# CVEs published 2022-07-14 68 CVEs were published on July 14, 2022: 0 critical, 2 high. Days are UTC. - [CVE-2022-32425](https://cve.now/CVE-2022-32425.md): The login function of Mealie v1.0.0beta-2 allows attackers to enumerate existing usernames by timing the server's response time. (no CVSS) - [CVE-2022-32417](https://cve.now/CVE-2022-32417.md): PbootCMS v3.1.2 was discovered to contain a remote code execution (RCE) vulnerability via the function parserIfLabel at function.php. (no CVSS) - [CVE-2022-32416](https://cve.now/CVE-2022-32416.md): Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/classes/Master.php?f=delete\_product. (no CVSS) - [CVE-2022-32415](https://cve.now/CVE-2022-32415.md): Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/?p=products/view\_product&id=. (no CVSS) - [CVE-2022-34094](https://cve.now/CVE-2022-34094.md): Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability via request\_token.ph (no CVSS) - [CVE-2022-34092](https://cve.now/CVE-2022-34092.md): Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability via svg2img.php. (no CVSS) - [CVE-2022-34093](https://cve.now/CVE-2022-34093.md): Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability via access\_token.php (no CVSS) - [CVE-2022-32409](https://cve.now/CVE-2022-32409.md): A local file inclusion (LFI) vulnerability in the component codemirror.php of Portal do Software Publico Brasileiro i3geo v7.0.5 allows atta (no CVSS) - [CVE-2022-32406](https://cve.now/CVE-2022-32406.md): GtkRadiant v1.6.6 was discovered to contain a buffer overflow via the component q3map2. (no CVSS) - [CVE-2022-32389](https://cve.now/CVE-2022-32389.md): Isode SWIFT v4.0.2 was discovered to contain hard-coded credentials in the Registry Editor. (no CVSS) - [CVE-2022-32323](https://cve.now/CVE-2022-32323.md): AutoTrace v0.40.0 was discovered to contain a heap overflow via the ReadImage function at input-bmp.c:660. (no CVSS) - [CVE-2022-31156](https://cve.now/CVE-2022-31156.md): Gradle's dependency verification can ignore checksum verification when signature verification cannot be performed (CVSS 6.6, gradle) - [CVE-2022-32318](https://cve.now/CVE-2022-32318.md): Fast Food Ordering System v1.0 was discovered to contain a persistent cross-site scripting (XSS) vulnerability via the component /ffos/class (no CVSS) - [CVE-2021-4135](https://cve.now/CVE-2021-4135.md): A memory leak vulnerability was found in the Linux kernel's eBPF for the Simulated networking device driver in the way user uses BPF for the (no CVSS, kernel) - [CVE-2022-31147](https://cve.now/CVE-2022-31147.md): jquery-validation ReDoS in url2 due to incomplete fix of CVE-2021-43306 (CVSS 7.5, jquery-validation) - [CVE-2021-26384](https://cve.now/CVE-2021-26384.md): A malformed SMI (System Management Interface) command may allow an attacker to establish a corrupted SMI Trigger Info data structure, potent (no CVSS, AMD Ryzen™ Series · AMD Athlon™ Series) - [CVE-2021-26382](https://cve.now/CVE-2021-26382.md): An attacker with root account privileges can load any legitimately signed firmware image into the Audio Co-Processor (ACP,) irrespective of (no CVSS, AMD Ryzen™ Series · AMD Athlon™ Series) - [CVE-2022-23825](https://cve.now/CVE-2022-23825.md): Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially leading to information disclosure (no CVSS, AMD Processors) - [CVE-2022-32298](https://cve.now/CVE-2022-32298.md): Toybox v0.8.7 was discovered to contain a NULL pointer dereference via the component httpd.c. (no CVSS) - [CVE-2022-32297](https://cve.now/CVE-2022-32297.md): Piwigo v12.2.0 was discovered to contain SQL injection vulnerability via the Search function. (no CVSS) - [CVE-2022-31142](https://cve.now/CVE-2022-31142.md): Potential Timing Attack Vector in @fastify/bearer-auth (CVSS 7.5, fastify-bearer-auth · @fastify/bearer-auth) - [CVE-2022-22460](https://cve.now/CVE-2022-22460.md): IBM Security Verify Identity Manager 10.0 contains sensitive information in the source code repository that could be used in further attacks (CVSS 3.0, IBM Security Verify Governance) - [CVE-2022-22453](https://cve.now/CVE-2022-22453.md): IBM Security Verify Identity Manager 10.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly (CVSS 5.1, IBM Security Verify Governance) - [CVE-2022-22452](https://cve.now/CVE-2022-22452.md): IBM Security Verify Identity Manager 10.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force accou (CVSS 5.3, IBM Security Verify Governance) - [CVE-2022-22450](https://cve.now/CVE-2022-22450.md): IBM Security Verify Identity Manager 10.0 could allow a privileged user to upload a malicious file by bypassing extension security in an HTT (CVSS 3.8, IBM Security Verify Governance) - [CVE-2022-2408](https://cve.now/CVE-2022-2408.md): Guest accounts can list all public channels (CVSS 4.3, Mattermost) - [CVE-2022-2406](https://cve.now/CVE-2022-2406.md): Malicious imports can lead to Denial of Service (CVSS 4.3, Mattermost) - [CVE-2022-2401](https://cve.now/CVE-2022-2401.md): Team members could access sensitive information of other users via an API call (CVSS 6.5, Mattermost · github.com/mattermost/mattermost-server/v6 +2) - [CVE-2022-35283](https://cve.now/CVE-2022-35283.md): IBM Security Verify Information Queue 10.0.2 could allow an authenticated user to cause a denial of service with a specially crafted HTTP re (CVSS 6.5, IBM Security Verify Information Queue) - [CVE-2022-22477](https://cve.now/CVE-2022-22477.md): IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. (CVSS 6.1, IBM WebSphere Application Server) - [CVE-2022-22473](https://cve.now/CVE-2022-22473.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper han (CVSS 3.7, IBM WebSphere Application Server) - [CVE-2021-39028](https://cve.now/CVE-2021-39028.md): IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to HTTP header injection, caused by (CVSS 5.4, IBM Engineering Lifecycle Optimization Publishing) - [CVE-2021-39019](https://cve.now/CVE-2021-39019.md): IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could disclose highly sensitive information throug (CVSS 6.5, IBM Engineering Lifecycle Optimization Publishing) - [CVE-2021-39018](https://cve.now/CVE-2021-39018.md): IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could disclose sensitive information in a SQL erro (CVSS 4.3, IBM Engineering Lifecycle Optimization Publishing) - [CVE-2021-39017](https://cve.now/CVE-2021-39017.md): IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to upload arbitrary (CVSS 5.7, IBM Engineering Lifecycle Optimization Publishing) - [CVE-2021-39016](https://cve.now/CVE-2021-39016.md): IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 does not sufficiently monitor or control transmitt (CVSS 4.3, IBM Engineering Lifecycle Optimization Publishing) - [CVE-2021-39015](https://cve.now/CVE-2021-39015.md): IBM Engineering Lifecycle Optimization - Publishing 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Engineering Lifecycle Optimization Publishing) - [CVE-2021-45492](https://cve.now/CVE-2021-45492.md): In Sage 300 ERP (formerly accpac) through 6.8.x, the installer configures the C:\\Sage\\Sage300\\Runtime directory to be the first entry in the (no CVSS) - [CVE-2022-29593](https://cve.now/CVE-2022-29593.md): relay\_cgi.cgi on Dingtian DT-R002 2CH relay devices with firmware 3.1.276A allows an attacker to replay HTTP post requests without the need (CVSS 5.9) - [CVE-2022-1662](https://cve.now/CVE-2022-1662.md): In convert2rhel, there's an ansible playbook named ansible/run-convert2rhel.yml which passes the Red Hat Subscription Manager user password (no CVSS, convert2rhel) - [CVE-2022-2393](https://cve.now/CVE-2022-2393.md): A flaw was found in pki-core, which could allow a user to get a certificate for another user identity when directory-based authentication is (no CVSS, pki-core) - [CVE-2022-32210](https://cve.now/CVE-2022-32210.md): \`Undici.ProxyAgent\` never verifies the remote server's certificate, and always exposes all request & response data to the proxy. (no CVSS, https://github.com/nodejs/undici · undici) - [CVE-2022-32225](https://cve.now/CVE-2022-32225.md): A reflected DOM-Based XSS vulnerability has been discovered in the Help directory of Veeam Management Pack for Microsoft System Center 8.0. (no CVSS, Veeam Management Pack for Microsoft System Center) - [CVE-2022-32223](https://cve.now/CVE-2022-32223.md): Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploi (no CVSS, NodeJS Node) - [CVE-2020-14127](https://cve.now/CVE-2020-14127.md): A denial of service vulnerability exists in some Xiaomi models of phones. (no CVSS, Redmi K40 ,Redmi Note10 Pro) - [CVE-2022-28876](https://cve.now/CVE-2022-28876.md): Denial-of-Service (DoS) Vulnerability (CVSS 4.3, All F-Secure & WithSecure endpoint protection products for…) - [CVE-2022-30024](https://cve.now/CVE-2022-30024.md): A buffer overflow in the httpd daemon on TP-Link TL-WR841N V12 (firmware version 3.16.9) devices allows an authenticated remote attacker to (no CVSS) - [CVE-2022-30113](https://cve.now/CVE-2022-30113.md): Electronic mall system 1.0\_build20200203 is affected vulnerable to SQL Injection. (no CVSS) - [CVE-2022-28369](https://cve.now/CVE-2022-28369.md): Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 does not validate the user-provided URL within the crtcmode function's enable\_ssh sub-op (no CVSS) - [CVE-2022-28370](https://cve.now/CVE-2022-28370.md): On Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 devices, the RPC endpoint crtc\_fw\_upgrade provides a means of provisioning a firmwar (no CVSS) - [CVE-2022-28371](https://cve.now/CVE-2022-28371.md): On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a st (no CVSS) - [CVE-2022-28372](https://cve.now/CVE-2022-28372.md): On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints provide a me (no CVSS) - [CVE-2022-28373](https://cve.now/CVE-2022-28373.md): Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 does not properly sanitize user-controlled parameters within the crtcreadpartition funct (no CVSS) - [CVE-2022-28374](https://cve.now/CVE-2022-28374.md): Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 does not property sanitize user-controlled parameters within the DMACC URLs on the Sett (no CVSS) - [CVE-2022-28375](https://cve.now/CVE-2022-28375.md): Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 does not property sanitize user-controlled parameters within the crtcswitchsimprofile f (no CVSS) - [CVE-2022-28377](https://cve.now/CVE-2022-28377.md): On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a st (no CVSS) - [CVE-2022-2396](https://cve.now/CVE-2022-2396.md): SourceCodester Simple e-Learning System claire\_blake cross site scripting (CVSS 3.5, SourceCodester Simple e-Learning System) - [CVE-2022-25803](https://cve.now/CVE-2022-25803.md): Best Practical Request Tracker (RT) before 5.0.3 has an Open Redirect via a ticket search. (no CVSS) - [CVE-2022-25802](https://cve.now/CVE-2022-25802.md): Best Practical Request Tracker (RT) before 4.4.6 and 5.x before 5.0.3 allows XSS via a crafted content type for an attachment. (no CVSS) - [CVE-2022-25801](https://cve.now/CVE-2022-25801.md): Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via Scripted Action tools. (no CVSS) - [CVE-2022-25800](https://cve.now/CVE-2022-25800.md): Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via the whois lookup tool. (no CVSS) - [CVE-2017-20129](https://cve.now/CVE-2017-20129.md): LogoStore search.php sql injection (CVSS 6.3, LogoStore) - [CVE-2022-32212](https://cve.now/CVE-2022-32212.md): A OS Command Injection vulnerability exists in Node.js versions \<14.20.0, \<16.20.0, \<18.5.0 due to an insufficient IsAllowedHost check that (no CVSS, NodeJS Node) - [CVE-2022-32213](https://cve.now/CVE-2022-32213.md): The llhttp parser \