# CVEs published 2022-08-26

56 CVEs were published on August 26, 2022: 0 critical, 2 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2022-36548](https://cve.now/CVE-2022-36548.md): Edoc-doctor-appointment-system v1.0.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability at /patient/settings.php. (no CVSS)
- [CVE-2022-36546](https://cve.now/CVE-2022-36546.md): Edoc-doctor-appointment-system v1.0.1 was discovered to contain a Cross-Site Request Forgery (CSRF) via /patient/settings.php. (no CVSS)
- [CVE-2022-36547](https://cve.now/CVE-2022-36547.md): Edoc-doctor-appointment-system v1.0.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability at /patient/index.php. (no CVSS)
- [CVE-2022-36545](https://cve.now/CVE-2022-36545.md): Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/settings.php. (no CVSS)
- [CVE-2022-36543](https://cve.now/CVE-2022-36543.md): Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/doctors.php. (no CVSS)
- [CVE-2022-36544](https://cve.now/CVE-2022-36544.md): Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/booking.php. (no CVSS)
- [CVE-2022-36542](https://cve.now/CVE-2022-36542.md): An access control issue in the component /ip/admin/ of Edoc-doctor-appointment-system v1.0.1 allows attackers to arbitrarily edit, read, and (no CVSS)
- [CVE-2022-2915](https://cve.now/CVE-2022-2915.md): A Heap-based Buffer Overflow vulnerability in the SonicWall SMA100 appliance allows a remote authenticated attacker to cause Denial of Servi (no CVSS, SonicWall SMA100)
- [CVE-2022-36529](https://cve.now/CVE-2022-36529.md): Kensite CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities via the name and oldname parameters at /framework/mod/db/D (no CVSS)
- [CVE-2022-36522](https://cve.now/CVE-2022-36522.md): Mikrotik RouterOs through stable v6.48.3 was discovered to contain an assertion failure in the component /advanced-tools/nova/bin/netwatch. (no CVSS)
- [CVE-2022-0207](https://cve.now/CVE-2022-0207.md): A race condition was found in vdsm. (no CVSS, vdsm)
- [CVE-2022-0217](https://cve.now/CVE-2022-0217.md): It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in pars (no CVSS, prosody)
- [CVE-2022-0084](https://cve.now/CVE-2022-0084.md): A flaw was found in XNIO, specifically in the notifyReadClosed method. (no CVSS, xnio · org.jboss.xnio:xnio-all)
- [CVE-2022-0168](https://cve.now/CVE-2022-0168.md): A denial of service (DOS) issue was found in the Linux kernel’s smb2\_ioctl\_query\_info function in the fs/cifs/smb2ops.c Common Internet File (no CVSS, kernel)
- [CVE-2022-0225](https://cve.now/CVE-2022-0225.md): A flaw was found in Keycloak. (no CVSS, keycloak · org.keycloak:keycloak-core)
- [CVE-2022-35714](https://cve.now/CVE-2022-35714.md): IBM Maximo Asset Management 7.6.1 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Maximo Asset Management)
- [CVE-2022-31773](https://cve.now/CVE-2022-31773.md): IBM DataPower Gateway V10CD, 10.0.1, and 2018.4.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malic (CVSS 8.8, IBM DataPower Gateway)
- [CVE-2021-4216](https://cve.now/CVE-2021-4216.md): A Floating point exception (division-by-zero) flaw was found in Mupdf for zero width pages in muraster.c. (no CVSS, mupdf)
- [CVE-2022-25625](https://cve.now/CVE-2022-25625.md): A malicious unauthorized PAM user can access the administration configuration data and change the values. (no CVSS, Symantec Privileged Access Management)
- [CVE-2021-3414](https://cve.now/CVE-2021-3414.md): A flaw was found in satellite. (no CVSS, satellite)
- [CVE-2021-3563](https://cve.now/CVE-2021-3563.md): A flaw was found in openstack-keystone. (no CVSS, keystone)
- [CVE-2021-3585](https://cve.now/CVE-2021-3585.md): A flaw was found in openstack-tripleo-heat-templates. (no CVSS, openstack/tripleo-heat-templates.)
- [CVE-2021-3632](https://cve.now/CVE-2021-3632.md): A flaw was found in Keycloak. (no CVSS, keycloak · org.keycloak:keycloak-core)
- [CVE-2021-3644](https://cve.now/CVE-2021-3644.md): A flaw was found in wildfly-core in all versions. (no CVSS, wildfly-core · org.wildfly.core:wildfly-server)
- [CVE-2021-3669](https://cve.now/CVE-2021-3669.md): A flaw was found in the Linux kernel. (no CVSS, kernel)
- [CVE-2021-3688](https://cve.now/CVE-2021-3688.md): A flaw was found in Red Hat JBoss Core Services HTTP Server in all versions, where it does not properly normalize the path component of a re (no CVSS, Red Hat JBCS HTTP Server)
- [CVE-2021-3703](https://cve.now/CVE-2021-3703.md): It was found that the CVE-2021-27918, CVE-2021-31525 and CVE-2021-33196 have been incorrectly mentioned as fixed in RHSA for Serverless 1.16 (no CVSS, Serverless)
- [CVE-2021-3735](https://cve.now/CVE-2021-3735.md): A deadlock issue was found in the AHCI controller device of QEMU. (no CVSS, QEMU)
- [CVE-2021-3754](https://cve.now/CVE-2021-3754.md): A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user. (no CVSS, keycloak · org.keycloak:keycloak-services)
- [CVE-2021-20260](https://cve.now/CVE-2021-20260.md): A flaw was found in the Foreman project. (no CVSS, foreman)
- [CVE-2021-3856](https://cve.now/CVE-2021-3856.md): ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. (no CVSS, keycloak · org.keycloak:keycloak-core)
- [CVE-2021-3864](https://cve.now/CVE-2021-3864.md): A flaw was found in the way the dumpable flag setting was handled when certain SUID binaries executed its descendants. (no CVSS, kernel)
- [CVE-2022-36521](https://cve.now/CVE-2022-36521.md): Insecure permissions in cskefu v7.0.1 allows unauthenticated attackers to arbitrarily add administrator accounts. (no CVSS)
- [CVE-2022-36681](https://cve.now/CVE-2022-36681.md): Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=del (no CVSS)
- [CVE-2021-39394](https://cve.now/CVE-2021-39394.md): mm-wiki v0.2.1 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add user accounts and mod (no CVSS)
- [CVE-2022-36683](https://cve.now/CVE-2022-36683.md): Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=del (no CVSS)
- [CVE-2022-36682](https://cve.now/CVE-2022-36682.md): Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=del (no CVSS)
- [CVE-2022-36680](https://cve.now/CVE-2022-36680.md): Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=del (no CVSS)
- [CVE-2022-36679](https://cve.now/CVE-2022-36679.md): Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=user/manage\_ (no CVSS)
- [CVE-2021-40285](https://cve.now/CVE-2021-40285.md): htmly v2.8.1 was discovered to contain an arbitrary file deletion vulnerability via the component \\views\\backup.html.php. (no CVSS)
- [CVE-2022-36678](https://cve.now/CVE-2022-36678.md): Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=del (no CVSS)
- [CVE-2021-39393](https://cve.now/CVE-2021-39393.md): mm-wiki v0.2.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the markdown editor. (no CVSS)
- [CVE-2022-37151](https://cve.now/CVE-2022-37151.md): There is an unauthorized access vulnerability in Online Diagnostic Lab Management System 1.0. (no CVSS)
- [CVE-2022-37152](https://cve.now/CVE-2022-37152.md): An issue was discovered in Online Diagnostic Lab Management System 1.0, There is a SQL injection vulnerability via "dob" parameter in "/clas (no CVSS)
- [CVE-2022-37150](https://cve.now/CVE-2022-37150.md): An issue was discovered in Online Diagnostic Lab Management System 1.0. (no CVSS)
- [CVE-2021-3427](https://cve.now/CVE-2021-3427.md): The Deluge Web-UI is vulnerable to XSS through a crafted torrent file. (no CVSS, Deluge-web · deluge)
- [CVE-2021-3574](https://cve.now/CVE-2021-3574.md): A vulnerability was found in ImageMagick-7.0.11-5, where executing a crafted file with the convert command, ASAN detects memory leaks. (no CVSS, ImageMagick)
- [CVE-2021-35939](https://cve.now/CVE-2021-35939.md): It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the (no CVSS, RPM)
- [CVE-2021-3859](https://cve.now/CVE-2021-3859.md): A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. (no CVSS, undertow · io.undertow:undertow-core)
- [CVE-2022-0171](https://cve.now/CVE-2022-0171.md): A flaw was found in the Linux kernel. (no CVSS, kernel)
- [CVE-2022-0175](https://cve.now/CVE-2022-0175.md): A flaw was found in the VirGL virtual OpenGL renderer (virglrenderer). (no CVSS, virglrenderer)
- [CVE-2022-0216](https://cve.now/CVE-2022-0216.md): A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. (no CVSS, QEMU)
- [CVE-2022-34301](https://cve.now/CVE-2022-34301.md): A flaw was found in CryptoPro Secure Disk bootloaders before 2022-06-01. (no CVSS)
- [CVE-2022-34302](https://cve.now/CVE-2022-34302.md): A flaw was found in New Horizon Datasys bootloaders before 2022-06-01. (no CVSS)
- [CVE-2022-34303](https://cve.now/CVE-2022-34303.md): A flaw was found in Eurosoft bootloaders before 2022-06-01. (no CVSS)
- [CVE-2022-36537](https://cve.now/CVE-2022-36537.md): ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent (CVSS 7.5, KEV, org.zkoss.zk:zk)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-08-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.