CVEs published July 5, 2022
31 CVEs were published on July 5, 2022: 0 critical, 4 high.
- Published
- 31
- Critical
- 0
- High
- 4
- Medium
- 8
- Low
- 0
- Unrated
- 19
- Now in CISA KEV
- 0
- Fix available
- 15
Most affected products
- Linux · xen
- 4
- VICIdial
- 4
- Linux
- 2
- pycti
- 2
- ultrajson · ujson
- 2
- com.alibaba.nacos:nacos-client
- 1
- github.com/astaxie/beego · github.com/beego/beego +1
- 1
- heroiclabs/nakama · github.com/heroiclabs/nakama
- 1
- heroiclabs/nakama · github.com/heroiclabs/nakama/v3
- 1
- IBM App Connect Enterprise Certified Container
- 1
High 4
- CVE-2022-2321Improper Restriction of Excessive Authentication Attempts in heroiclabs/nakamaheroiclabs/nakama · github.com/heroiclabs/nakama/v3
- CVE-2022-31116Incorrect handling of invalid surrogate pair characters in ujsonultrajson · ujson
- CVE-2022-2306Insufficient Session Expiration in heroiclabs/nakamaheroiclabs/nakama · github.com/heroiclabs/nakama
- CVE-2022-2304Stack-based Buffer Overflow in vim/vimvim/vim
Medium, low and unrated 27
- CVE-2022-32413An arbitrary file upload vulnerability in Dice v4.2.0 allows attackers to execute arbitrary code via a crafted file.
- CVE-2022-34972So Filter Shop v3.x was discovered to contain multiple blind SQL injection vulnerabilities via the att_value_id , manu_value_id , opt_value_
- CVE-2022-32311Ingredient Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /isms/admin/stocks/v
- CVE-2022-32310An access control issue in Ingredient Stock Management System v1.0 allows attackers to take over user accounts via a crafted POST request to
- CVE-2022-31856Newsletter Module v3.x was discovered to contain a SQL injection vulnerability via the zemez_newsletter_email parameter at /index.php.
- CVE-2022-33075A stored cross-site scripting (XSS) vulnerability in the Add Classification function of Zoo Management System v1.0 allows attackers to execu
- CVE-2022-31117Double free of buffer during string decoding in ujsonultrajson · ujson
- CVE-2022-31014SMTP Command Injection in iCalendar Attachments to emails via newlines in Nextcloud Servernextcloud security-advisories
- CVE-2021-44915Taocms 3.0.2 was discovered to contain a blind SQL injection vulnerability via the function Edit category.
- CVE-2022-31770IBM App Connect Enterprise Certified Container 4.2 could allow a user from the administration console to cause a denial of service by creatiIBM App Connect Enterprise Certified Container
- CVE-2022-34879VICIDial 2.14b0.5 SVN 3550 was discovered to contain multiple Cross Site Scripting (XSS) vulnerabilities at /vicidial/admin.php.VICIdial
- CVE-2022-34878VICIDial 2.14b0.5 SVN 3550 was discovered to contain a SQL injection vulnerability at /vicidial/user_stats.php.VICIdial
- CVE-2022-34877VICIDial 2.14b0.5 SVN 3550 was discovered to contains a SQL injection vulnerability at /vicidial/AST_agent_time_sheet.php.VICIdial
- CVE-2022-34876VICIDial 2.14b0.5 SVN 3550 was discovered to contain multiple SQL injection vulnerability at /vicidial/admin.php.VICIdial
- CVE-2022-33742Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cLinux · xen
- CVE-2022-33741Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cLinux · xen
- CVE-2022-33740Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cLinux · xen
- CVE-2022-26365Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cLinux · xen
- CVE-2022-33743network backend may cause Linux netfront to use freed SKBs While adding logic to support XDP (eXpress Data Path), a code label was moved in Linux
- CVE-2022-33744Arm guests can cause Dom0 DoS via PV devices When mapping pages of guests on Arm, dom0 is using an rbtree to keep track of the foreign mappiLinux
- CVE-2022-30290In OpenCTI through 5.2.4, a broken access control vulnerability has been identified in the profile endpoint.pycti
- CVE-2022-30289A stored Cross-site Scripting (XSS) vulnerability was identified in the Data Import functionality of OpenCTI through 5.2.4.pycti
- CVE-2021-43702ASUS RT-A88U 3.0.0.4.386_45898 is vulnerable to Cross Site Scripting (XSS).
- CVE-2022-2097AES OCB fails to encrypt some bytesOpenSSL · openssl-src
- CVE-2022-2309NULL Pointer Dereference in lxml/lxmllxml/lxml · lxml
- CVE-2021-43116An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on login to capture packcom.alibaba.nacos:nacos-client
- CVE-2022-31836The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to cross directory risk.github.com/astaxie/beego · github.com/beego/beego +1