Security Vulnerabilities - CVEs Published In 2022
CVE-2022-41223
The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via crafted data due to insufficient restrictions on the database data type.
Known exploited
CVSS Score
6.8
EPSS Score
0.107
Published
2022-11-22
Fusiondirectory 1.3 is vulnerable to Cross Site Scripting (XSS) via /fusiondirectory/index.php?message=[injection], /fusiondirectory/index.php?message=invalidparameter&plug={Injection], /fusiondirectory/index.php?signout=1&message=[injection]&plug=106.
CVSS Score
9.6
EPSS Score
0.009
Published
2022-11-22
CVE-2022-40765
A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with internal network access to conduct a command-injection attack, due to insufficient restriction of URL parameters.
Known exploited
CVSS Score
6.8
EPSS Score
0.106
Published
2022-11-22
Fusiondirectory 1.3 suffers from Improper Session Handling.
CVSS Score
9.8
EPSS Score
0.01
Published
2022-11-22
File upload vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to upload arbitrary files via /system/application/libs/js/tinymce/plugins/filemanager/dialog.php and /system/application/libs/js/tinymce/plugins/filemanager/upload.php.
CVSS Score
7.2
EPSS Score
0.01
Published
2022-11-22
MyBB 1.8.31 has a (issue 2 of 2) cross-site scripting (XSS) vulnerabilities in the post Attachments interface allow attackers to inject HTML by persuading the user to upload a file with specially crafted name
CVSS Score
6.1
EPSS Score
0.004
Published
2022-11-22
MyBB 1.8.31 has a SQL injection vulnerability in the Admin CP's Users module allows remote authenticated users to modify the query string via direct user input or stored search filter settings.
CVSS Score
4.9
EPSS Score
0.007
Published
2022-11-22
MyBB 1.8.31 has a Cross-site scripting (XSS) vulnerability in the visual MyCode editor (SCEditor) allows remote attackers to inject HTML via user input or stored data
CVSS Score
6.1
EPSS Score
0.005
Published
2022-11-22
An issue was discovered in Appalti & Contratti 9.12.2. The target web applications are subject to multiple SQL Injection vulnerabilities, some of which executable even by unauthenticated users, as demonstrated by the GetListaEnti.do cfamm parameter.
CVSS Score
9.8
EPSS Score
0.009
Published
2022-11-21
An issue was discovered in Appalti & Contratti 9.12.2. The target web applications allow Local File Inclusion in any page relying on the href parameter to specify the JSP page to be rendered. This affects ApriPagina.do POST and GET requests to each application.
CVSS Score
7.5
EPSS Score
0.007
Published
2022-11-21