CVEs published August 28, 2022
36 CVEs were published on August 28, 2022: 2 critical, 1 high. 1 is now in CISA KEV.
- Published
- 36
- Critical
- 2
- High
- 1
- Medium
- 1
- Low
- 0
- Unrated
- 32
- Now in CISA KEV
- 1
- Fix available
- 2
Most affected products
- froxlor/froxlor
- 1
- pagekit/pagekit
- 1
- vim/vim
- 1
Critical 2
High 1
Medium, low and unrated 33
- CVE-2022-38511TOTOLINK A810R V5.9c.4050_B20190424 was discovered to contain a command injection vulnerability via the component downloadFile.cgi.
- CVE-2022-38510Tenda_TX9pro V22.03.02.10 was discovered to contain a buffer overflow via the component httpd/SetNetControlList.
- CVE-2022-36615TOTOLINK A3000RU V4.1.2cu.5185_B20201128 was discovered to contain a hardcoded password for root at /etc/shadow.sample.
- CVE-2022-36616TOTOLINK A810R V4.1.2cu.5182_B20201026 and V5.9c.4050_B20190424 was discovered to contain a hardcoded password for root at /etc/shadow.sampl
- CVE-2022-36614TOTOLINK A860R V4.1.2cu.5182_B20201027 was discovered to contain a hardcoded password for root at /etc/shadow.sample.
- CVE-2022-36612TOTOLINK A950RG V4.1.2cu.5204_B20210112 was discovered to contain a hardcoded password for root at /etc/shadow.sample.
- CVE-2022-36613TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a hardcoded password for root at /etc/shadow.sample.
- CVE-2022-36611TOTOLINK A800R V4.1.2cu.5137_B20200730 was discovered to contain a hardcoded password for root at /etc/shadow.sample.
- CVE-2022-36610TOTOLINK A720R V4.1.5cu.532_B20210610 was discovered to contain a hardcoded password for root at /etc/shadow.sample.
- CVE-2022-36573A cross-site scripting (XSS) vulnerability in Pagekit CMS v1.0.18 allows attackers to execute arbitrary web scripts or HTML via a crafted papagekit/pagekit
- CVE-2022-36572Sinsiu Sinsiu Enterprise Website System v1.1.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /up
- CVE-2022-36708Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Id parameter at /student/bookdetails.php.
- CVE-2022-36706Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the Id parameter at /stocks/manage_stoc
- CVE-2022-36705Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the Id parameter at /stocks/manage_wast
- CVE-2022-36704Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Id parameter at /librarian/studentdetails.php
- CVE-2022-38562Tenda M3 V1.0.0.12(4856) was discovered to contain a heap buffer overflow vulnerability in the function formSetFixTools.
- CVE-2022-38564Tenda M3 V1.0.0.12(4856) was discovered to contain a buffer overflow vulnerability in the function formSetPicListItem.
- CVE-2022-38565Tenda M3 V1.0.0.12(4856) was discovered to contain a heap buffer overflow vulnerability in the function formEmailTest.
- CVE-2022-38566Tenda M3 V1.0.0.12(4856) was discovered to contain a heap buffer overflow vulnerability in the function formEmailTest.
- CVE-2022-38567Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow vulnerability in the function formSetAdConfigInfo.
- CVE-2022-38563Tenda M3 V1.0.0.12(4856) was discovered to contain a heap buffer overflow vulnerability in the function formSetFixTools.
- CVE-2022-38568Tenda M3 V1.0.0.12(4856) was discovered to contain a heap buffer overflow vulnerability in the function formSetFixTools.
- CVE-2022-38569Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow in the function formDelAd.
- CVE-2022-38571Tenda M3 V1.0.0.12(4856) was discovered to contain a buffer overflow in the function formSetGuideListItem.
- CVE-2022-38570Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow in the function formDelPushedAd.
- CVE-2022-38555Linksys E1200 v1.0.04 is vulnerable to Buffer Overflow via ej_get_web_page_name.
- CVE-2022-37057D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Command Injection via cgibin, ssdpcgi_main.
- CVE-2022-37053TRENDnet TEW733GR v1.03B01 is vulnerable to Command injection via /htdocs/upnpinc/gena.php.
- CVE-2022-38556Trendnet TEW733GR v1.03B01 contains a Static Default Credential vulnerability in /etc/init0.d/S80telnetd.sh.
- CVE-2022-38557D-Link DIR845L v1.00-v1.03 contains a Static Default Credential vulnerability in /etc/init0.d/S80telnetd.sh.
- CVE-2022-36756DIR845L A1 v1.00-v1.03 is vulnerable to command injection via /htdocs/upnpinc/gena.php.
- CVE-2022-36755D-Link DIR845L A1 contains a authentication vulnerability via an AUTHORIZED_GROUP=1 value, as demonstrated by a request for getcfg.php.
- CVE-2022-3017Cross-Site Request Forgery (CSRF) in froxlor/froxlorfroxlor/froxlor