# CVEs published 2022-08-19

50 CVEs were published on August 19, 2022: 1 critical, 7 high. Days are UTC.

- [CVE-2022-36030](https://cve.now/CVE-2022-36030.md): SQL Injection in Project-nexus (CVSS 9.8, vinsdragonis Project-Nexus)
- [CVE-2022-35692](https://cve.now/CVE-2022-35692.md): Adobe Commerce Improper Access Control Security feature bypass (CVSS 5.3, Adobe Magento Commerce · magento/community-edition +1)
- [CVE-2020-27792](https://cve.now/CVE-2020-27792.md): Ghostscript: heap buffer over write vulnerability in ghostscript's lp8000\_print\_page() in gdevlp8k.c (CVSS 7.1, Red Hat Enterprise Linux)
- [CVE-2020-27794](https://cve.now/CVE-2020-27794.md): A double free issue was discovered in radare2 in cmd\_info.c:cmd\_info(). (no CVSS, radare2)
- [CVE-2020-27793](https://cve.now/CVE-2020-27793.md): An off-by-one overflow flaw was found in radare2 due to mismatched array length in core\_java.c. (no CVSS, radare2)
- [CVE-2020-27795](https://cve.now/CVE-2020-27795.md): A segmentation fault was discovered in radare2 with adf command. (no CVSS, radare2)
- [CVE-2022-2793](https://cve.now/CVE-2022-2793.md): Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-353 Missing Support for Integrity Check, and has no a (CVSS 5.9, Emerson Electric Proficy Machine Edition)
- [CVE-2022-35554](https://cve.now/CVE-2022-35554.md): Multiple reflected XSS vulnerabilities occur when handling error message of BPC SmartVista version 3.28.0 allowing an attacker to execute ja (no CVSS)
- [CVE-2022-2789](https://cve.now/CVE-2022-2789.md): Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulnerable to CWE-345 Insufficient Verification of Data Authenticity, a (CVSS 4.7, Emerson Electric Proficy Machine Edition)
- [CVE-2022-2790](https://cve.now/CVE-2022-2790.md): Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-347 Improper Verification of Cryptographic Signature, (CVSS 5.9, Emerson Electric Proficy Machine Edition)
- [CVE-2022-2792](https://cve.now/CVE-2022-2792.md): Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-284 Improper Access Control, and stores project data (CVSS 6.6, Emerson Electric Proficy Machine Edition)
- [CVE-2022-36233](https://cve.now/CVE-2022-36233.md): Tenda AC9 V15.03.2.13 is vulnerable to Buffer Overflow via httpd, form\_fast\_setting\_wifi\_set. (no CVSS)
- [CVE-2022-36171](https://cve.now/CVE-2022-36171.md): MapGIS IGServer 10.5.6.11 is vulnerable to Arbitrary file deletion. (no CVSS)
- [CVE-2022-36157](https://cve.now/CVE-2022-36157.md): XXL-JOB all versions as of 11 July 2022 are vulnerable to Insecure Permissions resulting in the ability to execute admin function with low P (no CVSS, com.xuxueli:xxl-job)
- [CVE-2022-2788](https://cve.now/CVE-2022-2788.md): Emerson Electric's Proficy Machine Edition Version 9.80 and prior is vulnerable to CWE-29 Path Traversal: '\\..\\Filename', also known as a Zi (CVSS 3.9, Emerson Electric Proficy Machine Edition)
- [CVE-2022-37175](https://cve.now/CVE-2022-37175.md): Tenda ac15 firmware V15.03.05.18 httpd server has stack buffer overflow in /goform/formWifiBasicSet. (no CVSS)
- [CVE-2022-36031](https://cve.now/CVE-2022-36031.md): Unhandled exception on illegal filename\_disk value (CVSS 6.5, directus)
- [CVE-2022-36009](https://cve.now/CVE-2022-36009.md): Incorrect parsing of access level in gomatrixserverlib and dendrite (CVSS 5.0, matrix-org gomatrixserverlib · github.com/matrix-org/den… +1)
- [CVE-2022-36170](https://cve.now/CVE-2022-36170.md): MapGIS 10.5 Pro IGServer has hardcoded credentials in the front-end and can lead to escalation of privileges and arbitrary file deletion. (no CVSS)
- [CVE-2022-36008](https://cve.now/CVE-2022-36008.md): Message length overflow in frontier (CVSS 7.1, paritytech frontier · fc-rpc)
- [CVE-2022-23460](https://cve.now/CVE-2022-23460.md): Stack overflow in Jsonxx (CVSS 5.9, hjiang Jsonxx)
- [CVE-2022-23459](https://cve.now/CVE-2022-23459.md): Double free or Use after Free in Value class of Jsonxx (CVSS 8.1, hjiang Jsonxx)
- [CVE-2022-22489](https://cve.now/CVE-2022-22489.md): IBM MQ 8.0, (9.0, 9.1, 9.2 LTS), and (9.1 and 9.2 CD) are vulnerable to an XML External Entity Injection (XXE) attack when processing XML da (CVSS 8.2, IBM MQ)
- [CVE-2022-0542](https://cve.now/CVE-2022-0542.md): Cross-site Scripting (XSS) - DOM in chatwoot/chatwoot (CVSS 8.8, chatwoot/chatwoot)
- [CVE-2022-36579](https://cve.now/CVE-2022-36579.md): Wellcms 2.2.0 is vulnerable to Cross Site Request Forgery (CSRF). (no CVSS)
- [CVE-2022-36578](https://cve.now/CVE-2022-36578.md): jizhicms v2.3.1 has SQL injection in the background. (no CVSS)
- [CVE-2022-36577](https://cve.now/CVE-2022-36577.md): An issue was discovered in jizhicms v2.3.1. (no CVSS)
- [CVE-2022-37254](https://cve.now/CVE-2022-37254.md): DolphinPHP 1.5.1 is vulnerable to Cross Site Scripting (XSS) via Background - \> System - \> system function - \> configuration management. (no CVSS)
- [CVE-2022-36225](https://cve.now/CVE-2022-36225.md): EyouCMS V1.5.8-UTF8-SP1 is vulnerable to Cross Site Request Forgery (CSRF) via the background, column management function and add. (no CVSS)
- [CVE-2022-36224](https://cve.now/CVE-2022-36224.md): XunRuiCMS V4.5.6 is vulnerable to Cross Site Request Forgery (CSRF). (no CVSS)
- [CVE-2022-36263](https://cve.now/CVE-2022-36263.md): StreamLabs Desktop Application 1.9.0 is vulnerable to Incorrect Access Control via obs64.exe. (no CVSS)
- [CVE-2022-36606](https://cve.now/CVE-2022-36606.md): Ywoa before v6.1 was discovered to contain a SQL injection vulnerability via /oa/setup/checkPool?database. (no CVSS)
- [CVE-2022-36605](https://cve.now/CVE-2022-36605.md): Yimioa v6.1 was discovered to contain a SQL injection vulnerability via the orderbyGET parameter. (no CVSS)
- [CVE-2022-35201](https://cve.now/CVE-2022-35201.md): Tenda-AC18 V15.03.05.05 was discovered to contain a remote command execution (RCE) vulnerability. (no CVSS)
- [CVE-2022-34624](https://cve.now/CVE-2022-34624.md): Mealie1.0.0beta3 does not terminate download tokens after a user logs out, allowing attackers to perform a man-in-the-middle attack via a cr (no CVSS)
- [CVE-2022-34621](https://cve.now/CVE-2022-34621.md): Mealie 1.0.0beta3 was discovered to contain an Insecure Direct Object Reference (IDOR) vulnerability which allows attackers to modify user p (no CVSS)
- [CVE-2022-34615](https://cve.now/CVE-2022-34615.md): Mealie 1.0.0beta3 employs weak password requirements which allows attackers to potentially gain unauthorized access to the application via b (no CVSS)
- [CVE-2022-36220](https://cve.now/CVE-2022-36220.md): Kiosk breakout (without quit password) in Safe Exam Browser (Windows) \<3.4.0, which allows an attacker to achieve code execution via the bro (no CVSS)
- [CVE-2022-1021](https://cve.now/CVE-2022-1021.md): Insecure Storage of Sensitive Information in chatwoot/chatwoot (CVSS 7.6, chatwoot/chatwoot)
- [CVE-2022-2886](https://cve.now/CVE-2022-2886.md): Laravel deserialization (CVSS 5.0, Laravel)
- [CVE-2022-35909](https://cve.now/CVE-2022-35909.md): In Jellyfin before 10.8, the /users endpoint has incorrect access control for admin functionality. (no CVSS, Jellyfin.Common)
- [CVE-2022-35910](https://cve.now/CVE-2022-35910.md): In Jellyfin before 10.8, stored XSS allows theft of an admin access token. (no CVSS)
- [CVE-2022-29805](https://cve.now/CVE-2022-29805.md): A Java Deserialization vulnerability in the Fishbowl Server in Fishbowl Inventory before 2022.4.1 allows remote attackers to execute arbitra (no CVSS)
- [CVE-2022-2075](https://cve.now/CVE-2022-2075.md): In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service targeting the build information request validatio (no CVSS, Octopus Deploy Octopus Server)
- [CVE-2022-2074](https://cve.now/CVE-2022-2074.md): In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service using the Variable Project Template. (no CVSS, Octopus Deploy Octopus Server)
- [CVE-2022-2049](https://cve.now/CVE-2022-2049.md): In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service via the package upload function. (no CVSS, Octopus Deploy Octopus Server)
- [CVE-2022-1901](https://cve.now/CVE-2022-1901.md): In affected versions of Octopus Deploy it is possible to unmask sensitive variables by using variable preview. (no CVSS, Octopus Deploy Octopus Server)
- [CVE-2020-23466](https://cve.now/CVE-2020-23466.md): Cross Site Scripting (XSS) vulnerability exists in the phpgurukul Online Marriage Registration System 1.0 allows attackers to run arbitrary (no CVSS)
- [CVE-2022-35167](https://cve.now/CVE-2022-35167.md): Printix Cloud Print Management v1.3.1149.0 for Windows was discovered to contain insecure permissions. (no CVSS)
- [CVE-2022-2889](https://cve.now/CVE-2022-2889.md): Use After Free in vim/vim (CVSS 7.8, vim/vim)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-08-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.