# CVEs published 2022-08-31

87 CVEs were published on August 31, 2022: 3 critical, 21 high. Days are UTC.

- [CVE-2022-37123](https://cve.now/CVE-2022-37123.md): D-link DIR-816 A2\_v1.10CNB04.img is vulnerable to Command injection via /goform/form2userconfig.cgi. (no CVSS)
- [CVE-2022-36619](https://cve.now/CVE-2022-36619.md): In D-link DIR-816 A2\_v1.10CNB04.img,the network can be reset without authentication via /goform/setMAC. (no CVSS)
- [CVE-2022-37129](https://cve.now/CVE-2022-37129.md): D-Link DIR-816 A2\_v1.10CNB04.img is vulnerable to Command Injection via /goform/SystemCommand. (no CVSS)
- [CVE-2022-36051](https://cve.now/CVE-2022-36051.md): Broken Authorization in ZITADEL Actions (CVSS 8.7, zitadel · github.com/zitadel/zitadel)
- [CVE-2022-37125](https://cve.now/CVE-2022-37125.md): D-link DIR-816 A2\_v1.10CNB04.img is vulnerable to Command injection via /goform/NTPSyncWithHost. (no CVSS)
- [CVE-2022-2898](https://cve.now/CVE-2022-2898.md): Measuresoft ScadaPro Server and Client Link Following (CVSS 6.1, Measuresoft ScadaPro Server and Client)
- [CVE-2022-2896](https://cve.now/CVE-2022-2896.md): Measuresoft ScadaPro Server Use After Free (CVSS 7.8, Measuresoft ScadaPro Server)
- [CVE-2022-2894](https://cve.now/CVE-2022-2894.md): Measuresoft ScadaPro Server Untrusted Pointer Dereference (CVSS 7.8, Measuresoft ScadaPro Server)
- [CVE-2022-2897](https://cve.now/CVE-2022-2897.md): Measuresoft ScadaPro Server and Client Link Following (CVSS 7.8, Measuresoft ScadaPro Server and Client)
- [CVE-2022-2895](https://cve.now/CVE-2022-2895.md): Measuresoft ScadaPro Server Stack-based Buffer Overflow (CVSS 7.8, Measuresoft ScadaPro Server)
- [CVE-2022-2892](https://cve.now/CVE-2022-2892.md): Measuresoft ScadaPro Server Out-of-bounds Write (CVSS 7.8, Measuresoft ScadaPro Server)
- [CVE-2022-36201](https://cve.now/CVE-2022-36201.md): Doctor’s Appointment System v1.0 is vulnerable to Blind SQLi via settings.php. (no CVSS)
- [CVE-2022-36202](https://cve.now/CVE-2022-36202.md): Doctor's Appointment System1.0 is vulnerable to Incorrect Access Control via edoc/patient/settings.php. (no CVSS)
- [CVE-2022-36203](https://cve.now/CVE-2022-36203.md): Doctor's Appointment System 1.0 is vulnerable to Cross Site Scripting (XSS) via the admin panel. (no CVSS)
- [CVE-2022-34383](https://cve.now/CVE-2022-34383.md): Dell Edge Gateway 5200 (EGW) versions before 1.03.10 contain an operating system command injection vulnerability. (CVSS 8.1, Dell Edge Gateway)
- [CVE-2022-34373](https://cve.now/CVE-2022-34373.md): Dell Command | Integration Suite for System Center, versions prior to 6.2.0, contains arbitrary file write vulnerability. (CVSS 7.3, Dell CPG SW)
- [CVE-2022-31233](https://cve.now/CVE-2022-31233.md): Unisphere for PowerMax versions before 9.2.3.15 contain a privilege escalation vulnerability. (CVSS 6.3, Dell Unisphere for PowerMax)
- [CVE-2022-36582](https://cve.now/CVE-2022-36582.md): An arbitrary file upload vulnerability in the component /php\_action/createProduct.php of Garage Management System v1.0 allows attackers to e (no CVSS)
- [CVE-2022-36581](https://cve.now/CVE-2022-36581.md): Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via the user\_email parameter at /admin/login.php. (no CVSS)
- [CVE-2022-36580](https://cve.now/CVE-2022-36580.md): An arbitrary file upload vulnerability in the component /admin/products/controller.php?action=add of Online Ordering System v2.3.2 allows at (no CVSS)
- [CVE-2022-1841](https://cve.now/CVE-2022-1841.md): Out-of-bound write in tcp\_flags (CVSS 7.2, zephyrproject-rtos zephyr)
- [CVE-2022-36048](https://cve.now/CVE-2022-36048.md): IP address leak via image proxy bypass in Zulip Server (CVSS 4.3, zulip)
- [CVE-2022-36571](https://cve.now/CVE-2022-36571.md): Tenda AC9 V15.03.05.19 was discovered to contain a stack overflow via the mask parameter at /goform/WanParameterSetting. (no CVSS)
- [CVE-2022-36570](https://cve.now/CVE-2022-36570.md): Tenda AC9 V15.03.05.19 was discovered to contain a stack overflow via the time parameter at /goform/SetLEDCfg. (no CVSS)
- [CVE-2022-36569](https://cve.now/CVE-2022-36569.md): Tenda AC9 V15.03.05.19 was discovered to contain a stack overflow via the deviceList parameter at /goform/setMacFilterCfg. (no CVSS)
- [CVE-2022-36568](https://cve.now/CVE-2022-36568.md): Tenda AC9 V15.03.05.19 was discovered to contain a stack overflow via the list parameter at /goform/setPptpUserList. (no CVSS)
- [CVE-2022-36046](https://cve.now/CVE-2022-36046.md): Unexpected server crash in Next.js version 12.2.3 (CVSS 5.3, vercel next.js · next +1)
- [CVE-2022-37128](https://cve.now/CVE-2022-37128.md): In D-Link DIR-816 A2\_v1.10CNB04.img the network can be initialized without authentication via /goform/wizard\_end. (no CVSS)
- [CVE-2022-38812](https://cve.now/CVE-2022-38812.md): AeroCMS 0.1.1 is vulnerable to SQL Injection via the author parameter. (no CVSS)
- [CVE-2022-37184](https://cve.now/CVE-2022-37184.md): The application manage\_website.php on Garage Management System 1.0 is vulnerable to Shell File Upload. (no CVSS)
- [CVE-2022-36566](https://cve.now/CVE-2022-36566.md): Rengine v1.3.0 was discovered to contain a command injection vulnerability via the scan engine function. (no CVSS)
- [CVE-2022-37183](https://cve.now/CVE-2022-37183.md): Piwigo 12.3.0 is vulnerable to Cross Site Scripting (XSS) via /search/1940/created-monthly-list. (no CVSS)
- [CVE-2022-2043](https://cve.now/CVE-2022-2043.md): MOXA NPort 5110 Out-of-bounds Write (CVSS 7.5, MOXA)
- [CVE-2022-2044](https://cve.now/CVE-2022-2044.md): MOXA NPort 5110 Out-of-bounds Write (CVSS 8.2, MOXA)
- [CVE-2022-2485](https://cve.now/CVE-2022-2485.md): AutomationDirect Stride Field I/O Cleartext Transmission of Sensitive Information (CVSS 9.6, AutomationDirect SIO-MB04RTDS · AutomationDirect SIO- MB… +9)
- [CVE-2022-2866](https://cve.now/CVE-2022-2866.md): FATEK Automation FvDesigner Out-of-bounds Write (CVSS 7.8, FATEK Automation FvDesigner)
- [CVE-2022-21941](https://cve.now/CVE-2022-21941.md): iSTAR Ultra (CVSS 10.0, Johnson Controls iSTAR Ultra)
- [CVE-2022-2004](https://cve.now/CVE-2022-2004.md): AutomationDirect DirectLOGIC with Ethernet Communication Uncontrolled Resource Consumption (CVSS 7.5, AutomationDirect DirectLOGIC D0-06 series CPUs)
- [CVE-2022-2003](https://cve.now/CVE-2022-2003.md): AutomationDirect DirectLOGIC with Serial Communication Cleartext Transmission (CVSS 7.7, AutomationDirect DirectLOGIC D0-06 series CPUs)
- [CVE-2022-28625](https://cve.now/CVE-2022-28625.md): A local disclosure of sensitive information vulnerability was discovered in HPE OneView version(s): Prior to 7.0 or 6.60.01. (no CVSS, HPE OneView)
- [CVE-2022-26331](https://cve.now/CVE-2022-26331.md): Potential vulnerabilities have been identified in Micro Focus ArcSight Logger. The vulnerabilities could be remotely exploited resulting in Self Cross-Site Scripting (XSS). (CVSS 6.1, Micro Focus ArcSight Logger)
- [CVE-2022-26330](https://cve.now/CVE-2022-26330.md): Potential vulnerability has been identified in Micro Focus ArcSight Logger. The vulnerability could be remotely exploited resulting in Information Disclosure. (CVSS 6.5, Micro Focus ArcSight Logger)
- [CVE-2022-37122](https://cve.now/CVE-2022-37122.md): Carel pCOWeb HVAC BACnet Gateway 2.1.0, Firmware: A2.1.0 - B2.1.0, Application Software: 2.15.4A Software v16 13020200 suffers from an unaut (no CVSS)
- [CVE-2022-30318](https://cve.now/CVE-2022-30318.md): Honeywell ControlEdge through R151.1 uses Hard-coded Credentials. (no CVSS)
- [CVE-2022-2759](https://cve.now/CVE-2022-2759.md): Delta Electronics Delta Robot Automation Studio (DRAS) versions prior to 1.13.20 are affected by improper restrictions where the software pr (CVSS 5.5, Delta Electronics Delta Robot Automation Studio)
- [CVE-2020-35538](https://cve.now/CVE-2020-35538.md): A crafted input file could cause a null pointer dereference in jcopy\_sample\_rows() when processed by libjpeg-turbo. (no CVSS, libjpeg-turbo)
- [CVE-2022-2758](https://cve.now/CVE-2022-2758.md): Update (CVSS 6.5, LS Industrial Systems (LSIS) Co. Ltd LS Electric XG5000… +5)
- [CVE-2022-1405](https://cve.now/CVE-2022-1405.md): Delta Electronics CNCSoft Stack-based Buffer Overflow (CVSS 7.8, Delta Electronics CNCSoft)
- [CVE-2022-1404](https://cve.now/CVE-2022-1404.md): Delta Electronics CNCSoft Out-of-bounds Read (CVSS 3.3, Delta Electronics CNCSoft)
- [CVE-2022-2006](https://cve.now/CVE-2022-2006.md): AutomationDirect C-more EA9 HMI Uncontrolled Search Path Element (CVSS 7.8, AutomationDirect C-more EA9)
- [CVE-2022-2005](https://cve.now/CVE-2022-2005.md): AutomationDirect C-more EA9 HMI Cleartext Transmission (CVSS 7.5, AutomationDirect C-more EA9)
- [CVE-2022-1508](https://cve.now/CVE-2022-1508.md): An out-of-bounds read flaw was found in the Linux kernel’s io\_uring module in the way a user triggers the io\_read() function with some speci (no CVSS, Kernel)
- [CVE-2022-2466](https://cve.now/CVE-2022-2466.md): It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior. (no CVSS, quarkus · io.quarkus:quarkus-core-parent)
- [CVE-2022-1263](https://cve.now/CVE-2022-1263.md): A NULL pointer dereference issue was found in KVM when releasing a vCPU with dirty ring support enabled. (no CVSS, Kernel:KVM)
- [CVE-2022-1271](https://cve.now/CVE-2022-1271.md): An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. (CVSS 8.8, gzip, xz-utils)
- [CVE-2022-1325](https://cve.now/CVE-2022-1325.md): A flaw was found in Clmg, where with the help of a maliciously crafted pandore or bmp file with modified dx and dy header field values it is (no CVSS, Clmg)
- [CVE-2022-1205](https://cve.now/CVE-2022-1205.md): A NULL pointer dereference flaw was found in the Linux kernel’s Amateur Radio AX.25 protocol functionality in the way a user connects with t (no CVSS, Kernel)
- [CVE-2022-1247](https://cve.now/CVE-2022-1247.md): An issue found in linux-kernel that leads to a race condition in rose\_connect(). (no CVSS, Kernel)
- [CVE-2022-1974](https://cve.now/CVE-2022-1974.md): A use-after-free flaw was found in the Linux kernel's NFC core functionality due to a race condition between kobject creation and delete. (no CVSS, Linux kernel)
- [CVE-2022-1975](https://cve.now/CVE-2022-1975.md): There is a sleep-in-atomic bug in /net/nfc/netlink.c that allows an attacker to crash the Linux kernel by simulating a nfc device from user- (no CVSS, Linux kernel)
- [CVE-2022-2132](https://cve.now/CVE-2022-2132.md): A permissive list of allowed inputs flaw was found in DPDK. (no CVSS, dpdk)
- [CVE-2022-1888](https://cve.now/CVE-2022-1888.md): Fuji Electric Alpha7 PC Loader Fuji Electric Alpha7 PC Loader (CVSS 7.8, Fuji Electric Alpha7 PC Loader)
- [CVE-2022-2590](https://cve.now/CVE-2022-2590.md): A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only shar (no CVSS, Linux kernel)
- [CVE-2022-30317](https://cve.now/CVE-2022-30317.md): Honeywell Experion LX through 2022-05-06 has Missing Authentication for a Critical Function. (no CVSS)
- [CVE-2022-36045](https://cve.now/CVE-2022-36045.md): Account takeover via cryptographically weak PRNG in NodeBB Forum (CVSS 9.0, NodeBB)
- [CVE-2022-36035](https://cve.now/CVE-2022-36035.md): Flux CLI Workload Injection (CVSS 7.7, fluxcd flux2 · github.com/fluxcd/flux2)
- [CVE-2022-27911](https://cve.now/CVE-2022-27911.md): \[20220801\] - Core - Multiple Full Path Disclosures because of missing '\_JEXEC or die check' (no CVSS, Joomla! Project Joomla! CMS)
- [CVE-2022-37023](https://cve.now/CVE-2022-37023.md): Apache Geode deserialization of untrusted data flaw when using REST API on Java 8 or Java 11 (no CVSS, Apache Software Foundation Apache Geode · org.apache.geode:…)
- [CVE-2022-37022](https://cve.now/CVE-2022-37022.md): Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 11 (no CVSS, Apache Software Foundation Apache Geode · org.apache.geode:…)
- [CVE-2022-37021](https://cve.now/CVE-2022-37021.md): Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 8. (no CVSS, Apache Software Foundation Apache Geode · org.apache.geode:…)
- [CVE-2022-39047](https://cve.now/CVE-2022-39047.md): Freeciv before 2.6.7 and before 3.0.3 is prone to a buffer overflow vulnerability in the Modpack Installer utility's handling of the modpack (no CVSS)
- [CVE-2022-1259](https://cve.now/CVE-2022-1259.md): A flaw was found in Undertow. (no CVSS, undertow)
- [CVE-2022-1319](https://cve.now/CVE-2022-1319.md): A flaw was found in Undertow. (no CVSS, undertow)
- [CVE-2022-1354](https://cve.now/CVE-2022-1354.md): A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped() function. (no CVSS, libtiff)
- [CVE-2022-1355](https://cve.now/CVE-2022-1355.md): A stack buffer overflow flaw was found in Libtiffs' tiffcp.c in main() function. (no CVSS, libtiff)
- [CVE-2022-1552](https://cve.now/CVE-2022-1552.md): A flaw was found in PostgreSQL. (no CVSS, postgresql)
- [CVE-2022-1976](https://cve.now/CVE-2022-1976.md): A flaw was found in the Linux kernel’s implementation of IO-URING. (no CVSS, kernel)
- [CVE-2022-2153](https://cve.now/CVE-2022-2153.md): A flaw was found in the Linux kernel’s KVM when attempting to set a SynIC IRQ. (no CVSS, kernel)
- [CVE-2022-2519](https://cve.now/CVE-2022-2519.md): There is a double free or corruption in rotateImage() at tiffcrop.c:8839 found in libtiff 4.4.0rc1 (no CVSS, libtiff)
- [CVE-2022-2520](https://cve.now/CVE-2022-2520.md): A flaw was found in libtiff 4.4.0rc1. (no CVSS, libtiff)
- [CVE-2022-2521](https://cve.now/CVE-2022-2521.md): It was found in libtiff 4.4.0rc1 that there is an invalid pointer free operation in TIFFClose() at tif\_close.c:131 called by tiffcrop.c:2522 (no CVSS, libtiff)
- [CVE-2022-3028](https://cve.now/CVE-2022-3028.md): A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm\_probe\_al (no CVSS, Linux kernel)
- [CVE-2022-36620](https://cve.now/CVE-2022-36620.md): D-link DIR-816 A2\_v1.10CNB04, DIR-878 DIR\_878\_FW1.30B08.img is vulnerable to Buffer Overflow via /goform/addRouting. (no CVSS)
- [CVE-2022-37130](https://cve.now/CVE-2022-37130.md): In D-Link DIR-816 A2\_v1.10CNB04, DIR-878 DIR\_878\_FW1.30B08.img a command injection vulnerability occurs in /goform/Diagnosis, after the cond (no CVSS)
- [CVE-2022-38152](https://cve.now/CVE-2022-38152.md): An issue was discovered in wolfSSL before 5.5.0. (no CVSS)
- [CVE-2022-38153](https://cve.now/CVE-2022-38153.md): An issue was discovered in wolfSSL before 5.5.0 (when --enable-session-ticket is used); however, only version 5.3.0 is exploitable. (no CVSS)
- [CVE-2022-39046](https://cve.now/CVE-2022-39046.md): An issue was discovered in the GNU C Library (glibc) 2.36. (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-08-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.