CVE-2022 records published in August 2022
Page three of three: records 2,001 to 2,086 of the 2,086 published in August 2022, newest first. The first page carries the figures for August 2022.
| CVE | Summary | CVSS | EPSS | Published | Signals |
|---|---|---|---|---|---|
| CVE-2022-31190 | Metadata of withdrawn Items is exposed to anonymous users in DSpace XMLUI | 5.3CNA v3.1 | 0.9% | 2022-08-01 | Fix |
| CVE-2022-31189 | Internal System Error page in DSpace JSPUI prints exceptions and stack traces without sanitization | 5.3CNA v3.1 | 0.7% | 2022-08-01 | Fix |
| CVE-2022-31188 | Server-side request forgery vulnerability in Computer Vision Annotation Tool (Cvat) | 8.6CNA v3.1 | 48.6% | 2022-08-01 | Exploit codeFix |
| CVE-2022-31186 | Leakage of excessive information into log in Next-auth | 3.3CNA v3.1 | 0.3% | 2022-08-01 | Fix |
| CVE-2022-31185 | Email addresses are not hidden regardless of selected state in mprweb | 5.3CNA v3.1 | 0.6% | 2022-08-01 | |
| CVE-2022-31184 | Email activation route can be abused by spammers in Discourse | 6.5CNA v3.1 | 0.7% | 2022-08-01 | Fix |
| CVE-2022-31183 | MTLS client verification is skipped in fs2 on Node.js | 9.1CNA v3.1 | 0.8% | 2022-08-01 | Fix |
| CVE-2022-31182 | Cache poisoning via maliciously-formed request in Discourse | 5.3CNA v3.1 | 0.8% | 2022-08-01 | Fix |
| CVE-2022-31181 | Remote code execution in PrestaShop | 9.8CNA v3.1 | 6.7% | 2022-08-01 | NucleiFix |
| CVE-2022-31180 | Insufficient escaping of whitespace in shescape | 9.8CNA v3.1 | 1.9% | 2022-08-01 | Fix |
| CVE-2022-31179 | Insufficient escaping of line feeds for CMD in shescape | 8.1CNA v3.1 | 1.4% | 2022-08-01 | Fix |
| CVE-2022-31178 | Improper authorization in eLabFTW | 4.3CNA v3.1 | 0.5% | 2022-08-01 | Fix |
| CVE-2022-31177 | Possible to infer sensitive information through query strings in Flask-AppBuilder | 2.7CNA v3.1 | 0.7% | 2022-08-01 | Fix |
| CVE-2022-31173 | Juniper is vulnerable to @DOS GraphQL Nested Fragments overflow | 7.5CNA v3.1 | 1.7% | 2022-08-01 | Fix |
| CVE-2022-31155 | Unauthorized overwriting of saved searches in Sourcegraph | 4.3CNA v3.1 | 0.5% | 2022-08-01 | Fix |
| CVE-2022-31154 | Indirect Object Access in Sourcegraph Code Monitoring | 6.4CNA v3.1 | 0.5% | 2022-08-01 | Fix |
| CVE-2022-31148 | Shopware customer module stored cross-site scripting | 5.4CNA v3.1 | 0.7% | 2022-08-01 | Fix |
| CVE-2022-31128 | Fine grained permissions are not checked in Tuleap | 5.4CNA v3.1 | 0.6% | 2022-08-01 | Fix |
| CVE-2022-31109 | HTTP host Header Attack vulnerability in laminas-diactoros | 7.2CNA v3.1 | 0.8% | 2022-08-01 | Fix |
| CVE-2022-30699 | NLnet Labs Unbound novel ghost domain names attack by updating almost expired delegation information | 6.5v3.1 | 1.1% | 2022-08-01 | Fix |
| CVE-2022-30698 | NLnet Labs Unbound novel ghost domain names attack by introducing subdomain delegations | 6.5v3.1 | 1.1% | 2022-08-01 | Fix |
| CVE-2022-30616 | IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a privileged user to elevate their privilege to platform administrator through manipulation of APIs. IBM X-Force ID: 227978. | 8.0CNA v3.0 | 0.9% | 2022-08-01 | Fix |
| CVE-2022-27255 | Realtek ECOS Rsdk stack-based buffer overflow | 9.8NVD v3.1 | 36.7% | 2022-08-01 | Emerging ThreatsExploit codeFix |
| CVE-2022-26445 | MediaTek chipsets improper input validation in wifi driver | 6.7v3.1 | 0.3% | 2022-08-01 | Fix |
| CVE-2022-26444 | MediaTek chipsets improper input validation in wifi driver | 6.7v3.1 | 0.3% | 2022-08-01 | Fix |
| CVE-2022-26443 | MediaTek chipsets improper input validation in wifi driver | 6.7v3.1 | 0.3% | 2022-08-01 | Fix |
| CVE-2022-26442 | MediaTek chipsets improper input validation in wifi driver | 6.7v3.1 | 0.3% | 2022-08-01 | Fix |
| CVE-2022-26441 | MediaTek chipsets improper input validation in wifi driver | 6.7v3.1 | 0.3% | 2022-08-01 | Fix |
| CVE-2022-26440 | MediaTek chipsets improper input validation in wifi driver | 6.7v3.1 | 0.3% | 2022-08-01 | Fix |
| CVE-2022-26439 | MediaTek chipsets improper input validation in wifi driver | 6.7v3.1 | 0.3% | 2022-08-01 | Fix |
| CVE-2022-26438 | MediaTek chipsets improper input validation in wifi driver | 6.7v3.1 | 0.3% | 2022-08-01 | Fix |
| CVE-2022-26437 | MediaTek MT2621, MT2625 out-of-bounds write in httpclient | 9.8v3.1 | 1.4% | 2022-08-01 | Fix |
| CVE-2022-26436 | MediaTek chipsets improper input validation in emi mpu | 4.4v3.1 | 0.1% | 2022-08-01 | Fix |
| CVE-2022-26435 | MediaTek chipsets access of resource using incompatible type (type confusion) in mailbox | 6.7v3.1 | 0.1% | 2022-08-01 | Fix |
| CVE-2022-26434 | MediaTek chipsets improper input validation in mailbox | 6.7v3.1 | 0.1% | 2022-08-01 | Fix |
| CVE-2022-26433 | MediaTek chipsets access of resource using incompatible type (type confusion) in mailbox | 6.7v3.1 | 0.1% | 2022-08-01 | Fix |
| CVE-2022-26432 | MediaTek chipsets improper input validation in mailbox | 6.7v3.1 | 0.1% | 2022-08-01 | Fix |
| CVE-2022-26431 | MediaTek chipsets improper input validation in mailbox | 6.7v3.1 | 0.1% | 2022-08-01 | Fix |
| CVE-2022-26430 | MediaTek chipsets access of resource using incompatible type (type confusion) in mailbox | 6.7v3.1 | 0.1% | 2022-08-01 | Fix |
| CVE-2022-26429 | MediaTek chipsets improper access control in cta | 7.8v3.1 | 0.1% | 2022-08-01 | Fix |
| CVE-2022-26428 | MediaTek chipsets video codec memory corruption | 6.4v3.1 | 0.1% | 2022-08-01 | Fix |
| CVE-2022-26427 | MediaTek chipsets improper input validation in camera isp | 6.7v3.1 | 0.1% | 2022-08-01 | Fix |
| CVE-2022-26426 | MediaTek chipsets improper input validation in camera isp | 6.7v3.1 | 0.1% | 2022-08-01 | Fix |
| CVE-2022-26310 | Artica PFMS Pandora FMS improper authorization in User Management to Vertical privilege escalation | 8.8v3.1 | 0.7% | 2022-08-01 | Fix |
| CVE-2022-26309 | Artica PFMS Pandora FMS Cross-Site request en Bulk operation (User operation) | 8.8v3.1 | 0.3% | 2022-08-01 | Fix |
| CVE-2022-26308 | Artica PFMS Pandora FMS improper access control in Configuration (Credential store) | 5.4v3.1 | 0.4% | 2022-08-01 | Fix |
| CVE-2022-22505 | IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 contains a vulnerability that could allow IBM tenant credentials to be exposed. IBM X-Force ID: 227288. | 4.6CNA v3.0 | 0.9% | 2022-08-01 | Fix |
| CVE-2022-22334 | IBM Robotic Process Automation tenant access controls vulnerability | 4.2CNA v3.0 | 0.5% | 2022-08-01 | Fix |
| CVE-2022-22326 | IBM DataPower Gateway incorrect authorization | 4.0CNA v3.0 | 0.2% | 2022-08-01 | Fix |
| CVE-2022-21792 | MediaTek chipsets improper input validation in camera isp | 6.7v3.1 | 0.1% | 2022-08-01 | Fix |
| CVE-2022-21791 | MediaTek chipsets improper input validation in camera isp | 4.4v3.1 | 0.1% | 2022-08-01 | Fix |
| CVE-2022-21790 | MediaTek chipsets improper input validation in camera isp | 4.4v3.1 | 0.1% | 2022-08-01 | Fix |
| CVE-2022-21789 | MediaTek chipsets audio ipi memory corruption | 6.4v3.1 | 0.2% | 2022-08-01 | Exploit codeFix |
| CVE-2022-21788 | MediaTek chipsets detection of error condition without action in scp | 6.7v3.1 | 0.1% | 2022-08-01 | Fix |
| CVE-2022-2598 | Out-of-bounds write to API in Vim/Vim | 5.5v3.1 | 1.1% | 2022-08-01 | Fix |
| CVE-2022-2596 | Inefficient regular expression complexity in node-fetch/node-fetch | 5.9NVD v3.1 | 1.3% | 2022-08-01 | Fix |
| CVE-2022-2595 | Improper authorization in kromitgmbh/titra | 10.0v3.1 | 1.3% | 2022-08-01 | Fix |
| CVE-2022-2591 | TEM FLEX-1085 reboot denial of service | 7.5v3.1 | 9.3% | 2022-08-01 | Exploit code |
| CVE-2022-2589 | Cross-site scripting (XSS) Reflected in beancount/Fava | 6.1v3.1 | 0.7% | 2022-08-01 | Fix |
| CVE-2022-2581 | Out-of-bounds read in Vim/Vim | 7.8v3.1 | 0.5% | 2022-08-01 | Fix |
| CVE-2022-2580 | Heap-based buffer overflow in Vim/Vim | 7.8v3.1 | 0.5% | 2022-08-01 | Fix |
| CVE-2022-2571 | Heap-based buffer overflow in Vim/Vim | 7.8v3.1 | 0.5% | 2022-08-01 | Fix |
| CVE-2022-2509 | GnuTLS PKCS7 signature verification double free | 7.5NVD v3.1 | 2.3% | 2022-08-01 | Fix |
| CVE-2022-2370 | YaySMTP WordPress plugin Subscriber+ SMTP credentials leak | 6.5NVD v3.1 | 0.9% | 2022-08-01 | Fix |
| CVE-2022-2369 | YaySMTP WordPress plugin Subscriber+ Logs disclosure | 4.3NVD v3.1 | 0.7% | 2022-08-01 | Fix |
| CVE-2022-2328 | Flexi Quote Rotator WordPress plugin Admin+ stored cross-site scripting | 4.8NVD v3.1 | 0.6% | 2022-08-01 | |
| CVE-2022-2325 | Invitation Based Registrations WordPress plugin Admin+ stored cross-site scripting | 4.8NVD v3.1 | 0.6% | 2022-08-01 | Fix |
| CVE-2022-2317 | Simple Membership WordPress plugin unauthenticated Membership privilege escalation | 9.8NVD v3.1 | 1.4% | 2022-08-01 | Fix |
| CVE-2022-2305 | Timersys Popup plugin settings stored cross-site scripting | 4.8NVD v3.1 | 0.6% | 2022-08-01 | |
| CVE-2022-2278 | Featured Image from URL WordPress plugin Admin+ stored cross-site scripting | 4.8NVD v3.1 | 0.6% | 2022-08-01 | Fix |
| CVE-2022-2273 | Simple Membership WordPress plugin Membership privilege escalation | 8.8NVD v3.1 | 1.2% | 2022-08-01 | Fix |
| CVE-2022-2260 | GiveWP WordPress plugin DoS via CSRF | 6.5NVD v3.1 | 0.4% | 2022-08-01 | Fix |
| CVE-2022-2245 | Counter Box WordPress plugin arbitrary Counter Activation/Deactivation via CSRF | 8.8NVD v3.1 | 0.5% | 2022-08-01 | Fix |
| CVE-2022-2241 | Featured Image from URL WordPress plugin arbitrary settings update to stored XSS via CSRF | 6.1NVD v3.1 | 0.6% | 2022-08-01 | Fix |
| CVE-2022-2215 | GiveWP WordPress plugin Admin+ stored cross-site scripting | 4.8NVD v3.1 | 0.6% | 2022-08-01 | Fix |
| CVE-2022-2184 | CAPTCHA 4WP WordPress plugin local file inclusion via CSRF | 8.8NVD v3.1 | 0.6% | 2022-08-01 | Fix |
| CVE-2022-2181 | Advanced WordPress Reset plugin reflected cross-site scripting | 6.1NVD v3.1 | 0.7% | 2022-08-01 | Fix |
| CVE-2022-2171 | Progressive License WordPress plugin CSRF to stored XSS | 5.4NVD v3.1 | 0.3% | 2022-08-01 | |
| CVE-2022-2170 | Microsoft Advertising Universal Event Tracking WordPress plugin Admin+ stored cross-site scripting | 4.8NVD v3.1 | 1.4% | 2022-08-01 | Fix |
| CVE-2022-1950 | Youzify WordPress plugin unauthenticated SQLi | 9.8NVD v3.1 | 5.9% | 2022-08-01 | NucleiFix |
| CVE-2022-1906 | Copyright Proof WordPress plugin reflected cross-site-scripting | 6.1NVD v3.1 | 1.1% | 2022-08-01 | Nuclei |
| CVE-2022-1600 | YOP Poll WordPress plugin IP spoofing | 5.3NVD v3.1 | 0.8% | 2022-08-01 | Fix |
| CVE-2022-1585 | Project Source Code Download WordPress plugin unauthenticated Backup download | 7.5NVD v3.1 | 1.1% | 2022-08-01 | |
| CVE-2022-1561 | Crafted backend URLs in Lura Project | 4.3v3.1 | 0.6% | 2022-08-01 | Fix |
| CVE-2022-1324 | Event Timeline WordPress plugin Admin+ stored cross-site scripting | 4.8NVD v3.1 | 0.6% | 2022-08-01 | |
| CVE-2022-0598 | Login with phone number WordPress plugin Multiple Admin+ stored XSS | 4.8NVD v3.1 | 0.7% | 2022-08-01 | Fix |