# CVEs published 2022-08-03

44 CVEs were published on August 3, 2022: 2 critical, 9 high. Days are UTC.

- [CVE-2022-35506](https://cve.now/CVE-2022-35506.md): TripleCross v0.1.0 was discovered to contain a stack overflow which occurs because there is no limit to the length of program parameters. (no CVSS)
- [CVE-2022-35161](https://cve.now/CVE-2022-35161.md): GVRET Stable Release as of Aug 15, 2015 was discovered to contain a buffer overflow via the handleConfigCmd function at SerialConsole.cpp. (no CVSS)
- [CVE-2022-35505](https://cve.now/CVE-2022-35505.md): A segmentation fault in TripleCross v0.1.0 occurs when sending a control command from the client to the server. (no CVSS)
- [CVE-2022-35158](https://cve.now/CVE-2022-35158.md): A vulnerability in the lua parser of TscanCode tsclua v2.15.01 allows attackers to cause a Denial of Service (DoS) via a crafted lua script. (no CVSS)
- [CVE-2022-27551](https://cve.now/CVE-2022-27551.md): HCL Launch could allow an authenticated user to obtain sensitive information (CVE-2022-27551) (CVSS 5.3, HCL Software HCL Launch)
- [CVE-2022-35928](https://cve.now/CVE-2022-35928.md): AES Crypt for Linux Password Security Vulnerability (CVSS 8.4, paulej AESCrypt)
- [CVE-2022-31175](https://cve.now/CVE-2022-31175.md): Cross-site scripting caused by the editor instance destroying process in ckeditor5 (CVSS 5.8, ckeditor5 · @ckeditor/ckeditor5-markdown-gfm +2)
- [CVE-2022-34992](https://cve.now/CVE-2022-34992.md): Luadec v0.9.9 was discovered to contain a heap-buffer overflow via the function UnsetPending. (no CVSS)
- [CVE-2022-37396](https://cve.now/CVE-2022-37396.md): In JetBrains Rider before 2022.2 Trust and Open Project dialog could be bypassed, leading to local code execution (CVSS 4.1, JetBrains Rider)
- [CVE-2022-35867](https://cve.now/CVE-2022-35867.md): This vulnerability allows local attackers to escalate privileges on affected installations of xhyve. (CVSS 7.5, xhyve)
- [CVE-2022-35865](https://cve.now/CVE-2022-35865.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of BMC Track-It! 20.21.2.109. (CVSS 7.3, BMC Track-It!)
- [CVE-2022-35864](https://cve.now/CVE-2022-35864.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of BMC Track-It! 20.21.02.109. (CVSS 5.3, BMC Track-It!)
- [CVE-2022-34872](https://cve.now/CVE-2022-34872.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Centreon. (CVSS 6.5, Centreon)
- [CVE-2022-34871](https://cve.now/CVE-2022-34871.md): This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. (CVSS 7.2, Centreon)
- [CVE-2022-2272](https://cve.now/CVE-2022-2272.md): This vulnerability allows remote attackers to bypass authentication on affected installations of Sante PACS Server 3.0.4. (CVSS 9.8, Sante PACS Server)
- [CVE-2022-28684](https://cve.now/CVE-2022-28684.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of DevExpress. (CVSS 8.8, DevExpress)
- [CVE-2022-28668](https://cve.now/CVE-2022-28668.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 11.9.2. (CVSS 7.8, Sante DICOM Viewer Pro)
- [CVE-2022-34973](https://cve.now/CVE-2022-34973.md): D-Link DIR820LA1\_FW106B02 was discovered to contain a buffer overflow via the nextPage parameter at ping.ccp. (no CVSS)
- [CVE-2022-35620](https://cve.now/CVE-2022-35620.md): D-LINK DIR-818LW A1:DIR818L\_FW105b01 was discovered to contain a remote code execution (RCE) vulnerability via the function binary.soapcgi\_m (no CVSS)
- [CVE-2022-35619](https://cve.now/CVE-2022-35619.md): D-LINK DIR-818LW A1:DIR818L\_FW105b01 was discovered to contain a remote code execution (RCE) vulnerability via the function ssdpcgi\_main. (no CVSS)
- [CVE-2022-34974](https://cve.now/CVE-2022-34974.md): D-Link DIR810LA1\_FW102B22 was discovered to contain a command injection vulnerability via the Ping\_addr function. (no CVSS)
- [CVE-2022-23442](https://cve.now/CVE-2022-23442.md): An improper access control vulnerability \[CWE-284\] in FortiOS versions 6.2.0 through 6.2.11, 6.4.0 through 6.4.8 and 7.0.0 through 7.0.5 may (CVSS 4.3, Fortinet FortiOS)
- [CVE-2022-27484](https://cve.now/CVE-2022-27484.md): A unverified password change in Fortinet FortiADC version 6.2.0 through 6.2.3, 6.1.x, 6.0.x, 5.x.x allows an authenticated attacker to bypas (CVSS 5.4, Fortinet FortiADC)
- [CVE-2022-37394](https://cve.now/CVE-2022-37394.md): An issue was discovered in OpenStack Nova before 23.2.2, 24.x before 24.1.2, and 25.x before 25.0.2. (no CVSS, nova)
- [CVE-2022-27621](https://cve.now/CVE-2022-27621.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology USB Copy before (CVSS 5.5, Synology USB Copy)
- [CVE-2022-27620](https://cve.now/CVE-2022-27620.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology SSO Server befo (CVSS 6.8, Synology SSO Server)
- [CVE-2022-27619](https://cve.now/CVE-2022-27619.md): Cleartext transmission of sensitive information vulnerability in authentication management in Synology Note Station Client before 2.2.2-609 (CVSS 6.8, Synology Note Station Client)
- [CVE-2022-36800](https://cve.now/CVE-2022-36800.md): Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers without the "Browse Users" permission t (CVSS 4.3, Atlassian Jira Service Management Server · Atlassian Jira S…)
- [CVE-2022-27618](https://cve.now/CVE-2022-27618.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Storage Analyze (CVSS 6.8, Synology Storage Analyzer)
- [CVE-2022-27617](https://cve.now/CVE-2022-27617.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Calendar before (CVSS 5.0, Synology Calendar)
- [CVE-2022-27616](https://cve.now/CVE-2022-27616.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in webapi component in Synology Dis (CVSS 7.2, Synology DiskStation Manager)
- [CVE-2022-34968](https://cve.now/CVE-2022-34968.md): An issue in the fetch\_step function in Percona Server for MySQL v8.0.28-19 allows attackers to cause a Denial of Service (DoS) via a SQL que (no CVSS)
- [CVE-2022-34969](https://cve.now/CVE-2022-34969.md): PingCAP TiDB v6.1.0 was discovered to contain a NULL pointer dereference. (no CVSS)
- [CVE-2022-34967](https://cve.now/CVE-2022-34967.md): The assertion \`stmt-\>Dbc-\>FirstStmt' failed in MonetDB Database Server v11.43.13. (no CVSS)
- [CVE-2022-34937](https://cve.now/CVE-2022-34937.md): Yuba u5cms v8.3.5 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component savepage.php. (no CVSS)
- [CVE-2022-34928](https://cve.now/CVE-2022-34928.md): JFinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via /system/user. (no CVSS)
- [CVE-2022-34927](https://cve.now/CVE-2022-34927.md): MilkyTracker v1.03.00 was discovered to contain a stack overflow via the component LoaderXM::load. (no CVSS)
- [CVE-2022-36197](https://cve.now/CVE-2022-36197.md): BigTree CMS 4.4.16 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a c (no CVSS)
- [CVE-2022-31197](https://cve.now/CVE-2022-31197.md): SQL Injection in ResultSet.refreshRow() with malicious column names in pgjdbc (CVSS 7.1, pgjdbc · org.postgresql:postgresql)
- [CVE-2022-32292](https://cve.now/CVE-2022-32292.md): In ConnMan through 1.41, remote attackers able to send HTTP requests to the gweb component are able to exploit a heap-based buffer overflow (no CVSS)
- [CVE-2022-32293](https://cve.now/CVE-2022-32293.md): In ConnMan through 1.41, a man-in-the-middle attack against a WISPR HTTP query could be used to trigger a use-after-free in WISPR handling, (no CVSS)
- [CVE-2022-35737](https://cve.now/CVE-2022-35737.md): SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a (CVSS 7.5, sqlite · libsqlite3-sys)
- [CVE-2022-35866](https://cve.now/CVE-2022-35866.md): This vulnerability allows remote attackers to bypass authentication on affected installations of Vinchin Backup and Recovery 6.5.0.17561. (CVSS 9.8, Vinchin Backup and Recovery)
- [CVE-2022-36359](https://cve.now/CVE-2022-36359.md): An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. (no CVSS, django)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-08-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.