# CVEs published 2022-08-15

55 CVEs were published on August 15, 2022: 3 critical, 14 high. Days are UTC.

- [CVE-2022-28756](https://cve.now/CVE-2022-28756.md): Local Privilege Escalation in Auto Updater for Zoom Client for Meetings for macOS (CVSS 8.8, Zoom Video Communications Zoom Client for Meetings for MacOS)
- [CVE-2022-38357](https://cve.now/CVE-2022-38357.md): Improper neutralization of special elements leaves the Eyes of Network Web application vulnerable to an iFrame injection attack, via the url (no CVSS, Eyes of Network Web)
- [CVE-2022-38359](https://cve.now/CVE-2022-38359.md): Cross-site request forgery attacks can be carried out against the Eyes of Network web application, due to an absence of adequate protections (no CVSS, Eyes of Network)
- [CVE-2022-38358](https://cve.now/CVE-2022-38358.md): Improper neutralization of input during web page generation leaves the Eyes of Network web application vulnerable to cross-site scripting at (no CVSS, Eyes of Network)
- [CVE-2022-38191](https://cve.now/CVE-2022-38191.md): HTML injection vulnerability in Portal for ArcGIS (CVSS 6.1, Esri Portal for ArcGIS)
- [CVE-2022-38187](https://cve.now/CVE-2022-38187.md): Prevent access to sharing/rest/content/features/analyze to unauthorized users (CVSS 7.5, Esri Portal for ArcGIS)
- [CVE-2022-38368](https://cve.now/CVE-2022-38368.md): An issue was discovered in Aviatrix Gateway before 6.6.5712 and 6.7.x before 6.7.1376. (no CVSS)
- [CVE-2022-38188](https://cve.now/CVE-2022-38188.md): There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 which may allow a remote attacker able to convince a user t (CVSS 7.1, Esri Portal for ArcGIS)
- [CVE-2022-38190](https://cve.now/CVE-2022-38190.md): Stored cross-site scripting vulnerability in Esri Portal for ArcGIS Configurable Apps (CVSS 6.1, Esri Portal for ArcGIS)
- [CVE-2022-38186](https://cve.now/CVE-2022-38186.md): There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below which may allow a remote attacker able to convinc (CVSS 7.1, Esri Portal for ArcGIS)
- [CVE-2022-35822](https://cve.now/CVE-2022-35822.md): Windows Defender Credential Guard Security Feature Bypass Vulnerability (CVSS 7.1, Microsoft Windows)
- [CVE-2022-34711](https://cve.now/CVE-2022-34711.md): Windows Defender Credential Guard Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2020-21641](https://cve.now/CVE-2020-21641.md): Out-of-Band XML External Entity (OOB-XXE) vulnerability in Zoho ManageEngine Analytics Plus before 4.3.5 allows remote attackers to read arb (no CVSS)
- [CVE-2020-21642](https://cve.now/CVE-2020-21642.md): Directory Traversal vulnerability ZDBQAREFSUBDIR parameter in /zropusermgmt API in Zoho ManageEngine Analytics Plus before 4350 allows remot (no CVSS)
- [CVE-2020-23622](https://cve.now/CVE-2020-23622.md): An issue in the UPnP protocol in 4thline cling 2.0.0 through 2.1.2 allows remote attackers to cause a denial of service via an unchecked CAL (no CVSS, org.fourthline.cling:cling-core)
- [CVE-2022-35978](https://cve.now/CVE-2022-35978.md): Lua sandbox escape from mod in Minetest (CVSS 7.7, minetest)
- [CVE-2022-24654](https://cve.now/CVE-2022-24654.md): Authenticated stored cross-site scripting (XSS) vulnerability in "Field Server Address" field in INTELBRAS ATA 200 Firmware 74.19.10.21 allo (no CVSS)
- [CVE-2022-36010](https://cve.now/CVE-2022-36010.md): Arbitrary code execution via function parsing in react-editable-json-tree (CVSS 10.0, oxyno-zeta react-editable-json-tree · react-editable-json-t…)
- [CVE-2022-36526](https://cve.now/CVE-2022-36526.md): D-Link GO-RT-AC750 GORTAC750\_revA\_v101b03 & GO-RT-AC750\_revB\_FWv200b02 is vulnerable to Authentication Bypass via function phpcgi\_main in cg (no CVSS)
- [CVE-2022-36525](https://cve.now/CVE-2022-36525.md): D-Link Go-RT-AC750 GORTAC750\_revA\_v101b03 & GO-RT-AC750\_revB\_FWv200b02 is vulnerable to Buffer Overflow via authenticationcgi\_main. (no CVSS)
- [CVE-2022-36524](https://cve.now/CVE-2022-36524.md): D-Link GO-RT-AC750 GORTAC750\_revA\_v101b03 & GO-RT-AC750\_revB\_FWv200b02 is vulnerable to Static Default Credentials via /etc/init0.d/S80telne (no CVSS)
- [CVE-2022-36523](https://cve.now/CVE-2022-36523.md): D-Link Go-RT-AC750 GORTAC750\_revA\_v101b03 & GO-RT-AC750\_revB\_FWv200b02 is vulnerable to command injection via /htdocs/upnpinc/gena.php. (no CVSS)
- [CVE-2022-35624](https://cve.now/CVE-2022-35624.md): In Nordic nRF5 SDK for Mesh 5.0, a heap overflow vulnerability can be triggered by sending a series of segmented packets with SegO \> SegN (CVSS 8.2)
- [CVE-2022-35623](https://cve.now/CVE-2022-35623.md): In Nordic nRF5 SDK for Mesh 5.0, a heap overflow vulnerability can be triggered by sending a series of segmented control packets and access (CVSS 8.2)
- [CVE-2022-2824](https://cve.now/CVE-2022-2824.md): Authorization Bypass Through User-Controlled Key in openemr/openemr (CVSS 8.8, openemr/openemr)
- [CVE-2022-33989](https://cve.now/CVE-2022-33989.md): dproxy-nexgen (aka dproxy nexgen) uses a static UDP source port (selected randomly only at boot time) in upstream queries sent to DNS resolv (no CVSS)
- [CVE-2022-33990](https://cve.now/CVE-2022-33990.md): Misinterpretation of special domain name characters in dproxy-nexgen (aka dproxy nexgen) leads to cache poisoning because domain names and t (no CVSS)
- [CVE-2022-33991](https://cve.now/CVE-2022-33991.md): dproxy-nexgen (aka dproxy nexgen) forwards and caches DNS queries with the CD (aka checking disabled) bit set to 1. (no CVSS)
- [CVE-2022-33988](https://cve.now/CVE-2022-33988.md): dproxy-nexgen (aka dproxy nexgen) re-uses the DNS transaction id (TXID) value from client queries, which allows attackers (able to send quer (no CVSS)
- [CVE-2022-34294](https://cve.now/CVE-2022-34294.md): totd 1.5.3 uses a fixed UDP source port in upstream queries sent to DNS resolvers. (no CVSS)
- [CVE-2022-33992](https://cve.now/CVE-2022-33992.md): DNRD (aka Domain Name Relay Daemon) 2.20.3 forwards and caches DNS queries with the CD (aka checking disabled) bit set to 1. (no CVSS)
- [CVE-2022-33993](https://cve.now/CVE-2022-33993.md): Misinterpretation of special domain name characters in DNRD (aka Domain Name Relay Daemon) 2.20.3 leads to cache poisoning because domain na (no CVSS)
- [CVE-2022-36262](https://cve.now/CVE-2022-36262.md): An issue was discovered in taocms 3.0.2. (no CVSS)
- [CVE-2022-2820](https://cve.now/CVE-2022-2820.md): Session Fixation in namelessmc/nameless (CVSS 7.0, namelessmc/nameless)
- [CVE-2022-2821](https://cve.now/CVE-2022-2821.md): Missing Critical Step in Authentication in namelessmc/nameless (CVSS 9.8, namelessmc/nameless)
- [CVE-2022-2822](https://cve.now/CVE-2022-2822.md): Authentication Bypass by Primary Weakness in octoprint/octoprint (CVSS 3.7, octoprint/octoprint · octoprint)
- [CVE-2022-2818](https://cve.now/CVE-2022-2818.md): Improper Removal of Sensitive Information Before Storage or Transfer in cockpit-hq/cockpit (CVSS 9.8, cockpit-hq/cockpit)
- [CVE-2022-2535](https://cve.now/CVE-2022-2535.md): SearchWP Live Ajax Search \< 1.6.2 - Unauthenticated Arbitrary Post Title Disclosure (no CVSS, SearchWP Live Ajax Search)
- [CVE-2022-2384](https://cve.now/CVE-2022-2384.md): Digital Publications by Supsystic \< 1.7.4 - Admin+ Stored Cross-Site Scripting (no CVSS, Digital Publications by Supsystic)
- [CVE-2022-2381](https://cve.now/CVE-2022-2381.md): E Unlocked - Student Result \<= 1.0.4 - Arbitrary File Upload via CSRF (no CVSS, E Unlocked – Student Result)
- [CVE-2022-2379](https://cve.now/CVE-2022-2379.md): Easy Student Results \<= 2.2.8 - Sensitive Information Disclosure via REST API (no CVSS, Easy Student Results)
- [CVE-2022-2378](https://cve.now/CVE-2022-2378.md): Easy Student Results \<= 2.2.8 - Reflected Cross-Site Scripting (no CVSS, Easy Student Results)
- [CVE-2022-2354](https://cve.now/CVE-2022-2354.md): WP-DBManager \< 2.80.8 - Admin+ Remote Command Execution (no CVSS, WP-DBManager)
- [CVE-2022-2314](https://cve.now/CVE-2022-2314.md): VR Calendar \< 2.3.2 - Unauthenticated Arbitrary Function Call (no CVSS, VR Calendar)
- [CVE-2022-2180](https://cve.now/CVE-2022-2180.md): GREYD.SUITE \< 1.2.7 - Unauthenticated File Upload to RCE (no CVSS, greyd\_suite)
- [CVE-2022-2152](https://cve.now/CVE-2022-2152.md): Duplicate Page and Post Plugin \< 2.8 - Admin+ Stored Cross-Site Scripting (no CVSS, Duplicate Page and Post)
- [CVE-2022-2116](https://cve.now/CVE-2022-2116.md): Elementor Contact Form DB \< 1.8.0 - Reflected Cross-Site Scripting (no CVSS, Contact Form DB – Elementor)
- [CVE-2022-2814](https://cve.now/CVE-2022-2814.md): SourceCodester Simple and Nice Shopping Cart Script login.php cross site scripting (CVSS 3.5, SourceCodester Simple and Nice Shopping Cart Script)
- [CVE-2022-38222](https://cve.now/CVE-2022-38222.md): There is a use-after-free issue in JBIG2Stream::close() located in JBIG2Stream.cc in Xpdf 4.04. (no CVSS)
- [CVE-2022-38221](https://cve.now/CVE-2022-38221.md): A buffer overflow in the FTcpListener thread in The Isle Evrima (the dedicated server on Windows and Linux) 0.9.88.07 before 2022-08-12 allo (no CVSS)
- [CVE-2020-21365](https://cve.now/CVE-2020-21365.md): Directory traversal vulnerability in wkhtmltopdf through 0.12.5 allows remote attackers to read local files and disclose sensitive informati (no CVSS)
- [CVE-2022-2816](https://cve.now/CVE-2022-2816.md): Out-of-bounds Read in vim/vim (CVSS 7.8, vim/vim)
- [CVE-2022-2817](https://cve.now/CVE-2022-2817.md): Use After Free in vim/vim (CVSS 7.8, vim/vim)
- [CVE-2022-2819](https://cve.now/CVE-2022-2819.md): Heap-based Buffer Overflow in vim/vim (CVSS 7.8, vim/vim)
- [CVE-2022-38223](https://cve.now/CVE-2022-38223.md): There is an out-of-bounds write in checkType located in etc.c in w3m 0.5.3. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-08-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.