CVEs published August 2, 2022
53 CVEs were published on August 2, 2022: 8 critical, 9 high.
- Published
- 53
- Critical
- 8
- High
- 9
- Medium
- 8
- Low
- 0
- Unrated
- 28
- Now in CISA KEV
- 0
- Fix available
- 10
Most affected products
- NHI card’s web service component
- 3
- TEAMPLUS TECHNOLOGY Teamplus Pro
- 2
- TIBCO Software TIBCO iWay Service Manager
- 2
- bookwyrm-social bookwyrm
- 1
- curljs
- 1
- EasyUse MailHunter Ultimate
- 1
- Flask-Security
- 1
- get-npm-package-version
- 1
- gitblame
- 1
- GitHub Enterprise Server
- 1
Critical 8
- CVE-2022-35924Verification requests (magic link) sent to unwanted emailsnextauthjs next-auth · next-auth
- CVE-2022-2631Improper Access Control in tooljet/tooljettooljet/tooljet
- CVE-2022-35223EasyUse MailHunter Ultimate - Deserialization of Untrusted DataEasyUse MailHunter Ultimate
- CVE-2020-28423Command Injectionmonorepo-build
- CVE-2020-28434Command Injectiongitblame
- CVE-2020-28437Command Injectionheroku-env
- CVE-2020-28451Command Injectionimage-tiler
- CVE-2020-28453Command Injectionnpos-tesseract
High 9
- CVE-2022-35923Inefficient Regular Expression Complexity in v8nimbrn · v8n
- CVE-2022-30571TIBCO iWay Service Manager Reflected Cross Site Scripting (XSS) VulnerabilityTIBCO Software TIBCO iWay Service Manager
- CVE-2022-35220TEAMPLUS TECHNOLOGY INC. Teamplus Pro - Allocation of Resources Without Limits or Throttling-1TEAMPLUS TECHNOLOGY Teamplus Pro
- CVE-2022-25867NULL Pointer Dereferenceio.socket:socket.io-client
- CVE-2020-28424Command Injections3-kilatstorage
- CVE-2020-28425Command Injectioncurljs
- CVE-2020-28433Command Injectionnode-latex-pdf
- CVE-2020-7795Command Injectionget-npm-package-version
- CVE-2022-35217NHI card’s web service component - Stack-based Buffer Overflow-1NHI card’s web service component
Medium, low and unrated 36
- CVE-2022-33917An issue was discovered in the Arm Mali GPU Kernel Driver (Valhall r29p0 through r38p0).
- CVE-2022-36968In Progress WS_FTP Server prior to version 8.7.3, forms within the administrative interface did not include a nonce to mitigate the risk of
- CVE-2022-36967In Progress WS_FTP Server prior to version 8.7.3, multiple reflected cross-site scripting (XSS) vulnerabilities exist in the administrative
- CVE-2022-34619A stored cross-site scripting (XSS) vulnerability in Mealie v0.5.5 allows attackers to execute arbitrary web scripts or HTML via a crafted p
- CVE-2022-29807A SQL injection vulnerability exists within Quest KACE Systems Management Appliance (SMA) through 12.0 that can allow for remote code execut
- CVE-2022-30285In Quest KACE Systems Management Appliance (SMA) through 12.0, a hash collision is possible during authentication.
- CVE-2022-29808In Quest KACE Systems Management Appliance (SMA) through 12.0, predictable token generation occurs when appliance linking is enabled.
- CVE-2022-35925Missing rate limit in Authentication in bookwyrmbookwyrm-social bookwyrm
- CVE-2022-34924Lanling OA Landray Office Automation (OA) internal patch number #133383/#137780 contains an arbitrary file read vulnerability via the compon
- CVE-2022-30572TIBCO iWay Service Manager Directory Traversal VulnerabilityTIBCO Software TIBCO iWay Service Manager
- CVE-2022-23733Stored XSS vulnerability in GitHub Enterprise Server leading to injection of arbitrary attributesGitHub Enterprise Server
- CVE-2022-1293XSS vulnerability in CitadelThales Citadel Web Client · Thales Citadel Macosx Deskto… +1
- CVE-2022-35222HiCOS Citizen verification component - Stack Buffer OverflowHINET HiCOS Citizen verification component - Stack Buffer O…
- CVE-2022-35221TEAMPLUS TECHNOLOGY INC. Teamplus Pro - Allocation of Resources Without Limits or Throttling-2TEAMPLUS TECHNOLOGY Teamplus Pro
- CVE-2022-35219NHI card’s web service component - Stack-based Buffer Overflow-2NHI card’s web service component
- CVE-2022-35218NHI card’s web service component - Heap-based Buffer OverflowNHI card’s web service component
- CVE-2022-34625Mealie1.0.0beta3 was discovered to contain a Server-Side Template Injection vulnerability, which allows attackers to execute arbitrary code
- CVE-2022-34613Mealie 1.0.0beta3 contains an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted file.
- CVE-2022-34618A stored cross-site scripting (XSS) vulnerability in Mealie 1.0.0beta3 allows attackers to execute arbitrary web scripts or HTML via a craft
- CVE-2022-29154An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connec
- CVE-2021-23385Open RedirectFlask-Security
- CVE-2022-35421Online Tours And Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the pname parameter at /admin/op
- CVE-2022-34956Pligg CMS v2.0.2 was discovered to contain a time-based SQL injection vulnerability via the page_size parameter at load_data_for_groups.php.
- CVE-2022-34953Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the startDate parameter at getOrderReport.php.
- CVE-2022-35422Web Based Quiz System v1.0 was discovered to contain a SQL injection vulnerability via the qid parameter at update.php.
- CVE-2022-34954Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at invoiceprint.php.
- CVE-2022-34955Pligg CMS v2.0.2 was discovered to contain a time-based SQL injection vulnerability via the page_size parameter at load_data_for_topusers.ph
- CVE-2022-34952Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at edituser.php.
- CVE-2022-34950Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at editproduct.php.
- CVE-2022-34951Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the startDate parameter at getsalereport.php.
- CVE-2022-34949Pharmacy Management System v1.0 was discovered to contain multiple SQL injection vulnerabilities via the email or password parameter at logi
- CVE-2022-34948Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at editbrand.php.
- CVE-2022-34947Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at editcategory.php.
- CVE-2022-34946Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the startDate parameter at getexpproduct.php.
- CVE-2022-34945Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the startDate parameter at getproductreport.php.
- CVE-2022-37035An issue was discovered in bgpd in FRRouting (FRR) 8.3.