# CVEs published 2022-08-22

115 CVEs were published on August 22, 2022: 13 critical, 15 high. Days are UTC.

- [CVE-2022-35191](https://cve.now/CVE-2022-35191.md): D-Link Wireless AC1200 Dual Band VDSL ADSL Modem Router DSL-3782 Firmware v1.01 allows unauthenticated attackers to cause a Denial of Servic (no CVSS)
- [CVE-2021-29891](https://cve.now/CVE-2021-29891.md): IBM OPENBMC OP910 and OP940 could allow a privileged user to upload an improper site identity certificate that may cause it to lose network (CVSS 4.5, IBM Power 9 AC922)
- [CVE-2022-38667](https://cve.now/CVE-2022-38667.md): HTTP applications (servers) based on Crow through 1.0+4 may allow a Use-After-Free and code execution when HTTP pipelining is used. (no CVSS)
- [CVE-2022-38668](https://cve.now/CVE-2022-38668.md): HTTP applications (servers) based on Crow through 1.0+4 may reveal potentially sensitive uninitialized data from stack memory when fulfillin (no CVSS)
- [CVE-2022-38171](https://cve.now/CVE-2022-38171.md): Xpdf prior to version 4.04 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIG2Stream.cc). (no CVSS)
- [CVE-2022-34652](https://cve.now/CVE-2022-34652.md): A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. (CVSS 8.3, WWBN AVideo)
- [CVE-2022-33149](https://cve.now/CVE-2022-33149.md): A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. (CVSS 8.3, WWBN AVideo)
- [CVE-2022-33148](https://cve.now/CVE-2022-33148.md): A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. (CVSS 8.3, WWBN AVideo)
- [CVE-2022-33147](https://cve.now/CVE-2022-33147.md): A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. (CVSS 8.3, WWBN AVideo)
- [CVE-2022-32778](https://cve.now/CVE-2022-32778.md): An information disclosure vulnerability exists in the cookie functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. (CVSS 7.5, WWBN AVideo)
- [CVE-2022-32777](https://cve.now/CVE-2022-32777.md): An information disclosure vulnerability exists in the cookie functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. (CVSS 7.5, WWBN AVideo)
- [CVE-2022-32772](https://cve.now/CVE-2022-32772.md): A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. (CVSS 9.6, WWBN AVideo)
- [CVE-2022-32771](https://cve.now/CVE-2022-32771.md): A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. (CVSS 9.6, WWBN AVideo)
- [CVE-2022-32770](https://cve.now/CVE-2022-32770.md): A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. (CVSS 9.6, WWBN AVideo)
- [CVE-2022-32769](https://cve.now/CVE-2022-32769.md): Multiple authentication bypass vulnerabilities exist in the objects id handling functionality of WWBN AVideo 11.6 and dev master commit 3f7c (CVSS 4.8, WWBN AVideo)
- [CVE-2022-32768](https://cve.now/CVE-2022-32768.md): Multiple authentication bypass vulnerabilities exist in the objects id handling functionality of WWBN AVideo 11.6 and dev master commit 3f7c (CVSS 4.8, WWBN AVideo)
- [CVE-2022-32761](https://cve.now/CVE-2022-32761.md): An information disclosure vulnerability exists in the aVideoEncoderReceiveImage functionality of WWBN AVideo 11.6 and dev master commit 3f7c (CVSS 6.5, WWBN AVideo)
- [CVE-2022-32572](https://cve.now/CVE-2022-32572.md): An os command injection vulnerability exists in the aVideoEncoder wget functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. (CVSS 9.9, WWBN AVideo)
- [CVE-2022-32282](https://cve.now/CVE-2022-32282.md): An improper password check exists in the login functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. (CVSS 7.2, WWBN AVideo)
- [CVE-2022-30690](https://cve.now/CVE-2022-30690.md): A cross-site scripting (xss) vulnerability exists in the image403 functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. (CVSS 9.6, WWBN AVideo)
- [CVE-2022-30605](https://cve.now/CVE-2022-30605.md): A privilege escalation vulnerability exists in the session id functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. (CVSS 8.8, WWBN AVideo)
- [CVE-2022-30547](https://cve.now/CVE-2022-30547.md): A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. (CVSS 9.9, WWBN AVideo)
- [CVE-2022-30534](https://cve.now/CVE-2022-30534.md): An OS command injection vulnerability exists in the aVideoEncoder chunkfile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364 (CVSS 9.9, WWBN AVideo)
- [CVE-2022-29468](https://cve.now/CVE-2022-29468.md): A cross-site request forgery (CSRF) vulnerability exists in WWBN AVideo 11.6 and dev master commit 3f7c0364. (CVSS 8.8, WWBN AVideo)
- [CVE-2022-28712](https://cve.now/CVE-2022-28712.md): A cross-site scripting (xss) vulnerability exists in the videoAddNew functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. (CVSS 9.0, WWBN AVideo)
- [CVE-2022-28710](https://cve.now/CVE-2022-28710.md): An information disclosure vulnerability exists in the chunkFile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. (CVSS 6.5, WWBN AVideo)
- [CVE-2022-26842](https://cve.now/CVE-2022-26842.md): A reflected cross-site scripting (xss) vulnerability exists in the charts tab selection functionality of WWBN AVideo 11.6 and dev master com (CVSS 9.6, WWBN AVideo)
- [CVE-2022-26061](https://cve.now/CVE-2022-26061.md): A heap-based buffer overflow vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4. (CVSS 7.8, HDF5 Group libhdf5)
- [CVE-2022-25972](https://cve.now/CVE-2022-25972.md): An out-of-bounds write vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4. (CVSS 7.8, HDF5 Group libhdf5)
- [CVE-2022-25942](https://cve.now/CVE-2022-25942.md): An out-of-bounds read vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4. (CVSS 7.8, HDF5 Group libhdf5)
- [CVE-2022-2842](https://cve.now/CVE-2022-2842.md): SourceCodester Gym Management System login.php sql injection (CVSS 7.3, SourceCodester Gym Management System)
- [CVE-2022-1930](https://cve.now/CVE-2022-1930.md): ReDoS in eth-account encode\_structured\_data function (CVSS 5.9, eth-account)
- [CVE-2022-33932](https://cve.now/CVE-2022-33932.md): Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.19, 9.2.1.12, 9.3.0.6, and 9.4.0.2, contain an unprotected primary channel v (CVSS 5.3, Dell PowerScale OneFS)
- [CVE-2022-32480](https://cve.now/CVE-2022-32480.md): Dell PowerScale OneFS, versions 9.0.0, up to and including 9.1.0.19, 9.2.1.12, 9.3.0.6, and 9.4.0.2, contain an insecure default initializat (CVSS 4.3, Dell PowerScale OneFS)
- [CVE-2022-31238](https://cve.now/CVE-2022-31238.md): Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.19, 9.2.1.12, 9.3.0.6, and 9.4.0.2, contain a process invoked with sensitive (CVSS 4.7, Dell PowerScale OneFS)
- [CVE-2022-31237](https://cve.now/CVE-2022-31237.md): Dell PowerScale OneFS, versions 9.2.0 up to and including 9.2.1.12 and 9.3.0.5 contain an improper preservation of permissions vulnerability (CVSS 3.3, Dell PowerScale OneFS)
- [CVE-2022-35150](https://cve.now/CVE-2022-35150.md): Baijicms v4 was discovered to contain an arbitrary file upload vulnerability. (no CVSS)
- [CVE-2022-2600](https://cve.now/CVE-2022-2600.md): Auto-hyperlink URLs \<= 5.4.1 - Tab Nabbing (no CVSS, Auto-hyperlink URLs)
- [CVE-2022-2594](https://cve.now/CVE-2022-2594.md): Advanced Custom Fields 5.0-5.12.2 - Unauthenticated File Upload (no CVSS, TODO Advanced Custom Fields)
- [CVE-2022-2593](https://cve.now/CVE-2022-2593.md): Better Search and Replace \< 1.4.1 - Admin+ SQLi (no CVSS, Better Search Replace)
- [CVE-2022-2558](https://cve.now/CVE-2022-2558.md): Simple Job Board \< 2.10.0 - Resume Disclosure via Directory Listing (no CVSS, Simple Job Board)
- [CVE-2022-2557](https://cve.now/CVE-2022-2557.md): WordPress Team Members Showcase \< 4.1.2 - Subscriber+ Arbitrary File Read and Deletion (no CVSS, Team – WordPress Team Members Showcase Plugin)
- [CVE-2022-2555](https://cve.now/CVE-2022-2555.md): Yotpo Reviews for WooCommerce \<= 2.0.4 - Arbitrary Settings Update via CSRF (no CVSS, Yotpo Reviews for WooCommerce)
- [CVE-2022-2552](https://cve.now/CVE-2022-2552.md): Duplicator \< 1.4.7.1 - Unauthenticated System Information Disclosure (no CVSS, Duplicator)
- [CVE-2022-2551](https://cve.now/CVE-2022-2551.md): Duplicator \< 1.4.7 - Unauthenticated Backup Download (no CVSS, Duplicator – WordPress Migration Plugin)
- [CVE-2022-2544](https://cve.now/CVE-2022-2544.md): Ninja Job Board \< 1.3.3 - Resume Disclosure via Directory Listing (no CVSS, Ninja Job Board – Ultimate WordPress Job Board Plugin)
- [CVE-2022-2532](https://cve.now/CVE-2022-2532.md): Feed Them Social \< 3.0.1 - Reflected Cross-Site Scripting (no CVSS, Feed Them Social – for Twitter feed, Youtube and more)
- [CVE-2022-2407](https://cve.now/CVE-2022-2407.md): WP phpMyAdmin \< 5.2.0.4 - Admin+ Stored Cross-Site Scripting (no CVSS, WP phpMyAdmin)
- [CVE-2022-2392](https://cve.now/CVE-2022-2392.md): Lana Downloads Manager \< 1.8.0 - Contributor+ Arbitrary File Download (no CVSS, Lana Downloads Manager)
- [CVE-2022-2389](https://cve.now/CVE-2022-2389.md): Automations By Autonami \< 2.1.2 - Subscriber+ Automation Creation (no CVSS, Abandoned Cart Recovery for WooCommerce, Follow Up Emails,…)
- [CVE-2022-2388](https://cve.now/CVE-2022-2388.md): WP Coder \< 2.5.3 - Code Deletion via CSRF (no CVSS, WP Coder – add custom html, css and js code)
- [CVE-2022-2383](https://cve.now/CVE-2022-2383.md): Feed Them Social \< 3.0.1 - Reflected Cross-Site Scripting (no CVSS, Feed Them Social – for Twitter feed, Youtube and more)
- [CVE-2022-2382](https://cve.now/CVE-2022-2382.md): Product Slider for WooCommerce \< 2.5.7 - Subscriber+ Arbitrary Options Deletion (no CVSS, Product Slider for WooCommerce)
- [CVE-2022-2377](https://cve.now/CVE-2022-2377.md): Directorist \< 7.3.0 - Subscriber+ Arbitrary E-mail Sending (no CVSS, Directorist – WordPress Business Directory Plugin with Clas…)
- [CVE-2022-2375](https://cve.now/CVE-2022-2375.md): WP Sticky Button \< 1.4.1 - Unauthenticated Arbitrary Settings Update to Stored XSS (no CVSS, WP Sticky Button – Click to Chat)
- [CVE-2022-2362](https://cve.now/CVE-2022-2362.md): Download Manager \< 3.2.50 - Bypass IP Address Blocking Restriction (no CVSS, Download Manager)
- [CVE-2022-2361](https://cve.now/CVE-2022-2361.md): Social Chat \< 6.0.5 - Admin+ Stored Cross-Site Scripting (no CVSS, WP Social Chat – Click To Chat App)
- [CVE-2022-2312](https://cve.now/CVE-2022-2312.md): Student Result or Employee Database \< 1.7.5 - Stored Cross Site Scripting via CSRF (no CVSS, Student Result or Employee Database)
- [CVE-2022-2276](https://cve.now/CVE-2022-2276.md): WP Edit Menu \< 1.5.0 - Unauthenticated Arbitrary Post Deletion (no CVSS, WP Edit Menu)
- [CVE-2022-2275](https://cve.now/CVE-2022-2275.md): WP Edit Menu \<= 1.5.0 - Arbitrary Post Deletion via CSRF (no CVSS, WP Edit Menu)
- [CVE-2022-2198](https://cve.now/CVE-2022-2198.md): WPQA \< 5.7 - Subscriber+ Private Message Disclosure via IDOR (no CVSS, WPQA Builder)
- [CVE-2022-2172](https://cve.now/CVE-2022-2172.md): LinkWorth Plugin \< 3.3.4 - Arbitrary Setting Update via CSRF (no CVSS, LinkWorth Plugin)
- [CVE-2022-25812](https://cve.now/CVE-2022-25812.md): Transposh WordPress Translation \< 1.0.8 - Admin+ RCE (no CVSS, Transposh WordPress Translation)
- [CVE-2022-25811](https://cve.now/CVE-2022-25811.md): Transposh WordPress Translation \<= 1.0.8 - Admin+ SQL Injection (no CVSS, Transposh WordPress Translation)
- [CVE-2022-25810](https://cve.now/CVE-2022-25810.md): Transposh WordPress Translation \<= 1.0.8 - Subscriber+ Unauthorised Calls (no CVSS, Transposh WordPress Translation)
- [CVE-2022-1932](https://cve.now/CVE-2022-1932.md): Rezgo Online Booking \< 4.1.8 - Reflected Cross-Site-Scripting (no CVSS, Rezgo Online Booking)
- [CVE-2022-1322](https://cve.now/CVE-2022-1322.md): Coming Soon - Under Construction \<= 1.1.9 - Admin+ Stored Cross-Site Scripting (no CVSS, Coming Soon – Under Construction)
- [CVE-2022-1251](https://cve.now/CVE-2022-1251.md): Ask Me \< 6.8.4 - CSRF in Edit Profile (no CVSS, Ask me)
- [CVE-2022-0446](https://cve.now/CVE-2022-0446.md): Simple Banner \< 2.12.0 - Admin+ Stored Cross Site Scripting (no CVSS, Simple Banner)
- [CVE-2021-24912](https://cve.now/CVE-2021-24912.md): Transposh WordPress Translation \< 1.0.8 - CSRF to Stored XSS (no CVSS, Transposh WordPress Translation)
- [CVE-2021-24911](https://cve.now/CVE-2021-24911.md): Transposh WordPress Translation \< 1.0.8 - Stored Cross-Site Scripting (no CVSS, Transposh WordPress Translation)
- [CVE-2021-24910](https://cve.now/CVE-2021-24910.md): Transposh WordPress Translation \< 1.0.8 - Reflected Cross-Site Scripting (no CVSS, Transposh WordPress Translation)
- [CVE-2022-34857](https://cve.now/CVE-2022-34857.md): WordPress SP Project & Document Manager plugin \<= 4.59 - Reflected Cross-Site Scripting (XSS) vulnerability (CVSS 6.1, smartypants SP Project & Document Manager)
- [CVE-2022-36346](https://cve.now/CVE-2022-36346.md): WordPress MaxButtons plugin \<= 9.2 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities (CVSS 4.3, Max Foundry MaxButtons)
- [CVE-2022-34149](https://cve.now/CVE-2022-34149.md): WordPress WP OAuth Server plugin \<= 3.0.4 - Authentication Bypass vulnerability (CVSS 9.8, miniOrange WP OAuth Server)
- [CVE-2021-3659](https://cve.now/CVE-2021-3659.md): A NULL pointer dereference flaw was found in the Linux kernel’s IEEE 802.15.4 wireless networking subsystem in the way the user closes the L (no CVSS, Kernel)
- [CVE-2022-34858](https://cve.now/CVE-2022-34858.md): WordPress OAuth 2.0 client for SSO plugin \<= 1.11.3 - Authentication Bypass vulnerability (CVSS 9.8, miniOrange OAuth 2.0 client for SSO)
- [CVE-2021-3639](https://cve.now/CVE-2021-3639.md): A flaw was found in mod\_auth\_mellon where it does not sanitize logout URLs properly. (no CVSS, mod\_auth\_mellon)
- [CVE-2022-33900](https://cve.now/CVE-2022-33900.md): WordPress Easy Digital Downloads plugin \<= 3.0.1 - PHP Object Injection vulnerability (CVSS 4.1, Easy Digital Downloads)
- [CVE-2021-3590](https://cve.now/CVE-2021-3590.md): A flaw was found in Foreman project. (no CVSS, foreman)
- [CVE-2022-35656](https://cve.now/CVE-2022-35656.md): Pega Platform from 8.3 to 8.7.3 vulnerability may allow authenticated security administrators to alter CSRF settings directly. (CVSS 6.8, Pegasystems Pega Infinity)
- [CVE-2022-35655](https://cve.now/CVE-2022-35655.md): Pega Platform from 7.3 to 8.7.3 is affected by an XSS issue due to a misconfiguration of a datapage setting. (CVSS 6.1, Pegasystems Pega Infinity)
- [CVE-2022-34347](https://cve.now/CVE-2022-34347.md): WordPress Download Manager plugin \<= 3.2.48 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 4.2, W3 Eden Download Manager)
- [CVE-2022-35654](https://cve.now/CVE-2022-35654.md): Pega Platform from 8.5.4 to 8.7.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter. (CVSS 6.1, Pegasystems Pega Infinity)
- [CVE-2021-3586](https://cve.now/CVE-2021-3586.md): A flaw was found in servicemesh-operator. (no CVSS, servicemesh-operator)
- [CVE-2021-36857](https://cve.now/CVE-2021-36857.md): WordPress Testimonial Builder plugin \<= 1.6.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, wpshopmart Testimonial)
- [CVE-2021-36852](https://cve.now/CVE-2021-36852.md): WordPress WP Hotel Booking plugin \<= 1.10.5 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 4.3, ThimPress WP Hotel Booking)
- [CVE-2021-3513](https://cve.now/CVE-2021-3513.md): A flaw was found in keycloak where a brute force attack is possible even when the permanent lockout feature is enabled. (no CVSS, keycloak · org.keycloak:keycloak-parent)
- [CVE-2021-36847](https://cve.now/CVE-2021-36847.md): WordPress Webba Booking plugin \<= 4.2.21 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, WebbaPlugins Webba Booking)
- [CVE-2022-37133](https://cve.now/CVE-2022-37133.md): D-link DIR-816 A2\_v1.10CNB04.img reboots the router without authentication via /goform/doReboot. (no CVSS)
- [CVE-2021-3442](https://cve.now/CVE-2021-3442.md): A flaw was found in the Red Hat OpenShift API Management product. (no CVSS, Red Hat OpenShift API Management.)
- [CVE-2020-27836](https://cve.now/CVE-2020-27836.md): A flaw was found in cluster-ingress-operator. (no CVSS, cluster-ingress-operator)
- [CVE-2022-34772](https://cve.now/CVE-2022-34772.md): Tabit - password enumeration (CVSS 4.3, Tabit)
- [CVE-2022-34776](https://cve.now/CVE-2022-34776.md): Tabit - giftcard stealth (CVSS 5.5, Tabit)
- [CVE-2022-34775](https://cve.now/CVE-2022-34775.md): Tabit - Excessive data exposure (CVSS 6.3, Tabit)
- [CVE-2022-34774](https://cve.now/CVE-2022-34774.md): Tabit - Arbitrary account modification (CVSS 6.3, Tabit)
- [CVE-2022-37134](https://cve.now/CVE-2022-37134.md): D-link DIR-816 A2\_v1.10CNB04.img is vulnerable to Buffer Overflow via /goform/form2Wan.cgi. (no CVSS)
- [CVE-2022-34773](https://cve.now/CVE-2022-34773.md): Tabit - HTTP Method manipulation (CVSS 4.9, Tabit)
- [CVE-2022-34770](https://cve.now/CVE-2022-34770.md): Tabit - sensitive information disclosure (CVSS 4.6, Tabit)
- [CVE-2022-34771](https://cve.now/CVE-2022-34771.md): Tabit - arbitrary SMS send on Tabits behalf (CVSS 5.5, Tabit)
- [CVE-2021-37289](https://cve.now/CVE-2021-37289.md): Insecure Permissions in administration interface in Planex MZK-DP150N 1.42 and 1.43 allows attackers to execute system command as root via e (no CVSS)
- [CVE-2022-2890](https://cve.now/CVE-2022-2890.md): Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm (CVSS 9.0, yetiforcecompany/yetiforcecrm · yetiforce/yetiforce-crm)
- [CVE-2022-2932](https://cve.now/CVE-2022-2932.md): Cross-site Scripting (XSS) - Reflected in bustle/mobiledoc-kit (CVSS 9.8, bustle/mobiledoc-kit · mobiledoc-kit)
- [CVE-2022-1340](https://cve.now/CVE-2022-1340.md): Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm (CVSS 7.0, yetiforcecompany/yetiforcecrm · yetiforce/yetiforce-crm)
- [CVE-2022-2930](https://cve.now/CVE-2022-2930.md): Unverified Password Change in octoprint/octoprint (CVSS 5.3, octoprint/octoprint · octoprint)
- [CVE-2022-2927](https://cve.now/CVE-2022-2927.md): Weak Password Requirements in notrinos/notrinoserp (CVSS 7.3, notrinos/notrinoserp · notrinos/notrinos-erp)
- [CVE-2022-2841](https://cve.now/CVE-2022-2841.md): CrowdStrike Falcon Uninstallation authorization (CVSS 2.7, CrowdStrike Falcon)
- [CVE-2022-36251](https://cve.now/CVE-2022-36251.md): Clinic's Patient Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via patients.php. (no CVSS)
- [CVE-2022-36198](https://cve.now/CVE-2022-36198.md): Multiple SQL injections detected in Bus Pass Management System 1.0 via buspassms/admin/view-enquiry.php, buspassms/admin/pass-bwdates-report (no CVSS)
- [CVE-2021-3481](https://cve.now/CVE-2021-3481.md): A flaw was found in Qt. (no CVSS, qt)
- [CVE-2021-3521](https://cve.now/CVE-2021-3521.md): There is a flaw in RPM's signature functionality. (no CVSS, RPM)
- [CVE-2022-28598](https://cve.now/CVE-2022-28598.md): Frappe ERPNext 12.29.0 is vulnerable to XSS where the software does not neutralize or incorrectly neutralize user-controllable input before (no CVSS)
- [CVE-2022-2873](https://cve.now/CVE-2022-2873.md): An out-of-bounds memory access flaw was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way a user triggers the I (no CVSS, Kernel)
- [CVE-2022-2923](https://cve.now/CVE-2022-2923.md): NULL Pointer Dereference in vim/vim (CVSS 6.6, vim/vim)
- [CVE-2022-35583](https://cve.now/CVE-2022-35583.md): wkhtmlTOpdf 0.12.6 is vulnerable to SSRF which allows an attacker to get initial access into the target's system by injecting iframe tag wit (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-08-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.