# CVEs published 2022-08-02

53 CVEs were published on August 2, 2022: 8 critical, 9 high. Days are UTC.

- [CVE-2022-33917](https://cve.now/CVE-2022-33917.md): An issue was discovered in the Arm Mali GPU Kernel Driver (Valhall r29p0 through r38p0). (no CVSS)
- [CVE-2022-36968](https://cve.now/CVE-2022-36968.md): In Progress WS\_FTP Server prior to version 8.7.3, forms within the administrative interface did not include a nonce to mitigate the risk of (no CVSS)
- [CVE-2022-36967](https://cve.now/CVE-2022-36967.md): In Progress WS\_FTP Server prior to version 8.7.3, multiple reflected cross-site scripting (XSS) vulnerabilities exist in the administrative (no CVSS)
- [CVE-2022-34619](https://cve.now/CVE-2022-34619.md): A stored cross-site scripting (XSS) vulnerability in Mealie v0.5.5 allows attackers to execute arbitrary web scripts or HTML via a crafted p (no CVSS)
- [CVE-2022-29807](https://cve.now/CVE-2022-29807.md): A SQL injection vulnerability exists within Quest KACE Systems Management Appliance (SMA) through 12.0 that can allow for remote code execut (no CVSS)
- [CVE-2022-30285](https://cve.now/CVE-2022-30285.md): In Quest KACE Systems Management Appliance (SMA) through 12.0, a hash collision is possible during authentication. (no CVSS)
- [CVE-2022-29808](https://cve.now/CVE-2022-29808.md): In Quest KACE Systems Management Appliance (SMA) through 12.0, predictable token generation occurs when appliance linking is enabled. (no CVSS)
- [CVE-2022-35925](https://cve.now/CVE-2022-35925.md): Missing rate limit in Authentication in bookwyrm (CVSS 5.3, bookwyrm-social bookwyrm)
- [CVE-2022-35923](https://cve.now/CVE-2022-35923.md): Inefficient Regular Expression Complexity in v8n (CVSS 7.5, imbrn · v8n)
- [CVE-2022-34924](https://cve.now/CVE-2022-34924.md): Lanling OA Landray Office Automation (OA) internal patch number #133383/#137780 contains an arbitrary file read vulnerability via the compon (no CVSS)
- [CVE-2022-35924](https://cve.now/CVE-2022-35924.md): Verification requests (magic link) sent to unwanted emails (CVSS 9.1, nextauthjs next-auth · next-auth)
- [CVE-2022-30572](https://cve.now/CVE-2022-30572.md): TIBCO iWay Service Manager Directory Traversal Vulnerability (CVSS 6.5, TIBCO Software TIBCO iWay Service Manager)
- [CVE-2022-30571](https://cve.now/CVE-2022-30571.md): TIBCO iWay Service Manager Reflected Cross Site Scripting (XSS) Vulnerability (CVSS 8.1, TIBCO Software TIBCO iWay Service Manager)
- [CVE-2022-2631](https://cve.now/CVE-2022-2631.md): Improper Access Control in tooljet/tooljet (CVSS 9.8, tooljet/tooljet)
- [CVE-2022-23733](https://cve.now/CVE-2022-23733.md): Stored XSS vulnerability in GitHub Enterprise Server leading to injection of arbitrary attributes (no CVSS, GitHub Enterprise Server)
- [CVE-2022-1293](https://cve.now/CVE-2022-1293.md): XSS vulnerability in Citadel (CVSS 5.7, Thales Citadel Web Client · Thales Citadel Macosx Deskto… +1)
- [CVE-2022-35223](https://cve.now/CVE-2022-35223.md): EasyUse MailHunter Ultimate - Deserialization of Untrusted Data (CVSS 9.8, EasyUse MailHunter Ultimate)
- [CVE-2022-35222](https://cve.now/CVE-2022-35222.md): HiCOS Citizen verification component - Stack Buffer Overflow (CVSS 6.8, HINET HiCOS Citizen verification component - Stack Buffer O…)
- [CVE-2022-35221](https://cve.now/CVE-2022-35221.md): TEAMPLUS TECHNOLOGY INC. Teamplus Pro - Allocation of Resources Without Limits or Throttling-2 (CVSS 5.4, TEAMPLUS TECHNOLOGY Teamplus Pro)
- [CVE-2022-35220](https://cve.now/CVE-2022-35220.md): TEAMPLUS TECHNOLOGY INC. Teamplus Pro - Allocation of Resources Without Limits or Throttling-1 (CVSS 7.7, TEAMPLUS TECHNOLOGY Teamplus Pro)
- [CVE-2022-35219](https://cve.now/CVE-2022-35219.md): NHI card’s web service component - Stack-based Buffer Overflow-2 (CVSS 5.5, NHI card’s web service component)
- [CVE-2022-35218](https://cve.now/CVE-2022-35218.md): NHI card’s web service component - Heap-based Buffer Overflow (CVSS 5.5, NHI card’s web service component)
- [CVE-2022-34625](https://cve.now/CVE-2022-34625.md): Mealie1.0.0beta3 was discovered to contain a Server-Side Template Injection vulnerability, which allows attackers to execute arbitrary code (no CVSS)
- [CVE-2022-34613](https://cve.now/CVE-2022-34613.md): Mealie 1.0.0beta3 contains an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted file. (no CVSS)
- [CVE-2022-34618](https://cve.now/CVE-2022-34618.md): A stored cross-site scripting (XSS) vulnerability in Mealie 1.0.0beta3 allows attackers to execute arbitrary web scripts or HTML via a craft (no CVSS)
- [CVE-2022-29154](https://cve.now/CVE-2022-29154.md): An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connec (no CVSS)
- [CVE-2022-25867](https://cve.now/CVE-2022-25867.md): NULL Pointer Dereference (CVSS 7.5, io.socket:socket.io-client)
- [CVE-2020-28423](https://cve.now/CVE-2020-28423.md): Command Injection (CVSS 9.8, monorepo-build)
- [CVE-2020-28424](https://cve.now/CVE-2020-28424.md): Command Injection (CVSS 7.2, s3-kilatstorage)
- [CVE-2020-28425](https://cve.now/CVE-2020-28425.md): Command Injection (CVSS 7.3, curljs)
- [CVE-2020-28433](https://cve.now/CVE-2020-28433.md): Command Injection (CVSS 7.3, node-latex-pdf)
- [CVE-2020-7795](https://cve.now/CVE-2020-7795.md): Command Injection (CVSS 7.3, get-npm-package-version)
- [CVE-2020-28434](https://cve.now/CVE-2020-28434.md): Command Injection (CVSS 9.4, gitblame)
- [CVE-2020-28437](https://cve.now/CVE-2020-28437.md): Command Injection (CVSS 9.4, heroku-env)
- [CVE-2020-28451](https://cve.now/CVE-2020-28451.md): Command Injection (CVSS 9.8, image-tiler)
- [CVE-2020-28453](https://cve.now/CVE-2020-28453.md): Command Injection (CVSS 9.4, npos-tesseract)
- [CVE-2021-23385](https://cve.now/CVE-2021-23385.md): Open Redirect (CVSS 5.4, Flask-Security)
- [CVE-2022-35217](https://cve.now/CVE-2022-35217.md): NHI card’s web service component - Stack-based Buffer Overflow-1 (CVSS 7.8, NHI card’s web service component)
- [CVE-2022-35421](https://cve.now/CVE-2022-35421.md): Online Tours And Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the pname parameter at /admin/op (no CVSS)
- [CVE-2022-34956](https://cve.now/CVE-2022-34956.md): Pligg CMS v2.0.2 was discovered to contain a time-based SQL injection vulnerability via the page\_size parameter at load\_data\_for\_groups.php. (no CVSS)
- [CVE-2022-34953](https://cve.now/CVE-2022-34953.md): Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the startDate parameter at getOrderReport.php. (no CVSS)
- [CVE-2022-35422](https://cve.now/CVE-2022-35422.md): Web Based Quiz System v1.0 was discovered to contain a SQL injection vulnerability via the qid parameter at update.php. (no CVSS)
- [CVE-2022-34954](https://cve.now/CVE-2022-34954.md): Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at invoiceprint.php. (no CVSS)
- [CVE-2022-34955](https://cve.now/CVE-2022-34955.md): Pligg CMS v2.0.2 was discovered to contain a time-based SQL injection vulnerability via the page\_size parameter at load\_data\_for\_topusers.ph (no CVSS)
- [CVE-2022-34952](https://cve.now/CVE-2022-34952.md): Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at edituser.php. (no CVSS)
- [CVE-2022-34950](https://cve.now/CVE-2022-34950.md): Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at editproduct.php. (no CVSS)
- [CVE-2022-34951](https://cve.now/CVE-2022-34951.md): Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the startDate parameter at getsalereport.php. (no CVSS)
- [CVE-2022-34949](https://cve.now/CVE-2022-34949.md): Pharmacy Management System v1.0 was discovered to contain multiple SQL injection vulnerabilities via the email or password parameter at logi (no CVSS)
- [CVE-2022-34948](https://cve.now/CVE-2022-34948.md): Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at editbrand.php. (no CVSS)
- [CVE-2022-34947](https://cve.now/CVE-2022-34947.md): Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at editcategory.php. (no CVSS)
- [CVE-2022-34946](https://cve.now/CVE-2022-34946.md): Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the startDate parameter at getexpproduct.php. (no CVSS)
- [CVE-2022-34945](https://cve.now/CVE-2022-34945.md): Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the startDate parameter at getproductreport.php. (no CVSS)
- [CVE-2022-37035](https://cve.now/CVE-2022-37035.md): An issue was discovered in bgpd in FRRouting (FRR) 8.3. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-08-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.