# CVEs published 2022-09-01

69 CVEs were published on September 1, 2022: 3 critical, 2 high. Days are UTC.

- [CVE-2022-23452](https://cve.now/CVE-2022-23452.md): An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container. (no CVSS, openstack/barbican · barbican)
- [CVE-2022-3078](https://cve.now/CVE-2022-3078.md): An issue was discovered in the Linux kernel through 5.16-rc6. (no CVSS, Kernel)
- [CVE-2022-2739](https://cve.now/CVE-2022-2739.md): The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory included an incorrect version of podman (no CVSS, podman)
- [CVE-2022-2738](https://cve.now/CVE-2022-2738.md): The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory included an incorrect version of podman (no CVSS, podman)
- [CVE-2022-2639](https://cve.now/CVE-2022-2639.md): An integer coercion error was found in the openvswitch kernel module. (no CVSS, kernel)
- [CVE-2022-2447](https://cve.now/CVE-2022-2447.md): A flaw was found in Keystone. (no CVSS, openstack-keystone)
- [CVE-2022-2403](https://cve.now/CVE-2022-2403.md): A credentials leak was found in the OpenShift Container Platform. (no CVSS, Openshift)
- [CVE-2022-36622](https://cve.now/CVE-2022-36622.md): Samsung Electronics mTower v0.3.0 and earlier was discovered to contain a NULL pointer dereference via the function TEE\_GetObjectInfo1. (no CVSS)
- [CVE-2022-36621](https://cve.now/CVE-2022-36621.md): Samsung Electronics mTower v0.3.0 and earlier was discovered to contain a NULL pointer dereference via the function TEE\_AllocateTransientObj (no CVSS)
- [CVE-2022-2308](https://cve.now/CVE-2022-2308.md): A flaw was found in vDPA with VDUSE backend. (no CVSS, Linux kernel)
- [CVE-2022-2806](https://cve.now/CVE-2022-2806.md): It was found that the ovirt-log-collector/sosreport collects the RHV admin password unfiltered. (no CVSS, ovirt-log-collector · sosreport)
- [CVE-2022-2256](https://cve.now/CVE-2022-2256.md): A Stored Cross-site scripting (XSS) vulnerability was found in keycloak as shipped in Red Hat Single Sign-On 7. (no CVSS, keycloak · org.keycloak:keycloak-parent)
- [CVE-2022-2238](https://cve.now/CVE-2022-2238.md): A vulnerability was found in the search-api container in Red Hat Advanced Cluster Management for Kubernetes when a query in the search filte (no CVSS, Red Hat Advanced Cluster Management for Kubernetes)
- [CVE-2022-1902](https://cve.now/CVE-2022-1902.md): A flaw was found in the Red Hat Advanced Cluster Security for Kubernetes. (no CVSS, Red Hat Advanced Cluster Security for Kubernetes)
- [CVE-2022-1677](https://cve.now/CVE-2022-1677.md): In OpenShift Container Platform, a user with permissions to create or modify Routes can craft a payload that inserts a malformed entry into (no CVSS, Openshift)
- [CVE-2022-36604](https://cve.now/CVE-2022-36604.md): An access control issue in Canaan Avalon ASIC Miner 2020.3.30 and below allows unauthenticated attackers to arbitrarily change user password (no CVSS)
- [CVE-2022-36603](https://cve.now/CVE-2022-36603.md): InnoSilicon T3T+ t2t+\_soc\_20190911\_151433.swu was discovered to contain a remote code execution (RCE) vulnerability in the checkUrl function (no CVSS)
- [CVE-2022-36601](https://cve.now/CVE-2022-36601.md): The Eclipse TCF debug interface in JasMiner-X4-Server-20220621-090907 and below is open on port 1534. (no CVSS)
- [CVE-2022-36602](https://cve.now/CVE-2022-36602.md): InnoSilicon A10 a10\_20200924\_120556 was discovered to contain a remote code execution (RCE) vulnerability in the setPlatformAPI function. (no CVSS)
- [CVE-2022-36773](https://cve.now/CVE-2022-36773.md): IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. (CVSS 7.1, IBM Cognos Analytics)
- [CVE-2022-30614](https://cve.now/CVE-2022-30614.md): IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to a denial of service via email flooding caused by sending a specially-crafte (CVSS 6.5, IBM Cognos Analytics)
- [CVE-2021-39045](https://cve.now/CVE-2021-39045.md): IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a local attacker to obtain information due to the autocomplete feature on passwo (CVSS 6.2, IBM Cognos Analytics)
- [CVE-2021-39009](https://cve.now/CVE-2021-39009.md): IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 stores user credentials in plain clear text which can be read by a local privileged user. (CVSS 4.4, IBM Cognos Analytics)
- [CVE-2021-29823](https://cve.now/CVE-2021-29823.md): IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicio (CVSS 4.3, IBM Cognos Analytics)
- [CVE-2021-20468](https://cve.now/CVE-2021-20468.md): IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicio (CVSS 4.3, IBM Cognos Analytics)
- [CVE-2020-4301](https://cve.now/CVE-2020-4301.md): IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicio (CVSS 4.3, IBM Cognos Analytics)
- [CVE-2022-34380](https://cve.now/CVE-2022-34380.md): Dell CloudLink 7.1.3 and all earlier versions contain an Authentication Bypass Using an Alternate Path or Channel Vulnerability. (CVSS 9.3, Dell CloudLink)
- [CVE-2022-34379](https://cve.now/CVE-2022-34379.md): Dell EMC CloudLink 7.1.2 and all prior versions contain an Authentication Bypass Vulnerability. (CVSS 9.4, Dell CloudLink)
- [CVE-2022-34372](https://cve.now/CVE-2022-34372.md): Dell PowerProtect Cyber Recovery versions before 19.11.0.2 contain an authentication bypass vulnerability. (CVSS 9.8, Dell Cyber Recovery)
- [CVE-2020-27784](https://cve.now/CVE-2020-27784.md): A vulnerability was found in the Linux kernel, where accessing a deallocated instance in printer\_ioctl() printer\_ioctl() tries to access of (no CVSS, kernel)
- [CVE-2020-35533](https://cve.now/CVE-2020-35533.md): In LibRaw, an out-of-bounds read vulnerability exists within the "LibRaw::adobe\_copy\_pixel()" function (libraw\\src\\decoders\\dng.cpp) when re (no CVSS, LibRaw)
- [CVE-2020-35534](https://cve.now/CVE-2020-35534.md): In LibRaw, there is a memory corruption vulnerability within the "crxFreeSubbandData()" function (libraw\\src\\decoders\\crx.cpp) when processi (no CVSS, LibRaw)
- [CVE-2020-35535](https://cve.now/CVE-2020-35535.md): In LibRaw, there is an out-of-bounds read vulnerability within the "LibRaw::parseSonySRF()" function (libraw\\src\\metadata\\sony.cpp) when pro (no CVSS, LibRaw)
- [CVE-2020-35530](https://cve.now/CVE-2020-35530.md): In LibRaw, there is an out-of-bounds write vulnerability within the "new\_node()" function (libraw\\src\\x3f\\x3f\_utils\_patched.cpp) that can be (no CVSS, LibRaw)
- [CVE-2020-35531](https://cve.now/CVE-2020-35531.md): In LibRaw, an out-of-bounds read vulnerability exists within the get\_huffman\_diff() function (libraw\\src\\x3f\\x3f\_utils\_patched.cpp) when rea (no CVSS, LibRaw)
- [CVE-2020-35532](https://cve.now/CVE-2020-35532.md): In LibRaw, an out-of-bounds read vulnerability exists within the "simple\_decode\_row()" function (libraw\\src\\x3f\\x3f\_utils\_patched.cpp) which (no CVSS, LibRaw)
- [CVE-2022-36583](https://cve.now/CVE-2022-36583.md): DedeCMS V5.7.97 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities at /dede/co\_do.php via the dopost, rpok, and a (no CVSS)
- [CVE-2021-45027](https://cve.now/CVE-2021-45027.md): An arbitrary file download vulnerability in Oliver v5 Library Server Versions \< 5.00.008.053 via the FileServlet function allows for arbitra (no CVSS)
- [CVE-2022-36796](https://cve.now/CVE-2022-36796.md): WordPress CallRail Phone Call Tracking plugin \<= 0.4.9 - Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) (CVSS 6.1, CallRail Phone Call Tracking)
- [CVE-2022-36373](https://cve.now/CVE-2022-36373.md): WordPress MP3 jPlayer plugin \<= 2.7.3 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities (CVSS 5.4, Simon Ward MP3-jPlayer)
- [CVE-2022-36355](https://cve.now/CVE-2022-36355.md): WordPress Easy Org Chart plugin \<= 3.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 5.4, PluginlySpeaking Easy Org Chart)
- [CVE-2022-28199](https://cve.now/CVE-2022-28199.md): NVIDIA’s distribution of the Data Plane Development Kit (MLNX\_DPDK) contains a vulnerability in the network stack, where error recovery is n (CVSS 6.5, NVIDIA FLARE)
- [CVE-2022-37435](https://cve.now/CVE-2022-37435.md): Apache ShenYu Admin Improper Privilege Management (no CVSS, Apache Software Foundation Apache ShenYu · org.apache.sheny…)
- [CVE-2022-38790](https://cve.now/CVE-2022-38790.md): Weave GitOps Enterprise before 0.9.0-rc.5 has a cross-site scripting (XSS) bug allowing a malicious user to inject a javascript: link in the (no CVSS)
- [CVE-2022-36055](https://cve.now/CVE-2022-36055.md): Denial of service in Helm (CVSS 6.5, helm · helm.sh/helm/v3)
- [CVE-2022-36054](https://cve.now/CVE-2022-36054.md): Out-of-bounds write when decompressing 6LoWPAN payload in Contiki-NG (CVSS 6.8, contiki-ng)
- [CVE-2022-36052](https://cve.now/CVE-2022-36052.md): Out-of-bounds read when decompressing UDP header (CVSS 5.9, contiki-ng)
- [CVE-2022-36053](https://cve.now/CVE-2022-36053.md): Out-of-bounds read in the uIP buffer module (CVSS 5.9, contiki-ng)
- [CVE-2022-3072](https://cve.now/CVE-2022-3072.md): Cross-site Scripting (XSS) - Stored in francoisjacquet/rosariosis (CVSS 8.0, francoisjacquet/rosariosis)
- [CVE-2022-36449](https://cve.now/CVE-2022-36449.md): An issue was discovered in the Arm Mali GPU Kernel Driver. (no CVSS)
- [CVE-2022-36676](https://cve.now/CVE-2022-36676.md): Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /categories/view\_category (no CVSS)
- [CVE-2022-36675](https://cve.now/CVE-2022-36675.md): Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /schedules/manage\_schedul (no CVSS)
- [CVE-2022-36674](https://cve.now/CVE-2022-36674.md): Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /schedules/view\_schedule. (no CVSS)
- [CVE-2022-36672](https://cve.now/CVE-2022-36672.md): Novel-Plus v3.6.2 was discovered to contain a hard-coded JWT key located in the project config file. (no CVSS)
- [CVE-2022-36671](https://cve.now/CVE-2022-36671.md): Novel-Plus v3.6.2 was discovered to contain an arbitrary file download vulnerability via the background file download API. (no CVSS)
- [CVE-2022-36130](https://cve.now/CVE-2022-36130.md): HashiCorp Boundary up to 0.10.1 did not properly perform data integrity checks to ensure the resources were associated with the correct scop (no CVSS)
- [CVE-2020-35525](https://cve.now/CVE-2020-35525.md): In SQlite 3.31.1, a potential null pointer derreference was found in the INTERSEC query processing. (no CVSS, sqlite)
- [CVE-2020-35527](https://cve.now/CVE-2020-35527.md): In SQLite 3.31.1, there is an out of bounds access problem through ALTER TABLE for views that have a nested FROM clause. (no CVSS, sqlite)
- [CVE-2021-3826](https://cve.now/CVE-2021-3826.md): Heap/stack buffer overflow in the dlang\_lname function in d-demangle.c in libiberty allows attackers to potentially cause a denial of servic (no CVSS, gcc)
- [CVE-2022-1615](https://cve.now/CVE-2022-1615.md): In Samba, GnuTLS gnutls\_rnd() can fail and give predictable random values. (no CVSS, Samba)
- [CVE-2022-1632](https://cve.now/CVE-2022-1632.md): An Improper Certificate Validation attack was found in Openshift. (no CVSS, Openshift)
- [CVE-2022-1729](https://cve.now/CVE-2022-1729.md): A race condition was found the Linux kernel in perf\_event\_open() which can be exploited by an unprivileged user to gain root privileges. (no CVSS, linux kernel)
- [CVE-2022-2319](https://cve.now/CVE-2022-2319.md): A flaw was found in the Xorg-x11-server. (no CVSS, xorg-x11-server)
- [CVE-2022-2320](https://cve.now/CVE-2022-2320.md): A flaw was found in the Xorg-x11-server. (no CVSS, xorg-x11-server)
- [CVE-2022-2663](https://cve.now/CVE-2022-2663.md): An issue was found in the Linux kernel in nf\_conntrack\_irc where the message handling can be confused and incorrectly matches the message. (no CVSS, Linux kernel)
- [CVE-2022-2764](https://cve.now/CVE-2022-2764.md): A flaw was found in Undertow. (no CVSS, undertow)
- [CVE-2022-2996](https://cve.now/CVE-2022-2996.md): A flaw was found in the python-scciclient when making an HTTPS connection to a server where the server's certificate would not be verified. (no CVSS, python-scciclient)
- [CVE-2022-3061](https://cve.now/CVE-2022-3061.md): Found Linux Kernel flaw in the i740 driver. (no CVSS, Kernel)
- [CVE-2022-32743](https://cve.now/CVE-2022-32743.md): Samba does not validate the Validated-DNS-Host-Name right for the dNSHostName attribute which could permit unprivileged users to write it. (no CVSS, samba)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-09-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.