CVEs published July 13, 2022
53 CVEs were published on July 13, 2022: 0 critical, 9 high.
- Published
- 53
- Critical
- 0
- High
- 9
- Medium
- 11
- Low
- 0
- Unrated
- 33
- Now in CISA KEV
- 0
- Fix available
- 17
Most affected products
- Android
- 19
- Schneider Electric OPC UA Modicon Communication Module · Sc…
- 7
- Schneider Electric Easergy P5
- 3
- @strapi/strapi
- 1
- Apache Software Foundation Apache Tapestry · org.apache.tap…
- 1
- codecov
- 1
- com.ruoyi:ruoyi
- 1
- flyteorg flyteadmin · github.com/flyteorg/flyteadmin
- 1
- IBM i
- 1
- KB Affiliate Referral Script
- 1
High 9
- CVE-2022-34761A CWE-476: NULL Pointer Dereference vulnerability exists that could cause a denial of service of the webserver when parsing JSON content typSchneider Electric OPC UA Modicon Communication Module · Sc…
- CVE-2022-34760A CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability exists that could cause a denial of service of the webserverSchneider Electric OPC UA Modicon Communication Module · Sc…
- CVE-2022-34759A CWE-787: Out-of-bounds Write vulnerability exists that could cause a denial of service of the webserver due to improper parsing of the HTTSchneider Electric OPC UA Modicon Communication Module · Sc…
- CVE-2022-34756A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in remote code execution or the crash of HTTPs Schneider Electric Easergy P5
- CVE-2022-34753A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause rSchneider Electric SpaceLogic C-Bus Home Controller
- CVE-2017-20128KB Messages PHP Script sql injectionKB Messages PHP Script
- CVE-2017-20127KB Login Authentication Script sql injectionKB Login Authentication Script
- CVE-2017-20126KB Affiliate Referral Script index.php sql injectionKB Affiliate Referral Script
- CVE-2019-10761Sandbox Bypassvm2
Medium, low and unrated 44
- CVE-2022-35857kvf-admin through 2022-02-12 allows remote attackers to execute arbitrary code because deserialization is mishandled.
- CVE-2022-34765A CWE-73: External Control of File Name or Path vulnerability exists that could cause loading of unauthorized firmware images when user-contSchneider Electric OPC UA Modicon Communication Module · Sc…
- CVE-2022-34764A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause denial of service wSchneider Electric OPC UA Modicon Communication Module · Sc…
- CVE-2022-34763A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could cause loading of unauthorized firmware images due Schneider Electric OPC UA Modicon Communication Module · Sc…
- CVE-2022-34762A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause unauthorized Schneider Electric OPC UA Modicon Communication Module · Sc…
- CVE-2022-34758A CWE-20: Improper Input Validation vulnerability exists that could cause the device watchdog function to be disabled if the attacker had acSchneider Electric Easergy P5
- CVE-2022-34757A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists where weak cipher suites can be used for the SSH connectionSchneider Electric Easergy P5
- CVE-2022-34754A CWE-269: Improper Privilege Management vulnerability exists that could allow elevated functionality when guessing credentials.Schneider Electric Acti9 PowerTag Link C
- CVE-2022-32117Jerryscript v2.4.0 was discovered to contain a stack buffer overflow via the function jerryx_print_unhandled_exception in /util/print.c.
- CVE-2022-31145Insufficient AccessToken Expiration Check in FlyteAdminflyteorg flyteadmin · github.com/flyteorg/flyteadmin
- CVE-2022-32308Cross Site Scripting (XSS) vulnerability in uBlock Origin extension before 1.41.1 allows remote attackers to run arbitrary code via a spoofe
- CVE-2020-21967File upload vulnerability in the Catalog feature in Prestashop 1.7.6.7 allows remote attackers to run arbitrary code via the add new file pa
- CVE-2022-2380The Linux kernel was found vulnerable out of bounds memory access in the drivers/video/fbdev/sm712fb.c:smtcfb_read() function.Kernel
- CVE-2022-20234In Car Settings app, the NotificationAccessConfirmationActivity is exported.Android
- CVE-2022-20212In wifi.RequestToggleWifiActivity of AndroidManifest.xml, there is a possible EoP due to a tapjacking/overlay attack.Android
- CVE-2022-20238'remap_pfn_range' here may map out of size kernel memory (for example, may map the kernel area), and because the 'vma->vm_page_prot' can alsAndroid
- CVE-2022-20236A drm driver have oob problem, could cause the system crash or EOPProduct: AndroidVersions: Android SoCAndroid ID: A-233124709Android
- CVE-2022-20230In choosePrivateKeyAlias of KeyChain.java, there is a possible access to the user's certificate due to improper input validation.Android
- CVE-2022-20229In bta_hf_client_handle_cind_list_item of bta_hf_client_at.cc, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2022-20228In various functions of C2DmaBufAllocator.cpp, there is a possible memory corruption due to a use after free.Android
- CVE-2022-20227In USB driver, there is a possible out of bounds read due to a heap buffer overflow.Android
- CVE-2022-20226In finishDrawingWindow of WindowManagerService.java, there is a possible tapjacking due to improper input validation.Android
- CVE-2022-20225In getSubscriptionProperty of SubscriptionController.java, there is a possible read of a sensitive identifier due to a missing permission chAndroid
- CVE-2022-20224In AT_SKIP_REST of bta_hf_client_at.cc, there is a possible out of bounds read due to an incorrect bounds check.Android
- CVE-2022-20223In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible way to start a phone call without permissions due toAndroid
- CVE-2022-20222In read_attr_value of gatt_db.cc, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2022-20221In avrc_ctrl_pars_vendor_cmd of avrc_pars_ct.cc, there is a possible out of bounds read due to improper input validation.Android
- CVE-2022-20220In openFile of CallLogProvider.java, there is a possible permission bypass due to a path traversal error.Android
- CVE-2022-20219In multiple functions of StorageManagerService.java and UserManagerService.java, there is a possible way to leave user's directories unencryAndroid
- CVE-2022-20218In PermissionController, there is a possible way to get and retain permissions without user's consent due to a logic error in the code.Android
- CVE-2022-20217There is a unauthorized broadcast in the SprdContactsProvider.Android
- CVE-2022-20216android exported is used to set third-party app access permissions, and the default value of intent-filter is true.Android
- CVE-2022-22982The vCenter Server contains a server-side request forgery (SSRF) vulnerability.VMware vCenter Server
- CVE-2022-34358IBM i 7.2, 7.3, 7.4, and 7.5 is vulnerable to cross-site scripting.IBM i
- CVE-2022-32096Rhonabwy before v1.1.5 was discovered to contain a buffer overflow via the component r_jwe_aesgcm_key_unwrap.
- CVE-2022-32074A stored cross-site scripting (XSS) vulnerability in the component audit/class.audit.php of osTicket-plugins - Storage-FS before commit a784
- CVE-2022-32073WolfSSH v1.4.7 was discovered to contain an integer overflow via the function wolfSSH_SFTP_RecvRMDIR.
- CVE-2022-32065An arbitrary file upload vulnerability in the background management module of RuoYi v4.7.3 and below allows attackers to execute arbitrary ccom.ruoyi:ruoyi
- CVE-2022-32274The Transition Scheduler add-on 6.5.0 for Atlassian Jira is prone to stored XSS via the project name to the creation function.
- CVE-2019-10800Command Injectioncodecov
- CVE-2022-31781Regular Expression Denial of Service (ReDoS) in ContentType.java. (GHSL-2022-022)Apache Software Foundation Apache Tapestry · org.apache.tap…
- CVE-2021-46827An issue was discovered in Oxygen XML WebHelp before 22.1 build 2021082006 and 23.x before 23.1 build 2021090310.
- CVE-2022-28888Spryker Commerce OS 1.4.2 allows Remote Command Execution.
- CVE-2022-32114An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a craf@strapi/strapi