# CVEs published 2022-08-12

53 CVEs were published on August 12, 2022: 1 critical, 5 high. Days are UTC.

- [CVE-2022-35942](https://cve.now/CVE-2022-35942.md): loopback-connector-postgresql Vulnerable to Improper Sanitization of \`contains\` Filter (CVSS 9.3, loopbackio loopback-connector-postgresql · loopback-connect…)
- [CVE-2022-35943](https://cve.now/CVE-2022-35943.md): SameSite may allow cross-site request forgery (CSRF) protection to be bypassed (CVSS 5.9, codeigniter4 shield · codeigniter4/shield)
- [CVE-2022-35956](https://cve.now/CVE-2022-35956.md): update\_by\_case before 0.1.3 vulnerable to sql injection (CVSS 5.8, camilova activerecord-update-by-case · update\_by\_case)
- [CVE-2022-35953](https://cve.now/CVE-2022-35953.md): URL Redirection to Untrusted Site ('Open Redirect') in bookwyrm (CVSS 7.1, bookwyrm-social bookwyrm)
- [CVE-2022-2804](https://cve.now/CVE-2022-2804.md): SourceCodester Zoo Management System apply\_vacancy.php unrestricted upload (CVSS 6.3, SourceCodester Zoo Management System)
- [CVE-2022-2803](https://cve.now/CVE-2022-2803.md): SourceCodester Zoo Management System animals.php sql injection (CVSS 6.3, SourceCodester Zoo Management System)
- [CVE-2022-2802](https://cve.now/CVE-2022-2802.md): SourceCodester Gas Agency Management System login.php sql injection (CVSS 7.3, SourceCodester Gas Agency Management System)
- [CVE-2022-2801](https://cve.now/CVE-2022-2801.md): SourceCodester Automated Beer Parlour Billing System Login sql injection (CVSS 6.3, SourceCodester Automated Beer Parlour Billing System)
- [CVE-2022-2800](https://cve.now/CVE-2022-2800.md): SourceCodester Gym Management System clickjacking (CVSS 4.3, SourceCodester Gym Management System)
- [CVE-2022-2624](https://cve.now/CVE-2022-2624.md): Heap buffer overflow in PDF in Google Chrome prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific… (no CVSS, Google Chrome)
- [CVE-2022-2623](https://cve.now/CVE-2022-2623.md): Use after free in Offline in Google Chrome on Android prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in… (no CVSS, Google Chrome)
- [CVE-2022-2622](https://cve.now/CVE-2022-2622.md): Insufficient validation of untrusted input in Safe Browsing in Google Chrome on Windows prior to 104.0.5112.79 allowed a remote attacker… (no CVSS, Google Chrome)
- [CVE-2022-2621](https://cve.now/CVE-2022-2621.md): Use after free in Extensions in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a malicious… (no CVSS, Google Chrome)
- [CVE-2022-2620](https://cve.now/CVE-2022-2620.md): Use after free in WebUI in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in… (no CVSS, Google Chrome)
- [CVE-2022-2619](https://cve.now/CVE-2022-2619.md): Insufficient validation of untrusted input in Settings in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to… (no CVSS, Google Chrome)
- [CVE-2022-2618](https://cve.now/CVE-2022-2618.md): Insufficient validation of untrusted input in Internals in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to bypass… (no CVSS, Google Chrome)
- [CVE-2022-2617](https://cve.now/CVE-2022-2617.md): Use after free in Extensions API in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a malicious… (no CVSS, Google Chrome)
- [CVE-2022-2616](https://cve.now/CVE-2022-2616.md): Inappropriate implementation in Extensions API in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install… (no CVSS, Google Chrome)
- [CVE-2022-2615](https://cve.now/CVE-2022-2615.md): Insufficient policy enforcement in Cookies in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to leak cross-origin data via… (no CVSS, Google Chrome)
- [CVE-2022-2614](https://cve.now/CVE-2022-2614.md): Use after free in Sign-In Flow in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to potentially exploit heap corruption… (no CVSS, Google Chrome)
- [CVE-2022-2613](https://cve.now/CVE-2022-2613.md): Use after free in Input in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to enage in… (no CVSS, Google Chrome)
- [CVE-2022-2612](https://cve.now/CVE-2022-2612.md): Side-channel information leakage in Keyboard input in Google Chrome prior to 104.0.5112.79 allowed a remote attacker who had compromised… (no CVSS, Google Chrome)
- [CVE-2022-2611](https://cve.now/CVE-2022-2611.md): Inappropriate implementation in Fullscreen API in Google Chrome on Android prior to 104.0.5112.79 allowed a remote attacker to spoof the… (no CVSS, Google Chrome)
- [CVE-2022-2610](https://cve.now/CVE-2022-2610.md): Insufficient policy enforcement in Background Fetch in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to leak cross-origin… (no CVSS, Google Chrome)
- [CVE-2022-2609](https://cve.now/CVE-2022-2609.md): Use after free in Nearby Share in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to… (no CVSS, Google Chrome)
- [CVE-2022-2608](https://cve.now/CVE-2022-2608.md): Use after free in Overview Mode in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to… (no CVSS, Google Chrome)
- [CVE-2022-2607](https://cve.now/CVE-2022-2607.md): Use after free in Tab Strip in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage… (no CVSS, Google Chrome)
- [CVE-2022-2606](https://cve.now/CVE-2022-2606.md): Use after free in Managed devices API in Google Chrome prior to 104.0.5112.79 allowed a remote attacker who convinced a user to enable a… (no CVSS, Google Chrome)
- [CVE-2022-2605](https://cve.now/CVE-2022-2605.md): Out of bounds read in Dawn in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to potentially exploit heap corruption via a… (no CVSS, Google Chrome)
- [CVE-2022-2604](https://cve.now/CVE-2022-2604.md): Use after free in Safe Browsing in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to potentially exploit heap corruption… (no CVSS, Google Chrome)
- [CVE-2022-2603](https://cve.now/CVE-2022-2603.md): Use after free in Omnibox in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to potentially exploit heap corruption via a… (no CVSS, Google Chrome)
- [CVE-2022-2587](https://cve.now/CVE-2022-2587.md): Out of bounds write in Chrome OS Audio Server in Google Chrome on Chrome OS prior to 102.0.5005.125 allowed a remote attacker to… (no CVSS, Google Chrome)
- [CVE-2022-2797](https://cve.now/CVE-2022-2797.md): SourceCodester Student Information System view\_student.php sql injection (CVSS 6.3, SourceCodester Student Information System)
- [CVE-2021-29117](https://cve.now/CVE-2021-29117.md): arcreader use-after-free (CVSS 7.8, Esri ArcReader)
- [CVE-2021-29112](https://cve.now/CVE-2021-29112.md): Esri ArcReader PMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Esri ArcReader)
- [CVE-2021-29118](https://cve.now/CVE-2021-29118.md): Esri ArcReader PMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Esri ArcReader)
- [CVE-2022-37397](https://cve.now/CVE-2022-37397.md): The software is vulnerable when using LDAP-based authentication in YCQL with Microsoft’s Active Directory (CVSS 8.3, Yugabyte DB)
- [CVE-2022-35980](https://cve.now/CVE-2022-35980.md): OpenSearch vulnerable to Improper Authorization of Index Containing Sensitive Information (CVSS 7.5, opensearch-project security · org.opensearch.plugin:opensea…)
- [CVE-2021-42751](https://cve.now/CVE-2021-42751.md): A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers (with administrative access) to… (no CVSS)
- [CVE-2021-42750](https://cve.now/CVE-2021-42750.md): A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers (with administrative access) to… (no CVSS)
- [CVE-2022-35585](https://cve.now/CVE-2022-35585.md): A stored cross-site scripting (XSS) issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaScript via the "start\_date"… (no CVSS, forkcms/forkcms)
- [CVE-2022-35587](https://cve.now/CVE-2022-35587.md): A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the "publish\_on\_date"… (no CVSS, forkcms/forkcms)
- [CVE-2022-35589](https://cve.now/CVE-2022-35589.md): A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the "publish\_on\_time"… (no CVSS, forkcms/forkcms)
- [CVE-2022-35590](https://cve.now/CVE-2022-35590.md): A cross-site scripting (XSS) issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaScript via the "end\_date" Parameter (no CVSS, forkcms/forkcms)
- [CVE-2022-35932](https://cve.now/CVE-2022-35932.md): Missing rate limit when trying to join a password protected Nextcloud Talk conversation (CVSS 3.5, nextcloud security-advisories)
- [CVE-2022-37423](https://cve.now/CVE-2022-37423.md): Neo4j APOC (Awesome Procedures on Cypher) before 4.3.0.7 and 4.x before 4.4.0.8 allows Directory Traversal to sibling directories via… (no CVSS, org.neo4j.procedure:apoc)
- [CVE-2022-2390](https://cve.now/CVE-2022-2390.md): Mutable pending intent in Google Play services SDK (CVSS 6.1, Google Play Services SDK · com.google.android.gms:play-serv…)
- [CVE-2022-38180](https://cve.now/CVE-2022-38180.md): In JetBrains Ktor before 2.1.0 the wrong authentication provider could be selected in some cases (CVSS 5.3, JetBrains Ktor · io.ktor:ktor)
- [CVE-2022-38179](https://cve.now/CVE-2022-38179.md): JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack (CVSS 4.7, JetBrains Ktor · io.ktor:ktor)
- [CVE-2022-2779](https://cve.now/CVE-2022-2779.md): SourceCodester Gas Agency Management System oneWord.php unrestricted upload (CVSS 6.3, SourceCodester Gas Agency Management System)
- [CVE-2022-2503](https://cve.now/CVE-2022-2503.md): Linux Kernel LoadPin bypass via dm-verity table reload (CVSS 6.9, Linux Kernel)
- [CVE-2022-35949](https://cve.now/CVE-2022-35949.md): \`undici.request\` vulnerable to SSRF using absolute URL on \`pathname\` (CVSS 5.3, nodejs undici · undici)
- [CVE-2022-38183](https://cve.now/CVE-2022-38183.md): In Gitea before 1.16.9, it was possible for users to add existing issues to projects. (no CVSS, code.gitea.io/gitea)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2022-08-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.