# CVEs published 2022-08-09

206 CVEs were published on August 9, 2022: 7 critical, 76 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2022-20361](https://cve.now/CVE-2022-20361.md): In btif\_dm\_auth\_cmpl\_evt of btif\_dm.cc, there is a possible vulnerability in Cross-Transport Key Derivation due to Weakness in Bluetooth Sta (CVSS 6.5, Android)
- [CVE-2022-20360](https://cve.now/CVE-2022-20360.md): In setChecked of SecureNfcPreferenceController.java, there is a missing permission check. (CVSS 6.2, Android)
- [CVE-2022-20358](https://cve.now/CVE-2022-20358.md): In startSync of AbstractThreadedSyncAdapter.java, there is a possible way to access protected content of content providers due to a missing (CVSS 7.1, Android)
- [CVE-2022-20357](https://cve.now/CVE-2022-20357.md): In writeToParcel of SurfaceControl.cpp, there is a possible information disclosure due to uninitialized data. (no CVSS, Android)
- [CVE-2022-20356](https://cve.now/CVE-2022-20356.md): In shouldAllowFgsWhileInUsePermissionLocked of ActiveServices.java, there is a possible way to start foreground service from background due (CVSS 4.0, Android)
- [CVE-2022-20355](https://cve.now/CVE-2022-20355.md): In get of PacProxyService.java, there is a possible system service crash due to improper input validation. (no CVSS, Android)
- [CVE-2022-20354](https://cve.now/CVE-2022-20354.md): In onDefaultNetworkChanged of Vpn.java, there is a possible way to disable VPN due to a logic error in the code. (no CVSS, Android)
- [CVE-2022-20353](https://cve.now/CVE-2022-20353.md): In onSaveRingtone of DefaultRingtonePreference.java, there is a possible inappropriate file read due to improper input validation. (no CVSS, Android)
- [CVE-2022-20352](https://cve.now/CVE-2022-20352.md): In addProviderRequestListener of LocationManagerService.java, there is a possible way to learn which packages request location information d (no CVSS, Android)
- [CVE-2022-20350](https://cve.now/CVE-2022-20350.md): In onCreate of NotificationAccessConfirmationActivity.java, there is a possible way to trick the victim to grant notification access to the (CVSS 6.2, Android)
- [CVE-2022-20349](https://cve.now/CVE-2022-20349.md): In WifiScanningPreferenceController and BluetoothScanningPreferenceController, there is a possible admin restriction bypass due to a missing (no CVSS, Android)
- [CVE-2022-20348](https://cve.now/CVE-2022-20348.md): In updateState of LocationServicesWifiScanningPreferenceController.java, there is a possible admin restriction bypass due to a missing permi (no CVSS, Android)
- [CVE-2022-20347](https://cve.now/CVE-2022-20347.md): In onAttach of ConnectedDeviceDashboardFragment.java, there is a possible permission bypass due to a confused deputy. (CVSS 7.5, Android)
- [CVE-2022-20346](https://cve.now/CVE-2022-20346.md): In updateAudioTrackInfoFromESDS\_MPEG4Audio of MPEG4Extractor.cpp, there is a possible out of bounds read due to an incorrect bounds check. (CVSS 7.5, Android)
- [CVE-2022-20345](https://cve.now/CVE-2022-20345.md): In l2cble\_process\_sig\_cmd of l2c\_ble.cc, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.5, Android)
- [CVE-2022-20344](https://cve.now/CVE-2022-20344.md): In stealReceiveChannel of EventThread.cpp, there is a possible way to interfere with process communication due to a race condition. (no CVSS, Android)
- [CVE-2022-20239](https://cve.now/CVE-2022-20239.md): remap\_pfn\_range' here may map out of size kernel memory (for example, may map the kernel area), and because the 'vma-\>vm\_page\_prot' can also (CVSS 4.2, Android)
- [CVE-2021-39696](https://cve.now/CVE-2021-39696.md): In Task.java, there is a possible escalation of privilege due to a confused deputy. (no CVSS, Android)
- [CVE-2021-46778](https://cve.now/CVE-2021-46778.md): Execution unit scheduler contention may lead to a side channel vulnerability found on AMD CPU microarchitectures codenamed “Zen 1”, “Zen 2” (no CVSS, AMD Processors)
- [CVE-2022-22983](https://cve.now/CVE-2022-22983.md): VMware Workstation (16.x prior to 16.2.4) contains an unprotected storage of credentials vulnerability. (no CVSS, VMware Workstation)
- [CVE-2022-31673](https://cve.now/CVE-2022-31673.md): VMware vRealize Operations contains an information disclosure vulnerability. (CVSS 8.8, VMware vRealize Operations)
- [CVE-2022-31674](https://cve.now/CVE-2022-31674.md): VMware vRealize Operations contains an information disclosure vulnerability. (CVSS 4.3, VMware vRealize Operations)
- [CVE-2022-31675](https://cve.now/CVE-2022-31675.md): VMware vRealize Operations contains an authentication bypass vulnerability. (no CVSS, VMware vRealize Operations)
- [CVE-2022-31672](https://cve.now/CVE-2022-31672.md): VMware vRealize Operations contains a privilege escalation vulnerability. (CVSS 6.4, VMware vRealize Operations)
- [CVE-2022-23238](https://cve.now/CVE-2022-23238.md): Linux deployments of StorageGRID (formerly StorageGRID Webscale) versions 11.6.0 through 11.6.0.2 deployed with a Linux kernel version less (no CVSS, StorageGRID)
- [CVE-2022-2634](https://cve.now/CVE-2022-2634.md): Digi ConnectPort X2D (CVSS 10.0, Digi ConnectPort X2D)
- [CVE-2022-32148](https://cve.now/CVE-2022-32148.md): Exposure of client IP addresses in net/http (CVSS 6.5, Go standard library net/http · stdlib)
- [CVE-2022-1962](https://cve.now/CVE-2022-1962.md): Stack exhaustion due to deeply nested types in go/parser (CVSS 5.5, Go standard library go/parser · stdlib)
- [CVE-2022-2719](https://cve.now/CVE-2022-2719.md): In ImageMagick, a crafted file could trigger an assertion failure when a call to WriteImages was made in MagickWand/operation.c, due to a NU (CVSS 5.5, ImageMagick)
- [CVE-2022-30580](https://cve.now/CVE-2022-30580.md): Empty Cmd.Path can trigger unintended binary in os/exec on Windows (CVSS 7.8, Go standard library os/exec · stdlib)
- [CVE-2022-32189](https://cve.now/CVE-2022-32189.md): Panic when decoding Float and Rat types in math/big (no CVSS, Go standard library math/big · golang +1)
- [CVE-2022-30629](https://cve.now/CVE-2022-30629.md): Session tickets lack random ticket\_age\_add in crypto/tls (CVSS 3.1, Go standard library crypto/tls · stdlib)
- [CVE-2022-30630](https://cve.now/CVE-2022-30630.md): Stack exhaustion in Glob on certain paths in io/fs (CVSS 7.5, Go standard library io/fs · stdlib)
- [CVE-2022-1705](https://cve.now/CVE-2022-1705.md): Improper sanitization of Transfer-Encoding headers in net/http (CVSS 6.5, Go standard library net/http · stdlib)
- [CVE-2022-30631](https://cve.now/CVE-2022-30631.md): Stack exhaustion when reading certain archives in compress/gzip (CVSS 7.5, Go standard library compress/gzip · stdlib)
- [CVE-2022-30633](https://cve.now/CVE-2022-30633.md): Stack exhaustion when unmarshaling certain documents in encoding/xml (CVSS 7.5, Go standard library encoding/xml · stdlib)
- [CVE-2022-30635](https://cve.now/CVE-2022-30635.md): Stack exhaustion when decoding certain messages in encoding/gob (CVSS 7.5, Go standard library encoding/gob · stdlib)
- [CVE-2022-2457](https://cve.now/CVE-2022-2457.md): A flaw was found in Red Hat Process Automation Manager 7 where an attacker can benefit from a brute force attack against Administration Cons (CVSS 6.5, Red Hat Process Automation Manager)
- [CVE-2022-30632](https://cve.now/CVE-2022-30632.md): Stack exhaustion on crafted paths in path/filepath (no CVSS, Go standard library path/filepath · stdlib)
- [CVE-2022-29083](https://cve.now/CVE-2022-29083.md): Prior Dell BIOS versions contain an Improper Authentication vulnerability. (CVSS 6.8, Dell CPG BIOS)
- [CVE-2022-2458](https://cve.now/CVE-2022-2458.md): XML external entity injection(XXE) is a vulnerability that allows an attacker to interfere with an application's processing of XML data. (no CVSS, Red Hat Process Automation Manager)
- [CVE-2022-32245](https://cve.now/CVE-2022-32245.md): SAP BusinessObjects Business Intelligence Platform (Open Document) - versions 420, 430, allows an unauthenticated attacker to retrieve sensi (no CVSS, SAP SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2022-35293](https://cve.now/CVE-2022-35293.md): Due to insecure session management, SAP Enable Now allows an unauthenticated attacker to gain access to user's account. (CVSS 9.1, SAP SE SAP Enable Now Manager)
- [CVE-2022-35827](https://cve.now/CVE-2022-35827.md): Visual Studio Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Visual Studio)
- [CVE-2022-35290](https://cve.now/CVE-2022-35290.md): Under certain conditions SAP Authenticator for Android allows an attacker to access information which would otherwise be restricted. (CVSS 7.5, SAP SE SAP Authenticator for Android)
- [CVE-2022-35826](https://cve.now/CVE-2022-35826.md): Visual Studio Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Visual Studio)
- [CVE-2022-35697](https://cve.now/CVE-2022-35697.md): AEM File Upload Security Issue leading to RXSS (CVSS 5.4, Adobe Experience Manager · com.adobe.cq:core.wcm.components…)
- [CVE-2022-35825](https://cve.now/CVE-2022-35825.md): Visual Studio Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Visual Studio)
- [CVE-2022-35824](https://cve.now/CVE-2022-35824.md): Azure Site Recovery Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-35821](https://cve.now/CVE-2022-35821.md): Azure Sphere Information Disclosure Vulnerability (CVSS 4.4, Microsoft Azure Sphere)
- [CVE-2022-35820](https://cve.now/CVE-2022-35820.md): Windows Bluetooth Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-37006](https://cve.now/CVE-2022-37006.md): Permission control vulnerability in the network module. (no CVSS, HarmonyOS;EMUI)
- [CVE-2022-35819](https://cve.now/CVE-2022-35819.md): Azure Site Recovery Elevation of Privilege Vulnerability (CVSS 6.5, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2021-40040](https://cve.now/CVE-2021-40040.md): Vulnerability of writing data to an arbitrary address in the HW\_KEYMASTER module. (CVSS 7.5, HarmonyOS;EMUI;Magic UI)
- [CVE-2022-35818](https://cve.now/CVE-2022-35818.md): Azure Site Recovery Elevation of Privilege Vulnerability (CVSS 6.5, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2021-40030](https://cve.now/CVE-2021-40030.md): The My HUAWEI app has a defect in the design. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI +1)
- [CVE-2022-35817](https://cve.now/CVE-2022-35817.md): Azure Site Recovery Elevation of Privilege Vulnerability (CVSS 6.5, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-37005](https://cve.now/CVE-2022-37005.md): The Settings application has an argument injection vulnerability. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI +1)
- [CVE-2022-35816](https://cve.now/CVE-2022-35816.md): Azure Site Recovery Elevation of Privilege Vulnerability (CVSS 6.5, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-37003](https://cve.now/CVE-2022-37003.md): The AOD module has a vulnerability in permission assignment. (CVSS 6.5, Huawei HarmonyOS · Huawei EMUI +1)
- [CVE-2022-37004](https://cve.now/CVE-2022-37004.md): The Settings application has a vulnerability of bypassing the out-of-box experience (OOBE). (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI +1)
- [CVE-2022-35815](https://cve.now/CVE-2022-35815.md): Azure Site Recovery Elevation of Privilege Vulnerability (CVSS 6.5, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-37002](https://cve.now/CVE-2022-37002.md): The SystemUI module has a privilege escalation vulnerability. (CVSS 7.4, Huawei HarmonyOS · Huawei EMUI +1)
- [CVE-2022-35814](https://cve.now/CVE-2022-35814.md): Azure Site Recovery Elevation of Privilege Vulnerability (CVSS 6.5, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-37008](https://cve.now/CVE-2022-37008.md): The recovery module has a vulnerability of bypassing the verification of an update package before use. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI +1)
- [CVE-2022-37001](https://cve.now/CVE-2022-37001.md): The diag-router module has a vulnerability in intercepting excessive long and short instructions. (no CVSS, Huawei HarmonyOS)
- [CVE-2022-35813](https://cve.now/CVE-2022-35813.md): Azure Site Recovery Elevation of Privilege Vulnerability (CVSS 6.5, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-37007](https://cve.now/CVE-2022-37007.md): The chinadrm module has an out-of-bounds read vulnerability. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI +1)
- [CVE-2021-40034](https://cve.now/CVE-2021-40034.md): The video framework has the memory overwriting vulnerability caused by addition overflow. (no CVSS, Huawei HarmonyOS · Huawei EMUI +1)
- [CVE-2022-35811](https://cve.now/CVE-2022-35811.md): Azure Site Recovery Elevation of Privilege Vulnerability (CVSS 6.5, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-35810](https://cve.now/CVE-2022-35810.md): Azure Site Recovery Elevation of Privilege Vulnerability (CVSS 6.5, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-35809](https://cve.now/CVE-2022-35809.md): Azure Site Recovery Elevation of Privilege Vulnerability (CVSS 6.5, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-35808](https://cve.now/CVE-2022-35808.md): Azure Site Recovery Elevation of Privilege Vulnerability (CVSS 6.5, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-35807](https://cve.now/CVE-2022-35807.md): Azure Site Recovery Elevation of Privilege Vulnerability (CVSS 6.5, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-35806](https://cve.now/CVE-2022-35806.md): Azure RTOS GUIX Studio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Azure RTOS GUIX Studio)
- [CVE-2022-35804](https://cve.now/CVE-2022-35804.md): SMB Client and Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-35802](https://cve.now/CVE-2022-35802.md): Azure Site Recovery Elevation of Privilege Vulnerability (CVSS 8.1, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-35801](https://cve.now/CVE-2022-35801.md): Azure Site Recovery Elevation of Privilege Vulnerability (CVSS 6.5, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-35800](https://cve.now/CVE-2022-35800.md): Azure Site Recovery Elevation of Privilege Vulnerability (CVSS 4.9, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-35799](https://cve.now/CVE-2022-35799.md): Azure Site Recovery Elevation of Privilege Vulnerability (CVSS 6.5, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-35797](https://cve.now/CVE-2022-35797.md): Windows Hello Security Feature Bypass Vulnerability (CVSS 6.1, Microsoft Windows)
- [CVE-2022-35796](https://cve.now/CVE-2022-35796.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 7.5, Microsoft Edge)
- [CVE-2022-35795](https://cve.now/CVE-2022-35795.md): Windows Error Reporting Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-35794](https://cve.now/CVE-2022-35794.md): Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2022-35793](https://cve.now/CVE-2022-35793.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Windows)
- [CVE-2022-35792](https://cve.now/CVE-2022-35792.md): Storage Spaces Direct Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-35791](https://cve.now/CVE-2022-35791.md): Azure Site Recovery Elevation of Privilege Vulnerability (CVSS 6.5, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-35790](https://cve.now/CVE-2022-35790.md): Azure Site Recovery Elevation of Privilege Vulnerability (CVSS 6.5, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-35789](https://cve.now/CVE-2022-35789.md): Azure Site Recovery Elevation of Privilege Vulnerability (CVSS 6.5, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-35788](https://cve.now/CVE-2022-35788.md): Azure Site Recovery Elevation of Privilege Vulnerability (CVSS 6.5, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-35787](https://cve.now/CVE-2022-35787.md): Azure Site Recovery Elevation of Privilege Vulnerability (CVSS 4.9, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-35786](https://cve.now/CVE-2022-35786.md): Azure Site Recovery Elevation of Privilege Vulnerability (CVSS 6.5, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-35785](https://cve.now/CVE-2022-35785.md): Azure Site Recovery Elevation of Privilege Vulnerability (CVSS 6.5, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-35784](https://cve.now/CVE-2022-35784.md): Azure Site Recovery Elevation of Privilege Vulnerability (CVSS 6.5, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-35783](https://cve.now/CVE-2022-35783.md): Azure Site Recovery Elevation of Privilege Vulnerability (CVSS 4.4, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-35782](https://cve.now/CVE-2022-35782.md): Azure Site Recovery Elevation of Privilege Vulnerability (CVSS 6.5, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-35781](https://cve.now/CVE-2022-35781.md): Azure Site Recovery Elevation of Privilege Vulnerability (CVSS 6.5, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-35780](https://cve.now/CVE-2022-35780.md): Azure Site Recovery Elevation of Privilege Vulnerability (CVSS 6.5, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-35779](https://cve.now/CVE-2022-35779.md): Azure RTOS GUIX Studio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Azure RTOS GUIX Studio)
- [CVE-2022-35517](https://cve.now/CVE-2022-35517.md): WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 adm.cgi has no filtering on parameters: web\_pskValue, wl\_Method, wlan\_ssid, EncrypType, (no CVSS)
- [CVE-2022-35777](https://cve.now/CVE-2022-35777.md): Visual Studio Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Visual Studio)
- [CVE-2022-35776](https://cve.now/CVE-2022-35776.md): Azure Site Recovery Denial of Service Vulnerability (CVSS 6.2, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-35775](https://cve.now/CVE-2022-35775.md): Azure Site Recovery Elevation of Privilege Vulnerability (CVSS 6.5, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-35774](https://cve.now/CVE-2022-35774.md): Azure Site Recovery Elevation of Privilege Vulnerability (CVSS 4.9, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-35773](https://cve.now/CVE-2022-35773.md): Azure RTOS GUIX Studio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Azure RTOS GUIX Studio)
- [CVE-2022-35772](https://cve.now/CVE-2022-35772.md): Azure Site Recovery Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Azure Site Recovery VMWare to Azure)
- [CVE-2022-35771](https://cve.now/CVE-2022-35771.md): Windows Defender Credential Guard Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-35769](https://cve.now/CVE-2022-35769.md): Windows Point-to-Point Protocol (PPP) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2022-35768](https://cve.now/CVE-2022-35768.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-35767](https://cve.now/CVE-2022-35767.md): Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2022-35766](https://cve.now/CVE-2022-35766.md): Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2022-35765](https://cve.now/CVE-2022-35765.md): Storage Spaces Direct Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-35764](https://cve.now/CVE-2022-35764.md): Storage Spaces Direct Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-35763](https://cve.now/CVE-2022-35763.md): Storage Spaces Direct Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-35762](https://cve.now/CVE-2022-35762.md): Storage Spaces Direct Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-35761](https://cve.now/CVE-2022-35761.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-35760](https://cve.now/CVE-2022-35760.md): Microsoft ATA Port Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-35518](https://cve.now/CVE-2022-35518.md): WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 nas.cgi has no filtering on parameters: User1Passwd and User1, which leads to command i (CVSS 4.6)
- [CVE-2022-34717](https://cve.now/CVE-2022-34717.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Office · Microsoft 365 Apps for Enterprise)
- [CVE-2022-34716](https://cve.now/CVE-2022-34716.md): .NET Spoofing Vulnerability (CVSS 5.9, Microsoft Visual Studio · Microsoft .NET +14)
- [CVE-2022-34715](https://cve.now/CVE-2022-34715.md): Windows Network File System Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows Server)
- [CVE-2022-35519](https://cve.now/CVE-2022-35519.md): WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 firewall.cgi has no filtering on parameter add\_mac, which leads to command injection in (no CVSS)
- [CVE-2022-34714](https://cve.now/CVE-2022-34714.md): Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2022-34713](https://cve.now/CVE-2022-34713.md): Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2022-34712](https://cve.now/CVE-2022-34712.md): Windows Defender Credential Guard Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2022-34710](https://cve.now/CVE-2022-34710.md): Windows Defender Credential Guard Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2022-34709](https://cve.now/CVE-2022-34709.md): Windows Defender Credential Guard Security Feature Bypass Vulnerability (CVSS 6.0, Microsoft Windows)
- [CVE-2022-34708](https://cve.now/CVE-2022-34708.md): Windows Kernel Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2022-34707](https://cve.now/CVE-2022-34707.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-35520](https://cve.now/CVE-2022-35520.md): WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 api.cgi has no filtering on parameter ufconf, and this is a hidden parameter which does (no CVSS)
- [CVE-2022-34706](https://cve.now/CVE-2022-34706.md): Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-34705](https://cve.now/CVE-2022-34705.md): Windows Defender Credential Guard Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-34703](https://cve.now/CVE-2022-34703.md): Windows Partition Management Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-34702](https://cve.now/CVE-2022-34702.md): Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2022-35521](https://cve.now/CVE-2022-35521.md): WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 firewall.cgi has no filtering on parameters: remoteManagementEnabled, blockPortScanEnab (no CVSS)
- [CVE-2022-34701](https://cve.now/CVE-2022-34701.md): Windows Secure Socket Tunneling Protocol (SSTP) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2022-34699](https://cve.now/CVE-2022-34699.md): Windows Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-34696](https://cve.now/CVE-2022-34696.md): Windows Hyper-V Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-34692](https://cve.now/CVE-2022-34692.md): Microsoft Exchange Server Information Disclosure Vulnerability (CVSS 5.3, Microsoft Exchange Server 2016 Cumulative Update · Microsof…)
- [CVE-2022-34691](https://cve.now/CVE-2022-34691.md): Active Directory Domain Services Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-35522](https://cve.now/CVE-2022-35522.md): WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 adm.cgi has no filtering on parameters: ppp\_username, ppp\_passwd, rwan\_gateway, rwan\_ma (no CVSS)
- [CVE-2022-34690](https://cve.now/CVE-2022-34690.md): Windows Fax Service Elevation of Privilege Vulnerability (CVSS 7.1, Microsoft Windows)
- [CVE-2022-34687](https://cve.now/CVE-2022-34687.md): Azure RTOS GUIX Studio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Azure RTOS GUIX Studio)
- [CVE-2022-34686](https://cve.now/CVE-2022-34686.md): Azure RTOS GUIX Studio Information Disclosure Vulnerability (CVSS 5.5, Microsoft Azure RTOS GUIX Studio)
- [CVE-2022-34685](https://cve.now/CVE-2022-34685.md): Azure RTOS GUIX Studio Information Disclosure Vulnerability (CVSS 5.5, Microsoft Azure RTOS GUIX Studio)
- [CVE-2022-33670](https://cve.now/CVE-2022-33670.md): Windows Partition Management Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-33649](https://cve.now/CVE-2022-33649.md): Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability (CVSS 9.6, Microsoft Edge)
- [CVE-2022-33648](https://cve.now/CVE-2022-33648.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office Online Server)
- [CVE-2022-33646](https://cve.now/CVE-2022-33646.md): Azure Batch Node Agent Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Azure Batch)
- [CVE-2022-35523](https://cve.now/CVE-2022-35523.md): WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 firewall.cgi has no filtering on parameter del\_mac and parameter flag, which leads to c (no CVSS)
- [CVE-2022-33640](https://cve.now/CVE-2022-33640.md): System Center Operations Manager: Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Open Management Infrastructure · Microsoft System…)
- [CVE-2022-33636](https://cve.now/CVE-2022-33636.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 8.3, Microsoft Edge)
- [CVE-2022-33631](https://cve.now/CVE-2022-33631.md): Microsoft Excel Security Feature Bypass Vulnerability (CVSS 7.3, Microsoft Office · Microsoft 365 Apps for Enterprise +1)
- [CVE-2022-30197](https://cve.now/CVE-2022-30197.md): Windows Kernel Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2022-30194](https://cve.now/CVE-2022-30194.md): Windows WebBrowser Control Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2022-35524](https://cve.now/CVE-2022-35524.md): WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 adm.cgi has no filtering on parameters: wlan\_signal, web\_pskValue, sel\_EncrypTyp, sel\_A (no CVSS)
- [CVE-2022-30176](https://cve.now/CVE-2022-30176.md): Azure RTOS GUIX Studio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Azure RTOS GUIX Studio)
- [CVE-2022-30175](https://cve.now/CVE-2022-30175.md): Azure RTOS GUIX Studio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Azure RTOS GUIX Studio)
- [CVE-2022-30144](https://cve.now/CVE-2022-30144.md): Windows Bluetooth Service Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2022-30134](https://cve.now/CVE-2022-30134.md): Microsoft Exchange Server Information Disclosure Vulnerability (CVSS 6.5, Microsoft Exchange Server 2019 Cumulative Update · Micro… +1)
- [CVE-2022-30133](https://cve.now/CVE-2022-30133.md): Windows Point-to-Point Protocol (PPP) Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows)
- [CVE-2022-24516](https://cve.now/CVE-2022-24516.md): Microsoft Exchange Server Elevation of Privilege Vulnerability (CVSS 8.0, Microsoft Exchange Server 2016 Cumulative Update · Micro… +1)
- [CVE-2022-24477](https://cve.now/CVE-2022-24477.md): Microsoft Exchange Server Elevation of Privilege Vulnerability (CVSS 8.0, Microsoft Exchange Server 2013 Cumulative Update · Micro… +1)
- [CVE-2022-35525](https://cve.now/CVE-2022-35525.md): WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 adm.cgi has no filtering on parameter led\_switch, which leads to command injection in p (no CVSS)
- [CVE-2022-21980](https://cve.now/CVE-2022-21980.md): Microsoft Exchange Server Elevation of Privilege Vulnerability (CVSS 8.0, Microsoft Exchange Server 2013 Cumulative Update · Micro… +1)
- [CVE-2022-21979](https://cve.now/CVE-2022-21979.md): Microsoft Exchange Server Information Disclosure Vulnerability (CVSS 4.8, Microsoft Exchange Server 2019 Cumulative Update · Micro… +1)
- [CVE-2022-35526](https://cve.now/CVE-2022-35526.md): WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 login.cgi has no filtering on parameter key, which leads to command injection in page / (no CVSS)
- [CVE-2022-35533](https://cve.now/CVE-2022-35533.md): WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 qos.cgi has no filtering on parameters: cli\_list and cli\_num, which leads to command in (no CVSS)
- [CVE-2022-35534](https://cve.now/CVE-2022-35534.md): WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 wireless.cgi has no filtering on parameter hiddenSSID32g and SSID2G2, which leads to co (no CVSS)
- [CVE-2022-35535](https://cve.now/CVE-2022-35535.md): WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 wireless.cgi has no filtering on parameter macAddr, which leads to command injection in (no CVSS)
- [CVE-2022-35536](https://cve.now/CVE-2022-35536.md): WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 qos.cgi has no filtering on parameters: qos\_bandwith and qos\_dat, which leads to comman (no CVSS)
- [CVE-2022-35537](https://cve.now/CVE-2022-35537.md): WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 wireless.cgi has no filtering on parameters: mac\_5g and Newname, which leads to command (no CVSS)
- [CVE-2022-35538](https://cve.now/CVE-2022-35538.md): WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 wireless.cgi has no filtering on parameters: delete\_list, delete\_al\_mac, b\_delete\_list (no CVSS)
- [CVE-2022-35509](https://cve.now/CVE-2022-35509.md): An issue was discovered in EyouCMS 1.5.8. (CVSS 6.1)
- [CVE-2022-30574](https://cve.now/CVE-2022-30574.md): TIBCO eFTL Secret Jacking (CVSS 4.6, TIBCO Software TIBCO FTL - Community Edition · TIBCO Sof… +4)
- [CVE-2022-30573](https://cve.now/CVE-2022-30573.md): TIBCO FTL Privilege Escalation (CVSS 6.7, TIBCO Software TIBCO FTL - Community Edition · TIBCO Sof… +1)
- [CVE-2022-35491](https://cve.now/CVE-2022-35491.md): TOTOLINK A3002RU V3.0.0-B20220304.1804 has a hardcoded password for root in /etc/shadow.sample. (no CVSS)
- [CVE-2022-35426](https://cve.now/CVE-2022-35426.md): UCMS 1.6 is vulnerable to arbitrary file upload via ucms/sadmin/file PHP file. (no CVSS)
- [CVE-2022-37024](https://cve.now/CVE-2022-37024.md): Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 t (no CVSS)
- [CVE-2022-2734](https://cve.now/CVE-2022-2734.md): Improper Restriction of Rendered UI Layers or Frames in openemr/openemr (CVSS 10.0, openemr/openemr)
- [CVE-2022-2732](https://cve.now/CVE-2022-2732.md): Missing Authorization in openemr/openemr (CVSS 8.3, openemr/openemr)
- [CVE-2022-2733](https://cve.now/CVE-2022-2733.md): Cross-site Scripting (XSS) - Reflected in openemr/openemr (CVSS 9.6, openemr/openemr)
- [CVE-2022-2731](https://cve.now/CVE-2022-2731.md): Cross-site Scripting (XSS) - Reflected in openemr/openemr (CVSS 5.4, openemr/openemr)
- [CVE-2022-2729](https://cve.now/CVE-2022-2729.md): Cross-site Scripting (XSS) - DOM in openemr/openemr (CVSS 5.4, openemr/openemr)
- [CVE-2022-2730](https://cve.now/CVE-2022-2730.md): Authorization Bypass Through User-Controlled Key in openemr/openemr (CVSS 6.5, openemr/openemr)
- [CVE-2022-2728](https://cve.now/CVE-2022-2728.md): SourceCodester Gym Management System index.php sql injection (CVSS 6.3, SourceCodester Gym Management System)
- [CVE-2022-2727](https://cve.now/CVE-2022-2727.md): SourceCodester Gym Management System login.php sql injection (CVSS 6.3, SourceCodester Gym Management System)
- [CVE-2022-2726](https://cve.now/CVE-2022-2726.md): SEMCMS Ant\_Check.php sql injection (CVSS 6.3, SEMCMS)
- [CVE-2022-2725](https://cve.now/CVE-2022-2725.md): SourceCodester Company Website CMS add-blog.php cross site scripting (CVSS 3.5, SourceCodester Company Website CMS)
- [CVE-2022-2724](https://cve.now/CVE-2022-2724.md): SourceCodester Employee Management System aprocess.php sql injection (CVSS 6.3, SourceCodester Employee Management System)
- [CVE-2022-2723](https://cve.now/CVE-2022-2723.md): SourceCodester Employee Management System eprocess.php sql injection (CVSS 6.3, SourceCodester Employee Management System)
- [CVE-2022-2722](https://cve.now/CVE-2022-2722.md): SourceCodester Simple Student Information System manage\_course.php sql injection (CVSS 6.3, SourceCodester Simple Student Information System)
- [CVE-2022-36125](https://cve.now/CVE-2022-36125.md): Integer overflow when reading corrupted .avro file in Avro Rust SDK (CVSS 7.5, Apache Software Foundation Apache Avro · apache-avro)
- [CVE-2022-36124](https://cve.now/CVE-2022-36124.md): Memory overconsumption in Avro Rust SDK (CVSS 7.5, Apache Software Foundation Apache Avro · avro +1)
- [CVE-2022-35724](https://cve.now/CVE-2022-35724.md): Denial of service while reading data in Avro Rust SDK (no CVSS, Apache Software Foundation Apache Avro · apache-avro)
- [CVE-2022-2715](https://cve.now/CVE-2022-2715.md): SourceCodester Employee Management System eloginwel.php sql injection (CVSS 6.3, SourceCodester Employee Management System)
- [CVE-2022-25907](https://cve.now/CVE-2022-25907.md): Prototype Pollution (CVSS 7.5, ts-deepmerge)
- [CVE-2021-33643](https://cve.now/CVE-2021-33643.md): An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable (CVSS 6.5, libtar)
- [CVE-2021-33644](https://cve.now/CVE-2021-33644.md): An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable (no CVSS, libtar)
- [CVE-2021-33645](https://cve.now/CVE-2021-33645.md): The th\_read() function doesn’t free a variable t-\>th\_buf.gnu\_longlink after allocating memory, which may cause a memory leak. (no CVSS, libtar)
- [CVE-2021-33646](https://cve.now/CVE-2021-33646.md): The th\_read() function doesn’t free a variable t-\>th\_buf.gnu\_longname after allocating memory, which may cause a memory leak. (no CVSS, libtar)
- [CVE-2022-28131](https://cve.now/CVE-2022-28131.md): Stack exhaustion from deeply nested XML documents in encoding/xml (no CVSS, Go standard library encoding/xml · stdlib)
- [CVE-2022-29804](https://cve.now/CVE-2022-29804.md): Path traversal via Clean on Windows in path/filepath (no CVSS, Go standard library path/filepath · stdlib)
- [CVE-2022-32429](https://cve.now/CVE-2022-32429.md): An authentication-bypass issue in the component http://MYDEVICEIP/cgi-bin-sdb/ExportSettings.sh of Mega System Technologies Inc MSNSwitch MN (no CVSS)
- [CVE-2022-34704](https://cve.now/CVE-2022-34704.md): Windows Defender Credential Guard Information Disclosure Vulnerability (CVSS 4.7, Microsoft Windows)
- [CVE-2022-35812](https://cve.now/CVE-2022-35812.md): Azure Site Recovery Elevation of Privilege Vulnerability (CVSS 4.9, Microsoft Azure Site Recovery VMWare to Azure)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-08-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.