CVEs published August 29, 2022
102 CVEs were published on August 29, 2022: 4 critical, 11 high.
- Published
- 102
- Critical
- 4
- High
- 11
- Medium
- 8
- Low
- 1
- Unrated
- 78
- Now in CISA KEV
- 0
- Fix available
- 23
Most affected products
- Kernel
- 7
- kernel
- 4
- HCL Software HCL iNotes
- 3
- convert2rhel
- 2
- ImageMagick
- 2
- Mailchimp for WooCommerce
- 2
- openscad
- 2
- Simply Schedule Appointments – WordPress Booking Plugin
- 2
- @pendo324/get-process-by-name
- 1
- Anti-Malware Security and Brute-Force Firewall
- 1
Critical 4
- CVE-2022-32548An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1.
- CVE-2022-25644Arbitrary Code Execution@pendo324/get-process-by-name
- CVE-2022-21165Arbitrary Command Injectionfont-converter
- CVE-2022-34668NVFLARE, versions prior to 2.1.4, contains a vulnerability that deserialization of Untrusted Data due to Pickle usage may allow an unprivileNVIDIA FLARE · nvflare
High 11
- CVE-2022-38625Patlite NH-FB v1.46 and below was discovered to contain insufficient firmware validation during the upgrade firmware file upload process.
- CVE-2022-36034Possible Regular Expression Denial of Service (ReDoS) used on uncontrolled data in nitrado.jscainthebest nitrado.js · nitrado.js
- CVE-2022-27546HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerabilityHCL Software HCL iNotes
- CVE-2022-35962Crafted link in Zulip message can cause disclosure of credentialszulip-mobile
- CVE-2022-0934A single-byte, non-arbitrary write/use-after-free flaw was found in dnsmasq.dnsmasq
- CVE-2022-37680An improper authentication for critical function issue in Hitachi Kokusai Electric Network products for monitoring system (Camera, Decoder a
- CVE-2022-37681Hitachi Kokusai Electric Newtork products for monitoring system (Camera, Decoder and Encoder) and below allows attckers to perform a directo
- CVE-2022-3019Improper Access Control in tooljet/tooljettooljet/tooljet
- CVE-2022-25921Arbitrary Code Executionmorgan-json
- CVE-2021-41780Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execu
- CVE-2022-1199A flaw was found in the Linux kernel.Kernel
Medium, low and unrated 87
- CVE-2022-36713Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Section parameter at /librarian/lab.php.
- CVE-2022-36714Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Section parameter at /staff/lab.php.
- CVE-2022-36712Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /staff/studentdetails.php.
- CVE-2022-36711Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /staff/bookdetails.php.
- CVE-2022-36709Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /staff/edit_book_details.php.
- CVE-2022-36560Seiko SkyBridge MB-A200 v01.00.04 and below was discovered to contain multiple hard-coded passcodes for root.
- CVE-2022-36558Seiko SkyBridge MB-A100/A110 v4.2.0 and below implements a hard-coded passcode for the root account.
- CVE-2022-36559Seiko SkyBridge MB-A200 v01.00.04 and below was discovered to contain a command injection vulnerability via the Ping parameter at ping_exec.
- CVE-2022-36557Seiko SkyBridge MB-A100/A110 v4.2.0 and below was discovered to contain an arbitrary file upload vulnerability via the restore backup functi
- CVE-2022-36556Seiko SkyBridge MB-A100/A110 v4.2.0 and below was discovered to contain a command injection vulnerability via the ipAddress parameter at 07s
- CVE-2022-36554A command injection vulnerability in the CLI (Command Line Interface) implementation of Hytec Inter HWL-2511-SS v1.05 and below allows attac
- CVE-2022-36555Hytec Inter HWL-2511-SS v1.05 and below implements a SHA512crypt hash for the root account which can be easily cracked via a brute-force att
- CVE-2022-36553Hytec Inter HWL-2511-SS v1.05 and below was discovered to contain a command injection vulnerability via the component /www/cgi-bin/popen.cgi
- CVE-2021-38934IBM Engineering Test Management 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting.IBM Engineering Test Management
- CVE-2020-26938In oauth2-server (aka node-oauth2-server) through 3.1.1, the value of the redirect_uri parameter received during the authorization and tokenoauth2-server
- CVE-2022-21385A flaw in net_rds_alloc_sgs() in Oracle Linux kernels allows unprivileged local users to crash the machine.Oracle Linux
- CVE-2022-38772Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 125658, 1260
- CVE-2022-32993TOTOLINK A7000R V4.1cu.4134 was discovered to contain an access control issue via /cgi-bin/ExportSettings.sh.
- CVE-2022-3035Cross-site Scripting (XSS) - Stored in snipe/snipe-itsnipe/snipe-it
- CVE-2022-36037Cross-site scripting (XSS) from dynamic options in the multiselect field in Kirbygetkirby kirby · getkirby/cms
- CVE-2022-36036Improper Control of Generation of Code ('Code Injection') in mdx-mermaidsjwall mdx-mermaid · mdx-mermaid
- CVE-2022-2599Anti-Malware Security and Brute-Force Firewall < 4.21.83 - Reflected Cross-Site ScriptingAnti-Malware Security and Brute-Force Firewall
- CVE-2022-2638Export All URLs < 4.4 - Admin+ Arbitrary System File RemovalExport All URLs
- CVE-2022-2374Simply Schedule Appointments < 1.5.7.7 - Admin+ Stored Cross-Site ScriptingSimply Schedule Appointments – WordPress Booking Plugin
- CVE-2022-2537WooCommerce PDF Invoices & Packing Slips < 3.0.1 - Reflected Cross-Site ScriptingWooCommerce PDF Invoices & Packing Slips
- CVE-2022-2538WP Hide & Security Enhancer < 1.8 - Reflected Cross-Site ScriptingWP Hide & Security Enhancer
- CVE-2022-2556MailChimp for Woocommerce < 2.7.2 - Admin+ SSRFMailchimp for WooCommerce
- CVE-2022-2559Fluent Support < 1.5.8 - Admin+ SQLiFluent Support – WordPress Helpdesk and Customer Support Ti…
- CVE-2022-2261WPide < 3.0 - Admin+ Local File InclusionWPIDE – File Manager & Code Editor
- CVE-2022-2267MailChimp for Woocommerce < 2.7.1 - Subscriber+ SSRFMailchimp for WooCommerce
- CVE-2022-2373Simply Schedule Appointments < 1.5.7.7 - Unauthenticated Email Address DisclosureSimply Schedule Appointments – WordPress Booking Plugin
- CVE-2022-27558HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability.HCL Software HCL iNotes
- CVE-2022-27547HCL iNotes is susceptible to a link to non-existent domain vulnerability.HCL Software HCL iNotes
- CVE-2022-2080Sensei LMS < 4.5.2 - Arbitrary Private Message Sending via IDORSensei LMS – Online Courses, Quizzes, & Learning
- CVE-2022-2034Sensei LMS < 4.5.0 - Unauthenticated Private Messages Disclosure via Rest APISensei LMS
- CVE-2022-1663Stop Spam Comments <= 0.2.1.2 - Access Token BypassStop Spam Comments
- CVE-2022-1123Leaflet Maps Marker < 3.12.5 - Admin+ SQLiLeaflet Maps Marker
- CVE-2022-36200In FiberHome VDSL2 Modem HG150-Ub_V3.0, Credentials of Admin are submitted in URL, which can be logged/sniffed.
- CVE-2022-1117A vulnerability was found in fapolicyd.fapolicyd
- CVE-2022-1198A use-after-free vulnerabilitity was discovered in drivers/net/hamradio/6pack.c of linux that allows an attacker to crash linux kernel by sikernel
- CVE-2022-1204A use-after-free flaw was found in the Linux kernel’s Amateur Radio AX.25 protocol functionality in the way a user connects with the protocoKernel
- CVE-2022-1016A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a use-after-free.Kernel
- CVE-2022-1115A heap-buffer-overflow flaw was found in ImageMagick’s PushShortPixel() function of quantum-private.h file.ImageMagick
- CVE-2022-0367A heap-based buffer overflow flaw was found in libmodbus in function modbus_reply() in src/modbus.c.libmodbus
- CVE-2022-0812An information leak flaw was found in NFS over RDMA in the net/sunrpc/xprtrdma/rpc_rdma.c in the Linux Kernel.Kernel
- CVE-2022-0850A vulnerability was found in linux kernel, where an information leak occurs via ext4_extent_header to userspace.kernel
- CVE-2022-0851There is a flaw in convert2rhel.convert2rhel
- CVE-2022-0852There is a flaw in convert2rhel.convert2rhel
- CVE-2022-0480A flaw was found in the filelock_init in fs/locks.c function in the Linux kernel.kernel
- CVE-2022-0485A flaw was found in the copying tool `nbdcopy` of libnbd.libnbd
- CVE-2022-0496A vulnerbiility was found in Openscad, where a DXF-format drawing with particular (not necessarily malformed!) properties may cause an out-oopenscad
- CVE-2022-0497A vulnerbiility was found in Openscad, where a .scad file with no trailing newline could cause an out-of-bounds read during parsing of annotopenscad
- CVE-2022-0669A flaw was found in dpdk.DPDK
- CVE-2022-0718A flaw was found in python-oslo-utils.openstack/python-oslo.utils · oslo-utils
- CVE-2022-0284A heap-based-buffer-over-read flaw was found in ImageMagick's GetPixelAlpha() function of 'pixel-accessor.h'.ImageMagick
- CVE-2022-0400An out-of-bounds read vulnerability was discovered in linux kernel in the smc protocol stack, causing remote dos.kernel
- CVE-2022-31677An Insufficient Session Expiration issue was discovered in the Pinniped Supervisor (before v0.19.0).Pinniped Supervisor · go.pinniped.dev
- CVE-2022-36690Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=user/m
- CVE-2022-36689Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the month parameter at /admin/?page=rep
- CVE-2022-36687Ingredients Stock Management System v1.0 was discovered to contain an arbitrary file deletion vulnerability via the component /classes/Maste
- CVE-2022-36688Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the month parameter at /admin/?page=rep
- CVE-2022-36686Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the month parameter at /admin/?page=rep
- CVE-2022-37059Cross Site Scripting (XSS) in Admin Panel of Subrion CMS 4.2.1 allows attacker to inject arbitrary code via Login Fieldintelliants/subrion
- CVE-2022-36194Centreon 22.04.0 is vulnerable to Cross Site Scripting (XSS) from the function Pollers > Broker Configuration by adding a crafted payload in
- CVE-2021-40326Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, mishandle hidden and incremental data in signed docum
- CVE-2021-41781Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execu
- CVE-2021-41782Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execu
- CVE-2021-41783Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execu
- CVE-2021-41784Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execu
- CVE-2021-41785Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execu
- CVE-2022-25641Foxit PDF Reader before 11.2.2 and PDF Editor before 11.2.2, and PhantomPDF before 10.1.8, mishandle cross-reference information during comp
- CVE-2022-0336The Samba AD DC includes checks when adding service principals names (SPNs) to an account to ensure that SPNs do not alias with those alreadSamba
- CVE-2022-0358A flaw was found in the QEMU virtio-fs shared file system daemon (virtiofsd) implementation.QEMU/virtiofsd
- CVE-2022-1043A flaw was found in the Linux kernel’s io_uring implementation.Kernel
- CVE-2022-1184A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel’s filesystem sub-component.Kernel
- CVE-2022-22897A SQL injection vulnerability in the product_all_one_img and image_product parameters of the ApolloTheme AP PageBuilder component through 2.
- CVE-2022-2953LibTIFF 4.4.0 has an out-of-bounds read in extractImageSection in tools/tiffcrop.c:6905, allowing attackers to cause a denial-of-service vialibtiff
- CVE-2022-2961A use-after-free flaw was found in the Linux kernel’s PLP Rose functionality in the way a user triggers a race condition by calling bind whiKernel
- CVE-2022-35014Advancecomp v2.3 contains a segmentation fault.
- CVE-2022-35015Advancecomp v2.3 was discovered to contain a heap buffer overflow via le_uint32_read at /lib/endianrw.h.
- CVE-2022-35016Advancecomp v2.3 was discovered to contain a heap buffer overflow.
- CVE-2022-35017Advancecomp v2.3 was discovered to contain a heap buffer overflow.
- CVE-2022-35018Advancecomp v2.3 was discovered to contain a segmentation fault.
- CVE-2022-35019Advancecomp v2.3 was discovered to contain a segmentation fault.
- CVE-2022-35020Advancecomp v2.3 was discovered to contain a heap buffer overflow via the component __interceptor_memcpy at /sanitizer_common/sanitizer_comm
- CVE-2022-36033jsoup may not sanitize Cross-Site Scripting (XSS) attempts if SafeList.preserveRelativeLinks is enabledjhy jsoup · org.jsoup:jsoup
- CVE-2022-37177HireVue Hiring Platform V1.0 suffers from Use of a Broken or Risky Cryptographic Algorithm.