CVEs published July 7, 2022
48 CVEs were published on July 7, 2022: 2 critical, 7 high.
- Published
- 48
- Critical
- 2
- High
- 7
- Medium
- 7
- Low
- 1
- Unrated
- 31
- Now in CISA KEV
- 0
- Fix available
- 19
Most affected products
- https://github.com/curl/curl
- 4
- Apache Software Foundation Apache Druid · org.apache.druid:…
- 2
- nextgen-gallery
- 2
- snipe/snipe-it
- 2
- The Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…
- 2
- Advance Secure Gateway and ProxySG
- 1
- AttorneyOnline akashi
- 1
- bookwyrm-social bookwyrm
- 1
- Cloud Mobility for Dell Storage
- 1
- Dell Cyber Recovery
- 1
Critical 2
High 7
- CVE-2022-33936Cloud Mobility for Dell EMC Storage, 1.3.0.XXX contains a RCE vulnerability.Cloud Mobility for Dell Storage
- CVE-2022-32481Dell PowerProtect Cyber Recovery, versions prior to 19.11, contain a privilege escalation vulnerability on virtual appliance deployments.Dell Cyber Recovery
- CVE-2022-2191In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByThe Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…
- CVE-2022-2048In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up noThe Eclipse Foundation Eclipse Jetty · org.eclipse.jetty.ht…
- CVE-2022-33680Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2022-31121Improper Input Validation in fabric hyperledgerhyperledger fabric · github.com/hyperledger/fabric
- CVE-2022-2342Cross-site Scripting (XSS) - Stored in outline/outlineoutline/outline
Medium, low and unrated 39
- CVE-2022-1245A privilege escalation flaw was found in the token exchange feature of keycloak.keycloak · org.keycloak:keycloak-services
- CVE-2022-32061An arbitrary file upload vulnerability in the Select User function under the People Menu component of Snipe-IT v6.0.2 allows attackers to exsnipe/snipe-it
- CVE-2022-31029Authenticated XSS in Pi-hole AdminLTEpi-hole AdminLTE
- CVE-2021-41042In Eclipse Lyo versions 1.0.0 to 4.1.0, a TransformerFactory is initialized with the defaults that do not restrict DTD loading when working The Eclipse Foundation Eclipse Lyo · org.eclipse.lyo:lyo-pa…
- CVE-2022-2047In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment oThe Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…
- CVE-2021-29281File upload vulnerability in GFI Mail Archiver versions up to and including 15.1 via insecure implementation of Telerik Web UI plugin which
- CVE-2021-35283SQL Injection vulnerability in product_admin.php in atoms183 CMS 1.0, allows attackers to execute arbitrary commands via the Name, Fname, an
- CVE-2022-33098Magnolia CMS v6.2.19 was discovered to contain a cross-site scripting (XSS) vulnerability via the Edit Contact function.
- CVE-2021-31645An issue was discovered in glFTPd 2.11a that allows remote attackers to cause a denial of service via exceeding the connection limit.
- CVE-2015-5298The Google Login Plugin (versions 1.0 and 1.1) allows malicious anonymous users to authenticate successfully against Jenkins instances that Jenkins Google Login Plugin · org.jenkins-ci.plugins:google…
- CVE-2022-28889Clickjacking in the web consoleApache Software Foundation Apache Druid · org.apache.druid:…
- CVE-2021-44791Reflected XSS on certain HTTP endpointsApache Software Foundation Apache Druid · org.apache.druid:…
- CVE-2022-31136Cross-site Scripting in BookWyrmbookwyrm-social bookwyrm
- CVE-2022-31135Maliciously crafted evidence packet may cause denial of serviceAttorneyOnline akashi
- CVE-2022-32058An infinite loop in the function httpRpmPass of TP-Link TL-WR741N/TL-WR742N V1/V2/V3_130415 allows attackers to cause a Denial of Service (D
- CVE-2022-31133Cross site scripting in HumHubhumhub
- CVE-2022-32056Online Accreditation Management v1.0 was discovered to contain a SQL injection vulnerability via the USERNAME parameter at process.php.
- CVE-2022-32055Inout Homestay v2.2 was discovered to contain a SQL injection vulnerability via the guests parameter at /index.php?page=search/rentals.
- CVE-2022-32054Tenda AC10 US_AC10V1.0RTL_V15.03.06.26_multi_TD01 was discovered to contain a remote code execution (RCE) vulnerability via the lanIp parame
- CVE-2015-5236It was discovered that the IcedTea-Web used codebase attribute of the <applet> tag on the HTML page that hosts Java applet in the Same OrigiIcedtea-web
- CVE-2022-23744Check Point Endpoint before version E86.50 failed to protect against specific registry change which allowed to disable endpoint protection bEnterprise Endpoint Security Windows Clients.
- CVE-2021-46825Symantec Advanced Secure Gateway (ASG) and ProxySG are susceptible to an HTTP desync vulnerability.Advance Secure Gateway and ProxySG
- CVE-2022-32441A memory corruption in Hex Rays Ida Pro v6.6 allows attackers to cause a Denial of Service (DoS) via a crafted file.
- CVE-2022-31854Codoforum v5.1 was discovered to contain an arbitrary file upload vulnerability via the logo change option in the admin panel.
- CVE-2015-1784In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the wenextgen-gallery
- CVE-2015-1785In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the wenextgen-gallery
- CVE-2015-3207In Openshift Origin 3 the cookies being set in console have no 'secure', 'HttpOnly' attributes.Openshift Origin · github.com/openshift/origin
- CVE-2022-25048Command injection vulnerability in CWP v0.9.8.1126 that allows normal users to run commands as the root user.
- CVE-2022-25047The password reset token in CWP v0.9.8.1126 is generated using known or predictable values.
- CVE-2022-25046A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted POST request.
- CVE-2022-33996Incorrect permission management in Devolutions Server before 2022.2 allows a new user with a preexisting username to inherit the permissions
- CVE-2022-34007EQS Integrity Line Professional through 2022-07-01 allows a stored XSS via a crafted whistleblower entry.
- CVE-2022-32567The Appfire Jira Misc Custom Fields (JMCF) app 2.4.6 for Atlassian Jira allows XSS via a crafted project name to the Add Auto Indexing Rule
- CVE-2022-32060An arbitrary file upload vulnerability in the Update Branding Settings component of Snipe-IT v6.0.2 allows attackers to execute arbitrary cosnipe/snipe-it
- CVE-2022-32205A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them.https://github.com/curl/curl
- CVE-2022-32206curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentiallyhttps://github.com/curl/curl
- CVE-2022-32208When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly.https://github.com/curl/curl
- CVE-2022-32449TOTOLINK EX300_V2 V4.0.3c.7484 was discovered to contain a command injection vulnerability via the langType parameter in the setLanguageCfg
- CVE-2022-34592Wavlink WL-WN575A3 RPT75A3.V4300.201217 was discovered to contain a command injection vulnerability via the function obtw.