CVEs published August 12, 2022
53 CVEs were published on August 12, 2022: 1 critical, 5 high.
- Published
- 53
- Critical
- 1
- High
- 5
- Medium
- 13
- Low
- 3
- Unrated
- 31
- Now in CISA KEV
- 0
- Fix available
- 43
Most affected products
- Google Chrome
- 23
- forkcms/forkcms
- 4
- Esri ArcReader
- 3
- JetBrains Ktor · io.ktor:ktor
- 2
- SourceCodester Gas Agency Management System
- 2
- SourceCodester Zoo Management System
- 2
- bookwyrm-social bookwyrm
- 1
- camilova activerecord-update-by-case · update_by_case
- 1
- code.gitea.io/gitea
- 1
- codeigniter4 shield · codeigniter4/shield
- 1
Critical 1
High 5
- CVE-2022-35953URL Redirection to Untrusted Site ('Open Redirect') in bookwyrmbookwyrm-social bookwyrm
- CVE-2022-2802SourceCodester Gas Agency Management System login.php sql injectionSourceCodester Gas Agency Management System
- CVE-2021-29117arcreader use-after-freeEsri ArcReader
- CVE-2022-37397The software is vulnerable when using LDAP-based authentication in YCQL with Microsoft’s Active DirectoryYugabyte DB
- CVE-2022-35980OpenSearch vulnerable to Improper Authorization of Index Containing Sensitive Informationopensearch-project security · org.opensearch.plugin:opensea…
Medium, low and unrated 47
- CVE-2022-35943SameSite may allow cross-site request forgery (CSRF) protection to be bypassedcodeigniter4 shield · codeigniter4/shield
- CVE-2022-35956update_by_case before 0.1.3 vulnerable to sql injectioncamilova activerecord-update-by-case · update_by_case
- CVE-2022-2804SourceCodester Zoo Management System apply_vacancy.php unrestricted uploadSourceCodester Zoo Management System
- CVE-2022-2803SourceCodester Zoo Management System animals.php sql injectionSourceCodester Zoo Management System
- CVE-2022-2801SourceCodester Automated Beer Parlour Billing System Login sql injectionSourceCodester Automated Beer Parlour Billing System
- CVE-2022-2800SourceCodester Gym Management System clickjackingSourceCodester Gym Management System
- CVE-2022-2624Heap buffer overflow in PDF in Google Chrome prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific useGoogle Chrome
- CVE-2022-2623Use after free in Offline in Google Chrome on Android prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in speGoogle Chrome
- CVE-2022-2622Insufficient validation of untrusted input in Safe Browsing in Google Chrome on Windows prior to 104.0.5112.79 allowed a remote attacker to Google Chrome
- CVE-2022-2621Use after free in Extensions in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a malicious extensiGoogle Chrome
- CVE-2022-2620Use after free in WebUI in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in speGoogle Chrome
- CVE-2022-2619Insufficient validation of untrusted input in Settings in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to iGoogle Chrome
- CVE-2022-2618Insufficient validation of untrusted input in Internals in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to bypass downloadGoogle Chrome
- CVE-2022-2617Use after free in Extensions API in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a malicious extGoogle Chrome
- CVE-2022-2616Inappropriate implementation in Extensions API in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install aGoogle Chrome
- CVE-2022-2615Insufficient policy enforcement in Cookies in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to leak cross-origin data via aGoogle Chrome
- CVE-2022-2614Use after free in Sign-In Flow in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to potentially exploit heap corruption via Google Chrome
- CVE-2022-2613Use after free in Input in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to enage in specGoogle Chrome
- CVE-2022-2612Side-channel information leakage in Keyboard input in Google Chrome prior to 104.0.5112.79 allowed a remote attacker who had compromised theGoogle Chrome
- CVE-2022-2611Inappropriate implementation in Fullscreen API in Google Chrome on Android prior to 104.0.5112.79 allowed a remote attacker to spoof the conGoogle Chrome
- CVE-2022-2610Insufficient policy enforcement in Background Fetch in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to leak cross-origin dGoogle Chrome
- CVE-2022-2609Use after free in Nearby Share in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engageGoogle Chrome
- CVE-2022-2608Use after free in Overview Mode in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engagGoogle Chrome
- CVE-2022-2607Use after free in Tab Strip in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage inGoogle Chrome
- CVE-2022-2606Use after free in Managed devices API in Google Chrome prior to 104.0.5112.79 allowed a remote attacker who convinced a user to enable a speGoogle Chrome
- CVE-2022-2605Out of bounds read in Dawn in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to potentially exploit heap corruption via a crGoogle Chrome
- CVE-2022-2604Use after free in Safe Browsing in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to potentially exploit heap corruption viaGoogle Chrome
- CVE-2022-2603Use after free in Omnibox in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to potentially exploit heap corruption via a craGoogle Chrome
- CVE-2022-2587Out of bounds write in Chrome OS Audio Server in Google Chrome on Chrome OS prior to 102.0.5005.125 allowed a remote attacker to potentiallyGoogle Chrome
- CVE-2022-2797SourceCodester Student Information System view_student.php sql injectionSourceCodester Student Information System
- CVE-2021-29112Esri ArcReader PMF File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEsri ArcReader
- CVE-2021-29118Esri ArcReader PMF File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityEsri ArcReader
- CVE-2021-42751A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers (with administrative access) to injec
- CVE-2021-42750A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers (with administrative access) to injec
- CVE-2022-35585A stored cross-site scripting (XSS) issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaScript via the "start_date" Parforkcms/forkcms
- CVE-2022-35587A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the "publish_on_date" Parameteforkcms/forkcms
- CVE-2022-35589A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the "publish_on_time" Parameteforkcms/forkcms
- CVE-2022-35590A cross-site scripting (XSS) issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaScript via the "end_date" Parameterforkcms/forkcms
- CVE-2022-35932Missing rate limit when trying to join a password protected Nextcloud Talk conversationnextcloud security-advisories
- CVE-2022-37423Neo4j APOC (Awesome Procedures on Cypher) before 4.3.0.7 and 4.x before 4.4.0.8 allows Directory Traversal to sibling directories via apoc.lorg.neo4j.procedure:apoc
- CVE-2022-2390Mutable pending intent in Google Play services SDKGoogle Play Services SDK · com.google.android.gms:play-serv…
- CVE-2022-38180In JetBrains Ktor before 2.1.0 the wrong authentication provider could be selected in some casesJetBrains Ktor · io.ktor:ktor
- CVE-2022-38179JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attackJetBrains Ktor · io.ktor:ktor
- CVE-2022-2779SourceCodester Gas Agency Management System oneWord.php unrestricted uploadSourceCodester Gas Agency Management System
- CVE-2022-2503Linux Kernel LoadPin bypass via dm-verity table reloadLinux Kernel
- CVE-2022-35949`undici.request` vulnerable to SSRF using absolute URL on `pathname`nodejs undici · undici
- CVE-2022-38183In Gitea before 1.16.9, it was possible for users to add existing issues to projects.code.gitea.io/gitea