# CVEs published 2022-08-27

9 CVEs were published on August 27, 2022: 1 critical, 0 high. Days are UTC.

- [CVE-2022-38794](https://cve.now/CVE-2022-38794.md): Zaver through 2020-12-15 allows directory traversal via the GET /.. (no CVSS)
- [CVE-2022-38792](https://cve.now/CVE-2022-38792.md): The exotel (aka exotel-py) package in PyPI as of 0.1.6 includes a code execution backdoor inserted by a third party. (no CVSS, exotel)
- [CVE-2022-2787](https://cve.now/CVE-2022-2787.md): stricter rules on chroot names (no CVSS, Debian schroot)
- [CVE-2022-3015](https://cve.now/CVE-2022-3015.md): oretnom23 Fast Food Ordering System cross site scripting (CVSS 3.5, oretnom23 Fast Food Ordering System)
- [CVE-2022-3014](https://cve.now/CVE-2022-3014.md): SourceCodester Simple Task Managing System cross site scripting (CVSS 3.5, SourceCodester Simple Task Managing System)
- [CVE-2022-3013](https://cve.now/CVE-2022-3013.md): SourceCodester Simple Task Managing System loginVaLidation.php sql injection (CVSS 6.3, SourceCodester Simple Task Managing System)
- [CVE-2022-3012](https://cve.now/CVE-2022-3012.md): oretnom23 Fast Food Ordering System index.php sql injection (CVSS 6.3, oretnom23 Fast Food Ordering System)
- [CVE-2019-15167](https://cve.now/CVE-2019-15167.md): The VRRP parser in tcpdump before 4.9.3 has a buffer over-read in print-vrrp.c:vrrp\_print() for VRRP version 3, a different vulnerability th (CVSS 9.1)
- [CVE-2022-38791](https://cve.now/CVE-2022-38791.md): In MariaDB before 10.9.2, compress\_write in extra/mariabackup/ds\_compress.cc does not release data\_mutex upon a stream write failure, which (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-08-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.