# CVEs published 2022-08-04

58 CVEs were published on August 4, 2022: 3 critical, 22 high. Days are UTC.

- [CVE-2022-37030](https://cve.now/CVE-2022-37030.md): Weak permissions on the configuration file in the PAM module in Grommunio Gromox 0.5 through 1.x before 1.28 allow a local unprivileged user (no CVSS)
- [CVE-2022-31793](https://cve.now/CVE-2022-31793.md): do\_request in request.c in muhttpd before 1.1.7 allows remote attackers to read arbitrary files by constructing a URL with a single characte (no CVSS)
- [CVE-2022-35930](https://cve.now/CVE-2022-35930.md): Ability to bypass attestation verification in sigstore PolicyController (CVSS 7.1, sigstore policy-controller · github.com/sigstore/policy-con…)
- [CVE-2022-35927](https://cve.now/CVE-2022-35927.md): Unverified DIO prefix info lengths in RPL-Classic in Contiki-NG (CVSS 8.1, contiki-ng)
- [CVE-2022-35926](https://cve.now/CVE-2022-35926.md): Out-of-bounds read in IPv6 neighbor solicitation in Contiki-NG (CVSS 5.9, contiki-ng)
- [CVE-2021-32771](https://cve.now/CVE-2021-32771.md): Buffer overflow in contiki-ng (CVSS 8.1, contiki-ng)
- [CVE-2022-35858](https://cve.now/CVE-2022-35858.md): The TEE\_PopulateTransientObject and \_\_utee\_from\_attr functions in Samsung mTower 0.3.0 allow a trusted application to trigger a memory overw (no CVSS)
- [CVE-2022-35142](https://cve.now/CVE-2022-35142.md): An issue in Renato v0.17.0 allows attackers to cause a Denial of Service (DoS) via a crafted payload injected into the Search parameter. (no CVSS, raneto)
- [CVE-2022-35143](https://cve.now/CVE-2022-35143.md): Renato v0.17.0 employs weak password complexity requirements, allowing attackers to crack user passwords via brute-force attacks. (no CVSS, raneto)
- [CVE-2022-35144](https://cve.now/CVE-2022-35144.md): Renato v0.17.0 was discovered to contain a cross-site scripting (XSS) vulnerability. (no CVSS, raneto)
- [CVE-2022-34993](https://cve.now/CVE-2022-34993.md): Totolink A3600R\_Firmware V4.1.2cu.5182\_B20201102 contains a hard code password for root in /etc/shadow.sample. (no CVSS)
- [CVE-2022-35929](https://cve.now/CVE-2022-35929.md): False positive signature verification in cosign (CVSS 7.1, sigstore cosign · github.com/sigstore/cosign)
- [CVE-2022-34970](https://cve.now/CVE-2022-34970.md): Crow before 1.0+4 has a heap-based buffer overflow via the function qs\_parse in query\_string.h. (no CVSS)
- [CVE-2022-35735](https://cve.now/CVE-2022-35735.md): BIG-IP monitor configuration vulnerability CVE-2022-35735 (CVSS 7.2, F5 BIG-IP)
- [CVE-2022-35728](https://cve.now/CVE-2022-35728.md): iControl REST vulnerability CVE-2022-35728 (CVSS 8.1, F5 BIG-IP · F5 BIG-IQ Centralized Management)
- [CVE-2022-35272](https://cve.now/CVE-2022-35272.md): BIG-IP HTTP MRF vulnerability CVE-2022-35272 (CVSS 7.5, F5 BIG-IP)
- [CVE-2022-35245](https://cve.now/CVE-2022-35245.md): BIG-IP APM access policy vulnerability CVE-2022-35245 (CVSS 7.5, F5 BIG-IP APM)
- [CVE-2022-35243](https://cve.now/CVE-2022-35243.md): Authenticated iControl REST in Appliance mode vulnerability CVE-2022-35243 (CVSS 8.7, F5 BIG-IP)
- [CVE-2022-35241](https://cve.now/CVE-2022-35241.md): NGINX Instance Manager vulnerability CVE-2022-35241 (CVSS 6.5, F5 NGINX Instance Manager)
- [CVE-2022-35240](https://cve.now/CVE-2022-35240.md): BIG-IP Message Routing MQTT vulnerability CVE-2022-35240 (CVSS 7.5, F5 BIG-IP)
- [CVE-2022-35236](https://cve.now/CVE-2022-35236.md): HTTP2 profile vulnerability CVE-2022-35236 (CVSS 7.5, F5 BIG-IP)
- [CVE-2022-34865](https://cve.now/CVE-2022-34865.md): Traffic intelligence feeds vulnerability CVE-2022-34865 (CVSS 4.8, F5 BIG-IP)
- [CVE-2022-34862](https://cve.now/CVE-2022-34862.md): TMM vulnerability CVE-2022-34862 (CVSS 7.5, F5 BIG-IP)
- [CVE-2022-34851](https://cve.now/CVE-2022-34851.md): BIG-IP and BIG-IQ iControl SOAP vulnerability CVE-2022-34851 (CVSS 4.3, F5 BIG-IP · F5 BIG-IQ Centralized Management)
- [CVE-2022-34844](https://cve.now/CVE-2022-34844.md): BIG-IP and BIG-IQ AWS vulnerability CVE-2022-34844 (CVSS 5.9, F5 BIG-IP · F5 BIG-IQ Centralized Management)
- [CVE-2022-34655](https://cve.now/CVE-2022-34655.md): TMM vulnerability CVE-2022-34655 (CVSS 7.5, F5 BIG-IP)
- [CVE-2022-34651](https://cve.now/CVE-2022-34651.md): BIG-IP TLS 1.3 iRule vulnerability CVE-2022-34651 (CVSS 7.5, F5 BIG-IP)
- [CVE-2022-33968](https://cve.now/CVE-2022-33968.md): BIG-IP LTM and APM NTLM vulnerability CVE-2022-33968 (CVSS 3.7, F5 BIG-IP)
- [CVE-2022-33962](https://cve.now/CVE-2022-33962.md): BIG-IP iRule vulnerability CVE-2022-33962 (CVSS 6.7, F5 BIG-IP)
- [CVE-2022-33947](https://cve.now/CVE-2022-33947.md): BIG-IP DNS TMUI Vulnerability CVE-2022-33947 (CVSS 5.4, F5 BIG-IP DNS)
- [CVE-2022-33203](https://cve.now/CVE-2022-33203.md): BIG-IP APM and F5 SSL Orchestrator vulnerability CVE-2022-33203 (CVSS 7.5, F5 BIG-IP APM)
- [CVE-2022-32455](https://cve.now/CVE-2022-32455.md): TMM vulnerability CVE-2022-32455 (CVSS 7.5, F5 BIG-IP)
- [CVE-2022-31473](https://cve.now/CVE-2022-31473.md): BIG-IP APM Appliance mode vulnerability CVE-2022-31473 (CVSS 6.8, F5 BIG-IP APM)
- [CVE-2022-30535](https://cve.now/CVE-2022-30535.md): NGINX Ingress Controller vulnerability CVE-2022-30535 (CVSS 6.5, F5 NGINX Ingress Controller)
- [CVE-2022-31119](https://cve.now/CVE-2022-31119.md): Password disclosure in log file in Nextcloud Mail App (CVSS 3.1, nextcloud security-advisories)
- [CVE-2022-31132](https://cve.now/CVE-2022-31132.md): Unauthenticated SSRF in 3rd party module "cerdic/csstidy" (CVSS 8.3, nextcloud security-advisories)
- [CVE-2022-31120](https://cve.now/CVE-2022-31120.md): Federated share accepting/declining is not logged in audit log in Nextcloud Server (CVSS 2.1, nextcloud security-advisories)
- [CVE-2022-31118](https://cve.now/CVE-2022-31118.md): Missing brute force protection on cloud federation sharing in Nextcloud Server (CVSS 6.5, nextcloud security-advisories)
- [CVE-2022-25168](https://cve.now/CVE-2022-25168.md): Command injection in org.apache.hadoop.fs.FileUtil.unTarUsingTar (no CVSS, Apache Software Foundation Apache Hadoop · org.apache.hadoo…)
- [CVE-2022-2656](https://cve.now/CVE-2022-2656.md): SourceCodester Multi Language Hotel Management Software sql injection (CVSS 6.3, SourceCodester Multi Language Hotel Management Software)
- [CVE-2022-2652](https://cve.now/CVE-2022-2652.md): Use of Externally-Controlled Format String in umlaeute/v4l2loopback (CVSS 7.3, umlaeute/v4l2loopback)
- [CVE-2022-2653](https://cve.now/CVE-2022-2653.md): Path Traversal in plankanban/planka (CVSS 7.1, plankanban/planka)
- [CVE-2022-35216](https://cve.now/CVE-2022-35216.md): ITPison OMICARD EDM - Use of Hard-coded Credentials (CVSS 7.5, ITPison OMICARD EDM)
- [CVE-2022-32965](https://cve.now/CVE-2022-32965.md): ITPison OMICARD EDM - Use of Hard-coded Credentials (CVSS 9.8, ITPison OMICARD EDM)
- [CVE-2022-32964](https://cve.now/CVE-2022-32964.md): ITPison OMICARD EDM - SQL Injection (CVSS 9.8, ITPison OMICARD EDM)
- [CVE-2022-32963](https://cve.now/CVE-2022-32963.md): ITPison OMICARD EDM - Path Traversal-1 (CVSS 7.5, ITPison OMICARD EDM)
- [CVE-2022-2651](https://cve.now/CVE-2022-2651.md): Authentication Bypass by Primary Weakness in bookwyrm-social/bookwyrm (CVSS 9.8, bookwyrm-social/bookwyrm)
- [CVE-2022-2648](https://cve.now/CVE-2022-2648.md): SourceCodester Multi Language Hotel Management Software sql injection (CVSS 6.3, SourceCodester Multi Language Hotel Management Software)
- [CVE-2022-2647](https://cve.now/CVE-2022-2647.md): jeecg-boot unrestricted upload (CVSS 7.3, jeecg-boot)
- [CVE-2022-2646](https://cve.now/CVE-2022-2646.md): SourceCodester Online Admission System index.php cross site scripting (CVSS 3.5, SourceCodester Online Admission System)
- [CVE-2022-2645](https://cve.now/CVE-2022-2645.md): SourceCodester Garage Management System edituser.php cross site scripting (CVSS 3.5, SourceCodester Garage Management System)
- [CVE-2022-2644](https://cve.now/CVE-2022-2644.md): SourceCodester Online Admission System GET Parameter sql injection (CVSS 5.5, SourceCodester Online Admission System)
- [CVE-2022-2643](https://cve.now/CVE-2022-2643.md): SourceCodester Online Admission System POST Parameter sql injection (CVSS 6.3, SourceCodester Online Admission System)
- [CVE-2022-34158](https://cve.now/CVE-2022-34158.md): User Group Privilege Escalation (no CVSS, Apache Software Foundation Apache JSPWiki · org.apache.jspw…)
- [CVE-2022-28732](https://cve.now/CVE-2022-28732.md): Apache JSPWiki Cross-site scripting vulnerability on WeblogPlugin (no CVSS, Apache Software Foundation Apache JSPWiki · org.apache.jspw…)
- [CVE-2022-28731](https://cve.now/CVE-2022-28731.md): Apache JSPWiki CSRF in UserPreferences.jsp (no CVSS, Apache Software Foundation Apache JSPWiki · org.apache.jspw…)
- [CVE-2022-28730](https://cve.now/CVE-2022-28730.md): Apache JSPWiki Cross-site scripting vulnerability on AJAXPreview.jsp (no CVSS, Apache Software Foundation Apache JSPWiki · org.apache.jspw…)
- [CVE-2022-27166](https://cve.now/CVE-2022-27166.md): XSS vulnerability on XHRHtml2Markup.jsp in JSPWiki 2.11.2 (no CVSS, Apache Software Foundation Apache JSPWiki · org.apache.jspw…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-08-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.