CVEs published August 18, 2022
127 CVEs were published on August 18, 2022: 4 critical, 32 high.
- Published
- 127
- Critical
- 4
- High
- 32
- Medium
- 28
- Low
- 1
- Unrated
- 62
- Now in CISA KEV
- 0
- Fix available
- 9
Most affected products
- Cybozu Office
- 12
- Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products
- 8
- version
- 7
- Intel(R) NUC Laptop Kits
- 6
- Intel(R) PROSet/Wireless WiFi products
- 6
- Intel(R) Data Center Manager software
- 4
- Intel(R) Edge Insights for Industrial software
- 4
- Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R)…
- 4
- Intel(R) AMT and Intel(R) Standard Manageability
- 3
- Intel(R) Processors
- 3
Critical 4
- CVE-2022-25899Authentication bypass for the Open AMT Cloud Toolkit software maintained by Intel(R) before versions 2.0.2 and 2.2.2 may allow an unauthentiIntel
- CVE-2022-22730Improper authentication in the Intel(R) Edge Insights for Industrial software before version 2.6.1 may allow an unauthenticated user to poteIntel(R) Edge Insights for Industrial software
- CVE-2022-35975Improper object validation allows for arbitrary code execution in GitOps Tools Extension for VSCodeweaveworks vscode-gitops-tools
- CVE-2022-30601Insufficiently protected credentials for Intel(R) AMT and Intel(R) Standard Manageability may allow an unauthenticated user to potentially eIntel(R) AMT and Intel(R) Standard Manageability
High 32
- CVE-2022-34488Improper buffer restrictions in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentiaIntel(R) NUC Laptop Kits
- CVE-2022-27493Improper initialization in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially eIntel(R) NUC Laptop Kits
- CVE-2022-33209Improper input validation in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentiallyIntel(R) NUC Laptop Kits
- CVE-2022-28858Improper buffer restriction in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentialIntel(R) NUC Laptop Kits
- CVE-2022-30296Insufficiently protected credentials in the Intel(R) Datacenter Group Event iOS application, all versions, may allow an unauthenticated userversion
- CVE-2022-26374Uncontrolled search path in the installation binaries for Intel(R) SEAPI all versions may allow an authenticated user to potentially enable version
- CVE-2022-26344Incorrect default permissions in the installation binaries for Intel(R) SEAPI all versions may allow an authenticated user to potentially enversion
- CVE-2022-26844Insufficiently protected credentials in the installation binaries for Intel(R) SEAPI in all versions may allow an authenticated user to poteversion
- CVE-2021-33060Out-of-bounds write in the BIOS firmware for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of prIntel(R) Processors
- CVE-2022-28696Uncontrolled search path in the Intel(R) Distribution for Python before version 2022.0.3 may allow an authenticated user to potentially enabIntel(R) Distribution for Python
- CVE-2022-26017Improper access control in the Intel(R) DSA software for before version 22.2.14 may allow an authenticated user to potentially enable escalaIntel(R) DSA software for
- CVE-2022-25841Uncontrolled search path elements in the Intel(R) Datacenter Group Event Android application, all versions, may allow an authenticated user version
- CVE-2022-25999Uncontrolled search path element in the Intel(R) Enpirion(R) Digital Power Configurator GUI software, all versions may allow an authenticateversion
- CVE-2022-23182Improper access control in the Intel(R) Data Center Manager software before version 4.1 may allow an unauthenticated user to potentially enaIntel(R) Data Center Manager software
- CVE-2022-21807Uncontrolled search path elements in the Intel(R) VTune(TM) Profiler software before version 2022.2.0 may allow an authenticated user to potIntel(R) VTune(TM) Profiler software
- CVE-2022-21812Improper access control in the Intel(R) HAXM software before version 7.7.1 may allow an authenticated user to potentially enable escalation Intel(R) HAXM software
- CVE-2022-21148Improper access control in the Intel(R) Edge Insights for Industrial software before version 2.6.1 may allow an authenticated user to potentIntel(R) Edge Insights for Industrial software
- CVE-2022-25966Improper access control in the Intel(R) Edge Insights for Industrial software before version 2.6.1 may allow an authenticated user to potentIntel(R) Edge Insights for Industrial software
- CVE-2021-23179Out of bounds read in firmware for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products before version 22.120 may allow Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R)…
- CVE-2021-33847Improper buffer restrictions in firmware for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products before version 22.120 Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R)…
- CVE-2022-21160Improper buffer restrictions for some Intel(R) PROSet/Wireless WiFi products may allow an unauthenticated user to potentially enable denial Intel(R) PROSet/Wireless WiFi products
- CVE-2022-21197Improper input validation for some Intel(R) PROSet/Wireless WiFi products may allow an unauthenticated user to potentially enable denial of Intel(R) PROSet/Wireless WiFi products
- CVE-2022-21139Inadequate encryption strength for some Intel(R) PROSet/Wireless WiFi products may allow an unauthenticated user to potentially enable escalIntel(R) PROSet/Wireless WiFi products
- CVE-2022-28757Local Privilege Escalation in Auto Updater for Zoom Client for Meetings for macOSZoom Video Communications Zoom Client for Meetings for MacOS
- CVE-2022-36024Bots using py-cord as discord api wrapper are vulnerable to shutdowns through remote code executionPycord-Development pycord · py-cord
- CVE-2021-23223Improper initialization for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enablIntel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products
- CVE-2021-32862nbconvert vulnerable to cross-site scripting (XSS) via multiple exploit pathsjupyter nbconvert · nbconvert
- CVE-2021-37409Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enablIntel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products
- CVE-2022-21181Improper input validation for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enaIntel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products
- CVE-2022-21225Improper neutralization in the Intel(R) Data Center Manager software before version 4.1 may allow an authenticated user to potentially enablIntel(R) Data Center Manager software
- CVE-2022-21229Improper buffer restrictions for some Intel(R) NUC 9 Extreme Laptop Kit drivers before version 2.2.0.22 may allow an authenticated user to pIntel(R) NUC 9 Extreme Laptop Kit drivers
- CVE-2022-36023Remote denial of service in Hyperledger Fabric Gatewayhyperledger fabric · github.com/hyperledger/fabric
Medium, low and unrated 91
- CVE-2020-36599lib/omniauth/failure_endpoint.rb in OmniAuth before 1.9.2 (and before 2.0) does not escape the message_key value.omniauth
- CVE-2022-35540Hardcoded JWT Secret in AgileConfig <1.6.8 Server allows remote attackers to use the generated JWT token to gain administrator access.AgileConfig.Client
- CVE-2022-36947Unsafe Parsing of a PNG tRNS chunk in FastStone Image Viewer through 7.5 results in a stack buffer overflow.
- CVE-2022-34345Improper input validation in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentiallyIntel(R) NUC Laptop Kits
- CVE-2022-32579Improper initialization in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially eIntel(R) NUC Laptop Kits
- CVE-2022-29507Insufficiently protected credentials in the Intel(R) Team Blue mobile application in all versions may allow an authenticated user to potentiversion
- CVE-2022-26074Incomplete cleanup in a firmware subsystem for Intel(R) SPS before versions SPS_E3_04.08.04.330.0 and SPS_E3_04.01.04.530.0 may allow a privIntel(R) SPS
- CVE-2022-23403Improper input validation in the Intel(R) Data Center Manager software before version 4.1 may allow an authenticated user to potentially enaIntel(R) Data Center Manager software
- CVE-2022-36727Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at /staff/delete.php.
- CVE-2022-36722Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the title parameter at /librarian/history.php.
- CVE-2022-36728Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the RollNo parameter at /staff/delstu.php.
- CVE-2022-36725Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the M_Id parameter at /student/dele.php.
- CVE-2022-36729Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the M_Id parameter at /librarian/del.php.
- CVE-2022-24378Improper initialization in the Intel(R) Data Center Manager software before version 4.1 may allow an authenticated user to potentially enablIntel(R) Data Center Manager software
- CVE-2022-27500Incorrect default permissions for the Intel(R) Support Android application before 21.07.40 may allow an authenticated user to potentially enIntel(R) Support Android application
- CVE-2022-21152Improper access control in the Intel(R) Edge Insights for Industrial software before version 2.6.1 may allow an authenticated user to potentIntel(R) Edge Insights for Industrial software
- CVE-2022-21793Insufficient control flow management in the Intel(R) Ethernet 500 Series Controller drivers for VMWare before version 1.11.4.0 and in the InIntel(R) Ethernet 500 Series Controller drivers for VMWare…
- CVE-2021-26950Out of bounds read in firmware for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products before version 22.120 may allow Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R)…
- CVE-2021-26257Improper buffer restrictions in firmware for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products before version 22.120 Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R)…
- CVE-2022-21140Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enablIntel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products
- CVE-2022-21212Improper input validation for some Intel(R) PROSet/Wireless WiFi products may allow an unauthenticated user to potentially enable denial of Intel(R) PROSet/Wireless WiFi products
- CVE-2021-23188Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow an authenticated user to potentially eIntel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products
- CVE-2022-21240Out of bounds read for some Intel(R) PROSet/Wireless WiFi products may allow a privileged user to potentially enable information disclosure Intel(R) PROSet/Wireless WiFi products
- CVE-2022-21172Out of bounds write for some Intel(R) PROSet/Wireless WiFi products may allow a privileged user to potentially enable escalation of privilegIntel(R) PROSet/Wireless WiFi products
- CVE-2021-26254Out of bounds read for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enable denIntel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products
- CVE-2021-44470Incorrect default permissions for the Intel(R) Connect M Android application before version 1.7.4 may allow an authenticated user to potentiIntel(R) Connect M Android application
- CVE-2022-28709Improper access control in the firmware for some Intel(R) E810 Ethernet Controllers before version 1.6.1.9 may allow a privileged user to poIntel(R) E810 Ethernet Controllers
- CVE-2021-33128Improper access control in the firmware for some Intel(R) E810 Ethernet Controllers before version 1.6.0.6 may allow a privileged user to poIntel(R) E810 Ethernet Controllers
- CVE-2021-33126Improper access control in the firmware for some Intel(R) 700 and 722 Series Ethernet Controllers and Adapters before versions 8.5 and 1.5.5Intel(R) 700 and 722 Series Ethernet Controllers and Adapte…
- CVE-2022-37770libjpeg commit 281daa9 was discovered to contain a segmentation fault via LineMerger::GetNextLowpassLine at linemerger.cpp.
- CVE-2022-37769libjpeg commit 281daa9 was discovered to contain a segmentation fault via HuffmanDecoder::Get at huffmandecoder.hpp.
- CVE-2022-37768libjpeg commit 281daa9 was discovered to contain an infinite loop via the component Frame::ParseTrailer.
- CVE-2022-35213Ecommerce-CodeIgniter-Bootstrap before commit 56465f was discovered to contain a cross-site scripting (XSS) vulnerability via the function b
- CVE-2022-35212osCommerce2 before v2.3.4.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the function tep_db_error().
- CVE-2022-25228CandidATS Version 3.0.0 Beta allows an authenticated user to inject SQL queries in '/index.php?m=settings&a=show' via the 'userID' parameterCandidATS
- CVE-2022-2568A privilege escalation flaw was found in the Ansible Automation Platform.Red Hat Ansible Automation Platform
- CVE-2020-27788An out-of-bounds read access vulnerability was discovered in UPX in PackLinuxElf64::canPack() function of p_lx_elf.cpp file.upx
- CVE-2020-27790A floating point exception issue was discovered in UPX in PackLinuxElf64::invert_pt_dynamic() function of p_lx_elf.cpp file.upx
- CVE-2022-35976Improper KubeConfig handling allows arbitrary code executionweaveworks vscode-gitops-tools
- CVE-2020-27787A Segmentaation fault was found in UPX in invert_pt_dynamic() function in p_lx_elf.cpp.upx
- CVE-2022-35204Vitejs Vite before v2.9.13 was discovered to allow attackers to perform a directory traversal via a crafted URL to the victim's service.vite
- CVE-2022-37422Payara through 5.2022.2 allows directory traversal without authentication.fish.payara.api:payara-bom
- CVE-2022-35175Barangay Management System v1.0 was discovered to contain a SQL injection vulnerability via the hidden_id parameter at /blotter/blotter.php.
- CVE-2022-35174A stored cross-site scripting (XSS) vulnerability in Kirby's Starterkit v3.7.0.2 allows attackers to execute arbitrary web scripts or HTML vgetkirby/starterkit
- CVE-2022-37063All FLIR AX8 thermal sensor cameras versions up to and including 1.46.16 are vulnerable to Cross Site Scripting (XSS) due to improper input
- CVE-2022-37062All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are affected by an insecure design vulnerability due to an improper
- CVE-2022-37025An improper privilege management vulnerability in McAfee Security Scan Plus (MSS+) before 4.1.262.1 could allow a local user to modify a con
- CVE-2022-29549An issue was discovered in Qualys Cloud Agent 4.8.0-49.
- CVE-2022-29550An issue was discovered in Qualys Cloud Agent 4.8.0-49.
- CVE-2022-2876SourceCodester Student Management System index.php sql injectionSourceCodester Student Management System
- CVE-2022-33311Browse restriction bypass vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to obtain tCybozu Office
- CVE-2022-33151Cross-site scripting vulnerability in the specific parameters of Cybozu Office 10.0.0 to 10.8.5 allows remote attackers to inject an arbitraCybozu Office
- CVE-2022-32583Operation restriction bypass vulnerability in Scheduler of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to alter thCybozu Office
- CVE-2022-32544Operation restriction bypass vulnerability in Project of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to alter the Cybozu Office
- CVE-2022-32453HTTP header injection vulnerability in Cybozu Office 10.0.0 to 10.8.5 may allow a remote attacker to obtain and/or alter the data of the proCybozu Office
- CVE-2022-32283Browse restriction bypass vulnerability in Cabinet of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to obtain the daCybozu Office
- CVE-2022-30693Information disclosure vulnerability in the system configuration of Cybozu Office 10.0.0 to 10.8.5 allows a remote attacker to obtain the daCybozu Office
- CVE-2022-30604Cross-site scripting vulnerability in the specific parameters of Cybozu Office 10.0.0 to 10.8.5 allows a remote attacker to inject an arbitrCybozu Office
- CVE-2022-29891Browse restriction bypass vulnerability in Custom Ap of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to obtain the Cybozu Office
- CVE-2022-29487Cross-site scripting vulnerability in Cybozu Office 10.0.0 to 10.8.5 allows a remote attacker to inject an arbitrary script via unspecified Cybozu Office
- CVE-2022-28715Cross-site scripting vulnerability in the specific parameters of Cybozu Office 10.0.0 to 10.8.5 allows a remote attacker to inject an arbitrCybozu Office
- CVE-2022-25986Browse restriction bypass vulnerability in Scheduler of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to obtain the Cybozu Office
- CVE-2022-35198Contract Management System v2.0 contains a weak default password which gives attackers to access database connection information.
- CVE-2022-35173An issue was discovered in Nginx NJS v0.7.5.
- CVE-2022-35166libjpeg commit 842c7ba was discovered to contain an infinite loop via the component JPEG::ReadInternal.
- CVE-2022-35164LibreDWG v0.12.4.4608 & commit f2dea29 was discovered to contain a heap use-after-free via bit_copy_chain.
- CVE-2022-35165An issue in AP4_SgpdAtom::AP4_SgpdAtom() of Bento4-1.6.0-639 allows attackers to cause a Denial of Service (DoS) via a crafted mp4 input.
- CVE-2022-35154Shopro Mall System v1.3.8 was discovered to contain a SQL injection vulnerability via the value parameter.
- CVE-2021-30071A cross-site scripting (XSS) vulnerability in /admin/list_key.html of HestiaCP before v1.3.5 allows attackers to execute arbitrary web scrip
- CVE-2021-30070An issue was discovered in HestiaCP before v1.3.5.
- CVE-2022-35153FusionPBX 5.0.1 was discovered to contain a command injection vulnerability via /fax/fax_send.php.
- CVE-2022-35606A SQL injection vulnerability in CustomerDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL comman
- CVE-2022-35605A SQL injection vulnerability in UserDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands v
- CVE-2022-35603A SQL injection vulnerability in CustomerDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL comman
- CVE-2022-35602A SQL injection vulnerability in UserDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands v
- CVE-2022-35601A SQL injection vulnerability in SupplierDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL comman
- CVE-2022-35599A SQL injection vulnerability in Stocks.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands vi
- CVE-2022-35598A SQL injection vulnerability in ConnectionFactoryDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary S
- CVE-2021-23168Out of bounds read for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow an unauthenticated user to potentially enabIntel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products
- CVE-2021-44545Improper input validation for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow an unauthenticated user to potentialIntel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products
- CVE-2022-21233Improper isolation of shared resources in some Intel(R) Processors may allow a privileged user to potentially enable information disclosure Intel(R) Processors
- CVE-2022-2625A vulnerability was found in PostgreSQL.postgresql
- CVE-2022-26373Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorized user to potentiallyIntel(R) Processors
- CVE-2022-28697Improper access control in firmware for Intel(R) AMT and Intel(R) Standard Manageability may allow an unauthenticated user to potentially enIntel(R) AMT and Intel(R) Standard Manageability
- CVE-2022-2874NULL Pointer Dereference in vim/vimvim/vim
- CVE-2022-30944Insufficiently protected credentials for Intel(R) AMT and Intel(R) Standard Manageability may allow a privileged user to potentially enable Intel(R) AMT and Intel(R) Standard Manageability
- CVE-2022-37047The component tcprewrite in Tcpreplay v4.4.1 was discovered to contain a heap-based buffer overflow in get_ipv6_next at common/get.c:713.
- CVE-2022-37048The component tcprewrite in Tcpreplay v4.4.1 was discovered to contain a heap-based buffer overflow in get_l2len_protocol at common/get.c:34
- CVE-2022-37049The component tcpprep in Tcpreplay v4.4.1 was discovered to contain a heap-based buffer overflow in parse_mpls at common/get.c:150.
- CVE-2022-37060FLIR AX8 thermal sensor cameras version up to and including 1.46.16 is vulnerable to Directory Traversal due to an improper access restricti
- CVE-2022-37061All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to Remote Command Injection.