Security Vulnerabilities Published In September 2022
RealVNC VNC Server before 6.11.0 and VNC Viewer before 6.22.826 on Windows allow local privilege escalation via MSI installer Repair mode.
| Max Base Score | 7.8 |
| Published | 2022-09-30 |
| Updated | 2022-10-04 |
| EPSS | 0.04% |
AP Manager in Innovaphone before 13r2 Service Release 17 allows command injection via a modified service ID during app upload.
| Max Base Score | 7.2 |
| Published | 2022-09-30 |
| Updated | 2022-10-11 |
| EPSS | 0.06% |
roccat_report_event in drivers/hid/hid-roccat.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free in certain situations where a report is received while copying a report->value is in progress.
| Max Base Score | 4.7 |
| Published | 2022-09-30 |
| Updated | 2023-02-23 |
| EPSS | 0.04% |
drivers/video/fbdev/smscufx.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically proximate attacker removes a USB device while calling open(), aka a race condition between ufx_ops_open and ufx_usb_disconnect.
| Max Base Score | 4.2 |
| Published | 2022-09-30 |
| Updated | 2023-02-23 |
| EPSS | 0.04% |
drivers/char/pcmcia/synclink_cs.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling ioctl, aka a race condition between mgslpc_ioctl and mgslpc_detach.
| Max Base Score | 4.2 |
| Published | 2022-09-30 |
| Updated | 2022-10-04 |
| EPSS | 0.04% |
An issue was discovered in Bento4 1.6.0-639. A memory leak exists in AP4_StdcFileByteStream::Create(AP4_FileByteStream*, char const*, AP4_FileByteStream::Mode, AP4_ByteStream*&) in System/StdC/Ap4StdCFileByteStream.cpp.
| Max Base Score | 5.5 |
| Published | 2022-09-30 |
| Updated | 2022-10-28 |
| EPSS | 0.05% |
An issue was discovered in Bento4 1.6.0-639. There ie excessive memory consumption in the function AP4_DataBuffer::ReallocateBuffer in Core/Ap4DataBuffer.cpp.
| Max Base Score | 5.5 |
| Published | 2022-09-30 |
| Updated | 2022-10-28 |
| EPSS | 0.04% |
An issue was discovered in Bento4 1.6.0-639. There ie excessive memory consumption in the function AP4_Array<AP4_ElstEntry>::EnsureCapacity in Core/Ap4Array.h.
| Max Base Score | 5.5 |
| Published | 2022-09-30 |
| Updated | 2022-10-03 |
| EPSS | 0.04% |
An issue was discovered in Xpdf 4.04. There is a crash in XRef::fetch(int, int, Object*, int) in xpdf/XRef.cc, a different vulnerability than CVE-2018-16369 and CVE-2019-16088.
| Max Base Score | 5.5 |
| Published | 2022-09-30 |
| Updated | 2022-10-28 |
| EPSS | 0.04% |
An issue was discovered in Xpdf 4.04. There is a crash in convertToType0 in fofi/FoFiType1C.cc, a different vulnerability than CVE-2022-38928.
| Max Base Score | 5.5 |
| Published | 2022-09-30 |
| Updated | 2022-10-03 |
| EPSS | 0.04% |
An issue was discovered in Xpdf 4.04. There is a crash in gfseek(_IO_FILE*, long, int) in goo/gfile.cc.
| Max Base Score | 5.5 |
| Published | 2022-09-30 |
| Updated | 2022-10-28 |
| EPSS | 0.04% |
An issue was discovered in Bento4 through 1.6.0-639. A NULL pointer dereference occurs in AP4_File::ParseStream in Core/Ap4File.cpp, which is called from AP4_File::AP4_File.
| Max Base Score | 5.5 |
| Published | 2022-09-30 |
| Updated | 2022-10-03 |
| EPSS | 0.04% |
In Amazon AWS Redshift JDBC Driver (aka amazon-redshift-jdbc-driver or redshift-jdbc42) before 2.1.0.8, the Object Factory does not check the class type when instantiating an object from a class name.
| Max Base Score | 8.1 |
| Published | 2022-09-29 |
| Updated | 2022-11-07 |
| EPSS | 0.11% |
Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. This occurs because of weak permissions for the %PROGRAMDATA%\CheckPoint\ZoneAlarm\Data\Updates directory, and a self-protection driver bypass that allows creation of a junction directory. This can be leveraged to perform an arbitrary file move as NT AUTHORITY\SYSTEM.
| Max Base Score | 8.8 |
| Published | 2022-09-27 |
| Updated | 2022-09-30 |
| EPSS | 0.04% |
An issue was discovered in EyesOfNetwork (EON) through 5.3.11. Local file inclusion can occur.
| Max Base Score | 9.8 |
| Published | 2022-09-27 |
| Updated | 2022-09-28 |
| EPSS | 0.10% |
An issue was discovered in EyesOfNetwork (EON) through 5.3.11. Unauthenticated SQL injection can occur.
| Max Base Score | 9.8 |
| Published | 2022-09-27 |
| Updated | 2022-09-28 |
| EPSS | 0.09% |
Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinventory/editcategory.php.
| Max Base Score | 7.2 |
| Published | 2022-09-30 |
| Updated | 2022-10-04 |
| EPSS | 0.06% |
Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinventory/edituser.php.
| Max Base Score | 7.2 |
| Published | 2022-09-30 |
| Updated | 2022-10-04 |
| EPSS | 0.06% |
Billing System Project v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /php_action/createProduct.php.
| Max Base Score | 7.2 |
| Published | 2022-09-30 |
| Updated | 2022-10-04 |
| EPSS | 0.06% |
CVE-2022-41352
Public exploit exists
Known Exploited Vulnerability
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavisd via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavisd automatically prefers it over cpio.
| Max Base Score | 9.8 |
| Published | 2022-09-26 |
| Updated | 2022-11-09 |
| EPSS | 96.45% |
| KEV Added | 2022-10-20 |
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.x and 9.x (e.g., 8.8.15). The Sudo configuration permits the zimbra user to execute the NGINX binary as root with arbitrary parameters. As part of its intended functionality, NGINX can load a user-defined configuration file, which includes plugins in the form of .so files, which also execute as root.
| Max Base Score | 7.8 |
| Published | 2022-09-26 |
| Updated | 2022-09-28 |
| EPSS | 0.04% |
registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-face rule.
| Max Base Score | 7.5 |
| Published | 2022-09-25 |
| Updated | 2022-11-21 |
| EPSS | 0.22% |
The secp256k1-js package before 1.1.0 for Node.js implements ECDSA without required r and s validation, leading to signature forgery.
| Max Base Score | 7.5 |
| Published | 2022-09-24 |
| Updated | 2022-09-28 |
| EPSS | 0.08% |
In Kitty before 0.26.2, insufficient validation in the desktop notification escape sequence can lead to arbitrary code execution. The user must display attacker-controlled content in the terminal, then click on a notification popup.
| Max Base Score | 7.8 |
| Published | 2022-09-23 |
| Updated | 2023-03-03 |
| EPSS | 0.07% |
Veritas System Recovery (VSR) versions 18 and 21 store a network destination password in the Windows registry during configuration of the backup configuration. This vulnerability could provide a Windows user (who has sufficient privileges) to access a network file system that they were not authorized to access.
| Max Base Score | 6.5 |
| Published | 2022-09-23 |
| Updated | 2022-09-26 |
| EPSS | 0.06% |