# CVEs published 2022-07-13

53 CVEs were published on July 13, 2022: 0 critical, 9 high. Days are UTC.

- [CVE-2022-35857](https://cve.now/CVE-2022-35857.md): kvf-admin through 2022-02-12 allows remote attackers to execute arbitrary code because deserialization is mishandled. (no CVSS)
- [CVE-2022-34765](https://cve.now/CVE-2022-34765.md): A CWE-73: External Control of File Name or Path vulnerability exists that could cause loading of unauthorized firmware images when user-cont (CVSS 5.5, Schneider Electric OPC UA Modicon Communication Module · Sc…)
- [CVE-2022-34764](https://cve.now/CVE-2022-34764.md): A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause denial of service w (CVSS 5.9, Schneider Electric OPC UA Modicon Communication Module · Sc…)
- [CVE-2022-34763](https://cve.now/CVE-2022-34763.md): A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could cause loading of unauthorized firmware images due (CVSS 5.9, Schneider Electric OPC UA Modicon Communication Module · Sc…)
- [CVE-2022-34762](https://cve.now/CVE-2022-34762.md): A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause unauthorized (CVSS 5.9, Schneider Electric OPC UA Modicon Communication Module · Sc…)
- [CVE-2022-34761](https://cve.now/CVE-2022-34761.md): A CWE-476: NULL Pointer Dereference vulnerability exists that could cause a denial of service of the webserver when parsing JSON content typ (CVSS 7.5, Schneider Electric OPC UA Modicon Communication Module · Sc…)
- [CVE-2022-34760](https://cve.now/CVE-2022-34760.md): A CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability exists that could cause a denial of service of the webserver (CVSS 7.5, Schneider Electric OPC UA Modicon Communication Module · Sc…)
- [CVE-2022-34759](https://cve.now/CVE-2022-34759.md): A CWE-787: Out-of-bounds Write vulnerability exists that could cause a denial of service of the webserver due to improper parsing of the HTT (CVSS 7.5, Schneider Electric OPC UA Modicon Communication Module · Sc…)
- [CVE-2022-34758](https://cve.now/CVE-2022-34758.md): A CWE-20: Improper Input Validation vulnerability exists that could cause the device watchdog function to be disabled if the attacker had ac (CVSS 5.1, Schneider Electric Easergy P5)
- [CVE-2022-34757](https://cve.now/CVE-2022-34757.md): A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists where weak cipher suites can be used for the SSH connection (CVSS 6.7, Schneider Electric Easergy P5)
- [CVE-2022-34756](https://cve.now/CVE-2022-34756.md): A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in remote code execution or the crash of HTTPs (CVSS 8.8, Schneider Electric Easergy P5)
- [CVE-2022-34754](https://cve.now/CVE-2022-34754.md): A CWE-269: Improper Privilege Management vulnerability exists that could allow elevated functionality when guessing credentials. (CVSS 6.8, Schneider Electric Acti9 PowerTag Link C)
- [CVE-2022-34753](https://cve.now/CVE-2022-34753.md): A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause r (CVSS 8.8, Schneider Electric SpaceLogic C-Bus Home Controller)
- [CVE-2022-32117](https://cve.now/CVE-2022-32117.md): Jerryscript v2.4.0 was discovered to contain a stack buffer overflow via the function jerryx\_print\_unhandled\_exception in /util/print.c. (no CVSS)
- [CVE-2022-31145](https://cve.now/CVE-2022-31145.md): Insufficient AccessToken Expiration Check in FlyteAdmin (CVSS 6.5, flyteorg flyteadmin · github.com/flyteorg/flyteadmin)
- [CVE-2022-32308](https://cve.now/CVE-2022-32308.md): Cross Site Scripting (XSS) vulnerability in uBlock Origin extension before 1.41.1 allows remote attackers to run arbitrary code via a spoofe (no CVSS)
- [CVE-2020-21967](https://cve.now/CVE-2020-21967.md): File upload vulnerability in the Catalog feature in Prestashop 1.7.6.7 allows remote attackers to run arbitrary code via the add new file pa (no CVSS)
- [CVE-2022-2380](https://cve.now/CVE-2022-2380.md): The Linux kernel was found vulnerable out of bounds memory access in the drivers/video/fbdev/sm712fb.c:smtcfb\_read() function. (CVSS 5.5, Kernel)
- [CVE-2022-20234](https://cve.now/CVE-2022-20234.md): In Car Settings app, the NotificationAccessConfirmationActivity is exported. (no CVSS, Android)
- [CVE-2022-20212](https://cve.now/CVE-2022-20212.md): In wifi.RequestToggleWifiActivity of AndroidManifest.xml, there is a possible EoP due to a tapjacking/overlay attack. (no CVSS, Android)
- [CVE-2022-20238](https://cve.now/CVE-2022-20238.md): 'remap\_pfn\_range' here may map out of size kernel memory (for example, may map the kernel area), and because the 'vma-\>vm\_page\_prot' can als (no CVSS, Android)
- [CVE-2022-20236](https://cve.now/CVE-2022-20236.md): A drm driver have oob problem, could cause the system crash or EOPProduct: AndroidVersions: Android SoCAndroid ID: A-233124709 (no CVSS, Android)
- [CVE-2022-20230](https://cve.now/CVE-2022-20230.md): In choosePrivateKeyAlias of KeyChain.java, there is a possible access to the user's certificate due to improper input validation. (no CVSS, Android)
- [CVE-2022-20229](https://cve.now/CVE-2022-20229.md): In bta\_hf\_client\_handle\_cind\_list\_item of bta\_hf\_client\_at.cc, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2022-20228](https://cve.now/CVE-2022-20228.md): In various functions of C2DmaBufAllocator.cpp, there is a possible memory corruption due to a use after free. (no CVSS, Android)
- [CVE-2022-20227](https://cve.now/CVE-2022-20227.md): In USB driver, there is a possible out of bounds read due to a heap buffer overflow. (no CVSS, Android)
- [CVE-2022-20226](https://cve.now/CVE-2022-20226.md): In finishDrawingWindow of WindowManagerService.java, there is a possible tapjacking due to improper input validation. (no CVSS, Android)
- [CVE-2022-20225](https://cve.now/CVE-2022-20225.md): In getSubscriptionProperty of SubscriptionController.java, there is a possible read of a sensitive identifier due to a missing permission ch (no CVSS, Android)
- [CVE-2022-20224](https://cve.now/CVE-2022-20224.md): In AT\_SKIP\_REST of bta\_hf\_client\_at.cc, there is a possible out of bounds read due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2022-20223](https://cve.now/CVE-2022-20223.md): In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible way to start a phone call without permissions due to (no CVSS, Android)
- [CVE-2022-20222](https://cve.now/CVE-2022-20222.md): In read\_attr\_value of gatt\_db.cc, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2022-20221](https://cve.now/CVE-2022-20221.md): In avrc\_ctrl\_pars\_vendor\_cmd of avrc\_pars\_ct.cc, there is a possible out of bounds read due to improper input validation. (no CVSS, Android)
- [CVE-2022-20220](https://cve.now/CVE-2022-20220.md): In openFile of CallLogProvider.java, there is a possible permission bypass due to a path traversal error. (no CVSS, Android)
- [CVE-2022-20219](https://cve.now/CVE-2022-20219.md): In multiple functions of StorageManagerService.java and UserManagerService.java, there is a possible way to leave user's directories unencry (no CVSS, Android)
- [CVE-2022-20218](https://cve.now/CVE-2022-20218.md): In PermissionController, there is a possible way to get and retain permissions without user's consent due to a logic error in the code. (no CVSS, Android)
- [CVE-2022-20217](https://cve.now/CVE-2022-20217.md): There is a unauthorized broadcast in the SprdContactsProvider. (no CVSS, Android)
- [CVE-2022-20216](https://cve.now/CVE-2022-20216.md): android exported is used to set third-party app access permissions, and the default value of intent-filter is true. (no CVSS, Android)
- [CVE-2022-22982](https://cve.now/CVE-2022-22982.md): The vCenter Server contains a server-side request forgery (SSRF) vulnerability. (no CVSS, VMware vCenter Server)
- [CVE-2017-20128](https://cve.now/CVE-2017-20128.md): KB Messages PHP Script sql injection (CVSS 7.3, KB Messages PHP Script)
- [CVE-2017-20127](https://cve.now/CVE-2017-20127.md): KB Login Authentication Script sql injection (CVSS 7.3, KB Login Authentication Script)
- [CVE-2017-20126](https://cve.now/CVE-2017-20126.md): KB Affiliate Referral Script index.php sql injection (CVSS 7.3, KB Affiliate Referral Script)
- [CVE-2022-34358](https://cve.now/CVE-2022-34358.md): IBM i 7.2, 7.3, 7.4, and 7.5 is vulnerable to cross-site scripting. (CVSS 5.4, IBM i)
- [CVE-2022-32096](https://cve.now/CVE-2022-32096.md): Rhonabwy before v1.1.5 was discovered to contain a buffer overflow via the component r\_jwe\_aesgcm\_key\_unwrap. (no CVSS)
- [CVE-2022-32074](https://cve.now/CVE-2022-32074.md): A stored cross-site scripting (XSS) vulnerability in the component audit/class.audit.php of osTicket-plugins - Storage-FS before commit a784 (no CVSS)
- [CVE-2022-32073](https://cve.now/CVE-2022-32073.md): WolfSSH v1.4.7 was discovered to contain an integer overflow via the function wolfSSH\_SFTP\_RecvRMDIR. (no CVSS)
- [CVE-2022-32065](https://cve.now/CVE-2022-32065.md): An arbitrary file upload vulnerability in the background management module of RuoYi v4.7.3 and below allows attackers to execute arbitrary c (no CVSS, com.ruoyi:ruoyi)
- [CVE-2022-32274](https://cve.now/CVE-2022-32274.md): The Transition Scheduler add-on 6.5.0 for Atlassian Jira is prone to stored XSS via the project name to the creation function. (no CVSS)
- [CVE-2019-10800](https://cve.now/CVE-2019-10800.md): Command Injection (CVSS 6.5, codecov)
- [CVE-2019-10761](https://cve.now/CVE-2019-10761.md): Sandbox Bypass (CVSS 8.3, vm2)
- [CVE-2022-31781](https://cve.now/CVE-2022-31781.md): Regular Expression Denial of Service (ReDoS) in ContentType.java. (GHSL-2022-022) (no CVSS, Apache Software Foundation Apache Tapestry · org.apache.tap…)
- [CVE-2021-46827](https://cve.now/CVE-2021-46827.md): An issue was discovered in Oxygen XML WebHelp before 22.1 build 2021082006 and 23.x before 23.1 build 2021090310. (no CVSS)
- [CVE-2022-28888](https://cve.now/CVE-2022-28888.md): Spryker Commerce OS 1.4.2 allows Remote Command Execution. (no CVSS)
- [CVE-2022-32114](https://cve.now/CVE-2022-32114.md): An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a craf (no CVSS, @strapi/strapi)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-07-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.