CVEs published August 23, 2022
90 CVEs were published on August 23, 2022: 0 critical, 17 high.
- Published
- 90
- Critical
- 0
- High
- 17
- Medium
- 22
- Low
- 2
- Unrated
- 49
- Now in CISA KEV
- 0
- Fix available
- 24
Most affected products
- kernel
- 4
- PukiWiki Development Team PukiWiki
- 3
- All F-Secure and WithSecure Endpoint Protection products fo…
- 2
- ansible-runner
- 2
- ASNeG/OpcUaStack
- 2
- com.jflyfox:jflyfox_jfinal
- 2
- dmitrylitvinov Uploading SVG, WEBP and ICO files
- 2
- libarchive
- 2
- node-opcua
- 2
- OpenEXR
- 2
High 17
- CVE-2022-38132Command injection vulnerability in Linksys MR8300 router while Registration to DDNS Service. By specifying username and password, an attacker connected to the router's web interface can execute arbitrary OS commands.Linksys MR8300 Router
- CVE-2022-1513A potential vulnerability was reported in Lenovo PCManager prior to version 5.0.10.4191 that may allow code execution when visiting a speciaLenovo PCManager
- CVE-2022-36285WordPress Uploading SVG, WEBP and ICO files plugin <= 1.0.1 - Authenticated Arbitrary File Upload vulnerabilitydmitrylitvinov Uploading SVG, WEBP and ICO files
- CVE-2022-36379WordPress ЮKassa для WooCommerce plugin <= 2.3.0 - Cross-Site Request Forgery (CSRF) leading to plugin settings updateYooMoney ЮKassa для WooCommerce
- CVE-2022-36394WordPress Contest Gallery plugin <= 17.0.4 - Authenticated SQL Injection (SQLi) vulnerabilityContest Gallery
- CVE-2022-33142WordPress Better Messages plugin <= 1.9.10.57 - Denial Of Service (DoS) vulnerabilityWordPlus Better Messages
- CVE-2022-34868WordPress ЮKassa для WooCommerce plugin <= 2.3.0 - Authenticated Arbitrary Settings Update vulnerabilityYooMoney ЮKassa для WooCommerce
- CVE-2022-24381Denial of Service (DoS)ASNeG/OpcUaStack
- CVE-2022-25888Denial of Service (DoS)opcua
- CVE-2022-25761Denial of Service (DoS)open62541/open62541
- CVE-2022-24298Denial of Service (DoS)FreeOpcUa/freeopcua
- CVE-2022-21208Denial of Service (DoS)node-opcua
- CVE-2022-25231Denial of Service (DoS)node-opcua
- CVE-2022-25304Denial of Service (DoS)opcua · asyncua
- CVE-2022-25302Denial of Service (DoS)ASNeG/OpcUaStack
- CVE-2022-2829Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrmyetiforcecompany/yetiforcecrm
- CVE-2022-2946Use After Free in vim/vimvim/vim
Medium, low and unrated 73
- CVE-2021-3917A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions.coreos-installer
- CVE-2022-38463ServiceNow through San Diego Patch 4b and Patch 6 allows reflected XSS in the logout functionality.
- CVE-2022-38172ServiceNow through San Diego Patch 3 allows XSS via the name field during creation of a new dashboard for the Performance Analytics dashboar
- CVE-2022-35115IceWarp WebClient DC2 - Update 2 Build 9 (13.0.2.9) was discovered to contain a SQL injection vulnerability via the search parameter at /web
- CVE-2022-38665Jenkins CollabNet Plugins Plugin 2.0.8 and earlier stores a RabbitMQ password unencrypted in its global configuration file on the Jenkins coJenkins project Jenkins CollabNet Plugins Plugin · org.jenk…
- CVE-2022-38664Jenkins Job Configuration History Plugin 1165.v8cc9fd1f4597 and earlier does not escape the job name on the System Configuration History pagJenkins project Jenkins Job Configuration History Plugin ·…
- CVE-2022-38663Jenkins Git Plugin 4.11.4 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log provided by the GitJenkins project Jenkins Git Plugin · org.jenkins-ci.plugins…
- CVE-2022-37428PowerDNS Recursor up to and including 4.5.9, 4.6.2 and 4.7.1, when protobuf logging is enabled, has Improper Cleanup upon a Thrown Exception
- CVE-2022-28883Denial-of-Service (DoS) VulnerabilityAll F-Secure and WithSecure Endpoint Protection products fo…
- CVE-2022-28882Denial-of-Service (DoS) VulnerabilityAll F-Secure and WithSecure Endpoint Protection products fo…
- CVE-2020-35509A flaw was found in keycloak affecting versions 11.0.3 and 12.0.0.keycloak · org.keycloak:keycloak-core
- CVE-2021-3827A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed.keycloak · org.keycloak:keycloak-saml-core
- CVE-2021-3839A flaw was found in the vhost library in DPDK.dpdk
- CVE-2021-3764A memory leak flaw was found in the Linux kernel's ccp_run_aes_gcm_cmd() function that allows an attacker to cause a denial of service.Linux Kernel
- CVE-2021-3763A flaw was found in the Red Hat AMQ Broker management console in version 7.8 where an existing user is able to access some limited informatiAMQ Broker
- CVE-2021-3736A flaw was found in the Linux kernel.kernel
- CVE-2021-3714A flaw was found in the Linux kernels memory deduplication mechanism.kernel
- CVE-2021-3702A race condition flaw was found in ansible-runner, where an attacker could watch for rapid creation and deletion of a temporary directory, sansible-runner
- CVE-2021-3701A flaw was found in ansible-runner where the default temporary files configuration in ansible-2.0.0 are written to world R/W locations.ansible-runner
- CVE-2021-3690A flaw was found in Undertow.undertow · io.undertow:undertow-core
- CVE-2021-3670MaxQueryDuration not honoured in Samba AD DC LDAPsamba
- CVE-2021-3798A flaw was found in openCryptoki.opencryptoki
- CVE-2022-36389WordPress Better Messages plugin <= 1.9.9.148 - Cross-Site Request Forgery (CSRF) vulnerabilityWordPlus Better Messages
- CVE-2022-36405WordPress amCharts: Charts and Maps plugin <= 1.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityamCharts: Charts and Maps
- CVE-2022-36347WordPress Alpine PhotoTile for Pinterest plugin <= 1.3.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityAlpine Press Alpine PhotoTile for Pinterest
- CVE-2022-36292WordPress Gallery PhotoBlocks plugin <= 1.2.6 - Cross-Site Request Forgery (CSRF) vulnerabilitiesWPChill Gallery PhotoBlocks
- CVE-2022-35726WordPress Video Gallery plugin <= 1.3.4.5 - Broken Authentication vulnerabilityyotuwp Video Gallery
- CVE-2022-36341WordPress AS – Create Pinterest Pinboard Pages plugin <= 1.0 - Authenticated plugin settings change leading to Stored Cross-Site Scripting (XSS) vulnerabilityAkash soni AS – Create Pinterest Pinboard Pages
- CVE-2022-36288WordPress Download Manager plugin <= 3.2.48 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilitiesW3 Eden Download Manager
- CVE-2022-35235WordPress WPide plugin <= 2.6 - Authenticated Arbitrary File Read vulnerabilityXplodedThemes WPIDE – File Manager & Code Editor
- CVE-2022-36282WordPress Search Exclude plugin <= 1.2.6 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityRoman Pronskiy Search Exclude
- CVE-2022-34658WordPress Download Manager plugin <= 3.2.48 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilitiesW3 Eden Download Manager
- CVE-2022-35242WordPress THE Leads Management System: 59sec LITE plugin <= 3.4.1 - Unauthenticated plugin settings change vulnerabilityTHE Leads Management System: 59sec LITE
- CVE-2022-29476WordPress Notification Bar for WordPress plugin <= 1.1.8 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability8 Degree Themes Notification Bar for WordPress
- CVE-2022-34648WordPress Uploading SVG, WEBP and ICO files plugin <= 1.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilitydmitrylitvinov Uploading SVG, WEBP and ICO files
- CVE-2022-2965Improper Restriction of Rendered UI Layers or Frames in notrinos/notrinoserpnotrinos/notrinoserp
- CVE-2022-37111BlueCMS 1.6 has SQL injection in line 132 of admin/article.php
- CVE-2022-37112BlueCMS 1.6 has SQL injection in line 55 of admin/model.php
- CVE-2022-37113Bluecms 1.6 has SQL injection in line 132 of admin/area.php
- CVE-2022-37223JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/role/list.com.jflyfox:jflyfox_jfinal
- CVE-2022-37199JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/user/list.com.jflyfox:jflyfox_jfinal
- CVE-2022-36261An arbitrary file deletion vulnerability was discovered in taocms 3.0.2, that allows attacker to delete file in server when request url admi
- CVE-2022-35203An access control issue in TrendNet TV-IP572PI v1.0 allows unauthenticated attackers to access sensitive system information.
- CVE-2021-42627The WAN configuration page "wan.htm" on D-Link DIR-615 devices with firmware 20.06 can be accessed directly without authentication which can
- CVE-2022-2956ConsoleTVs Noxen users.php cross site scriptingConsoleTVs Noxen
- CVE-2022-1989CODESYS Visualization vulnerable to user enumerationCODESYS Visualization
- CVE-2022-2796Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore
- CVE-2022-36350Stored cross-site scripting vulnerability in PukiWiki versions 1.3.1 to 1.5.3 allows a remote attacker to inject an arbitrary script via unsPukiWiki Development Team PukiWiki
- CVE-2022-34486Path traversal vulnerability in PukiWiki versions 1.4.5 to 1.5.3 allows a remote authenticated attacker with an administrative privilege to PukiWiki Development Team PukiWiki
- CVE-2022-27637Reflected cross-site scripting vulnerability in PukiWiki versions 1.5.1 to 1.5.3 allows a remote attacker to inject an arbitrary script via PukiWiki Development Team PukiWiki
- CVE-2022-35733Missing authentication for critical function vulnerability in UNIMO Technology digital video recorders (UDR-JA1004/JA1008/JA1016 firmware veUNIMO Technology Co. UNIMO Technology digital video recorde…
- CVE-2020-35992Fiserv Prologue through 2020-12-16 does not properly protect the database password.
- CVE-2022-34919The file upload wizard in Zengenti Contensis Classic before 15.2.1.79 does not correctly check that a user has authenticated.
- CVE-2019-25075HTML injection combined with path traversal in the Email service in Gravitee API Management before 1.25.3 allows anonymous users to read arbio.gravitee.apim:gravitee-api-management
- CVE-2021-42232TP-Link Archer A7 Archer A7(US)_V5_210519 is affected by a command injection vulnerability in /usr/bin/tddp.
- CVE-2022-33916OPC UA .NET Standard Reference Server 1.04.368 allows a remote attacker to cause the application to access sensitive information.OPCFoundation.NetStandard.Opc.Ua.Server
- CVE-2020-35511A global buffer overflow was discovered in pngcheck function in pngcheck-2.4.0(5 patches applied) via a crafted png file.pngcheck
- CVE-2021-20298A flaw was found in OpenEXR's B44Compressor.OpenEXR
- CVE-2021-20304A flaw was found in OpenEXR's hufDecode functionality.OpenEXR
- CVE-2021-20316A flaw was found in the way Samba handled file/directory metadata.samba
- CVE-2021-23177An improper link resolution flaw while extracting an archive can lead to changing the access control list (ACL) of the target of the link.libarchive
- CVE-2021-28861Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginnilibpython · python +1
- CVE-2021-31566An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of libarchive
- CVE-2021-3759A memory overflow vulnerability was found in the Linux kernel’s ipc functionality of the memcg subsystem, in the way a user calls the semgetkernel
- CVE-2021-3800A flaw was found in glib before version 2.63.6.Glib
- CVE-2021-3905A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing.openvswitch
- CVE-2021-3975A use-after-free flaw was found in libvirt.libvirt
- CVE-2021-3995A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem.util-linux
- CVE-2021-3996A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem.util-linux
- CVE-2021-3997A flaw was found in systemd.systemd
- CVE-2022-2938A flaw was found in the Linux kernel's implementation of Pressure Stall Information.kernel
- CVE-2022-31676VMware Tools (12.0.0, 11.x.y and 10.x.y) contains a local privilege escalation vulnerability.VMware Tools
- CVE-2022-35278HTML Injection in ActiveMQ Artemis Web ConsoleApache Software Foundation Apache ActiveMQ Artemis · org.ap…