# CVEs published 2022-08-29

102 CVEs were published on August 29, 2022: 4 critical, 11 high. Days are UTC.

- [CVE-2022-36713](https://cve.now/CVE-2022-36713.md): Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Section parameter at /librarian/lab.php. (no CVSS)
- [CVE-2022-36714](https://cve.now/CVE-2022-36714.md): Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Section parameter at /staff/lab.php. (no CVSS)
- [CVE-2022-36712](https://cve.now/CVE-2022-36712.md): Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /staff/studentdetails.php. (no CVSS)
- [CVE-2022-36711](https://cve.now/CVE-2022-36711.md): Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /staff/bookdetails.php. (no CVSS)
- [CVE-2022-36709](https://cve.now/CVE-2022-36709.md): Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /staff/edit\_book\_details.php. (no CVSS)
- [CVE-2022-36560](https://cve.now/CVE-2022-36560.md): Seiko SkyBridge MB-A200 v01.00.04 and below was discovered to contain multiple hard-coded passcodes for root. (no CVSS)
- [CVE-2022-36558](https://cve.now/CVE-2022-36558.md): Seiko SkyBridge MB-A100/A110 v4.2.0 and below implements a hard-coded passcode for the root account. (no CVSS)
- [CVE-2022-36559](https://cve.now/CVE-2022-36559.md): Seiko SkyBridge MB-A200 v01.00.04 and below was discovered to contain a command injection vulnerability via the Ping parameter at ping\_exec. (no CVSS)
- [CVE-2022-36557](https://cve.now/CVE-2022-36557.md): Seiko SkyBridge MB-A100/A110 v4.2.0 and below was discovered to contain an arbitrary file upload vulnerability via the restore backup functi (no CVSS)
- [CVE-2022-36556](https://cve.now/CVE-2022-36556.md): Seiko SkyBridge MB-A100/A110 v4.2.0 and below was discovered to contain a command injection vulnerability via the ipAddress parameter at 07s (no CVSS)
- [CVE-2022-36554](https://cve.now/CVE-2022-36554.md): A command injection vulnerability in the CLI (Command Line Interface) implementation of Hytec Inter HWL-2511-SS v1.05 and below allows attac (no CVSS)
- [CVE-2022-36555](https://cve.now/CVE-2022-36555.md): Hytec Inter HWL-2511-SS v1.05 and below implements a SHA512crypt hash for the root account which can be easily cracked via a brute-force att (no CVSS)
- [CVE-2022-36553](https://cve.now/CVE-2022-36553.md): Hytec Inter HWL-2511-SS v1.05 and below was discovered to contain a command injection vulnerability via the component /www/cgi-bin/popen.cgi (no CVSS)
- [CVE-2022-38625](https://cve.now/CVE-2022-38625.md): Patlite NH-FB v1.46 and below was discovered to contain insufficient firmware validation during the upgrade firmware file upload process. (CVSS 8.8)
- [CVE-2021-38934](https://cve.now/CVE-2021-38934.md): IBM Engineering Test Management 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Engineering Test Management)
- [CVE-2020-26938](https://cve.now/CVE-2020-26938.md): In oauth2-server (aka node-oauth2-server) through 3.1.1, the value of the redirect\_uri parameter received during the authorization and token (no CVSS, oauth2-server)
- [CVE-2022-21385](https://cve.now/CVE-2022-21385.md): A flaw in net\_rds\_alloc\_sgs() in Oracle Linux kernels allows unprivileged local users to crash the machine. (CVSS 6.2, Oracle Linux)
- [CVE-2022-38772](https://cve.now/CVE-2022-38772.md): Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 125658, 1260 (no CVSS)
- [CVE-2022-32993](https://cve.now/CVE-2022-32993.md): TOTOLINK A7000R V4.1cu.4134 was discovered to contain an access control issue via /cgi-bin/ExportSettings.sh. (no CVSS)
- [CVE-2022-3035](https://cve.now/CVE-2022-3035.md): Cross-site Scripting (XSS) - Stored in snipe/snipe-it (CVSS 5.9, snipe/snipe-it)
- [CVE-2022-36037](https://cve.now/CVE-2022-36037.md): Cross-site scripting (XSS) from dynamic options in the multiselect field in Kirby (CVSS 5.9, getkirby kirby · getkirby/cms)
- [CVE-2022-36036](https://cve.now/CVE-2022-36036.md): Improper Control of Generation of Code ('Code Injection') in mdx-mermaid (CVSS 3.6, sjwall mdx-mermaid · mdx-mermaid)
- [CVE-2022-2599](https://cve.now/CVE-2022-2599.md): Anti-Malware Security and Brute-Force Firewall \< 4.21.83 - Reflected Cross-Site Scripting (no CVSS, Anti-Malware Security and Brute-Force Firewall)
- [CVE-2022-2638](https://cve.now/CVE-2022-2638.md): Export All URLs \< 4.4 - Admin+ Arbitrary System File Removal (no CVSS, Export All URLs)
- [CVE-2022-2374](https://cve.now/CVE-2022-2374.md): Simply Schedule Appointments \< 1.5.7.7 - Admin+ Stored Cross-Site Scripting (no CVSS, Simply Schedule Appointments – WordPress Booking Plugin)
- [CVE-2022-2537](https://cve.now/CVE-2022-2537.md): WooCommerce PDF Invoices & Packing Slips \< 3.0.1 - Reflected Cross-Site Scripting (no CVSS, WooCommerce PDF Invoices & Packing Slips)
- [CVE-2022-2538](https://cve.now/CVE-2022-2538.md): WP Hide & Security Enhancer \< 1.8 - Reflected Cross-Site Scripting (no CVSS, WP Hide & Security Enhancer)
- [CVE-2022-2556](https://cve.now/CVE-2022-2556.md): MailChimp for Woocommerce \< 2.7.2 - Admin+ SSRF (no CVSS, Mailchimp for WooCommerce)
- [CVE-2022-2559](https://cve.now/CVE-2022-2559.md): Fluent Support \< 1.5.8 - Admin+ SQLi (no CVSS, Fluent Support – WordPress Helpdesk and Customer Support Ti…)
- [CVE-2022-2261](https://cve.now/CVE-2022-2261.md): WPide \< 3.0 - Admin+ Local File Inclusion (no CVSS, WPIDE – File Manager & Code Editor)
- [CVE-2022-2267](https://cve.now/CVE-2022-2267.md): MailChimp for Woocommerce \< 2.7.1 - Subscriber+ SSRF (no CVSS, Mailchimp for WooCommerce)
- [CVE-2022-2373](https://cve.now/CVE-2022-2373.md): Simply Schedule Appointments \< 1.5.7.7 - Unauthenticated Email Address Disclosure (no CVSS, Simply Schedule Appointments – WordPress Booking Plugin)
- [CVE-2022-36034](https://cve.now/CVE-2022-36034.md): Possible Regular Expression Denial of Service (ReDoS) used on uncontrolled data in nitrado.js (CVSS 7.5, cainthebest nitrado.js · nitrado.js)
- [CVE-2022-27558](https://cve.now/CVE-2022-27558.md): HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability. (CVSS 5.9, HCL Software HCL iNotes)
- [CVE-2022-27547](https://cve.now/CVE-2022-27547.md): HCL iNotes is susceptible to a link to non-existent domain vulnerability. (CVSS 6.1, HCL Software HCL iNotes)
- [CVE-2022-27546](https://cve.now/CVE-2022-27546.md): HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability (CVSS 8.3, HCL Software HCL iNotes)
- [CVE-2022-35962](https://cve.now/CVE-2022-35962.md): Crafted link in Zulip message can cause disclosure of credentials (CVSS 8.0, zulip-mobile)
- [CVE-2022-2080](https://cve.now/CVE-2022-2080.md): Sensei LMS \< 4.5.2 - Arbitrary Private Message Sending via IDOR (no CVSS, Sensei LMS – Online Courses, Quizzes, & Learning)
- [CVE-2022-2034](https://cve.now/CVE-2022-2034.md): Sensei LMS \< 4.5.0 - Unauthenticated Private Messages Disclosure via Rest API (no CVSS, Sensei LMS)
- [CVE-2022-1663](https://cve.now/CVE-2022-1663.md): Stop Spam Comments \<= 0.2.1.2 - Access Token Bypass (no CVSS, Stop Spam Comments)
- [CVE-2022-1123](https://cve.now/CVE-2022-1123.md): Leaflet Maps Marker \< 3.12.5 - Admin+ SQLi (no CVSS, Leaflet Maps Marker)
- [CVE-2022-36200](https://cve.now/CVE-2022-36200.md): In FiberHome VDSL2 Modem HG150-Ub\_V3.0, Credentials of Admin are submitted in URL, which can be logged/sniffed. (no CVSS)
- [CVE-2022-1117](https://cve.now/CVE-2022-1117.md): A vulnerability was found in fapolicyd. (no CVSS, fapolicyd)
- [CVE-2022-1198](https://cve.now/CVE-2022-1198.md): A use-after-free vulnerabilitity was discovered in drivers/net/hamradio/6pack.c of linux that allows an attacker to crash linux kernel by si (no CVSS, kernel)
- [CVE-2022-1204](https://cve.now/CVE-2022-1204.md): A use-after-free flaw was found in the Linux kernel’s Amateur Radio AX.25 protocol functionality in the way a user connects with the protoco (no CVSS, Kernel)
- [CVE-2022-1016](https://cve.now/CVE-2022-1016.md): A flaw was found in the Linux kernel in net/netfilter/nf\_tables\_core.c:nft\_do\_chain, which can cause a use-after-free. (no CVSS, Kernel)
- [CVE-2022-1115](https://cve.now/CVE-2022-1115.md): A heap-buffer-overflow flaw was found in ImageMagick’s PushShortPixel() function of quantum-private.h file. (no CVSS, ImageMagick)
- [CVE-2022-0367](https://cve.now/CVE-2022-0367.md): A heap-based buffer overflow flaw was found in libmodbus in function modbus\_reply() in src/modbus.c. (no CVSS, libmodbus)
- [CVE-2022-0812](https://cve.now/CVE-2022-0812.md): An information leak flaw was found in NFS over RDMA in the net/sunrpc/xprtrdma/rpc\_rdma.c in the Linux Kernel. (no CVSS, Kernel)
- [CVE-2022-0850](https://cve.now/CVE-2022-0850.md): A vulnerability was found in linux kernel, where an information leak occurs via ext4\_extent\_header to userspace. (no CVSS, kernel)
- [CVE-2022-0851](https://cve.now/CVE-2022-0851.md): There is a flaw in convert2rhel. (no CVSS, convert2rhel)
- [CVE-2022-0852](https://cve.now/CVE-2022-0852.md): There is a flaw in convert2rhel. (no CVSS, convert2rhel)
- [CVE-2022-0480](https://cve.now/CVE-2022-0480.md): A flaw was found in the filelock\_init in fs/locks.c function in the Linux kernel. (no CVSS, kernel)
- [CVE-2022-0485](https://cve.now/CVE-2022-0485.md): A flaw was found in the copying tool \`nbdcopy\` of libnbd. (no CVSS, libnbd)
- [CVE-2022-0496](https://cve.now/CVE-2022-0496.md): A vulnerbiility was found in Openscad, where a DXF-format drawing with particular (not necessarily malformed!) properties may cause an out-o (no CVSS, openscad)
- [CVE-2022-0497](https://cve.now/CVE-2022-0497.md): A vulnerbiility was found in Openscad, where a .scad file with no trailing newline could cause an out-of-bounds read during parsing of annot (no CVSS, openscad)
- [CVE-2022-0669](https://cve.now/CVE-2022-0669.md): A flaw was found in dpdk. (no CVSS, DPDK)
- [CVE-2022-0718](https://cve.now/CVE-2022-0718.md): A flaw was found in python-oslo-utils. (no CVSS, openstack/python-oslo.utils · oslo-utils)
- [CVE-2022-0284](https://cve.now/CVE-2022-0284.md): A heap-based-buffer-over-read flaw was found in ImageMagick's GetPixelAlpha() function of 'pixel-accessor.h'. (no CVSS, ImageMagick)
- [CVE-2022-0400](https://cve.now/CVE-2022-0400.md): An out-of-bounds read vulnerability was discovered in linux kernel in the smc protocol stack, causing remote dos. (no CVSS, kernel)
- [CVE-2022-0934](https://cve.now/CVE-2022-0934.md): A single-byte, non-arbitrary write/use-after-free flaw was found in dnsmasq. (CVSS 7.5, dnsmasq)
- [CVE-2022-31677](https://cve.now/CVE-2022-31677.md): An Insufficient Session Expiration issue was discovered in the Pinniped Supervisor (before v0.19.0). (no CVSS, Pinniped Supervisor · go.pinniped.dev)
- [CVE-2022-36690](https://cve.now/CVE-2022-36690.md): Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=user/m (no CVSS)
- [CVE-2022-36689](https://cve.now/CVE-2022-36689.md): Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the month parameter at /admin/?page=rep (no CVSS)
- [CVE-2022-36687](https://cve.now/CVE-2022-36687.md): Ingredients Stock Management System v1.0 was discovered to contain an arbitrary file deletion vulnerability via the component /classes/Maste (no CVSS)
- [CVE-2022-36688](https://cve.now/CVE-2022-36688.md): Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the month parameter at /admin/?page=rep (no CVSS)
- [CVE-2022-36686](https://cve.now/CVE-2022-36686.md): Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the month parameter at /admin/?page=rep (no CVSS)
- [CVE-2022-37680](https://cve.now/CVE-2022-37680.md): An improper authentication for critical function issue in Hitachi Kokusai Electric Network products for monitoring system (Camera, Decoder a (CVSS 7.5)
- [CVE-2022-37681](https://cve.now/CVE-2022-37681.md): Hitachi Kokusai Electric Newtork products for monitoring system (Camera, Decoder and Encoder) and below allows attckers to perform a directo (CVSS 7.5)
- [CVE-2022-37059](https://cve.now/CVE-2022-37059.md): Cross Site Scripting (XSS) in Admin Panel of Subrion CMS 4.2.1 allows attacker to inject arbitrary code via Login Field (no CVSS, intelliants/subrion)
- [CVE-2022-36194](https://cve.now/CVE-2022-36194.md): Centreon 22.04.0 is vulnerable to Cross Site Scripting (XSS) from the function Pollers \> Broker Configuration by adding a crafted payload in (no CVSS)
- [CVE-2022-32548](https://cve.now/CVE-2022-32548.md): An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. (CVSS 10.0)
- [CVE-2022-3019](https://cve.now/CVE-2022-3019.md): Improper Access Control in tooljet/tooljet (CVSS 7.1, tooljet/tooljet)
- [CVE-2022-25921](https://cve.now/CVE-2022-25921.md): Arbitrary Code Execution (CVSS 8.1, morgan-json)
- [CVE-2022-25644](https://cve.now/CVE-2022-25644.md): Arbitrary Code Execution (CVSS 9.8, @pendo324/get-process-by-name)
- [CVE-2022-21165](https://cve.now/CVE-2022-21165.md): Arbitrary Command Injection (CVSS 9.8, font-converter)
- [CVE-2021-40326](https://cve.now/CVE-2021-40326.md): Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, mishandle hidden and incremental data in signed docum (no CVSS)
- [CVE-2021-41780](https://cve.now/CVE-2021-41780.md): Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execu (CVSS 7.8)
- [CVE-2021-41781](https://cve.now/CVE-2021-41781.md): Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execu (no CVSS)
- [CVE-2021-41782](https://cve.now/CVE-2021-41782.md): Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execu (no CVSS)
- [CVE-2021-41783](https://cve.now/CVE-2021-41783.md): Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execu (no CVSS)
- [CVE-2021-41784](https://cve.now/CVE-2021-41784.md): Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execu (no CVSS)
- [CVE-2021-41785](https://cve.now/CVE-2021-41785.md): Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execu (no CVSS)
- [CVE-2022-25641](https://cve.now/CVE-2022-25641.md): Foxit PDF Reader before 11.2.2 and PDF Editor before 11.2.2, and PhantomPDF before 10.1.8, mishandle cross-reference information during comp (no CVSS)
- [CVE-2022-0336](https://cve.now/CVE-2022-0336.md): The Samba AD DC includes checks when adding service principals names (SPNs) to an account to ensure that SPNs do not alias with those alread (no CVSS, Samba)
- [CVE-2022-0358](https://cve.now/CVE-2022-0358.md): A flaw was found in the QEMU virtio-fs shared file system daemon (virtiofsd) implementation. (no CVSS, QEMU/virtiofsd)
- [CVE-2022-1043](https://cve.now/CVE-2022-1043.md): A flaw was found in the Linux kernel’s io\_uring implementation. (no CVSS, Kernel)
- [CVE-2022-1184](https://cve.now/CVE-2022-1184.md): A use-after-free flaw was found in fs/ext4/namei.c:dx\_insert\_block() in the Linux kernel’s filesystem sub-component. (no CVSS, Kernel)
- [CVE-2022-1199](https://cve.now/CVE-2022-1199.md): A flaw was found in the Linux kernel. (CVSS 7.5, Kernel)
- [CVE-2022-22897](https://cve.now/CVE-2022-22897.md): A SQL injection vulnerability in the product\_all\_one\_img and image\_product parameters of the ApolloTheme AP PageBuilder component through 2. (no CVSS)
- [CVE-2022-2953](https://cve.now/CVE-2022-2953.md): LibTIFF 4.4.0 has an out-of-bounds read in extractImageSection in tools/tiffcrop.c:6905, allowing attackers to cause a denial-of-service via (CVSS 5.5, libtiff)
- [CVE-2022-2961](https://cve.now/CVE-2022-2961.md): A use-after-free flaw was found in the Linux kernel’s PLP Rose functionality in the way a user triggers a race condition by calling bind whi (no CVSS, Kernel)
- [CVE-2022-34668](https://cve.now/CVE-2022-34668.md): NVFLARE, versions prior to 2.1.4, contains a vulnerability that deserialization of Untrusted Data due to Pickle usage may allow an unprivile (CVSS 9.8, NVIDIA FLARE · nvflare)
- [CVE-2022-35014](https://cve.now/CVE-2022-35014.md): Advancecomp v2.3 contains a segmentation fault. (no CVSS)
- [CVE-2022-35015](https://cve.now/CVE-2022-35015.md): Advancecomp v2.3 was discovered to contain a heap buffer overflow via le\_uint32\_read at /lib/endianrw.h. (no CVSS)
- [CVE-2022-35016](https://cve.now/CVE-2022-35016.md): Advancecomp v2.3 was discovered to contain a heap buffer overflow. (no CVSS)
- [CVE-2022-35017](https://cve.now/CVE-2022-35017.md): Advancecomp v2.3 was discovered to contain a heap buffer overflow. (no CVSS)
- [CVE-2022-35018](https://cve.now/CVE-2022-35018.md): Advancecomp v2.3 was discovered to contain a segmentation fault. (no CVSS)
- [CVE-2022-35019](https://cve.now/CVE-2022-35019.md): Advancecomp v2.3 was discovered to contain a segmentation fault. (no CVSS)
- [CVE-2022-35020](https://cve.now/CVE-2022-35020.md): Advancecomp v2.3 was discovered to contain a heap buffer overflow via the component \_\_interceptor\_memcpy at /sanitizer\_common/sanitizer\_comm (no CVSS)
- [CVE-2022-36033](https://cve.now/CVE-2022-36033.md): jsoup may not sanitize Cross-Site Scripting (XSS) attempts if SafeList.preserveRelativeLinks is enabled (CVSS 6.1, jhy jsoup · org.jsoup:jsoup)
- [CVE-2022-37177](https://cve.now/CVE-2022-37177.md): HireVue Hiring Platform V1.0 suffers from Use of a Broken or Risky Cryptographic Algorithm. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-08-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.