Security Vulnerabilities - CVEs Published In 2022
Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow in /usr/sbin/httpd via parameter enable_band_steering.
CVSS Score
9.8
EPSS Score
0.011
Published
2022-11-22
Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow via parameter enable_band_steering.
CVSS Score
9.8
EPSS Score
0.011
Published
2022-11-22
Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack.
CVSS Score
8.8
EPSS Score
0.014
Published
2022-11-22
A cross-site scripting (XSS) vulnerability in Record Management System using CodeIgniter 1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Add Subject page.
CVSS Score
4.8
EPSS Score
0.011
Published
2022-11-22
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the 'Card' content.
CVSS Score
4.8
EPSS Score
0.027
Published
2022-11-22
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via 'Comment.' .
CVSS Score
4.8
EPSS Score
0.008
Published
2022-11-22
KLiK SocialMediaWebsite version v1.0.1 is vulnerable to SQL Injection via the profile.php.
CVSS Score
8.8
EPSS Score
0.014
Published
2022-11-22
Use After Free vulnerability in Linux Kernel allows Privilege Escalation. An improper Update of Reference Count in io_uring leads to Use-After-Free and Local Privilege Escalation.
When io_msg_ring was invoked with a fixed file, it called io_fput_file() which improperly decreased its reference count (leading to Use-After-Free and Local Privilege Escalation). Fixed files are permanently registered to the ring, and should not be put separately.
We recommend upgrading past commit https://github.com/torvalds/linux/commit/fc7222c3a9f56271fba02aabbfbae999042f1679 https://github.com/torvalds/linux/commit/fc7222c3a9f56271fba02aabbfbae999042f1679
CVSS Score
7.8
EPSS Score
0.011
Published
2022-11-22
Silverstripe silverstripe/framework through 4.11 is vulnerable to XSS by carefully crafting a return URL on a /dev/build or /Security/login request.
CVSS Score
6.1
EPSS Score
0.005
Published
2022-11-22
A CWE-269: Improper Privilege Management vulnerability exists that could cause a denial of service of the Ethernet communication of the controller when sending a specific request over SNMP. Affected products: Modicon M340 CPUs(BMXP34* versions prior to V3.40), Modicon M340 X80 Ethernet Communication modules:BMXNOE0100 (H), BMXNOE0110 (H), BMXNOR0200H RTU(BMXNOE* all versions)(BMXNOR* versions prior to v1.7 IR24)
CVSS Score
7.5
EPSS Score
0.006
Published
2022-11-22