# CVEs published 2022-08-28 36 CVEs were published on August 28, 2022: 2 critical, 1 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2022-38511](https://cve.now/CVE-2022-38511.md): TOTOLINK A810R V5.9c.4050\_B20190424 was discovered to contain a command injection vulnerability via the component downloadFile.cgi. (no CVSS) - [CVE-2022-38510](https://cve.now/CVE-2022-38510.md): Tenda\_TX9pro V22.03.02.10 was discovered to contain a buffer overflow via the component httpd/SetNetControlList. (no CVSS) - [CVE-2022-36615](https://cve.now/CVE-2022-36615.md): TOTOLINK A3000RU V4.1.2cu.5185\_B20201128 was discovered to contain a hardcoded password for root at /etc/shadow.sample. (no CVSS) - [CVE-2022-36616](https://cve.now/CVE-2022-36616.md): TOTOLINK A810R V4.1.2cu.5182\_B20201026 and V5.9c.4050\_B20190424 was discovered to contain a hardcoded password for root at /etc/shadow.sampl (no CVSS) - [CVE-2022-36614](https://cve.now/CVE-2022-36614.md): TOTOLINK A860R V4.1.2cu.5182\_B20201027 was discovered to contain a hardcoded password for root at /etc/shadow.sample. (no CVSS) - [CVE-2022-36612](https://cve.now/CVE-2022-36612.md): TOTOLINK A950RG V4.1.2cu.5204\_B20210112 was discovered to contain a hardcoded password for root at /etc/shadow.sample. (no CVSS) - [CVE-2022-36613](https://cve.now/CVE-2022-36613.md): TOTOLINK N600R V4.3.0cu.7647\_B20210106 was discovered to contain a hardcoded password for root at /etc/shadow.sample. (no CVSS) - [CVE-2022-36611](https://cve.now/CVE-2022-36611.md): TOTOLINK A800R V4.1.2cu.5137\_B20200730 was discovered to contain a hardcoded password for root at /etc/shadow.sample. (no CVSS) - [CVE-2022-36610](https://cve.now/CVE-2022-36610.md): TOTOLINK A720R V4.1.5cu.532\_B20210610 was discovered to contain a hardcoded password for root at /etc/shadow.sample. (no CVSS) - [CVE-2022-36573](https://cve.now/CVE-2022-36573.md): A cross-site scripting (XSS) vulnerability in Pagekit CMS v1.0.18 allows attackers to execute arbitrary web scripts or HTML via a crafted pa (no CVSS, pagekit/pagekit) - [CVE-2022-36572](https://cve.now/CVE-2022-36572.md): Sinsiu Sinsiu Enterprise Website System v1.1.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /up (no CVSS) - [CVE-2022-36708](https://cve.now/CVE-2022-36708.md): Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Id parameter at /student/bookdetails.php. (no CVSS) - [CVE-2022-36706](https://cve.now/CVE-2022-36706.md): Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the Id parameter at /stocks/manage\_stoc (no CVSS) - [CVE-2022-36705](https://cve.now/CVE-2022-36705.md): Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the Id parameter at /stocks/manage\_wast (no CVSS) - [CVE-2022-36704](https://cve.now/CVE-2022-36704.md): Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Id parameter at /librarian/studentdetails.php (no CVSS) - [CVE-2022-38562](https://cve.now/CVE-2022-38562.md): Tenda M3 V1.0.0.12(4856) was discovered to contain a heap buffer overflow vulnerability in the function formSetFixTools. (no CVSS) - [CVE-2022-38564](https://cve.now/CVE-2022-38564.md): Tenda M3 V1.0.0.12(4856) was discovered to contain a buffer overflow vulnerability in the function formSetPicListItem. (no CVSS) - [CVE-2022-38565](https://cve.now/CVE-2022-38565.md): Tenda M3 V1.0.0.12(4856) was discovered to contain a heap buffer overflow vulnerability in the function formEmailTest. (no CVSS) - [CVE-2022-38566](https://cve.now/CVE-2022-38566.md): Tenda M3 V1.0.0.12(4856) was discovered to contain a heap buffer overflow vulnerability in the function formEmailTest. (no CVSS) - [CVE-2022-38567](https://cve.now/CVE-2022-38567.md): Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow vulnerability in the function formSetAdConfigInfo. (no CVSS) - [CVE-2022-38563](https://cve.now/CVE-2022-38563.md): Tenda M3 V1.0.0.12(4856) was discovered to contain a heap buffer overflow vulnerability in the function formSetFixTools. (no CVSS) - [CVE-2022-38568](https://cve.now/CVE-2022-38568.md): Tenda M3 V1.0.0.12(4856) was discovered to contain a heap buffer overflow vulnerability in the function formSetFixTools. (no CVSS) - [CVE-2022-38569](https://cve.now/CVE-2022-38569.md): Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow in the function formDelAd. (no CVSS) - [CVE-2022-38571](https://cve.now/CVE-2022-38571.md): Tenda M3 V1.0.0.12(4856) was discovered to contain a buffer overflow in the function formSetGuideListItem. (no CVSS) - [CVE-2022-38570](https://cve.now/CVE-2022-38570.md): Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow in the function formDelPushedAd. (no CVSS) - [CVE-2022-38555](https://cve.now/CVE-2022-38555.md): Linksys E1200 v1.0.04 is vulnerable to Buffer Overflow via ej\_get\_web\_page\_name. (no CVSS) - [CVE-2022-37055](https://cve.now/CVE-2022-37055.md): D-Link Go-RT-AC750 GORTAC750\_revA\_v101b03 and GO-RT-AC750\_revB\_FWv200b02 are vulnerable to Buffer Overflow via cgibin, hnap\_main, (CVSS 9.8, KEV) - [CVE-2022-37056](https://cve.now/CVE-2022-37056.md): D-Link GO-RT-AC750 GORTAC750\_revA\_v101b03 and GO-RT-AC750\_revB\_FWv200b02 is vulnerable to Command Injection via /cgibin, hnap\_main, (CVSS 9.8) - [CVE-2022-37057](https://cve.now/CVE-2022-37057.md): D-Link Go-RT-AC750 GORTAC750\_revA\_v101b03 and GO-RT-AC750\_revB\_FWv200b02 are vulnerable to Command Injection via cgibin, ssdpcgi\_main. (no CVSS) - [CVE-2022-37053](https://cve.now/CVE-2022-37053.md): TRENDnet TEW733GR v1.03B01 is vulnerable to Command injection via /htdocs/upnpinc/gena.php. (no CVSS) - [CVE-2022-38556](https://cve.now/CVE-2022-38556.md): Trendnet TEW733GR v1.03B01 contains a Static Default Credential vulnerability in /etc/init0.d/S80telnetd.sh. (no CVSS) - [CVE-2022-38557](https://cve.now/CVE-2022-38557.md): D-Link DIR845L v1.00-v1.03 contains a Static Default Credential vulnerability in /etc/init0.d/S80telnetd.sh. (no CVSS) - [CVE-2022-36756](https://cve.now/CVE-2022-36756.md): DIR845L A1 v1.00-v1.03 is vulnerable to command injection via /htdocs/upnpinc/gena.php. (no CVSS) - [CVE-2022-36755](https://cve.now/CVE-2022-36755.md): D-Link DIR845L A1 contains a authentication vulnerability via an AUTHORIZED\_GROUP=1 value, as demonstrated by a request for getcfg.php. (no CVSS) - [CVE-2022-3017](https://cve.now/CVE-2022-3017.md): Cross-Site Request Forgery (CSRF) in froxlor/froxlor (CVSS 4.3, froxlor/froxlor) - [CVE-2022-3016](https://cve.now/CVE-2022-3016.md): Use After Free in vim/vim (CVSS 7.8, vim/vim) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2022-08-28 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.