE-2022-39034: Smart eVision - Path Traversal -2
Smart eVision has a path traversal vulnerability in the Report API function due to insufficient filtering for special characters in URLs. A remote attacker with general user privilege can exploit this vulnerability to bypass authentication, access restricted paths and download system files.
Published Sep 28, 2022 · Updated May 21, 2025
CVE-2022-39035: Smart eVision - Stored XSS
Smart eVision has insufficient filtering for special characters in the POST Data parameter in the specific function. An unauthenticated remote attacker can inject JavaScript to perform XSS (Stored Cross-Site Scripting) attack.
Published Sep 28, 2022 · Updated May 21, 2025
CVE-2022-40486: TP Link Archer AX10 V1 Firmware Version 1.3.1 Build 20220401 Rel.
TP Link Archer AX10 V1 Firmware Version 1.3.1 Build 20220401 Rel. 57450(5553) was discovered to allow authenticated attackers to execute arbitrary code via a crafted backup file.
Published Sep 28, 2022 · Updated May 21, 2025
CVE-2022-40082: Hertz v0.3.0 ws discovered to contain a path traversal vulnerability via the normalizePath function.
Hertz v0.3.0 ws discovered to contain a path traversal vulnerability via the normalizePath function.
Published Sep 28, 2022 · Updated May 21, 2025
CVE-2022-40083: Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler compon...
Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by attackers to cause a Server-Side Request Forgery (SSRF).
Published Sep 28, 2022 · Updated May 21, 2025
CVE-2022-22522: Hard-coded credentials in Carlo Gavazzi UWP3.0 allows for authentication bypass and full control of the device
In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of hard-coded credentials to gain full access to the device.
Published Sep 28, 2022 · Updated May 21, 2025
CVE-2022-22523: Carlo Gavazzi UWP 3.0 WebApp allows for authentication bypass
An improper authentication vulnerability exists in the Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 Web-App which allows an authentication bypass to the context of an unauthorised user if free-access is disabled.
Published Sep 28, 2022 · Updated May 21, 2025