# CVEs published 2022-07-08 25 CVEs were published on July 8, 2022: 2 critical, 3 high. Days are UTC. - [CVE-2022-35412](https://cve.now/CVE-2022-35412.md): Digital Guardian Agent 7.7.4.0042 allows an administrator (who ordinarily does not have a supported way to uninstall the product) to disable (no CVSS) - [CVE-2022-34914](https://cve.now/CVE-2022-34914.md): Webswing before 22.1.3 allows X-Forwarded-For header injection. (no CVSS) - [CVE-2022-35411](https://cve.now/CVE-2022-35411.md): rpc.py through 0.6.0 allows Remote Code Execution because an unpickle occurs when the "serializer: pickle" HTTP header is sent. (no CVSS, rpc-py) - [CVE-2022-22476](https://cve.now/CVE-2022-22476.md): IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.7 and Open Liberty are vulnerable to identity spoofing by an authenticated (CVSS 5.0, IBM WebSphere Application Server Liberty) - [CVE-2022-22465](https://cve.now/CVE-2022-22465.md): IBM Security Access Manager Appliance 10.0.0.0, 10.0.1.0, 10.0.2.0, and 10.0.3.0 could allow a local user to obtain elevated privileges due (CVSS 6.3, IBM Security Verify Access) - [CVE-2022-22464](https://cve.now/CVE-2022-22464.md): IBM Security Access Manager Appliance 10.0.0.0, 10.0.1.0, 10.0.2.0, and 10.0.3.0 uses weaker than expected cryptographic algorithms that cou (CVSS 5.9, IBM Security Verify Access) - [CVE-2022-22463](https://cve.now/CVE-2022-22463.md): IBM Security Access Manager Appliance 10.0.0.0, 10.0.1.0, 10.0.2.0, and 10.0.3.0 is vulnerable to SQL injection. (CVSS 5.4, IBM Security Verify Access) - [CVE-2022-22370](https://cve.now/CVE-2022-22370.md): IBM Security Verify Access 10.0.0.0, 10.0.1.0, 10.0.2.0, and 10.0.3.0 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Security Verify Access) - [CVE-2022-35410](https://cve.now/CVE-2022-35410.md): mat2 (aka metadata anonymisation toolkit) before 0.13.0 allows ../ directory traversal during the ZIP archive cleaning process. (no CVSS, mat2) - [CVE-2022-34306](https://cve.now/CVE-2022-34306.md): IBM CICS TX Standard and Advanced 11.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. (CVSS 5.4, IBM CICS TX Advanced · IBM CICS TX Standard) - [CVE-2022-34167](https://cve.now/CVE-2022-34167.md): IBM CICS TX Standard and Advanced 11.1 is vulnerable to stored cross-site scripting. (CVSS 5.4, IBM CICS TX Standard · IBM CICS TX Advanced) - [CVE-2022-34166](https://cve.now/CVE-2022-34166.md): IBM CICS TX Standard and Advanced 11.1 is vulnerable to cross-site scripting. (CVSS 5.4, IBM CICS TX Advanced · IBM CICS TX Standard) - [CVE-2022-34160](https://cve.now/CVE-2022-34160.md): IBM CICS TX Standard and Advanced 11.1 is vulnerable to HTML injection. (CVSS 5.4, IBM CICS TX Advanced · IBM CICS TX Standard) - [CVE-2022-35406](https://cve.now/CVE-2022-35406.md): A URL disclosure issue was discovered in Burp Suite before 2022.6. (no CVSS) - [CVE-2022-28623](https://cve.now/CVE-2022-28623.md): Security vulnerabilities in HPE IceWall SSO 10.0 certd could be exploited remotely to allow SQL injection or unauthorized data injection. (no CVSS, HPE IceWall SSO) - [CVE-2022-28624](https://cve.now/CVE-2022-28624.md): A potential security vulnerability has been identified in certain HPE FlexNetwork and FlexFabric switch products. (no CVSS, HPE FlexNetwork 5130 EI Switch Series; HPE FlexFabric 5945…) - [CVE-2022-33011](https://cve.now/CVE-2022-33011.md): Known v1.3.1+2020120201 was discovered to allow attackers to perform an account takeover via a host header injection attack. (no CVSS, idno/known) - [CVE-2022-32115](https://cve.now/CVE-2022-32115.md): An issue in the isSVG() function of Known v1.2.2+2020061101 allows attackers to execute arbitrary code via a crafted SVG file. (no CVSS, idno/known) - [CVE-2022-31290](https://cve.now/CVE-2022-31290.md): A cross-site scripting (XSS) vulnerability in Known v1.2.2+2020061101 allows authenticated attackers to execute arbitrary web scripts or HTM (no CVSS, idno/known) - [CVE-2022-30852](https://cve.now/CVE-2022-30852.md): Known v1.3.1 was discovered to contain an Insecure Direct Object Reference (IDOR). (no CVSS, idno/known) - [CVE-2021-41037](https://cve.now/CVE-2021-41037.md): In Eclipse p2, installable units are able to alter the Eclipse Platform installation and the local machine via touchpoints during installati (CVSS 10.0, The Eclipse Foundation Eclipse Equinox p2) - [CVE-2022-2343](https://cve.now/CVE-2022-2343.md): Heap-based Buffer Overflow in vim/vim (CVSS 7.8, vim/vim) - [CVE-2022-2344](https://cve.now/CVE-2022-2344.md): Heap-based Buffer Overflow in vim/vim (CVSS 7.8, vim/vim) - [CVE-2022-2345](https://cve.now/CVE-2022-2345.md): Use After Free in vim/vim (CVSS 7.8, vim/vim) - [CVE-2022-31137](https://cve.now/CVE-2022-31137.md): Unauthenticated Remote Code Execution in Roxy-WI (CVSS 10.0, hap-wi roxy-wi) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2022-07-08 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.