CVEs published August 22, 2022
115 CVEs were published on August 22, 2022: 13 critical, 15 high.
- Published
- 115
- Critical
- 13
- High
- 15
- Medium
- 28
- Low
- 2
- Unrated
- 57
- Now in CISA KEV
- 0
- Fix available
- 41
Most affected products
- WWBN AVideo
- 22
- Tabit
- 7
- Transposh WordPress Translation
- 6
- Dell PowerScale OneFS
- 4
- HDF5 Group libhdf5
- 3
- Pegasystems Pega Infinity
- 3
- Feed Them Social – for Twitter feed, Youtube and more
- 2
- Kernel
- 2
- WP Edit Menu
- 2
- yetiforcecompany/yetiforcecrm · yetiforce/yetiforce-crm
- 2
Critical 13
- CVE-2022-32772A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364.WWBN AVideo
- CVE-2022-32771A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364.WWBN AVideo
- CVE-2022-32770A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364.WWBN AVideo
- CVE-2022-32572An os command injection vulnerability exists in the aVideoEncoder wget functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364.WWBN AVideo
- CVE-2022-30690A cross-site scripting (xss) vulnerability exists in the image403 functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364.WWBN AVideo
- CVE-2022-30547A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364.WWBN AVideo
- CVE-2022-30534An OS command injection vulnerability exists in the aVideoEncoder chunkfile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364WWBN AVideo
- CVE-2022-28712A cross-site scripting (xss) vulnerability exists in the videoAddNew functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364.WWBN AVideo
- CVE-2022-26842A reflected cross-site scripting (xss) vulnerability exists in the charts tab selection functionality of WWBN AVideo 11.6 and dev master comWWBN AVideo
- CVE-2022-34149WordPress WP OAuth Server plugin <= 3.0.4 - Authentication Bypass vulnerabilityminiOrange WP OAuth Server
- CVE-2022-34858WordPress OAuth 2.0 client for SSO plugin <= 1.11.3 - Authentication Bypass vulnerabilityminiOrange OAuth 2.0 client for SSO
- CVE-2022-2890Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrmyetiforcecompany/yetiforcecrm · yetiforce/yetiforce-crm
- CVE-2022-2932Cross-site Scripting (XSS) - Reflected in bustle/mobiledoc-kitbustle/mobiledoc-kit · mobiledoc-kit
High 15
- CVE-2022-34652A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364.WWBN AVideo
- CVE-2022-33149A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364.WWBN AVideo
- CVE-2022-33148A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364.WWBN AVideo
- CVE-2022-33147A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364.WWBN AVideo
- CVE-2022-32778An information disclosure vulnerability exists in the cookie functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364.WWBN AVideo
- CVE-2022-32777An information disclosure vulnerability exists in the cookie functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364.WWBN AVideo
- CVE-2022-32282An improper password check exists in the login functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364.WWBN AVideo
- CVE-2022-30605A privilege escalation vulnerability exists in the session id functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364.WWBN AVideo
- CVE-2022-29468A cross-site request forgery (CSRF) vulnerability exists in WWBN AVideo 11.6 and dev master commit 3f7c0364.WWBN AVideo
- CVE-2022-26061A heap-based buffer overflow vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4.HDF5 Group libhdf5
- CVE-2022-25972An out-of-bounds write vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4.HDF5 Group libhdf5
- CVE-2022-25942An out-of-bounds read vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4.HDF5 Group libhdf5
- CVE-2022-2842SourceCodester Gym Management System login.php sql injectionSourceCodester Gym Management System
- CVE-2022-1340Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrmyetiforcecompany/yetiforcecrm · yetiforce/yetiforce-crm
- CVE-2022-2927Weak Password Requirements in notrinos/notrinoserpnotrinos/notrinoserp · notrinos/notrinos-erp
Medium, low and unrated 87
- CVE-2022-35191D-Link Wireless AC1200 Dual Band VDSL ADSL Modem Router DSL-3782 Firmware v1.01 allows unauthenticated attackers to cause a Denial of Servic
- CVE-2021-29891IBM OPENBMC OP910 and OP940 could allow a privileged user to upload an improper site identity certificate that may cause it to lose network IBM Power 9 AC922
- CVE-2022-38667HTTP applications (servers) based on Crow through 1.0+4 may allow a Use-After-Free and code execution when HTTP pipelining is used.
- CVE-2022-38668HTTP applications (servers) based on Crow through 1.0+4 may reveal potentially sensitive uninitialized data from stack memory when fulfillin
- CVE-2022-38171Xpdf prior to version 4.04 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIG2Stream.cc).
- CVE-2022-32769Multiple authentication bypass vulnerabilities exist in the objects id handling functionality of WWBN AVideo 11.6 and dev master commit 3f7cWWBN AVideo
- CVE-2022-32768Multiple authentication bypass vulnerabilities exist in the objects id handling functionality of WWBN AVideo 11.6 and dev master commit 3f7cWWBN AVideo
- CVE-2022-32761An information disclosure vulnerability exists in the aVideoEncoderReceiveImage functionality of WWBN AVideo 11.6 and dev master commit 3f7cWWBN AVideo
- CVE-2022-28710An information disclosure vulnerability exists in the chunkFile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364.WWBN AVideo
- CVE-2022-1930ReDoS in eth-account encode_structured_data functioneth-account
- CVE-2022-33932Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.19, 9.2.1.12, 9.3.0.6, and 9.4.0.2, contain an unprotected primary channel vDell PowerScale OneFS
- CVE-2022-32480Dell PowerScale OneFS, versions 9.0.0, up to and including 9.1.0.19, 9.2.1.12, 9.3.0.6, and 9.4.0.2, contain an insecure default initializatDell PowerScale OneFS
- CVE-2022-31238Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.19, 9.2.1.12, 9.3.0.6, and 9.4.0.2, contain a process invoked with sensitiveDell PowerScale OneFS
- CVE-2022-31237Dell PowerScale OneFS, versions 9.2.0 up to and including 9.2.1.12 and 9.3.0.5 contain an improper preservation of permissions vulnerabilityDell PowerScale OneFS
- CVE-2022-35150Baijicms v4 was discovered to contain an arbitrary file upload vulnerability.
- CVE-2022-2600Auto-hyperlink URLs <= 5.4.1 - Tab NabbingAuto-hyperlink URLs
- CVE-2022-2594Advanced Custom Fields 5.0-5.12.2 - Unauthenticated File UploadTODO Advanced Custom Fields
- CVE-2022-2593Better Search and Replace < 1.4.1 - Admin+ SQLiBetter Search Replace
- CVE-2022-2558Simple Job Board < 2.10.0 - Resume Disclosure via Directory ListingSimple Job Board
- CVE-2022-2557WordPress Team Members Showcase < 4.1.2 - Subscriber+ Arbitrary File Read and DeletionTeam – WordPress Team Members Showcase Plugin
- CVE-2022-2555Yotpo Reviews for WooCommerce <= 2.0.4 - Arbitrary Settings Update via CSRFYotpo Reviews for WooCommerce
- CVE-2022-2552Duplicator < 1.4.7.1 - Unauthenticated System Information DisclosureDuplicator
- CVE-2022-2551Duplicator < 1.4.7 - Unauthenticated Backup DownloadDuplicator – WordPress Migration Plugin
- CVE-2022-2544Ninja Job Board < 1.3.3 - Resume Disclosure via Directory ListingNinja Job Board – Ultimate WordPress Job Board Plugin
- CVE-2022-2532Feed Them Social < 3.0.1 - Reflected Cross-Site ScriptingFeed Them Social – for Twitter feed, Youtube and more
- CVE-2022-2407WP phpMyAdmin < 5.2.0.4 - Admin+ Stored Cross-Site ScriptingWP phpMyAdmin
- CVE-2022-2392Lana Downloads Manager < 1.8.0 - Contributor+ Arbitrary File DownloadLana Downloads Manager
- CVE-2022-2389Automations By Autonami < 2.1.2 - Subscriber+ Automation CreationAbandoned Cart Recovery for WooCommerce, Follow Up Emails,…
- CVE-2022-2388WP Coder < 2.5.3 - Code Deletion via CSRFWP Coder – add custom html, css and js code
- CVE-2022-2383Feed Them Social < 3.0.1 - Reflected Cross-Site ScriptingFeed Them Social – for Twitter feed, Youtube and more
- CVE-2022-2382Product Slider for WooCommerce < 2.5.7 - Subscriber+ Arbitrary Options DeletionProduct Slider for WooCommerce
- CVE-2022-2377Directorist < 7.3.0 - Subscriber+ Arbitrary E-mail SendingDirectorist – WordPress Business Directory Plugin with Clas…
- CVE-2022-2375WP Sticky Button < 1.4.1 - Unauthenticated Arbitrary Settings Update to Stored XSSWP Sticky Button – Click to Chat
- CVE-2022-2362Download Manager < 3.2.50 - Bypass IP Address Blocking RestrictionDownload Manager
- CVE-2022-2361Social Chat < 6.0.5 - Admin+ Stored Cross-Site ScriptingWP Social Chat – Click To Chat App
- CVE-2022-2312Student Result or Employee Database < 1.7.5 - Stored Cross Site Scripting via CSRFStudent Result or Employee Database
- CVE-2022-2276WP Edit Menu < 1.5.0 - Unauthenticated Arbitrary Post DeletionWP Edit Menu
- CVE-2022-2275WP Edit Menu <= 1.5.0 - Arbitrary Post Deletion via CSRFWP Edit Menu
- CVE-2022-2198WPQA < 5.7 - Subscriber+ Private Message Disclosure via IDORWPQA Builder
- CVE-2022-2172LinkWorth Plugin < 3.3.4 - Arbitrary Setting Update via CSRFLinkWorth Plugin
- CVE-2022-25812Transposh WordPress Translation < 1.0.8 - Admin+ RCETransposh WordPress Translation
- CVE-2022-25811Transposh WordPress Translation <= 1.0.8 - Admin+ SQL InjectionTransposh WordPress Translation
- CVE-2022-25810Transposh WordPress Translation <= 1.0.8 - Subscriber+ Unauthorised CallsTransposh WordPress Translation
- CVE-2022-1932Rezgo Online Booking < 4.1.8 - Reflected Cross-Site-ScriptingRezgo Online Booking
- CVE-2022-1322Coming Soon - Under Construction <= 1.1.9 - Admin+ Stored Cross-Site ScriptingComing Soon – Under Construction
- CVE-2022-1251Ask Me < 6.8.4 - CSRF in Edit ProfileAsk me
- CVE-2022-0446Simple Banner < 2.12.0 - Admin+ Stored Cross Site ScriptingSimple Banner
- CVE-2021-24912Transposh WordPress Translation < 1.0.8 - CSRF to Stored XSSTransposh WordPress Translation
- CVE-2021-24911Transposh WordPress Translation < 1.0.8 - Stored Cross-Site ScriptingTransposh WordPress Translation
- CVE-2021-24910Transposh WordPress Translation < 1.0.8 - Reflected Cross-Site ScriptingTransposh WordPress Translation
- CVE-2022-34857WordPress SP Project & Document Manager plugin <= 4.59 - Reflected Cross-Site Scripting (XSS) vulnerabilitysmartypants SP Project & Document Manager
- CVE-2022-36346WordPress MaxButtons plugin <= 9.2 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilitiesMax Foundry MaxButtons
- CVE-2021-3659A NULL pointer dereference flaw was found in the Linux kernel’s IEEE 802.15.4 wireless networking subsystem in the way the user closes the LKernel
- CVE-2021-3639A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly.mod_auth_mellon
- CVE-2022-33900WordPress Easy Digital Downloads plugin <= 3.0.1 - PHP Object Injection vulnerabilityEasy Digital Downloads
- CVE-2021-3590A flaw was found in Foreman project.foreman
- CVE-2022-35656Pega Platform from 8.3 to 8.7.3 vulnerability may allow authenticated security administrators to alter CSRF settings directly.Pegasystems Pega Infinity
- CVE-2022-35655Pega Platform from 7.3 to 8.7.3 is affected by an XSS issue due to a misconfiguration of a datapage setting.Pegasystems Pega Infinity
- CVE-2022-34347WordPress Download Manager plugin <= 3.2.48 - Cross-Site Request Forgery (CSRF) vulnerabilityW3 Eden Download Manager
- CVE-2022-35654Pega Platform from 8.5.4 to 8.7.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter.Pegasystems Pega Infinity
- CVE-2021-3586A flaw was found in servicemesh-operator.servicemesh-operator
- CVE-2021-36857WordPress Testimonial Builder plugin <= 1.6.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilitywpshopmart Testimonial
- CVE-2021-36852WordPress WP Hotel Booking plugin <= 1.10.5 - Cross-Site Request Forgery (CSRF) vulnerabilityThimPress WP Hotel Booking
- CVE-2021-3513A flaw was found in keycloak where a brute force attack is possible even when the permanent lockout feature is enabled.keycloak · org.keycloak:keycloak-parent
- CVE-2021-36847WordPress Webba Booking plugin <= 4.2.21 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityWebbaPlugins Webba Booking
- CVE-2022-37133D-link DIR-816 A2_v1.10CNB04.img reboots the router without authentication via /goform/doReboot.
- CVE-2021-3442A flaw was found in the Red Hat OpenShift API Management product.Red Hat OpenShift API Management.
- CVE-2020-27836A flaw was found in cluster-ingress-operator.cluster-ingress-operator
- CVE-2022-34772Tabit - password enumerationTabit
- CVE-2022-34776Tabit - giftcard stealthTabit
- CVE-2022-34775Tabit - Excessive data exposureTabit
- CVE-2022-34774Tabit - Arbitrary account modificationTabit
- CVE-2022-37134D-link DIR-816 A2_v1.10CNB04.img is vulnerable to Buffer Overflow via /goform/form2Wan.cgi.
- CVE-2022-34773Tabit - HTTP Method manipulationTabit
- CVE-2022-34770Tabit - sensitive information disclosureTabit
- CVE-2022-34771Tabit - arbitrary SMS send on Tabits behalfTabit
- CVE-2021-37289Insecure Permissions in administration interface in Planex MZK-DP150N 1.42 and 1.43 allows attackers to execute system command as root via e
- CVE-2022-2930Unverified Password Change in octoprint/octoprintoctoprint/octoprint · octoprint
- CVE-2022-2841CrowdStrike Falcon Uninstallation authorizationCrowdStrike Falcon
- CVE-2022-36251Clinic's Patient Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via patients.php.
- CVE-2022-36198Multiple SQL injections detected in Bus Pass Management System 1.0 via buspassms/admin/view-enquiry.php, buspassms/admin/pass-bwdates-report
- CVE-2021-3481A flaw was found in Qt.qt
- CVE-2021-3521There is a flaw in RPM's signature functionality.RPM
- CVE-2022-28598Frappe ERPNext 12.29.0 is vulnerable to XSS where the software does not neutralize or incorrectly neutralize user-controllable input before
- CVE-2022-2873An out-of-bounds memory access flaw was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way a user triggers the IKernel
- CVE-2022-2923NULL Pointer Dereference in vim/vimvim/vim
- CVE-2022-35583wkhtmlTOpdf 0.12.6 is vulnerable to SSRF which allows an attacker to get initial access into the target's system by injecting iframe tag wit