# CVEs published 2022-08-23

90 CVEs were published on August 23, 2022: 0 critical, 17 high. Days are UTC.

- [CVE-2022-38132](https://cve.now/CVE-2022-38132.md): Command injection vulnerability in Linksys MR8300 router while Registration to DDNS Service. By specifying username and password, an… (CVSS 8.2, Linksys MR8300 Router)
- [CVE-2021-3917](https://cve.now/CVE-2021-3917.md): A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. (no CVSS, coreos-installer)
- [CVE-2022-38463](https://cve.now/CVE-2022-38463.md): ServiceNow through San Diego Patch 4b and Patch 6 allows reflected XSS in the logout functionality. (no CVSS)
- [CVE-2022-38172](https://cve.now/CVE-2022-38172.md): ServiceNow through San Diego Patch 3 allows XSS via the name field during creation of a new dashboard for the Performance Analytics… (no CVSS)
- [CVE-2022-35115](https://cve.now/CVE-2022-35115.md): IceWarp WebClient DC2 - Update 2 Build 9 (13.0.2.9) was discovered to contain a SQL injection vulnerability via the search parameter at… (no CVSS)
- [CVE-2022-1513](https://cve.now/CVE-2022-1513.md): A potential vulnerability was reported in Lenovo PCManager prior to version 5.0.10.4191 that may allow code execution when visiting a… (CVSS 7.3, Lenovo PCManager)
- [CVE-2022-38665](https://cve.now/CVE-2022-38665.md): Jenkins CollabNet Plugins Plugin 2.0.8 and earlier stores a RabbitMQ password unencrypted in its global configuration file on the Jenkins… (no CVSS, Jenkins project Jenkins CollabNet Plugins Plugin · org.jenk…)
- [CVE-2022-38664](https://cve.now/CVE-2022-38664.md): Jenkins Job Configuration History Plugin 1165.v8cc9fd1f4597 and earlier does not escape the job name on the System Configuration History… (no CVSS, Jenkins project Jenkins Job Configuration History Plugin ·…)
- [CVE-2022-38663](https://cve.now/CVE-2022-38663.md): Jenkins Git Plugin 4.11.4 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log provided by the… (no CVSS, Jenkins project Jenkins Git Plugin · org.jenkins-ci.plugins…)
- [CVE-2022-37428](https://cve.now/CVE-2022-37428.md): PowerDNS Recursor up to and including 4.5.9, 4.6.2 and 4.7.1, when protobuf logging is enabled, has Improper Cleanup upon a Thrown… (CVSS 6.5)
- [CVE-2022-28883](https://cve.now/CVE-2022-28883.md): Denial-of-Service (DoS) Vulnerability (CVSS 3.5, All F-Secure and WithSecure Endpoint Protection products fo…)
- [CVE-2022-28882](https://cve.now/CVE-2022-28882.md): Denial-of-Service (DoS) Vulnerability (CVSS 4.3, All F-Secure and WithSecure Endpoint Protection products fo…)
- [CVE-2020-35509](https://cve.now/CVE-2020-35509.md): A flaw was found in keycloak affecting versions 11.0.3 and 12.0.0. (CVSS 5.4, keycloak · org.keycloak:keycloak-core)
- [CVE-2021-3827](https://cve.now/CVE-2021-3827.md): A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed. (no CVSS, keycloak · org.keycloak:keycloak-saml-core)
- [CVE-2021-3839](https://cve.now/CVE-2021-3839.md): A flaw was found in the vhost library in DPDK. (no CVSS, dpdk)
- [CVE-2021-3764](https://cve.now/CVE-2021-3764.md): A memory leak flaw was found in the Linux kernel's ccp\_run\_aes\_gcm\_cmd() function that allows an attacker to cause a denial of service. (no CVSS, Linux Kernel)
- [CVE-2021-3763](https://cve.now/CVE-2021-3763.md): A flaw was found in the Red Hat AMQ Broker management console in version 7.8 where an existing user is able to access some limited… (no CVSS, AMQ Broker)
- [CVE-2021-3736](https://cve.now/CVE-2021-3736.md): A flaw was found in the Linux kernel. (no CVSS, kernel)
- [CVE-2021-3714](https://cve.now/CVE-2021-3714.md): A flaw was found in the Linux kernels memory deduplication mechanism. (no CVSS, kernel)
- [CVE-2021-3702](https://cve.now/CVE-2021-3702.md): A race condition flaw was found in ansible-runner, where an attacker could watch for rapid creation and deletion of a temporary directory… (no CVSS, ansible-runner)
- [CVE-2021-3701](https://cve.now/CVE-2021-3701.md): A flaw was found in ansible-runner where the default temporary files configuration in ansible-2.0.0 are written to world R/W locations. (no CVSS, ansible-runner)
- [CVE-2021-3690](https://cve.now/CVE-2021-3690.md): A flaw was found in Undertow. (no CVSS, undertow · io.undertow:undertow-core)
- [CVE-2021-3670](https://cve.now/CVE-2021-3670.md): MaxQueryDuration not honoured in Samba AD DC LDAP (no CVSS, samba)
- [CVE-2021-3798](https://cve.now/CVE-2021-3798.md): A flaw was found in openCryptoki. (no CVSS, opencryptoki)
- [CVE-2022-36389](https://cve.now/CVE-2022-36389.md): WordPress Better Messages plugin \<= 1.9.9.148 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 4.3, WordPlus Better Messages)
- [CVE-2022-36405](https://cve.now/CVE-2022-36405.md): WordPress amCharts: Charts and Maps plugin \<= 1.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 5.4, amCharts: Charts and Maps)
- [CVE-2022-36347](https://cve.now/CVE-2022-36347.md): WordPress Alpine PhotoTile for Pinterest plugin \<= 1.3.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, Alpine Press Alpine PhotoTile for Pinterest)
- [CVE-2022-36292](https://cve.now/CVE-2022-36292.md): WordPress Gallery PhotoBlocks plugin \<= 1.2.6 - Cross-Site Request Forgery (CSRF) vulnerabilities (CVSS 5.4, WPChill Gallery PhotoBlocks)
- [CVE-2022-36285](https://cve.now/CVE-2022-36285.md): WordPress Uploading SVG, WEBP and ICO files plugin \<= 1.0.1 - Authenticated Arbitrary File Upload vulnerability (CVSS 7.2, dmitrylitvinov Uploading SVG, WEBP and ICO files)
- [CVE-2022-35726](https://cve.now/CVE-2022-35726.md): WordPress Video Gallery plugin \<= 1.3.4.5 - Broken Authentication vulnerability (CVSS 4.3, yotuwp Video Gallery)
- [CVE-2022-36379](https://cve.now/CVE-2022-36379.md): WordPress ЮKassa для WooCommerce plugin \<= 2.3.0 - Cross-Site Request Forgery (CSRF) leading to plugin settings update (CVSS 8.8, YooMoney ЮKassa для WooCommerce)
- [CVE-2022-36394](https://cve.now/CVE-2022-36394.md): WordPress Contest Gallery plugin \<= 17.0.4 - Authenticated SQL Injection (SQLi) vulnerability (CVSS 7.6, Contest Gallery)
- [CVE-2022-36341](https://cve.now/CVE-2022-36341.md): WordPress AS – Create Pinterest Pinboard Pages plugin \<= 1.0 - Authenticated plugin settings change leading to Stored Cross-Site Scripting… (CVSS 5.4, Akash soni AS – Create Pinterest Pinboard Pages)
- [CVE-2022-36288](https://cve.now/CVE-2022-36288.md): WordPress Download Manager plugin \<= 3.2.48 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities (CVSS 5.4, W3 Eden Download Manager)
- [CVE-2022-35235](https://cve.now/CVE-2022-35235.md): WordPress WPide plugin \<= 2.6 - Authenticated Arbitrary File Read vulnerability (CVSS 4.9, XplodedThemes WPIDE – File Manager & Code Editor)
- [CVE-2022-36282](https://cve.now/CVE-2022-36282.md): WordPress Search Exclude plugin \<= 1.2.6 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, Roman Pronskiy Search Exclude)
- [CVE-2022-34658](https://cve.now/CVE-2022-34658.md): WordPress Download Manager plugin \<= 3.2.48 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities (CVSS 5.4, W3 Eden Download Manager)
- [CVE-2022-33142](https://cve.now/CVE-2022-33142.md): WordPress Better Messages plugin \<= 1.9.10.57 - Denial Of Service (DoS) vulnerability (CVSS 7.7, WordPlus Better Messages)
- [CVE-2022-34868](https://cve.now/CVE-2022-34868.md): WordPress ЮKassa для WooCommerce plugin \<= 2.3.0 - Authenticated Arbitrary Settings Update vulnerability (CVSS 8.8, YooMoney ЮKassa для WooCommerce)
- [CVE-2022-35242](https://cve.now/CVE-2022-35242.md): WordPress THE Leads Management System: 59sec LITE plugin \<= 3.4.1 - Unauthenticated plugin settings change vulnerability (CVSS 6.5, THE Leads Management System: 59sec LITE)
- [CVE-2022-29476](https://cve.now/CVE-2022-29476.md): WordPress Notification Bar for WordPress plugin \<= 1.1.8 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 6.1, 8 Degree Themes Notification Bar for WordPress)
- [CVE-2022-34648](https://cve.now/CVE-2022-34648.md): WordPress Uploading SVG, WEBP and ICO files plugin \<= 1.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, dmitrylitvinov Uploading SVG, WEBP and ICO files)
- [CVE-2022-2965](https://cve.now/CVE-2022-2965.md): Improper Restriction of Rendered UI Layers or Frames in notrinos/notrinoserp (CVSS 6.4, notrinos/notrinoserp)
- [CVE-2022-37111](https://cve.now/CVE-2022-37111.md): BlueCMS 1.6 has SQL injection in line 132 of admin/article.php (no CVSS)
- [CVE-2022-37112](https://cve.now/CVE-2022-37112.md): BlueCMS 1.6 has SQL injection in line 55 of admin/model.php (no CVSS)
- [CVE-2022-37113](https://cve.now/CVE-2022-37113.md): Bluecms 1.6 has SQL injection in line 132 of admin/area.php (no CVSS)
- [CVE-2022-37223](https://cve.now/CVE-2022-37223.md): JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal\_cms/system/role/list. (no CVSS, com.jflyfox:jflyfox\_jfinal)
- [CVE-2022-37199](https://cve.now/CVE-2022-37199.md): JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal\_cms/system/user/list. (no CVSS, com.jflyfox:jflyfox\_jfinal)
- [CVE-2022-36261](https://cve.now/CVE-2022-36261.md): An arbitrary file deletion vulnerability was discovered in taocms 3.0.2, that allows attacker to delete file in server when request url… (no CVSS)
- [CVE-2022-35203](https://cve.now/CVE-2022-35203.md): An access control issue in TrendNet TV-IP572PI v1.0 allows unauthenticated attackers to access sensitive system information. (no CVSS)
- [CVE-2021-42627](https://cve.now/CVE-2021-42627.md): The WAN configuration page "wan.htm" on D-Link DIR-615 devices with firmware 20.06 can be accessed directly without authentication which… (no CVSS)
- [CVE-2022-2956](https://cve.now/CVE-2022-2956.md): ConsoleTVs Noxen users.php cross site scripting (CVSS 3.5, ConsoleTVs Noxen)
- [CVE-2022-1989](https://cve.now/CVE-2022-1989.md): CODESYS Visualization vulnerable to user enumeration (CVSS 5.3, CODESYS Visualization)
- [CVE-2022-2796](https://cve.now/CVE-2022-2796.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 6.7, pimcore/pimcore)
- [CVE-2022-36350](https://cve.now/CVE-2022-36350.md): Stored cross-site scripting vulnerability in PukiWiki versions 1.3.1 to 1.5.3 allows a remote attacker to inject an arbitrary script via… (CVSS 6.1, PukiWiki Development Team PukiWiki)
- [CVE-2022-34486](https://cve.now/CVE-2022-34486.md): Path traversal vulnerability in PukiWiki versions 1.4.5 to 1.5.3 allows a remote authenticated attacker with an administrative privilege… (no CVSS, PukiWiki Development Team PukiWiki)
- [CVE-2022-27637](https://cve.now/CVE-2022-27637.md): Reflected cross-site scripting vulnerability in PukiWiki versions 1.5.1 to 1.5.3 allows a remote attacker to inject an arbitrary script… (no CVSS, PukiWiki Development Team PukiWiki)
- [CVE-2022-24381](https://cve.now/CVE-2022-24381.md): Denial of Service (DoS) (CVSS 7.5, ASNeG/OpcUaStack)
- [CVE-2022-25888](https://cve.now/CVE-2022-25888.md): Denial of Service (DoS) (CVSS 7.5, opcua)
- [CVE-2022-25761](https://cve.now/CVE-2022-25761.md): Denial of Service (DoS) (CVSS 7.5, open62541/open62541)
- [CVE-2022-24298](https://cve.now/CVE-2022-24298.md): Denial of Service (DoS) (CVSS 7.5, FreeOpcUa/freeopcua)
- [CVE-2022-21208](https://cve.now/CVE-2022-21208.md): Denial of Service (DoS) (CVSS 7.5, node-opcua)
- [CVE-2022-25231](https://cve.now/CVE-2022-25231.md): Denial of Service (DoS) (CVSS 7.5, node-opcua)
- [CVE-2022-25304](https://cve.now/CVE-2022-25304.md): Denial of Service (DoS) (CVSS 7.5, opcua · asyncua)
- [CVE-2022-25302](https://cve.now/CVE-2022-25302.md): Denial of Service (DoS) (CVSS 7.5, ASNeG/OpcUaStack)
- [CVE-2022-2829](https://cve.now/CVE-2022-2829.md): Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm (CVSS 8.8, yetiforcecompany/yetiforcecrm)
- [CVE-2022-35733](https://cve.now/CVE-2022-35733.md): Missing authentication for critical function vulnerability in UNIMO Technology digital video recorders (UDR-JA1004/JA1008/JA1016 firmware… (no CVSS, UNIMO Technology Co. UNIMO Technology digital video recorde…)
- [CVE-2020-35992](https://cve.now/CVE-2020-35992.md): Fiserv Prologue through 2020-12-16 does not properly protect the database password. (no CVSS)
- [CVE-2022-34919](https://cve.now/CVE-2022-34919.md): The file upload wizard in Zengenti Contensis Classic before 15.2.1.79 does not correctly check that a user has authenticated. (no CVSS)
- [CVE-2019-25075](https://cve.now/CVE-2019-25075.md): HTML injection combined with path traversal in the Email service in Gravitee API Management before 1.25.3 allows anonymous users to read… (no CVSS, io.gravitee.apim:gravitee-api-management)
- [CVE-2021-42232](https://cve.now/CVE-2021-42232.md): TP-Link Archer A7 Archer A7(US)\_V5\_210519 is affected by a command injection vulnerability in /usr/bin/tddp. (no CVSS)
- [CVE-2022-33916](https://cve.now/CVE-2022-33916.md): OPC UA .NET Standard Reference Server 1.04.368 allows a remote attacker to cause the application to access sensitive information. (no CVSS, OPCFoundation.NetStandard.Opc.Ua.Server)
- [CVE-2020-35511](https://cve.now/CVE-2020-35511.md): A global buffer overflow was discovered in pngcheck function in pngcheck-2.4.0(5 patches applied) via a crafted png file. (no CVSS, pngcheck)
- [CVE-2021-20298](https://cve.now/CVE-2021-20298.md): A flaw was found in OpenEXR's B44Compressor. (no CVSS, OpenEXR)
- [CVE-2021-20304](https://cve.now/CVE-2021-20304.md): A flaw was found in OpenEXR's hufDecode functionality. (no CVSS, OpenEXR)
- [CVE-2021-20316](https://cve.now/CVE-2021-20316.md): A flaw was found in the way Samba handled file/directory metadata. (no CVSS, samba)
- [CVE-2021-23177](https://cve.now/CVE-2021-23177.md): An improper link resolution flaw while extracting an archive can lead to changing the access control list (ACL) of the target of the link. (no CVSS, libarchive)
- [CVE-2021-28861](https://cve.now/CVE-2021-28861.md): Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginni (CVSS 6.5, libpython · python +1)
- [CVE-2021-31566](https://cve.now/CVE-2021-31566.md): An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags… (no CVSS, libarchive)
- [CVE-2021-3759](https://cve.now/CVE-2021-3759.md): A memory overflow vulnerability was found in the Linux kernel’s ipc functionality of the memcg subsystem, in the way a user calls the semget (no CVSS, kernel)
- [CVE-2021-3800](https://cve.now/CVE-2021-3800.md): A flaw was found in glib before version 2.63.6. (no CVSS, Glib)
- [CVE-2021-3905](https://cve.now/CVE-2021-3905.md): A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. (no CVSS, openvswitch)
- [CVE-2021-3975](https://cve.now/CVE-2021-3975.md): A use-after-free flaw was found in libvirt. (no CVSS, libvirt)
- [CVE-2021-3995](https://cve.now/CVE-2021-3995.md): A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. (no CVSS, util-linux)
- [CVE-2021-3996](https://cve.now/CVE-2021-3996.md): A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. (CVSS 5.5, util-linux)
- [CVE-2021-3997](https://cve.now/CVE-2021-3997.md): A flaw was found in systemd. (no CVSS, systemd)
- [CVE-2022-2938](https://cve.now/CVE-2022-2938.md): A flaw was found in the Linux kernel's implementation of Pressure Stall Information. (no CVSS, kernel)
- [CVE-2022-2946](https://cve.now/CVE-2022-2946.md): Use After Free in vim/vim (CVSS 7.8, vim/vim)
- [CVE-2022-31676](https://cve.now/CVE-2022-31676.md): VMware Tools (12.0.0, 11.x.y and 10.x.y) contains a local privilege escalation vulnerability. (no CVSS, VMware Tools)
- [CVE-2022-35278](https://cve.now/CVE-2022-35278.md): HTML Injection in ActiveMQ Artemis Web Console (no CVSS, Apache Software Foundation Apache ActiveMQ Artemis · org.ap…)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2022-08-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.