# CVEs published 2022-08-16

166 CVEs were published on August 16, 2022: 4 critical, 9 high. Days are UTC.

- [CVE-2022-1401](https://cve.now/CVE-2022-1401.md): Insufficient validation of provided paths in Exago WrImageResource.axd (CVSS 6.9, Device42 CMDB)
- [CVE-2022-1410](https://cve.now/CVE-2022-1410.md): Remote Code Execution in Device42 ApplianceManager console (CVSS 8.0, Device42 CMDB)
- [CVE-2022-1400](https://cve.now/CVE-2022-1400.md): Hardcoded encryption key IV in Exago WebReportsApi.dll (CVSS 7.1, Device42 CMDB)
- [CVE-2022-1399](https://cve.now/CVE-2022-1399.md): Remote code execution in scheduled tasks component (CVSS 9.1, Device42 CMDB)
- [CVE-2022-25799](https://cve.now/CVE-2022-25799.md): An open redirect vulnerability exists in CERT/CC VINCE software prior to version 1.50.0 (no CVSS, CERT/CC VINCE - The Vulnerability Information and Coordinat…)
- [CVE-2021-42052](https://cve.now/CVE-2021-42052.md): IPESA e-Flow 3.3.6 allows path traversal for reading any file within the web root directory via the lib/js/build/STEResource.res path and th (no CVSS)
- [CVE-2022-38238](https://cve.now/CVE-2022-38238.md): XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::lookChar() at /xpdf/Stream.cc. (no CVSS)
- [CVE-2022-38237](https://cve.now/CVE-2022-38237.md): XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::readScan() at /xpdf/Stream.cc. (no CVSS)
- [CVE-2022-38236](https://cve.now/CVE-2022-38236.md): XPDF commit ffaf11c was discovered to contain a global-buffer overflow via Lexer::getObj(Object\*) at /xpdf/Lexer.cc. (no CVSS)
- [CVE-2022-38235](https://cve.now/CVE-2022-38235.md): XPDF commit ffaf11c was discovered to contain a segmentation violation via DCTStream::getChar() at /xpdf/Stream.cc. (no CVSS)
- [CVE-2022-38234](https://cve.now/CVE-2022-38234.md): XPDF commit ffaf11c was discovered to contain a segmentation violation via Lexer::getObj(Object\*) at /xpdf/Lexer.cc. (no CVSS)
- [CVE-2022-38233](https://cve.now/CVE-2022-38233.md): XPDF commit ffaf11c was discovered to contain a segmentation violation via DCTStream::readMCURow() at /xpdf/Stream.cc. (no CVSS)
- [CVE-2022-38231](https://cve.now/CVE-2022-38231.md): XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::getChar() at /xpdf/Stream.cc. (no CVSS)
- [CVE-2022-38230](https://cve.now/CVE-2022-38230.md): XPDF commit ffaf11c was discovered to contain a floating point exception (FPE) via DCTStream::decodeImage() at /xpdf/Stream.cc. (no CVSS)
- [CVE-2022-38228](https://cve.now/CVE-2022-38228.md): XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::transformDataUnit at /xpdf/Stream.cc. (no CVSS)
- [CVE-2022-38229](https://cve.now/CVE-2022-38229.md): XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::readHuffSym(DCTHuffTable\*) at /xpdf/Stream.cc. (no CVSS)
- [CVE-2022-38227](https://cve.now/CVE-2022-38227.md): XPDF commit ffaf11c was discovered to contain a stack overflow via \_\_asan\_memcpy at asan\_interceptors\_memintrinsics.cpp. (no CVSS)
- [CVE-2022-37781](https://cve.now/CVE-2022-37781.md): fdkaac v1.0.3 was discovered to contain a heap buffer overflow via \_\_interceptor\_memcpy.part.46 at /sanitizer\_common/sanitizer\_common\_interc (no CVSS)
- [CVE-2022-36153](https://cve.now/CVE-2022-36153.md): tifig v0.2.2 was discovered to contain a segmentation violation via std::vector\<unsigned int, std::allocator\<unsigned int\> \>::size() const a (no CVSS)
- [CVE-2022-36151](https://cve.now/CVE-2022-36151.md): tifig v0.2.2 was discovered to contain a segmentation violation via getType() at /common/bbox.cpp. (no CVSS)
- [CVE-2022-36150](https://cve.now/CVE-2022-36150.md): tifig v0.2.2 was discovered to contain a heap-buffer overflow via \_\_asan\_memmove at /asan/asan\_interceptors\_memintrinsics.cpp. (no CVSS)
- [CVE-2022-36149](https://cve.now/CVE-2022-36149.md): tifig v0.2.2 was discovered to contain a heap-use-after-free via temInfoEntry(). (no CVSS)
- [CVE-2022-36146](https://cve.now/CVE-2022-36146.md): SWFMill commit 53d7690 was discovered to contain a memory allocation issue via operator new\[\](unsigned long) at asan\_new\_delete.cpp. (no CVSS)
- [CVE-2022-36144](https://cve.now/CVE-2022-36144.md): SWFMill commit 53d7690 was discovered to contain a heap-buffer overflow via base64\_encode. (no CVSS)
- [CVE-2022-36145](https://cve.now/CVE-2022-36145.md): SWFMill commit 53d7690 was discovered to contain a segmentation violation via SWF::Reader::getWord(). (no CVSS)
- [CVE-2022-36143](https://cve.now/CVE-2022-36143.md): SWFMill commit 53d7690 was discovered to contain a heap-buffer overflow via \_\_interceptor\_strlen.part at /sanitizer\_common/sanitizer\_common\_ (no CVSS)
- [CVE-2022-36142](https://cve.now/CVE-2022-36142.md): SWFMill commit 53d7690 was discovered to contain a heap-buffer overflow via SWF::Reader::getU30(). (no CVSS)
- [CVE-2022-36141](https://cve.now/CVE-2022-36141.md): SWFMill commit 53d7690 was discovered to contain a segmentation violation via SWF::MethodBody::write(SWF::Writer\*, SWF::Context\*). (no CVSS)
- [CVE-2022-36140](https://cve.now/CVE-2022-36140.md): SWFMill commit 53d7690 was discovered to contain a segmentation violation via SWF::DeclareFunction2::write(SWF::Writer\*, SWF::Context\*). (no CVSS)
- [CVE-2022-35486](https://cve.now/CVE-2022-35486.md): OTFCC v0.10.4 was discovered to contain a segmentation violation via /release-x64/otfccdump+0x6badae. (no CVSS)
- [CVE-2022-36139](https://cve.now/CVE-2022-36139.md): SWFMill commit 53d7690 was discovered to contain a heap-buffer overflow via SWF::Writer::writeByte(unsigned char). (no CVSS)
- [CVE-2022-35484](https://cve.now/CVE-2022-35484.md): OTFCC v0.10.4 was discovered to contain a segmentation violation via /release-x64/otfccdump+0x6b6a8f. (no CVSS)
- [CVE-2022-35485](https://cve.now/CVE-2022-35485.md): OTFCC v0.10.4 was discovered to contain a segmentation violation via /release-x64/otfccdump+0x703969. (no CVSS)
- [CVE-2022-35483](https://cve.now/CVE-2022-35483.md): OTFCC v0.10.4 was discovered to contain a segmentation violation via /release-x64/otfccdump+0x5266a8. (no CVSS)
- [CVE-2022-35482](https://cve.now/CVE-2022-35482.md): OTFCC v0.10.4 was discovered to contain a segmentation violation via /release-x64/otfccdump+0x65f724. (no CVSS)
- [CVE-2022-35481](https://cve.now/CVE-2022-35481.md): OTFCC v0.10.4 was discovered to contain a segmentation violation via /multiarch/memmove-vec-unaligned-erms.S. (no CVSS)
- [CVE-2022-35471](https://cve.now/CVE-2022-35471.md): OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6e41b0. (no CVSS)
- [CVE-2022-35477](https://cve.now/CVE-2022-35477.md): OTFCC v0.10.4 was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fe954. (no CVSS)
- [CVE-2022-35479](https://cve.now/CVE-2022-35479.md): OTFCC v0.10.4 was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fbbb6. (no CVSS)
- [CVE-2022-35475](https://cve.now/CVE-2022-35475.md): OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6e41a8. (no CVSS)
- [CVE-2022-35470](https://cve.now/CVE-2022-35470.md): OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x65fc97. (no CVSS)
- [CVE-2022-35473](https://cve.now/CVE-2022-35473.md): OTFCC v0.10.4 was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fe9a7. (no CVSS)
- [CVE-2022-35469](https://cve.now/CVE-2022-35469.md): OTFCC v0.10.4 was discovered to contain a segmentation violation via /x86\_64-linux-gnu/libc.so.6+0xbb384. (no CVSS)
- [CVE-2022-35466](https://cve.now/CVE-2022-35466.md): OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6c0473. (no CVSS)
- [CVE-2022-35468](https://cve.now/CVE-2022-35468.md): OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6e420d. (no CVSS)
- [CVE-2022-35467](https://cve.now/CVE-2022-35467.md): OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6e41b8. (no CVSS)
- [CVE-2022-35465](https://cve.now/CVE-2022-35465.md): OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6c0414. (no CVSS)
- [CVE-2022-35464](https://cve.now/CVE-2022-35464.md): OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6171b2. (no CVSS)
- [CVE-2022-35462](https://cve.now/CVE-2022-35462.md): OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6c0bc3. (no CVSS)
- [CVE-2022-35463](https://cve.now/CVE-2022-35463.md): OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6b0478. (no CVSS)
- [CVE-2022-35460](https://cve.now/CVE-2022-35460.md): OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x61731f. (no CVSS)
- [CVE-2022-35461](https://cve.now/CVE-2022-35461.md): OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6c0a32. (no CVSS)
- [CVE-2022-35458](https://cve.now/CVE-2022-35458.md): OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6b05ce. (no CVSS)
- [CVE-2022-35459](https://cve.now/CVE-2022-35459.md): OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6e412a. (no CVSS)
- [CVE-2022-35455](https://cve.now/CVE-2022-35455.md): OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6b0d63. (no CVSS)
- [CVE-2022-35456](https://cve.now/CVE-2022-35456.md): OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x617087. (no CVSS)
- [CVE-2022-35454](https://cve.now/CVE-2022-35454.md): OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6b05aa. (no CVSS)
- [CVE-2022-35453](https://cve.now/CVE-2022-35453.md): OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6c08a6. (no CVSS)
- [CVE-2022-35451](https://cve.now/CVE-2022-35451.md): OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6b03b5. (no CVSS)
- [CVE-2022-35452](https://cve.now/CVE-2022-35452.md): OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6b0b2c. (no CVSS)
- [CVE-2022-35450](https://cve.now/CVE-2022-35450.md): OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6b84b1. (no CVSS)
- [CVE-2022-35448](https://cve.now/CVE-2022-35448.md): OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6b55af. (no CVSS)
- [CVE-2022-35449](https://cve.now/CVE-2022-35449.md): OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6b0466. (no CVSS)
- [CVE-2022-35447](https://cve.now/CVE-2022-35447.md): OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6b04de. (no CVSS)
- [CVE-2022-35434](https://cve.now/CVE-2022-35434.md): jpeg-quantsmooth before commit 8879454 contained a floating point exception (FPE) via /jpeg-quantsmooth/jpegqs+0x4f5d6c. (no CVSS)
- [CVE-2022-35433](https://cve.now/CVE-2022-35433.md): ffjpeg commit caade60a69633d74100bd3c2528bddee0b6a1291 was discovered to contain a memory leak via /src/jfif.c. (no CVSS)
- [CVE-2022-35114](https://cve.now/CVE-2022-35114.md): SWFTools commit 772e55a2 was discovered to contain a segmentation violation via extractFrame at /readers/swf.c. (no CVSS)
- [CVE-2022-35113](https://cve.now/CVE-2022-35113.md): SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via swf\_DefineLosslessBitsTagToImage at /modules/swfbits.c. (no CVSS)
- [CVE-2022-35111](https://cve.now/CVE-2022-35111.md): SWFTools commit 772e55a2 was discovered to contain a stack overflow via \_\_sanitizer::StackDepotNode::hash(\_\_sanitizer::StackTrace const&) at (no CVSS)
- [CVE-2022-35110](https://cve.now/CVE-2022-35110.md): SWFTools commit 772e55a2 was discovered to contain a memory leak via /lib/mem.c. (no CVSS)
- [CVE-2022-35109](https://cve.now/CVE-2022-35109.md): SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via draw\_stroke at /gfxpoly/stroke.c. (no CVSS)
- [CVE-2022-35108](https://cve.now/CVE-2022-35108.md): SWFTools commit 772e55a2 was discovered to contain a segmentation violation via DCTStream::getChar() at /xpdf/Stream.cc. (no CVSS)
- [CVE-2022-35107](https://cve.now/CVE-2022-35107.md): SWFTools commit 772e55a2 was discovered to contain a stack overflow via vfprintf at /stdio-common/vfprintf.c. (no CVSS)
- [CVE-2022-35105](https://cve.now/CVE-2022-35105.md): SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via /bin/png2swf+0x552cea. (no CVSS)
- [CVE-2022-35106](https://cve.now/CVE-2022-35106.md): SWFTools commit 772e55a2 was discovered to contain a segmentation violation via FoFiTrueType::computeTableChecksum(unsigned char\*, int) at / (no CVSS)
- [CVE-2022-35104](https://cve.now/CVE-2022-35104.md): SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via DCTStream::reset() at /xpdf/Stream.cc. (no CVSS)
- [CVE-2022-35100](https://cve.now/CVE-2022-35100.md): SWFTools commit 772e55a2 was discovered to contain a segmentation violation via gfxline\_getbbox at /lib/gfxtools.c. (no CVSS)
- [CVE-2022-35101](https://cve.now/CVE-2022-35101.md): SWFTools commit 772e55a2 was discovered to contain a segmentation violation via /multiarch/memset-vec-unaligned-erms.S. (no CVSS)
- [CVE-2022-35013](https://cve.now/CVE-2022-35013.md): PNGDec commit 8abf6be was discovered to contain a FPE via SaveBMP at /linux/main.cpp. (no CVSS)
- [CVE-2022-35012](https://cve.now/CVE-2022-35012.md): PNGDec commit 8abf6be was discovered to contain a heap buffer overflow via SaveBMP at /linux/main.cpp. (no CVSS)
- [CVE-2022-35011](https://cve.now/CVE-2022-35011.md): PNGDec commit 8abf6be was discovered to contain a global buffer overflow via inflate\_fast at /src/inffast.c. (no CVSS)
- [CVE-2022-35009](https://cve.now/CVE-2022-35009.md): PNGDec commit 8abf6be was discovered to contain a memory allocation problem via asan\_malloc\_linux.cpp. (no CVSS)
- [CVE-2022-35010](https://cve.now/CVE-2022-35010.md): PNGDec commit 8abf6be was discovered to contain a heap buffer overflow via asan\_interceptors\_memintrinsics.cpp. (no CVSS)
- [CVE-2022-36155](https://cve.now/CVE-2022-36155.md): tifig v0.2.2 was discovered to contain a resource allocation issue via operator new(unsigned long) at asan\_new\_delete.cpp. (no CVSS)
- [CVE-2022-36152](https://cve.now/CVE-2022-36152.md): tifig v0.2.2 was discovered to contain a memory leak via operator new\[\](unsigned long) at /asan/asan\_new\_delete.cpp. (no CVSS)
- [CVE-2022-36148](https://cve.now/CVE-2022-36148.md): fdkaac commit 53fe239 was discovered to contain a floating point exception (FPE) via wav\_open at /src/wav\_reader.c. (no CVSS)
- [CVE-2022-35478](https://cve.now/CVE-2022-35478.md): OTFCC v0.10.4 was discovered to contain a segmentation violation via /release-x64/otfccdump+0x6babea. (no CVSS)
- [CVE-2022-35476](https://cve.now/CVE-2022-35476.md): OTFCC v0.10.4 was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fbc0b. (no CVSS)
- [CVE-2022-35474](https://cve.now/CVE-2022-35474.md): OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6b544e. (no CVSS)
- [CVE-2022-35472](https://cve.now/CVE-2022-35472.md): OTFCC v0.10.4 was discovered to contain a global overflow via /release-x64/otfccdump+0x718693. (no CVSS)
- [CVE-2022-37393](https://cve.now/CVE-2022-37393.md): Zimbra zmslapd arbitrary module load (no CVSS, Synacor Zimbra Server)
- [CVE-2022-35008](https://cve.now/CVE-2022-35008.md): PNGDec commit 8abf6be was discovered to contain a stack overflow via /linux/main.cpp. (no CVSS)
- [CVE-2022-35007](https://cve.now/CVE-2022-35007.md): PNGDec commit 8abf6be was discovered to contain a heap buffer overflow via \_\_interceptor\_fwrite.part.57 at sanitizer\_common\_interceptors.inc (no CVSS)
- [CVE-2022-35003](https://cve.now/CVE-2022-35003.md): JPEGDEC commit be4843c was discovered to contain a global buffer overflow via ucDitherBuffer at /src/jpeg.inl. (no CVSS)
- [CVE-2022-35004](https://cve.now/CVE-2022-35004.md): JPEGDEC commit be4843c was discovered to contain a FPE via TIFFSHORT at /src/jpeg.inl. (no CVSS)
- [CVE-2022-35002](https://cve.now/CVE-2022-35002.md): JPEGDEC commit be4843c was discovered to contain a segmentation fault via TIFFSHORT at /src/jpeg.inl. (no CVSS)
- [CVE-2022-35000](https://cve.now/CVE-2022-35000.md): JPEGDEC commit be4843c was discovered to contain a segmentation fault via fseek at /libio/fseek.c. (no CVSS)
- [CVE-2022-34999](https://cve.now/CVE-2022-34999.md): JPEGDEC commit be4843c was discovered to contain a FPE via DecodeJPEG at /src/jpeg.inl. (no CVSS)
- [CVE-2022-34998](https://cve.now/CVE-2022-34998.md): JPEGDEC commit be4843c was discovered to contain a global buffer overflow via JPEGDecodeMCU at /src/jpeg.inl. (no CVSS)
- [CVE-2022-2662](https://cve.now/CVE-2022-2662.md): Sequi PortBloque S Improper Authentication (CVSS 9.6, Sequi PortBloque S)
- [CVE-2022-2661](https://cve.now/CVE-2022-2661.md): Sequi PortBloque S Improper Authorization (CVSS 9.9, Sequi PortBloque S)
- [CVE-2022-37437](https://cve.now/CVE-2022-37437.md): Ingest Actions UI in Splunk Enterprise 9.0.0 disabled TLS certificate validation (CVSS 7.4, Splunk Enterprise)
- [CVE-2022-37439](https://cve.now/CVE-2022-37439.md): Malformed ZIP file crashes Universal Forwarders and Splunk Enterprise through file monitoring input (CVSS 5.5, Splunk Enterprise · Splunk Universal Forwarders)
- [CVE-2022-37438](https://cve.now/CVE-2022-37438.md): Information disclosure via the dashboard drilldown in Splunk Enterprise (CVSS 2.6, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2022-34259](https://cve.now/CVE-2022-34259.md): Adobe Commerce Improper Access Control Security feature bypass (CVSS 5.3, Adobe Magento Commerce · magento/community-edition)
- [CVE-2022-34257](https://cve.now/CVE-2022-34257.md): Adobe Commerce Stored XSS Arbitrary code execution (CVSS 6.1, Adobe Magento Commerce · magento/community-edition)
- [CVE-2022-34253](https://cve.now/CVE-2022-34253.md): Adobe Commerce XML Injection Arbitrary code execution (CVSS 9.1, Adobe Magento Commerce · magento/community-edition)
- [CVE-2022-34255](https://cve.now/CVE-2022-34255.md): Adobe Commerce Improper Access Control Privilege escalation (CVSS 8.8, Adobe Magento Commerce · magento/community-edition)
- [CVE-2022-34254](https://cve.now/CVE-2022-34254.md): Adobe Commerce Improper Limitation of a Pathname to a Restricted Directory Arbitrary code execution (CVSS 8.5, Adobe Magento Commerce · magento/community-edition)
- [CVE-2022-34256](https://cve.now/CVE-2022-34256.md): Adobe Commerce Improper Authorization Privilege escalation (CVSS 7.5, Adobe Magento Commerce · magento/community-edition)
- [CVE-2022-34258](https://cve.now/CVE-2022-34258.md): Adobe Commerce Stored XSS Arbitrary code execution (CVSS 4.8, Adobe Magento Commerce · magento/community-edition)
- [CVE-2020-14379](https://cve.now/CVE-2020-14379.md): A flaw was found in Red Hat AMQ Broker in a way that a XEE attack can be done via Broker's configuration files, leading to denial of service (no CVSS, Red Hat AMQ)
- [CVE-2020-14320](https://cve.now/CVE-2020-14320.md): In Moodle before 3.9.1, 3.8.4 and 3.7.7, the filter in the admin task log required extra sanitizing to prevent a reflected XSS risk. (no CVSS, Moodle · moodle/moodle)
- [CVE-2020-10728](https://cve.now/CVE-2020-10728.md): A flaw was found in automationbroker/apb container in versions up to and including 2.0.4-1. (no CVSS, automationbroker/apb)
- [CVE-2020-1756](https://cve.now/CVE-2020-1756.md): In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, insufficient input escaping was applied to the PHP unit webrunner admin tool. (no CVSS, Moodle)
- [CVE-2020-1755](https://cve.now/CVE-2020-1755.md): In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, X-Forwarded-For headers could be used to spoof a user's IP, in order to bypass remote addre (no CVSS, Moodle)
- [CVE-2022-2832](https://cve.now/CVE-2022-2832.md): A flaw was found in Blender 3.3.0. (no CVSS, Blender)
- [CVE-2022-2833](https://cve.now/CVE-2022-2833.md): Endless Infinite loop in Blender-thumnailing due to logical bugs. (no CVSS, Blender)
- [CVE-2022-2831](https://cve.now/CVE-2022-2831.md): A flaw was found in Blender 3.3.0. (no CVSS, Blender)
- [CVE-2022-2847](https://cve.now/CVE-2022-2847.md): SourceCodester Guest Management System front.php sql injection (CVSS 6.3, SourceCodester Guest Management System)
- [CVE-2022-2844](https://cve.now/CVE-2022-2844.md): MotoPress Timetable and Event Schedule Calendar cross site scripting (CVSS 3.5, MotoPress Timetable and Event Schedule)
- [CVE-2022-2843](https://cve.now/CVE-2022-2843.md): MotoPress Timetable and Event Schedule Quick Edit admin-ajax.php cross site scripting (CVSS 3.5, MotoPress Timetable and Event Schedule)
- [CVE-2021-39087](https://cve.now/CVE-2021-39087.md): IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.1.1 could allow an au (CVSS 4.3, IBM Sterling B2B Integrator)
- [CVE-2021-39086](https://cve.now/CVE-2021-39086.md): IBM Sterling File Gateway 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.1.1 could allow a remote attacker to obt (CVSS 4.3, IBM Sterling File Gateway)
- [CVE-2021-39085](https://cve.now/CVE-2021-39085.md): IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.1.1 is vulnerable to (CVSS 6.3, IBM Sterling B2B Integrator)
- [CVE-2021-39035](https://cve.now/CVE-2021-39035.md): IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.1.1 is vulnerable to (CVSS 5.4, IBM Sterling B2B Integrator)
- [CVE-2022-30576](https://cve.now/CVE-2022-30576.md): TIBCO Statistica Stored Cross Site Scripting (XSS) Vulnerability (CVSS 8.7, TIBCO Software TIBCO Data Science - Workbench · TIBCO Softw…)
- [CVE-2022-30575](https://cve.now/CVE-2022-30575.md): TIBCO Statistica Reflected Cross Site Scripting (XSS) Vulnerability (CVSS 7.3, TIBCO Software TIBCO Data Science - Workbench · TIBCO Softw…)
- [CVE-2022-38189](https://cve.now/CVE-2022-38189.md): There is a stored cross-site scripting (XSS) vulnerability in ArcGIS API for JavaScript. (CVSS 5.4, Esri Portal for ArcGIS)
- [CVE-2022-38184](https://cve.now/CVE-2022-38184.md): There is an improper access control vulnerability in Portal for ArcGIS versions 10.8.1 (CVSS 7.5, Esri Portal for ArcGIS)
- [CVE-2022-38192](https://cve.now/CVE-2022-38192.md): There is a stored cross-site scripting (XSS) vulnerability in ArcGIS API for JavaScript. (CVSS 6.1, Esri Portal for ArcGIS)
- [CVE-2022-38193](https://cve.now/CVE-2022-38193.md): Code injection issue in Portal for ArcGIS (10.7.1 and 10.8.1) (CVSS 6.1, Esri Portal for ArcGIS)
- [CVE-2022-38194](https://cve.now/CVE-2022-38194.md): Portal for ArcGIS system properties are not properly encrypted (10.8.1 only) (CVSS 6.7, Esri Portal for ArcGIS)
- [CVE-2022-36242](https://cve.now/CVE-2022-36242.md): Clinic's Patient Management System v1.0 is vulnerable to SQL Injection via /pms/update\_medicine.php?id=. (no CVSS)
- [CVE-2022-38362](https://cve.now/CVE-2022-38362.md): Docker Provider \<3.0 RCE vulnerability in example dag (no CVSS, Apache Software Foundation Apache Airflow · apache-airflow-…)
- [CVE-2022-36599](https://cve.now/CVE-2022-36599.md): Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/model/delete URI via models Lists. (no CVSS, net.mingsoft:ms-mcms)
- [CVE-2022-36272](https://cve.now/CVE-2022-36272.md): Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/page/verify URI via fieldName parameter. (no CVSS, net.mingsoft:ms-mcms)
- [CVE-2022-36273](https://cve.now/CVE-2022-36273.md): Tenda AC9 V15.03.2.21\_cn is vulnerable to command injection via goform/SetSysTimeCfg. (no CVSS)
- [CVE-2022-30264](https://cve.now/CVE-2022-30264.md): The Emerson ROC and FloBoss RTU product lines through 2022-05-02 perform insecure filesystem operations. (no CVSS)
- [CVE-2022-36530](https://cve.now/CVE-2022-36530.md): An issue was discovered in rageframe2 2.6.37. (no CVSS)
- [CVE-2021-30490](https://cve.now/CVE-2021-30490.md): upsMonitor in ViewPower (aka ViewPowerHTML) 1.04-21012 through 1.04-21353 has insecure permissions for the service binary that enable an Aut (no CVSS)
- [CVE-2022-29959](https://cve.now/CVE-2022-29959.md): Emerson OpenBSI through 2022-04-29 mishandles credential storage. (no CVSS)
- [CVE-2022-2838](https://cve.now/CVE-2022-2838.md): In Eclipse Sphinx™ before version 0.13.1, Apache Xerces XML Parser was used without disabling processing of referenced external entities all (no CVSS, The Eclipse Foundation Eclipse Sphinx)
- [CVE-2022-36381](https://cve.now/CVE-2022-36381.md): OS command injection vulnerability in Nintendo Wi-Fi Network Adaptor WAP-001 All versions allows an attacker with an administrative privileg (no CVSS, Nintendo Co. Nintendo Wi-Fi Network Adaptor WAP-001)
- [CVE-2022-36344](https://cve.now/CVE-2022-36344.md): An unquoted search path vulnerability exists in 'JustSystems JUST Online Update for J-License' bundled with multiple products for corporate (no CVSS, JustSystems JUST Online Update for J-License')
- [CVE-2022-36293](https://cve.now/CVE-2022-36293.md): Buffer overflow vulnerability in Nintendo Wi-Fi Network Adaptor WAP-001 All versions allows an attacker with an administrative privilege to (no CVSS, Nintendo Co. Nintendo Wi-Fi Network Adaptor WAP-001)
- [CVE-2022-35734](https://cve.now/CVE-2022-35734.md): 'Hulu / フールー' App for Android from version 3.0.47 to the version prior to 3.1.2 uses a hard-coded API key for an external service. (no CVSS, HJ Holdings 'Hulu / フールー' App for Android)
- [CVE-2022-35239](https://cve.now/CVE-2022-35239.md): The image file management page of SolarView Compact SV-CPT-MC310 Ver.7.23 and earlier, and SV-CPT-MC310F Ver.7.23 and earlier contains an in (no CVSS, CONTEC CO. SolarView Compact)
- [CVE-2022-34156](https://cve.now/CVE-2022-34156.md): 'Hulu / フールー' App for iOS versions prior to 3.0.81 improperly verifies server certificates, which may allow an attacker to eavesdrop on an e (no CVSS, HJ Holdings 'Hulu / フールー' App for iOS)
- [CVE-2022-33939](https://cve.now/CVE-2022-33939.md): CENTUM VP / CS 3000 controller FCS (CP31, CP33, CP345, CP401, and CP451) contains an issue in processing communication packets, which may le (no CVSS, Yokogawa Electric CENTUM VP / CS 3000 controller FCS)
- [CVE-2022-38216](https://cve.now/CVE-2022-38216.md): An integer overflow exists in Mapbox's closed source gl-native library prior to version 10.6.1, which is bundled with multiple Mapbox produc (no CVSS, Mapbox · com.mapbox.mapboxsdk:mapbox-android-core)
- [CVE-2022-36312](https://cve.now/CVE-2022-36312.md): Airspan AirVelocity 1500 software version 15.18.00.2511 lacks CSRF protections in the eNodeB's web management UI. (no CVSS, Airspan AirVelocity)
- [CVE-2022-36311](https://cve.now/CVE-2022-36311.md): Airspan AirVelocity 1500 prior to software version 15.18.00.2511 is vulnerable to injection leading to XSS in the SNMP community field in th (no CVSS, Airspan AirVelocity)
- [CVE-2022-36310](https://cve.now/CVE-2022-36310.md): Airspan AirVelocity 1500 software prior to version 15.18.00.2511 had NET-SNMP-EXTEND-MIB enabled on its snmpd service, enabling an attacker (no CVSS, Airspan AirVelocity)
- [CVE-2022-36309](https://cve.now/CVE-2022-36309.md): Airspan AirVelocity 1500 software versions prior to 15.18.00.2511 have a root command injection vulnerability in the ActiveBank parameter of (no CVSS, Airspan AirVelocity)
- [CVE-2022-36308](https://cve.now/CVE-2022-36308.md): Airspan AirVelocity 1500 web management UI displays SNMP credentials in plaintext on software versions older than 15.18.00.2511, and stores (no CVSS, Airspan AirVelocity)
- [CVE-2022-36307](https://cve.now/CVE-2022-36307.md): The AirVelocity 1500 prints SNMP credentials on its physically accessible serial port during boot. (no CVSS, Airspan AirVelocity)
- [CVE-2022-36306](https://cve.now/CVE-2022-36306.md): An authenticated attacker can enumerate and download sensitive files, including the eNodeB's web management UI's TLS private key, the web se (no CVSS, Airspan AirVelocity)
- [CVE-2022-24949](https://cve.now/CVE-2022-24949.md): A privilege escalation to root exists in Eternal Terminal prior to version 6.2.0. (no CVSS, Jason Gauci Eternal Terminal)
- [CVE-2020-10710](https://cve.now/CVE-2020-10710.md): A flaw was found where the Plaintext Candlepin password is disclosed while updating Red Hat Satellite through the satellite-installer. (no CVSS, foreman-installer)
- [CVE-2020-14321](https://cve.now/CVE-2020-14321.md): In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, teachers of a course were able to assign themselves the manager role within that course. (no CVSS, Moodle · moodle/moodle)
- [CVE-2020-14322](https://cve.now/CVE-2020-14322.md): In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, yui\_combo needed to limit the amount of files it can load to help mitigate the risk of deni (no CVSS, Moodle)
- [CVE-2022-24950](https://cve.now/CVE-2022-24950.md): A race condition exists in Eternal Terminal prior to version 6.2.0 that allows an authenticated attacker to hijack other users' SSH authoriz (no CVSS, Jason Gauci Eternal Terminal)
- [CVE-2022-24951](https://cve.now/CVE-2022-24951.md): A race condition exists in Eternal Terminal prior to version 6.2.0 which allows a local attacker to hijack Eternal Terminal's IPC socket, en (no CVSS, Jason Gauci Eternal Terminal)
- [CVE-2022-24952](https://cve.now/CVE-2022-24952.md): Several denial of service vulnerabilities exist in Eternal Terminal prior to version 6.2.0, including a DoS triggered remotely by an invalid (no CVSS, Jason Gauci Eternal Terminal)
- [CVE-2022-2846](https://cve.now/CVE-2022-2846.md): Calendar Event Multi View \< 1.4.07 - Unauthenticated Arbitrary Event Creation to Stored XSS (CVSS 4.3, Calendar Event Multi View)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-08-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.