# CVEs published 2022-07-04

38 CVEs were published on July 4, 2022: 1 critical, 3 high. Days are UTC.

- [CVE-2022-34918](https://cve.now/CVE-2022-34918.md): An issue was discovered in the Linux kernel through 5.18.9. (no CVSS)
- [CVE-2022-34829](https://cve.now/CVE-2022-34829.md): Zoho ManageEngine ADSelfService Plus before 6203 allows a denial of service (application restart) via a crafted payload to the Mobile App De (no CVSS)
- [CVE-2022-31603](https://cve.now/CVE-2022-31603.md): NVIDIA DGX A100 contains a vulnerability in SBIOS in the IpSecDxe, where a user with high privileges and preconditioned IpSecDxe global data (CVSS 6.4, NVIDIA DGX A100)
- [CVE-2022-31602](https://cve.now/CVE-2022-31602.md): NVIDIA DGX A100 contains a vulnerability in SBIOS in the IpSecDxe, where a user with elevated privileges and a preconditioned heap can explo (CVSS 6.4, NVIDIA DGX A100)
- [CVE-2022-31601](https://cve.now/CVE-2022-31601.md): NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmbiosPei, which may allow a highly privileged local attacker to cause an out-of-bo (CVSS 6.7, NVIDIA DGX A100)
- [CVE-2022-31600](https://cve.now/CVE-2022-31600.md): NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmmCore, where a user with high privileges can chain another vulnerability to this (CVSS 7.5, NVIDIA DGX A100)
- [CVE-2022-31599](https://cve.now/CVE-2022-31599.md): NVIDIA DGX A100 contains a vulnerability in SBIOS in the Ofbd, where a local user with elevated privileges can cause access to an uninitiali (CVSS 8.2, NVIDIA DGX A100)
- [CVE-2022-33171](https://cve.now/CVE-2022-33171.md): The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object. (no CVSS, typeorm)
- [CVE-2022-2268](https://cve.now/CVE-2022-2268.md): WP All Import \< 3.6.8 - Admin+ Arbitrary File Upload (no CVSS, Import any XML or CSV File to WordPress)
- [CVE-2022-1967](https://cve.now/CVE-2022-1967.md): WP Championship \< 9.3 - Multiple CSRF (no CVSS, WP Championship)
- [CVE-2022-1946](https://cve.now/CVE-2022-1946.md): Gallery \< 2.0.0 - Reflected Cross-Site Scripting (no CVSS, Gallery – Image and Video Gallery with Thumbnails)
- [CVE-2022-1301](https://cve.now/CVE-2022-1301.md): WP Contact Slider \< 2.4.7 - Editor+ Stored Cross-Site Scripting (no CVSS, WP Contact Slider)
- [CVE-2022-0250](https://cve.now/CVE-2022-0250.md): Redirection for Contact Form 7 \< 2.5.0 - Reflected Cross-Site Scripting (no CVSS, Redirection for Contact Form)
- [CVE-2021-25066](https://cve.now/CVE-2021-25066.md): Ninja Forms \< 3.6.10 - Admin+ Stored Cross-Site Scripting via Import (no CVSS, Ninja Forms Contact Form – The Drag and Drop Form Builder f…)
- [CVE-2021-25056](https://cve.now/CVE-2021-25056.md): Ninja Forms \< 3.6.10 - Admin+ Stored Cross-Site Scripting (no CVSS, Ninja Forms Contact Form – The Drag and Drop Form Builder f…)
- [CVE-2022-2300](https://cve.now/CVE-2022-2300.md): Cross-site Scripting (XSS) - Stored in microweber/microweber (CVSS 6.3, microweber/microweber)
- [CVE-2022-2301](https://cve.now/CVE-2022-2301.md): Buffer Over-read in hpjansson/chafa (CVSS 5.5, hpjansson/chafa)
- [CVE-2022-29892](https://cve.now/CVE-2022-29892.md): Improper input validation vulnerability in Space of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to repeatedly displa (no CVSS, Cybozu Garoon)
- [CVE-2022-29513](https://cve.now/CVE-2022-29513.md): Cross-site scripting vulnerability in Scheduler of Cybozu Garoon 4.10.0 to 5.5.1 allows a remote authenticated attacker with an administrati (no CVSS, Cybozu Garoon)
- [CVE-2022-29484](https://cve.now/CVE-2022-29484.md): Operation restriction bypass vulnerability in Space of Cybozu Garoon 4.0.0 to 5.9.0 allows a remote authenticated attacker to delete the dat (no CVSS, Cybozu Garoon)
- [CVE-2022-29471](https://cve.now/CVE-2022-29471.md): Browse restriction bypass vulnerability in Bulletin of Cybozu Garoon allows a remote authenticated attacker to obtain the data of Bulletin. (no CVSS, Cybozu Garoon)
- [CVE-2022-29467](https://cve.now/CVE-2022-29467.md): Address information disclosure vulnerability in Cybozu Garoon 4.2.0 to 5.5.1 allows a remote authenticated attacker to obtain some data of A (no CVSS, Cybozu Garoon)
- [CVE-2022-28718](https://cve.now/CVE-2022-28718.md): Operation restriction bypass vulnerability in Bulletin of Cybozu Garoon 4.0.0 to 5.5.1 allow a remote authenticated attacker to alter the da (no CVSS, Cybozu Garoon)
- [CVE-2022-28713](https://cve.now/CVE-2022-28713.md): Improper authentication vulnerability in Scheduler of Cybozu Garoon 4.10.0 to 5.5.1 allows a remote attacker to obtain some data of Facility (no CVSS, Cybozu Garoon)
- [CVE-2022-28692](https://cve.now/CVE-2022-28692.md): Improper input validation vulnerability in Scheduler of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the dat (no CVSS, Cybozu Garoon)
- [CVE-2022-27807](https://cve.now/CVE-2022-27807.md): Improper input validation vulnerability in Link of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to disable to add Cat (no CVSS, Cybozu Garoon)
- [CVE-2022-27803](https://cve.now/CVE-2022-27803.md): Improper input validation vulnerability in Space of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of (no CVSS, Cybozu Garoon)
- [CVE-2022-27661](https://cve.now/CVE-2022-27661.md): Operation restriction bypass vulnerability in Workflow of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the d (no CVSS, Cybozu Garoon)
- [CVE-2022-27627](https://cve.now/CVE-2022-27627.md): Cross-site scripting vulnerability in Organization's Information of Cybozu Garoon 4.10.2 to 5.5.1 allows a remote attacker to execute an arb (no CVSS, Cybozu Garoon)
- [CVE-2022-26368](https://cve.now/CVE-2022-26368.md): Browse restriction bypass and operation restriction bypass vulnerability in Cabinet of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenti (no CVSS, Cybozu Garoon)
- [CVE-2022-26054](https://cve.now/CVE-2022-26054.md): Operation restriction bypass vulnerability in Link of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data (no CVSS, Cybozu Garoon)
- [CVE-2022-26051](https://cve.now/CVE-2022-26051.md): Operation restriction bypass vulnerability in Portal of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the dat (no CVSS, Cybozu Garoon)
- [CVE-2022-34151](https://cve.now/CVE-2022-34151.md): Use of hard-coded credentials vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automat (CVSS 9.4, OMRON Machine automation controller NJ series, Machine auto…)
- [CVE-2022-33971](https://cve.now/CVE-2022-33971.md): Authentication bypass by capture-replay vulnerability exists in Machine automation controller NX7 series all models V1.28 and earlier, Machi (CVSS 8.3, OMRON Machine automation controller NJ series, Machine auto…)
- [CVE-2022-33948](https://cve.now/CVE-2022-33948.md): HOME SPOT CUBE2 V102 contains an OS command injection vulnerability due to improper processing of data received from DHCP server. (no CVSS, KDDI HOME SPOT CUBE2)
- [CVE-2022-33208](https://cve.now/CVE-2022-33208.md): Authentication bypass by capture-replay vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machi (no CVSS, OMRON Machine automation controller NJ series, Machine auto…)
- [CVE-2022-32284](https://cve.now/CVE-2022-32284.md): Use of insufficiently random values vulnerability exists in Vnet/IP communication module VI461 of YOKOGAWA Wide Area Communication Router (W (no CVSS, Yokogawa Electric Communication Module for Wide Area Commun…)
- [CVE-2022-34265](https://cve.now/CVE-2022-34265.md): An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. (no CVSS, django)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-07-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.