CVEs published August 3, 2022
44 CVEs were published on August 3, 2022: 2 critical, 9 high.
- Published
- 44
- Critical
- 2
- High
- 9
- Medium
- 13
- Low
- 0
- Unrated
- 20
- Now in CISA KEV
- 0
- Fix available
- 13
Most affected products
- BMC Track-It!
- 2
- Centreon
- 2
- Atlassian Jira Service Management Server · Atlassian Jira S…
- 1
- ckeditor5 · @ckeditor/ckeditor5-markdown-gfm +2
- 1
- DevExpress
- 1
- django
- 1
- Fortinet FortiADC
- 1
- Fortinet FortiOS
- 1
- HCL Software HCL Launch
- 1
- JetBrains Rider
- 1
Critical 2
- CVE-2022-2272This vulnerability allows remote attackers to bypass authentication on affected installations of Sante PACS Server 3.0.4.Sante PACS Server
- CVE-2022-35866This vulnerability allows remote attackers to bypass authentication on affected installations of Vinchin Backup and Recovery 6.5.0.17561.Vinchin Backup and Recovery
High 9
- CVE-2022-35928AES Crypt for Linux Password Security Vulnerabilitypaulej AESCrypt
- CVE-2022-35867This vulnerability allows local attackers to escalate privileges on affected installations of xhyve.xhyve
- CVE-2022-35865This vulnerability allows remote attackers to execute arbitrary code on affected installations of BMC Track-It! 20.21.2.109.BMC Track-It!
- CVE-2022-34871This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon.Centreon
- CVE-2022-28684This vulnerability allows remote attackers to execute arbitrary code on affected installations of DevExpress.DevExpress
- CVE-2022-28668This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 11.9.2.Sante DICOM Viewer Pro
- CVE-2022-27616Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in webapi component in Synology DisSynology DiskStation Manager
- CVE-2022-31197SQL Injection in ResultSet.refreshRow() with malicious column names in pgjdbcpgjdbc · org.postgresql:postgresql
- CVE-2022-35737SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to asqlite · libsqlite3-sys
Medium, low and unrated 33
- CVE-2022-35506TripleCross v0.1.0 was discovered to contain a stack overflow which occurs because there is no limit to the length of program parameters.
- CVE-2022-35161GVRET Stable Release as of Aug 15, 2015 was discovered to contain a buffer overflow via the handleConfigCmd function at SerialConsole.cpp.
- CVE-2022-35505A segmentation fault in TripleCross v0.1.0 occurs when sending a control command from the client to the server.
- CVE-2022-35158A vulnerability in the lua parser of TscanCode tsclua v2.15.01 allows attackers to cause a Denial of Service (DoS) via a crafted lua script.
- CVE-2022-27551HCL Launch could allow an authenticated user to obtain sensitive information (CVE-2022-27551)HCL Software HCL Launch
- CVE-2022-31175Cross-site scripting caused by the editor instance destroying process in ckeditor5ckeditor5 · @ckeditor/ckeditor5-markdown-gfm +2
- CVE-2022-34992Luadec v0.9.9 was discovered to contain a heap-buffer overflow via the function UnsetPending.
- CVE-2022-37396In JetBrains Rider before 2022.2 Trust and Open Project dialog could be bypassed, leading to local code executionJetBrains Rider
- CVE-2022-35864This vulnerability allows remote attackers to disclose sensitive information on affected installations of BMC Track-It! 20.21.02.109.BMC Track-It!
- CVE-2022-34872This vulnerability allows remote attackers to disclose sensitive information on affected installations of Centreon.Centreon
- CVE-2022-34973D-Link DIR820LA1_FW106B02 was discovered to contain a buffer overflow via the nextPage parameter at ping.ccp.
- CVE-2022-35620D-LINK DIR-818LW A1:DIR818L_FW105b01 was discovered to contain a remote code execution (RCE) vulnerability via the function binary.soapcgi_m
- CVE-2022-35619D-LINK DIR-818LW A1:DIR818L_FW105b01 was discovered to contain a remote code execution (RCE) vulnerability via the function ssdpcgi_main.
- CVE-2022-34974D-Link DIR810LA1_FW102B22 was discovered to contain a command injection vulnerability via the Ping_addr function.
- CVE-2022-23442An improper access control vulnerability [CWE-284] in FortiOS versions 6.2.0 through 6.2.11, 6.4.0 through 6.4.8 and 7.0.0 through 7.0.5 mayFortinet FortiOS
- CVE-2022-27484A unverified password change in Fortinet FortiADC version 6.2.0 through 6.2.3, 6.1.x, 6.0.x, 5.x.x allows an authenticated attacker to bypasFortinet FortiADC
- CVE-2022-37394An issue was discovered in OpenStack Nova before 23.2.2, 24.x before 24.1.2, and 25.x before 25.0.2.nova
- CVE-2022-27621Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology USB Copy beforeSynology USB Copy
- CVE-2022-27620Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology SSO Server befoSynology SSO Server
- CVE-2022-27619Cleartext transmission of sensitive information vulnerability in authentication management in Synology Note Station Client before 2.2.2-609 Synology Note Station Client
- CVE-2022-36800Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers without the "Browse Users" permission tAtlassian Jira Service Management Server · Atlassian Jira S…
- CVE-2022-27618Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Storage AnalyzeSynology Storage Analyzer
- CVE-2022-27617Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Calendar beforeSynology Calendar
- CVE-2022-34968An issue in the fetch_step function in Percona Server for MySQL v8.0.28-19 allows attackers to cause a Denial of Service (DoS) via a SQL que
- CVE-2022-34969PingCAP TiDB v6.1.0 was discovered to contain a NULL pointer dereference.
- CVE-2022-34967The assertion `stmt->Dbc->FirstStmt' failed in MonetDB Database Server v11.43.13.
- CVE-2022-34937Yuba u5cms v8.3.5 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component savepage.php.
- CVE-2022-34928JFinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via /system/user.
- CVE-2022-34927MilkyTracker v1.03.00 was discovered to contain a stack overflow via the component LoaderXM::load.
- CVE-2022-36197BigTree CMS 4.4.16 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a c
- CVE-2022-32292In ConnMan through 1.41, remote attackers able to send HTTP requests to the gweb component are able to exploit a heap-based buffer overflow
- CVE-2022-32293In ConnMan through 1.41, a man-in-the-middle attack against a WISPR HTTP query could be used to trigger a use-after-free in WISPR handling,
- CVE-2022-36359An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7.django