CVEs published August 26, 2022
56 CVEs were published on August 26, 2022: 0 critical, 2 high. 1 is now in CISA KEV.
- Published
- 56
- Critical
- 0
- High
- 2
- Medium
- 1
- Low
- 0
- Unrated
- 53
- Now in CISA KEV
- 1
- Fix available
- 8
Most affected products
- kernel
- 4
- keycloak · org.keycloak:keycloak-core
- 3
- QEMU
- 2
- Deluge-web · deluge
- 1
- foreman
- 1
- IBM DataPower Gateway
- 1
- IBM Maximo Asset Management
- 1
- ImageMagick
- 1
- keycloak · org.keycloak:keycloak-services
- 1
- keystone
- 1
High 2
- CVE-2022-31773IBM DataPower Gateway V10CD, 10.0.1, and 2018.4.1 is vulnerable to cross-site request forgery which could allow an attacker to execute…IBM DataPower Gateway
- CVE-2022-36537ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent org.zkoss.zk:zk
Medium, low and unrated 54
- CVE-2022-36548Edoc-doctor-appointment-system v1.0.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability at /patient/settings.php.
- CVE-2022-36546Edoc-doctor-appointment-system v1.0.1 was discovered to contain a Cross-Site Request Forgery (CSRF) via /patient/settings.php.
- CVE-2022-36547Edoc-doctor-appointment-system v1.0.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability at /patient/index.php.
- CVE-2022-36545Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/settings.php.
- CVE-2022-36543Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/doctors.php.
- CVE-2022-36544Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/booking.php.
- CVE-2022-36542An access control issue in the component /ip/admin/ of Edoc-doctor-appointment-system v1.0.1 allows attackers to arbitrarily edit, read…
- CVE-2022-2915A Heap-based Buffer Overflow vulnerability in the SonicWall SMA100 appliance allows a remote authenticated attacker to cause Denial of…SonicWall SMA100
- CVE-2022-36529Kensite CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities via the name and oldname parameters at…
- CVE-2022-36522Mikrotik RouterOs through stable v6.48.3 was discovered to contain an assertion failure in the component /advanced-tools/nova/bin/netwatch.
- CVE-2022-0207A race condition was found in vdsm.vdsm
- CVE-2022-0217It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in…prosody
- CVE-2022-0084A flaw was found in XNIO, specifically in the notifyReadClosed method.xnio · org.jboss.xnio:xnio-all
- CVE-2022-0168A denial of service (DOS) issue was found in the Linux kernel’s smb2_ioctl_query_info function in the fs/cifs/smb2ops.c Common Internet…kernel
- CVE-2022-0225A flaw was found in Keycloak.keycloak · org.keycloak:keycloak-core
- CVE-2022-35714IBM Maximo Asset Management 7.6.1 is vulnerable to cross-site scripting.IBM Maximo Asset Management
- CVE-2021-4216A Floating point exception (division-by-zero) flaw was found in Mupdf for zero width pages in muraster.c.mupdf
- CVE-2022-25625A malicious unauthorized PAM user can access the administration configuration data and change the values.Symantec Privileged Access Management
- CVE-2021-3414A flaw was found in satellite.satellite
- CVE-2021-3563A flaw was found in openstack-keystone.keystone
- CVE-2021-3585A flaw was found in openstack-tripleo-heat-templates.openstack/tripleo-heat-templates.
- CVE-2021-3632A flaw was found in Keycloak.keycloak · org.keycloak:keycloak-core
- CVE-2021-3644A flaw was found in wildfly-core in all versions.wildfly-core · org.wildfly.core:wildfly-server
- CVE-2021-3669A flaw was found in the Linux kernel.kernel
- CVE-2021-3688A flaw was found in Red Hat JBoss Core Services HTTP Server in all versions, where it does not properly normalize the path component of a…Red Hat JBCS HTTP Server
Show all 54 entriesShow fewer entries
- CVE-2021-3703It was found that the CVE-2021-27918, CVE-2021-31525 and CVE-2021-33196 have been incorrectly mentioned as fixed in RHSA for Serverless…Serverless
- CVE-2021-3735A deadlock issue was found in the AHCI controller device of QEMU.QEMU
- CVE-2021-3754A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user.keycloak · org.keycloak:keycloak-services
- CVE-2021-20260A flaw was found in the Foreman project.foreman
- CVE-2021-3856ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader.keycloak · org.keycloak:keycloak-core
- CVE-2021-3864A flaw was found in the way the dumpable flag setting was handled when certain SUID binaries executed its descendants.kernel
- CVE-2022-36521Insecure permissions in cskefu v7.0.1 allows unauthenticated attackers to arbitrarily add administrator accounts.
- CVE-2022-36681Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at…
- CVE-2021-39394mm-wiki v0.2.1 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add user accounts and…
- CVE-2022-36683Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at…
- CVE-2022-36682Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at…
- CVE-2022-36680Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at…
- CVE-2022-36679Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at…
- CVE-2021-40285htmly v2.8.1 was discovered to contain an arbitrary file deletion vulnerability via the component \views\backup.html.php.
- CVE-2022-36678Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at…
- CVE-2021-39393mm-wiki v0.2.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the markdown editor.
- CVE-2022-37151There is an unauthorized access vulnerability in Online Diagnostic Lab Management System 1.0.
- CVE-2022-37152An issue was discovered in Online Diagnostic Lab Management System 1.0, There is a SQL injection vulnerability via "dob" parameter in…
- CVE-2022-37150An issue was discovered in Online Diagnostic Lab Management System 1.0.
- CVE-2021-3427The Deluge Web-UI is vulnerable to XSS through a crafted torrent file.Deluge-web · deluge
- CVE-2021-3574A vulnerability was found in ImageMagick-7.0.11-5, where executing a crafted file with the convert command, ASAN detects memory leaks.ImageMagick
- CVE-2021-35939It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of…RPM
- CVE-2021-3859A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2.undertow · io.undertow:undertow-core
- CVE-2022-0171A flaw was found in the Linux kernel.kernel
- CVE-2022-0175A flaw was found in the VirGL virtual OpenGL renderer (virglrenderer).virglrenderer
- CVE-2022-0216A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU.QEMU
- CVE-2022-34301A flaw was found in CryptoPro Secure Disk bootloaders before 2022-06-01.
- CVE-2022-34302A flaw was found in New Horizon Datasys bootloaders before 2022-06-01.
- CVE-2022-34303A flaw was found in Eurosoft bootloaders before 2022-06-01.