# CVEs published 2022-08-08

44 CVEs were published on August 8, 2022: 0 critical, 2 high. Days are UTC.

- [CVE-2021-41615](https://cve.now/CVE-2021-41615.md): websda.c in GoAhead WebServer 2.1.8 has insufficient nonce entropy because the nonce calculation relies on the hardcoded onceuponatimeinpara (no CVSS)
- [CVE-2022-34293](https://cve.now/CVE-2022-34293.md): wolfSSL before 5.4.0 allows remote attackers to cause a denial of service via DTLS because a check for return-routability can be skipped. (no CVSS)
- [CVE-2022-36264](https://cve.now/CVE-2022-36264.md): In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists an Unauthenticated remote Arbitrary File Upload vulnerability which allows (no CVSS)
- [CVE-2022-36265](https://cve.now/CVE-2022-36265.md): In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Hidden system command web page. (no CVSS)
- [CVE-2022-36266](https://cve.now/CVE-2022-36266.md): In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a stored XSS vulnerability. (no CVSS)
- [CVE-2022-36267](https://cve.now/CVE-2022-36267.md): In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Unauthenticated remote command injection vulnerability. (no CVSS)
- [CVE-2022-2713](https://cve.now/CVE-2022-2713.md): Insufficient Session Expiration in cockpit-hq/cockpit (CVSS 8.6, cockpit-hq/cockpit · aheinze/cockpit)
- [CVE-2022-35493](https://cve.now/CVE-2022-35493.md): A Cross-site scripting (XSS) vulnerability in json search parse and the json response in wrteam.in, eShop - Multipurpose Ecommerce Store Web (CVSS 6.1)
- [CVE-2022-35490](https://cve.now/CVE-2022-35490.md): Zammad 5.2.0 is vulnerable to privilege escalation. (no CVSS)
- [CVE-2022-35489](https://cve.now/CVE-2022-35489.md): In Zammad 5.2.0, customers who have secondary organizations assigned were able to see all organizations of the system rather than only those (no CVSS)
- [CVE-2022-35488](https://cve.now/CVE-2022-35488.md): In Zammad 5.2.0, an attacker could manipulate the rate limiting in the 'forgot password' feature of Zammad, and thereby send many requests f (no CVSS)
- [CVE-2022-35487](https://cve.now/CVE-2022-35487.md): Zammad 5.2.0 suffers from Incorrect Access Control. (no CVSS)
- [CVE-2022-2460](https://cve.now/CVE-2022-2460.md): WPDating \< 7.4.0 - Multiple Unauthenticated SQLi (CVSS 4.3, WPDating)
- [CVE-2022-2426](https://cve.now/CVE-2022-2426.md): Thinkific Uploader \<= 1.0.0 - Admin+ Stored Cross-Site Scripting (no CVSS, Thinkific Uploader)
- [CVE-2022-2425](https://cve.now/CVE-2022-2425.md): WP DS Blog Map \<= 3.1.3 - Admin+ Stored Cross-Site Scripting (no CVSS, WP DS Blog Map)
- [CVE-2022-2424](https://cve.now/CVE-2022-2424.md): Google Maps Anywhere \<= 1.2.6.3 - Admin+ Stored Cross-Site Scripting (no CVSS, Google Maps Anywhere)
- [CVE-2022-2423](https://cve.now/CVE-2022-2423.md): DW Promobar \<= 1.0.4 - Admin+ Stored Cross-Site Scripting (no CVSS, DW Promobar)
- [CVE-2022-2412](https://cve.now/CVE-2022-2412.md): Better Tag Cloud \<= 0.99.5 - Admin+ Stored Cross-Site Scripting (no CVSS, Better Tag Cloud)
- [CVE-2022-2411](https://cve.now/CVE-2022-2411.md): Auto More Tag \<= 4.0.0 - Admin+ Stored Cross-Site Scripting (no CVSS, Auto More Tag)
- [CVE-2022-2410](https://cve.now/CVE-2022-2410.md): mTouch Quiz \<= 3.1.3 - Admin+ Stored Cross Site Scripting (no CVSS, mTouch Quiz)
- [CVE-2022-2409](https://cve.now/CVE-2022-2409.md): Rough Chart \<= 1.0.0 - Admin+ Stored Cross-Site Scripting (no CVSS, Rough Chart)
- [CVE-2022-2398](https://cve.now/CVE-2022-2398.md): WP Comments Fields \< 4.1 - Admin+ Stored Cross-Site Scripting (no CVSS, WordPress Comments Fields)
- [CVE-2022-2395](https://cve.now/CVE-2022-2395.md): weForms \< 1.6.14 - Admin+ Stored Cross-Site Scripting (no CVSS, weForms – Easy Drag & Drop Contact Form Builder For WordPre…)
- [CVE-2022-2391](https://cve.now/CVE-2022-2391.md): Inspiro Pro \< 7.2.3 - Contributor+ Stored Cross-Site Scripting (no CVSS, Inspiro PRO)
- [CVE-2022-2386](https://cve.now/CVE-2022-2386.md): Crowdsignal Polls & Ratings \< 3.0.8 - Reflected Cross-Site Scripting (no CVSS, Crowdsignal Dashboard – Polls, Surveys & more)
- [CVE-2022-2372](https://cve.now/CVE-2022-2372.md): YaySMTP \< 2.2.2 - Admin+ Stored Cross-Site Scripting (no CVSS, YaySMTP – Simple WP SMTP Mail)
- [CVE-2022-2371](https://cve.now/CVE-2022-2371.md): YaySMTP \< 2.2.1 - Subscriber+ Stored Cross-Site Scripting (no CVSS, YaySMTP – Simple WP SMTP Mail)
- [CVE-2022-2367](https://cve.now/CVE-2022-2367.md): WSM Downloader \<= 1.4.0 - Domain Name Restriction Bypass (no CVSS, WSM Downloader)
- [CVE-2022-2357](https://cve.now/CVE-2022-2357.md): WSM Downloader \<= 1.4.0 - Unauthenticated Arbitrary File Download (no CVSS, WSM Downloader)
- [CVE-2022-2356](https://cve.now/CVE-2022-2356.md): User Private Files \< 1.1.3 - Subscriber+ Arbitrary File Upload (CVSS 6.5, Frontend File Manager & Sharing – User Private Files)
- [CVE-2022-2355](https://cve.now/CVE-2022-2355.md): Easy Username Updater \< 1.0.5 - Arbitrary Username Update via CSRF (CVSS 5.7, Easy Username Updater)
- [CVE-2022-2269](https://cve.now/CVE-2022-2269.md): Website File Changes Monitor \< 1.8.3 - Admin+ SQLi (no CVSS, Website File Changes Monitor)
- [CVE-2022-2046](https://cve.now/CVE-2022-2046.md): Directorist - Business Directory Plugin \< 7.2.3 - Admin+ Arbitrary File Upload (no CVSS, Directorist – WordPress Business Directory Plugin with Clas…)
- [CVE-2022-1323](https://cve.now/CVE-2022-1323.md): Discy \< 5.0 - Subscriber+ Broken Access Control to change settings (no CVSS, Discy)
- [CVE-2022-2708](https://cve.now/CVE-2022-2708.md): SourceCodester Gym Management System login.php sql injection (CVSS 5.5, SourceCodester Gym Management System)
- [CVE-2022-2707](https://cve.now/CVE-2022-2707.md): SourceCodester Online Class and Exam Scheduling System faculty\_sched.php sql injection (CVSS 6.3, SourceCodester Online Class and Exam Scheduling System)
- [CVE-2022-2706](https://cve.now/CVE-2022-2706.md): SourceCodester Online Class and Exam Scheduling System class\_sched.php sql injection (CVSS 6.3, SourceCodester Online Class and Exam Scheduling System)
- [CVE-2022-2705](https://cve.now/CVE-2022-2705.md): SourceCodester Simple Student Information System manage\_department.php sql injection (CVSS 6.3, SourceCodester Simple Student Information System)
- [CVE-2022-2704](https://cve.now/CVE-2022-2704.md): SourceCodester Simple E-Learning System downloadFiles.php information disclosure (CVSS 4.3, SourceCodester Simple E-Learning System)
- [CVE-2022-2703](https://cve.now/CVE-2022-2703.md): SourceCodester Gym Management System Exercises Module sql injection (CVSS 6.3, SourceCodester Gym Management System)
- [CVE-2022-2702](https://cve.now/CVE-2022-2702.md): SourceCodester Company Website CMS Cookie site-settings.php access control (CVSS 7.3, SourceCodester Company Website CMS)
- [CVE-2022-2701](https://cve.now/CVE-2022-2701.md): SourceCodester Simple E-Learning System claire\_blake cross site scripting (CVSS 3.5, SourceCodester Simple E-Learning System)
- [CVE-2022-2700](https://cve.now/CVE-2022-2700.md): SourceCodester Gym Management System GET Parameter sql injection (CVSS 4.7, SourceCodester Gym Management System)
- [CVE-2022-2699](https://cve.now/CVE-2022-2699.md): SourceCodester Simple E-Learning System claire\_blake sql injection (CVSS 6.3, SourceCodester Simple E-Learning System)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-08-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.