# CVEs published 2022-08-30

47 CVEs were published on August 30, 2022: 1 critical, 7 high. Days are UTC.

- [CVE-2022-36749](https://cve.now/CVE-2022-36749.md): RPi-Jukebox-RFID v2.3.0 was discovered to contain a command injection vulnerability via the component /htdocs/utils/Files.php. (no CVSS)
- [CVE-2022-36748](https://cve.now/CVE-2022-36748.md): PicUploader v2.6.3 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /master/index.php. (no CVSS)
- [CVE-2022-36747](https://cve.now/CVE-2022-36747.md): Razor v0.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the function uploadchannel(). (no CVSS)
- [CVE-2022-36745](https://cve.now/CVE-2022-36745.md): LibreNMS v22.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component print-customoid.php. (no CVSS, librenms/librenms)
- [CVE-2022-36746](https://cve.now/CVE-2022-36746.md): LibreNMS v22.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component oxidized-cfg-check.inc.php. (no CVSS, librenms/librenms)
- [CVE-2022-27563](https://cve.now/CVE-2022-27563.md): Overload/denial of service affects HCL VersionVault Express (CVSS 7.5, HCL Software HCL VersionVault Express)
- [CVE-2022-27560](https://cve.now/CVE-2022-27560.md): An insufficiently protected credential vulnerability affects HCL VersionVault Express (CVSS 6.0, HCL Software HCL VersionVault Express)
- [CVE-2022-36657](https://cve.now/CVE-2022-36657.md): Library Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /librarian/edit\_book\_d (no CVSS)
- [CVE-2022-36735](https://cve.now/CVE-2022-36735.md): Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at /admin/delete.php. (no CVSS)
- [CVE-2022-36734](https://cve.now/CVE-2022-36734.md): Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the RollNo parameter at /admin/delstu.php. (no CVSS)
- [CVE-2022-36733](https://cve.now/CVE-2022-36733.md): Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the M\_Id parameter at /admin/del.php. (no CVSS)
- [CVE-2022-36732](https://cve.now/CVE-2022-36732.md): Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /librarian/dele.php. (no CVSS)
- [CVE-2022-36731](https://cve.now/CVE-2022-36731.md): Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the RollNo parameter at /librarian/delstu.php. (no CVSS)
- [CVE-2022-36730](https://cve.now/CVE-2022-36730.md): Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at /librarian/delete.php. (no CVSS)
- [CVE-2022-3037](https://cve.now/CVE-2022-3037.md): Use After Free in vim/vim (CVSS 7.8, vim/vim)
- [CVE-2022-34375](https://cve.now/CVE-2022-34375.md): Dell Container Storage Modules 1.2 contains a path traversal vulnerability in goiscsi and gobrick libraries. (CVSS 8.8, Dell Container Storage Modules)
- [CVE-2022-34374](https://cve.now/CVE-2022-34374.md): Dell Container Storage Modules 1.2 contains an OS command injection in goiscsi and gobrick libraries. (CVSS 8.8, Dell Container Storage Modules)
- [CVE-2022-34368](https://cve.now/CVE-2022-34368.md): Dell EMC NetWorker 19.2.1.x 19.3.x, 19.4.x, 19.5.x, 19.6.x and 19.7.0.0 contain an Improper Handling of Insufficient Permissions or Privileg (CVSS 6.1, Dell NetWorker Management Console)
- [CVE-2022-33935](https://cve.now/CVE-2022-33935.md): Dell EMC Data Protection Advisor versions 19.6 and earlier, contains a Stored Cross Site Scripting, an attacker could potentially exploit th (CVSS 5.4, Dell Data Protection Advisor)
- [CVE-2022-31232](https://cve.now/CVE-2022-31232.md): SmartFabric storage software version 1.0.0 contains a Command-Injection vulnerability. (CVSS 8.6, Dell Smart Fabric Storage Software)
- [CVE-2022-37173](https://cve.now/CVE-2022-37173.md): An issue in the installer of gvim 9.0.0000 allows authenticated attackers to execute arbitrary code via a binary hijacking attack on C:\\Prog (no CVSS)
- [CVE-2022-36565](https://cve.now/CVE-2022-36565.md): Incorrect access control in the install directory (C:\\Wamp64) of Wamp v3.2.6 and below allows authenticated attackers to execute arbitrary c (no CVSS)
- [CVE-2022-37172](https://cve.now/CVE-2022-37172.md): Incorrect access control in the install directory (C:\\msys64) of Msys2 v20220603 and below allows authenticated attackers to execute arbitra (no CVSS)
- [CVE-2022-36563](https://cve.now/CVE-2022-36563.md): Incorrect access control in the install directory (C:\\RailsInstaller) of Rubyinstaller2 v3.1.2 and below allows authenticated attackers to e (no CVSS)
- [CVE-2022-36564](https://cve.now/CVE-2022-36564.md): Incorrect access control in the install directory (C:\\Strawberry) of StrawberryPerl v5.32.1.1 and below allows authenticated attackers to ex (no CVSS)
- [CVE-2022-36562](https://cve.now/CVE-2022-36562.md): Incorrect access control in the install directory (C:\\Ruby31-x64) of Rubyinstaller2 v3.1.2 and below allows authenticated attackers to execu (no CVSS)
- [CVE-2022-36561](https://cve.now/CVE-2022-36561.md): XPDF v4.0.4 was discovered to contain a segmentation violation via the component /xpdf/AcroForm.cc:538. (no CVSS)
- [CVE-2021-29864](https://cve.now/CVE-2021-29864.md): IBM Security Identity Manager 6.0 and 6.0.2 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. (CVSS 6.8, IBM Security Identity Manager)
- [CVE-2022-37237](https://cve.now/CVE-2022-37237.md): An attacker can send malicious RTMP requests to make the ZLMediaKit server crash remotely. (no CVSS)
- [CVE-2022-37176](https://cve.now/CVE-2022-37176.md): Tenda AC6(AC1200) v5.0 Firmware v02.03.01.114 and below contains a vulnerability which allows attackers to remove the Wi-Fi password and for (no CVSS)
- [CVE-2022-36552](https://cve.now/CVE-2022-36552.md): Tenda AC6(AC1200) v5.0 Firmware v02.03.01.114 and below contains an issue in the component /cgi-bin/DownloadFlash which allows attackers to (no CVSS)
- [CVE-2022-37149](https://cve.now/CVE-2022-37149.md): WAVLINK WL-WN575A3 RPT75A3.V4300.201217 was discovered to contain a command injection vulnerability when operating the file adm.cgi. (no CVSS)
- [CVE-2022-2330](https://cve.now/CVE-2022-2330.md): XXE vulnerability in DLP Endpoint for Windows (CVSS 6.5, Trellix DLP Endpoint for Windows)
- [CVE-2022-25646](https://cve.now/CVE-2022-25646.md): Cross-site Scripting (XSS) (CVSS 5.4, x-data-spreadsheet)
- [CVE-2022-25857](https://cve.now/CVE-2022-25857.md): Denial of Service (DoS) (CVSS 7.5, org.yaml:snakeyaml)
- [CVE-2022-25887](https://cve.now/CVE-2022-25887.md): Regular Expression Denial of Service (ReDoS) (CVSS 5.3, sanitize-html)
- [CVE-2022-38118](https://cve.now/CVE-2022-38118.md): HGiga OAKlouds - SQL Injection (CVSS 8.8, HGiga OAKlouds)
- [CVE-2022-38116](https://cve.now/CVE-2022-38116.md): Le-yan Co., Ltd. Personnel and Salary Management System - Hard-coded password (CVSS 9.8, Le-yan Co. Personnel and Salary Management System)
- [CVE-2022-26529](https://cve.now/CVE-2022-26529.md): Realtek Linux/Android Bluetooth Mesh SDK - Buffer Overflow (CVSS 6.5, Realtek Linux/Android Bluetooth Mesh SDK)
- [CVE-2022-26528](https://cve.now/CVE-2022-26528.md): Realtek Linux/Android Bluetooth Mesh SDK - Buffer Overflow (CVSS 6.5, Realtek Linux/Android Bluetooth Mesh SDK)
- [CVE-2022-26527](https://cve.now/CVE-2022-26527.md): Realtek Linux/Android Bluetooth Mesh SDK - Buffer Overflow (CVSS 6.5, Realtek Linux/Android Bluetooth Mesh SDK)
- [CVE-2022-25635](https://cve.now/CVE-2022-25635.md): Realtek Linux/Android Bluetooth Mesh SDK - Buffer Overflow (CVSS 6.5, Realtek Linux/Android Bluetooth Mesh SDK)
- [CVE-2022-24106](https://cve.now/CVE-2022-24106.md): In Xpdf prior to 4.04, the DCT (JPEG) decoder was incorrectly allowing the 'interleaved' flag to be changed after the first scan of the imag (no CVSS)
- [CVE-2022-24107](https://cve.now/CVE-2022-24107.md): Xpdf prior to 4.04 lacked an integer overflow check in JPXStream.cc. (no CVSS)
- [CVE-2022-38784](https://cve.now/CVE-2022-38784.md): Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIGStream.cc) (no CVSS)
- [CVE-2021-46837](https://cve.now/CVE-2021-46837.md): res\_pjsip\_t38 in Sangoma Asterisk 16.x before 16.16.2, 17.x before 17.9.3, and 18.x before 18.2.2, and Certified Asterisk before 16.8-cert7, (no CVSS)
- [CVE-2022-39028](https://cve.now/CVE-2022-39028.md): telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference via 0xff 0xf7 or 0xff (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-08-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.