# CVEs published 2022-08-24

64 CVEs were published on August 24, 2022: 2 critical, 14 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2022-32857](https://cve.now/CVE-2022-32857.md): This issue was addressed by using HTTPS when sending information over the network. (CVSS 4.3, Apple macOS · Apple tvOS +1)
- [CVE-2022-32838](https://cve.now/CVE-2022-32838.md): A logic issue was addressed with improved state management. (CVSS 5.5, Apple macOS)
- [CVE-2022-32840](https://cve.now/CVE-2022-32840.md): This issue was addressed with improved checks. (CVSS 7.8, Apple macOS · Apple watchOS)
- [CVE-2022-32813](https://cve.now/CVE-2022-32813.md): The issue was addressed with improved memory handling. (CVSS 7.8, Apple macOS · Apple tvOS +1)
- [CVE-2022-32837](https://cve.now/CVE-2022-32837.md): This issue was addressed with improved checks. (CVSS 7.8, Apple macOS · Apple tvOS)
- [CVE-2022-32834](https://cve.now/CVE-2022-32834.md): An access issue was addressed with improvements to the sandbox. (CVSS 5.5, Apple macOS)
- [CVE-2022-32811](https://cve.now/CVE-2022-32811.md): A memory corruption vulnerability was addressed with improved locking. (CVSS 7.8, Apple macOS)
- [CVE-2022-32839](https://cve.now/CVE-2022-32839.md): The issue was addressed with improved bounds checks. (CVSS 9.8, Apple macOS · Apple tvOS +1)
- [CVE-2022-32812](https://cve.now/CVE-2022-32812.md): The issue was addressed with improved memory handling. (CVSS 7.8, Apple macOS)
- [CVE-2022-32810](https://cve.now/CVE-2022-32810.md): The issue was addressed with improved memory handling. (CVSS 7.8, Apple macOS · Apple watchOS)
- [CVE-2018-14519](https://cve.now/CVE-2018-14519.md): An issue was discovered in Kirby 2.5.12. (no CVSS, getkirby/cms)
- [CVE-2018-14520](https://cve.now/CVE-2018-14520.md): An issue was discovered in Kirby 2.5.12. (CVSS 5.4, getkirby/cms)
- [CVE-2022-37178](https://cve.now/CVE-2022-37178.md): An issue was discovered in 72crm 9.0. (no CVSS)
- [CVE-2022-37181](https://cve.now/CVE-2022-37181.md): 72crm 9.0 has an Arbitrary file upload vulnerability. (no CVSS)
- [CVE-2021-43309](https://cve.now/CVE-2021-43309.md): ReDoS in uri-template-lite URI.expand function (CVSS 5.9, uri-template-lite)
- [CVE-2022-2569](https://cve.now/CVE-2022-2569.md): ARC Informatique PcVue (CVSS 5.5, ARC Informatique PcVue 12 OAuth web service configuration ·…)
- [CVE-2022-2234](https://cve.now/CVE-2022-2234.md): mySCADA myPRO Command Injection (CVSS 9.9, mySCADA Technologies mySCADA myPRO)
- [CVE-2022-34838](https://cve.now/CVE-2022-34838.md): ABB Ability TM Operations Data Management Zenon Zenon Log Server file access control (CVSS 8.1, ABB Zenon)
- [CVE-2022-34836](https://cve.now/CVE-2022-34836.md): ABB Ability TM Operations Data Management Zenon Zenon Log Server file access control (CVSS 5.9, ABB Zenon)
- [CVE-2022-34837](https://cve.now/CVE-2022-34837.md): ABB Ability TM Operations Data Management Zenon Zenon Log Server file access control (CVSS 6.2, ABB Zenon)
- [CVE-2021-4040](https://cve.now/CVE-2021-4040.md): A flaw was found in AMQ Broker. (no CVSS, AMQ Broker · org.apache.activemq:artemis-core-client)
- [CVE-2021-4041](https://cve.now/CVE-2021-4041.md): A flaw was found in ansible-runner. (no CVSS, ansible-runner)
- [CVE-2021-4159](https://cve.now/CVE-2021-4159.md): A vulnerability was found in the Linux kernel's EBPF verifier when handling internal data structures. (no CVSS, kernel)
- [CVE-2021-4158](https://cve.now/CVE-2021-4158.md): A NULL pointer dereference issue was found in the ACPI code of QEMU. (no CVSS, QEMU)
- [CVE-2021-4155](https://cve.now/CVE-2021-4155.md): A data leak flaw was found in the way XFS\_IOC\_ALLOCSP IOCTL in the XFS filesystem allowed for size increase of files with unaligned size. (no CVSS, kernel)
- [CVE-2021-4142](https://cve.now/CVE-2021-4142.md): The Candlepin component of Red Hat Satellite was affected by an improper authentication flaw. (no CVSS, candlepin)
- [CVE-2021-4125](https://cve.now/CVE-2021-4125.md): It was found that the original fix for log4j CVE-2021-44228 and CVE-2021-45046 in the OpenShift metering hive containers was incomplete, as (no CVSS, kube-reporting/hive)
- [CVE-2021-4122](https://cve.now/CVE-2021-4122.md): It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. (no CVSS, cryptsetup)
- [CVE-2021-4217](https://cve.now/CVE-2021-4217.md): A flaw was found in unzip. (no CVSS, unzip)
- [CVE-2021-4218](https://cve.now/CVE-2021-4218.md): A flaw was found in the Linux kernel’s implementation of reading the SVC RDMA counters. (no CVSS, kernel)
- [CVE-2021-4213](https://cve.now/CVE-2021-4213.md): A flaw was found in JSS, where it did not properly free up all memory. (no CVSS, JSS)
- [CVE-2021-4209](https://cve.now/CVE-2021-4209.md): A NULL pointer dereference flaw was found in GnuTLS. (no CVSS, GnuTLS)
- [CVE-2021-4178](https://cve.now/CVE-2021-4178.md): A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. (no CVSS, kubernetes-client · io.fabric8:kubernetes-client)
- [CVE-2022-20122](https://cve.now/CVE-2022-20122.md): The PowerVR GPU driver allows unprivileged apps to allocated pinned memory, unpin it (which makes it available to be freed), and continue us (no CVSS, Android)
- [CVE-2021-39815](https://cve.now/CVE-2021-39815.md): The PowerVR GPU driver allows unprivileged apps to allocated pinned memory, unpin it (which makes it available to be freed), and continue us (no CVSS, Android)
- [CVE-2021-0947](https://cve.now/CVE-2021-0947.md): The method PVRSRVBridgeTLDiscoverStreams allocates puiStreamsInt on the heap, fills the contents of the buffer via TLServerDiscoverStreamsKM (no CVSS, Android)
- [CVE-2021-0946](https://cve.now/CVE-2021-0946.md): The method PVRSRVBridgePMRPDumpSymbolicAddr allocates puiMemspaceNameInt on the heap, fills the contents of the buffer via PMR\_PDumpSymbolic (no CVSS, Android)
- [CVE-2021-0891](https://cve.now/CVE-2021-0891.md): An unprivileged app can trigger PowerVR driver to return an uninitialized heap memory causing information disclosure.Product: AndroidVersion (no CVSS, Android)
- [CVE-2021-0887](https://cve.now/CVE-2021-0887.md): In PVRSRVBridgeHeapCfgHeapConfigName, there is a possible leak of kernel heap content due to uninitialized data. (no CVSS, Android)
- [CVE-2021-0698](https://cve.now/CVE-2021-0698.md): In PVRSRVBridgeHeapCfgHeapDetails, there is a possible leak of kernel heap content due to uninitialized data. (no CVSS, Android)
- [CVE-2022-36633](https://cve.now/CVE-2022-36633.md): Teleport 9.3.6 is vulnerable to Command injection leading to Remote Code Execution. (no CVSS, github.com/gravitational/teleport)
- [CVE-2022-37153](https://cve.now/CVE-2022-37153.md): An issue was discovered in Artica Proxy 4.30.000000. (no CVSS)
- [CVE-2022-33172](https://cve.now/CVE-2022-33172.md): de.fac2 1.34 allows bypassing the User Presence protection mechanism when there is malware on the victim's PC. (no CVSS)
- [CVE-2022-38089](https://cve.now/CVE-2022-38089.md): Stored cross-site scripting vulnerability in Exment ((PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-admin v3.0.0 and earli (no CVSS, Kajitori Co. Exment)
- [CVE-2022-38080](https://cve.now/CVE-2022-38080.md): Reflected cross-site scripting vulnerability in Exment ((PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-admin v3.0.0 and ea (no CVSS, Kajitori Co. Exment · exceedone/exment +1)
- [CVE-2022-38078](https://cve.now/CVE-2022-38078.md): Movable Type XMLRPC API provided by Six Apart Ltd. (no CVSS, Six Apart Movable Type XMLRPC API)
- [CVE-2022-37333](https://cve.now/CVE-2022-37333.md): SQL injection vulnerability in the Exment ((PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-admin v3.0.0 and earlier, (PHP7) (no CVSS, Kajitori Co. Exment · exceedone/exment +1)
- [CVE-2022-37418](https://cve.now/CVE-2022-37418.md): The Remote Keyless Entry (RKE) receiving unit on certain Nissan, Kia, and Hyundai vehicles through 2017 allows remote attackers to perform u (no CVSS)
- [CVE-2022-37305](https://cve.now/CVE-2022-37305.md): The Remote Keyless Entry (RKE) receiving unit on certain Honda vehicles through 2018 allows remote attackers to perform unlock operations an (no CVSS)
- [CVE-2022-24375](https://cve.now/CVE-2022-24375.md): Denial of Service (DoS) (CVSS 7.5, node-opcua)
- [CVE-2022-36945](https://cve.now/CVE-2022-36945.md): The Remote Keyless Entry (RKE) receiving unit on certain Mazda vehicles through 2020 allows remote attackers to perform unlock operations an (no CVSS)
- [CVE-2022-25903](https://cve.now/CVE-2022-25903.md): Denial of Service (DoS) (CVSS 7.5, opcua)
- [CVE-2021-3998](https://cve.now/CVE-2021-3998.md): A flaw was found in glibc. (CVSS 7.5, glibc)
- [CVE-2021-3999](https://cve.now/CVE-2021-3999.md): A flaw was found in glibc. (CVSS 7.8, glibc)
- [CVE-2021-4028](https://cve.now/CVE-2021-4028.md): A flaw in the Linux kernel's implementation of RDMA communications manager listener code allowed an attacker with local access to setup a so (no CVSS, kernel)
- [CVE-2021-4037](https://cve.now/CVE-2021-4037.md): Kernel: security regression for cve-2018-13405 (CVSS 4.4, Linux kernel · Red Hat Enterprise Linux)
- [CVE-2021-4189](https://cve.now/CVE-2021-4189.md): A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. (CVSS 5.3, python · libpython +1)
- [CVE-2021-4204](https://cve.now/CVE-2021-4204.md): An out-of-bounds (OOB) memory access flaw was found in the Linux kernel's eBPF due to an Improper Input Validation. (no CVSS, kernel)
- [CVE-2021-4214](https://cve.now/CVE-2021-4214.md): A heap overflow flaw was found in libpngs' pngimage.c program. (no CVSS, libpng)
- [CVE-2022-27812](https://cve.now/CVE-2022-27812.md): Flooding SNS firewall versions 3.7.0 to 3.7.29, 3.11.0 to 3.11.17, 4.2.0 to 4.2.10, and 4.3.0 to 4.3.6 with specific forged traffic, can lea (no CVSS)
- [CVE-2022-2978](https://cve.now/CVE-2022-2978.md): A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function security\_inode\_alloc to fail with fo (no CVSS, Kernel)
- [CVE-2022-32793](https://cve.now/CVE-2022-32793.md): Multiple out-of-bounds write issues were addressed with improved bounds checking. (CVSS 7.5, Apple macOS · Apple tvOS +1)
- [CVE-2022-32893](https://cve.now/CVE-2022-32893.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 8.8, KEV, Apple Safari · Apple iOS and iPadOS +1)
- [CVE-2022-32894](https://cve.now/CVE-2022-32894.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 7.8, KEV, Apple iOS and iPadOS · Apple macOS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-08-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.