CVEs published August 31, 2022
87 CVEs were published on August 31, 2022: 3 critical, 21 high.
- Published
- 87
- Critical
- 3
- High
- 21
- Medium
- 8
- Low
- 1
- Unrated
- 54
- Now in CISA KEV
- 0
- Fix available
- 24
Most affected products
- libtiff
- 5
- Linux kernel
- 4
- Measuresoft ScadaPro Server
- 4
- Apache Software Foundation Apache Geode · org.apache.geode:…
- 3
- Kernel
- 3
- AutomationDirect C-more EA9
- 2
- AutomationDirect DirectLOGIC D0-06 series CPUs
- 2
- Delta Electronics CNCSoft
- 2
- kernel
- 2
- Measuresoft ScadaPro Server and Client
- 2
Critical 3
High 21
- CVE-2022-36051Broken Authorization in ZITADEL Actionszitadel · github.com/zitadel/zitadel
- CVE-2022-2896Measuresoft ScadaPro Server Use After FreeMeasuresoft ScadaPro Server
- CVE-2022-2894Measuresoft ScadaPro Server Untrusted Pointer DereferenceMeasuresoft ScadaPro Server
- CVE-2022-2897Measuresoft ScadaPro Server and Client Link FollowingMeasuresoft ScadaPro Server and Client
- CVE-2022-2895Measuresoft ScadaPro Server Stack-based Buffer OverflowMeasuresoft ScadaPro Server
- CVE-2022-2892Measuresoft ScadaPro Server Out-of-bounds WriteMeasuresoft ScadaPro Server
- CVE-2022-34383Dell Edge Gateway 5200 (EGW) versions before 1.03.10 contain an operating system command injection vulnerability.Dell Edge Gateway
- CVE-2022-34373Dell Command | Integration Suite for System Center, versions prior to 6.2.0, contains arbitrary file write vulnerability.Dell CPG SW
- CVE-2022-1841Out-of-bound write in tcp_flagszephyrproject-rtos zephyr
- CVE-2022-2043MOXA NPort 5110 Out-of-bounds WriteMOXA
- CVE-2022-2044MOXA NPort 5110 Out-of-bounds WriteMOXA
- CVE-2022-2866FATEK Automation FvDesigner Out-of-bounds WriteFATEK Automation FvDesigner
- CVE-2022-2004AutomationDirect DirectLOGIC with Ethernet Communication Uncontrolled Resource ConsumptionAutomationDirect DirectLOGIC D0-06 series CPUs
- CVE-2022-2003AutomationDirect DirectLOGIC with Serial Communication Cleartext TransmissionAutomationDirect DirectLOGIC D0-06 series CPUs
- CVE-2022-1405Delta Electronics CNCSoft Stack-based Buffer OverflowDelta Electronics CNCSoft
- CVE-2022-2006AutomationDirect C-more EA9 HMI Uncontrolled Search Path ElementAutomationDirect C-more EA9
- CVE-2022-2005AutomationDirect C-more EA9 HMI Cleartext TransmissionAutomationDirect C-more EA9
- CVE-2022-1271An arbitrary file write vulnerability was found in GNU gzip's zgrep utility.gzip, xz-utils
- CVE-2022-1888Fuji Electric Alpha7 PC Loader Fuji Electric Alpha7 PC LoaderFuji Electric Alpha7 PC Loader
- CVE-2022-36035Flux CLI Workload Injectionfluxcd flux2 · github.com/fluxcd/flux2
- CVE-2022-39046An issue was discovered in the GNU C Library (glibc) 2.36.
Medium, low and unrated 63
- CVE-2022-37123D-link DIR-816 A2_v1.10CNB04.img is vulnerable to Command injection via /goform/form2userconfig.cgi.
- CVE-2022-36619In D-link DIR-816 A2_v1.10CNB04.img,the network can be reset without authentication via /goform/setMAC.
- CVE-2022-37129D-Link DIR-816 A2_v1.10CNB04.img is vulnerable to Command Injection via /goform/SystemCommand.
- CVE-2022-37125D-link DIR-816 A2_v1.10CNB04.img is vulnerable to Command injection via /goform/NTPSyncWithHost.
- CVE-2022-2898Measuresoft ScadaPro Server and Client Link FollowingMeasuresoft ScadaPro Server and Client
- CVE-2022-36201Doctor’s Appointment System v1.0 is vulnerable to Blind SQLi via settings.php.
- CVE-2022-36202Doctor's Appointment System1.0 is vulnerable to Incorrect Access Control via edoc/patient/settings.php.
- CVE-2022-36203Doctor's Appointment System 1.0 is vulnerable to Cross Site Scripting (XSS) via the admin panel.
- CVE-2022-31233Unisphere for PowerMax versions before 9.2.3.15 contain a privilege escalation vulnerability.Dell Unisphere for PowerMax
- CVE-2022-36582An arbitrary file upload vulnerability in the component /php_action/createProduct.php of Garage Management System v1.0 allows attackers to e
- CVE-2022-36581Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via the user_email parameter at /admin/login.php.
- CVE-2022-36580An arbitrary file upload vulnerability in the component /admin/products/controller.php?action=add of Online Ordering System v2.3.2 allows at
- CVE-2022-36048IP address leak via image proxy bypass in Zulip Serverzulip
- CVE-2022-36571Tenda AC9 V15.03.05.19 was discovered to contain a stack overflow via the mask parameter at /goform/WanParameterSetting.
- CVE-2022-36570Tenda AC9 V15.03.05.19 was discovered to contain a stack overflow via the time parameter at /goform/SetLEDCfg.
- CVE-2022-36569Tenda AC9 V15.03.05.19 was discovered to contain a stack overflow via the deviceList parameter at /goform/setMacFilterCfg.
- CVE-2022-36568Tenda AC9 V15.03.05.19 was discovered to contain a stack overflow via the list parameter at /goform/setPptpUserList.
- CVE-2022-36046Unexpected server crash in Next.js version 12.2.3vercel next.js · next +1
- CVE-2022-37128In D-Link DIR-816 A2_v1.10CNB04.img the network can be initialized without authentication via /goform/wizard_end.
- CVE-2022-38812AeroCMS 0.1.1 is vulnerable to SQL Injection via the author parameter.
- CVE-2022-37184The application manage_website.php on Garage Management System 1.0 is vulnerable to Shell File Upload.
- CVE-2022-36566Rengine v1.3.0 was discovered to contain a command injection vulnerability via the scan engine function.
- CVE-2022-37183Piwigo 12.3.0 is vulnerable to Cross Site Scripting (XSS) via /search/1940/created-monthly-list.
- CVE-2022-28625A local disclosure of sensitive information vulnerability was discovered in HPE OneView version(s): Prior to 7.0 or 6.60.01.HPE OneView
- CVE-2022-26331Potential vulnerabilities have been identified in Micro Focus ArcSight Logger. The vulnerabilities could be remotely exploited resulting in Self Cross-Site Scripting (XSS).Micro Focus ArcSight Logger
- CVE-2022-26330Potential vulnerability has been identified in Micro Focus ArcSight Logger. The vulnerability could be remotely exploited resulting in Information Disclosure.Micro Focus ArcSight Logger
- CVE-2022-37122Carel pCOWeb HVAC BACnet Gateway 2.1.0, Firmware: A2.1.0 - B2.1.0, Application Software: 2.15.4A Software v16 13020200 suffers from an unaut
- CVE-2022-30318Honeywell ControlEdge through R151.1 uses Hard-coded Credentials.
- CVE-2022-2759Delta Electronics Delta Robot Automation Studio (DRAS) versions prior to 1.13.20 are affected by improper restrictions where the software prDelta Electronics Delta Robot Automation Studio
- CVE-2020-35538A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo.libjpeg-turbo
- CVE-2022-2758UpdateLS Industrial Systems (LSIS) Co. Ltd LS Electric XG5000… +5
- CVE-2022-1404Delta Electronics CNCSoft Out-of-bounds ReadDelta Electronics CNCSoft
- CVE-2022-1508An out-of-bounds read flaw was found in the Linux kernel’s io_uring module in the way a user triggers the io_read() function with some speciKernel
- CVE-2022-2466It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior.quarkus · io.quarkus:quarkus-core-parent
- CVE-2022-1263A NULL pointer dereference issue was found in KVM when releasing a vCPU with dirty ring support enabled.Kernel:KVM
- CVE-2022-1325A flaw was found in Clmg, where with the help of a maliciously crafted pandore or bmp file with modified dx and dy header field values it isClmg
- CVE-2022-1205A NULL pointer dereference flaw was found in the Linux kernel’s Amateur Radio AX.25 protocol functionality in the way a user connects with tKernel
- CVE-2022-1247An issue found in linux-kernel that leads to a race condition in rose_connect().Kernel
- CVE-2022-1974A use-after-free flaw was found in the Linux kernel's NFC core functionality due to a race condition between kobject creation and delete.Linux kernel
- CVE-2022-1975There is a sleep-in-atomic bug in /net/nfc/netlink.c that allows an attacker to crash the Linux kernel by simulating a nfc device from user-Linux kernel
- CVE-2022-2132A permissive list of allowed inputs flaw was found in DPDK.dpdk
- CVE-2022-2590A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only sharLinux kernel
- CVE-2022-30317Honeywell Experion LX through 2022-05-06 has Missing Authentication for a Critical Function.
- CVE-2022-27911[20220801] - Core - Multiple Full Path Disclosures because of missing '_JEXEC or die check'Joomla! Project Joomla! CMS
- CVE-2022-37023Apache Geode deserialization of untrusted data flaw when using REST API on Java 8 or Java 11Apache Software Foundation Apache Geode · org.apache.geode:…
- CVE-2022-37022Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 11Apache Software Foundation Apache Geode · org.apache.geode:…
- CVE-2022-37021Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 8.Apache Software Foundation Apache Geode · org.apache.geode:…
- CVE-2022-39047Freeciv before 2.6.7 and before 3.0.3 is prone to a buffer overflow vulnerability in the Modpack Installer utility's handling of the modpack
- CVE-2022-1259A flaw was found in Undertow.undertow
- CVE-2022-1319A flaw was found in Undertow.undertow
- CVE-2022-1354A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped() function.libtiff
- CVE-2022-1355A stack buffer overflow flaw was found in Libtiffs' tiffcp.c in main() function.libtiff
- CVE-2022-1552A flaw was found in PostgreSQL.postgresql
- CVE-2022-1976A flaw was found in the Linux kernel’s implementation of IO-URING.kernel
- CVE-2022-2153A flaw was found in the Linux kernel’s KVM when attempting to set a SynIC IRQ.kernel
- CVE-2022-2519There is a double free or corruption in rotateImage() at tiffcrop.c:8839 found in libtiff 4.4.0rc1libtiff
- CVE-2022-2520A flaw was found in libtiff 4.4.0rc1.libtiff
- CVE-2022-2521It was found in libtiff 4.4.0rc1 that there is an invalid pointer free operation in TIFFClose() at tif_close.c:131 called by tiffcrop.c:2522libtiff
- CVE-2022-3028A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_alLinux kernel
- CVE-2022-36620D-link DIR-816 A2_v1.10CNB04, DIR-878 DIR_878_FW1.30B08.img is vulnerable to Buffer Overflow via /goform/addRouting.
- CVE-2022-37130In D-Link DIR-816 A2_v1.10CNB04, DIR-878 DIR_878_FW1.30B08.img a command injection vulnerability occurs in /goform/Diagnosis, after the cond
- CVE-2022-38152An issue was discovered in wolfSSL before 5.5.0.
- CVE-2022-38153An issue was discovered in wolfSSL before 5.5.0 (when --enable-session-ticket is used); however, only version 5.3.0 is exploitable.