CVEs published August 26, 2022
56 CVEs were published on August 26, 2022: 0 critical, 2 high. 1 is now in CISA KEV.
- Published
- 56
- Critical
- 0
- High
- 2
- Medium
- 1
- Low
- 0
- Unrated
- 53
- Now in CISA KEV
- 1
- Fix available
- 8
Most affected products
- kernel
- 4
- keycloak · org.keycloak:keycloak-core
- 3
- QEMU
- 2
- Deluge-web · deluge
- 1
- foreman
- 1
- IBM DataPower Gateway
- 1
- IBM Maximo Asset Management
- 1
- ImageMagick
- 1
- keycloak · org.keycloak:keycloak-services
- 1
- keystone
- 1
High 2
- CVE-2022-31773IBM DataPower Gateway V10CD, 10.0.1, and 2018.4.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicIBM DataPower Gateway
- CVE-2022-36537ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent org.zkoss.zk:zk
Medium, low and unrated 54
- CVE-2022-36548Edoc-doctor-appointment-system v1.0.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability at /patient/settings.php.
- CVE-2022-36546Edoc-doctor-appointment-system v1.0.1 was discovered to contain a Cross-Site Request Forgery (CSRF) via /patient/settings.php.
- CVE-2022-36547Edoc-doctor-appointment-system v1.0.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability at /patient/index.php.
- CVE-2022-36545Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/settings.php.
- CVE-2022-36543Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/doctors.php.
- CVE-2022-36544Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/booking.php.
- CVE-2022-36542An access control issue in the component /ip/admin/ of Edoc-doctor-appointment-system v1.0.1 allows attackers to arbitrarily edit, read, and
- CVE-2022-2915A Heap-based Buffer Overflow vulnerability in the SonicWall SMA100 appliance allows a remote authenticated attacker to cause Denial of ServiSonicWall SMA100
- CVE-2022-36529Kensite CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities via the name and oldname parameters at /framework/mod/db/D
- CVE-2022-36522Mikrotik RouterOs through stable v6.48.3 was discovered to contain an assertion failure in the component /advanced-tools/nova/bin/netwatch.
- CVE-2022-0207A race condition was found in vdsm.vdsm
- CVE-2022-0217It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsprosody
- CVE-2022-0084A flaw was found in XNIO, specifically in the notifyReadClosed method.xnio · org.jboss.xnio:xnio-all
- CVE-2022-0168A denial of service (DOS) issue was found in the Linux kernel’s smb2_ioctl_query_info function in the fs/cifs/smb2ops.c Common Internet Filekernel
- CVE-2022-0225A flaw was found in Keycloak.keycloak · org.keycloak:keycloak-core
- CVE-2022-35714IBM Maximo Asset Management 7.6.1 is vulnerable to cross-site scripting.IBM Maximo Asset Management
- CVE-2021-4216A Floating point exception (division-by-zero) flaw was found in Mupdf for zero width pages in muraster.c.mupdf
- CVE-2022-25625A malicious unauthorized PAM user can access the administration configuration data and change the values.Symantec Privileged Access Management
- CVE-2021-3414A flaw was found in satellite.satellite
- CVE-2021-3563A flaw was found in openstack-keystone.keystone
- CVE-2021-3585A flaw was found in openstack-tripleo-heat-templates.openstack/tripleo-heat-templates.
- CVE-2021-3632A flaw was found in Keycloak.keycloak · org.keycloak:keycloak-core
- CVE-2021-3644A flaw was found in wildfly-core in all versions.wildfly-core · org.wildfly.core:wildfly-server
- CVE-2021-3669A flaw was found in the Linux kernel.kernel
- CVE-2021-3688A flaw was found in Red Hat JBoss Core Services HTTP Server in all versions, where it does not properly normalize the path component of a reRed Hat JBCS HTTP Server
- CVE-2021-3703It was found that the CVE-2021-27918, CVE-2021-31525 and CVE-2021-33196 have been incorrectly mentioned as fixed in RHSA for Serverless 1.16Serverless
- CVE-2021-3735A deadlock issue was found in the AHCI controller device of QEMU.QEMU
- CVE-2021-3754A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user.keycloak · org.keycloak:keycloak-services
- CVE-2021-20260A flaw was found in the Foreman project.foreman
- CVE-2021-3856ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader.keycloak · org.keycloak:keycloak-core
- CVE-2021-3864A flaw was found in the way the dumpable flag setting was handled when certain SUID binaries executed its descendants.kernel
- CVE-2022-36521Insecure permissions in cskefu v7.0.1 allows unauthenticated attackers to arbitrarily add administrator accounts.
- CVE-2022-36681Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=del
- CVE-2021-39394mm-wiki v0.2.1 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add user accounts and mod
- CVE-2022-36683Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=del
- CVE-2022-36682Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=del
- CVE-2022-36680Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=del
- CVE-2022-36679Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=user/manage_
- CVE-2021-40285htmly v2.8.1 was discovered to contain an arbitrary file deletion vulnerability via the component \views\backup.html.php.
- CVE-2022-36678Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=del
- CVE-2021-39393mm-wiki v0.2.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the markdown editor.
- CVE-2022-37151There is an unauthorized access vulnerability in Online Diagnostic Lab Management System 1.0.
- CVE-2022-37152An issue was discovered in Online Diagnostic Lab Management System 1.0, There is a SQL injection vulnerability via "dob" parameter in "/clas
- CVE-2022-37150An issue was discovered in Online Diagnostic Lab Management System 1.0.
- CVE-2021-3427The Deluge Web-UI is vulnerable to XSS through a crafted torrent file.Deluge-web · deluge
- CVE-2021-3574A vulnerability was found in ImageMagick-7.0.11-5, where executing a crafted file with the convert command, ASAN detects memory leaks.ImageMagick
- CVE-2021-35939It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of theRPM
- CVE-2021-3859A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2.undertow · io.undertow:undertow-core
- CVE-2022-0171A flaw was found in the Linux kernel.kernel
- CVE-2022-0175A flaw was found in the VirGL virtual OpenGL renderer (virglrenderer).virglrenderer
- CVE-2022-0216A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU.QEMU
- CVE-2022-34301A flaw was found in CryptoPro Secure Disk bootloaders before 2022-06-01.
- CVE-2022-34302A flaw was found in New Horizon Datasys bootloaders before 2022-06-01.
- CVE-2022-34303A flaw was found in Eurosoft bootloaders before 2022-06-01.