CVEs published August 23, 2022
90 CVEs were published on August 23, 2022: 0 critical, 17 high. Browse them by severity, product and exploitation status.
- Published
- 90
- Critical
- 0
- High
- 17
- Medium
- 22
- Low
- 2
- Unrated
- 49
- Now in CISA KEV
- 0
- Fix available
- 24
Most affected products
- kernel
- 4
- PukiWiki Development Team PukiWiki
- 3
- All F-Secure and WithSecure Endpoint Protection products fo…
- 2
- ansible-runner
- 2
- ASNeG/OpcUaStack
- 2
- com.jflyfox:jflyfox_jfinal
- 2
- dmitrylitvinov Uploading SVG, WEBP and ICO files
- 2
- libarchive
- 2
- node-opcua
- 2
- OpenEXR
- 2
High 17
- CVE-2022-38132Command injection vulnerability in Linksys MR8300 router while Registration to DDNS Service. By specifying username and password, an…Linksys MR8300 Router
- CVE-2022-1513A potential vulnerability was reported in Lenovo PCManager prior to version 5.0.10.4191 that may allow code execution when visiting a…Lenovo PCManager
- CVE-2022-36285WordPress Uploading SVG, WEBP and ICO files plugin <= 1.0.1 - Authenticated Arbitrary File Upload vulnerabilitydmitrylitvinov Uploading SVG, WEBP and ICO files
- CVE-2022-36379WordPress ЮKassa для WooCommerce plugin <= 2.3.0 - Cross-Site Request Forgery (CSRF) leading to plugin settings updateYooMoney ЮKassa для WooCommerce
- CVE-2022-36394WordPress Contest Gallery plugin <= 17.0.4 - Authenticated SQL Injection (SQLi) vulnerabilityContest Gallery
- CVE-2022-33142WordPress Better Messages plugin <= 1.9.10.57 - Denial Of Service (DoS) vulnerabilityWordPlus Better Messages
- CVE-2022-34868WordPress ЮKassa для WooCommerce plugin <= 2.3.0 - Authenticated Arbitrary Settings Update vulnerabilityYooMoney ЮKassa для WooCommerce
- CVE-2022-24381Denial of Service (DoS)ASNeG/OpcUaStack
- CVE-2022-25888Denial of Service (DoS)opcua
- CVE-2022-25761Denial of Service (DoS)open62541/open62541
- CVE-2022-24298Denial of Service (DoS)FreeOpcUa/freeopcua
- CVE-2022-21208Denial of Service (DoS)node-opcua
- CVE-2022-25231Denial of Service (DoS)node-opcua
- CVE-2022-25304Denial of Service (DoS)opcua · asyncua
- CVE-2022-25302Denial of Service (DoS)ASNeG/OpcUaStack
- CVE-2022-2829Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrmyetiforcecompany/yetiforcecrm
- CVE-2022-2946Use After Free in vim/vimvim/vim
Medium, low and unrated 73
- CVE-2021-3917A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions.coreos-installer
- CVE-2022-38463ServiceNow through San Diego Patch 4b and Patch 6 allows reflected XSS in the logout functionality.
- CVE-2022-38172ServiceNow through San Diego Patch 3 allows XSS via the name field during creation of a new dashboard for the Performance Analytics…
- CVE-2022-35115IceWarp WebClient DC2 - Update 2 Build 9 (13.0.2.9) was discovered to contain a SQL injection vulnerability via the search parameter at…
- CVE-2022-38665Jenkins CollabNet Plugins Plugin 2.0.8 and earlier stores a RabbitMQ password unencrypted in its global configuration file on the Jenkins…Jenkins project Jenkins CollabNet Plugins Plugin · org.jenk…
- CVE-2022-38664Jenkins Job Configuration History Plugin 1165.v8cc9fd1f4597 and earlier does not escape the job name on the System Configuration History…Jenkins project Jenkins Job Configuration History Plugin ·…
- CVE-2022-38663Jenkins Git Plugin 4.11.4 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log provided by the…Jenkins project Jenkins Git Plugin · org.jenkins-ci.plugins…
- CVE-2022-37428PowerDNS Recursor up to and including 4.5.9, 4.6.2 and 4.7.1, when protobuf logging is enabled, has Improper Cleanup upon a Thrown…
- CVE-2022-28883Denial-of-Service (DoS) VulnerabilityAll F-Secure and WithSecure Endpoint Protection products fo…
- CVE-2022-28882Denial-of-Service (DoS) VulnerabilityAll F-Secure and WithSecure Endpoint Protection products fo…
- CVE-2020-35509A flaw was found in keycloak affecting versions 11.0.3 and 12.0.0.keycloak · org.keycloak:keycloak-core
- CVE-2021-3827A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed.keycloak · org.keycloak:keycloak-saml-core
- CVE-2021-3839A flaw was found in the vhost library in DPDK.dpdk
- CVE-2021-3764A memory leak flaw was found in the Linux kernel's ccp_run_aes_gcm_cmd() function that allows an attacker to cause a denial of service.Linux Kernel
- CVE-2021-3763A flaw was found in the Red Hat AMQ Broker management console in version 7.8 where an existing user is able to access some limited…AMQ Broker
- CVE-2021-3736A flaw was found in the Linux kernel.kernel
- CVE-2021-3714A flaw was found in the Linux kernels memory deduplication mechanism.kernel
- CVE-2021-3702A race condition flaw was found in ansible-runner, where an attacker could watch for rapid creation and deletion of a temporary directory…ansible-runner
- CVE-2021-3701A flaw was found in ansible-runner where the default temporary files configuration in ansible-2.0.0 are written to world R/W locations.ansible-runner
- CVE-2021-3690A flaw was found in Undertow.undertow · io.undertow:undertow-core
- CVE-2021-3670MaxQueryDuration not honoured in Samba AD DC LDAPsamba
- CVE-2021-3798A flaw was found in openCryptoki.opencryptoki
- CVE-2022-36389WordPress Better Messages plugin <= 1.9.9.148 - Cross-Site Request Forgery (CSRF) vulnerabilityWordPlus Better Messages
- CVE-2022-36405WordPress amCharts: Charts and Maps plugin <= 1.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityamCharts: Charts and Maps
- CVE-2022-36347WordPress Alpine PhotoTile for Pinterest plugin <= 1.3.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityAlpine Press Alpine PhotoTile for Pinterest
Show all 73 entriesShow fewer entries
- CVE-2022-36292WordPress Gallery PhotoBlocks plugin <= 1.2.6 - Cross-Site Request Forgery (CSRF) vulnerabilitiesWPChill Gallery PhotoBlocks
- CVE-2022-35726WordPress Video Gallery plugin <= 1.3.4.5 - Broken Authentication vulnerabilityyotuwp Video Gallery
- CVE-2022-36341WordPress AS – Create Pinterest Pinboard Pages plugin <= 1.0 - Authenticated plugin settings change leading to Stored Cross-Site Scripting…Akash soni AS – Create Pinterest Pinboard Pages
- CVE-2022-36288WordPress Download Manager plugin <= 3.2.48 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilitiesW3 Eden Download Manager
- CVE-2022-35235WordPress WPide plugin <= 2.6 - Authenticated Arbitrary File Read vulnerabilityXplodedThemes WPIDE – File Manager & Code Editor
- CVE-2022-36282WordPress Search Exclude plugin <= 1.2.6 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityRoman Pronskiy Search Exclude
- CVE-2022-34658WordPress Download Manager plugin <= 3.2.48 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilitiesW3 Eden Download Manager
- CVE-2022-35242WordPress THE Leads Management System: 59sec LITE plugin <= 3.4.1 - Unauthenticated plugin settings change vulnerabilityTHE Leads Management System: 59sec LITE
- CVE-2022-29476WordPress Notification Bar for WordPress plugin <= 1.1.8 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability8 Degree Themes Notification Bar for WordPress
- CVE-2022-34648WordPress Uploading SVG, WEBP and ICO files plugin <= 1.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilitydmitrylitvinov Uploading SVG, WEBP and ICO files
- CVE-2022-2965Improper Restriction of Rendered UI Layers or Frames in notrinos/notrinoserpnotrinos/notrinoserp
- CVE-2022-37111BlueCMS 1.6 has SQL injection in line 132 of admin/article.php
- CVE-2022-37112BlueCMS 1.6 has SQL injection in line 55 of admin/model.php
- CVE-2022-37113Bluecms 1.6 has SQL injection in line 132 of admin/area.php
- CVE-2022-37223JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/role/list.com.jflyfox:jflyfox_jfinal
- CVE-2022-37199JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/user/list.com.jflyfox:jflyfox_jfinal
- CVE-2022-36261An arbitrary file deletion vulnerability was discovered in taocms 3.0.2, that allows attacker to delete file in server when request url…
- CVE-2022-35203An access control issue in TrendNet TV-IP572PI v1.0 allows unauthenticated attackers to access sensitive system information.
- CVE-2021-42627The WAN configuration page "wan.htm" on D-Link DIR-615 devices with firmware 20.06 can be accessed directly without authentication which…
- CVE-2022-2956ConsoleTVs Noxen users.php cross site scriptingConsoleTVs Noxen
- CVE-2022-1989CODESYS Visualization vulnerable to user enumerationCODESYS Visualization
- CVE-2022-2796Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore
- CVE-2022-36350Stored cross-site scripting vulnerability in PukiWiki versions 1.3.1 to 1.5.3 allows a remote attacker to inject an arbitrary script via…PukiWiki Development Team PukiWiki
- CVE-2022-34486Path traversal vulnerability in PukiWiki versions 1.4.5 to 1.5.3 allows a remote authenticated attacker with an administrative privilege…PukiWiki Development Team PukiWiki
- CVE-2022-27637Reflected cross-site scripting vulnerability in PukiWiki versions 1.5.1 to 1.5.3 allows a remote attacker to inject an arbitrary script…PukiWiki Development Team PukiWiki
- CVE-2022-35733Missing authentication for critical function vulnerability in UNIMO Technology digital video recorders (UDR-JA1004/JA1008/JA1016 firmware…UNIMO Technology Co. UNIMO Technology digital video recorde…
- CVE-2020-35992Fiserv Prologue through 2020-12-16 does not properly protect the database password.
- CVE-2022-34919The file upload wizard in Zengenti Contensis Classic before 15.2.1.79 does not correctly check that a user has authenticated.
- CVE-2019-25075HTML injection combined with path traversal in the Email service in Gravitee API Management before 1.25.3 allows anonymous users to read…io.gravitee.apim:gravitee-api-management
- CVE-2021-42232TP-Link Archer A7 Archer A7(US)_V5_210519 is affected by a command injection vulnerability in /usr/bin/tddp.
- CVE-2022-33916OPC UA .NET Standard Reference Server 1.04.368 allows a remote attacker to cause the application to access sensitive information.OPCFoundation.NetStandard.Opc.Ua.Server
- CVE-2020-35511A global buffer overflow was discovered in pngcheck function in pngcheck-2.4.0(5 patches applied) via a crafted png file.pngcheck
- CVE-2021-20298A flaw was found in OpenEXR's B44Compressor.OpenEXR
- CVE-2021-20304A flaw was found in OpenEXR's hufDecode functionality.OpenEXR
- CVE-2021-20316A flaw was found in the way Samba handled file/directory metadata.samba
- CVE-2021-23177An improper link resolution flaw while extracting an archive can lead to changing the access control list (ACL) of the target of the link.libarchive
- CVE-2021-28861Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginnilibpython · python +1
- CVE-2021-31566An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags…libarchive
- CVE-2021-3759A memory overflow vulnerability was found in the Linux kernel’s ipc functionality of the memcg subsystem, in the way a user calls the semgetkernel
- CVE-2021-3800A flaw was found in glib before version 2.63.6.Glib
- CVE-2021-3905A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing.openvswitch
- CVE-2021-3975A use-after-free flaw was found in libvirt.libvirt
- CVE-2021-3995A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem.util-linux
- CVE-2021-3996A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem.util-linux
- CVE-2021-3997A flaw was found in systemd.systemd
- CVE-2022-2938A flaw was found in the Linux kernel's implementation of Pressure Stall Information.kernel
- CVE-2022-31676VMware Tools (12.0.0, 11.x.y and 10.x.y) contains a local privilege escalation vulnerability.VMware Tools
- CVE-2022-35278HTML Injection in ActiveMQ Artemis Web ConsoleApache Software Foundation Apache ActiveMQ Artemis · org.ap…