# CVEs published 2022-07-05

31 CVEs were published on July 5, 2022: 0 critical, 4 high. Days are UTC.

- [CVE-2022-32413](https://cve.now/CVE-2022-32413.md): An arbitrary file upload vulnerability in Dice v4.2.0 allows attackers to execute arbitrary code via a crafted file. (no CVSS)
- [CVE-2022-34972](https://cve.now/CVE-2022-34972.md): So Filter Shop v3.x was discovered to contain multiple blind SQL injection vulnerabilities via the att\_value\_id , manu\_value\_id , opt\_value\_ (no CVSS)
- [CVE-2022-32311](https://cve.now/CVE-2022-32311.md): Ingredient Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /isms/admin/stocks/v (no CVSS)
- [CVE-2022-32310](https://cve.now/CVE-2022-32310.md): An access control issue in Ingredient Stock Management System v1.0 allows attackers to take over user accounts via a crafted POST request to (no CVSS)
- [CVE-2022-31856](https://cve.now/CVE-2022-31856.md): Newsletter Module v3.x was discovered to contain a SQL injection vulnerability via the zemez\_newsletter\_email parameter at /index.php. (no CVSS)
- [CVE-2022-2321](https://cve.now/CVE-2022-2321.md): Improper Restriction of Excessive Authentication Attempts in heroiclabs/nakama (CVSS 7.5, heroiclabs/nakama · github.com/heroiclabs/nakama/v3)
- [CVE-2022-31116](https://cve.now/CVE-2022-31116.md): Incorrect handling of invalid surrogate pair characters in ujson (CVSS 7.5, ultrajson · ujson)
- [CVE-2022-33075](https://cve.now/CVE-2022-33075.md): A stored cross-site scripting (XSS) vulnerability in the Add Classification function of Zoo Management System v1.0 allows attackers to execu (no CVSS)
- [CVE-2022-31117](https://cve.now/CVE-2022-31117.md): Double free of buffer during string decoding in ujson (CVSS 5.9, ultrajson · ujson)
- [CVE-2022-31014](https://cve.now/CVE-2022-31014.md): SMTP Command Injection in iCalendar Attachments to emails via newlines in Nextcloud Server (CVSS 5.4, nextcloud security-advisories)
- [CVE-2021-44915](https://cve.now/CVE-2021-44915.md): Taocms 3.0.2 was discovered to contain a blind SQL injection vulnerability via the function Edit category. (no CVSS)
- [CVE-2022-31770](https://cve.now/CVE-2022-31770.md): IBM App Connect Enterprise Certified Container 4.2 could allow a user from the administration console to cause a denial of service by creati (CVSS 4.9, IBM App Connect Enterprise Certified Container)
- [CVE-2022-34879](https://cve.now/CVE-2022-34879.md): VICIDial 2.14b0.5 SVN 3550 was discovered to contain multiple Cross Site Scripting (XSS) vulnerabilities at /vicidial/admin.php. (CVSS 6.5, VICIdial)
- [CVE-2022-34878](https://cve.now/CVE-2022-34878.md): VICIDial 2.14b0.5 SVN 3550 was discovered to contain a SQL injection vulnerability at /vicidial/user\_stats.php. (CVSS 5.5, VICIdial)
- [CVE-2022-34877](https://cve.now/CVE-2022-34877.md): VICIDial 2.14b0.5 SVN 3550 was discovered to contains a SQL injection vulnerability at /vicidial/AST\_agent\_time\_sheet.php. (CVSS 6.4, VICIdial)
- [CVE-2022-34876](https://cve.now/CVE-2022-34876.md): VICIDial 2.14b0.5 SVN 3550 was discovered to contain multiple SQL injection vulnerability at /vicidial/admin.php. (CVSS 5.5, VICIdial)
- [CVE-2022-33742](https://cve.now/CVE-2022-33742.md): Linux disk/nic frontends data leaks T\[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities c (no CVSS, Linux · xen)
- [CVE-2022-33741](https://cve.now/CVE-2022-33741.md): Linux disk/nic frontends data leaks T\[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities c (no CVSS, Linux · xen)
- [CVE-2022-33740](https://cve.now/CVE-2022-33740.md): Linux disk/nic frontends data leaks T\[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities c (no CVSS, Linux · xen)
- [CVE-2022-26365](https://cve.now/CVE-2022-26365.md): Linux disk/nic frontends data leaks T\[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities c (no CVSS, Linux · xen)
- [CVE-2022-33743](https://cve.now/CVE-2022-33743.md): network backend may cause Linux netfront to use freed SKBs While adding logic to support XDP (eXpress Data Path), a code label was moved in (no CVSS, Linux)
- [CVE-2022-33744](https://cve.now/CVE-2022-33744.md): Arm guests can cause Dom0 DoS via PV devices When mapping pages of guests on Arm, dom0 is using an rbtree to keep track of the foreign mappi (no CVSS, Linux)
- [CVE-2022-30290](https://cve.now/CVE-2022-30290.md): In OpenCTI through 5.2.4, a broken access control vulnerability has been identified in the profile endpoint. (no CVSS, pycti)
- [CVE-2022-30289](https://cve.now/CVE-2022-30289.md): A stored Cross-site Scripting (XSS) vulnerability was identified in the Data Import functionality of OpenCTI through 5.2.4. (no CVSS, pycti)
- [CVE-2021-43702](https://cve.now/CVE-2021-43702.md): ASUS RT-A88U 3.0.0.4.386\_45898 is vulnerable to Cross Site Scripting (XSS). (no CVSS)
- [CVE-2022-2097](https://cve.now/CVE-2022-2097.md): AES OCB fails to encrypt some bytes (no CVSS, OpenSSL · openssl-src)
- [CVE-2022-2309](https://cve.now/CVE-2022-2309.md): NULL Pointer Dereference in lxml/lxml (CVSS 5.3, lxml/lxml · lxml)
- [CVE-2022-2306](https://cve.now/CVE-2022-2306.md): Insufficient Session Expiration in heroiclabs/nakama (CVSS 8.2, heroiclabs/nakama · github.com/heroiclabs/nakama)
- [CVE-2021-43116](https://cve.now/CVE-2021-43116.md): An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on login to capture pack (no CVSS, com.alibaba.nacos:nacos-client)
- [CVE-2022-2304](https://cve.now/CVE-2022-2304.md): Stack-based Buffer Overflow in vim/vim (CVSS 7.8, vim/vim)
- [CVE-2022-31836](https://cve.now/CVE-2022-31836.md): The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to cross directory risk. (no CVSS, github.com/astaxie/beego · github.com/beego/beego +1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-07-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.