CVE-2022-37108

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

An injection vulnerability in the syslog-ng configuration wizard in Securonix Snypr 6.4 allows an application user with the "Manage Ingesters" permission to execute arbitrary code on remote ingesters by appending arbitrary text to text files that are executed by the system, such as users' crontab files. The patch for this was present in SNYPR version 6.4 Jun 2022 R3_[06170871], but may have been introduced sooner.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

No affected versions have been published.

Timeline

Published
Sep 7, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-371099.8patrickfuller camp up to and including commit bbd53a256ed70e79bd8758080936afbf6d738767 is vulnerable to Incorrect Access Control. Access to CVE-2022-37114.3A post-auth read-only SQL injection vulnerability allows users to read non-sensitive configuration database contents in the User Portal of SCVE-2022-371119.8BlueCMS 1.6 has SQL injection in line 132 of admin/article.phpCVE-2022-371129.8BlueCMS 1.6 has SQL injection in line 55 of admin/model.phpCVE-2022-371139.8Bluecms 1.6 has SQL injection in line 132 of admin/area.phpCVE-2022-371227.5Carel pCOWeb HVAC BACnet Gateway 2.1.0, Firmware: A2.1.0 - B2.1.0, Application Software: 2.15.4A Software v16 13020200 suffers from an unautCVE-2022-371238.8D-link DIR-816 A2_v1.10CNB04.img is vulnerable to Command injection via /goform/form2userconfig.cgi.CVE-2022-371259.8D-link DIR-816 A2_v1.10CNB04.img is vulnerable to Command injection via /goform/NTPSyncWithHost.CVE-2022-371289.8In D-Link DIR-816 A2_v1.10CNB04.img the network can be initialized without authentication via /goform/wizard_end.CVE-2022-371298.8D-Link DIR-816 A2_v1.10CNB04.img is vulnerable to Command Injection via /goform/SystemCommand. After the user passes in the command parameteCVE-2022-37138.8A code injection vulnerability allows adjacent attackers to execute code in the Wifi controller of Sophos Firewall releases older than versiCVE-2022-371309.8In D-Link DIR-816 A2_v1.10CNB04, DIR-878 DIR_878_FW1.30B08.img a command injection vulnerability occurs in /goform/Diagnosis, after the cond