CVEs published July 14, 2022
68 CVEs were published on July 14, 2022: 0 critical, 2 high.
- Published
- 68
- Critical
- 0
- High
- 2
- Medium
- 17
- Low
- 4
- Unrated
- 45
- Now in CISA KEV
- 0
- Fix available
- 10
Most affected products
- IBM Engineering Lifecycle Optimization Publishing
- 6
- IBM Security Verify Governance
- 4
- NodeJS Node
- 4
- AMD Ryzen™ Series · AMD Athlon™ Series
- 2
- IBM WebSphere Application Server
- 2
- Mattermost
- 2
- NodeJS Node · llhttp
- 2
- All F-Secure & WithSecure endpoint protection products for…
- 1
- AMD Processors
- 1
- convert2rhel
- 1
High 2
Medium, low and unrated 66
- CVE-2022-32425The login function of Mealie v1.0.0beta-2 allows attackers to enumerate existing usernames by timing the server's response time.
- CVE-2022-32417PbootCMS v3.1.2 was discovered to contain a remote code execution (RCE) vulnerability via the function parserIfLabel at function.php.
- CVE-2022-32416Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/classes/Master.php?f=delete_product.
- CVE-2022-32415Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/?p=products/view_product&id=.
- CVE-2022-34094Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability via request_token.ph
- CVE-2022-34092Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability via svg2img.php.
- CVE-2022-34093Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability via access_token.php
- CVE-2022-32409A local file inclusion (LFI) vulnerability in the component codemirror.php of Portal do Software Publico Brasileiro i3geo v7.0.5 allows atta
- CVE-2022-32406GtkRadiant v1.6.6 was discovered to contain a buffer overflow via the component q3map2.
- CVE-2022-32389Isode SWIFT v4.0.2 was discovered to contain hard-coded credentials in the Registry Editor.
- CVE-2022-32323AutoTrace v0.40.0 was discovered to contain a heap overflow via the ReadImage function at input-bmp.c:660.
- CVE-2022-31156Gradle's dependency verification can ignore checksum verification when signature verification cannot be performedgradle
- CVE-2022-32318Fast Food Ordering System v1.0 was discovered to contain a persistent cross-site scripting (XSS) vulnerability via the component /ffos/class
- CVE-2021-4135A memory leak vulnerability was found in the Linux kernel's eBPF for the Simulated networking device driver in the way user uses BPF for thekernel
- CVE-2021-26384A malformed SMI (System Management Interface) command may allow an attacker to establish a corrupted SMI Trigger Info data structure, potentAMD Ryzen™ Series · AMD Athlon™ Series
- CVE-2021-26382An attacker with root account privileges can load any legitimately signed firmware image into the Audio Co-Processor (ACP,) irrespective of AMD Ryzen™ Series · AMD Athlon™ Series
- CVE-2022-23825Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially leading to information disclosureAMD Processors
- CVE-2022-32298Toybox v0.8.7 was discovered to contain a NULL pointer dereference via the component httpd.c.
- CVE-2022-32297Piwigo v12.2.0 was discovered to contain SQL injection vulnerability via the Search function.
- CVE-2022-22460IBM Security Verify Identity Manager 10.0 contains sensitive information in the source code repository that could be used in further attacksIBM Security Verify Governance
- CVE-2022-22453IBM Security Verify Identity Manager 10.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly IBM Security Verify Governance
- CVE-2022-22452IBM Security Verify Identity Manager 10.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force accouIBM Security Verify Governance
- CVE-2022-22450IBM Security Verify Identity Manager 10.0 could allow a privileged user to upload a malicious file by bypassing extension security in an HTTIBM Security Verify Governance
- CVE-2022-2408Guest accounts can list all public channelsMattermost
- CVE-2022-2406Malicious imports can lead to Denial of ServiceMattermost
- CVE-2022-2401Team members could access sensitive information of other users via an API callMattermost · github.com/mattermost/mattermost-server/v6 +2
- CVE-2022-35283IBM Security Verify Information Queue 10.0.2 could allow an authenticated user to cause a denial of service with a specially crafted HTTP reIBM Security Verify Information Queue
- CVE-2022-22477IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting.IBM WebSphere Application Server
- CVE-2022-22473IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper hanIBM WebSphere Application Server
- CVE-2021-39028IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to HTTP header injection, caused by IBM Engineering Lifecycle Optimization Publishing
- CVE-2021-39019IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could disclose highly sensitive information througIBM Engineering Lifecycle Optimization Publishing
- CVE-2021-39018IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could disclose sensitive information in a SQL erroIBM Engineering Lifecycle Optimization Publishing
- CVE-2021-39017IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to upload arbitrary IBM Engineering Lifecycle Optimization Publishing
- CVE-2021-39016IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 does not sufficiently monitor or control transmittIBM Engineering Lifecycle Optimization Publishing
- CVE-2021-39015IBM Engineering Lifecycle Optimization - Publishing 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting.IBM Engineering Lifecycle Optimization Publishing
- CVE-2021-45492In Sage 300 ERP (formerly accpac) through 6.8.x, the installer configures the C:\Sage\Sage300\Runtime directory to be the first entry in the
- CVE-2022-29593relay_cgi.cgi on Dingtian DT-R002 2CH relay devices with firmware 3.1.276A allows an attacker to replay HTTP post requests without the need
- CVE-2022-1662In convert2rhel, there's an ansible playbook named ansible/run-convert2rhel.yml which passes the Red Hat Subscription Manager user password convert2rhel
- CVE-2022-2393A flaw was found in pki-core, which could allow a user to get a certificate for another user identity when directory-based authentication ispki-core
- CVE-2022-32210`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy.https://github.com/nodejs/undici · undici
- CVE-2022-32225A reflected DOM-Based XSS vulnerability has been discovered in the Help directory of Veeam Management Pack for Microsoft System Center 8.0.Veeam Management Pack for Microsoft System Center
- CVE-2022-32223Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploiNodeJS Node
- CVE-2020-14127A denial of service vulnerability exists in some Xiaomi models of phones.Redmi K40 ,Redmi Note10 Pro
- CVE-2022-28876Denial-of-Service (DoS) VulnerabilityAll F-Secure & WithSecure endpoint protection products for…
- CVE-2022-30024A buffer overflow in the httpd daemon on TP-Link TL-WR841N V12 (firmware version 3.16.9) devices allows an authenticated remote attacker to
- CVE-2022-30113Electronic mall system 1.0_build20200203 is affected vulnerable to SQL Injection.
- CVE-2022-28369Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 does not validate the user-provided URL within the crtcmode function's enable_ssh sub-op
- CVE-2022-28370On Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 devices, the RPC endpoint crtc_fw_upgrade provides a means of provisioning a firmwar
- CVE-2022-28371On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a st
- CVE-2022-28372On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints provide a me
- CVE-2022-28373Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 does not properly sanitize user-controlled parameters within the crtcreadpartition funct
- CVE-2022-28374Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 does not property sanitize user-controlled parameters within the DMACC URLs on the Sett
- CVE-2022-28375Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 does not property sanitize user-controlled parameters within the crtcswitchsimprofile f
- CVE-2022-28377On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a st
- CVE-2022-2396SourceCodester Simple e-Learning System claire_blake cross site scriptingSourceCodester Simple e-Learning System
- CVE-2022-25803Best Practical Request Tracker (RT) before 5.0.3 has an Open Redirect via a ticket search.
- CVE-2022-25802Best Practical Request Tracker (RT) before 4.4.6 and 5.x before 5.0.3 allows XSS via a crafted content type for an attachment.
- CVE-2022-25801Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via Scripted Action tools.
- CVE-2022-25800Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via the whois lookup tool.
- CVE-2017-20129LogoStore search.php sql injectionLogoStore
- CVE-2022-32212A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that NodeJS Node
- CVE-2022-32213The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding heNodeJS Node · llhttp
- CVE-2022-32214The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP reNodeJS Node · llhttp
- CVE-2022-32215The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding heaNodeJS Node
- CVE-2022-32222A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf tNodeJS Node
- CVE-2022-32317The MPlayer Project v1.5 was discovered to contain a heap use-after-free resulting in a double free in the preinit function at libvo/vo_v4l2