# CVEs published 2022-07-15

78 CVEs were published on July 15, 2022: 1 critical, 36 high. Days are UTC.

- [CVE-2022-35906](https://cve.now/CVE-2022-35906.md): An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. (CVSS 3.3)
- [CVE-2022-35905](https://cve.now/CVE-2022-35905.md): An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. (CVSS 3.3)
- [CVE-2022-35904](https://cve.now/CVE-2022-35904.md): An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. (CVSS 3.3)
- [CVE-2022-35903](https://cve.now/CVE-2022-35903.md): An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. (CVSS 3.3)
- [CVE-2022-35902](https://cve.now/CVE-2022-35902.md): An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. (CVSS 3.3)
- [CVE-2022-35901](https://cve.now/CVE-2022-35901.md): An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. (CVSS 3.3)
- [CVE-2022-35900](https://cve.now/CVE-2022-35900.md): An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. (CVSS 3.3)
- [CVE-2022-34891](https://cve.now/CVE-2022-34891.md): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop Parallels Desktop 17.1.1. (CVSS 7.8, Parallels Desktop)
- [CVE-2022-34890](https://cve.now/CVE-2022-34890.md): This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 17.1.1 (51537). (CVSS 7.3, Parallels Desktop)
- [CVE-2022-34889](https://cve.now/CVE-2022-34889.md): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 17.1.1 (51537). (CVSS 8.2, Parallels Desktop)
- [CVE-2022-35890](https://cve.now/CVE-2022-35890.md): An issue was discovered in Inductive Automation Ignition before 7.9.20 and 8.x before 8.1.17. (no CVSS)
- [CVE-2022-32434](https://cve.now/CVE-2022-32434.md): EIPStackGroup OpENer v2.3.0 was discovered to contain a stack overflow via /bin/posix/src/ports/POSIX/OpENer+0x56073d. (no CVSS)
- [CVE-2022-25869](https://cve.now/CVE-2022-25869.md): All versions of the package angular; all versions of the package angularjs.core; all versions of the package angularjs are vulnerable to Cro (CVSS 4.2, angular · org.webjars.npm:angular +4)
- [CVE-2022-25891](https://cve.now/CVE-2022-25891.md): Denial of Service (DoS) (CVSS 7.5, github.com/containrrr/shoutrrr/pkg/util · github.com/contai…)
- [CVE-2022-25858](https://cve.now/CVE-2022-25858.md): Regular Expression Denial of Service (ReDoS) (CVSS 5.3, terser)
- [CVE-2022-30634](https://cve.now/CVE-2022-30634.md): Indefinite hang with large buffers on Windows in crypto/rand (no CVSS, Go standard library crypto/rand · stdlib)
- [CVE-2021-34987](https://cve.now/CVE-2021-34987.md): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.5.1 (49187). (CVSS 8.2, Parallels Desktop)
- [CVE-2021-34986](https://cve.now/CVE-2021-34986.md): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.5.0 (49183). (CVSS 7.8, Parallels Desktop)
- [CVE-2022-31153](https://cve.now/CVE-2022-31153.md): OpenZeppelin Contracts for Cairo account cannot process transactions on Goerli (CVSS 6.5, OpenZeppelin cairo-contracts · openzeppelin-cairo-contracts)
- [CVE-2022-31159](https://cve.now/CVE-2022-31159.md): Partial Path Traversal in com.amazonaws:aws-java-sdk-s3 (CVSS 7.9, aws-sdk-java · com.amazonaws:aws-java-sdk-s3)
- [CVE-2022-31157](https://cve.now/CVE-2022-31157.md): Use of a Broken or Risky Cryptographic Algorithm in packbackbooks/lti-1-3-php-library (CVSS 7.5, packbackbooks lti-1-3-php-library · packbackbooks/lti-1-3-p…)
- [CVE-2022-31158](https://cve.now/CVE-2022-31158.md): Authentication Bypass by Capture-replay in packbackbooks/lti-1-3-php-library (CVSS 7.5, packbackbooks lti-1-3-php-library · packbackbooks/lti-1-3-p…)
- [CVE-2022-34251](https://cve.now/CVE-2022-34251.md): Adobe InCopy Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe InCopy)
- [CVE-2022-34252](https://cve.now/CVE-2022-34252.md): Adobe InCopy Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe InCopy)
- [CVE-2022-34249](https://cve.now/CVE-2022-34249.md): Adobe InCopy Font Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Adobe InCopy)
- [CVE-2022-34250](https://cve.now/CVE-2022-34250.md): Adobe InCopy Font Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Adobe InCopy)
- [CVE-2022-34247](https://cve.now/CVE-2022-34247.md): Adobe InDesign Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe InDesign)
- [CVE-2022-34245](https://cve.now/CVE-2022-34245.md): Adobe InDesign Font Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Adobe InDesign)
- [CVE-2022-34246](https://cve.now/CVE-2022-34246.md): Adobe InDesign Font Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Adobe InDesign)
- [CVE-2022-34248](https://cve.now/CVE-2022-34248.md): Adobe InDesign Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe InDesign)
- [CVE-2022-23201](https://cve.now/CVE-2022-23201.md): Adobe RoboHelp Reflected XSS could lead to Arbitrary code execution (CVSS 6.1, Adobe RoboHelp)
- [CVE-2022-34243](https://cve.now/CVE-2022-34243.md): Adobe Photoshop U3D File Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Photoshop)
- [CVE-2022-34244](https://cve.now/CVE-2022-34244.md): Adobe Photoshop U3D File Parsing Access of Uninitialized Pointer Information Disclosure Vulnerability (CVSS 5.5, Adobe Photoshop)
- [CVE-2022-34241](https://cve.now/CVE-2022-34241.md): Adobe Character Animator SVG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Adobe Character Animator)
- [CVE-2022-34242](https://cve.now/CVE-2022-34242.md): Adobe Character Animator SVG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Character Animator)
- [CVE-2022-34239](https://cve.now/CVE-2022-34239.md): Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2022-34228](https://cve.now/CVE-2022-34228.md): Adobe Acrobat Reader DC Font Parsing Uninitialized Variable Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-34233](https://cve.now/CVE-2022-34233.md): Adobe Acrobat Reader DC Doc print Use-After-Free Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2022-34236](https://cve.now/CVE-2022-34236.md): Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2022-34237](https://cve.now/CVE-2022-34237.md): Adobe Acrobat Reader DC Font Parsing Use-After-Free Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2022-34230](https://cve.now/CVE-2022-34230.md): Adobe Acrobat Reader Use After Free could lead to Arbitrary code execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-34232](https://cve.now/CVE-2022-34232.md): Adobe Acrobat Reader DC Annotation print Use-After-Free Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2022-34234](https://cve.now/CVE-2022-34234.md): Adobe Acrobat Reader DC Doc printWithParams Use-After-Free Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2022-34229](https://cve.now/CVE-2022-34229.md): Adobe Acrobat Reader DC AcroForm rect Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-34226](https://cve.now/CVE-2022-34226.md): Adobe Acrobat Reader DC PDF Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-34225](https://cve.now/CVE-2022-34225.md): Adobe Acrobat Reader DC AcroForm exportValues Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-34222](https://cve.now/CVE-2022-34222.md): Adobe Acrobat Reader DC query Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-34223](https://cve.now/CVE-2022-34223.md): Adobe Acrobat Reader DC AcroForm currentValueIndices Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-34219](https://cve.now/CVE-2022-34219.md): Adobe Acrobat Reader DC Font Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-34217](https://cve.now/CVE-2022-34217.md): Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-34220](https://cve.now/CVE-2022-34220.md): Acrobat Reader DC Font Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-34221](https://cve.now/CVE-2022-34221.md): Adobe Acrobat Reader Type Confusion vulnerability could lead to Arbitrary code execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-34215](https://cve.now/CVE-2022-34215.md): Adobe Acrobat Reader DC Annotation Polygon Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-34216](https://cve.now/CVE-2022-34216.md): Adobe Acrobat Reader DC PDF Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-23141](https://cve.now/CVE-2022-23141.md): ZXMP M721 has an information leak vulnerability. (no CVSS, ZXMP M721)
- [CVE-2020-35305](https://cve.now/CVE-2020-35305.md): Cross site scripting (XSS) in gollum 5.0 to 5.1.2 via the filename parameter to the 'New Page' dialog. (no CVSS, gollum)
- [CVE-2022-31107](https://cve.now/CVE-2022-31107.md): Grafana account takeover via OAuth vulnerability (CVSS 7.1, grafana · github.com/grafana/grafana)
- [CVE-2022-31097](https://cve.now/CVE-2022-31097.md): Stored XSS in Grafana's Unified Alerting (CVSS 7.3, grafana · github.com/grafana/grafana)
- [CVE-2022-30245](https://cve.now/CVE-2022-30245.md): Honeywell Alerton Compass Software 1.6.5 allows unauthenticated configuration changes from remote users. (no CVSS)
- [CVE-2022-30244](https://cve.now/CVE-2022-30244.md): Honeywell Alerton Ascent Control Module (ACM) through 2022-05-04 allows unauthenticated programming writes from remote users. (no CVSS)
- [CVE-2022-30243](https://cve.now/CVE-2022-30243.md): Honeywell Alerton Visual Logic through 2022-05-04 allows unauthenticated programming writes from remote users. (no CVSS)
- [CVE-2022-30242](https://cve.now/CVE-2022-30242.md): Honeywell Alerton Ascent Control Module (ACM) through 2022-05-04 allows unauthenticated configuration changes from remote users. (no CVSS)
- [CVE-2021-36461](https://cve.now/CVE-2021-36461.md): An Arbitrary File Upload vulnerability exists in Microweber 1.1.3 that allows attackers to getshell via the Settings Upload Picture section (no CVSS)
- [CVE-2022-34826](https://cve.now/CVE-2022-34826.md): In Couchbase Server 7.1.x before 7.1.1, an encrypted Private Key passphrase may be leaked in the logs. (no CVSS)
- [CVE-2020-35261](https://cve.now/CVE-2020-35261.md): Cross Site Scripting (XSS) vulnerability in sourcecodester Multi Restaurant Table Reservation System 1.0 via the Restaurant Name field to /d (no CVSS)
- [CVE-2020-36550](https://cve.now/CVE-2020-36550.md): Cross Site Scripting (XSS) vulnerability in sourcecodester Multi Restaurant Table Reservation System 1.0 via the Table Name field to /dashbo (no CVSS)
- [CVE-2020-36551](https://cve.now/CVE-2020-36551.md): Cross Site Scripting (XSS) vulnerability in sourcecodester Multi Restaurant Table Reservation System 1.0 via the Item Name field to /dashboa (no CVSS)
- [CVE-2020-36552](https://cve.now/CVE-2020-36552.md): Cross Site Scripting (XSS) vulnerability in sourcecodester Multi Restaurant Table Reservation System 1.0 via the Made field to /dashboard/me (no CVSS)
- [CVE-2020-36553](https://cve.now/CVE-2020-36553.md): Cross Site Scripting (XSS) vulnerability in sourcecodester Multi Restaurant Table Reservation System 1.0 via the Area(food\_type) field to /d (no CVSS)
- [CVE-2022-32118](https://cve.now/CVE-2022-32118.md): Arox School ERP Pro v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the dispatchcategory parameter in backoffi (no CVSS)
- [CVE-2022-32119](https://cve.now/CVE-2022-32119.md): Arox School ERP Pro v1.0 was discovered to contain multiple arbitrary file upload vulnerabilities via the Add Photo function at photogalleri (no CVSS)
- [CVE-2022-29890](https://cve.now/CVE-2022-29890.md): In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link. (no CVSS, Octopus Deploy Octopus Server)
- [CVE-2022-1881](https://cve.now/CVE-2022-1881.md): In affected versions of Octopus Server an Insecure Direct Object Reference vulnerability exists where it is possible for a user to download (no CVSS, Octopus Deploy Octopus Server)
- [CVE-2022-2420](https://cve.now/CVE-2022-2420.md): URVE Web Manager uploader.php unrestricted upload (CVSS 8.0, URVE Web Manager)
- [CVE-2022-2419](https://cve.now/CVE-2022-2419.md): URVE Web Manager upload.php unrestricted upload (CVSS 8.0, URVE Web Manager)
- [CVE-2022-2418](https://cve.now/CVE-2022-2418.md): URVE Web Manager img\_upload.php unrestricted upload (CVSS 8.0, URVE Web Manager)
- [CVE-2022-31161](https://cve.now/CVE-2022-31161.md): Roxy-WI Vulnerable to Unauthenticated Remote Code Execution via ssl\_cert Upload (CVSS 10.0, hap-wi roxy-wi)
- [CVE-2022-35409](https://cve.now/CVE-2022-35409.md): An issue was discovered in Mbed TLS before 2.28.1 and 3.x before 3.2.0. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-07-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.