# CVEs published 2022-08-23

90 CVEs were published on August 23, 2022: 0 critical, 17 high. Days are UTC.

- [CVE-2022-38132](https://cve.now/CVE-2022-38132.md): Command injection vulnerability in Linksys MR8300 router while Registration to DDNS Service. By specifying username and password, an attacker connected to the router's web interface can execute arbitrary OS commands. (CVSS 8.2, Linksys MR8300 Router)
- [CVE-2021-3917](https://cve.now/CVE-2021-3917.md): A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. (no CVSS, coreos-installer)
- [CVE-2022-38463](https://cve.now/CVE-2022-38463.md): ServiceNow through San Diego Patch 4b and Patch 6 allows reflected XSS in the logout functionality. (no CVSS)
- [CVE-2022-38172](https://cve.now/CVE-2022-38172.md): ServiceNow through San Diego Patch 3 allows XSS via the name field during creation of a new dashboard for the Performance Analytics dashboar (no CVSS)
- [CVE-2022-35115](https://cve.now/CVE-2022-35115.md): IceWarp WebClient DC2 - Update 2 Build 9 (13.0.2.9) was discovered to contain a SQL injection vulnerability via the search parameter at /web (no CVSS)
- [CVE-2022-1513](https://cve.now/CVE-2022-1513.md): A potential vulnerability was reported in Lenovo PCManager prior to version 5.0.10.4191 that may allow code execution when visiting a specia (CVSS 7.3, Lenovo PCManager)
- [CVE-2022-38665](https://cve.now/CVE-2022-38665.md): Jenkins CollabNet Plugins Plugin 2.0.8 and earlier stores a RabbitMQ password unencrypted in its global configuration file on the Jenkins co (no CVSS, Jenkins project Jenkins CollabNet Plugins Plugin · org.jenk…)
- [CVE-2022-38664](https://cve.now/CVE-2022-38664.md): Jenkins Job Configuration History Plugin 1165.v8cc9fd1f4597 and earlier does not escape the job name on the System Configuration History pag (no CVSS, Jenkins project Jenkins Job Configuration History Plugin ·…)
- [CVE-2022-38663](https://cve.now/CVE-2022-38663.md): Jenkins Git Plugin 4.11.4 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log provided by the Git (no CVSS, Jenkins project Jenkins Git Plugin · org.jenkins-ci.plugins…)
- [CVE-2022-37428](https://cve.now/CVE-2022-37428.md): PowerDNS Recursor up to and including 4.5.9, 4.6.2 and 4.7.1, when protobuf logging is enabled, has Improper Cleanup upon a Thrown Exception (CVSS 6.5)
- [CVE-2022-28883](https://cve.now/CVE-2022-28883.md): Denial-of-Service (DoS) Vulnerability (CVSS 3.5, All F-Secure and WithSecure Endpoint Protection products fo…)
- [CVE-2022-28882](https://cve.now/CVE-2022-28882.md): Denial-of-Service (DoS) Vulnerability (CVSS 4.3, All F-Secure and WithSecure Endpoint Protection products fo…)
- [CVE-2020-35509](https://cve.now/CVE-2020-35509.md): A flaw was found in keycloak affecting versions 11.0.3 and 12.0.0. (CVSS 5.4, keycloak · org.keycloak:keycloak-core)
- [CVE-2021-3827](https://cve.now/CVE-2021-3827.md): A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed. (no CVSS, keycloak · org.keycloak:keycloak-saml-core)
- [CVE-2021-3839](https://cve.now/CVE-2021-3839.md): A flaw was found in the vhost library in DPDK. (no CVSS, dpdk)
- [CVE-2021-3764](https://cve.now/CVE-2021-3764.md): A memory leak flaw was found in the Linux kernel's ccp\_run\_aes\_gcm\_cmd() function that allows an attacker to cause a denial of service. (no CVSS, Linux Kernel)
- [CVE-2021-3763](https://cve.now/CVE-2021-3763.md): A flaw was found in the Red Hat AMQ Broker management console in version 7.8 where an existing user is able to access some limited informati (no CVSS, AMQ Broker)
- [CVE-2021-3736](https://cve.now/CVE-2021-3736.md): A flaw was found in the Linux kernel. (no CVSS, kernel)
- [CVE-2021-3714](https://cve.now/CVE-2021-3714.md): A flaw was found in the Linux kernels memory deduplication mechanism. (no CVSS, kernel)
- [CVE-2021-3702](https://cve.now/CVE-2021-3702.md): A race condition flaw was found in ansible-runner, where an attacker could watch for rapid creation and deletion of a temporary directory, s (no CVSS, ansible-runner)
- [CVE-2021-3701](https://cve.now/CVE-2021-3701.md): A flaw was found in ansible-runner where the default temporary files configuration in ansible-2.0.0 are written to world R/W locations. (no CVSS, ansible-runner)
- [CVE-2021-3690](https://cve.now/CVE-2021-3690.md): A flaw was found in Undertow. (no CVSS, undertow · io.undertow:undertow-core)
- [CVE-2021-3670](https://cve.now/CVE-2021-3670.md): MaxQueryDuration not honoured in Samba AD DC LDAP (no CVSS, samba)
- [CVE-2021-3798](https://cve.now/CVE-2021-3798.md): A flaw was found in openCryptoki. (no CVSS, opencryptoki)
- [CVE-2022-36389](https://cve.now/CVE-2022-36389.md): WordPress Better Messages plugin \<= 1.9.9.148 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 4.3, WordPlus Better Messages)
- [CVE-2022-36405](https://cve.now/CVE-2022-36405.md): WordPress amCharts: Charts and Maps plugin \<= 1.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 5.4, amCharts: Charts and Maps)
- [CVE-2022-36347](https://cve.now/CVE-2022-36347.md): WordPress Alpine PhotoTile for Pinterest plugin \<= 1.3.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, Alpine Press Alpine PhotoTile for Pinterest)
- [CVE-2022-36292](https://cve.now/CVE-2022-36292.md): WordPress Gallery PhotoBlocks plugin \<= 1.2.6 - Cross-Site Request Forgery (CSRF) vulnerabilities (CVSS 5.4, WPChill Gallery PhotoBlocks)
- [CVE-2022-36285](https://cve.now/CVE-2022-36285.md): WordPress Uploading SVG, WEBP and ICO files plugin \<= 1.0.1 - Authenticated Arbitrary File Upload vulnerability (CVSS 7.2, dmitrylitvinov Uploading SVG, WEBP and ICO files)
- [CVE-2022-35726](https://cve.now/CVE-2022-35726.md): WordPress Video Gallery plugin \<= 1.3.4.5 - Broken Authentication vulnerability (CVSS 4.3, yotuwp Video Gallery)
- [CVE-2022-36379](https://cve.now/CVE-2022-36379.md): WordPress ЮKassa для WooCommerce plugin \<= 2.3.0 - Cross-Site Request Forgery (CSRF) leading to plugin settings update (CVSS 8.8, YooMoney ЮKassa для WooCommerce)
- [CVE-2022-36394](https://cve.now/CVE-2022-36394.md): WordPress Contest Gallery plugin \<= 17.0.4 - Authenticated SQL Injection (SQLi) vulnerability (CVSS 7.6, Contest Gallery)
- [CVE-2022-36341](https://cve.now/CVE-2022-36341.md): WordPress AS – Create Pinterest Pinboard Pages plugin \<= 1.0 - Authenticated plugin settings change leading to Stored Cross-Site Scripting (XSS) vulnerability (CVSS 5.4, Akash soni AS – Create Pinterest Pinboard Pages)
- [CVE-2022-36288](https://cve.now/CVE-2022-36288.md): WordPress Download Manager plugin \<= 3.2.48 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities (CVSS 5.4, W3 Eden Download Manager)
- [CVE-2022-35235](https://cve.now/CVE-2022-35235.md): WordPress WPide plugin \<= 2.6 - Authenticated Arbitrary File Read vulnerability (CVSS 4.9, XplodedThemes WPIDE – File Manager & Code Editor)
- [CVE-2022-36282](https://cve.now/CVE-2022-36282.md): WordPress Search Exclude plugin \<= 1.2.6 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, Roman Pronskiy Search Exclude)
- [CVE-2022-34658](https://cve.now/CVE-2022-34658.md): WordPress Download Manager plugin \<= 3.2.48 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities (CVSS 5.4, W3 Eden Download Manager)
- [CVE-2022-33142](https://cve.now/CVE-2022-33142.md): WordPress Better Messages plugin \<= 1.9.10.57 - Denial Of Service (DoS) vulnerability (CVSS 7.7, WordPlus Better Messages)
- [CVE-2022-34868](https://cve.now/CVE-2022-34868.md): WordPress ЮKassa для WooCommerce plugin \<= 2.3.0 - Authenticated Arbitrary Settings Update vulnerability (CVSS 8.8, YooMoney ЮKassa для WooCommerce)
- [CVE-2022-35242](https://cve.now/CVE-2022-35242.md): WordPress THE Leads Management System: 59sec LITE plugin \<= 3.4.1 - Unauthenticated plugin settings change vulnerability (CVSS 6.5, THE Leads Management System: 59sec LITE)
- [CVE-2022-29476](https://cve.now/CVE-2022-29476.md): WordPress Notification Bar for WordPress plugin \<= 1.1.8 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 6.1, 8 Degree Themes Notification Bar for WordPress)
- [CVE-2022-34648](https://cve.now/CVE-2022-34648.md): WordPress Uploading SVG, WEBP and ICO files plugin \<= 1.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, dmitrylitvinov Uploading SVG, WEBP and ICO files)
- [CVE-2022-2965](https://cve.now/CVE-2022-2965.md): Improper Restriction of Rendered UI Layers or Frames in notrinos/notrinoserp (CVSS 6.4, notrinos/notrinoserp)
- [CVE-2022-37111](https://cve.now/CVE-2022-37111.md): BlueCMS 1.6 has SQL injection in line 132 of admin/article.php (no CVSS)
- [CVE-2022-37112](https://cve.now/CVE-2022-37112.md): BlueCMS 1.6 has SQL injection in line 55 of admin/model.php (no CVSS)
- [CVE-2022-37113](https://cve.now/CVE-2022-37113.md): Bluecms 1.6 has SQL injection in line 132 of admin/area.php (no CVSS)
- [CVE-2022-37223](https://cve.now/CVE-2022-37223.md): JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal\_cms/system/role/list. (no CVSS, com.jflyfox:jflyfox\_jfinal)
- [CVE-2022-37199](https://cve.now/CVE-2022-37199.md): JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal\_cms/system/user/list. (no CVSS, com.jflyfox:jflyfox\_jfinal)
- [CVE-2022-36261](https://cve.now/CVE-2022-36261.md): An arbitrary file deletion vulnerability was discovered in taocms 3.0.2, that allows attacker to delete file in server when request url admi (no CVSS)
- [CVE-2022-35203](https://cve.now/CVE-2022-35203.md): An access control issue in TrendNet TV-IP572PI v1.0 allows unauthenticated attackers to access sensitive system information. (no CVSS)
- [CVE-2021-42627](https://cve.now/CVE-2021-42627.md): The WAN configuration page "wan.htm" on D-Link DIR-615 devices with firmware 20.06 can be accessed directly without authentication which can (no CVSS)
- [CVE-2022-2956](https://cve.now/CVE-2022-2956.md): ConsoleTVs Noxen users.php cross site scripting (CVSS 3.5, ConsoleTVs Noxen)
- [CVE-2022-1989](https://cve.now/CVE-2022-1989.md): CODESYS Visualization vulnerable to user enumeration (CVSS 5.3, CODESYS Visualization)
- [CVE-2022-2796](https://cve.now/CVE-2022-2796.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 6.7, pimcore/pimcore)
- [CVE-2022-36350](https://cve.now/CVE-2022-36350.md): Stored cross-site scripting vulnerability in PukiWiki versions 1.3.1 to 1.5.3 allows a remote attacker to inject an arbitrary script via uns (CVSS 6.1, PukiWiki Development Team PukiWiki)
- [CVE-2022-34486](https://cve.now/CVE-2022-34486.md): Path traversal vulnerability in PukiWiki versions 1.4.5 to 1.5.3 allows a remote authenticated attacker with an administrative privilege to (no CVSS, PukiWiki Development Team PukiWiki)
- [CVE-2022-27637](https://cve.now/CVE-2022-27637.md): Reflected cross-site scripting vulnerability in PukiWiki versions 1.5.1 to 1.5.3 allows a remote attacker to inject an arbitrary script via (no CVSS, PukiWiki Development Team PukiWiki)
- [CVE-2022-24381](https://cve.now/CVE-2022-24381.md): Denial of Service (DoS) (CVSS 7.5, ASNeG/OpcUaStack)
- [CVE-2022-25888](https://cve.now/CVE-2022-25888.md): Denial of Service (DoS) (CVSS 7.5, opcua)
- [CVE-2022-25761](https://cve.now/CVE-2022-25761.md): Denial of Service (DoS) (CVSS 7.5, open62541/open62541)
- [CVE-2022-24298](https://cve.now/CVE-2022-24298.md): Denial of Service (DoS) (CVSS 7.5, FreeOpcUa/freeopcua)
- [CVE-2022-21208](https://cve.now/CVE-2022-21208.md): Denial of Service (DoS) (CVSS 7.5, node-opcua)
- [CVE-2022-25231](https://cve.now/CVE-2022-25231.md): Denial of Service (DoS) (CVSS 7.5, node-opcua)
- [CVE-2022-25304](https://cve.now/CVE-2022-25304.md): Denial of Service (DoS) (CVSS 7.5, opcua · asyncua)
- [CVE-2022-25302](https://cve.now/CVE-2022-25302.md): Denial of Service (DoS) (CVSS 7.5, ASNeG/OpcUaStack)
- [CVE-2022-2829](https://cve.now/CVE-2022-2829.md): Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm (CVSS 8.8, yetiforcecompany/yetiforcecrm)
- [CVE-2022-35733](https://cve.now/CVE-2022-35733.md): Missing authentication for critical function vulnerability in UNIMO Technology digital video recorders (UDR-JA1004/JA1008/JA1016 firmware ve (no CVSS, UNIMO Technology Co. UNIMO Technology digital video recorde…)
- [CVE-2020-35992](https://cve.now/CVE-2020-35992.md): Fiserv Prologue through 2020-12-16 does not properly protect the database password. (no CVSS)
- [CVE-2022-34919](https://cve.now/CVE-2022-34919.md): The file upload wizard in Zengenti Contensis Classic before 15.2.1.79 does not correctly check that a user has authenticated. (no CVSS)
- [CVE-2019-25075](https://cve.now/CVE-2019-25075.md): HTML injection combined with path traversal in the Email service in Gravitee API Management before 1.25.3 allows anonymous users to read arb (no CVSS, io.gravitee.apim:gravitee-api-management)
- [CVE-2021-42232](https://cve.now/CVE-2021-42232.md): TP-Link Archer A7 Archer A7(US)\_V5\_210519 is affected by a command injection vulnerability in /usr/bin/tddp. (no CVSS)
- [CVE-2022-33916](https://cve.now/CVE-2022-33916.md): OPC UA .NET Standard Reference Server 1.04.368 allows a remote attacker to cause the application to access sensitive information. (no CVSS, OPCFoundation.NetStandard.Opc.Ua.Server)
- [CVE-2020-35511](https://cve.now/CVE-2020-35511.md): A global buffer overflow was discovered in pngcheck function in pngcheck-2.4.0(5 patches applied) via a crafted png file. (no CVSS, pngcheck)
- [CVE-2021-20298](https://cve.now/CVE-2021-20298.md): A flaw was found in OpenEXR's B44Compressor. (no CVSS, OpenEXR)
- [CVE-2021-20304](https://cve.now/CVE-2021-20304.md): A flaw was found in OpenEXR's hufDecode functionality. (no CVSS, OpenEXR)
- [CVE-2021-20316](https://cve.now/CVE-2021-20316.md): A flaw was found in the way Samba handled file/directory metadata. (no CVSS, samba)
- [CVE-2021-23177](https://cve.now/CVE-2021-23177.md): An improper link resolution flaw while extracting an archive can lead to changing the access control list (ACL) of the target of the link. (no CVSS, libarchive)
- [CVE-2021-28861](https://cve.now/CVE-2021-28861.md): Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginni (CVSS 6.5, libpython · python +1)
- [CVE-2021-31566](https://cve.now/CVE-2021-31566.md): An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of (no CVSS, libarchive)
- [CVE-2021-3759](https://cve.now/CVE-2021-3759.md): A memory overflow vulnerability was found in the Linux kernel’s ipc functionality of the memcg subsystem, in the way a user calls the semget (no CVSS, kernel)
- [CVE-2021-3800](https://cve.now/CVE-2021-3800.md): A flaw was found in glib before version 2.63.6. (no CVSS, Glib)
- [CVE-2021-3905](https://cve.now/CVE-2021-3905.md): A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. (no CVSS, openvswitch)
- [CVE-2021-3975](https://cve.now/CVE-2021-3975.md): A use-after-free flaw was found in libvirt. (no CVSS, libvirt)
- [CVE-2021-3995](https://cve.now/CVE-2021-3995.md): A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. (no CVSS, util-linux)
- [CVE-2021-3996](https://cve.now/CVE-2021-3996.md): A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. (CVSS 5.5, util-linux)
- [CVE-2021-3997](https://cve.now/CVE-2021-3997.md): A flaw was found in systemd. (no CVSS, systemd)
- [CVE-2022-2938](https://cve.now/CVE-2022-2938.md): A flaw was found in the Linux kernel's implementation of Pressure Stall Information. (no CVSS, kernel)
- [CVE-2022-2946](https://cve.now/CVE-2022-2946.md): Use After Free in vim/vim (CVSS 7.8, vim/vim)
- [CVE-2022-31676](https://cve.now/CVE-2022-31676.md): VMware Tools (12.0.0, 11.x.y and 10.x.y) contains a local privilege escalation vulnerability. (no CVSS, VMware Tools)
- [CVE-2022-35278](https://cve.now/CVE-2022-35278.md): HTML Injection in ActiveMQ Artemis Web Console (no CVSS, Apache Software Foundation Apache ActiveMQ Artemis · org.ap…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-08-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.