CVEs published August 19, 2022
50 CVEs were published on August 19, 2022: 1 critical, 7 high.
- Published
- 50
- Critical
- 1
- High
- 7
- Medium
- 9
- Low
- 1
- Unrated
- 32
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- Emerson Electric Proficy Machine Edition
- 5
- Octopus Deploy Octopus Server
- 4
- radare2
- 3
- chatwoot/chatwoot
- 2
- hjiang Jsonxx
- 2
- Adobe Magento Commerce · magento/community-edition +1
- 1
- com.xuxueli:xxl-job
- 1
- directus
- 1
- IBM MQ
- 1
- Jellyfin.Common
- 1
Critical 1
High 7
- CVE-2020-27792Ghostscript: heap buffer over write vulnerability in ghostscript's lp8000_print_page() in gdevlp8k.cRed Hat Enterprise Linux
- CVE-2022-36008Message length overflow in frontierparitytech frontier · fc-rpc
- CVE-2022-23459Double free or Use after Free in Value class of Jsonxxhjiang Jsonxx
- CVE-2022-22489IBM MQ 8.0, (9.0, 9.1, 9.2 LTS), and (9.1 and 9.2 CD) are vulnerable to an XML External Entity Injection (XXE) attack when processing XML daIBM MQ
- CVE-2022-0542Cross-site Scripting (XSS) - DOM in chatwoot/chatwootchatwoot/chatwoot
- CVE-2022-1021Insecure Storage of Sensitive Information in chatwoot/chatwootchatwoot/chatwoot
- CVE-2022-2889Use After Free in vim/vimvim/vim
Medium, low and unrated 42
- CVE-2022-35692Adobe Commerce Improper Access Control Security feature bypassAdobe Magento Commerce · magento/community-edition +1
- CVE-2020-27794A double free issue was discovered in radare2 in cmd_info.c:cmd_info().radare2
- CVE-2020-27793An off-by-one overflow flaw was found in radare2 due to mismatched array length in core_java.c.radare2
- CVE-2020-27795A segmentation fault was discovered in radare2 with adf command.radare2
- CVE-2022-2793Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-353 Missing Support for Integrity Check, and has no aEmerson Electric Proficy Machine Edition
- CVE-2022-35554Multiple reflected XSS vulnerabilities occur when handling error message of BPC SmartVista version 3.28.0 allowing an attacker to execute ja
- CVE-2022-2789Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulnerable to CWE-345 Insufficient Verification of Data Authenticity, aEmerson Electric Proficy Machine Edition
- CVE-2022-2790Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-347 Improper Verification of Cryptographic Signature,Emerson Electric Proficy Machine Edition
- CVE-2022-2792Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-284 Improper Access Control, and stores project data Emerson Electric Proficy Machine Edition
- CVE-2022-36233Tenda AC9 V15.03.2.13 is vulnerable to Buffer Overflow via httpd, form_fast_setting_wifi_set.
- CVE-2022-36171MapGIS IGServer 10.5.6.11 is vulnerable to Arbitrary file deletion.
- CVE-2022-36157XXL-JOB all versions as of 11 July 2022 are vulnerable to Insecure Permissions resulting in the ability to execute admin function with low Pcom.xuxueli:xxl-job
- CVE-2022-2788Emerson Electric's Proficy Machine Edition Version 9.80 and prior is vulnerable to CWE-29 Path Traversal: '\..\Filename', also known as a ZiEmerson Electric Proficy Machine Edition
- CVE-2022-37175Tenda ac15 firmware V15.03.05.18 httpd server has stack buffer overflow in /goform/formWifiBasicSet.
- CVE-2022-36031Unhandled exception on illegal filename_disk valuedirectus
- CVE-2022-36009Incorrect parsing of access level in gomatrixserverlib and dendritematrix-org gomatrixserverlib · github.com/matrix-org/den… +1
- CVE-2022-36170MapGIS 10.5 Pro IGServer has hardcoded credentials in the front-end and can lead to escalation of privileges and arbitrary file deletion.
- CVE-2022-23460Stack overflow in Jsonxxhjiang Jsonxx
- CVE-2022-36579Wellcms 2.2.0 is vulnerable to Cross Site Request Forgery (CSRF).
- CVE-2022-36578jizhicms v2.3.1 has SQL injection in the background.
- CVE-2022-36577An issue was discovered in jizhicms v2.3.1.
- CVE-2022-37254DolphinPHP 1.5.1 is vulnerable to Cross Site Scripting (XSS) via Background - > System - > system function - > configuration management.
- CVE-2022-36225EyouCMS V1.5.8-UTF8-SP1 is vulnerable to Cross Site Request Forgery (CSRF) via the background, column management function and add.
- CVE-2022-36224XunRuiCMS V4.5.6 is vulnerable to Cross Site Request Forgery (CSRF).
- CVE-2022-36263StreamLabs Desktop Application 1.9.0 is vulnerable to Incorrect Access Control via obs64.exe.
- CVE-2022-36606Ywoa before v6.1 was discovered to contain a SQL injection vulnerability via /oa/setup/checkPool?database.
- CVE-2022-36605Yimioa v6.1 was discovered to contain a SQL injection vulnerability via the orderbyGET parameter.
- CVE-2022-35201Tenda-AC18 V15.03.05.05 was discovered to contain a remote command execution (RCE) vulnerability.
- CVE-2022-34624Mealie1.0.0beta3 does not terminate download tokens after a user logs out, allowing attackers to perform a man-in-the-middle attack via a cr
- CVE-2022-34621Mealie 1.0.0beta3 was discovered to contain an Insecure Direct Object Reference (IDOR) vulnerability which allows attackers to modify user p
- CVE-2022-34615Mealie 1.0.0beta3 employs weak password requirements which allows attackers to potentially gain unauthorized access to the application via b
- CVE-2022-36220Kiosk breakout (without quit password) in Safe Exam Browser (Windows) <3.4.0, which allows an attacker to achieve code execution via the bro
- CVE-2022-2886Laravel deserializationLaravel
- CVE-2022-35909In Jellyfin before 10.8, the /users endpoint has incorrect access control for admin functionality.Jellyfin.Common
- CVE-2022-35910In Jellyfin before 10.8, stored XSS allows theft of an admin access token.
- CVE-2022-29805A Java Deserialization vulnerability in the Fishbowl Server in Fishbowl Inventory before 2022.4.1 allows remote attackers to execute arbitra
- CVE-2022-2075In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service targeting the build information request validatioOctopus Deploy Octopus Server
- CVE-2022-2074In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service using the Variable Project Template.Octopus Deploy Octopus Server
- CVE-2022-2049In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service via the package upload function.Octopus Deploy Octopus Server
- CVE-2022-1901In affected versions of Octopus Deploy it is possible to unmask sensitive variables by using variable preview.Octopus Deploy Octopus Server
- CVE-2020-23466Cross Site Scripting (XSS) vulnerability exists in the phpgurukul Online Marriage Registration System 1.0 allows attackers to run arbitrary
- CVE-2022-35167Printix Cloud Print Management v1.3.1149.0 for Windows was discovered to contain insecure permissions.