Security Vulnerabilities - CVEs Published In 2022
An issue was discovered in the Growth extension in MediaWiki through 1.36.2. Any admin can add arbitrary JavaScript code to the Newcomer home page footer, which can be executed by viewers with zero edits.
CVSS Score
4.8
EPSS Score
0.007
Published
2022-09-29
An issue was discovered in the Translate extension in MediaWiki through 1.36.2. Oversighters cannot undo revisions or oversight on pages where they suppressed information (such as PII). This allows oversighters to whitewash revisions.
CVSS Score
6.5
EPSS Score
0.01
Published
2022-09-29
An issue was discovered in FusionPBX before 4.5.30. The log_viewer.php Log View page allows an authenticated user to choose an arbitrary filename for download (i.e., not necessarily freeswitch.log in the intended directory).
CVSS Score
6.5
EPSS Score
0.009
Published
2022-09-29
Time-based SQL Injection vulnerabilities were found in Metersphere v1.15.4 via the "orders" parameter.
CVSS Score
8.8
EPSS Score
0.031
Published
2022-09-29
An arbitrary file read vulnerability was found in Metersphere v1.15.4, where authenticated users can read any file on the server via the file download function.
CVSS Score
6.5
EPSS Score
0.009
Published
2022-09-29
An arbitrary file upload vulnerability was found in Metersphere v1.15.4. Unauthenticated users can upload any file to arbitrary directory, where attackers can write a cron job to execute commands.
CVSS Score
9.8
EPSS Score
0.019
Published
2022-09-29
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 uses ZODB storage without authentication.
CVSS Score
7.5
EPSS Score
0.01
Published
2022-09-29
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak /opt/axess/var/blobstorage/ permissions.
CVSS Score
5.3
EPSS Score
0.008
Published
2022-09-29
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak Data.fs permissions.
CVSS Score
5.3
EPSS Score
0.008
Published
2022-09-29
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded APP_KEY in /opt/axess/etc/default/axess.
CVSS Score
5.3
EPSS Score
0.006
Published
2022-09-29