# CVEs published 2022-08-12

53 CVEs were published on August 12, 2022: 1 critical, 5 high. Days are UTC.

- [CVE-2022-35942](https://cve.now/CVE-2022-35942.md): loopback-connector-postgresql Vulnerable to Improper Sanitization of \`contains\` Filter (CVSS 9.3, loopbackio loopback-connector-postgresql · loopback-connect…)
- [CVE-2022-35943](https://cve.now/CVE-2022-35943.md): SameSite may allow cross-site request forgery (CSRF) protection to be bypassed (CVSS 5.9, codeigniter4 shield · codeigniter4/shield)
- [CVE-2022-35956](https://cve.now/CVE-2022-35956.md): update\_by\_case before 0.1.3 vulnerable to sql injection (CVSS 5.8, camilova activerecord-update-by-case · update\_by\_case)
- [CVE-2022-35953](https://cve.now/CVE-2022-35953.md): URL Redirection to Untrusted Site ('Open Redirect') in bookwyrm (CVSS 7.1, bookwyrm-social bookwyrm)
- [CVE-2022-2804](https://cve.now/CVE-2022-2804.md): SourceCodester Zoo Management System apply\_vacancy.php unrestricted upload (CVSS 6.3, SourceCodester Zoo Management System)
- [CVE-2022-2803](https://cve.now/CVE-2022-2803.md): SourceCodester Zoo Management System animals.php sql injection (CVSS 6.3, SourceCodester Zoo Management System)
- [CVE-2022-2802](https://cve.now/CVE-2022-2802.md): SourceCodester Gas Agency Management System login.php sql injection (CVSS 7.3, SourceCodester Gas Agency Management System)
- [CVE-2022-2801](https://cve.now/CVE-2022-2801.md): SourceCodester Automated Beer Parlour Billing System Login sql injection (CVSS 6.3, SourceCodester Automated Beer Parlour Billing System)
- [CVE-2022-2800](https://cve.now/CVE-2022-2800.md): SourceCodester Gym Management System clickjacking (CVSS 4.3, SourceCodester Gym Management System)
- [CVE-2022-2624](https://cve.now/CVE-2022-2624.md): Heap buffer overflow in PDF in Google Chrome prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific use (no CVSS, Google Chrome)
- [CVE-2022-2623](https://cve.now/CVE-2022-2623.md): Use after free in Offline in Google Chrome on Android prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in spe (no CVSS, Google Chrome)
- [CVE-2022-2622](https://cve.now/CVE-2022-2622.md): Insufficient validation of untrusted input in Safe Browsing in Google Chrome on Windows prior to 104.0.5112.79 allowed a remote attacker to (no CVSS, Google Chrome)
- [CVE-2022-2621](https://cve.now/CVE-2022-2621.md): Use after free in Extensions in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a malicious extensi (no CVSS, Google Chrome)
- [CVE-2022-2620](https://cve.now/CVE-2022-2620.md): Use after free in WebUI in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in spe (no CVSS, Google Chrome)
- [CVE-2022-2619](https://cve.now/CVE-2022-2619.md): Insufficient validation of untrusted input in Settings in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to i (no CVSS, Google Chrome)
- [CVE-2022-2618](https://cve.now/CVE-2022-2618.md): Insufficient validation of untrusted input in Internals in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to bypass download (no CVSS, Google Chrome)
- [CVE-2022-2617](https://cve.now/CVE-2022-2617.md): Use after free in Extensions API in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a malicious ext (no CVSS, Google Chrome)
- [CVE-2022-2616](https://cve.now/CVE-2022-2616.md): Inappropriate implementation in Extensions API in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a (no CVSS, Google Chrome)
- [CVE-2022-2615](https://cve.now/CVE-2022-2615.md): Insufficient policy enforcement in Cookies in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to leak cross-origin data via a (no CVSS, Google Chrome)
- [CVE-2022-2614](https://cve.now/CVE-2022-2614.md): Use after free in Sign-In Flow in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to potentially exploit heap corruption via (no CVSS, Google Chrome)
- [CVE-2022-2613](https://cve.now/CVE-2022-2613.md): Use after free in Input in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to enage in spec (no CVSS, Google Chrome)
- [CVE-2022-2612](https://cve.now/CVE-2022-2612.md): Side-channel information leakage in Keyboard input in Google Chrome prior to 104.0.5112.79 allowed a remote attacker who had compromised the (no CVSS, Google Chrome)
- [CVE-2022-2611](https://cve.now/CVE-2022-2611.md): Inappropriate implementation in Fullscreen API in Google Chrome on Android prior to 104.0.5112.79 allowed a remote attacker to spoof the con (no CVSS, Google Chrome)
- [CVE-2022-2610](https://cve.now/CVE-2022-2610.md): Insufficient policy enforcement in Background Fetch in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to leak cross-origin d (no CVSS, Google Chrome)
- [CVE-2022-2609](https://cve.now/CVE-2022-2609.md): Use after free in Nearby Share in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage (no CVSS, Google Chrome)
- [CVE-2022-2608](https://cve.now/CVE-2022-2608.md): Use after free in Overview Mode in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engag (no CVSS, Google Chrome)
- [CVE-2022-2607](https://cve.now/CVE-2022-2607.md): Use after free in Tab Strip in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in (no CVSS, Google Chrome)
- [CVE-2022-2606](https://cve.now/CVE-2022-2606.md): Use after free in Managed devices API in Google Chrome prior to 104.0.5112.79 allowed a remote attacker who convinced a user to enable a spe (no CVSS, Google Chrome)
- [CVE-2022-2605](https://cve.now/CVE-2022-2605.md): Out of bounds read in Dawn in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to potentially exploit heap corruption via a cr (no CVSS, Google Chrome)
- [CVE-2022-2604](https://cve.now/CVE-2022-2604.md): Use after free in Safe Browsing in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to potentially exploit heap corruption via (no CVSS, Google Chrome)
- [CVE-2022-2603](https://cve.now/CVE-2022-2603.md): Use after free in Omnibox in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to potentially exploit heap corruption via a cra (no CVSS, Google Chrome)
- [CVE-2022-2587](https://cve.now/CVE-2022-2587.md): Out of bounds write in Chrome OS Audio Server in Google Chrome on Chrome OS prior to 102.0.5005.125 allowed a remote attacker to potentially (no CVSS, Google Chrome)
- [CVE-2022-2797](https://cve.now/CVE-2022-2797.md): SourceCodester Student Information System view\_student.php sql injection (CVSS 6.3, SourceCodester Student Information System)
- [CVE-2021-29117](https://cve.now/CVE-2021-29117.md): arcreader use-after-free (CVSS 7.8, Esri ArcReader)
- [CVE-2021-29112](https://cve.now/CVE-2021-29112.md): Esri ArcReader PMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Esri ArcReader)
- [CVE-2021-29118](https://cve.now/CVE-2021-29118.md): Esri ArcReader PMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Esri ArcReader)
- [CVE-2022-37397](https://cve.now/CVE-2022-37397.md): The software is vulnerable when using LDAP-based authentication in YCQL with Microsoft’s Active Directory (CVSS 8.3, Yugabyte DB)
- [CVE-2022-35980](https://cve.now/CVE-2022-35980.md): OpenSearch vulnerable to Improper Authorization of Index Containing Sensitive Information (CVSS 7.5, opensearch-project security · org.opensearch.plugin:opensea…)
- [CVE-2021-42751](https://cve.now/CVE-2021-42751.md): A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers (with administrative access) to injec (no CVSS)
- [CVE-2021-42750](https://cve.now/CVE-2021-42750.md): A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers (with administrative access) to injec (no CVSS)
- [CVE-2022-35585](https://cve.now/CVE-2022-35585.md): A stored cross-site scripting (XSS) issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaScript via the "start\_date" Par (no CVSS, forkcms/forkcms)
- [CVE-2022-35587](https://cve.now/CVE-2022-35587.md): A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the "publish\_on\_date" Paramete (no CVSS, forkcms/forkcms)
- [CVE-2022-35589](https://cve.now/CVE-2022-35589.md): A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the "publish\_on\_time" Paramete (no CVSS, forkcms/forkcms)
- [CVE-2022-35590](https://cve.now/CVE-2022-35590.md): A cross-site scripting (XSS) issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaScript via the "end\_date" Parameter (no CVSS, forkcms/forkcms)
- [CVE-2022-35932](https://cve.now/CVE-2022-35932.md): Missing rate limit when trying to join a password protected Nextcloud Talk conversation (CVSS 3.5, nextcloud security-advisories)
- [CVE-2022-37423](https://cve.now/CVE-2022-37423.md): Neo4j APOC (Awesome Procedures on Cypher) before 4.3.0.7 and 4.x before 4.4.0.8 allows Directory Traversal to sibling directories via apoc.l (no CVSS, org.neo4j.procedure:apoc)
- [CVE-2022-2390](https://cve.now/CVE-2022-2390.md): Mutable pending intent in Google Play services SDK (CVSS 6.1, Google Play Services SDK · com.google.android.gms:play-serv…)
- [CVE-2022-38180](https://cve.now/CVE-2022-38180.md): In JetBrains Ktor before 2.1.0 the wrong authentication provider could be selected in some cases (CVSS 5.3, JetBrains Ktor · io.ktor:ktor)
- [CVE-2022-38179](https://cve.now/CVE-2022-38179.md): JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack (CVSS 4.7, JetBrains Ktor · io.ktor:ktor)
- [CVE-2022-2779](https://cve.now/CVE-2022-2779.md): SourceCodester Gas Agency Management System oneWord.php unrestricted upload (CVSS 6.3, SourceCodester Gas Agency Management System)
- [CVE-2022-2503](https://cve.now/CVE-2022-2503.md): Linux Kernel LoadPin bypass via dm-verity table reload (CVSS 6.9, Linux Kernel)
- [CVE-2022-35949](https://cve.now/CVE-2022-35949.md): \`undici.request\` vulnerable to SSRF using absolute URL on \`pathname\` (CVSS 5.3, nodejs undici · undici)
- [CVE-2022-38183](https://cve.now/CVE-2022-38183.md): In Gitea before 1.16.9, it was possible for users to add existing issues to projects. (no CVSS, code.gitea.io/gitea)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-08-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.