# CVEs published 2022-07-07

48 CVEs were published on July 7, 2022: 2 critical, 7 high. Days are UTC.

- [CVE-2022-1245](https://cve.now/CVE-2022-1245.md): A privilege escalation flaw was found in the token exchange feature of keycloak. (no CVSS, keycloak · org.keycloak:keycloak-services)
- [CVE-2022-32061](https://cve.now/CVE-2022-32061.md): An arbitrary file upload vulnerability in the Select User function under the People Menu component of Snipe-IT v6.0.2 allows attackers to ex (no CVSS, snipe/snipe-it)
- [CVE-2022-33936](https://cve.now/CVE-2022-33936.md): Cloud Mobility for Dell EMC Storage, 1.3.0.XXX contains a RCE vulnerability. (CVSS 8.0, Cloud Mobility for Dell Storage)
- [CVE-2022-32481](https://cve.now/CVE-2022-32481.md): Dell PowerProtect Cyber Recovery, versions prior to 19.11, contain a privilege escalation vulnerability on virtual appliance deployments. (CVSS 7.8, Dell Cyber Recovery)
- [CVE-2022-31029](https://cve.now/CVE-2022-31029.md): Authenticated XSS in Pi-hole AdminLTE (CVSS 5.9, pi-hole AdminLTE)
- [CVE-2021-41042](https://cve.now/CVE-2021-41042.md): In Eclipse Lyo versions 1.0.0 to 4.1.0, a TransformerFactory is initialized with the defaults that do not restrict DTD loading when working (no CVSS, The Eclipse Foundation Eclipse Lyo · org.eclipse.lyo:lyo-pa…)
- [CVE-2022-2191](https://cve.now/CVE-2022-2191.md): In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured By (CVSS 7.5, The Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…)
- [CVE-2022-2047](https://cve.now/CVE-2022-2047.md): In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment o (CVSS 2.7, The Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…)
- [CVE-2022-2048](https://cve.now/CVE-2022-2048.md): In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up no (CVSS 7.5, The Eclipse Foundation Eclipse Jetty · org.eclipse.jetty.ht…)
- [CVE-2022-33680](https://cve.now/CVE-2022-33680.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 8.3, Microsoft Edge)
- [CVE-2021-29281](https://cve.now/CVE-2021-29281.md): File upload vulnerability in GFI Mail Archiver versions up to and including 15.1 via insecure implementation of Telerik Web UI plugin which (no CVSS)
- [CVE-2021-35283](https://cve.now/CVE-2021-35283.md): SQL Injection vulnerability in product\_admin.php in atoms183 CMS 1.0, allows attackers to execute arbitrary commands via the Name, Fname, an (no CVSS)
- [CVE-2022-33098](https://cve.now/CVE-2022-33098.md): Magnolia CMS v6.2.19 was discovered to contain a cross-site scripting (XSS) vulnerability via the Edit Contact function. (no CVSS)
- [CVE-2021-31645](https://cve.now/CVE-2021-31645.md): An issue was discovered in glFTPd 2.11a that allows remote attackers to cause a denial of service via exceeding the connection limit. (no CVSS)
- [CVE-2015-5298](https://cve.now/CVE-2015-5298.md): The Google Login Plugin (versions 1.0 and 1.1) allows malicious anonymous users to authenticate successfully against Jenkins instances that (no CVSS, Jenkins Google Login Plugin · org.jenkins-ci.plugins:google…)
- [CVE-2022-28889](https://cve.now/CVE-2022-28889.md): Clickjacking in the web console (no CVSS, Apache Software Foundation Apache Druid · org.apache.druid:…)
- [CVE-2021-44791](https://cve.now/CVE-2021-44791.md): Reflected XSS on certain HTTP endpoints (no CVSS, Apache Software Foundation Apache Druid · org.apache.druid:…)
- [CVE-2022-31121](https://cve.now/CVE-2022-31121.md): Improper Input Validation in fabric hyperledger (CVSS 7.5, hyperledger fabric · github.com/hyperledger/fabric)
- [CVE-2022-31136](https://cve.now/CVE-2022-31136.md): Cross-site Scripting in BookWyrm (CVSS 6.3, bookwyrm-social bookwyrm)
- [CVE-2022-31135](https://cve.now/CVE-2022-31135.md): Maliciously crafted evidence packet may cause denial of service (CVSS 6.5, AttorneyOnline akashi)
- [CVE-2022-32058](https://cve.now/CVE-2022-32058.md): An infinite loop in the function httpRpmPass of TP-Link TL-WR741N/TL-WR742N V1/V2/V3\_130415 allows attackers to cause a Denial of Service (D (no CVSS)
- [CVE-2022-31133](https://cve.now/CVE-2022-31133.md): Cross site scripting in HumHub (CVSS 5.9, humhub)
- [CVE-2022-32056](https://cve.now/CVE-2022-32056.md): Online Accreditation Management v1.0 was discovered to contain a SQL injection vulnerability via the USERNAME parameter at process.php. (no CVSS)
- [CVE-2022-32055](https://cve.now/CVE-2022-32055.md): Inout Homestay v2.2 was discovered to contain a SQL injection vulnerability via the guests parameter at /index.php?page=search/rentals. (no CVSS)
- [CVE-2022-32054](https://cve.now/CVE-2022-32054.md): Tenda AC10 US\_AC10V1.0RTL\_V15.03.06.26\_multi\_TD01 was discovered to contain a remote code execution (RCE) vulnerability via the lanIp parame (no CVSS)
- [CVE-2015-5236](https://cve.now/CVE-2015-5236.md): It was discovered that the IcedTea-Web used codebase attribute of the \<applet\> tag on the HTML page that hosts Java applet in the Same Origi (no CVSS, Icedtea-web)
- [CVE-2022-23744](https://cve.now/CVE-2022-23744.md): Check Point Endpoint before version E86.50 failed to protect against specific registry change which allowed to disable endpoint protection b (no CVSS, Enterprise Endpoint Security Windows Clients.)
- [CVE-2021-46825](https://cve.now/CVE-2021-46825.md): Symantec Advanced Secure Gateway (ASG) and ProxySG are susceptible to an HTTP desync vulnerability. (no CVSS, Advance Secure Gateway and ProxySG)
- [CVE-2022-32441](https://cve.now/CVE-2022-32441.md): A memory corruption in Hex Rays Ida Pro v6.6 allows attackers to cause a Denial of Service (DoS) via a crafted file. (no CVSS)
- [CVE-2022-31854](https://cve.now/CVE-2022-31854.md): Codoforum v5.1 was discovered to contain an arbitrary file upload vulnerability via the logo change option in the admin panel. (no CVSS)
- [CVE-2015-1784](https://cve.now/CVE-2015-1784.md): In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the we (no CVSS, nextgen-gallery)
- [CVE-2015-1785](https://cve.now/CVE-2015-1785.md): In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the we (no CVSS, nextgen-gallery)
- [CVE-2015-3207](https://cve.now/CVE-2015-3207.md): In Openshift Origin 3 the cookies being set in console have no 'secure', 'HttpOnly' attributes. (no CVSS, Openshift Origin · github.com/openshift/origin)
- [CVE-2022-25048](https://cve.now/CVE-2022-25048.md): Command injection vulnerability in CWP v0.9.8.1126 that allows normal users to run commands as the root user. (no CVSS)
- [CVE-2022-25047](https://cve.now/CVE-2022-25047.md): The password reset token in CWP v0.9.8.1126 is generated using known or predictable values. (no CVSS)
- [CVE-2022-25046](https://cve.now/CVE-2022-25046.md): A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted POST request. (no CVSS)
- [CVE-2022-33996](https://cve.now/CVE-2022-33996.md): Incorrect permission management in Devolutions Server before 2022.2 allows a new user with a preexisting username to inherit the permissions (no CVSS)
- [CVE-2022-34007](https://cve.now/CVE-2022-34007.md): EQS Integrity Line Professional through 2022-07-01 allows a stored XSS via a crafted whistleblower entry. (no CVSS)
- [CVE-2022-32567](https://cve.now/CVE-2022-32567.md): The Appfire Jira Misc Custom Fields (JMCF) app 2.4.6 for Atlassian Jira allows XSS via a crafted project name to the Add Auto Indexing Rule (no CVSS)
- [CVE-2022-2342](https://cve.now/CVE-2022-2342.md): Cross-site Scripting (XSS) - Stored in outline/outline (CVSS 7.3, outline/outline)
- [CVE-2022-2339](https://cve.now/CVE-2022-2339.md): Server-Side Request Forgery (SSRF) in nocodb/nocodb (CVSS 9.1, nocodb/nocodb)
- [CVE-2022-32060](https://cve.now/CVE-2022-32060.md): An arbitrary file upload vulnerability in the Update Branding Settings component of Snipe-IT v6.0.2 allows attackers to execute arbitrary co (no CVSS, snipe/snipe-it)
- [CVE-2022-32205](https://cve.now/CVE-2022-32205.md): A malicious server can serve excessive amounts of \`Set-Cookie:\` headers in a HTTP response to curl and curl \< 7.84.0 stores all of them. (CVSS 4.3, https://github.com/curl/curl)
- [CVE-2022-32206](https://cve.now/CVE-2022-32206.md): curl \< 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially (CVSS 6.5, https://github.com/curl/curl)
- [CVE-2022-32207](https://cve.now/CVE-2022-32207.md): When curl \< 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a ren (CVSS 9.8, https://github.com/curl/curl)
- [CVE-2022-32208](https://cve.now/CVE-2022-32208.md): When curl \< 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. (CVSS 5.9, https://github.com/curl/curl)
- [CVE-2022-32449](https://cve.now/CVE-2022-32449.md): TOTOLINK EX300\_V2 V4.0.3c.7484 was discovered to contain a command injection vulnerability via the langType parameter in the setLanguageCfg (no CVSS)
- [CVE-2022-34592](https://cve.now/CVE-2022-34592.md): Wavlink WL-WN575A3 RPT75A3.V4300.201217 was discovered to contain a command injection vulnerability via the function obtw. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-07-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.