Security Vulnerabilities - CVEs Published In 2022
An issue was discovered in WSO2 Enterprise Integrator 6.4.0. A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Management Console under /carbon/ndatasource/validateconnection/ajaxprocessor.jsp via the driver parameter. Session hijacking or similar attacks would not be possible.
CVSS Score
6.1
EPSS Score
0.583
Published
2022-09-09
OpenKM 6.3.11 allows stored XSS related to the javascript: substring in an A element.
CVSS Score
5.4
EPSS Score
0.011
Published
2022-09-09
A Path Traversal vulnerability in SmartVista Cardgen v3.28.0 allows authenticated attackers to read arbitrary files in the system.
CVSS Score
6.5
EPSS Score
0.01
Published
2022-09-09
aEnrich eHRD Learning Management Key Performance Indicator System 5+ exposes Sensitive Information to an Unauthorized Actor.
CVSS Score
7.5
EPSS Score
0.008
Published
2022-09-09
aEnrich a+HRD 5.x Learning Management Key Performance Indicator System has a local file inclusion (LFI) vulnerability that occurs due to missing input validation in v5.x
CVSS Score
8.1
EPSS Score
0.011
Published
2022-09-09
aEnrich eHRD Learning Management Key Performance Indicator System 5+ has Improper Access Control. The web application does not validate user session when accessing many application pages. This can allow an attacker to gain unauthenticated access to sensitive functionalities in the application
CVSS Score
7.5
EPSS Score
0.008
Published
2022-09-09
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.9 are vulnerable to HTTP header injection, caused by improper validation. This could allow an attacker to conduct various attacks against the vulnerable system, including cache poisoning and cross-site scripting. IBM X-Force ID: 229429.
CVSS Score
5.4
EPSS Score
0.006
Published
2022-09-09
Arq Backup 7.19.5.0 and below stores backup encryption passwords using reversible encryption. This issue allows attackers with administrative privileges to recover cleartext passwords.
CVSS Score
4.9
EPSS Score
0.005
Published
2022-09-09
Mattermost version 7.0.x and earlier fails to sufficiently limit the in-memory sizes of concurrently uploaded JPEG images, which allows authenticated users to cause resource exhaustion on specific system configurations, resulting in server-side Denial of Service.
CVSS Score
3.1
EPSS Score
0.011
Published
2022-09-09
A flaw was found in the Linux kernel. A denial of service flaw may occur if there is a consecutive request of the NVME_IOCTL_RESET and the NVME_IOCTL_SUBSYS_RESET through the device file of the driver, resulting in a PCIe link disconnect.
CVSS Score
5.5
EPSS Score
0.003
Published
2022-09-09