# CVEs published 2022-07-17

76 CVEs were published on July 17, 2022: 1 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2022-27434](https://cve.now/CVE-2022-27434.md): UNIT4 TETA Mobile Edition (ME) before 29.5.HF17 was discovered to contain a SQL injection vulnerability via the ProfileName parameter in the (no CVSS)
- [CVE-2021-44954](https://cve.now/CVE-2021-44954.md): In QVIS NVR DVR before 2021-12-13, an attacker can escalate privileges from a qvisdvr user to the root user by abusing a Sudo misconfigurati (no CVSS)
- [CVE-2021-42923](https://cve.now/CVE-2021-42923.md): ShowMyPC 3606 on Windows suffers from a DLL hijack vulnerability. (no CVSS)
- [CVE-2021-41419](https://cve.now/CVE-2021-41419.md): QVIS NVR DVR before 2021-12-13 is vulnerable to Remote Code Execution via Java deserialization. (no CVSS)
- [CVE-2021-40874](https://cve.now/CVE-2021-40874.md): An issue was discovered in LemonLDAP::NG (aka lemonldap-ng) 2.0.13. (no CVSS)
- [CVE-2020-23563](https://cve.now/CVE-2020-23563.md): IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ShowPlugInSaveOptions\_W+0x0000000000002cba. (no CVSS)
- [CVE-2020-23562](https://cve.now/CVE-2020-23562.md): IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ShowPlugInSaveOptions\_W+0x000000000000aefe. (no CVSS)
- [CVE-2020-23561](https://cve.now/CVE-2020-23561.md): IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ShowPlugInSaveOptions\_W+0x0000000000005722. (no CVSS)
- [CVE-2022-31201](https://cve.now/CVE-2022-31201.md): SoftGuard Web (SGW) before 5.1.5 allows HTML injection. (no CVSS)
- [CVE-2021-40150](https://cve.now/CVE-2021-40150.md): The web server of the E1 Zoom camera through 3.0.0.716 discloses its configuration via the /conf/ directory that is mapped to a publicly acc (no CVSS)
- [CVE-2022-32985](https://cve.now/CVE-2022-32985.md): libnx\_apl.so on Nexans FTTO GigaSwitch before 6.02N and 7.x before 7.02 implements a Backdoor Account for SSH logins on port 50200 or 50201. (no CVSS)
- [CVE-2022-31211](https://cve.now/CVE-2022-31211.md): An issue was discovered in Infiray IRAY-A8Z3 1.0.957. (no CVSS)
- [CVE-2022-31210](https://cve.now/CVE-2022-31210.md): An issue was discovered in Infiray IRAY-A8Z3 1.0.957. (no CVSS)
- [CVE-2022-31209](https://cve.now/CVE-2022-31209.md): An issue was discovered in Infiray IRAY-A8Z3 1.0.957. (no CVSS)
- [CVE-2022-31208](https://cve.now/CVE-2022-31208.md): An issue was discovered in Infiray IRAY-A8Z3 1.0.957. (no CVSS)
- [CVE-2022-31202](https://cve.now/CVE-2022-31202.md): The export function in SoftGuard Web (SGW) before 5.1.5 allows directory traversal to read an arbitrary local file via export or man.tcl. (no CVSS)
- [CVE-2022-30982](https://cve.now/CVE-2022-30982.md): An issue was discovered in Gentics CMS before 5.43.1. (no CVSS)
- [CVE-2022-30981](https://cve.now/CVE-2022-30981.md): An issue was discovered in Gentics CMS before 5.43.1. (no CVSS)
- [CVE-2022-28809](https://cve.now/CVE-2022-28809.md): An issue was discovered in Open Design Alliance Drawings SDK before 2023.3. (no CVSS)
- [CVE-2022-28808](https://cve.now/CVE-2022-28808.md): An issue was discovered in Open Design Alliance Drawings SDK before 2023.3. (no CVSS)
- [CVE-2022-28807](https://cve.now/CVE-2022-28807.md): An issue was discovered in Open Design Alliance Drawings SDK before 2023.2. (no CVSS)
- [CVE-2022-26481](https://cve.now/CVE-2022-26481.md): An issue was discovered in Poly Studio before 3.7.0. (no CVSS)
- [CVE-2022-26482](https://cve.now/CVE-2022-26482.md): An issue was discovered in Poly EagleEye Director II before 2.2.2.1. (no CVSS)
- [CVE-2022-26479](https://cve.now/CVE-2022-26479.md): An issue was discovered in Poly EagleEye Director II before 2.2.2.1. (no CVSS)
- [CVE-2022-26352](https://cve.now/CVE-2022-26352.md): An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. (CVSS 9.8, KEV)
- [CVE-2021-40149](https://cve.now/CVE-2021-40149.md): The web server of the E1 Zoom camera through 3.0.0.716 discloses its SSL private key via the root web server directory. (no CVSS)
- [CVE-2022-32263](https://cve.now/CVE-2022-32263.md): Pexip Infinity before 28.1 allows remote attackers to trigger a software abort via G.719. (no CVSS)
- [CVE-2022-29286](https://cve.now/CVE-2022-29286.md): Pexip Infinity 27 before 28.0 allows remote attackers to trigger excessive resource consumption and termination because of registrar resourc (no CVSS)
- [CVE-2022-27937](https://cve.now/CVE-2022-27937.md): Pexip Infinity before 27.3 allows remote attackers to trigger excessive resource consumption via H.264. (no CVSS)
- [CVE-2022-27936](https://cve.now/CVE-2022-27936.md): Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via H.323. (no CVSS)
- [CVE-2022-27935](https://cve.now/CVE-2022-27935.md): Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via Epic Telehealth. (no CVSS)
- [CVE-2022-27934](https://cve.now/CVE-2022-27934.md): Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via HTTP. (no CVSS)
- [CVE-2022-27933](https://cve.now/CVE-2022-27933.md): Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join. (no CVSS)
- [CVE-2022-27932](https://cve.now/CVE-2022-27932.md): Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join. (no CVSS)
- [CVE-2022-27931](https://cve.now/CVE-2022-27931.md): Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via the Session Initiation Protocol. (no CVSS)
- [CVE-2022-27930](https://cve.now/CVE-2022-27930.md): Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via single-sign-on if a random Universally Unique Identi (no CVSS)
- [CVE-2022-27929](https://cve.now/CVE-2022-27929.md): Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via HTTP. (no CVSS)
- [CVE-2022-27928](https://cve.now/CVE-2022-27928.md): Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via the Session Initiation Protocol. (no CVSS)
- [CVE-2022-26657](https://cve.now/CVE-2022-26657.md): Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join. (no CVSS)
- [CVE-2022-26656](https://cve.now/CVE-2022-26656.md): Pexip Infinity before 27.3 allows remote attackers to trigger a software abort, and possibly enumerate usernames, via One Touch Join. (no CVSS)
- [CVE-2022-26655](https://cve.now/CVE-2022-26655.md): Pexip Infinity 27.x before 27.3 has Improper Input Validation. (no CVSS)
- [CVE-2022-26654](https://cve.now/CVE-2022-26654.md): Pexip Infinity before 27.3 allows remote attackers to force a software abort via HTTP. (no CVSS)
- [CVE-2022-30622](https://cve.now/CVE-2022-30622.md): Chcnav - P5E GNSS Information disclosure (CVSS 5.3, Chcnav - P5E GNSS)
- [CVE-2022-25357](https://cve.now/CVE-2022-25357.md): Pexip Infinity 27.x before 27.2 has Improper Access Control. (no CVSS)
- [CVE-2022-31260](https://cve.now/CVE-2022-31260.md): In Montala ResourceSpace through 9.8 before r19636, csv\_export\_results\_metadata.php allows attackers to export collection metadata via a non (no CVSS)
- [CVE-2022-35861](https://cve.now/CVE-2022-35861.md): pyenv 1.2.24 through 2.3.2 allows local users to gain privileges via a .python-version file in the current working directory. (no CVSS)
- [CVE-2022-32320](https://cve.now/CVE-2022-32320.md): A Cross-Site Request Forgery (CSRF) in Ferdi through 5.8.1 and Ferdium through 6.0.0-nightly.98 allows attackers to read files via an upload (no CVSS)
- [CVE-2022-2222](https://cve.now/CVE-2022-2222.md): Download Monitor \< 4.5.91 - Admin+ Arbitrary File Download (no CVSS, Download Monitor)
- [CVE-2022-2194](https://cve.now/CVE-2022-2194.md): Accept Stripe Payments \< 2.0.64 - Admin+ Stored Cross-Site Scripting (no CVSS, Accept Stripe Payments)
- [CVE-2022-2187](https://cve.now/CVE-2022-2187.md): Contact Form 7 Captcha \< 0.1.2 - Reflected Cross-Site Scripting (no CVSS, Contact Form 7 Captcha)
- [CVE-2022-2186](https://cve.now/CVE-2022-2186.md): Simple Post Notes \< 1.7.6 - Admin+ Stored Cross-Site Scripting (no CVSS, Simple Post Notes)
- [CVE-2022-2173](https://cve.now/CVE-2022-2173.md): Advanced Database Cleaner \< 3.1.1 - Reflected Cross-Site Scripting (no CVSS, Advanced Database Cleaner)
- [CVE-2022-2169](https://cve.now/CVE-2022-2169.md): Loading Page with Loading Screen \< 1.0.83 - Admin+ Stored Cross-Site Scripting (no CVSS, Loading Page with Loading Screen)
- [CVE-2022-2168](https://cve.now/CVE-2022-2168.md): Download Manager \< 3.2.44 - Reflected Cross-Site Scripting (no CVSS, Download Manager)
- [CVE-2022-2151](https://cve.now/CVE-2022-2151.md): Best Contact Management Software \<= 3.7.3 - Admin+ Stored Cross-Site Scripting (no CVSS, Best Contact Management Software for WordPress)
- [CVE-2022-2149](https://cve.now/CVE-2022-2149.md): Very Simple Breadcrumb \<= 1.0 - Admin+ Stored Cross-Site Scripting (no CVSS, Very Simple Breadcrumb)
- [CVE-2022-2148](https://cve.now/CVE-2022-2148.md): LinkedIn Company Updates \<= 1.5.3 - Admin+ Stored Cross-Site Scripting (no CVSS, LinkedIn Company Updates)
- [CVE-2022-2146](https://cve.now/CVE-2022-2146.md): Import CSV Files \<= 1.0 - Reflected Cross-Site Scripting (no CVSS, Import CSV Files)
- [CVE-2022-2144](https://cve.now/CVE-2022-2144.md): Jquery Validation For Contact Form 7 \< 5.3 - Arbitrary Options Update via CSRF (no CVSS, Jquery Validation For Contact Form)
- [CVE-2022-2133](https://cve.now/CVE-2022-2133.md): OAuth Single Sign On \< 6.22.6 - Authentication Bypass (no CVSS, OAuth Single Sign On – SSO)
- [CVE-2022-2118](https://cve.now/CVE-2022-2118.md): 404s \< 3.5.1 - Admin+ Stored Cross-Site Scripting (no CVSS, 404s)
- [CVE-2022-2114](https://cve.now/CVE-2022-2114.md): Data Tables Generator by Supsystic \< 1.10.20 - Admin+ Stored Cross-Site Scripting (no CVSS, Data Tables Generator by Supsystic)
- [CVE-2022-2100](https://cve.now/CVE-2022-2100.md): Page Generator Plugin \< 1.6.5 - Admin+ Stored Cross-Site Scripting (no CVSS, Page Generator)
- [CVE-2022-2099](https://cve.now/CVE-2022-2099.md): WooCommerce \< 6.6.0 - Admin+ Stored HTML Injection (no CVSS, WooCommerce · woocommerce/woocommerce)
- [CVE-2022-2090](https://cve.now/CVE-2022-2090.md): Woo Discount Rules \< 2.4.2 - Reflected Cross-Site Scripting (no CVSS, Discount Rules for WooCommerce)
- [CVE-2022-1933](https://cve.now/CVE-2022-1933.md): CDI \< 5.1.9 - Reflected Cross-Site-Scripting (no CVSS, CDI – Collect and Deliver Interface for Woocommerce)
- [CVE-2022-1672](https://cve.now/CVE-2022-1672.md): Insights from Google PageSpeed \< 4.0.7 - Multiple CSRF (no CVSS, Insights from Google PageSpeed)
- [CVE-2021-24655](https://cve.now/CVE-2021-24655.md): WP User Manager \< 2.6.3 - Arbitrary User Password Reset to Account Compromise (no CVSS, WP User Manager – User Profile Builder & Membership)
- [CVE-2020-7641](https://cve.now/CVE-2020-7641.md): Prototype Pollution (CVSS 4.0, grunt-util-property)
- [CVE-2015-10003](https://cve.now/CVE-2015-10003.md): FileZilla Server PORT confused deputy (CVSS 4.3, FileZilla Server)
- [CVE-2020-16093](https://cve.now/CVE-2020-16093.md): In LemonLDAP::NG (aka lemonldap-ng) through 2.0.8, validity of the X.509 certificate is not checked by default when connecting to remote LDA (no CVSS)
- [CVE-2021-46784](https://cve.now/CVE-2021-46784.md): In Squid 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6, due to improper buffer management, a Denial of Service can occur when pro (no CVSS)
- [CVE-2022-30550](https://cve.now/CVE-2022-30550.md): An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. (CVSS 8.8)
- [CVE-2022-31212](https://cve.now/CVE-2022-31212.md): An issue was discovered in dbus-broker before 31. (no CVSS)
- [CVE-2022-31213](https://cve.now/CVE-2022-31213.md): An issue was discovered in dbus-broker before 31. (no CVSS)
- [CVE-2022-33903](https://cve.now/CVE-2022-33903.md): Tor 0.4.7.x before 0.4.7.8 allows a denial of service via the wedging of RTT estimation. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-07-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.