CVEs published July 17, 2022
76 CVEs were published on July 17, 2022: 1 critical, 1 high. 1 is now in CISA KEV.
- Published
- 76
- Critical
- 1
- High
- 1
- Medium
- 3
- Low
- 0
- Unrated
- 71
- Now in CISA KEV
- 1
- Fix available
- 17
Most affected products
- 404s
- 1
- Accept Stripe Payments
- 1
- Advanced Database Cleaner
- 1
- Best Contact Management Software for WordPress
- 1
- CDI – Collect and Deliver Interface for Woocommerce
- 1
- Chcnav - P5E GNSS
- 1
- Contact Form 7 Captcha
- 1
- Data Tables Generator by Supsystic
- 1
- Discount Rules for WooCommerce
- 1
- Download Manager
- 1
Critical 1
High 1
Medium, low and unrated 74
- CVE-2022-27434UNIT4 TETA Mobile Edition (ME) before 29.5.HF17 was discovered to contain a SQL injection vulnerability via the ProfileName parameter in the
- CVE-2021-44954In QVIS NVR DVR before 2021-12-13, an attacker can escalate privileges from a qvisdvr user to the root user by abusing a Sudo misconfigurati
- CVE-2021-42923ShowMyPC 3606 on Windows suffers from a DLL hijack vulnerability.
- CVE-2021-41419QVIS NVR DVR before 2021-12-13 is vulnerable to Remote Code Execution via Java deserialization.
- CVE-2021-40874An issue was discovered in LemonLDAP::NG (aka lemonldap-ng) 2.0.13.
- CVE-2020-23563IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ShowPlugInSaveOptions_W+0x0000000000002cba.
- CVE-2020-23562IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ShowPlugInSaveOptions_W+0x000000000000aefe.
- CVE-2020-23561IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ShowPlugInSaveOptions_W+0x0000000000005722.
- CVE-2022-31201SoftGuard Web (SGW) before 5.1.5 allows HTML injection.
- CVE-2021-40150The web server of the E1 Zoom camera through 3.0.0.716 discloses its configuration via the /conf/ directory that is mapped to a publicly acc
- CVE-2022-32985libnx_apl.so on Nexans FTTO GigaSwitch before 6.02N and 7.x before 7.02 implements a Backdoor Account for SSH logins on port 50200 or 50201.
- CVE-2022-31211An issue was discovered in Infiray IRAY-A8Z3 1.0.957.
- CVE-2022-31210An issue was discovered in Infiray IRAY-A8Z3 1.0.957.
- CVE-2022-31209An issue was discovered in Infiray IRAY-A8Z3 1.0.957.
- CVE-2022-31208An issue was discovered in Infiray IRAY-A8Z3 1.0.957.
- CVE-2022-31202The export function in SoftGuard Web (SGW) before 5.1.5 allows directory traversal to read an arbitrary local file via export or man.tcl.
- CVE-2022-30982An issue was discovered in Gentics CMS before 5.43.1.
- CVE-2022-30981An issue was discovered in Gentics CMS before 5.43.1.
- CVE-2022-28809An issue was discovered in Open Design Alliance Drawings SDK before 2023.3.
- CVE-2022-28808An issue was discovered in Open Design Alliance Drawings SDK before 2023.3.
- CVE-2022-28807An issue was discovered in Open Design Alliance Drawings SDK before 2023.2.
- CVE-2022-26481An issue was discovered in Poly Studio before 3.7.0.
- CVE-2022-26482An issue was discovered in Poly EagleEye Director II before 2.2.2.1.
- CVE-2022-26479An issue was discovered in Poly EagleEye Director II before 2.2.2.1.
- CVE-2021-40149The web server of the E1 Zoom camera through 3.0.0.716 discloses its SSL private key via the root web server directory.
- CVE-2022-32263Pexip Infinity before 28.1 allows remote attackers to trigger a software abort via G.719.
- CVE-2022-29286Pexip Infinity 27 before 28.0 allows remote attackers to trigger excessive resource consumption and termination because of registrar resourc
- CVE-2022-27937Pexip Infinity before 27.3 allows remote attackers to trigger excessive resource consumption via H.264.
- CVE-2022-27936Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via H.323.
- CVE-2022-27935Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via Epic Telehealth.
- CVE-2022-27934Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via HTTP.
- CVE-2022-27933Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.
- CVE-2022-27932Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.
- CVE-2022-27931Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via the Session Initiation Protocol.
- CVE-2022-27930Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via single-sign-on if a random Universally Unique Identi
- CVE-2022-27929Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via HTTP.
- CVE-2022-27928Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via the Session Initiation Protocol.
- CVE-2022-26657Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.
- CVE-2022-26656Pexip Infinity before 27.3 allows remote attackers to trigger a software abort, and possibly enumerate usernames, via One Touch Join.
- CVE-2022-26655Pexip Infinity 27.x before 27.3 has Improper Input Validation.
- CVE-2022-26654Pexip Infinity before 27.3 allows remote attackers to force a software abort via HTTP.
- CVE-2022-30622Chcnav - P5E GNSS Information disclosureChcnav - P5E GNSS
- CVE-2022-25357Pexip Infinity 27.x before 27.2 has Improper Access Control.
- CVE-2022-31260In Montala ResourceSpace through 9.8 before r19636, csv_export_results_metadata.php allows attackers to export collection metadata via a non
- CVE-2022-35861pyenv 1.2.24 through 2.3.2 allows local users to gain privileges via a .python-version file in the current working directory.
- CVE-2022-32320A Cross-Site Request Forgery (CSRF) in Ferdi through 5.8.1 and Ferdium through 6.0.0-nightly.98 allows attackers to read files via an upload
- CVE-2022-2222Download Monitor < 4.5.91 - Admin+ Arbitrary File DownloadDownload Monitor
- CVE-2022-2194Accept Stripe Payments < 2.0.64 - Admin+ Stored Cross-Site ScriptingAccept Stripe Payments
- CVE-2022-2187Contact Form 7 Captcha < 0.1.2 - Reflected Cross-Site ScriptingContact Form 7 Captcha
- CVE-2022-2186Simple Post Notes < 1.7.6 - Admin+ Stored Cross-Site ScriptingSimple Post Notes
- CVE-2022-2173Advanced Database Cleaner < 3.1.1 - Reflected Cross-Site ScriptingAdvanced Database Cleaner
- CVE-2022-2169Loading Page with Loading Screen < 1.0.83 - Admin+ Stored Cross-Site ScriptingLoading Page with Loading Screen
- CVE-2022-2168Download Manager < 3.2.44 - Reflected Cross-Site ScriptingDownload Manager
- CVE-2022-2151Best Contact Management Software <= 3.7.3 - Admin+ Stored Cross-Site ScriptingBest Contact Management Software for WordPress
- CVE-2022-2149Very Simple Breadcrumb <= 1.0 - Admin+ Stored Cross-Site ScriptingVery Simple Breadcrumb
- CVE-2022-2148LinkedIn Company Updates <= 1.5.3 - Admin+ Stored Cross-Site ScriptingLinkedIn Company Updates
- CVE-2022-2146Import CSV Files <= 1.0 - Reflected Cross-Site ScriptingImport CSV Files
- CVE-2022-2144Jquery Validation For Contact Form 7 < 5.3 - Arbitrary Options Update via CSRFJquery Validation For Contact Form
- CVE-2022-2133OAuth Single Sign On < 6.22.6 - Authentication BypassOAuth Single Sign On – SSO
- CVE-2022-2118404s < 3.5.1 - Admin+ Stored Cross-Site Scripting404s
- CVE-2022-2114Data Tables Generator by Supsystic < 1.10.20 - Admin+ Stored Cross-Site ScriptingData Tables Generator by Supsystic
- CVE-2022-2100Page Generator Plugin < 1.6.5 - Admin+ Stored Cross-Site ScriptingPage Generator
- CVE-2022-2099WooCommerce < 6.6.0 - Admin+ Stored HTML InjectionWooCommerce · woocommerce/woocommerce
- CVE-2022-2090Woo Discount Rules < 2.4.2 - Reflected Cross-Site ScriptingDiscount Rules for WooCommerce
- CVE-2022-1933CDI < 5.1.9 - Reflected Cross-Site-ScriptingCDI – Collect and Deliver Interface for Woocommerce
- CVE-2022-1672Insights from Google PageSpeed < 4.0.7 - Multiple CSRFInsights from Google PageSpeed
- CVE-2021-24655WP User Manager < 2.6.3 - Arbitrary User Password Reset to Account CompromiseWP User Manager – User Profile Builder & Membership
- CVE-2020-7641Prototype Pollutiongrunt-util-property
- CVE-2015-10003FileZilla Server PORT confused deputyFileZilla Server
- CVE-2020-16093In LemonLDAP::NG (aka lemonldap-ng) through 2.0.8, validity of the X.509 certificate is not checked by default when connecting to remote LDA
- CVE-2021-46784In Squid 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6, due to improper buffer management, a Denial of Service can occur when pro
- CVE-2022-31212An issue was discovered in dbus-broker before 31.
- CVE-2022-31213An issue was discovered in dbus-broker before 31.
- CVE-2022-33903Tor 0.4.7.x before 0.4.7.8 allows a denial of service via the wedging of RTT estimation.