CVEs published July 18, 2022
100 CVEs were published on July 18, 2022: 1 critical, 35 high. 1 is now in CISA KEV.
- Published
- 100
- Critical
- 1
- High
- 35
- Medium
- 25
- Low
- 5
- Unrated
- 34
- Now in CISA KEV
- 1
- Fix available
- 6
Most affected products
- Foxit PDF Reader
- 18
- Chcnav - P5E GNSS
- 5
- IBM Engineering Requirements Quality Assistant On-Premises
- 4
- Parallels Access
- 4
- Cellinx NVT - IP PTZ Camera
- 2
- Fortinet FortiClientWindows
- 2
- Apache Software Foundation Apache CloudStack
- 1
- Apache Software Foundation Apache SkyWalking NodeJS Agent ·…
- 1
- Apache Software Foundation Apache Spark · org.apache.spa… +1
- 1
- Checkpoint Harmony Capsule Workspace
- 1
Critical 1
High 35
- CVE-2022-28683This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537.Foxit PDF Reader
- CVE-2022-28682This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537.Foxit PDF Reader
- CVE-2022-28680This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537.Foxit PDF Reader
- CVE-2022-28679This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537.Foxit PDF Reader
- CVE-2022-28678This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537.Foxit PDF Reader
- CVE-2022-28677This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537.Foxit PDF Reader
- CVE-2022-28676This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537.Foxit PDF Reader
- CVE-2022-28675This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537.Foxit PDF Reader
- CVE-2022-28674This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537.Foxit PDF Reader
- CVE-2022-28673This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537.Foxit PDF Reader
- CVE-2022-28672This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537.Foxit PDF Reader
- CVE-2022-28671This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537.Foxit PDF Reader
- CVE-2022-28669This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537.Foxit PDF Reader
- CVE-2022-22445An attacker that gains service access to the FSP (POWER9 only) or gains admin authority to a partition can compromise partition firmware.IBM PowerVM Hypervisor
- CVE-2022-27483A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiManager version 7.0.0 through Fortinet FortiManager, FortiAnalyzer
- CVE-2021-41031A relative path traversal vulnerability [CWE-23] in FortiClient for Windows versions 7.0.2 and prior, 6.4.6 and prior and 6.2.9 and below maFortinet FortiClientWindows
- CVE-2022-26113An execution with unnecessary privileges vulnerability [CWE-250] in FortiClientWindows 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2.0 throuFortinet FortiClientWindows
- CVE-2022-30301A path traversal vulnerability [CWE-22] in FortiAP-U CLI 6.2.0 through 6.2.3, 6.0.0 through 6.0.4, 5.4.0 through 5.4.6 may allow an admin usFortinet FortiAP-U
- CVE-2022-29060A use of hard-coded cryptographic key vulnerability [CWE-321] in FortiDDoS API 5.5.0 through 5.5.1, 5.4.0 through 5.4.2, 5.3.0 through 5.3.1Fortinet FortiDDoS
- CVE-2022-2443FreeMind WP Browser <= 1.2 - Cross-Site Request Forgery to Cross-Site Scriptingkusbandono FreeMind WP Browser
- CVE-2022-2001DX Share Selection <= 1.4 - Cross-Site Request Forgery to Cross-Site Scriptingnofearinc DX Share Selection
- CVE-2022-1912Button Widget Smartsoft <= 1.0.1 - Cross-Site Request Forgery to Cross-Site Scriptingsmartsoftbuttonwidget Button Widget Smartsoft
- CVE-2022-2444Visualizer: Tables and Charts Manager for WordPress <= 3.7.9 - Authenticated (Contributor+) PHAR Deserializationthemeisle Visualizer: Tables and Charts Manager for WordPre…
- CVE-2022-2435AnyMind Widget <= 1.1 - Cross-Site Request Forgery to Cross-Site Scriptingmbeltwski AnyMind Widget
- CVE-2022-2039Free Live Chat Support <= 1.0.11 - Cross-Site Request Forgery to Cross-Site Scriptinglivesupporti Free Live Chat Support
- CVE-2022-34902This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 (39316) Agent.Parallels Access
- CVE-2022-34901This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 (39316) Agent.Parallels Access
- CVE-2022-34900This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.3 (39313) Agent.Parallels Access
- CVE-2022-34899This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 (39316) Agent.Parallels Access
- CVE-2022-34892This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop Parallels Desktop 17.1.1.Parallels Desktop
- CVE-2022-30621Cellinx NVT – IP PTZ Camera local file inclusionCellinx NVT - IP PTZ Camera
- CVE-2022-30620Cellinx NVT – IP PTZ Camera Privilege EscalationCellinx NVT - IP PTZ Camera
- CVE-2022-1565Import any XML or CSV File to WordPress <= 3.6.7 - Admin+ Malicious File Uploadwpallimport WP All Import – Drag & Drop Import for CSV, XML…
- CVE-2022-26117An empty password in configuration file vulnerability [CWE-258] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 anFortinet FortiNAC
- CVE-2022-33891Apache Spark shell command injection vulnerability via Spark UIApache Software Foundation Apache Spark · org.apache.spa… +1
Medium, low and unrated 64
- CVE-2022-34643RISCV ISA Sim commit ac466a21df442c59962589ba296c702631e041b5 implements the incorrect exception priotrity when accessing memory.
- CVE-2022-34642The component mcontrol.action in RISCV ISA Sim commit ac466a21df442c59962589ba296c702631e041b5 contains the incorrect mask which can cause a
- CVE-2022-34641CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a and RISCV-Boom commit ad64c5419151e5e886daee7084d8399713b46b4b implements the incorrect
- CVE-2022-34640The *tval of ecall/ebreak in CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a was discovered to be incorrect.
- CVE-2022-34639CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a treats non-standard fence instructions as illegal which can affect the function of the
- CVE-2022-34637CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a implements an incorrect exception type when an illegal virtual address is loaded.
- CVE-2022-34635The mstatus.sd field in CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a does not update when the mstatus.fs field is set to Dirty.
- CVE-2022-34636CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a and RISCV-Boom commit ad64c5419151e5e886daee7084d8399713b46b4b implements the incorrect
- CVE-2022-34634CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a executes crafted or incorrectly formatted det instructions rather create an exception.
- CVE-2022-34633CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a executes crafted or incorrectly formatted sfence.vma instructions rather create an exce
- CVE-2022-34632Rocket-Chip commit 4f8114374d8824dfdec03f576a8cd68bebce4e56 was discovered to contain insufficient cryptography via the component /rocket/Ro
- CVE-2015-8031Hudson (aka org.jvnet.hudson.main:hudson-core) before 3.3.2 allows XXE attacks.org.jvnet.hudson.main:hudson-core
- CVE-2022-34035HTMLDoc v1.9.12 and below was discovered to contain a heap overflow via e_node htmldoc/htmldoc/html.cxx:588.
- CVE-2022-34033HTMLDoc v1.9.15 was discovered to contain a heap overflow via (write_header) /htmldoc/htmldoc/html.cxx:273.
- CVE-2022-34032Nginx NJS v0.7.5 was discovered to contain a segmentation violation in the function njs_value_own_enumerate at src/njs_value.c.
- CVE-2022-34031Nginx NJS v0.7.5 was discovered to contain a segmentation violation via njs_value_to_number at src/njs_value_conversion.h.
- CVE-2022-34030Nginx NJS v0.7.5 was discovered to contain a segmentation violation via njs_djb_hash at src/njs_djb_hash.c.
- CVE-2022-34029Nginx NJS v0.7.4 was discovered to contain an out-of-bounds read via njs_scope_value at njs_scope.h.
- CVE-2022-34028Nginx NJS v0.7.5 was discovered to contain a segmentation violation via njs_utf8_next at src/njs_utf8.h.
- CVE-2022-34027Nginx NJS v0.7.4 was discovered to contain a segmentation violation via njs_value_property at njs_value.c.
- CVE-2022-34875This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 11.2.1.53537.Foxit PDF Reader
- CVE-2022-34874This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 11.2.2.53575.Foxit PDF Reader
- CVE-2022-34873This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 11.2.1.53537.Foxit PDF Reader
- CVE-2022-28681This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 11.2.1.53537.Foxit PDF Reader
- CVE-2022-28670This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 11.2.1.53537.Foxit PDF Reader
- CVE-2021-38868IBM Engineering Requirements Quality Assistant On-Premises (All versions) is vulnerable to cross-site request forgery which could allow an aIBM Engineering Requirements Quality Assistant On-Premises
- CVE-2021-29799IBM Engineering Requirements Quality Assistant On-Premises (All versions) could allow an authenticated user to obtain sensitive information IBM Engineering Requirements Quality Assistant On-Premises
- CVE-2021-29790IBM Engineering Requirements Quality Assistant On-Premises (All versions) is vulnerable to cross-site scripting.IBM Engineering Requirements Quality Assistant On-Premises
- CVE-2021-29788IBM Engineering Requirements Quality Assistant On-Premises (All versions) is vulnerable to cross-site scripting.IBM Engineering Requirements Quality Assistant On-Premises
- CVE-2022-29057A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiEDR version 5.1.0, 5.0.0 through 5.0Fortinet FortiEDR
- CVE-2022-26120Multiple improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerabilities [CWE-89] in FortiADC managemenFortinet FortiADC
- CVE-2022-26118A privilege chaining vulnerability [CWE-268] in FortiManager and FortiAnalyzer 6.0.x, 6.2.x, 6.4.0 through 6.4.7, 7.0.0 through 7.0.3 may alFortinet FortiManager , FortiAnalyzer
- CVE-2022-23438An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in FortiOS version 7.0.5 and Fortinet FortiOS
- CVE-2022-30302Multiple relative path traversal vulnerabilities [CWE-23] in FortiDeceptor management interface 1.0.0 through 3.2.x, 3.3.0 through 3.3.2, 4.Fortinet FortiDeceptor
- CVE-2021-22131A improper validation of certificate with host mismatch in Fortinet FortiTokenAndroid version 5.0.3 and below, Fortinet FortiTokeniOS versioFortinet FortiTokenAndroid, Fortinet FortiTokeniOS, Fortine…
- CVE-2022-22304An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiAuthenticator OWA Agent for Microsoft version Fortinet FortiAuthenticator OutlookAgent
- CVE-2021-42755An integer overflow / wraparound vulnerability [CWE-190] in FortiSwitch 7.0.2 and below, 6.4.9 and below, 6.2.x, 6.0.x; FortiRecorder 6.4.2 Fortinet FortiSwitch, FortiRecorder, FortiVoiceEnterprise,…
- CVE-2021-44170A stack-based buffer overflow vulnerability [CWE-121] in the command line interpreter of FortiOS before 7.0.4 and FortiProxy before 2.0.8 maFortinet FortiProxy, FortiOS
- CVE-2022-2224Gallery for Social Photo <= 1.0.0.27 - Cross-Site Request Forgery to Post Duplicationghozylab Gallery for Social Photo
- CVE-2022-2117GiveWP – Donation Plugin and Fundraising Platform <= 2.20.2 - Sensitive Information Disclosurestellarwp GiveWP – Donation Plugin and Fundraising Platform
- CVE-2022-2101Download Manager <= 3.2.46 - Contributor+ Cross-Site Scriptingcodename065 Download Manager
- CVE-2022-2223Image Slider <= 1.1.121 - Cross-Site Request Forgery to Post Duplicationghozylab Image Slider
- CVE-2022-2108Wbcom Designs – BuddyPress Group Reviews <= 2.8.3 - Unauthorized AJAX Actions due to Nonce Bypasswbcomdesigns Wbcom Designs – BuddyPress Group Reviews
- CVE-2022-23745A potential memory corruption issue was found in Capsule Workspace Android app (running on GrapheneOS).Checkpoint Harmony Capsule Workspace
- CVE-2022-32387In Kentico before 13.0.66, attackers can achieve Denial of Service via a crafted request to the GetResource handler.
- CVE-2022-23142ZXEN CG200 has a DoS vulnerability.ZXEN CG200
- CVE-2021-33655When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of bounds.kernel · :linux_kernel:
- CVE-2021-33656When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out of bounds.openEuler:kernel
- CVE-2022-35741Apache CloudStack SAML Single Sign-On XXEApache Software Foundation Apache CloudStack
- CVE-2022-30623Chcnav - P5E GNSS Authentication bypassChcnav - P5E GNSS
- CVE-2022-30625Chcnav - P5E GNSS Directory listingChcnav - P5E GNSS
- CVE-2022-30626Chcnav - P5E GNSS API not secureChcnav - P5E GNSS
- CVE-2022-30624Chcnav - P5E GNSS Authentication bypass admin password resetChcnav - P5E GNSS
- CVE-2022-30627Chcnav - P5E GNSS Information disclosure hard coded credentials.Chcnav - P5E GNSS
- CVE-2022-24692An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5.
- CVE-2022-24691An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5.
- CVE-2022-24690An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5.
- CVE-2022-24689An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5.
- CVE-2022-24688An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5.
- CVE-2022-35404ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are vulnerable to unauthorized file and directory creation
- CVE-2022-32450AnyDesk 7.0.9 allows a local user to gain SYSTEM privileges via a symbolic link because the user can write to their own %APPDATA% folder (us
- CVE-2022-36127Service unavailability impact in NodeJS agent(version <= 0.5.0)Apache Software Foundation Apache SkyWalking NodeJS Agent ·…
- CVE-2016-15003FileZilla Client Installer uninstall.exe unquoted search pathFileZilla Client
- CVE-2022-2400External Control of File Name or Path in dompdf/dompdfdompdf/dompdf