# CVEs published 2022-07-05

31 CVEs were published on July 5, 2022: 0 critical, 4 high. Days are UTC.

- [CVE-2022-32413](https://cve.now/CVE-2022-32413.md): An arbitrary file upload vulnerability in Dice v4.2.0 allows attackers to execute arbitrary code via a crafted file. (no CVSS)
- [CVE-2022-34972](https://cve.now/CVE-2022-34972.md): So Filter Shop v3.x was discovered to contain multiple blind SQL injection vulnerabilities via the att\_value\_id , manu\_value\_id… (no CVSS)
- [CVE-2022-32311](https://cve.now/CVE-2022-32311.md): Ingredient Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at… (no CVSS)
- [CVE-2022-32310](https://cve.now/CVE-2022-32310.md): An access control issue in Ingredient Stock Management System v1.0 allows attackers to take over user accounts via a crafted POST request… (no CVSS)
- [CVE-2022-31856](https://cve.now/CVE-2022-31856.md): Newsletter Module v3.x was discovered to contain a SQL injection vulnerability via the zemez\_newsletter\_email parameter at /index.php. (no CVSS)
- [CVE-2022-2321](https://cve.now/CVE-2022-2321.md): Improper Restriction of Excessive Authentication Attempts in heroiclabs/nakama (CVSS 7.5, heroiclabs/nakama · github.com/heroiclabs/nakama/v3)
- [CVE-2022-31116](https://cve.now/CVE-2022-31116.md): Incorrect handling of invalid surrogate pair characters in ujson (CVSS 7.5, ultrajson · ujson)
- [CVE-2022-33075](https://cve.now/CVE-2022-33075.md): A stored cross-site scripting (XSS) vulnerability in the Add Classification function of Zoo Management System v1.0 allows attackers to… (no CVSS)
- [CVE-2022-31117](https://cve.now/CVE-2022-31117.md): Double free of buffer during string decoding in ujson (CVSS 5.9, ultrajson · ujson)
- [CVE-2022-31014](https://cve.now/CVE-2022-31014.md): SMTP Command Injection in iCalendar Attachments to emails via newlines in Nextcloud Server (CVSS 5.4, nextcloud security-advisories)
- [CVE-2021-44915](https://cve.now/CVE-2021-44915.md): Taocms 3.0.2 was discovered to contain a blind SQL injection vulnerability via the function Edit category. (no CVSS)
- [CVE-2022-31770](https://cve.now/CVE-2022-31770.md): IBM App Connect Enterprise Certified Container 4.2 could allow a user from the administration console to cause a denial of service by… (CVSS 4.9, IBM App Connect Enterprise Certified Container)
- [CVE-2022-34879](https://cve.now/CVE-2022-34879.md): VICIDial 2.14b0.5 SVN 3550 was discovered to contain multiple Cross Site Scripting (XSS) vulnerabilities at /vicidial/admin.php. (CVSS 6.5, VICIdial)
- [CVE-2022-34878](https://cve.now/CVE-2022-34878.md): VICIDial 2.14b0.5 SVN 3550 was discovered to contain a SQL injection vulnerability at /vicidial/user\_stats.php. (CVSS 5.5, VICIdial)
- [CVE-2022-34877](https://cve.now/CVE-2022-34877.md): VICIDial 2.14b0.5 SVN 3550 was discovered to contains a SQL injection vulnerability at /vicidial/AST\_agent\_time\_sheet.php. (CVSS 6.4, VICIdial)
- [CVE-2022-34876](https://cve.now/CVE-2022-34876.md): VICIDial 2.14b0.5 SVN 3550 was discovered to contain multiple SQL injection vulnerability at /vicidial/admin.php. (CVSS 5.5, VICIdial)
- [CVE-2022-33742](https://cve.now/CVE-2022-33742.md): Linux disk/nic frontends data leaks T\[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities… (no CVSS, Linux · xen)
- [CVE-2022-33741](https://cve.now/CVE-2022-33741.md): Linux disk/nic frontends data leaks T\[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities… (no CVSS, Linux · xen)
- [CVE-2022-33740](https://cve.now/CVE-2022-33740.md): Linux disk/nic frontends data leaks T\[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities… (no CVSS, Linux · xen)
- [CVE-2022-26365](https://cve.now/CVE-2022-26365.md): Linux disk/nic frontends data leaks T\[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities… (no CVSS, Linux · xen)
- [CVE-2022-33743](https://cve.now/CVE-2022-33743.md): network backend may cause Linux netfront to use freed SKBs While adding logic to support XDP (eXpress Data Path), a code label was moved… (no CVSS, Linux)
- [CVE-2022-33744](https://cve.now/CVE-2022-33744.md): Arm guests can cause Dom0 DoS via PV devices When mapping pages of guests on Arm, dom0 is using an rbtree to keep track of the foreign… (no CVSS, Linux)
- [CVE-2022-30290](https://cve.now/CVE-2022-30290.md): In OpenCTI through 5.2.4, a broken access control vulnerability has been identified in the profile endpoint. (no CVSS, pycti)
- [CVE-2022-30289](https://cve.now/CVE-2022-30289.md): A stored Cross-site Scripting (XSS) vulnerability was identified in the Data Import functionality of OpenCTI through 5.2.4. (no CVSS, pycti)
- [CVE-2021-43702](https://cve.now/CVE-2021-43702.md): ASUS RT-A88U 3.0.0.4.386\_45898 is vulnerable to Cross Site Scripting (XSS). (no CVSS)
- [CVE-2022-2097](https://cve.now/CVE-2022-2097.md): AES OCB fails to encrypt some bytes (no CVSS, OpenSSL · openssl-src)
- [CVE-2022-2309](https://cve.now/CVE-2022-2309.md): NULL Pointer Dereference in lxml/lxml (CVSS 5.3, lxml/lxml · lxml)
- [CVE-2022-2306](https://cve.now/CVE-2022-2306.md): Insufficient Session Expiration in heroiclabs/nakama (CVSS 8.2, heroiclabs/nakama · github.com/heroiclabs/nakama)
- [CVE-2021-43116](https://cve.now/CVE-2021-43116.md): An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on login to capture… (no CVSS, com.alibaba.nacos:nacos-client)
- [CVE-2022-2304](https://cve.now/CVE-2022-2304.md): Stack-based Buffer Overflow in vim/vim (CVSS 7.8, vim/vim)
- [CVE-2022-31836](https://cve.now/CVE-2022-31836.md): The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to cross directory risk. (no CVSS, github.com/astaxie/beego · github.com/beego/beego +1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2022-07-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.