# CVEs published 2022-07-01

84 CVEs were published on July 1, 2022: 4 critical, 6 high. Days are UTC.

- [CVE-2022-32551](https://cve.now/CVE-2022-32551.md): Zoho ManageEngine ServiceDesk Plus MSP before 10604 allows path traversal (to WEBINF/web.xml from sample/WEB-INF/web.xml or sample/META-INF/ (no CVSS)
- [CVE-2022-32412](https://cve.now/CVE-2022-32412.md): An issue in the /template/edit component of HongCMS v3.0 allows attackers to getshell. (no CVSS)
- [CVE-2022-32411](https://cve.now/CVE-2022-32411.md): An issue in the languages config file of HongCMS v3.0 allows attackers to getshell. (no CVSS)
- [CVE-2022-32324](https://cve.now/CVE-2022-32324.md): PDFAlto v0.4 was discovered to contain a heap buffer overflow via the component /pdfalto/src/pdfalto.cc. (no CVSS)
- [CVE-2022-34903](https://cve.now/CVE-2022-34903.md): GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constrai (no CVSS)
- [CVE-2022-32095](https://cve.now/CVE-2022-32095.md): Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter at orders.php. (no CVSS)
- [CVE-2022-32094](https://cve.now/CVE-2022-32094.md): Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the loginid parameter at doctorlogin.php. (no CVSS)
- [CVE-2022-32093](https://cve.now/CVE-2022-32093.md): Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the loginid parameter at adminlogin.php. (no CVSS)
- [CVE-2022-32420](https://cve.now/CVE-2022-32420.md): College Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via /College/admin/teacher.php. (no CVSS)
- [CVE-2022-32384](https://cve.now/CVE-2022-32384.md): Tenda AC23 v16.03.07.44 was discovered to contain a stack overflow via the security\_5g parameter in the function formWifiBasicSet. (no CVSS)
- [CVE-2022-31943](https://cve.now/CVE-2022-31943.md): MCMS v5.2.8 was discovered to contain an arbitrary file upload vulnerability. (no CVSS, net.mingsoft:ms-mcms)
- [CVE-2022-25896](https://cve.now/CVE-2022-25896.md): Session Fixation (CVSS 4.8, passport)
- [CVE-2022-25900](https://cve.now/CVE-2022-25900.md): Command Injection (CVSS 8.1, git-clone)
- [CVE-2022-25898](https://cve.now/CVE-2022-25898.md): Improper Verification of Cryptographic Signature (CVSS 7.7, jsrsasign)
- [CVE-2022-25758](https://cve.now/CVE-2022-25758.md): Regular Expression Denial of Service (ReDoS) (CVSS 5.3, scss-tokenizer)
- [CVE-2022-25876](https://cve.now/CVE-2022-25876.md): Server-side Request Forgery (SSRF) (CVSS 6.2, link-preview-js)
- [CVE-2022-32088](https://cve.now/CVE-2022-32088.md): MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Exec\_time\_tracker::get\_loops/Filesort\_tracker::repor (no CVSS)
- [CVE-2022-32087](https://cve.now/CVE-2022-32087.md): MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item\_args::walk\_args. (no CVSS)
- [CVE-2022-32086](https://cve.now/CVE-2022-32086.md): MariaDB v10.4 to v10.8 was discovered to contain a segmentation fault via the component Item\_field::fix\_outer\_field. (no CVSS)
- [CVE-2022-32085](https://cve.now/CVE-2022-32085.md): MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item\_func\_in::cleanup/Item::cleanup\_processor. (no CVSS)
- [CVE-2022-32083](https://cve.now/CVE-2022-32083.md): MariaDB v10.2 to v10.6.1 was discovered to contain a segmentation fault via the component Item\_subselect::init\_expr\_cache\_tracker. (no CVSS)
- [CVE-2022-22373](https://cve.now/CVE-2022-22373.md): An improper validation vulnerability in IBM InfoSphere Information Server 11.7 Pack for SAP Apps and BW Packs may lead to creation of direct (CVSS 4.6, IBM InfoSphere Information Server)
- [CVE-2022-22367](https://cve.now/CVE-2022-22367.md): IBM UrbanCode Deploy (UCD) 6.2.7.15, 7.0.5.10, 7.1.2.6, and 7.2.2.1 could disclose sensitive database information to a local user in plain t (CVSS 4.0, IBM UrbanCode Deploy)
- [CVE-2022-22366](https://cve.now/CVE-2022-22366.md): IBM UrbanCode Deploy (UCD) 6.2.7.15, 7.0.5.10, 7.1.2.6, and 7.2.2.1 stores user credentials in plain clear text which can be read by a local (CVSS 4.9, IBM UrbanCode Deploy)
- [CVE-2022-32030](https://cve.now/CVE-2022-32030.md): Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the list parameter in the function formSetQosBand. (no CVSS)
- [CVE-2022-32031](https://cve.now/CVE-2022-32031.md): Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the list parameter in the function fromSetRouteStatic. (no CVSS)
- [CVE-2022-32032](https://cve.now/CVE-2022-32032.md): Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the deviceList parameter in the function formAddMacfilterRule. (no CVSS)
- [CVE-2022-32033](https://cve.now/CVE-2022-32033.md): Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the function formSetVirtualSer. (no CVSS)
- [CVE-2022-32034](https://cve.now/CVE-2022-32034.md): Tenda M3 V1.0.0.12 was discovered to contain a stack overflow via the items parameter in the function formdelMasteraclist. (no CVSS)
- [CVE-2022-32035](https://cve.now/CVE-2022-32035.md): Tenda M3 V1.0.0.12 was discovered to contain a stack overflow via the function formMasterMng. (no CVSS)
- [CVE-2022-32036](https://cve.now/CVE-2022-32036.md): Tenda M3 V1.0.0.12 was discovered to contain multiple stack overflow vulnerabilities via the ssidList, storeName, and trademark parameters i (no CVSS)
- [CVE-2022-32037](https://cve.now/CVE-2022-32037.md): Tenda M3 V1.0.0.12 was discovered to contain a stack overflow via the function formSetAPCfg. (no CVSS)
- [CVE-2022-32039](https://cve.now/CVE-2022-32039.md): Tenda M3 V1.0.0.12 was discovered to contain a stack overflow via the listN parameter in the function fromDhcpListClient. (no CVSS)
- [CVE-2022-32040](https://cve.now/CVE-2022-32040.md): Tenda M3 V1.0.0.12 was discovered to contain a stack overflow via the function formSetCfm. (no CVSS)
- [CVE-2022-32041](https://cve.now/CVE-2022-32041.md): Tenda M3 V1.0.0.12 was discovered to contain a stack overflow via the function formGetPassengerAnalyseData. (no CVSS)
- [CVE-2022-32043](https://cve.now/CVE-2022-32043.md): Tenda M3 V1.0.0.12 was discovered to contain a stack overflow via the function formSetAccessCodeInfo. (no CVSS)
- [CVE-2022-32044](https://cve.now/CVE-2022-32044.md): TOTOLINK T6 V4.1.9cu.5179\_B20201015 was discovered to contain a stack overflow via the password parameter in the function FUN\_00413f80. (no CVSS)
- [CVE-2022-32045](https://cve.now/CVE-2022-32045.md): TOTOLINK T6 V4.1.9cu.5179\_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN\_00413be4. (no CVSS)
- [CVE-2022-32046](https://cve.now/CVE-2022-32046.md): TOTOLINK T6 V4.1.9cu.5179\_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN\_0041880c. (no CVSS)
- [CVE-2022-32047](https://cve.now/CVE-2022-32047.md): TOTOLINK T6 V4.1.9cu.5179\_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN\_00412ef4. (no CVSS)
- [CVE-2022-32048](https://cve.now/CVE-2022-32048.md): TOTOLINK T6 V4.1.9cu.5179\_B20201015 was discovered to contain a stack overflow via the command parameter in the function FUN\_0041cc88. (no CVSS)
- [CVE-2022-32049](https://cve.now/CVE-2022-32049.md): TOTOLINK T6 V4.1.9cu.5179\_B20201015 was discovered to contain a stack overflow via the url parameter in the function FUN\_00418540. (no CVSS)
- [CVE-2022-32050](https://cve.now/CVE-2022-32050.md): TOTOLINK T6 V4.1.9cu.5179\_B20201015 was discovered to contain a stack overflow via the cloneMac parameter in the function FUN\_0041af40. (no CVSS)
- [CVE-2022-32051](https://cve.now/CVE-2022-32051.md): TOTOLINK T6 V4.1.9cu.5179\_B20201015 was discovered to contain a stack overflow via the desc, week, sTime, eTime parameters in the function F (no CVSS)
- [CVE-2022-32052](https://cve.now/CVE-2022-32052.md): TOTOLINK T6 V4.1.9cu.5179\_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN\_004137a4. (no CVSS)
- [CVE-2022-32053](https://cve.now/CVE-2022-32053.md): TOTOLINK T6 V4.1.9cu.5179\_B20201015 was discovered to contain a stack overflow via the cloneMac parameter in the function FUN\_0041621c. (no CVSS)
- [CVE-2021-37524](https://cve.now/CVE-2021-37524.md): Cross Site Scripting (XSS) vulnerability in FusionPBX 4.5.26 allows remote unauthenticated users to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2022-31605](https://cve.now/CVE-2022-31605.md): NVFLARE, versions prior to 2.1.2, contains a vulnerability in its utils module, where YAML files are loaded via yaml.load() instead of yaml. (CVSS 9.8, NVIDIA FLARE · nvflare)
- [CVE-2022-31604](https://cve.now/CVE-2022-31604.md): NVFLARE, versions prior to 2.1.2, contains a vulnerability in its PKI implementation module, where The CA credentials are transported via pi (CVSS 9.8, NVIDIA FLARE · nvflare)
- [CVE-2022-0167](https://cve.now/CVE-2022-0167.md): An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.4.5, all versions starting from 14.5.0 before 14. (CVSS 3.1, GitLab)
- [CVE-2022-1954](https://cve.now/CVE-2022-1954.md): A Regular Expression Denial of Service vulnerability in GitLab CE/EE affecting all versions from 1.0.2 prior to 14.10.5, 15.0 prior to 15.0. (CVSS 4.3, GitLab)
- [CVE-2022-1963](https://cve.now/CVE-2022-1963.md): An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 14.10.5, all versions starting from 15.0 befor (CVSS 5.3, GitLab)
- [CVE-2022-2270](https://cve.now/CVE-2022-2270.md): An issue has been discovered in GitLab affecting all versions starting from 12.4 before 14.10.5, all versions starting from 15.0 before 15.0 (CVSS 3.5, GitLab)
- [CVE-2022-2229](https://cve.now/CVE-2022-2229.md): An improper authorization issue in GitLab CE/EE affecting all versions from 13.7 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 1 (CVSS 7.5, GitLab)
- [CVE-2022-31113](https://cve.now/CVE-2022-31113.md): Cross-Site Scripting in Canarytoken history (CVSS 6.3, thinkst canarytokens)
- [CVE-2022-2228](https://cve.now/CVE-2022-2228.md): Information exposure in GitLab EE affecting all versions from 12.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows a (CVSS 5.3, GitLab)
- [CVE-2022-1999](https://cve.now/CVE-2022-1999.md): An issue has been discovered in GitLab CE/EE affecting all versions from 8.13 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1 (CVSS 3.1, GitLab)
- [CVE-2022-1981](https://cve.now/CVE-2022-1981.md): An issue has been discovered in GitLab EE affecting all versions starting from 12.2 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior t (CVSS 2.7, GitLab)
- [CVE-2022-1983](https://cve.now/CVE-2022-1983.md): Incorrect authorization in GitLab EE affecting all versions from 10.7 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allo (CVSS 6.5, GitLab)
- [CVE-2022-2230](https://cve.now/CVE-2022-2230.md): A Stored Cross-Site Scripting vulnerability in the project settings page in GitLab CE/EE affecting all versions from 14.4 prior to 14.10.5, (CVSS 8.1, GitLab)
- [CVE-2022-2227](https://cve.now/CVE-2022-2227.md): Improper access control in the runner jobs API in GitLab CE/EE affecting all versions prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior (CVSS 3.1, GitLab)
- [CVE-2022-2243](https://cve.now/CVE-2022-2243.md): An access control vulnerability in GitLab EE/CE affecting all versions from 14.8 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 1 (CVSS 5.0, GitLab)
- [CVE-2022-2235](https://cve.now/CVE-2022-2235.md): Insufficient sanitization in GitLab EE's external issue tracker affecting all versions from 14.5 prior to 14.10.5, 15.0 prior to 15.0.4, and (CVSS 8.7, GitLab)
- [CVE-2022-2185](https://cve.now/CVE-2022-2185.md): A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 pr (CVSS 9.9, GitLab)
- [CVE-2022-2281](https://cve.now/CVE-2022-2281.md): An information disclosure vulnerability in GitLab EE affecting all versions from 12.5 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior (CVSS 2.6, GitLab)
- [CVE-2022-2244](https://cve.now/CVE-2022-2244.md): An improper authorization vulnerability in GitLab EE/CE affecting all versions from 14.8 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 pr (CVSS 4.3, GitLab)
- [CVE-2022-2250](https://cve.now/CVE-2022-2250.md): An open redirect vulnerability in GitLab EE/CE affecting all versions from 11.1 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15 (CVSS 4.7, GitLab)
- [CVE-2022-2254](https://cve.now/CVE-2022-2254.md): Distributed Data Systems WebHMI Cross-site Scripting (CVSS 6.2, Distributed Data Systems WebHMI)
- [CVE-2022-2253](https://cve.now/CVE-2022-2253.md): Distributed Data Systems WebHMI OS Command Injection (CVSS 9.1, Distributed Data Systems WebHMI)
- [CVE-2014-3650](https://cve.now/CVE-2014-3650.md): Multiple persistent cross-site scripting (XSS) flaws were found in the way Aerogear handled certain user-supplied content. (no CVSS, Jboss Aerogear)
- [CVE-2014-3648](https://cve.now/CVE-2014-3648.md): The simplepush server iterates through the application installations and pushes a notification to the server provided by deviceToken. (no CVSS, Jboss Aerogear)
- [CVE-2022-33103](https://cve.now/CVE-2022-33103.md): Das U-Boot from v2020.10 to v2022.07-rc3 was discovered to contain an out-of-bounds write via the function sqfs\_readdir(). (no CVSS)
- [CVE-2022-33099](https://cve.now/CVE-2022-33099.md): An issue in the component luaG\_runerror of Lua v5.4.4 and below leads to a heap-buffer overflow when a recursive error occurs. (no CVSS)
- [CVE-2022-34894](https://cve.now/CVE-2022-34894.md): In JetBrains Hub before 2022.2.14799, insufficient access control allowed the hijacking of untrusted services (CVSS 3.5, JetBrains Hub)
- [CVE-2022-2279](https://cve.now/CVE-2022-2279.md): NULL Pointer Dereference in bfabiszewski/libmobi (CVSS 6.6, bfabiszewski/libmobi)
- [CVE-2022-2280](https://cve.now/CVE-2022-2280.md): Cross-site Scripting (XSS) - Stored in microweber/microweber (CVSS 6.5, microweber/microweber)
- [CVE-2022-2274](https://cve.now/CVE-2022-2274.md): RSA implementation bug in AVX512IFMA instructions (no CVSS, OpenSSL · openssl-src)
- [CVE-2022-2264](https://cve.now/CVE-2022-2264.md): Heap-based Buffer Overflow in vim/vim (CVSS 7.8, vim/vim)
- [CVE-2022-32081](https://cve.now/CVE-2022-32081.md): MariaDB v10.4 to v10.7 was discovered to contain an use-after-poison in prepare\_inplace\_add\_virtual at /storage/innobase/handler/handler0alt (no CVSS)
- [CVE-2022-32082](https://cve.now/CVE-2022-32082.md): MariaDB v10.5 to v10.7 was discovered to contain an assertion failure at table-\>get\_ref\_count() == 0 in dict0dict.cc. (no CVSS)
- [CVE-2022-32084](https://cve.now/CVE-2022-32084.md): MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component sub\_select. (no CVSS)
- [CVE-2022-32089](https://cve.now/CVE-2022-32089.md): MariaDB v10.5 to v10.7 was discovered to contain a segmentation fault via the component st\_select\_lex\_unit::exclude\_level. (no CVSS)
- [CVE-2022-32091](https://cve.now/CVE-2022-32091.md): MariaDB v10.7 was discovered to contain an use-after-poison in in \_\_interceptor\_memset at /libsanitizer/sanitizer\_common/sanitizer\_common\_in (no CVSS)
- [CVE-2022-32325](https://cve.now/CVE-2022-32325.md): JPEGOPTIM v1.4.7 was discovered to contain a segmentation violation which is caused by a READ memory access at jpegoptim.c. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-07-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.