# CVEs published 2022-07-11

205 CVEs were published on July 11, 2022: 2 critical, 10 high. Days are UTC.

- [CVE-2022-31080](https://cve.now/CVE-2022-31080.md): KubeEdge Websocket Client in package Viaduct: DoS from large response message (CVSS 4.4, kubeedge · github.com/kubeedge/kubeedge)
- [CVE-2022-31079](https://cve.now/CVE-2022-31079.md): KubeEdge Cloud Stream and Edge Stream DoS from large stream message (CVSS 4.4, kubeedge · github.com/kubeedge/kubeedge)
- [CVE-2022-31078](https://cve.now/CVE-2022-31078.md): KubeEdge CloudCore Router memory exhaustion (CVSS 4.4, kubeedge · github.com/kubeedge/kubeedge)
- [CVE-2022-31075](https://cve.now/CVE-2022-31075.md): KubeEdge DoS when signing the CSR from EdgeCore (CVSS 4.9, kubeedge · github.com/kubeedge/kubeedge)
- [CVE-2022-31074](https://cve.now/CVE-2022-31074.md): KubeEdge Cloud AdmissionController component DoS (CVSS 4.5, kubeedge · github.com/kubeedge/kubeedge)
- [CVE-2022-31073](https://cve.now/CVE-2022-31073.md): KubeEdge Edge ServiceBus module DoS (CVSS 6.5, kubeedge · github.com/kubeedge/kubeedge)
- [CVE-2022-31140](https://cve.now/CVE-2022-31140.md): Valinor error messages leading to potential data exfiltration (CVSS 7.5, CuyZ Valinor · cuyz/valinor)
- [CVE-2020-35169](https://cve.now/CVE-2020-35169.md): Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain an Improper Inp (CVSS 9.1, Dell BSAFE Crypto-C Micro Edition)
- [CVE-2020-35168](https://cve.now/CVE-2020-35168.md): Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Tim (CVSS 4.7, Dell BSAFE Crypto-C Micro Edition)
- [CVE-2020-35167](https://cve.now/CVE-2020-35167.md): Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Tim (CVSS 4.8, Dell BSAFE Crypto-C Micro Edition)
- [CVE-2020-35166](https://cve.now/CVE-2020-35166.md): Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Tim (CVSS 5.1, Dell BSAFE Crypto-C Micro Edition · Dell BSAFE Micro Editio…)
- [CVE-2020-35164](https://cve.now/CVE-2020-35164.md): Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Tim (CVSS 6.7, Dell BSAFE Crypto-C Micro Edition)
- [CVE-2020-35163](https://cve.now/CVE-2020-35163.md): Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain a Use of Insuffic (CVSS 5.3, Dell BSAFE Crypto-C Micro Edition)
- [CVE-2020-29508](https://cve.now/CVE-2020-29508.md): Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Improper Input (CVSS 5.3, Dell BSAFE Micro Edition Suite)
- [CVE-2020-29507](https://cve.now/CVE-2020-29507.md): Dell BSAFE Crypto-C Micro Edition, versions before 4.1.4, and Dell BSAFE Micro Edition Suite, versions before 4.4, contain an Improper Input (CVSS 5.3, Dell BSAFE Crypto-C Micro Edition)
- [CVE-2020-29506](https://cve.now/CVE-2020-29506.md): Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain an Observable T (CVSS 6.8, Dell BSAFE Crypto-C Micro Edition)
- [CVE-2020-29505](https://cve.now/CVE-2020-29505.md): Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain a Key Managemen (CVSS 7.1, Dell BSAFE Crypto-C Micro Edition)
- [CVE-2022-31139](https://cve.now/CVE-2022-31139.md): No security checking for UnsafeAccess.getInstance() in UnsafeAccessor (CVSS 5.9, Karlatemp UnsafeAccessor · io.github.karlatemp:unsafe-acces…)
- [CVE-2022-31904](https://cve.now/CVE-2022-31904.md): EGT-Kommunikationstechnik UG Mediacenter before v2.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component (no CVSS)
- [CVE-2020-4150](https://cve.now/CVE-2020-4150.md): IBM SiteProtector Appliance 3.1.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inboun (CVSS 6.8, IBM Security SiteProtector System)
- [CVE-2020-4138](https://cve.now/CVE-2020-4138.md): IBM SiteProtector Appliance 3.1.1 allows web pages to be stored locally which can be read by another user on the system. (CVSS 4.0, IBM Security SiteProtector System)
- [CVE-2021-36668](https://cve.now/CVE-2021-36668.md): URL injection in Driva inSync 6.9.0 for MacOS, allows attackers to force a visit to an arbitrary url via the port parameter to the Electron (no CVSS)
- [CVE-2021-36667](https://cve.now/CVE-2021-36667.md): Command injection vulnerability in Druva inSync 6.9.0 for MacOS, allows attackers to execute arbitrary commands via crafted payload to the l (no CVSS)
- [CVE-2021-36666](https://cve.now/CVE-2021-36666.md): An issue was discovered in Druva 6.9.0 for MacOS, allows attackers to gain escalated local privileges via the inSyncDecommission. (no CVSS)
- [CVE-2021-36665](https://cve.now/CVE-2021-36665.md): An issue was discovered in Druva 6.9.0 for macOS, allows attackers to gain escalated local privileges via the inSyncUpgradeDaemon. (no CVSS)
- [CVE-2022-2366](https://cve.now/CVE-2022-2366.md): Incorrect defaults can cause attackers to bypass rate limitations (CVSS 5.6, Mattermost)
- [CVE-2022-31138](https://cve.now/CVE-2022-31138.md): OS Command Injection in mailcow (CVSS 8.8, mailcow-dockerized)
- [CVE-2021-39999](https://cve.now/CVE-2021-39999.md): There is a buffer overflow vulnerability in eSE620X vESS V100R001C10SPC200 and V100R001C20SPC200. (no CVSS, eSE620X vESS)
- [CVE-2021-40016](https://cve.now/CVE-2021-40016.md): Improper permission control vulnerability in the Bluetooth module.Successful exploitation of this vulnerability will affect confidentiality. (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-40013](https://cve.now/CVE-2021-40013.md): Improper permission control vulnerability in the Bluetooth module.Successful exploitation of this vulnerability will affect integrity. (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-40012](https://cve.now/CVE-2021-40012.md): Vulnerability of pointers being incorrectly used during data transmission in the video framework. (no CVSS, Huawei HarmonyOS · Huawei EMUI +1)
- [CVE-2022-34738](https://cve.now/CVE-2022-34738.md): The SystemUI module has a vulnerability in permission control. (no CVSS, Huawei HarmonyOS · Huawei EMUI +1)
- [CVE-2022-34737](https://cve.now/CVE-2022-34737.md): The application security module has a vulnerability in permission assignment. (no CVSS, Huawei HarmonyOS · Huawei EMUI +1)
- [CVE-2022-34742](https://cve.now/CVE-2022-34742.md): The system module has a read/write vulnerability. (no CVSS, Huawei HarmonyOS · Huawei EMUI +1)
- [CVE-2022-34739](https://cve.now/CVE-2022-34739.md): The fingerprint module has a vulnerability of overflow in arithmetic addition. (no CVSS, Huawei HarmonyOS · Huawei EMUI +1)
- [CVE-2022-34741](https://cve.now/CVE-2022-34741.md): The NFC module has a buffer overflow vulnerability. (no CVSS, Huawei HarmonyOS · Huawei EMUI +1)
- [CVE-2022-34740](https://cve.now/CVE-2022-34740.md): The NFC module has a buffer overflow vulnerability. (no CVSS, Huawei HarmonyOS · Huawei EMUI +1)
- [CVE-2022-34743](https://cve.now/CVE-2022-34743.md): The AT commands of the USB port have an out-of-bounds read vulnerability. (no CVSS, Huawei HarmonyOS · Huawei EMUI +1)
- [CVE-2022-34736](https://cve.now/CVE-2022-34736.md): The frame scheduling module has a null pointer dereference vulnerability. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-34735](https://cve.now/CVE-2022-34735.md): The frame scheduling module has a null pointer dereference vulnerability. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2021-46741](https://cve.now/CVE-2021-46741.md): The basic framework and setting module have defects, which were introduced during the design. (no CVSS, Huawei HarmonyOS · Huawei EMUI +1)
- [CVE-2022-33707](https://cve.now/CVE-2022-33707.md): Improper identifier creation logic in Find My Mobile prior to version 7.2.24.12 allows attacker to identify the device. (no CVSS, Samsung Mobile FindMyMobile)
- [CVE-2022-33705](https://cve.now/CVE-2022-33705.md): Information exposure in Calendar prior to version 12.3.05.10000 allows attacker to access calendar schedule without READ\_CALENDAR permission (no CVSS, Samsung Mobile Calendar)
- [CVE-2022-33713](https://cve.now/CVE-2022-33713.md): Implicit Intent hijacking vulnerability in Samsung Cloud prior to version 5.2.0 allows attacker to get sensitive information. (no CVSS, Samsung Mobile Samsung Cloud)
- [CVE-2022-33706](https://cve.now/CVE-2022-33706.md): Improper access control vulnerability in Samsung Gallery prior to version 13.1.05.8 allows physical attackers to access the pictures using S (no CVSS, Samsung Mobile Samsung Gallery)
- [CVE-2022-33711](https://cve.now/CVE-2022-33711.md): Improper validation of integrity check vulnerability in Samsung USB Driver Windows Installer for Mobile Phones prior to version 1.7.56.0 all (no CVSS, Samsung Mobile Samsung USB Driver Windows Installer for Mob…)
- [CVE-2022-33712](https://cve.now/CVE-2022-33712.md): Intent redirection vulnerability using implict intent in Camera prior to versions 12.0.01.64 ,12.0.3.23, 12.0.0.98, 12.0.6.11, 12.0.3.19 in (no CVSS, Samsung Mobile Camera)
- [CVE-2022-33710](https://cve.now/CVE-2022-33710.md): Improper input validation vulnerability in BillingPackageInsraller in Galaxy Store prior to version 4.5.41.8 allows local attackers to launc (no CVSS, Samsung Mobile Galaxy Store)
- [CVE-2022-33709](https://cve.now/CVE-2022-33709.md): Improper input validation vulnerability in ApexPackageInstaller in Galaxy Store prior to version 4.5.41.8 allows local attackers to launch a (no CVSS, Samsung Mobile Galaxy Store)
- [CVE-2022-33708](https://cve.now/CVE-2022-33708.md): Improper input validation vulnerability in AppsPackageInstaller in Galaxy Store prior to version 4.5.41.8 allows local attackers to launch a (no CVSS, Samsung Mobile Galaxy Store)
- [CVE-2022-33704](https://cve.now/CVE-2022-33704.md): Improper validation vulnerability in ucmRetParcelable of KnoxSDK prior to SMR Jul-2022 Release 1 allows attackers to launch certain activiti (CVSS 8.5, Samsung Mobile Devices)
- [CVE-2022-33703](https://cve.now/CVE-2022-33703.md): Improper validation vulnerability in CACertificateInfo prior to SMR Jul-2022 Release 1 allows attackers to launch certain activities. (CVSS 8.5, Samsung Mobile Devices)
- [CVE-2022-33702](https://cve.now/CVE-2022-33702.md): Improper authorization vulnerability in Knoxguard prior to SMR Jul-2022 Release 1 allows local attacker to disable keyguard and bypass Knoxg (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2022-33701](https://cve.now/CVE-2022-33701.md): Improper access control vulnerability in KnoxCustomManagerService prior to SMR Jul-2022 Release 1 allows attacker to call PowerManaer.goToSl (CVSS 3.3, Samsung Mobile Devices)
- [CVE-2022-33700](https://cve.now/CVE-2022-33700.md): Exposure of Sensitive Information in putDsaSimImsi in TelephonyUI prior to SMR Jul-2022 Release 1 allows local attacker to access imsi via l (CVSS 2.0, Samsung Mobile Devices)
- [CVE-2022-33699](https://cve.now/CVE-2022-33699.md): Exposure of Sensitive Information in getDsaSimImsi in TelephonyUI prior to SMR Jul-2022 Release 1 allows local attacker to access imsi via l (CVSS 2.0, Samsung Mobile Devices)
- [CVE-2022-33698](https://cve.now/CVE-2022-33698.md): Exposure of Sensitive Information in Telecom application prior to SMR Jul-2022 Release 1 allows local attackers to access ICCID via log. (CVSS 3.3, Samsung Mobile Devices)
- [CVE-2022-33697](https://cve.now/CVE-2022-33697.md): Sensitive information exposure vulnerability in ImsServiceSwitchBase in ImsCore prior to SMR Jul-2022 Release 1 allows local attackers with (CVSS 3.3, Samsung Mobile Devices)
- [CVE-2022-33696](https://cve.now/CVE-2022-33696.md): Exposure of Sensitive Information in Telephony service prior to SMR Jul-2022 Release 1 allows local attacker to access imsi and iccid via lo (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2022-33695](https://cve.now/CVE-2022-33695.md): Use of improper permission in InputManagerService prior to SMR Jul-2022 Release 1 allows unauthorized access to the service. (CVSS 5.1, Samsung Mobile Devices)
- [CVE-2022-33694](https://cve.now/CVE-2022-33694.md): Exposure of Sensitive Information in CSC application prior to SMR Jul-2022 Release 1 allows local attacker to access wifi information via un (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2022-33693](https://cve.now/CVE-2022-33693.md): Exposure of Sensitive Information in CID Manager prior to SMR Jul-2022 Release 1 allows local attacker to access iccid via log. (CVSS 2.0, Samsung Mobile Devices)
- [CVE-2022-33692](https://cve.now/CVE-2022-33692.md): Exposure of Sensitive Information in Messaging application prior to SMR Jul-2022 Release 1 allows local attacker to access imsi and iccid vi (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2022-33691](https://cve.now/CVE-2022-33691.md): A possible race condition vulnerability in score driver prior to SMR Jul-2022 Release 1 can allow local attackers to interleave malicious op (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2022-33690](https://cve.now/CVE-2022-33690.md): Improper input validation in Contacts Storage prior to SMR Jul-2022 Release 1 allows attacker to access arbitrary file. (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2022-33689](https://cve.now/CVE-2022-33689.md): Improper access control vulnerability in TelephonyUI prior to SMR Jul-2022 Release 1 allows attackers to change preferred network type by un (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2022-33688](https://cve.now/CVE-2022-33688.md): Sensitive information exposure vulnerability in EventType in SecTelephonyProvider prior to SMR Jul-2022 Release 1 allows local attackers wit (CVSS 3.3, Samsung Mobile Devices)
- [CVE-2022-33687](https://cve.now/CVE-2022-33687.md): Exposure of Sensitive Information in telephony-common.jar prior to SMR Jul-2022 Release 1 allows local attackers to access IMSI via log. (CVSS 3.3, Samsung Mobile Devices)
- [CVE-2022-33686](https://cve.now/CVE-2022-33686.md): Exposure of Sensitive Information in GsmAlarmManager prior to SMR Jul-2022 Release 1 allows local attacker to access iccid via log. (CVSS 2.3, Samsung Mobile Devices)
- [CVE-2022-33685](https://cve.now/CVE-2022-33685.md): Unprotected dynamic receiver in Wearable Manager Service prior to SMR Jul-2022 Release 1 allows attacker to launch arbitray activity and acc (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2022-30758](https://cve.now/CVE-2022-30758.md): Implicit Intent hijacking vulnerability in Finder prior to SMR Jul-2022 Release 1 allow allows attackers to access some protected informatio (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2022-30757](https://cve.now/CVE-2022-30757.md): Improper authorization in isemtelephony prior to SMR Jul-2022 Release 1 allows attacker to obtain CID without ACCESS\_FINE\_LOCATION permissio (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2022-30756](https://cve.now/CVE-2022-30756.md): Implicit Intent hijacking vulnerability in Finder prior to SMR Jul-2022 Release 1 allow allows attackers to launch certain activities with p (CVSS 8.5, Samsung Mobile Devices)
- [CVE-2022-30755](https://cve.now/CVE-2022-30755.md): Improper authentication vulnerability in AppLock prior to SMR Jul-2022 Release 1 allows attacker to bypass password confirm activity by hija (CVSS 7.3, Samsung Mobile Devices)
- [CVE-2022-30754](https://cve.now/CVE-2022-30754.md): Implicit Intent hijacking vulnerability in AppLinker prior to SMR Jul-2022 Release 1 allow allows attackers to launch certain activities wit (CVSS 8.5, Samsung Mobile Devices)
- [CVE-2022-30753](https://cve.now/CVE-2022-30753.md): Improper use of a unique device ID in unprotected SecSoterService prior to SMR Jul-2022 Release 1 allows local attackers to get the device I (CVSS 3.3, Samsung Mobile Devices)
- [CVE-2022-30752](https://cve.now/CVE-2022-30752.md): Improper access control vulnerability in sendDHCPACKBroadcast function of SemWifiApClient prior to SMR Jul-2022 Release 1 allows attacker to (CVSS 3.3, Samsung Mobile Devices)
- [CVE-2022-30751](https://cve.now/CVE-2022-30751.md): Improper access control vulnerability in sendDHCPACKBroadcast function of SemWifiApClient prior to SMR Jul-2022 Release 1 allows attacker to (CVSS 3.3, Samsung Mobile Devices)
- [CVE-2022-30750](https://cve.now/CVE-2022-30750.md): Improper access control vulnerability in updateLastConnectedClientInfo function of SemWifiApClient prior to SMR Jul-2022 Release 1 allows at (CVSS 3.3, Samsung Mobile Devices)
- [CVE-2022-2123](https://cve.now/CVE-2022-2123.md): WP Opt-in \<= 1.4.1 - Arbitrary Settings Update via CSRF (no CVSS, WP Opt-in)
- [CVE-2022-2093](https://cve.now/CVE-2022-2093.md): WP Duplicate Page \< 1.3 - Admin+ Stored Cross Site Scripting (no CVSS, WP Duplicate Page)
- [CVE-2022-2092](https://cve.now/CVE-2022-2092.md): WooCommerce PDF Invoices & Packing Slips \< 2.16.0 - Reflected Cross-Site Scripting (no CVSS, WooCommerce PDF Invoices & Packing Slips)
- [CVE-2022-2091](https://cve.now/CVE-2022-2091.md): Cache Images \< 3.2.1 - Image Upload / Import via CSRF (no CVSS, Cache Images)
- [CVE-2022-2089](https://cve.now/CVE-2022-2089.md): Bold Page Builder \< 4.3.3 - Admin+ Stored Cross-Site Scripting (no CVSS, Bold Page Builder)
- [CVE-2022-2050](https://cve.now/CVE-2022-2050.md): WP Paginate \< 2.1.9 - Admin+ Stored Cross-Site Scripting (no CVSS, WP-Paginate)
- [CVE-2022-1957](https://cve.now/CVE-2022-1957.md): Comment License \< 1.4.0 - Arbitrary Settings Update via CSRF (no CVSS, Comment License)
- [CVE-2022-1956](https://cve.now/CVE-2022-1956.md): Shortcut Macros \<= 1.3 - Subscriber+ Arbitrary Settings Update (no CVSS, Shortcut Macros)
- [CVE-2022-1952](https://cve.now/CVE-2022-1952.md): eaSYNC \< 1.1.16 - Unauthenticated Arbitrary File Upload (no CVSS, Free Booking Plugin for Hotels, Restaurant and Car Rental –…)
- [CVE-2022-1951](https://cve.now/CVE-2022-1951.md): Core Plugin for Kitestudio Themes \< 2.3.1 - Reflected Cross-Site-Scripting (no CVSS, core plugin for kitestudio themes)
- [CVE-2022-1938](https://cve.now/CVE-2022-1938.md): Awin Data Feed \< 1.8 - Unauthenticated Stored Cross-Site Scripting (no CVSS, Awin Data Feed)
- [CVE-2022-1937](https://cve.now/CVE-2022-1937.md): Awin Data Feed \< 1.8 - Reflected Cross-Site Scripting (no CVSS, Awin Data Feed)
- [CVE-2022-1910](https://cve.now/CVE-2022-1910.md): Shortcodes and extra features for Phlox theme \< 2.9.8 - Reflected Cross-Site-Scripting (no CVSS, Shortcodes and extra features for Phlox theme)
- [CVE-2022-1894](https://cve.now/CVE-2022-1894.md): Popup Builder \< 4.1.11 - Admin+ Stored Cross-Site Scripting (no CVSS, Popup Builder – Create highly converting, mobile friendly m…)
- [CVE-2022-1757](https://cve.now/CVE-2022-1757.md): Pagebar \< 2.70 - Arbitrary Settings Update via CSRF to Stored XSS (no CVSS, pagebar)
- [CVE-2022-1732](https://cve.now/CVE-2022-1732.md): Rename wp-login.php \<= 2.6.0 - Secret URL Update via CSRF (no CVSS, Rename wp-login.php)
- [CVE-2022-1626](https://cve.now/CVE-2022-1626.md): Sharebar \<= 1.4.1 - Arbitrary Settings Update to Stored XSS via CSRF (no CVSS, Sharebar)
- [CVE-2022-1599](https://cve.now/CVE-2022-1599.md): Admin Management Xtended \< 2.4.5 - Post Visibility/Date/Comment Status Update via CSRF (no CVSS, Admin Management Xtended)
- [CVE-2022-1576](https://cve.now/CVE-2022-1576.md): WP Maintenance Mode & Coming Soon \< 2.4.5 - Subscribed Users Deletion via CSRF (no CVSS, WP Maintenance Mode & Coming Soon)
- [CVE-2022-1546](https://cve.now/CVE-2022-1546.md): WooCommerce - Product Importer \<= 1.5.2 - Reflected Cross-Site Scripting (no CVSS, WooCommerce – Product Importer)
- [CVE-2022-1474](https://cve.now/CVE-2022-1474.md): WP Event Manager \< 3.1.28 - Reflected Cross-Site Scripting (no CVSS, WP Event Manager – Easily Build your Calendar of Events!)
- [CVE-2022-1220](https://cve.now/CVE-2022-1220.md): FoxyShop \< 4.8.2 - Reflected Cross-Site Scripting (no CVSS, FoxyShop)
- [CVE-2022-1057](https://cve.now/CVE-2022-1057.md): Pricing Deals for WooCommerce \<= 2.0.2.02 - Unauthenticated SQLi (no CVSS, Pricing Deals for WooCommerce)
- [CVE-2022-33911](https://cve.now/CVE-2022-33911.md): An issue was discovered in Couchbase Server 7.x before 7.0.4. (no CVSS)
- [CVE-2022-33173](https://cve.now/CVE-2022-33173.md): An algorithm-downgrade issue was discovered in Couchbase Server before 7.0.4. (no CVSS)
- [CVE-2021-41396](https://cve.now/CVE-2021-41396.md): Live555 through 1.08 does not handle socket connections properly. (no CVSS)
- [CVE-2022-30792](https://cve.now/CVE-2022-30792.md): CODESYS: CmpChannelServer, CmpChannelServerEmbedded allow unauthenticated attackers to block all their available communication channels (CVSS 7.5, CODESYS Control RTE · CODESYS Control Win +18)
- [CVE-2022-30791](https://cve.now/CVE-2022-30791.md): CODESYS V3: CmpBlkDrvTcp allows unauthenticated attackers to block all its available TCP connections (CVSS 7.5, CODESYS Control RTE · CODESYS Control Win +18)
- [CVE-2022-2302](https://cve.now/CVE-2022-2302.md): LENZE: Missing password verification in authorisation procedure (CVSS 9.8, LENZE cabinet c520 · LENZE cabinet c550 +1)
- [CVE-2022-1794](https://cve.now/CVE-2022-1794.md): Plaintext Storage of a password in CODESYS V3 OPC DA Server (CVSS 5.5, CODESYS OPC DA Server)
- [CVE-2022-2368](https://cve.now/CVE-2022-2368.md): Authentication Bypass by Spoofing in microweber/microweber (CVSS 6.5, microweber/microweber)
- [CVE-2022-35416](https://cve.now/CVE-2022-35416.md): H3C SSL VPN through 2022-07-10 allows wnm/login/login.json svpnlang cookie XSS. (no CVSS)
- [CVE-2022-35414](https://cve.now/CVE-2022-35414.md): softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate\_fail path, leading to an io\_readx or io\_writex cr (no CVSS)
- [CVE-2022-31588](https://cve.now/CVE-2022-31588.md): The zippies/testplatform repository through 2016-07-19 on GitHub allows absolute path traversal because the Flask send\_file function is used (no CVSS)
- [CVE-2022-31587](https://cve.now/CVE-2022-31587.md): The yuriyouzhou/KG-fashion-chatbot repository through 2018-05-22 on GitHub allows absolute path traversal because the Flask send\_file functi (no CVSS)
- [CVE-2022-31586](https://cve.now/CVE-2022-31586.md): The unizar-30226-2019-06/ChangePop-Back repository through 2019-06-04 on GitHub allows absolute path traversal because the Flask send\_file f (no CVSS)
- [CVE-2022-31585](https://cve.now/CVE-2022-31585.md): The umeshpatil-dev/Home\_\_internet repository through 2020-08-28 on GitHub allows absolute path traversal because the Flask send\_file functio (no CVSS)
- [CVE-2022-31584](https://cve.now/CVE-2022-31584.md): The stonethree/s3label repository through 2019-08-14 on GitHub allows absolute path traversal because the Flask send\_file function is used u (no CVSS)
- [CVE-2022-31583](https://cve.now/CVE-2022-31583.md): The sravaniboinepelli/AutomatedQuizEval repository through 2020-04-27 on GitHub allows absolute path traversal because the Flask send\_file f (no CVSS)
- [CVE-2022-31582](https://cve.now/CVE-2022-31582.md): The shaolo1/VideoServer repository through 2019-09-21 on GitHub allows absolute path traversal because the Flask send\_file function is used (no CVSS)
- [CVE-2022-31581](https://cve.now/CVE-2022-31581.md): The scorelab/OpenMF repository before 2022-05-03 on GitHub allows absolute path traversal because the Flask send\_file function is used unsaf (no CVSS)
- [CVE-2022-31580](https://cve.now/CVE-2022-31580.md): The sanojtharindu/caretakerr-api repository through 2021-05-17 on GitHub allows absolute path traversal because the Flask send\_file function (no CVSS)
- [CVE-2022-31579](https://cve.now/CVE-2022-31579.md): The ralphjzhang/iasset repository through 2022-05-04 on GitHub allows absolute path traversal because the Flask send\_file function is used u (no CVSS)
- [CVE-2022-31578](https://cve.now/CVE-2022-31578.md): The piaoyunsoft/bt\_lnmp repository through 2019-10-10 on GitHub allows absolute path traversal because the Flask send\_file function is used (no CVSS)
- [CVE-2022-31577](https://cve.now/CVE-2022-31577.md): The longmaoteamtf/audio\_aligner\_app repository through 2020-01-10 on GitHub allows absolute path traversal because the Flask send\_file funct (no CVSS)
- [CVE-2022-31576](https://cve.now/CVE-2022-31576.md): The heidi-luong1109/shackerpanel repository through 2021-05-25 on GitHub allows absolute path traversal because the Flask send\_file function (no CVSS)
- [CVE-2022-31575](https://cve.now/CVE-2022-31575.md): The duducosmos/livro\_python repository through 2018-06-06 on GitHub allows absolute path traversal because the Flask send\_file function is u (no CVSS)
- [CVE-2022-31574](https://cve.now/CVE-2022-31574.md): The deepaliupadhyay/RealEstate repository through 2018-11-30 on GitHub allows absolute path traversal because the Flask send\_file function i (no CVSS)
- [CVE-2022-31573](https://cve.now/CVE-2022-31573.md): The chainer/chainerrl-visualizer repository through 0.1.1 on GitHub allows absolute path traversal because the Flask send\_file function is u (no CVSS, chainerrl-visualizer)
- [CVE-2022-31572](https://cve.now/CVE-2022-31572.md): The ceee-vip/cockybook repository through 2015-04-16 on GitHub allows absolute path traversal because the Flask send\_file function is used u (no CVSS)
- [CVE-2022-31571](https://cve.now/CVE-2022-31571.md): The akashtalole/python-flask-restful-api repository through 2019-09-16 on GitHub allows absolute path traversal because the Flask send\_file (no CVSS)
- [CVE-2022-31570](https://cve.now/CVE-2022-31570.md): The adriankoczuruek/ceneo-web-scrapper repository through 2021-03-15 on GitHub allows absolute path traversal because the Flask send\_file fu (no CVSS)
- [CVE-2022-31568](https://cve.now/CVE-2022-31568.md): The Rexians/rex-web repository through 2022-06-05 on GitHub allows absolute path traversal because the Flask send\_file function is used unsa (no CVSS)
- [CVE-2022-31567](https://cve.now/CVE-2022-31567.md): The DSABenchmark/DSAB repository through 2.1 on GitHub allows absolute path traversal because the Flask send\_file function is used unsafely. (no CVSS)
- [CVE-2022-31566](https://cve.now/CVE-2022-31566.md): The DSAB-local/DSAB repository through 2019-02-18 on GitHub allows absolute path traversal because the Flask send\_file function is used unsa (no CVSS)
- [CVE-2022-31565](https://cve.now/CVE-2022-31565.md): The yogson/syrabond repository through 2020-05-25 on GitHub allows absolute path traversal because the Flask send\_file function is used unsa (no CVSS)
- [CVE-2022-31564](https://cve.now/CVE-2022-31564.md): The woduq1414/munhak-moa repository before 2022-05-03 on GitHub allows absolute path traversal because the Flask send\_file function is used (no CVSS)
- [CVE-2022-31563](https://cve.now/CVE-2022-31563.md): The whmacmac/vprj repository through 2022-04-06 on GitHub allows absolute path traversal because the Flask send\_file function is used unsafe (no CVSS)
- [CVE-2022-31562](https://cve.now/CVE-2022-31562.md): The waveyan/internshipsystem repository through 2018-05-22 on GitHub allows absolute path traversal because the Flask send\_file function is (no CVSS)
- [CVE-2022-31561](https://cve.now/CVE-2022-31561.md): The varijkapil13/Sphere\_ImageBackend repository through 2019-10-03 on GitHub allows absolute path traversal because the Flask send\_file func (no CVSS)
- [CVE-2022-31560](https://cve.now/CVE-2022-31560.md): The uncleYiba/photo\_tag repository through 2020-08-31 on GitHub allows absolute path traversal because the Flask send\_file function is used (no CVSS)
- [CVE-2022-31559](https://cve.now/CVE-2022-31559.md): The tsileo/flask-yeoman repository through 2013-09-13 on GitHub allows absolute path traversal because the Flask send\_file function is used (no CVSS)
- [CVE-2022-31558](https://cve.now/CVE-2022-31558.md): The tooxie/shiva-server repository through 0.10.0 on GitHub allows absolute path traversal because the Flask send\_file function is used unsa (no CVSS, shiva)
- [CVE-2022-31557](https://cve.now/CVE-2022-31557.md): The seveas/golem repository through 2016-05-17 on GitHub allows absolute path traversal because the Flask send\_file function is used unsafel (no CVSS)
- [CVE-2022-31556](https://cve.now/CVE-2022-31556.md): The rusyasoft/TrainEnergyServer repository through 2017-08-03 on GitHub allows absolute path traversal because the Flask send\_file function (no CVSS)
- [CVE-2022-31555](https://cve.now/CVE-2022-31555.md): The romain20100/nursequest repository through 2018-02-22 on GitHub allows absolute path traversal because the Flask send\_file function is us (no CVSS)
- [CVE-2022-31554](https://cve.now/CVE-2022-31554.md): The rohitnayak/movie-review-sentiment-analysis repository through 2017-05-07 on GitHub allows absolute path traversal because the Flask send (no CVSS)
- [CVE-2022-31553](https://cve.now/CVE-2022-31553.md): The rainsoupah/sleep-learner repository through 2021-02-21 on GitHub allows absolute path traversal because the Flask send\_file function is (no CVSS)
- [CVE-2022-31552](https://cve.now/CVE-2022-31552.md): The project-anuvaad/anuvaad-corpus repository through 2020-11-23 on GitHub allows absolute path traversal because the Flask send\_file functi (no CVSS)
- [CVE-2022-31551](https://cve.now/CVE-2022-31551.md): The pleomax00/flask-mongo-skel repository through 2012-11-01 on GitHub allows absolute path traversal because the Flask send\_file function i (no CVSS)
- [CVE-2022-31550](https://cve.now/CVE-2022-31550.md): The olmax99/pyathenastack repository through 2019-11-08 on GitHub allows absolute path traversal because the Flask send\_file function is use (no CVSS)
- [CVE-2022-31549](https://cve.now/CVE-2022-31549.md): The olmax99/helm-flask-celery repository before 2022-05-25 on GitHub allows absolute path traversal because the Flask send\_file function is (no CVSS)
- [CVE-2022-31548](https://cve.now/CVE-2022-31548.md): The nrlakin/homepage repository through 2017-03-06 on GitHub allows absolute path traversal because the Flask send\_file function is used uns (no CVSS)
- [CVE-2022-31547](https://cve.now/CVE-2022-31547.md): The noamezekiel/sphere repository through 2020-05-31 on GitHub allows absolute path traversal because the Flask send\_file function is used u (no CVSS)
- [CVE-2022-31546](https://cve.now/CVE-2022-31546.md): The nlpweb/glance repository through 2014-06-27 on GitHub allows absolute path traversal because the Flask send\_file function is used unsafe (no CVSS)
- [CVE-2022-31545](https://cve.now/CVE-2022-31545.md): The ml-inory/ModelConverter repository through 2021-04-26 on GitHub allows absolute path traversal because the Flask send\_file function is u (no CVSS)
- [CVE-2022-31544](https://cve.now/CVE-2022-31544.md): The meerstein/rbtm repository through 1.5 on GitHub allows absolute path traversal because the Flask send\_file function is used unsafely. (no CVSS)
- [CVE-2022-31543](https://cve.now/CVE-2022-31543.md): The maxtortime/SetupBox repository through 1.0 on GitHub allows absolute path traversal because the Flask send\_file function is used unsafel (no CVSS)
- [CVE-2022-31542](https://cve.now/CVE-2022-31542.md): The mandoku/mdweb repository through 2015-05-07 on GitHub allows absolute path traversal because the Flask send\_file function is used unsafe (no CVSS)
- [CVE-2022-31541](https://cve.now/CVE-2022-31541.md): The lyubolp/Barry-Voice-Assistant repository through 2021-01-18 on GitHub allows absolute path traversal because the Flask send\_file functio (no CVSS)
- [CVE-2022-31540](https://cve.now/CVE-2022-31540.md): The kumardeepak/hin-eng-preprocessing repository through 2019-07-16 on GitHub allows absolute path traversal because the Flask send\_file fun (no CVSS)
- [CVE-2022-31539](https://cve.now/CVE-2022-31539.md): The kotekan/kotekan repository through 2021.11 on GitHub allows absolute path traversal because the Flask send\_file function is used unsafel (no CVSS)
- [CVE-2022-31538](https://cve.now/CVE-2022-31538.md): The joaopedro-fg/mp-m08-interface repository through 2020-12-10 on GitHub allows absolute path traversal because the Flask send\_file functio (no CVSS)
- [CVE-2022-31537](https://cve.now/CVE-2022-31537.md): The jmcginty15/Solar-system-simulator repository through 2021-07-26 on GitHub allows absolute path traversal because the Flask send\_file fun (no CVSS)
- [CVE-2022-31536](https://cve.now/CVE-2022-31536.md): The jaygarza1982/ytdl-sync repository through 2021-01-02 on GitHub allows absolute path traversal because the Flask send\_file function is us (no CVSS)
- [CVE-2022-31535](https://cve.now/CVE-2022-31535.md): The freefood89/Fishtank repository through 2015-06-24 on GitHub allows absolute path traversal because the Flask send\_file function is used (no CVSS)
- [CVE-2022-31534](https://cve.now/CVE-2022-31534.md): The echoleegroup/PythonWeb repository through 2018-10-31 on GitHub allows absolute path traversal because the Flask send\_file function is us (no CVSS)
- [CVE-2022-31533](https://cve.now/CVE-2022-31533.md): The decentraminds/umbral repository through 2020-01-15 on GitHub allows absolute path traversal because the Flask send\_file function is used (no CVSS)
- [CVE-2022-31532](https://cve.now/CVE-2022-31532.md): The dankolbman/travel\_blahg repository through 2016-01-16 on GitHub allows absolute path traversal because the Flask send\_file function is u (no CVSS)
- [CVE-2022-31531](https://cve.now/CVE-2022-31531.md): The dainst/cilantro repository through 0.0.4 on GitHub allows absolute path traversal because the Flask send\_file function is used unsafely. (no CVSS)
- [CVE-2022-31530](https://cve.now/CVE-2022-31530.md): The csm-aut/csm repository through 3.5 on GitHub allows absolute path traversal because the Flask send\_file function is used unsafely. (no CVSS)
- [CVE-2022-31529](https://cve.now/CVE-2022-31529.md): The cinemaproject/monorepo repository through 2021-03-03 on GitHub allows absolute path traversal because the Flask send\_file function is us (no CVSS)
- [CVE-2022-31528](https://cve.now/CVE-2022-31528.md): The bonn-activity-maps/bam\_annotation\_tool repository through 2021-08-31 on GitHub allows absolute path traversal because the Flask send\_fil (no CVSS)
- [CVE-2022-31527](https://cve.now/CVE-2022-31527.md): The Wildog/flask-file-server repository through 2020-02-20 on GitHub allows absolute path traversal because the Flask send\_file function is (no CVSS)
- [CVE-2022-31526](https://cve.now/CVE-2022-31526.md): The ThundeRatz/ThunderDocs repository through 2020-05-01 on GitHub allows absolute path traversal because the Flask send\_file function is us (no CVSS)
- [CVE-2022-31525](https://cve.now/CVE-2022-31525.md): The SummaLabs/DLS repository through 0.1.0 on GitHub allows absolute path traversal because the Flask send\_file function is used unsafely. (no CVSS)
- [CVE-2022-31524](https://cve.now/CVE-2022-31524.md): The PureStorage-OpenConnect/swagger repository through 1.1.5 on GitHub allows absolute path traversal because the Flask send\_file function i (no CVSS)
- [CVE-2022-31523](https://cve.now/CVE-2022-31523.md): The PaddlePaddle/Anakin repository through 0.1.1 on GitHub allows absolute path traversal because the Flask send\_file function is used unsaf (no CVSS)
- [CVE-2022-31522](https://cve.now/CVE-2022-31522.md): The NotVinay/karaokey repository through 2019-12-11 on GitHub allows absolute path traversal because the Flask send\_file function is used un (no CVSS)
- [CVE-2022-31521](https://cve.now/CVE-2022-31521.md): The Niyaz-Mohamed/mosaic repository through 1.0.0 on GitHub allows absolute path traversal because the Flask send\_file function is used unsa (no CVSS)
- [CVE-2022-31520](https://cve.now/CVE-2022-31520.md): The Luxas98/logstash-management-api repository through 2020-05-04 on GitHub allows absolute path traversal because the Flask send\_file funct (no CVSS)
- [CVE-2022-31519](https://cve.now/CVE-2022-31519.md): The Lukasavicus/WindMill repository through 1.0 on GitHub allows absolute path traversal because the Flask send\_file function is used unsafe (no CVSS)
- [CVE-2022-31518](https://cve.now/CVE-2022-31518.md): The JustAnotherSoftwareDeveloper/Python-Recipe-Database repository through 2021-03-31 on GitHub allows absolute path traversal because the F (no CVSS)
- [CVE-2022-31517](https://cve.now/CVE-2022-31517.md): The HolgerGraef/MSM repository through 2021-04-20 on GitHub allows absolute path traversal because the Flask send\_file function is used unsa (no CVSS)
- [CVE-2022-31516](https://cve.now/CVE-2022-31516.md): The Harveyzyh/Python repository through 2022-05-04 on GitHub allows absolute path traversal because the Flask send\_file function is used uns (no CVSS)
- [CVE-2022-31515](https://cve.now/CVE-2022-31515.md): The Delor4/CarceresBE repository through 1.0 on GitHub allows absolute path traversal because the Flask send\_file function is used unsafely. (no CVSS)
- [CVE-2022-31514](https://cve.now/CVE-2022-31514.md): The Caoyongqi912/Fan\_Platform repository through 2021-04-20 on GitHub allows absolute path traversal because the Flask send\_file function is (no CVSS)
- [CVE-2022-31513](https://cve.now/CVE-2022-31513.md): The BolunHan/Krypton repository through 2021-06-03 on GitHub allows absolute path traversal because the Flask send\_file function is used uns (no CVSS)
- [CVE-2022-31512](https://cve.now/CVE-2022-31512.md): The Atom02/flask-mvc repository through 2020-09-14 on GitHub allows absolute path traversal because the Flask send\_file function is used uns (no CVSS)
- [CVE-2022-31511](https://cve.now/CVE-2022-31511.md): The AFDudley/equanimity repository through 2014-04-23 on GitHub allows absolute path traversal because the Flask send\_file function is used (no CVSS)
- [CVE-2022-31510](https://cve.now/CVE-2022-31510.md): The sergeKashkin/Simple-RAT repository before 2022-05-03 on GitHub allows absolute path traversal because the Flask send\_file function is us (no CVSS)
- [CVE-2022-31509](https://cve.now/CVE-2022-31509.md): The iedadata/usap-dc-website repository through 1.0.1 on GitHub allows absolute path traversal because the Flask send\_file function is used (no CVSS)
- [CVE-2022-31508](https://cve.now/CVE-2022-31508.md): The idayrus/evoting repository before 2022-05-08 on GitHub allows absolute path traversal because the Flask send\_file function is used unsaf (no CVSS)
- [CVE-2022-31507](https://cve.now/CVE-2022-31507.md): The ganga-devs/ganga repository before 8.5.10 on GitHub allows absolute path traversal because the Flask send\_file function is used unsafely (no CVSS, ganga)
- [CVE-2022-31506](https://cve.now/CVE-2022-31506.md): The cmusatyalab/opendiamond repository through 10.1.1 on GitHub allows absolute path traversal because the Flask send\_file function is used (no CVSS, opendiamond)
- [CVE-2022-31505](https://cve.now/CVE-2022-31505.md): The cheo0/MercadoEnLineaBack repository through 2022-05-04 on GitHub allows absolute path traversal because the Flask send\_file function is (no CVSS)
- [CVE-2022-31504](https://cve.now/CVE-2022-31504.md): The ChangeWeDer/BaiduWenkuSpider\_flaskWeb repository before 2021-11-29 on GitHub allows absolute path traversal because the Flask send\_file (no CVSS)
- [CVE-2022-31503](https://cve.now/CVE-2022-31503.md): The orchest/orchest repository before 2022.05.0 on GitHub allows absolute path traversal because the Flask send\_file function is used unsafe (no CVSS)
- [CVE-2022-31502](https://cve.now/CVE-2022-31502.md): The operatorequals/wormnest repository through 0.4.7 on GitHub allows absolute path traversal because the Flask send\_file function is used u (no CVSS)
- [CVE-2022-31501](https://cve.now/CVE-2022-31501.md): The ChaoticOnyx/OnyxForum repository before 2022-05-04 on GitHub allows absolute path traversal because the Flask send\_file function is used (no CVSS)
- [CVE-2022-31472](https://cve.now/CVE-2022-31472.md): Browse restriction bypass vulnerability in Cabinet of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to obtain the data (no CVSS, Cybozu Garoon)
- [CVE-2022-30943](https://cve.now/CVE-2022-30943.md): Browsing restriction bypass vulnerability in Bulletin of Cybozu Garoon 4.0.0 to 5.9.1 allows a remote authenticated attacker to obtain the d (no CVSS, Cybozu Garoon)
- [CVE-2022-30602](https://cve.now/CVE-2022-30602.md): Operation restriction bypass in multiple applications of Cybozu Garoon 4.0.0 to 5.9.1 allows a remote authenticated attacker to alter the fi (no CVSS, Cybozu Garoon)
- [CVE-2022-29512](https://cve.now/CVE-2022-29512.md): Exposure of sensitive information to an unauthorized actor issue in multiple applications of Cybozu Garoon 4.0.0 to 5.9.1 allows a remote au (no CVSS, Cybozu Garoon)
- [CVE-2022-27168](https://cve.now/CVE-2022-27168.md): Cross-site scripting vulnerability in LiteCart versions prior to 2.4.2 allows a remote attacker to inject an arbitrary script via unspecifie (no CVSS, LiteCart)
- [CVE-2022-32294](https://cve.now/CVE-2022-32294.md): Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly created password (from the "zmprove ca" command). (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-07-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.