CVEs published August 15, 2022
55 CVEs were published on August 15, 2022: 3 critical, 14 high.
- Published
- 55
- Critical
- 3
- High
- 14
- Medium
- 2
- Low
- 2
- Unrated
- 34
- Now in CISA KEV
- 0
- Fix available
- 19
Most affected products
- Esri Portal for ArcGIS
- 5
- vim/vim
- 3
- Easy Student Results
- 2
- Eyes of Network
- 2
- Microsoft Windows
- 2
- namelessmc/nameless
- 2
- cockpit-hq/cockpit
- 1
- Contact Form DB – Elementor
- 1
- Digital Publications by Supsystic
- 1
- Duplicate Page and Post
- 1
Critical 3
- CVE-2022-36010Arbitrary code execution via function parsing in react-editable-json-treeoxyno-zeta react-editable-json-tree · react-editable-json-t…
- CVE-2022-2821Missing Critical Step in Authentication in namelessmc/namelessnamelessmc/nameless
- CVE-2022-2818Improper Removal of Sensitive Information Before Storage or Transfer in cockpit-hq/cockpitcockpit-hq/cockpit
High 14
- CVE-2022-28756Local Privilege Escalation in Auto Updater for Zoom Client for Meetings for macOSZoom Video Communications Zoom Client for Meetings for MacOS
- CVE-2022-38187Prevent access to sharing/rest/content/features/analyze to unauthorized usersEsri Portal for ArcGIS
- CVE-2022-38188There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 which may allow a remote attacker able to convince a user tEsri Portal for ArcGIS
- CVE-2022-38186There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below which may allow a remote attacker able to convincEsri Portal for ArcGIS
- CVE-2022-35822Windows Defender Credential Guard Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2022-34711Windows Defender Credential Guard Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-35978Lua sandbox escape from mod in Minetestminetest
- CVE-2022-35624In Nordic nRF5 SDK for Mesh 5.0, a heap overflow vulnerability can be triggered by sending a series of segmented packets with SegO > SegN
- CVE-2022-35623In Nordic nRF5 SDK for Mesh 5.0, a heap overflow vulnerability can be triggered by sending a series of segmented control packets and access
- CVE-2022-2824Authorization Bypass Through User-Controlled Key in openemr/openemropenemr/openemr
- CVE-2022-2820Session Fixation in namelessmc/namelessnamelessmc/nameless
- CVE-2022-2816Out-of-bounds Read in vim/vimvim/vim
- CVE-2022-2817Use After Free in vim/vimvim/vim
- CVE-2022-2819Heap-based Buffer Overflow in vim/vimvim/vim
Medium, low and unrated 38
- CVE-2022-38357Improper neutralization of special elements leaves the Eyes of Network Web application vulnerable to an iFrame injection attack, via the urlEyes of Network Web
- CVE-2022-38359Cross-site request forgery attacks can be carried out against the Eyes of Network web application, due to an absence of adequate protectionsEyes of Network
- CVE-2022-38358Improper neutralization of input during web page generation leaves the Eyes of Network web application vulnerable to cross-site scripting atEyes of Network
- CVE-2022-38191HTML injection vulnerability in Portal for ArcGISEsri Portal for ArcGIS
- CVE-2022-38368An issue was discovered in Aviatrix Gateway before 6.6.5712 and 6.7.x before 6.7.1376.
- CVE-2022-38190Stored cross-site scripting vulnerability in Esri Portal for ArcGIS Configurable AppsEsri Portal for ArcGIS
- CVE-2020-21641Out-of-Band XML External Entity (OOB-XXE) vulnerability in Zoho ManageEngine Analytics Plus before 4.3.5 allows remote attackers to read arb
- CVE-2020-21642Directory Traversal vulnerability ZDBQAREFSUBDIR parameter in /zropusermgmt API in Zoho ManageEngine Analytics Plus before 4350 allows remot
- CVE-2020-23622An issue in the UPnP protocol in 4thline cling 2.0.0 through 2.1.2 allows remote attackers to cause a denial of service via an unchecked CALorg.fourthline.cling:cling-core
- CVE-2022-24654Authenticated stored cross-site scripting (XSS) vulnerability in "Field Server Address" field in INTELBRAS ATA 200 Firmware 74.19.10.21 allo
- CVE-2022-36526D-Link GO-RT-AC750 GORTAC750_revA_v101b03 & GO-RT-AC750_revB_FWv200b02 is vulnerable to Authentication Bypass via function phpcgi_main in cg
- CVE-2022-36525D-Link Go-RT-AC750 GORTAC750_revA_v101b03 & GO-RT-AC750_revB_FWv200b02 is vulnerable to Buffer Overflow via authenticationcgi_main.
- CVE-2022-36524D-Link GO-RT-AC750 GORTAC750_revA_v101b03 & GO-RT-AC750_revB_FWv200b02 is vulnerable to Static Default Credentials via /etc/init0.d/S80telne
- CVE-2022-36523D-Link Go-RT-AC750 GORTAC750_revA_v101b03 & GO-RT-AC750_revB_FWv200b02 is vulnerable to command injection via /htdocs/upnpinc/gena.php.
- CVE-2022-33989dproxy-nexgen (aka dproxy nexgen) uses a static UDP source port (selected randomly only at boot time) in upstream queries sent to DNS resolv
- CVE-2022-33990Misinterpretation of special domain name characters in dproxy-nexgen (aka dproxy nexgen) leads to cache poisoning because domain names and t
- CVE-2022-33991dproxy-nexgen (aka dproxy nexgen) forwards and caches DNS queries with the CD (aka checking disabled) bit set to 1.
- CVE-2022-33988dproxy-nexgen (aka dproxy nexgen) re-uses the DNS transaction id (TXID) value from client queries, which allows attackers (able to send quer
- CVE-2022-34294totd 1.5.3 uses a fixed UDP source port in upstream queries sent to DNS resolvers.
- CVE-2022-33992DNRD (aka Domain Name Relay Daemon) 2.20.3 forwards and caches DNS queries with the CD (aka checking disabled) bit set to 1.
- CVE-2022-33993Misinterpretation of special domain name characters in DNRD (aka Domain Name Relay Daemon) 2.20.3 leads to cache poisoning because domain na
- CVE-2022-36262An issue was discovered in taocms 3.0.2.
- CVE-2022-2822Authentication Bypass by Primary Weakness in octoprint/octoprintoctoprint/octoprint · octoprint
- CVE-2022-2535SearchWP Live Ajax Search < 1.6.2 - Unauthenticated Arbitrary Post Title DisclosureSearchWP Live Ajax Search
- CVE-2022-2384Digital Publications by Supsystic < 1.7.4 - Admin+ Stored Cross-Site ScriptingDigital Publications by Supsystic
- CVE-2022-2381E Unlocked - Student Result <= 1.0.4 - Arbitrary File Upload via CSRFE Unlocked – Student Result
- CVE-2022-2379Easy Student Results <= 2.2.8 - Sensitive Information Disclosure via REST APIEasy Student Results
- CVE-2022-2378Easy Student Results <= 2.2.8 - Reflected Cross-Site ScriptingEasy Student Results
- CVE-2022-2354WP-DBManager < 2.80.8 - Admin+ Remote Command ExecutionWP-DBManager
- CVE-2022-2314VR Calendar < 2.3.2 - Unauthenticated Arbitrary Function CallVR Calendar
- CVE-2022-2180GREYD.SUITE < 1.2.7 - Unauthenticated File Upload to RCEgreyd_suite
- CVE-2022-2152Duplicate Page and Post Plugin < 2.8 - Admin+ Stored Cross-Site ScriptingDuplicate Page and Post
- CVE-2022-2116Elementor Contact Form DB < 1.8.0 - Reflected Cross-Site ScriptingContact Form DB – Elementor
- CVE-2022-2814SourceCodester Simple and Nice Shopping Cart Script login.php cross site scriptingSourceCodester Simple and Nice Shopping Cart Script
- CVE-2022-38222There is a use-after-free issue in JBIG2Stream::close() located in JBIG2Stream.cc in Xpdf 4.04.
- CVE-2022-38221A buffer overflow in the FTcpListener thread in The Isle Evrima (the dedicated server on Windows and Linux) 0.9.88.07 before 2022-08-12 allo
- CVE-2020-21365Directory traversal vulnerability in wkhtmltopdf through 0.12.5 allows remote attackers to read local files and disclose sensitive informati
- CVE-2022-38223There is an out-of-bounds write in checkType located in etc.c in w3m 0.5.3.