CVEs published July 1, 2022
84 CVEs were published on July 1, 2022: 4 critical, 6 high.
- Published
- 84
- Critical
- 4
- High
- 6
- Medium
- 17
- Low
- 7
- Unrated
- 50
- Now in CISA KEV
- 0
- Fix available
- 28
Most affected products
- GitLab
- 17
- Distributed Data Systems WebHMI
- 2
- IBM UrbanCode Deploy
- 2
- Jboss Aerogear
- 2
- NVIDIA FLARE · nvflare
- 2
- bfabiszewski/libmobi
- 1
- git-clone
- 1
- IBM InfoSphere Information Server
- 1
- JetBrains Hub
- 1
- jsrsasign
- 1
Critical 4
- CVE-2022-31605NVFLARE, versions prior to 2.1.2, contains a vulnerability in its utils module, where YAML files are loaded via yaml.load() instead of yaml.NVIDIA FLARE · nvflare
- CVE-2022-31604NVFLARE, versions prior to 2.1.2, contains a vulnerability in its PKI implementation module, where The CA credentials are transported via piNVIDIA FLARE · nvflare
- CVE-2022-2185A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prGitLab
- CVE-2022-2253Distributed Data Systems WebHMI OS Command InjectionDistributed Data Systems WebHMI
High 6
- CVE-2022-25900Command Injectiongit-clone
- CVE-2022-25898Improper Verification of Cryptographic Signaturejsrsasign
- CVE-2022-2229An improper authorization issue in GitLab CE/EE affecting all versions from 13.7 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 1GitLab
- CVE-2022-2230A Stored Cross-Site Scripting vulnerability in the project settings page in GitLab CE/EE affecting all versions from 14.4 prior to 14.10.5, GitLab
- CVE-2022-2235Insufficient sanitization in GitLab EE's external issue tracker affecting all versions from 14.5 prior to 14.10.5, 15.0 prior to 15.0.4, andGitLab
- CVE-2022-2264Heap-based Buffer Overflow in vim/vimvim/vim
Medium, low and unrated 74
- CVE-2022-32551Zoho ManageEngine ServiceDesk Plus MSP before 10604 allows path traversal (to WEBINF/web.xml from sample/WEB-INF/web.xml or sample/META-INF/
- CVE-2022-32412An issue in the /template/edit component of HongCMS v3.0 allows attackers to getshell.
- CVE-2022-32411An issue in the languages config file of HongCMS v3.0 allows attackers to getshell.
- CVE-2022-32324PDFAlto v0.4 was discovered to contain a heap buffer overflow via the component /pdfalto/src/pdfalto.cc.
- CVE-2022-34903GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constrai
- CVE-2022-32095Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter at orders.php.
- CVE-2022-32094Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the loginid parameter at doctorlogin.php.
- CVE-2022-32093Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the loginid parameter at adminlogin.php.
- CVE-2022-32420College Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via /College/admin/teacher.php.
- CVE-2022-32384Tenda AC23 v16.03.07.44 was discovered to contain a stack overflow via the security_5g parameter in the function formWifiBasicSet.
- CVE-2022-31943MCMS v5.2.8 was discovered to contain an arbitrary file upload vulnerability.net.mingsoft:ms-mcms
- CVE-2022-25896Session Fixationpassport
- CVE-2022-25758Regular Expression Denial of Service (ReDoS)scss-tokenizer
- CVE-2022-25876Server-side Request Forgery (SSRF)link-preview-js
- CVE-2022-32088MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Exec_time_tracker::get_loops/Filesort_tracker::repor
- CVE-2022-32087MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_args::walk_args.
- CVE-2022-32086MariaDB v10.4 to v10.8 was discovered to contain a segmentation fault via the component Item_field::fix_outer_field.
- CVE-2022-32085MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_func_in::cleanup/Item::cleanup_processor.
- CVE-2022-32083MariaDB v10.2 to v10.6.1 was discovered to contain a segmentation fault via the component Item_subselect::init_expr_cache_tracker.
- CVE-2022-22373An improper validation vulnerability in IBM InfoSphere Information Server 11.7 Pack for SAP Apps and BW Packs may lead to creation of directIBM InfoSphere Information Server
- CVE-2022-22367IBM UrbanCode Deploy (UCD) 6.2.7.15, 7.0.5.10, 7.1.2.6, and 7.2.2.1 could disclose sensitive database information to a local user in plain tIBM UrbanCode Deploy
- CVE-2022-22366IBM UrbanCode Deploy (UCD) 6.2.7.15, 7.0.5.10, 7.1.2.6, and 7.2.2.1 stores user credentials in plain clear text which can be read by a localIBM UrbanCode Deploy
- CVE-2022-32030Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the list parameter in the function formSetQosBand.
- CVE-2022-32031Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the list parameter in the function fromSetRouteStatic.
- CVE-2022-32032Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the deviceList parameter in the function formAddMacfilterRule.
- CVE-2022-32033Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the function formSetVirtualSer.
- CVE-2022-32034Tenda M3 V1.0.0.12 was discovered to contain a stack overflow via the items parameter in the function formdelMasteraclist.
- CVE-2022-32035Tenda M3 V1.0.0.12 was discovered to contain a stack overflow via the function formMasterMng.
- CVE-2022-32036Tenda M3 V1.0.0.12 was discovered to contain multiple stack overflow vulnerabilities via the ssidList, storeName, and trademark parameters i
- CVE-2022-32037Tenda M3 V1.0.0.12 was discovered to contain a stack overflow via the function formSetAPCfg.
- CVE-2022-32039Tenda M3 V1.0.0.12 was discovered to contain a stack overflow via the listN parameter in the function fromDhcpListClient.
- CVE-2022-32040Tenda M3 V1.0.0.12 was discovered to contain a stack overflow via the function formSetCfm.
- CVE-2022-32041Tenda M3 V1.0.0.12 was discovered to contain a stack overflow via the function formGetPassengerAnalyseData.
- CVE-2022-32043Tenda M3 V1.0.0.12 was discovered to contain a stack overflow via the function formSetAccessCodeInfo.
- CVE-2022-32044TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the password parameter in the function FUN_00413f80.
- CVE-2022-32045TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN_00413be4.
- CVE-2022-32046TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN_0041880c.
- CVE-2022-32047TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN_00412ef4.
- CVE-2022-32048TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the command parameter in the function FUN_0041cc88.
- CVE-2022-32049TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the url parameter in the function FUN_00418540.
- CVE-2022-32050TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the cloneMac parameter in the function FUN_0041af40.
- CVE-2022-32051TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc, week, sTime, eTime parameters in the function F
- CVE-2022-32052TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN_004137a4.
- CVE-2022-32053TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the cloneMac parameter in the function FUN_0041621c.
- CVE-2021-37524Cross Site Scripting (XSS) vulnerability in FusionPBX 4.5.26 allows remote unauthenticated users to inject arbitrary web script or HTML via
- CVE-2022-0167An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.4.5, all versions starting from 14.5.0 before 14.GitLab
- CVE-2022-1954A Regular Expression Denial of Service vulnerability in GitLab CE/EE affecting all versions from 1.0.2 prior to 14.10.5, 15.0 prior to 15.0.GitLab
- CVE-2022-1963An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 14.10.5, all versions starting from 15.0 beforGitLab
- CVE-2022-2270An issue has been discovered in GitLab affecting all versions starting from 12.4 before 14.10.5, all versions starting from 15.0 before 15.0GitLab
- CVE-2022-31113Cross-Site Scripting in Canarytoken historythinkst canarytokens
- CVE-2022-2228Information exposure in GitLab EE affecting all versions from 12.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows aGitLab
- CVE-2022-1999An issue has been discovered in GitLab CE/EE affecting all versions from 8.13 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1GitLab
- CVE-2022-1981An issue has been discovered in GitLab EE affecting all versions starting from 12.2 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior tGitLab
- CVE-2022-1983Incorrect authorization in GitLab EE affecting all versions from 10.7 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, alloGitLab
- CVE-2022-2227Improper access control in the runner jobs API in GitLab CE/EE affecting all versions prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 priorGitLab
- CVE-2022-2243An access control vulnerability in GitLab EE/CE affecting all versions from 14.8 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 1GitLab
- CVE-2022-2281An information disclosure vulnerability in GitLab EE affecting all versions from 12.5 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 priorGitLab
- CVE-2022-2244An improper authorization vulnerability in GitLab EE/CE affecting all versions from 14.8 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prGitLab
- CVE-2022-2250An open redirect vulnerability in GitLab EE/CE affecting all versions from 11.1 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15GitLab
- CVE-2022-2254Distributed Data Systems WebHMI Cross-site ScriptingDistributed Data Systems WebHMI
- CVE-2014-3650Multiple persistent cross-site scripting (XSS) flaws were found in the way Aerogear handled certain user-supplied content.Jboss Aerogear
- CVE-2014-3648The simplepush server iterates through the application installations and pushes a notification to the server provided by deviceToken.Jboss Aerogear
- CVE-2022-33103Das U-Boot from v2020.10 to v2022.07-rc3 was discovered to contain an out-of-bounds write via the function sqfs_readdir().
- CVE-2022-33099An issue in the component luaG_runerror of Lua v5.4.4 and below leads to a heap-buffer overflow when a recursive error occurs.
- CVE-2022-34894In JetBrains Hub before 2022.2.14799, insufficient access control allowed the hijacking of untrusted servicesJetBrains Hub
- CVE-2022-2279NULL Pointer Dereference in bfabiszewski/libmobibfabiszewski/libmobi
- CVE-2022-2280Cross-site Scripting (XSS) - Stored in microweber/microwebermicroweber/microweber
- CVE-2022-2274RSA implementation bug in AVX512IFMA instructionsOpenSSL · openssl-src
- CVE-2022-32081MariaDB v10.4 to v10.7 was discovered to contain an use-after-poison in prepare_inplace_add_virtual at /storage/innobase/handler/handler0alt
- CVE-2022-32082MariaDB v10.5 to v10.7 was discovered to contain an assertion failure at table->get_ref_count() == 0 in dict0dict.cc.
- CVE-2022-32084MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component sub_select.
- CVE-2022-32089MariaDB v10.5 to v10.7 was discovered to contain a segmentation fault via the component st_select_lex_unit::exclude_level.
- CVE-2022-32091MariaDB v10.7 was discovered to contain an use-after-poison in in __interceptor_memset at /libsanitizer/sanitizer_common/sanitizer_common_in
- CVE-2022-32325JPEGOPTIM v1.4.7 was discovered to contain a segmentation violation which is caused by a READ memory access at jpegoptim.c.