Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: August 2022

81 records · 8 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2022-36799
    42Plan

    This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented.

    HighCVSS 7.2No exploitEPSS 46%

    atlassian · jira data centerAug 1, 2022

  • CVE-2022-27255
    50Plan

    In Realtek eCos RSDK 1.5.7p1 and MSDK 4.9.4p1, the SIP ALG function that rewrites SDP data has a stack-based buffer overflow.

    CriticalCVSS 9.8Proof of conceptEPSS 36%

    realtek · ecos rsdk firmwareAug 1, 2022

  • CVE-2022-31188
    53Plan

    Server-Side Request Forgery Vulnerability in Computer Vision Annotation Tool (CVAT)

    CriticalCVSS 9.8Proof of conceptEPSS 48%

    cvat · computer vision annotation toolAug 1, 2022

  • CVE-2022-35919
    26Monitor

    Authenticated requests for server update admin API allows path traversal in minio

    LowCVSS 2.7Proof of conceptEPSS 52%

    minio · minioAug 1, 2022

  • CVE-2022-35737
    37Monitor

    SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a

    HighCVSS 7.5Proof of conceptEPSS 23%

    sqlite · sqliteAug 3, 2022

  • CVE-2022-34973
    35Monitor

    D-Link DIR820LA1_FW106B02 was discovered to contain a buffer overflow via the nextPage parameter at ping.ccp.

    HighCVSS 7.5No exploitEPSS 15%

    dlink · dir-820l firmwareAug 3, 2022

  • CVE-2022-34974
    46Plan

    D-Link DIR810LA1_FW102B22 was discovered to contain a command injection vulnerability via the Ping_addr function.

    CriticalCVSS 9.8No exploitEPSS 24%

    dlink · dir-810l firmwareAug 3, 2022

  • CVE-2022-35620
    49Plan

    D-LINK DIR-818LW A1:DIR818L_FW105b01 was discovered to contain a remote code execution (RCE) vulnerability via the function binary.soapcgi_m

    CriticalCVSS 9.8No exploitEPSS 32%

    dlink · dir-818l firmwareAug 3, 2022

  • CVE-2022-27166
    50Plan

    XSS vulnerability on XHRHtml2Markup.jsp in JSPWiki 2.11.2

    MediumCVSS 6.1No exploitEPSS 85%

    apache · jspwikiAug 4, 2022

  • CVE-2022-28730
    50Plan

    Apache JSPWiki Cross-site scripting vulnerability on AJAXPreview.jsp

    MediumCVSS 6.1No exploitEPSS 85%

    apache · jspwikiAug 4, 2022

  • CVE-2022-28731
    43Plan

    Apache JSPWiki CSRF in UserPreferences.jsp

    MediumCVSS 6.5No exploitEPSS 57%

    apache · jspwikiAug 4, 2022

  • CVE-2022-28732
    49Plan

    Apache JSPWiki Cross-site scripting vulnerability on WeblogPlugin

    MediumCVSS 6.1No exploitEPSS 82%

    apache · jspwikiAug 4, 2022

  • CVE-2022-2651
    44Plan

    Authentication Bypass by Primary Weakness in bookwyrm-social/bookwyrm

    CriticalCVSS 9.8Proof of conceptEPSS 15%

    joinbookwyrm · bookwyrmAug 4, 2022

  • CVE-2022-31793
    35Monitor

    do_request in request.c in muhttpd before 1.1.7 allows remote attackers to read arbitrary files by constructing a URL with a single characte

    HighCVSS 7.5Proof of conceptEPSS 16%

    inglorion · muhttpdAug 4, 2022

  • CVE-2022-21186
    47Plan

    Arbitrary Command Injection

    CriticalCVSS 9.8No exploitEPSS 25%

    acrontum · filesystem-templateAug 5, 2022

  • CVE-2022-37434
    45Plan

    zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field.

    CriticalCVSS 9.8Proof of conceptEPSS 18%

    zlib · zlibAug 5, 2022

  • CVE-2022-31656
    46Plan

    VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain

    CriticalCVSS 9.8Proof of conceptEPSS 24%

    vmware · identity managerAug 5, 2022

  • CVE-2022-31660
    40Plan

    VMware Workspace ONE Access, Identity Manager and vRealize Automation contains a privilege escalation vulnerability.

    HighCVSS 7.8WeaponizedEPSS 1%

    vmware · identity managerAug 5, 2022

  • CVE-2022-36267
    55Plan

    In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Unauthenticated remote command injection vulnerability.

    CriticalCVSS 9.8Proof of conceptEPSS 54%

    airspan · airspot 5410 firmwareAug 8, 2022

  • CVE-2022-2733
    53Plan

    Cross-site Scripting (XSS) - Reflected in openemr/openemr

    MediumCVSS 6.1Proof of conceptEPSS 95%

    open-emr · openemrAug 9, 2022

  • CVE-2022-34713
    81Now

    Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 67%

    microsoft · windows 10 1507Aug 9, 2022

  • CVE-2022-34715
    63This week

    Windows Network File System Remote Code Execution Vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 80%

    microsoft · windows server 2022Aug 9, 2022

  • CVE-2022-36801
    44Plan

    Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Ref

    MediumCVSS 6.1No exploitEPSS 66%

    atlassian · jira data centerAug 9, 2022

  • CVE-2022-0028
    65This week

    PAN-OS: Reflected Amplification Denial-of-Service (DoS) Vulnerability in URL Filtering

    HighCVSS 8.6KEVWeaponizedEPSS 2%

    paloaltonetworks · pan-osAug 10, 2022

  • CVE-2022-20866
    35Monitor

    Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software RSA Private Key Leak Vulnerability

    HighCVSS 7.5Proof of conceptEPSS 17%

    cisco · adaptive security appliance softwareAug 10, 2022

  • CVE-2022-23238
    26Monitor

    Linux deployments of StorageGRID (formerly StorageGRID Webscale) versions 11.6.0 through 11.6.0.2 deployed with a Linux kernel version less

    MediumCVSS 6.5No exploitEPSS 0%

    linux · linux kernelAug 10, 2022

  • CVE-2022-32429
    62This week

    An authentication-bypass issue in the component http://MYDEVICEIP/cgi-bin-sdb/ExportSettings.sh of Mega System Technologies Inc MSNSwitch MN

    CriticalCVSS 9.8Proof of conceptEPSS 75%

    megatech · msnswitch firmwareAug 10, 2022

  • CVE-2022-37024
    59Plan

    Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 t

    HighCVSS 8.8No exploitEPSS 79%

    zohocorp · manageengine firewall analyzerAug 10, 2022

  • CVE-2022-38129
    45Plan

    A path traversal vulnerability exists in the com.keysight.tentacle.licensing.LicenseManager.addLicenseFile() method in the Keysight Sensor M

    CriticalCVSS 9.8No exploitEPSS 21%

    keysight · sensor management serverAug 10, 2022

  • CVE-2022-38130
    55Plan

    The com.keysight.tentacle.config.ResourceManager.smsRestoreDatabaseZip() method is used to restore the HSQLDB database used in SMS.

    CriticalCVSS 9.8Proof of conceptEPSS 54%

    keysight · sensor management serverAug 10, 2022

  • CVE-2022-35555
    47Plan

    A command injection vulnerability exists in /goform/exeCommand in Tenda W6 V1.0.0.9(4122), which allows attackers to construct cmdinput para

    CriticalCVSS 9.8No exploitEPSS 26%

    tenda · w6 firmwareAug 12, 2022

  • CVE-2022-35559
    43Plan

    A stack overflow vulnerability exists in /goform/setAutoPing in Tenda W6 V1.0.0.9(4122), which allows an attacker to construct ping1 paramet

    CriticalCVSS 9.8No exploitEPSS 11%

    tenda · w6 firmwareAug 12, 2022

  • CVE-2022-37042
    97Now

    Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it.

    CriticalCVSS 9.8KEVWeaponizedEPSS 91%

    synacor · zimbra collaboration suiteAug 12, 2022

  • CVE-2022-2314
    44Plan

    VR Calendar < 2.3.2 - Unauthenticated Arbitrary Function Call

    CriticalCVSS 9.8Proof of conceptEPSS 17%

    vr calendar project · vr calendarAug 15, 2022

  • CVE-2022-36309
    42Plan

    Airspan AirVelocity 1500 software versions prior to 15.18.00.2511 have a root command injection vulnerability in the ActiveBank parameter of

    HighCVSS 8.8No exploitEPSS 24%

    airspan · airvelocity 1500 firmwareAug 15, 2022

  • CVE-2022-37393
    40Plan

    Zimbra zmslapd arbitrary module load

    HighCVSS 7.8WeaponizedEPSS 1%

    zimbra · collaborationAug 16, 2022

  • CVE-2020-14321
    40Plan

    In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, teachers of a course were able to assign themselves the manager role within that course.

    HighCVSS 8.8WeaponizedEPSS 16%

    moodle · moodleAug 16, 2022

  • CVE-2022-34258
    40Plan

    Adobe Commerce Stored XSS Arbitrary code execution

    MediumCVSS 4.8No exploitEPSS 69%

    adobe · commerceAug 16, 2022

  • CVE-2022-1401
    36Monitor

    Insufficient validation of provided paths in Exago WrImageResource.axd

    HighCVSS 7.5No exploitEPSS 18%

    device42 · cmdbAug 16, 2022

  • CVE-2022-1373
    40Plan

    Softing Secure Integration Server Relative Path Traversal

    HighCVSS 7.2WeaponizedEPSS 12%

    softing · edgeaggregatorAug 17, 2022

  • CVE-2022-23747
    42Plan

    In Sony Xperia series 1, 5, and Pro, an out of bound memory access can occur due to lack of validation of the number of frames being passed

    CriticalCVSS 9.8No exploitEPSS 10%

    sony · xperia 1 firmwareAug 17, 2022

  • CVE-2022-2334
    40Plan

    Softing Secure Integration Server Uncontrolled Search Path Element

    HighCVSS 7.2WeaponizedEPSS 12%

    softing · edgeaggregatorAug 17, 2022

  • CVE-2022-37060
    36Monitor

    FLIR AX8 thermal sensor cameras version up to and including 1.46.16 is vulnerable to Directory Traversal due to an improper access restricti

    HighCVSS 7.5No exploitEPSS 18%

    flir · flir ax8 firmwareAug 18, 2022

  • CVE-2022-37061
    69This week

    All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to Remote Command Injection.

    CriticalCVSS 9.8WeaponizedEPSS 99%

    flir · flir ax8 firmwareAug 18, 2022

  • CVE-2022-29805
    47Plan

    A Java Deserialization vulnerability in the Fishbowl Server in Fishbowl Inventory before 2022.4.1 allows remote attackers to execute arbitra

    CriticalCVSS 9.8No exploitEPSS 27%

    fishbowlinventory · fishbowlAug 19, 2022

  • CVE-2022-2551
    35Monitor

    Duplicator < 1.4.7 - Unauthenticated Backup Download

    HighCVSS 7.5Proof of conceptEPSS 17%

    awesomemotive · duplicatorAug 22, 2022

  • CVE-2022-2552
    25Monitor

    Duplicator < 1.4.7.1 - Unauthenticated System Information Disclosure

    MediumCVSS 5.3Proof of conceptEPSS 12%

    awesomemotive · duplicatorAug 22, 2022

  • CVE-2022-37134
    46Plan

    D-link DIR-816 A2_v1.10CNB04.img is vulnerable to Buffer Overflow via /goform/form2Wan.cgi.

    CriticalCVSS 9.8No exploitEPSS 21%

    dlink · dir-816 firmwareAug 22, 2022

  • CVE-2022-35583
    44Plan

    wkhtmlTOpdf 0.12.6 is vulnerable to SSRF which allows an attacker to get initial access into the target's system by injecting iframe tag wit

    CriticalCVSS 9.8Proof of conceptEPSS 16%

    wkhtmltopdf · wkhtmltopdfAug 22, 2022

  • CVE-2022-30534
    57Plan

    An OS command injection vulnerability exists in the aVideoEncoder chunkfile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364

    HighCVSS 8.8No exploitEPSS 74%

    wwbn · avideoAug 22, 2022

  • CVE-2022-30547
    58Plan

    A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364.

    CriticalCVSS 9.9No exploitEPSS 63%

    wwbn · avideoAug 22, 2022

  • CVE-2022-30690
    49Plan

    A cross-site scripting (xss) vulnerability exists in the image403 functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364.

    MediumCVSS 6.1No exploitEPSS 83%

    wwbn · avideoAug 22, 2022

  • CVE-2022-32572
    42Plan

    An os command injection vulnerability exists in the aVideoEncoder wget functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364.

    HighCVSS 8.8No exploitEPSS 24%

    wwbn · avideoAug 22, 2022

  • CVE-2021-42627
    58Plan

    The WAN configuration page "wan.htm" on D-Link DIR-615 devices with firmware 20.06 can be accessed directly without authentication which can

    CriticalCVSS 9.8Proof of conceptEPSS 63%

    dlink · dir-615 firmwareAug 23, 2022

  • CVE-2022-37113
    44Plan

    Bluecms 1.6 has SQL injection in line 132 of admin/area.php

    CriticalCVSS 9.8No exploitEPSS 15%

    bluecms project · bluecmsAug 23, 2022

  • CVE-2022-36633
    50Plan

    Teleport 9.3.6 is vulnerable to Command injection leading to Remote Code Execution.

    HighCVSS 8.8Proof of conceptEPSS 50%

    goteleport · teleportAug 24, 2022

  • CVE-2022-2234
    48Plan

    mySCADA myPRO Command Injection

    HighCVSS 8.8No exploitEPSS 43%

    myscada · myproAug 24, 2022

  • CVE-2022-32893
    68This week

    An out-of-bounds write issue was addressed with improved bounds checking.

    HighCVSS 8.8KEVWeaponizedEPSS 9%

    apple · safariAug 24, 2022

  • CVE-2022-32894
    62This week

    An out-of-bounds write issue was addressed with improved bounds checking.

    HighCVSS 7.8KEVWeaponizedEPSS 3%

    apple · ipadosAug 24, 2022

  • CVE-2022-36804
    95Now

    Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10,

    HighCVSS 8.8KEVWeaponizedEPSS 99%

    atlassian · bitbucketAug 25, 2022

  • CVE-2022-36509
    34Monitor

    H3C GR3200 MiniGR1B0V100R014 was discovered to contain a command injection vulnerability via the param parameter at DelL2tpLNSList.

    HighCVSS 7.8No exploitEPSS 10%

    h3c · gr3200 firmwareAug 25, 2022

  • CVE-2022-36510
    34Monitor

    H3C GR2200 MiniGR1A0V100R014 was discovered to contain a command injection vulnerability via the param parameter at DelL2tpLNSList.

    HighCVSS 7.8No exploitEPSS 10%

    h3c · gr2200 firmwareAug 25, 2022

  • CVE-2022-37070
    42Plan

    H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a command injection vulnerability via the param parameter at DelL2tpLNSList.

    CriticalCVSS 9.8No exploitEPSS 10%

    h3c · gr-1200w firmwareAug 25, 2022

  • CVE-2022-37159
    47Plan

    Claroline 13.5.7 and prior is vulnerable to Remote code execution via arbitrary file upload.

    CriticalCVSS 9.8No exploitEPSS 27%

    claroline · clarolineAug 25, 2022

  • CVE-2022-31499
    58Plan

    Nortek Linear eMerge E3-Series devices before 0.32-08f allow an unauthenticated attacker to inject OS commands via ReaderNo.

    CriticalCVSS 9.8Proof of conceptEPSS 64%

    nortekcontrol · emerge e3 firmwareAug 25, 2022

  • CVE-2022-36537
    89Now

    ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent

    HighCVSS 7.5KEVWeaponizedEPSS 95%

    zkoss · zk frameworkAug 26, 2022

  • CVE-2022-37057
    47Plan

    D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Command Injection via cgibin, ssdpcgi_main.

    CriticalCVSS 9.8No exploitEPSS 25%

    dlink · go-rt-ac750 firmwareAug 28, 2022

  • CVE-2022-37055
    86Now

    D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Buffer Overflow via cgibin, hnap_main,

    CriticalCVSS 9.8KEVWeaponizedEPSS 55%

    dlink · go-rt-ac750 firmwareAug 28, 2022

  • CVE-2022-37056
    42Plan

    D-Link GO-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 is vulnerable to Command Injection via /cgibin, hnap_main,

    CriticalCVSS 9.8No exploitEPSS 10%

    dlink · go-rt-ac750 firmwareAug 28, 2022

  • CVE-2022-36572
    46Plan

    Sinsiu Sinsiu Enterprise Website System v1.1.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /up

    CriticalCVSS 9.8No exploitEPSS 22%

    sinsiu · enterprise website systemAug 28, 2022

  • CVE-2022-34668
    42Plan

    NVFLARE, versions prior to 2.1.4, contains a vulnerability that deserialization of Untrusted Data due to Pickle usage may allow an unprivile

    CriticalCVSS 9.8Proof of conceptEPSS 10%

    nvidia · nvflareAug 28, 2022

  • CVE-2022-22897
    43Plan

    A SQL injection vulnerability in the product_all_one_img and image_product parameters of the ApolloTheme AP PageBuilder component through 2.

    CriticalCVSS 9.8Proof of conceptEPSS 13%

    apollotheme · ap pagebuilderAug 29, 2022

  • CVE-2022-32548
    49Plan

    An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1.

    CriticalCVSS 9.8Proof of conceptEPSS 33%

    draytek · vigor3910 firmwareAug 29, 2022

  • CVE-2022-1043
    40Plan

    A flaw was found in the Linux kernel’s io_uring implementation.

    HighCVSS 8.8WeaponizedEPSS 3%

    linux · linux kernelAug 29, 2022

  • CVE-2022-38772
    58Plan

    Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 125658, 1260

    HighCVSS 8.8No exploitEPSS 78%

    zohocorp · manageengine netflow analyzerAug 29, 2022

  • CVE-2022-36553
    66This week

    Hytec Inter HWL-2511-SS v1.05 and below was discovered to contain a command injection vulnerability via the component /www/cgi-bin/popen.cgi

    CriticalCVSS 9.8Proof of conceptEPSS 90%

    hytec · hwl-2511-ss firmwareAug 29, 2022

  • CVE-2022-1552
    40Plan

    A flaw was found in PostgreSQL.

    HighCVSS 8.8No exploitEPSS 15%

    postgresql · postgresqlAug 31, 2022

  • CVE-2022-37122
    37Monitor

    Carel pCOWeb HVAC BACnet Gateway 2.1.0, Firmware: A2.1.0 - B2.1.0, Application Software: 2.15.4A Software v16 13020200 suffers from an unaut

    HighCVSS 7.5Proof of conceptEPSS 23%

    carel · pcoweb card firmwareAug 31, 2022

  • CVE-2022-37128
    46Plan

    In D-Link DIR-816 A2_v1.10CNB04.img the network can be initialized without authentication via /goform/wizard_end.

    CriticalCVSS 9.8No exploitEPSS 21%

    dlink · dir-816 firmwareAug 31, 2022

  • CVE-2022-36620
    37Monitor

    D-link DIR-816 A2_v1.10CNB04, DIR-878 DIR_878_FW1.30B08.img is vulnerable to Buffer Overflow via /goform/addRouting.

    HighCVSS 7.5No exploitEPSS 23%

    dlink · dir-816 firmwareAug 31, 2022

  • CVE-2022-37130
    47Plan

    In D-Link DIR-816 A2_v1.10CNB04, DIR-878 DIR_878_FW1.30B08.img a command injection vulnerability occurs in /goform/Diagnosis, after the cond

    CriticalCVSS 9.8No exploitEPSS 26%

    dlink · dir-816 firmwareAug 31, 2022