# CVEs published 2022-08-17

44 CVEs were published on August 17, 2022: 1 critical, 15 high. Days are UTC.

- [CVE-2022-35151](https://cve.now/CVE-2022-35151.md): kkFileView v4.1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the urls and currentUrl parameters at… (no CVSS)
- [CVE-2022-28752](https://cve.now/CVE-2022-28752.md): Local Privilege Escalation in the Zoom Rooms for Windows Client (CVSS 8.8, Zoom Video Communications Zoom Room for Conference Room for…)
- [CVE-2022-28751](https://cve.now/CVE-2022-28751.md): Local Privilege Escalation in Zoom Client for Meetings for MacOS (CVSS 8.8, Zoom Video Communications Zoom Client for Meetings for MacOS)
- [CVE-2022-35148](https://cve.now/CVE-2022-35148.md): maccms10 v2021.1000.1081 to v2022.1000.3031 was discovered to contain a SQL injection vulnerability via the table parameter at… (no CVSS)
- [CVE-2022-23747](https://cve.now/CVE-2022-23747.md): In Sony Xperia series 1, 5, and Pro, an out of bound memory access can occur due to lack of validation of the number of frames being… (no CVSS, Sony Xperia)
- [CVE-2022-35147](https://cve.now/CVE-2022-35147.md): DoraCMS v2.18 and earlier allows attackers to bypass login authentication via a crafted HTTP request. (no CVSS)
- [CVE-2022-35133](https://cve.now/CVE-2022-35133.md): A cross-site scripting (XSS) vulnerability in CherryTree v0.99.30 allows attackers to execute arbitrary web scripts or HTML via a crafted… (no CVSS)
- [CVE-2022-35122](https://cve.now/CVE-2022-35122.md): An access control issue in Ecowitt GW1100 Series Weather Stations \<=GW1100B\_v2.1.5 allows unauthenticated attackers to access sensitive… (no CVSS)
- [CVE-2022-23765](https://cve.now/CVE-2022-23765.md): IPTIME NAS family CSRF vulnerability (CVSS 8.0, EFM Networks Co. NAS1dual, NAS2dual, NAS4dual)
- [CVE-2022-23764](https://cve.now/CVE-2022-23764.md): TERUTEN WebCube update remote code execution vulnerability (CVSS 8.8, TERUTEN Co. WebCube)
- [CVE-2021-26639](https://cve.now/CVE-2021-26639.md): WISA Smart Wing CMS File Download Vulnerability (CVSS 8.1, WISA Smart Wing CMS)
- [CVE-2022-2337](https://cve.now/CVE-2022-2337.md): Softing Secure Integration Server NULL Pointer Dereference (CVSS 7.5, Softing Secure Integration Server)
- [CVE-2022-1069](https://cve.now/CVE-2022-1069.md): Softing Secure Integration Server Out-of-bounds Read (CVSS 7.5, Softing Secure Integration Server)
- [CVE-2022-2338](https://cve.now/CVE-2022-2338.md): Softing Secure Integration Server Cleartext Transmission of Sensitive Information (CVSS 5.7, Softing Secure Integration Server)
- [CVE-2022-2335](https://cve.now/CVE-2022-2335.md): Softing Secure Integration Server Integer Underflow (CVSS 7.5, Softing Secure Integration Server)
- [CVE-2022-2334](https://cve.now/CVE-2022-2334.md): Softing Secure Integration Server Uncontrolled Search Path Element (CVSS 7.2, Softing Secure Integration Server)
- [CVE-2022-1373](https://cve.now/CVE-2022-1373.md): Softing Secure Integration Server Relative Path Traversal (CVSS 7.2, Softing Secure Integration Server)
- [CVE-2022-1748](https://cve.now/CVE-2022-1748.md): Softing Secure Integration Server NULL Pointer Dereference (CVSS 7.5, Softing Secure Integration Server · Softing OPC UA C++ S… +3)
- [CVE-2022-2336](https://cve.now/CVE-2022-2336.md): Softing Secure Integration Server Improper Authentication (CVSS 9.8, Softing Secure Integration Server · Softing edgeConnecto… +2)
- [CVE-2022-2547](https://cve.now/CVE-2022-2547.md): Softing Secure Integration Server NULL Pointer Dereference (CVSS 7.5, Softing Secure Integration Server)
- [CVE-2022-35121](https://cve.now/CVE-2022-35121.md): Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/BookServiceImpl.java. (no CVSS)
- [CVE-2022-36215](https://cve.now/CVE-2022-36215.md): DedeBIZ v6 was discovered to contain a remote code execution vulnerability in sys\_info.php. (no CVSS)
- [CVE-2022-35516](https://cve.now/CVE-2022-35516.md): DedeCMS v5.7.93 - v5.7.96 was discovered to contain a remote code execution vulnerability in login.php. (no CVSS)
- [CVE-2022-36216](https://cve.now/CVE-2022-36216.md): DedeCMS v5.7.94 - v5.7.97 was discovered to contain a remote code execution vulnerability in member\_toadmin.php. (no CVSS)
- [CVE-2022-2870](https://cve.now/CVE-2022-2870.md): laravel deserialization (CVSS 4.1, laravel)
- [CVE-2022-35117](https://cve.now/CVE-2022-35117.md): Clinic's Patient Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via… (no CVSS)
- [CVE-2022-22455](https://cve.now/CVE-2022-22455.md): IBM Security Verify Governance Identity Manager 10.0 virtual appliance component performs an operation at a privilege level that is higher… (CVSS 2.3, IBM Security Verify Governance)
- [CVE-2022-36186](https://cve.now/CVE-2022-36186.md): A Null Pointer dereference vulnerability exists in GPAC 2.1-DEV-revUNKNOWN-master via the function gf\_filter\_pid\_set\_property\_full () at… (no CVSS)
- [CVE-2022-31262](https://cve.now/CVE-2022-31262.md): An exploitable local privilege escalation vulnerability exists in GOG Galaxy 2.0.46. (no CVSS)
- [CVE-2022-38149](https://cve.now/CVE-2022-38149.md): HashiCorp Consul Template up to 0.27.2, 0.28.2, and 0.29.1 may expose the contents of Vault secrets in the error returned by the… (no CVSS, github.com/hashicorp/consul-template)
- [CVE-2022-30262](https://cve.now/CVE-2022-30262.md): The Emerson ControlWave 'Next Generation' RTUs through 2022-05-02 mishandle firmware integrity. (no CVSS)
- [CVE-2022-37459](https://cve.now/CVE-2022-37459.md): Ampere Altra devices before 1.08g and Ampere Altra Max devices before 2.05a allow attackers to control the predictions for return… (no CVSS)
- [CVE-2021-45454](https://cve.now/CVE-2021-45454.md): Ampere Altra before SRP 1.08b and Altra Max​ before SRP 2.05 allow information disclosure of power telemetry via HWmon. (no CVSS)
- [CVE-2022-2871](https://cve.now/CVE-2022-2871.md): Cross-site Scripting (XSS) - Stored in notrinos/notrinoserp (CVSS 4.6, notrinos/notrinoserp · notrinos/notrinos-erp)
- [CVE-2020-14394](https://cve.now/CVE-2020-14394.md): An infinite loop flaw was found in the USB xHCI controller emulation of QEMU while computing the length of the Transfer Request Block… (no CVSS, QEMU)
- [CVE-2022-2845](https://cve.now/CVE-2022-2845.md): Improper Validation of Specified Quantity in Input in vim/vim (CVSS 7.8, vim/vim)
- [CVE-2022-2849](https://cve.now/CVE-2022-2849.md): Heap-based Buffer Overflow in vim/vim (CVSS 7.8, vim/vim)
- [CVE-2022-2862](https://cve.now/CVE-2022-2862.md): Use After Free in vim/vim (CVSS 7.6, vim/vim)
- [CVE-2022-2867](https://cve.now/CVE-2022-2867.md): libtiff's tiffcrop utility has a uint32\_t underflow that can lead to out of bounds read and write. (no CVSS, libtiff)
- [CVE-2022-2868](https://cve.now/CVE-2022-2868.md): libtiff's tiffcrop utility has a improper input validation flaw that can lead to out of bounds read and ultimately cause a crash if an… (no CVSS, libtiff)
- [CVE-2022-2869](https://cve.now/CVE-2022-2869.md): libtiff's tiffcrop tool has a uint32\_t underflow which leads to out of bounds read and write in the extractContigSamples8bits routine. (no CVSS, libtiff)
- [CVE-2022-36190](https://cve.now/CVE-2022-36190.md): GPAC mp4box 2.1-DEV-revUNKNOWN-master has a use-after-free vulnerability in function gf\_isom\_dovi\_config\_get. (no CVSS)
- [CVE-2022-36191](https://cve.now/CVE-2022-36191.md): A heap-buffer-overflow had occurred in function gf\_isom\_dovi\_config\_get of isomedia/avc\_ext.c:2490, as demonstrated by MP4Box. (no CVSS)
- [CVE-2022-38392](https://cve.now/CVE-2022-38392.md): Certain 5400 RPM hard drives, for laptops and other PCs in approximately 2005 and later, allow physically proximate attackers to cause a… (CVSS 5.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2022-08-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.