# CVEs published 2022-08-26

56 CVEs were published on August 26, 2022: 0 critical, 2 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2022-36548](https://cve.now/CVE-2022-36548.md): Edoc-doctor-appointment-system v1.0.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability at /patient/settings.php. (no CVSS)
- [CVE-2022-36546](https://cve.now/CVE-2022-36546.md): Edoc-doctor-appointment-system v1.0.1 was discovered to contain a Cross-Site Request Forgery (CSRF) via /patient/settings.php. (no CVSS)
- [CVE-2022-36547](https://cve.now/CVE-2022-36547.md): Edoc-doctor-appointment-system v1.0.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability at /patient/index.php. (no CVSS)
- [CVE-2022-36545](https://cve.now/CVE-2022-36545.md): Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/settings.php. (no CVSS)
- [CVE-2022-36543](https://cve.now/CVE-2022-36543.md): Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/doctors.php. (no CVSS)
- [CVE-2022-36544](https://cve.now/CVE-2022-36544.md): Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/booking.php. (no CVSS)
- [CVE-2022-36542](https://cve.now/CVE-2022-36542.md): An access control issue in the component /ip/admin/ of Edoc-doctor-appointment-system v1.0.1 allows attackers to arbitrarily edit, read… (no CVSS)
- [CVE-2022-2915](https://cve.now/CVE-2022-2915.md): A Heap-based Buffer Overflow vulnerability in the SonicWall SMA100 appliance allows a remote authenticated attacker to cause Denial of… (no CVSS, SonicWall SMA100)
- [CVE-2022-36529](https://cve.now/CVE-2022-36529.md): Kensite CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities via the name and oldname parameters at… (no CVSS)
- [CVE-2022-36522](https://cve.now/CVE-2022-36522.md): Mikrotik RouterOs through stable v6.48.3 was discovered to contain an assertion failure in the component /advanced-tools/nova/bin/netwatch. (no CVSS)
- [CVE-2022-0207](https://cve.now/CVE-2022-0207.md): A race condition was found in vdsm. (no CVSS, vdsm)
- [CVE-2022-0217](https://cve.now/CVE-2022-0217.md): It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in… (no CVSS, prosody)
- [CVE-2022-0084](https://cve.now/CVE-2022-0084.md): A flaw was found in XNIO, specifically in the notifyReadClosed method. (no CVSS, xnio · org.jboss.xnio:xnio-all)
- [CVE-2022-0168](https://cve.now/CVE-2022-0168.md): A denial of service (DOS) issue was found in the Linux kernel’s smb2\_ioctl\_query\_info function in the fs/cifs/smb2ops.c Common Internet… (no CVSS, kernel)
- [CVE-2022-0225](https://cve.now/CVE-2022-0225.md): A flaw was found in Keycloak. (no CVSS, keycloak · org.keycloak:keycloak-core)
- [CVE-2022-35714](https://cve.now/CVE-2022-35714.md): IBM Maximo Asset Management 7.6.1 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Maximo Asset Management)
- [CVE-2022-31773](https://cve.now/CVE-2022-31773.md): IBM DataPower Gateway V10CD, 10.0.1, and 2018.4.1 is vulnerable to cross-site request forgery which could allow an attacker to execute… (CVSS 8.8, IBM DataPower Gateway)
- [CVE-2021-4216](https://cve.now/CVE-2021-4216.md): A Floating point exception (division-by-zero) flaw was found in Mupdf for zero width pages in muraster.c. (no CVSS, mupdf)
- [CVE-2022-25625](https://cve.now/CVE-2022-25625.md): A malicious unauthorized PAM user can access the administration configuration data and change the values. (no CVSS, Symantec Privileged Access Management)
- [CVE-2021-3414](https://cve.now/CVE-2021-3414.md): A flaw was found in satellite. (no CVSS, satellite)
- [CVE-2021-3563](https://cve.now/CVE-2021-3563.md): A flaw was found in openstack-keystone. (no CVSS, keystone)
- [CVE-2021-3585](https://cve.now/CVE-2021-3585.md): A flaw was found in openstack-tripleo-heat-templates. (no CVSS, openstack/tripleo-heat-templates.)
- [CVE-2021-3632](https://cve.now/CVE-2021-3632.md): A flaw was found in Keycloak. (no CVSS, keycloak · org.keycloak:keycloak-core)
- [CVE-2021-3644](https://cve.now/CVE-2021-3644.md): A flaw was found in wildfly-core in all versions. (no CVSS, wildfly-core · org.wildfly.core:wildfly-server)
- [CVE-2021-3669](https://cve.now/CVE-2021-3669.md): A flaw was found in the Linux kernel. (no CVSS, kernel)
- [CVE-2021-3688](https://cve.now/CVE-2021-3688.md): A flaw was found in Red Hat JBoss Core Services HTTP Server in all versions, where it does not properly normalize the path component of a… (no CVSS, Red Hat JBCS HTTP Server)
- [CVE-2021-3703](https://cve.now/CVE-2021-3703.md): It was found that the CVE-2021-27918, CVE-2021-31525 and CVE-2021-33196 have been incorrectly mentioned as fixed in RHSA for Serverless… (no CVSS, Serverless)
- [CVE-2021-3735](https://cve.now/CVE-2021-3735.md): A deadlock issue was found in the AHCI controller device of QEMU. (no CVSS, QEMU)
- [CVE-2021-3754](https://cve.now/CVE-2021-3754.md): A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user. (no CVSS, keycloak · org.keycloak:keycloak-services)
- [CVE-2021-20260](https://cve.now/CVE-2021-20260.md): A flaw was found in the Foreman project. (no CVSS, foreman)
- [CVE-2021-3856](https://cve.now/CVE-2021-3856.md): ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. (no CVSS, keycloak · org.keycloak:keycloak-core)
- [CVE-2021-3864](https://cve.now/CVE-2021-3864.md): A flaw was found in the way the dumpable flag setting was handled when certain SUID binaries executed its descendants. (no CVSS, kernel)
- [CVE-2022-36521](https://cve.now/CVE-2022-36521.md): Insecure permissions in cskefu v7.0.1 allows unauthenticated attackers to arbitrarily add administrator accounts. (no CVSS)
- [CVE-2022-36681](https://cve.now/CVE-2022-36681.md): Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at… (no CVSS)
- [CVE-2021-39394](https://cve.now/CVE-2021-39394.md): mm-wiki v0.2.1 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add user accounts and… (no CVSS)
- [CVE-2022-36683](https://cve.now/CVE-2022-36683.md): Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at… (no CVSS)
- [CVE-2022-36682](https://cve.now/CVE-2022-36682.md): Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at… (no CVSS)
- [CVE-2022-36680](https://cve.now/CVE-2022-36680.md): Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at… (no CVSS)
- [CVE-2022-36679](https://cve.now/CVE-2022-36679.md): Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at… (no CVSS)
- [CVE-2021-40285](https://cve.now/CVE-2021-40285.md): htmly v2.8.1 was discovered to contain an arbitrary file deletion vulnerability via the component \\views\\backup.html.php. (no CVSS)
- [CVE-2022-36678](https://cve.now/CVE-2022-36678.md): Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at… (no CVSS)
- [CVE-2021-39393](https://cve.now/CVE-2021-39393.md): mm-wiki v0.2.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the markdown editor. (no CVSS)
- [CVE-2022-37151](https://cve.now/CVE-2022-37151.md): There is an unauthorized access vulnerability in Online Diagnostic Lab Management System 1.0. (no CVSS)
- [CVE-2022-37152](https://cve.now/CVE-2022-37152.md): An issue was discovered in Online Diagnostic Lab Management System 1.0, There is a SQL injection vulnerability via "dob" parameter in… (no CVSS)
- [CVE-2022-37150](https://cve.now/CVE-2022-37150.md): An issue was discovered in Online Diagnostic Lab Management System 1.0. (no CVSS)
- [CVE-2021-3427](https://cve.now/CVE-2021-3427.md): The Deluge Web-UI is vulnerable to XSS through a crafted torrent file. (no CVSS, Deluge-web · deluge)
- [CVE-2021-3574](https://cve.now/CVE-2021-3574.md): A vulnerability was found in ImageMagick-7.0.11-5, where executing a crafted file with the convert command, ASAN detects memory leaks. (no CVSS, ImageMagick)
- [CVE-2021-35939](https://cve.now/CVE-2021-35939.md): It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of… (no CVSS, RPM)
- [CVE-2021-3859](https://cve.now/CVE-2021-3859.md): A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. (no CVSS, undertow · io.undertow:undertow-core)
- [CVE-2022-0171](https://cve.now/CVE-2022-0171.md): A flaw was found in the Linux kernel. (no CVSS, kernel)
- [CVE-2022-0175](https://cve.now/CVE-2022-0175.md): A flaw was found in the VirGL virtual OpenGL renderer (virglrenderer). (no CVSS, virglrenderer)
- [CVE-2022-0216](https://cve.now/CVE-2022-0216.md): A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. (no CVSS, QEMU)
- [CVE-2022-34301](https://cve.now/CVE-2022-34301.md): A flaw was found in CryptoPro Secure Disk bootloaders before 2022-06-01. (no CVSS)
- [CVE-2022-34302](https://cve.now/CVE-2022-34302.md): A flaw was found in New Horizon Datasys bootloaders before 2022-06-01. (no CVSS)
- [CVE-2022-34303](https://cve.now/CVE-2022-34303.md): A flaw was found in Eurosoft bootloaders before 2022-06-01. (no CVSS)
- [CVE-2022-36537](https://cve.now/CVE-2022-36537.md): ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent (CVSS 7.5, KEV, org.zkoss.zk:zk)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2022-08-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.