CVEs published August 17, 2022
44 CVEs were published on August 17, 2022: 1 critical, 15 high.
- Published
- 44
- Critical
- 1
- High
- 15
- Medium
- 4
- Low
- 1
- Unrated
- 23
- Now in CISA KEV
- 0
- Fix available
- 10
Most affected products
- Softing Secure Integration Server
- 7
- libtiff
- 3
- vim/vim
- 3
- EFM Networks Co. NAS1dual, NAS2dual, NAS4dual
- 1
- github.com/hashicorp/consul-template
- 1
- IBM Security Verify Governance
- 1
- laravel
- 1
- notrinos/notrinoserp · notrinos/notrinos-erp
- 1
- QEMU
- 1
- Softing Secure Integration Server · Softing edgeConnecto… +2
- 1
Critical 1
High 15
- CVE-2022-28752Local Privilege Escalation in the Zoom Rooms for Windows ClientZoom Video Communications Zoom Room for Conference Room for…
- CVE-2022-28751Local Privilege Escalation in Zoom Client for Meetings for MacOSZoom Video Communications Zoom Client for Meetings for MacOS
- CVE-2022-23765IPTIME NAS family CSRF vulnerabilityEFM Networks Co. NAS1dual, NAS2dual, NAS4dual
- CVE-2022-23764TERUTEN WebCube update remote code execution vulnerabilityTERUTEN Co. WebCube
- CVE-2021-26639WISA Smart Wing CMS File Download VulnerabilityWISA Smart Wing CMS
- CVE-2022-2337Softing Secure Integration Server NULL Pointer DereferenceSofting Secure Integration Server
- CVE-2022-1069Softing Secure Integration Server Out-of-bounds ReadSofting Secure Integration Server
- CVE-2022-2335Softing Secure Integration Server Integer UnderflowSofting Secure Integration Server
- CVE-2022-2334Softing Secure Integration Server Uncontrolled Search Path ElementSofting Secure Integration Server
- CVE-2022-1373Softing Secure Integration Server Relative Path TraversalSofting Secure Integration Server
- CVE-2022-1748Softing Secure Integration Server NULL Pointer DereferenceSofting Secure Integration Server · Softing OPC UA C++ S… +3
- CVE-2022-2547Softing Secure Integration Server NULL Pointer DereferenceSofting Secure Integration Server
- CVE-2022-2845Improper Validation of Specified Quantity in Input in vim/vimvim/vim
- CVE-2022-2849Heap-based Buffer Overflow in vim/vimvim/vim
- CVE-2022-2862Use After Free in vim/vimvim/vim
Medium, low and unrated 28
- CVE-2022-35151kkFileView v4.1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the urls and currentUrl parameters at /c
- CVE-2022-35148maccms10 v2021.1000.1081 to v2022.1000.3031 was discovered to contain a SQL injection vulnerability via the table parameter at database/colu
- CVE-2022-23747In Sony Xperia series 1, 5, and Pro, an out of bound memory access can occur due to lack of validation of the number of frames being passed Sony Xperia
- CVE-2022-35147DoraCMS v2.18 and earlier allows attackers to bypass login authentication via a crafted HTTP request.
- CVE-2022-35133A cross-site scripting (XSS) vulnerability in CherryTree v0.99.30 allows attackers to execute arbitrary web scripts or HTML via a crafted pa
- CVE-2022-35122An access control issue in Ecowitt GW1100 Series Weather Stations <=GW1100B_v2.1.5 allows unauthenticated attackers to access sensitive info
- CVE-2022-2338Softing Secure Integration Server Cleartext Transmission of Sensitive InformationSofting Secure Integration Server
- CVE-2022-35121Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/BookServiceImpl.java.
- CVE-2022-36215DedeBIZ v6 was discovered to contain a remote code execution vulnerability in sys_info.php.
- CVE-2022-35516DedeCMS v5.7.93 - v5.7.96 was discovered to contain a remote code execution vulnerability in login.php.
- CVE-2022-36216DedeCMS v5.7.94 - v5.7.97 was discovered to contain a remote code execution vulnerability in member_toadmin.php.
- CVE-2022-2870laravel deserializationlaravel
- CVE-2022-35117Clinic's Patient Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via update_medicine_details.php
- CVE-2022-22455IBM Security Verify Governance Identity Manager 10.0 virtual appliance component performs an operation at a privilege level that is higher tIBM Security Verify Governance
- CVE-2022-36186A Null Pointer dereference vulnerability exists in GPAC 2.1-DEV-revUNKNOWN-master via the function gf_filter_pid_set_property_full () at fil
- CVE-2022-31262An exploitable local privilege escalation vulnerability exists in GOG Galaxy 2.0.46.
- CVE-2022-38149HashiCorp Consul Template up to 0.27.2, 0.28.2, and 0.29.1 may expose the contents of Vault secrets in the error returned by the *template.Tgithub.com/hashicorp/consul-template
- CVE-2022-30262The Emerson ControlWave 'Next Generation' RTUs through 2022-05-02 mishandle firmware integrity.
- CVE-2022-37459Ampere Altra devices before 1.08g and Ampere Altra Max devices before 2.05a allow attackers to control the predictions for return addresses
- CVE-2021-45454Ampere Altra before SRP 1.08b and Altra Max before SRP 2.05 allow information disclosure of power telemetry via HWmon.
- CVE-2022-2871Cross-site Scripting (XSS) - Stored in notrinos/notrinoserpnotrinos/notrinoserp · notrinos/notrinos-erp
- CVE-2020-14394An infinite loop flaw was found in the USB xHCI controller emulation of QEMU while computing the length of the Transfer Request Block (TRB) QEMU
- CVE-2022-2867libtiff's tiffcrop utility has a uint32_t underflow that can lead to out of bounds read and write.libtiff
- CVE-2022-2868libtiff's tiffcrop utility has a improper input validation flaw that can lead to out of bounds read and ultimately cause a crash if an attaclibtiff
- CVE-2022-2869libtiff's tiffcrop tool has a uint32_t underflow which leads to out of bounds read and write in the extractContigSamples8bits routine.libtiff
- CVE-2022-36190GPAC mp4box 2.1-DEV-revUNKNOWN-master has a use-after-free vulnerability in function gf_isom_dovi_config_get.
- CVE-2022-36191A heap-buffer-overflow had occurred in function gf_isom_dovi_config_get of isomedia/avc_ext.c:2490, as demonstrated by MP4Box.
- CVE-2022-38392Certain 5400 RPM hard drives, for laptops and other PCs in approximately 2005 and later, allow physically proximate attackers to cause a den