CVEs published July 6, 2022
93 CVEs were published on July 6, 2022: 5 critical, 7 high.
- Published
- 93
- Critical
- 5
- High
- 7
- Medium
- 16
- Low
- 3
- Unrated
- 62
- Now in CISA KEV
- 0
- Fix available
- 16
Most affected products
- MediaTek MT6761, MT6779, MT6781, MT6833, MT6853, MT6873, MT…
- 6
- Cisco Unified Communications Manager
- 5
- MediaTek MT6580, MT6735, MT6737, MT6739, MT6753, MT6761, MT…
- 4
- grub2
- 3
- JFrog Artifactory
- 3
- OpenVPN Access Server
- 3
- Cisco TelePresence Video Communication Server (VCS) Express…
- 2
- hap-wi roxy-wi
- 2
- HCL Software HCL Launch
- 2
- MediaTek MT2731, MT2735, MT6297, MT6725, MT6735, MT6737, MT…
- 2
Critical 5
- CVE-2022-20813Cisco Expressway Series and Cisco TelePresence Video Communication Server VulnerabilitiesCisco TelePresence Video Communication Server (VCS) Express…
- CVE-2022-20812Cisco Expressway Series and Cisco TelePresence Video Communication Server VulnerabilitiesCisco TelePresence Video Communication Server (VCS) Express…
- CVE-2022-31126Unauthenticated Remote Code Execution in Roxy-wihap-wi roxy-wi
- CVE-2022-32533Apache Portals Jetspeed XSS, CSRF, SSRF, and XXE issuesApache Software Foundation Apache Portals · org.apache.port…
- CVE-2022-31125Authentication Bypass in Roxy-wihap-wi roxy-wi
High 7
- CVE-2022-20808Cisco Smart Software Manager On-Prem Denial of Service VulnerabilityCisco Smart Software Manager On-Prem
- CVE-2022-31127Improper handling of email input in next-authnextauthjs next-auth · next-auth
- CVE-2022-31124Possible leak of key's raw field if declared length is incorrect in openssh_key_parserscottcwang openssh_key_parser · openssh-key-parser
- CVE-2022-26348Command Centre Server is vulnerable to SQL Injection via Windows Registry settings for date fields on the server.Gallagher Command Centre
- CVE-2022-26078Gallagher Controller 6000 is vulnerable to a Denial of Service attack via conflicting ARP packets with a duplicate IP address.Gallagher Controller
- CVE-2022-22681Session fixation vulnerability in access control management in Synology Photo Station before 6.8.16-3506 allows remote attackers to bypass sSynology Photo Station
- CVE-2022-31129Inefficient Regular Expression Complexity in momentmoment · Moment.js
Medium, low and unrated 81
- CVE-2022-20862Cisco Unified Communications Manager Arbitrary File Read VulnerabilityCisco Unified Communications Manager
- CVE-2022-20859Cisco Unified Communications Products Access Control VulnerabilityCisco Unified Communications Manager
- CVE-2022-20815Cisco Unified Communications Products Cross-Site Scripting VulnerabilityCisco Unified Communications Manager
- CVE-2022-20800Cisco Unified Communications Products Cross-Site Scripting VulnerabilityCisco Unity Connection
- CVE-2022-20791Cisco Unified Communications Products Arbitrary File Read VulnerabilityCisco Unified Communications Manager
- CVE-2022-20768Cisco TelePresence Collaboration Endpoint and RoomOS Software Information Disclosure VulnerabilityCisco RoomOS Software
- CVE-2022-20752Cisco Unified Communications Products Timing Attack VulnerabilityCisco Unified Communications Manager
- CVE-2022-27549HCL Launch could disclose sensitive database information to a local user in plain text.HCL Software HCL Launch
- CVE-2022-27548HCL Launch is vulnerable to information disclosure which can be read by a local user.HCL Software HCL Launch
- CVE-2021-4234OpenVPN Access Server 2.10 and prior versions are susceptible to resending multiple packets in a response to a reset packet sent from the clOpenVPN Access Server
- CVE-2014-8164A insecure configuration for certificate verification (http.verify_mode = OpenSSL::SSL::VERIFY_NONE) may lead to verification bypass in Red Red Hat CloudForms
- CVE-2015-3173custom-content-type-manager Wordpress plugin can be used by an administrator to achieve arbitrary PHP remote code execution.custom-content-type-manager
- CVE-2015-3172EidoGo is susceptible to Cross-Site Scripting (XSS) attacks via maliciously crafted SGF input.EidoGo
- CVE-2022-2316HTML injection vulnerability in secure messages of Devolutions Server before 2022.2 allows attackers to alter the rendering of the page or rDevolutions Server
- CVE-2022-33047OTFCC v0.10.4 was discovered to contain a heap buffer overflow after free via otfccbuild.c.
- CVE-2022-31131Ownership check missing when updating or deleting mail attachments in Nextcloud mailnextcloud security-advisories
- CVE-2022-31111Discrepency in transfer value and actual value due to incorrect truncation in Frontierparitytech frontier
- CVE-2022-34598The udpserver in H3C Magic R100 V200R004 and V100R005 has the 9034 port opened, allowing attackers to execute arbitrary commands.
- CVE-2022-34597Tenda AX1806 v1.0.0.1 was discovered to contain a command injection vulnerability via the function WanParameterSetting.
- CVE-2022-34596Tenda AX1803 v1.0.0.1_2890 was discovered to contain a command injection vulnerability via the function WanParameterSetting.
- CVE-2022-34595Tenda AX1803 v1.0.0.1_2890 was discovered to contain a command injection vulnerability via the function setipv6status.
- CVE-2022-33738OpenVPN Access Server before 2.11 uses a weak random generator used to create user session token for the web portalOpenVPN Access Server
- CVE-2022-33737The OpenVPN Access Server installer creates a log file readable for everyone, which from version 2.10.0 and before 2.11.0 may contain a randOpenVPN Access Server
- CVE-2021-3697A crafted JPEG image may lead the JPEG reader to underflow its data pointer, allowing user-controlled data to be written in heap.grub2
- CVE-2021-3696A heap out-of-bounds write may heppen during the handling of Huffman tables in the PNG reader.grub2
- CVE-2021-3695A crafted 16-bit grayscale PNG image may lead to a out-of-bounds write in the heap area.grub2
- CVE-2022-30929Mini-Tmall v1.0 is vulnerable to Insecure Permissions via tomcat-embed-jasper.
- CVE-2022-23714A local privilege escalation (LPE) issue was discovered in the ransomware canaries features of Elastic Endpoint Security for Windows, which Elastic Endpoint Security
- CVE-2022-23713A cross-site-scripting (XSS) vulnerability was discovered in the Vega Charts Kibana integration which could allow arbitrary JavaScript to beElastic kibana
- CVE-2022-30619Agile Point - Agile Point NX SQL injection (SQLi)Agile Point NX
- CVE-2022-23173Priority - Priority web Insecure direct object references (IDOR)Priority web
- CVE-2022-23172Priority - Priority User EnumerationPriority
- CVE-2022-21787In audio DSP, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6833, MT6853, MT6873, MT6877, MT6879, MT6885, MT…
- CVE-2022-21786In audio DSP, there is a possible memory corruption due to improper casting.MediaTek MT6833, MT6853, MT6873, MT6877, MT6879, MT6885, MT…
- CVE-2022-21785In WLAN driver, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6877, MT6983, MT8167S, MT8168, MT8175, MT8183, M…
- CVE-2022-21784In WLAN driver, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6761, MT6779, MT6781, MT6833, MT6853, MT6873, MT…
- CVE-2022-21783In WLAN driver, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6761, MT6779, MT6781, MT6833, MT6853, MT6873, MT…
- CVE-2022-21782In WLAN driver, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6761, MT6779, MT6781, MT6833, MT6853, MT6873, MT…
- CVE-2022-21781In WLAN driver, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6761, MT6779, MT6781, MT6833, MT6853, MT6873, MT…
- CVE-2022-21780In WLAN driver, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6761, MT6779, MT6781, MT6833, MT6853, MT6873, MT…
- CVE-2022-21779In WLAN driver, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6761, MT6779, MT6781, MT6833, MT6853, MT6873, MT…
- CVE-2022-21777In Autoboot, there is a possible permission bypass due to a missing permission check.MediaTek MT6580, MT6735, MT6739, MT6761, MT6765, MT6768, MT…
- CVE-2022-21776In MDP, there is a possible use after free due to a race condition.MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6771, MT…
- CVE-2022-21775In sched driver, there is a possible use after free due to improper locking.MediaTek MT6761, MT6762, MT6763, MT6765, MT6768, MT6769, MT…
- CVE-2022-21774In TEEI driver, there is a possible use after free due to a race condition.MediaTek MT6761, MT6765, MT6768, MT6771, MT6779, MT6781, MT…
- CVE-2022-21773In TEEI driver, there is a possible use after free due to a race condition.MediaTek MT6580, MT6735, MT6737, MT6739, MT6750, MT6750S, M…
- CVE-2022-21772In TEEI driver, there is a possible type confusion due to a race condition.MediaTek MT6761, MT6765, MT6768, MT6771, MT6779, MT6833, MT…
- CVE-2022-21771In GED driver, there is a possible use after free due to a race condition.MediaTek MT6580, MT6735, MT6737, MT6739, MT6753, MT6761, MT…
- CVE-2022-21770In sound driver, there is a possible information disclosure due to symlink following.MediaTek MT6781, MT6877, MT6879, MT6893, MT6895, MT6983, MT…
- CVE-2022-21769In CCCI, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6580, MT6735, MT6737, MT6739, MT6753, MT6761, MT…
- CVE-2022-21766In CCCI, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6580, MT6735, MT6737, MT6739, MT6753, MT6761, MT…
- CVE-2022-21765In CCCI, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6580, MT6735, MT6737, MT6739, MT6753, MT6761, MT…
- CVE-2022-21768In Bluetooth, there is a possible out of bounds write due to a missing bounds check.MediaTek MT8167S, MT8175, MT8183, MT8362A, MT8365, MT8385
- CVE-2022-21767In Bluetooth, there is a possible out of bounds write due to a missing bounds check.MediaTek MT8167, MT8175, MT8183, MT8362A, MT8365, MT8385
- CVE-2022-20083In Modem 2G/3G CC, there is a possible out of bounds write due to a missing bounds check.MediaTek MT2731, MT2735, MT6297, MT6725, MT6735, MT6737, MT…
- CVE-2022-21744In Modem 2G RR, there is a possible out of bounds write due to a missing bounds check.MediaTek MT2731, MT2735, MT6297, MT6725, MT6735, MT6737, MT…
- CVE-2022-21764In telecom service, there is a possible information disclosure due to a missing permission check.MediaTek MT6739, MT6761, MT6762, MT6763, MT6765, MT6768, MT…
- CVE-2022-21763In telecom service, there is a possible information disclosure due to a missing permission check.MediaTek MT6739, MT6761, MT6762, MT6763, MT6765, MT6768, MT…
- CVE-2022-20082In GPU, there is a possible use after free due to a race condition.MediaTek MT6768, MT6769, MT6781, MT6785, MT6789, MT6833, MT…
- CVE-2022-24141The iTopVPNmini.exe component of iTop VPN 3.2 will try to connect to datastate_iTopVPN_Pipe_Server on a loop.
- CVE-2022-24140IOBit Advanced System Care 15, iTop Screen Recorder 2.1, iTop VPN 3.2, Driver Booster 9, and iTop Screenshot sends HTTP requests in their up
- CVE-2022-24139In IOBit Advanced System Care (AscService.exe) 15, an attacker with SEImpersonatePrivilege can create a named pipe with the same name as one
- CVE-2022-24138IOBit Advanced System Care (Asc.exe) 15 and Action Download Center both download components of IOBit suite into ProgramData folder, ProgramD
- CVE-2021-37839Improper access to dataset metadata informationApache Software Foundation Apache Superset · apache-superset
- CVE-2022-28935Totolink A830R V5.9c.4729_B20191112, Totolink A3100R V4.1.2cu.5050_B20200504, Totolink A950RG V4.1.2cu.5161_B20200903, Totolink A800R V4.1.2
- CVE-2021-31678An issue was discovered in PESCMS-V2.3.3.
- CVE-2021-31679An issue was discovered in PESCMS-V2.3.3.
- CVE-2021-31677An issue was discovered in PESCMS-V2.3.3.
- CVE-2021-31676A reflected XSS was discovered in PESCMS-V2.3.3.
- CVE-2022-32383Tenda AC23 v16.03.07.44 was discovered to contain a stack overflow via the AdvSetMacMtuWan function.
- CVE-2022-32385Tenda AC23 v16.03.07.44 is vulnerable to Stack Overflow that will allow for the execution of arbitrary code (remote).
- CVE-2022-32386Tenda AC23 v16.03.07.44 was discovered to contain a buffer overflow via fromAdvSetMacMtuWan.
- CVE-2022-30591quic-go through 0.27.0 allows remote attackers to cause a denial of service (CPU consumption) via a Slowloris variant in which incomplete QU
- CVE-2022-32290The client in Northern.tech Mender 3.2.0, 3.2.1, and 3.2.2 has Incorrect Access Control.
- CVE-2022-35230Reflected XSS in graphs page of Zabbix FrontendZabbix Frontend
- CVE-2022-35229Reflected XSS in discovery page of Zabbix FrontendZabbix Frontend
- CVE-2021-23163JFrog Artifactory prior to version 7.33.6 and 6.23.38, is vulnerable to CSRF ( Cross-Site Request Forgery) for specific endpoints.JFrog Artifactory
- CVE-2021-46687JFrog Artifactory prior to version 7.31.10 and 6.23.38 is vulnerable to Sensitive Data Exposure through the Project Administrator REST API.JFrog Artifactory
- CVE-2021-45721JFrog Artifactory prior to version 7.29.8 and 6.23.38 is vulnerable to Reflected Cross-Site Scripting (XSS) through one of the XHR parameterJFrog Artifactory
- CVE-2022-2318There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that allow attackers to crash linux kerneKernel
- CVE-2022-33980Apache Commons Configuration insecure interpolation defaultsApache Software Foundation Apache Commons Configuration · o…