# CVEs published 2022-07-06

93 CVEs were published on July 6, 2022: 5 critical, 7 high. Days are UTC.

- [CVE-2022-20862](https://cve.now/CVE-2022-20862.md): Cisco Unified Communications Manager Arbitrary File Read Vulnerability (CVSS 4.3, Cisco Unified Communications Manager)
- [CVE-2022-20859](https://cve.now/CVE-2022-20859.md): Cisco Unified Communications Products Access Control Vulnerability (CVSS 6.5, Cisco Unified Communications Manager)
- [CVE-2022-20815](https://cve.now/CVE-2022-20815.md): Cisco Unified Communications Products Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Unified Communications Manager)
- [CVE-2022-20813](https://cve.now/CVE-2022-20813.md): Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities (CVSS 9.0, Cisco TelePresence Video Communication Server (VCS) Express…)
- [CVE-2022-20812](https://cve.now/CVE-2022-20812.md): Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities (CVSS 9.0, Cisco TelePresence Video Communication Server (VCS) Express…)
- [CVE-2022-20808](https://cve.now/CVE-2022-20808.md): Cisco Smart Software Manager On-Prem Denial of Service Vulnerability (CVSS 7.7, Cisco Smart Software Manager On-Prem)
- [CVE-2022-20800](https://cve.now/CVE-2022-20800.md): Cisco Unified Communications Products Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Unity Connection)
- [CVE-2022-20791](https://cve.now/CVE-2022-20791.md): Cisco Unified Communications Products Arbitrary File Read Vulnerability (CVSS 6.5, Cisco Unified Communications Manager)
- [CVE-2022-20768](https://cve.now/CVE-2022-20768.md): Cisco TelePresence Collaboration Endpoint and RoomOS Software Information Disclosure Vulnerability (CVSS 4.9, Cisco RoomOS Software)
- [CVE-2022-20752](https://cve.now/CVE-2022-20752.md): Cisco Unified Communications Products Timing Attack Vulnerability (CVSS 5.3, Cisco Unified Communications Manager)
- [CVE-2022-27549](https://cve.now/CVE-2022-27549.md): HCL Launch could disclose sensitive database information to a local user in plain text. (CVSS 4.0, HCL Software HCL Launch)
- [CVE-2022-27548](https://cve.now/CVE-2022-27548.md): HCL Launch is vulnerable to information disclosure which can be read by a local user. (CVSS 4.9, HCL Software HCL Launch)
- [CVE-2021-4234](https://cve.now/CVE-2021-4234.md): OpenVPN Access Server 2.10 and prior versions are susceptible to resending multiple packets in a response to a reset packet sent from the cl (no CVSS, OpenVPN Access Server)
- [CVE-2014-8164](https://cve.now/CVE-2014-8164.md): A insecure configuration for certificate verification (http.verify\_mode = OpenSSL::SSL::VERIFY\_NONE) may lead to verification bypass in Red (no CVSS, Red Hat CloudForms)
- [CVE-2015-3173](https://cve.now/CVE-2015-3173.md): custom-content-type-manager Wordpress plugin can be used by an administrator to achieve arbitrary PHP remote code execution. (no CVSS, custom-content-type-manager)
- [CVE-2015-3172](https://cve.now/CVE-2015-3172.md): EidoGo is susceptible to Cross-Site Scripting (XSS) attacks via maliciously crafted SGF input. (no CVSS, EidoGo)
- [CVE-2022-2316](https://cve.now/CVE-2022-2316.md): HTML injection vulnerability in secure messages of Devolutions Server before 2022.2 allows attackers to alter the rendering of the page or r (no CVSS, Devolutions Server)
- [CVE-2022-33047](https://cve.now/CVE-2022-33047.md): OTFCC v0.10.4 was discovered to contain a heap buffer overflow after free via otfccbuild.c. (no CVSS)
- [CVE-2022-31127](https://cve.now/CVE-2022-31127.md): Improper handling of email input in next-auth (CVSS 7.1, nextauthjs next-auth · next-auth)
- [CVE-2022-31131](https://cve.now/CVE-2022-31131.md): Ownership check missing when updating or deleting mail attachments in Nextcloud mail (CVSS 5.4, nextcloud security-advisories)
- [CVE-2022-31124](https://cve.now/CVE-2022-31124.md): Possible leak of key's raw field if declared length is incorrect in openssh\_key\_parser (CVSS 7.7, scottcwang openssh\_key\_parser · openssh-key-parser)
- [CVE-2022-31126](https://cve.now/CVE-2022-31126.md): Unauthenticated Remote Code Execution in Roxy-wi (CVSS 10.0, hap-wi roxy-wi)
- [CVE-2022-31111](https://cve.now/CVE-2022-31111.md): Discrepency in transfer value and actual value due to incorrect truncation in Frontier (CVSS 5.3, paritytech frontier)
- [CVE-2022-34598](https://cve.now/CVE-2022-34598.md): The udpserver in H3C Magic R100 V200R004 and V100R005 has the 9034 port opened, allowing attackers to execute arbitrary commands. (no CVSS)
- [CVE-2022-34597](https://cve.now/CVE-2022-34597.md): Tenda AX1806 v1.0.0.1 was discovered to contain a command injection vulnerability via the function WanParameterSetting. (no CVSS)
- [CVE-2022-34596](https://cve.now/CVE-2022-34596.md): Tenda AX1803 v1.0.0.1\_2890 was discovered to contain a command injection vulnerability via the function WanParameterSetting. (no CVSS)
- [CVE-2022-34595](https://cve.now/CVE-2022-34595.md): Tenda AX1803 v1.0.0.1\_2890 was discovered to contain a command injection vulnerability via the function setipv6status. (no CVSS)
- [CVE-2022-26348](https://cve.now/CVE-2022-26348.md): Command Centre Server is vulnerable to SQL Injection via Windows Registry settings for date fields on the server. (CVSS 8.2, Gallagher Command Centre)
- [CVE-2022-26078](https://cve.now/CVE-2022-26078.md): Gallagher Controller 6000 is vulnerable to a Denial of Service attack via conflicting ARP packets with a duplicate IP address. (CVSS 7.5, Gallagher Controller)
- [CVE-2022-33738](https://cve.now/CVE-2022-33738.md): OpenVPN Access Server before 2.11 uses a weak random generator used to create user session token for the web portal (no CVSS, OpenVPN Access Server)
- [CVE-2022-33737](https://cve.now/CVE-2022-33737.md): The OpenVPN Access Server installer creates a log file readable for everyone, which from version 2.10.0 and before 2.11.0 may contain a rand (no CVSS, OpenVPN Access Server)
- [CVE-2021-3697](https://cve.now/CVE-2021-3697.md): A crafted JPEG image may lead the JPEG reader to underflow its data pointer, allowing user-controlled data to be written in heap. (no CVSS, grub2)
- [CVE-2021-3696](https://cve.now/CVE-2021-3696.md): A heap out-of-bounds write may heppen during the handling of Huffman tables in the PNG reader. (no CVSS, grub2)
- [CVE-2021-3695](https://cve.now/CVE-2021-3695.md): A crafted 16-bit grayscale PNG image may lead to a out-of-bounds write in the heap area. (no CVSS, grub2)
- [CVE-2022-30929](https://cve.now/CVE-2022-30929.md): Mini-Tmall v1.0 is vulnerable to Insecure Permissions via tomcat-embed-jasper. (no CVSS)
- [CVE-2022-23714](https://cve.now/CVE-2022-23714.md): A local privilege escalation (LPE) issue was discovered in the ransomware canaries features of Elastic Endpoint Security for Windows, which (no CVSS, Elastic Endpoint Security)
- [CVE-2022-23713](https://cve.now/CVE-2022-23713.md): A cross-site-scripting (XSS) vulnerability was discovered in the Vega Charts Kibana integration which could allow arbitrary JavaScript to be (no CVSS, Elastic kibana)
- [CVE-2022-30619](https://cve.now/CVE-2022-30619.md): Agile Point - Agile Point NX SQL injection (SQLi) (CVSS 5.9, Agile Point NX)
- [CVE-2022-23173](https://cve.now/CVE-2022-23173.md): Priority - Priority web Insecure direct object references (IDOR) (CVSS 5.5, Priority web)
- [CVE-2022-23172](https://cve.now/CVE-2022-23172.md): Priority - Priority User Enumeration (CVSS 5.5, Priority)
- [CVE-2022-21787](https://cve.now/CVE-2022-21787.md): In audio DSP, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT6833, MT6853, MT6873, MT6877, MT6879, MT6885, MT…)
- [CVE-2022-21786](https://cve.now/CVE-2022-21786.md): In audio DSP, there is a possible memory corruption due to improper casting. (no CVSS, MediaTek MT6833, MT6853, MT6873, MT6877, MT6879, MT6885, MT…)
- [CVE-2022-21785](https://cve.now/CVE-2022-21785.md): In WLAN driver, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT6877, MT6983, MT8167S, MT8168, MT8175, MT8183, M…)
- [CVE-2022-21784](https://cve.now/CVE-2022-21784.md): In WLAN driver, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT6761, MT6779, MT6781, MT6833, MT6853, MT6873, MT…)
- [CVE-2022-21783](https://cve.now/CVE-2022-21783.md): In WLAN driver, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT6761, MT6779, MT6781, MT6833, MT6853, MT6873, MT…)
- [CVE-2022-21782](https://cve.now/CVE-2022-21782.md): In WLAN driver, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT6761, MT6779, MT6781, MT6833, MT6853, MT6873, MT…)
- [CVE-2022-21781](https://cve.now/CVE-2022-21781.md): In WLAN driver, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT6761, MT6779, MT6781, MT6833, MT6853, MT6873, MT…)
- [CVE-2022-21780](https://cve.now/CVE-2022-21780.md): In WLAN driver, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT6761, MT6779, MT6781, MT6833, MT6853, MT6873, MT…)
- [CVE-2022-21779](https://cve.now/CVE-2022-21779.md): In WLAN driver, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT6761, MT6779, MT6781, MT6833, MT6853, MT6873, MT…)
- [CVE-2022-21777](https://cve.now/CVE-2022-21777.md): In Autoboot, there is a possible permission bypass due to a missing permission check. (no CVSS, MediaTek MT6580, MT6735, MT6739, MT6761, MT6765, MT6768, MT…)
- [CVE-2022-21776](https://cve.now/CVE-2022-21776.md): In MDP, there is a possible use after free due to a race condition. (no CVSS, MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6771, MT…)
- [CVE-2022-21775](https://cve.now/CVE-2022-21775.md): In sched driver, there is a possible use after free due to improper locking. (no CVSS, MediaTek MT6761, MT6762, MT6763, MT6765, MT6768, MT6769, MT…)
- [CVE-2022-21774](https://cve.now/CVE-2022-21774.md): In TEEI driver, there is a possible use after free due to a race condition. (no CVSS, MediaTek MT6761, MT6765, MT6768, MT6771, MT6779, MT6781, MT…)
- [CVE-2022-21773](https://cve.now/CVE-2022-21773.md): In TEEI driver, there is a possible use after free due to a race condition. (no CVSS, MediaTek MT6580, MT6735, MT6737, MT6739, MT6750, MT6750S, M…)
- [CVE-2022-21772](https://cve.now/CVE-2022-21772.md): In TEEI driver, there is a possible type confusion due to a race condition. (no CVSS, MediaTek MT6761, MT6765, MT6768, MT6771, MT6779, MT6833, MT…)
- [CVE-2022-21771](https://cve.now/CVE-2022-21771.md): In GED driver, there is a possible use after free due to a race condition. (no CVSS, MediaTek MT6580, MT6735, MT6737, MT6739, MT6753, MT6761, MT…)
- [CVE-2022-21770](https://cve.now/CVE-2022-21770.md): In sound driver, there is a possible information disclosure due to symlink following. (no CVSS, MediaTek MT6781, MT6877, MT6879, MT6893, MT6895, MT6983, MT…)
- [CVE-2022-21769](https://cve.now/CVE-2022-21769.md): In CCCI, there is a possible out of bounds read due to a missing bounds check. (no CVSS, MediaTek MT6580, MT6735, MT6737, MT6739, MT6753, MT6761, MT…)
- [CVE-2022-21766](https://cve.now/CVE-2022-21766.md): In CCCI, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT6580, MT6735, MT6737, MT6739, MT6753, MT6761, MT…)
- [CVE-2022-21765](https://cve.now/CVE-2022-21765.md): In CCCI, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT6580, MT6735, MT6737, MT6739, MT6753, MT6761, MT…)
- [CVE-2022-21768](https://cve.now/CVE-2022-21768.md): In Bluetooth, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT8167S, MT8175, MT8183, MT8362A, MT8365, MT8385)
- [CVE-2022-21767](https://cve.now/CVE-2022-21767.md): In Bluetooth, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT8167, MT8175, MT8183, MT8362A, MT8365, MT8385)
- [CVE-2022-20083](https://cve.now/CVE-2022-20083.md): In Modem 2G/3G CC, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT2731, MT2735, MT6297, MT6725, MT6735, MT6737, MT…)
- [CVE-2022-21744](https://cve.now/CVE-2022-21744.md): In Modem 2G RR, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT2731, MT2735, MT6297, MT6725, MT6735, MT6737, MT…)
- [CVE-2022-21764](https://cve.now/CVE-2022-21764.md): In telecom service, there is a possible information disclosure due to a missing permission check. (no CVSS, MediaTek MT6739, MT6761, MT6762, MT6763, MT6765, MT6768, MT…)
- [CVE-2022-21763](https://cve.now/CVE-2022-21763.md): In telecom service, there is a possible information disclosure due to a missing permission check. (no CVSS, MediaTek MT6739, MT6761, MT6762, MT6763, MT6765, MT6768, MT…)
- [CVE-2022-20082](https://cve.now/CVE-2022-20082.md): In GPU, there is a possible use after free due to a race condition. (no CVSS, MediaTek MT6768, MT6769, MT6781, MT6785, MT6789, MT6833, MT…)
- [CVE-2022-24141](https://cve.now/CVE-2022-24141.md): The iTopVPNmini.exe component of iTop VPN 3.2 will try to connect to datastate\_iTopVPN\_Pipe\_Server on a loop. (no CVSS)
- [CVE-2022-24140](https://cve.now/CVE-2022-24140.md): IOBit Advanced System Care 15, iTop Screen Recorder 2.1, iTop VPN 3.2, Driver Booster 9, and iTop Screenshot sends HTTP requests in their up (no CVSS)
- [CVE-2022-24139](https://cve.now/CVE-2022-24139.md): In IOBit Advanced System Care (AscService.exe) 15, an attacker with SEImpersonatePrivilege can create a named pipe with the same name as one (no CVSS)
- [CVE-2022-24138](https://cve.now/CVE-2022-24138.md): IOBit Advanced System Care (Asc.exe) 15 and Action Download Center both download components of IOBit suite into ProgramData folder, ProgramD (no CVSS)
- [CVE-2021-37839](https://cve.now/CVE-2021-37839.md): Improper access to dataset metadata information (no CVSS, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2022-28935](https://cve.now/CVE-2022-28935.md): Totolink A830R V5.9c.4729\_B20191112, Totolink A3100R V4.1.2cu.5050\_B20200504, Totolink A950RG V4.1.2cu.5161\_B20200903, Totolink A800R V4.1.2 (no CVSS)
- [CVE-2021-31678](https://cve.now/CVE-2021-31678.md): An issue was discovered in PESCMS-V2.3.3. (no CVSS)
- [CVE-2021-31679](https://cve.now/CVE-2021-31679.md): An issue was discovered in PESCMS-V2.3.3. (no CVSS)
- [CVE-2021-31677](https://cve.now/CVE-2021-31677.md): An issue was discovered in PESCMS-V2.3.3. (no CVSS)
- [CVE-2021-31676](https://cve.now/CVE-2021-31676.md): A reflected XSS was discovered in PESCMS-V2.3.3. (no CVSS)
- [CVE-2022-32383](https://cve.now/CVE-2022-32383.md): Tenda AC23 v16.03.07.44 was discovered to contain a stack overflow via the AdvSetMacMtuWan function. (no CVSS)
- [CVE-2022-32385](https://cve.now/CVE-2022-32385.md): Tenda AC23 v16.03.07.44 is vulnerable to Stack Overflow that will allow for the execution of arbitrary code (remote). (no CVSS)
- [CVE-2022-32386](https://cve.now/CVE-2022-32386.md): Tenda AC23 v16.03.07.44 was discovered to contain a buffer overflow via fromAdvSetMacMtuWan. (no CVSS)
- [CVE-2022-30591](https://cve.now/CVE-2022-30591.md): quic-go through 0.27.0 allows remote attackers to cause a denial of service (CPU consumption) via a Slowloris variant in which incomplete QU (no CVSS)
- [CVE-2022-32290](https://cve.now/CVE-2022-32290.md): The client in Northern.tech Mender 3.2.0, 3.2.1, and 3.2.2 has Incorrect Access Control. (no CVSS)
- [CVE-2022-35230](https://cve.now/CVE-2022-35230.md): Reflected XSS in graphs page of Zabbix Frontend (CVSS 3.7, Zabbix Frontend)
- [CVE-2022-35229](https://cve.now/CVE-2022-35229.md): Reflected XSS in discovery page of Zabbix Frontend (CVSS 3.7, Zabbix Frontend)
- [CVE-2021-23163](https://cve.now/CVE-2021-23163.md): JFrog Artifactory prior to version 7.33.6 and 6.23.38, is vulnerable to CSRF ( Cross-Site Request Forgery) for specific endpoints. (CVSS 3.1, JFrog Artifactory)
- [CVE-2022-32533](https://cve.now/CVE-2022-32533.md): Apache Portals Jetspeed XSS, CSRF, SSRF, and XXE issues (CVSS 9.8, Apache Software Foundation Apache Portals · org.apache.port…)
- [CVE-2021-46687](https://cve.now/CVE-2021-46687.md): JFrog Artifactory prior to version 7.31.10 and 6.23.38 is vulnerable to Sensitive Data Exposure through the Project Administrator REST API. (CVSS 4.9, JFrog Artifactory)
- [CVE-2021-45721](https://cve.now/CVE-2021-45721.md): JFrog Artifactory prior to version 7.29.8 and 6.23.38 is vulnerable to Reflected Cross-Site Scripting (XSS) through one of the XHR parameter (CVSS 6.1, JFrog Artifactory)
- [CVE-2022-22681](https://cve.now/CVE-2022-22681.md): Session fixation vulnerability in access control management in Synology Photo Station before 6.8.16-3506 allows remote attackers to bypass s (CVSS 8.1, Synology Photo Station)
- [CVE-2022-2318](https://cve.now/CVE-2022-2318.md): There are use-after-free vulnerabilities caused by timer handler in net/rose/rose\_timer.c of linux that allow attackers to crash linux kerne (no CVSS, Kernel)
- [CVE-2022-31125](https://cve.now/CVE-2022-31125.md): Authentication Bypass in Roxy-wi (CVSS 10.0, hap-wi roxy-wi)
- [CVE-2022-31129](https://cve.now/CVE-2022-31129.md): Inefficient Regular Expression Complexity in moment (CVSS 7.5, moment · Moment.js)
- [CVE-2022-33980](https://cve.now/CVE-2022-33980.md): Apache Commons Configuration insecure interpolation defaults (no CVSS, Apache Software Foundation Apache Commons Configuration · o…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-07-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.