# CVEs published 2022-08-17

44 CVEs were published on August 17, 2022: 1 critical, 15 high. Days are UTC.

- [CVE-2022-35151](https://cve.now/CVE-2022-35151.md): kkFileView v4.1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the urls and currentUrl parameters at /c (no CVSS)
- [CVE-2022-28752](https://cve.now/CVE-2022-28752.md): Local Privilege Escalation in the Zoom Rooms for Windows Client (CVSS 8.8, Zoom Video Communications Zoom Room for Conference Room for…)
- [CVE-2022-28751](https://cve.now/CVE-2022-28751.md): Local Privilege Escalation in Zoom Client for Meetings for MacOS (CVSS 8.8, Zoom Video Communications Zoom Client for Meetings for MacOS)
- [CVE-2022-35148](https://cve.now/CVE-2022-35148.md): maccms10 v2021.1000.1081 to v2022.1000.3031 was discovered to contain a SQL injection vulnerability via the table parameter at database/colu (no CVSS)
- [CVE-2022-23747](https://cve.now/CVE-2022-23747.md): In Sony Xperia series 1, 5, and Pro, an out of bound memory access can occur due to lack of validation of the number of frames being passed (no CVSS, Sony Xperia)
- [CVE-2022-35147](https://cve.now/CVE-2022-35147.md): DoraCMS v2.18 and earlier allows attackers to bypass login authentication via a crafted HTTP request. (no CVSS)
- [CVE-2022-35133](https://cve.now/CVE-2022-35133.md): A cross-site scripting (XSS) vulnerability in CherryTree v0.99.30 allows attackers to execute arbitrary web scripts or HTML via a crafted pa (no CVSS)
- [CVE-2022-35122](https://cve.now/CVE-2022-35122.md): An access control issue in Ecowitt GW1100 Series Weather Stations \<=GW1100B\_v2.1.5 allows unauthenticated attackers to access sensitive info (no CVSS)
- [CVE-2022-23765](https://cve.now/CVE-2022-23765.md): IPTIME NAS family CSRF vulnerability (CVSS 8.0, EFM Networks Co. NAS1dual, NAS2dual, NAS4dual)
- [CVE-2022-23764](https://cve.now/CVE-2022-23764.md): TERUTEN WebCube update remote code execution vulnerability (CVSS 8.8, TERUTEN Co. WebCube)
- [CVE-2021-26639](https://cve.now/CVE-2021-26639.md): WISA Smart Wing CMS File Download Vulnerability (CVSS 8.1, WISA Smart Wing CMS)
- [CVE-2022-2337](https://cve.now/CVE-2022-2337.md): Softing Secure Integration Server NULL Pointer Dereference (CVSS 7.5, Softing Secure Integration Server)
- [CVE-2022-1069](https://cve.now/CVE-2022-1069.md): Softing Secure Integration Server Out-of-bounds Read (CVSS 7.5, Softing Secure Integration Server)
- [CVE-2022-2338](https://cve.now/CVE-2022-2338.md): Softing Secure Integration Server Cleartext Transmission of Sensitive Information (CVSS 5.7, Softing Secure Integration Server)
- [CVE-2022-2335](https://cve.now/CVE-2022-2335.md): Softing Secure Integration Server Integer Underflow (CVSS 7.5, Softing Secure Integration Server)
- [CVE-2022-2334](https://cve.now/CVE-2022-2334.md): Softing Secure Integration Server Uncontrolled Search Path Element (CVSS 7.2, Softing Secure Integration Server)
- [CVE-2022-1373](https://cve.now/CVE-2022-1373.md): Softing Secure Integration Server Relative Path Traversal (CVSS 7.2, Softing Secure Integration Server)
- [CVE-2022-1748](https://cve.now/CVE-2022-1748.md): Softing Secure Integration Server NULL Pointer Dereference (CVSS 7.5, Softing Secure Integration Server · Softing OPC UA C++ S… +3)
- [CVE-2022-2336](https://cve.now/CVE-2022-2336.md): Softing Secure Integration Server Improper Authentication (CVSS 9.8, Softing Secure Integration Server · Softing edgeConnecto… +2)
- [CVE-2022-2547](https://cve.now/CVE-2022-2547.md): Softing Secure Integration Server NULL Pointer Dereference (CVSS 7.5, Softing Secure Integration Server)
- [CVE-2022-35121](https://cve.now/CVE-2022-35121.md): Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/BookServiceImpl.java. (no CVSS)
- [CVE-2022-36215](https://cve.now/CVE-2022-36215.md): DedeBIZ v6 was discovered to contain a remote code execution vulnerability in sys\_info.php. (no CVSS)
- [CVE-2022-35516](https://cve.now/CVE-2022-35516.md): DedeCMS v5.7.93 - v5.7.96 was discovered to contain a remote code execution vulnerability in login.php. (no CVSS)
- [CVE-2022-36216](https://cve.now/CVE-2022-36216.md): DedeCMS v5.7.94 - v5.7.97 was discovered to contain a remote code execution vulnerability in member\_toadmin.php. (no CVSS)
- [CVE-2022-2870](https://cve.now/CVE-2022-2870.md): laravel deserialization (CVSS 4.1, laravel)
- [CVE-2022-35117](https://cve.now/CVE-2022-35117.md): Clinic's Patient Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via update\_medicine\_details.php (no CVSS)
- [CVE-2022-22455](https://cve.now/CVE-2022-22455.md): IBM Security Verify Governance Identity Manager 10.0 virtual appliance component performs an operation at a privilege level that is higher t (CVSS 2.3, IBM Security Verify Governance)
- [CVE-2022-36186](https://cve.now/CVE-2022-36186.md): A Null Pointer dereference vulnerability exists in GPAC 2.1-DEV-revUNKNOWN-master via the function gf\_filter\_pid\_set\_property\_full () at fil (no CVSS)
- [CVE-2022-31262](https://cve.now/CVE-2022-31262.md): An exploitable local privilege escalation vulnerability exists in GOG Galaxy 2.0.46. (no CVSS)
- [CVE-2022-38149](https://cve.now/CVE-2022-38149.md): HashiCorp Consul Template up to 0.27.2, 0.28.2, and 0.29.1 may expose the contents of Vault secrets in the error returned by the \*template.T (no CVSS, github.com/hashicorp/consul-template)
- [CVE-2022-30262](https://cve.now/CVE-2022-30262.md): The Emerson ControlWave 'Next Generation' RTUs through 2022-05-02 mishandle firmware integrity. (no CVSS)
- [CVE-2022-37459](https://cve.now/CVE-2022-37459.md): Ampere Altra devices before 1.08g and Ampere Altra Max devices before 2.05a allow attackers to control the predictions for return addresses (no CVSS)
- [CVE-2021-45454](https://cve.now/CVE-2021-45454.md): Ampere Altra before SRP 1.08b and Altra Max​ before SRP 2.05 allow information disclosure of power telemetry via HWmon. (no CVSS)
- [CVE-2022-2871](https://cve.now/CVE-2022-2871.md): Cross-site Scripting (XSS) - Stored in notrinos/notrinoserp (CVSS 4.6, notrinos/notrinoserp · notrinos/notrinos-erp)
- [CVE-2020-14394](https://cve.now/CVE-2020-14394.md): An infinite loop flaw was found in the USB xHCI controller emulation of QEMU while computing the length of the Transfer Request Block (TRB) (no CVSS, QEMU)
- [CVE-2022-2845](https://cve.now/CVE-2022-2845.md): Improper Validation of Specified Quantity in Input in vim/vim (CVSS 7.8, vim/vim)
- [CVE-2022-2849](https://cve.now/CVE-2022-2849.md): Heap-based Buffer Overflow in vim/vim (CVSS 7.8, vim/vim)
- [CVE-2022-2862](https://cve.now/CVE-2022-2862.md): Use After Free in vim/vim (CVSS 7.6, vim/vim)
- [CVE-2022-2867](https://cve.now/CVE-2022-2867.md): libtiff's tiffcrop utility has a uint32\_t underflow that can lead to out of bounds read and write. (no CVSS, libtiff)
- [CVE-2022-2868](https://cve.now/CVE-2022-2868.md): libtiff's tiffcrop utility has a improper input validation flaw that can lead to out of bounds read and ultimately cause a crash if an attac (no CVSS, libtiff)
- [CVE-2022-2869](https://cve.now/CVE-2022-2869.md): libtiff's tiffcrop tool has a uint32\_t underflow which leads to out of bounds read and write in the extractContigSamples8bits routine. (no CVSS, libtiff)
- [CVE-2022-36190](https://cve.now/CVE-2022-36190.md): GPAC mp4box 2.1-DEV-revUNKNOWN-master has a use-after-free vulnerability in function gf\_isom\_dovi\_config\_get. (no CVSS)
- [CVE-2022-36191](https://cve.now/CVE-2022-36191.md): A heap-buffer-overflow had occurred in function gf\_isom\_dovi\_config\_get of isomedia/avc\_ext.c:2490, as demonstrated by MP4Box. (no CVSS)
- [CVE-2022-38392](https://cve.now/CVE-2022-38392.md): Certain 5400 RPM hard drives, for laptops and other PCs in approximately 2005 and later, allow physically proximate attackers to cause a den (CVSS 5.3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-08-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.