# CVEs published 2022-07-18

100 CVEs were published on July 18, 2022: 1 critical, 35 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2022-34643](https://cve.now/CVE-2022-34643.md): RISCV ISA Sim commit ac466a21df442c59962589ba296c702631e041b5 implements the incorrect exception priotrity when accessing memory. (no CVSS)
- [CVE-2022-34642](https://cve.now/CVE-2022-34642.md): The component mcontrol.action in RISCV ISA Sim commit ac466a21df442c59962589ba296c702631e041b5 contains the incorrect mask which can cause a (no CVSS)
- [CVE-2022-34641](https://cve.now/CVE-2022-34641.md): CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a and RISCV-Boom commit ad64c5419151e5e886daee7084d8399713b46b4b implements the incorrect (no CVSS)
- [CVE-2022-34640](https://cve.now/CVE-2022-34640.md): The \*tval of ecall/ebreak in CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a was discovered to be incorrect. (no CVSS)
- [CVE-2022-34639](https://cve.now/CVE-2022-34639.md): CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a treats non-standard fence instructions as illegal which can affect the function of the (no CVSS)
- [CVE-2022-34637](https://cve.now/CVE-2022-34637.md): CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a implements an incorrect exception type when an illegal virtual address is loaded. (no CVSS)
- [CVE-2022-34635](https://cve.now/CVE-2022-34635.md): The mstatus.sd field in CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a does not update when the mstatus.fs field is set to Dirty. (no CVSS)
- [CVE-2022-34636](https://cve.now/CVE-2022-34636.md): CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a and RISCV-Boom commit ad64c5419151e5e886daee7084d8399713b46b4b implements the incorrect (no CVSS)
- [CVE-2022-34634](https://cve.now/CVE-2022-34634.md): CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a executes crafted or incorrectly formatted det instructions rather create an exception. (no CVSS)
- [CVE-2022-34633](https://cve.now/CVE-2022-34633.md): CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a executes crafted or incorrectly formatted sfence.vma instructions rather create an exce (no CVSS)
- [CVE-2022-34632](https://cve.now/CVE-2022-34632.md): Rocket-Chip commit 4f8114374d8824dfdec03f576a8cd68bebce4e56 was discovered to contain insufficient cryptography via the component /rocket/Ro (no CVSS)
- [CVE-2015-8031](https://cve.now/CVE-2015-8031.md): Hudson (aka org.jvnet.hudson.main:hudson-core) before 3.3.2 allows XXE attacks. (no CVSS, org.jvnet.hudson.main:hudson-core)
- [CVE-2022-34035](https://cve.now/CVE-2022-34035.md): HTMLDoc v1.9.12 and below was discovered to contain a heap overflow via e\_node htmldoc/htmldoc/html.cxx:588. (no CVSS)
- [CVE-2022-34033](https://cve.now/CVE-2022-34033.md): HTMLDoc v1.9.15 was discovered to contain a heap overflow via (write\_header) /htmldoc/htmldoc/html.cxx:273. (no CVSS)
- [CVE-2022-34032](https://cve.now/CVE-2022-34032.md): Nginx NJS v0.7.5 was discovered to contain a segmentation violation in the function njs\_value\_own\_enumerate at src/njs\_value.c. (no CVSS)
- [CVE-2022-34031](https://cve.now/CVE-2022-34031.md): Nginx NJS v0.7.5 was discovered to contain a segmentation violation via njs\_value\_to\_number at src/njs\_value\_conversion.h. (no CVSS)
- [CVE-2022-34030](https://cve.now/CVE-2022-34030.md): Nginx NJS v0.7.5 was discovered to contain a segmentation violation via njs\_djb\_hash at src/njs\_djb\_hash.c. (no CVSS)
- [CVE-2022-34029](https://cve.now/CVE-2022-34029.md): Nginx NJS v0.7.4 was discovered to contain an out-of-bounds read via njs\_scope\_value at njs\_scope.h. (no CVSS)
- [CVE-2022-34028](https://cve.now/CVE-2022-34028.md): Nginx NJS v0.7.5 was discovered to contain a segmentation violation via njs\_utf8\_next at src/njs\_utf8.h. (no CVSS)
- [CVE-2022-34027](https://cve.now/CVE-2022-34027.md): Nginx NJS v0.7.4 was discovered to contain a segmentation violation via njs\_value\_property at njs\_value.c. (no CVSS)
- [CVE-2022-34875](https://cve.now/CVE-2022-34875.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 11.2.1.53537. (CVSS 3.3, Foxit PDF Reader)
- [CVE-2022-34874](https://cve.now/CVE-2022-34874.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 11.2.2.53575. (CVSS 3.3, Foxit PDF Reader)
- [CVE-2022-34873](https://cve.now/CVE-2022-34873.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 11.2.1.53537. (CVSS 3.3, Foxit PDF Reader)
- [CVE-2022-28683](https://cve.now/CVE-2022-28683.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. (CVSS 7.8, Foxit PDF Reader)
- [CVE-2022-28682](https://cve.now/CVE-2022-28682.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. (CVSS 7.8, Foxit PDF Reader)
- [CVE-2022-28681](https://cve.now/CVE-2022-28681.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 11.2.1.53537. (CVSS 2.5, Foxit PDF Reader)
- [CVE-2022-28680](https://cve.now/CVE-2022-28680.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. (CVSS 7.8, Foxit PDF Reader)
- [CVE-2022-28679](https://cve.now/CVE-2022-28679.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. (CVSS 7.8, Foxit PDF Reader)
- [CVE-2022-28678](https://cve.now/CVE-2022-28678.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. (CVSS 7.8, Foxit PDF Reader)
- [CVE-2022-28677](https://cve.now/CVE-2022-28677.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. (CVSS 7.8, Foxit PDF Reader)
- [CVE-2022-28676](https://cve.now/CVE-2022-28676.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. (CVSS 7.8, Foxit PDF Reader)
- [CVE-2022-28675](https://cve.now/CVE-2022-28675.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. (CVSS 7.8, Foxit PDF Reader)
- [CVE-2022-28674](https://cve.now/CVE-2022-28674.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. (CVSS 7.8, Foxit PDF Reader)
- [CVE-2022-28673](https://cve.now/CVE-2022-28673.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. (CVSS 7.8, Foxit PDF Reader)
- [CVE-2022-28672](https://cve.now/CVE-2022-28672.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. (CVSS 7.8, Foxit PDF Reader)
- [CVE-2022-28671](https://cve.now/CVE-2022-28671.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. (CVSS 7.8, Foxit PDF Reader)
- [CVE-2022-28670](https://cve.now/CVE-2022-28670.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 11.2.1.53537. (CVSS 3.3, Foxit PDF Reader)
- [CVE-2022-28669](https://cve.now/CVE-2022-28669.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. (CVSS 7.8, Foxit PDF Reader)
- [CVE-2022-22445](https://cve.now/CVE-2022-22445.md): An attacker that gains service access to the FSP (POWER9 only) or gains admin authority to a partition can compromise partition firmware. (CVSS 7.6, IBM PowerVM Hypervisor)
- [CVE-2021-38868](https://cve.now/CVE-2021-38868.md): IBM Engineering Requirements Quality Assistant On-Premises (All versions) is vulnerable to cross-site request forgery which could allow an a (CVSS 6.5, IBM Engineering Requirements Quality Assistant On-Premises)
- [CVE-2021-29799](https://cve.now/CVE-2021-29799.md): IBM Engineering Requirements Quality Assistant On-Premises (All versions) could allow an authenticated user to obtain sensitive information (CVSS 6.5, IBM Engineering Requirements Quality Assistant On-Premises)
- [CVE-2021-29790](https://cve.now/CVE-2021-29790.md): IBM Engineering Requirements Quality Assistant On-Premises (All versions) is vulnerable to cross-site scripting. (CVSS 5.4, IBM Engineering Requirements Quality Assistant On-Premises)
- [CVE-2021-29788](https://cve.now/CVE-2021-29788.md): IBM Engineering Requirements Quality Assistant On-Premises (All versions) is vulnerable to cross-site scripting. (CVSS 5.4, IBM Engineering Requirements Quality Assistant On-Premises)
- [CVE-2022-29057](https://cve.now/CVE-2022-29057.md): A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiEDR version 5.1.0, 5.0.0 through 5.0 (CVSS 5.4, Fortinet FortiEDR)
- [CVE-2022-26120](https://cve.now/CVE-2022-26120.md): Multiple improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerabilities \[CWE-89\] in FortiADC managemen (CVSS 5.4, Fortinet FortiADC)
- [CVE-2022-26118](https://cve.now/CVE-2022-26118.md): A privilege chaining vulnerability \[CWE-268\] in FortiManager and FortiAnalyzer 6.0.x, 6.2.x, 6.4.0 through 6.4.7, 7.0.0 through 7.0.3 may al (CVSS 6.7, Fortinet FortiManager , FortiAnalyzer)
- [CVE-2022-23438](https://cve.now/CVE-2022-23438.md): An improper neutralization of input during web page generation ('Cross-site Scripting') \[CWE-79\] vulnerability in FortiOS version 7.0.5 and (CVSS 4.7, Fortinet FortiOS)
- [CVE-2022-30302](https://cve.now/CVE-2022-30302.md): Multiple relative path traversal vulnerabilities \[CWE-23\] in FortiDeceptor management interface 1.0.0 through 3.2.x, 3.3.0 through 3.3.2, 4. (CVSS 6.5, Fortinet FortiDeceptor)
- [CVE-2022-27483](https://cve.now/CVE-2022-27483.md): A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiManager version 7.0.0 through (CVSS 7.2, Fortinet FortiManager, FortiAnalyzer)
- [CVE-2021-41031](https://cve.now/CVE-2021-41031.md): A relative path traversal vulnerability \[CWE-23\] in FortiClient for Windows versions 7.0.2 and prior, 6.4.6 and prior and 6.2.9 and below ma (CVSS 7.8, Fortinet FortiClientWindows)
- [CVE-2022-26113](https://cve.now/CVE-2022-26113.md): An execution with unnecessary privileges vulnerability \[CWE-250\] in FortiClientWindows 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2.0 throu (CVSS 7.7, Fortinet FortiClientWindows)
- [CVE-2021-22131](https://cve.now/CVE-2021-22131.md): A improper validation of certificate with host mismatch in Fortinet FortiTokenAndroid version 5.0.3 and below, Fortinet FortiTokeniOS versio (CVSS 6.4, Fortinet FortiTokenAndroid, Fortinet FortiTokeniOS, Fortine…)
- [CVE-2022-30301](https://cve.now/CVE-2022-30301.md): A path traversal vulnerability \[CWE-22\] in FortiAP-U CLI 6.2.0 through 6.2.3, 6.0.0 through 6.0.4, 5.4.0 through 5.4.6 may allow an admin us (CVSS 7.8, Fortinet FortiAP-U)
- [CVE-2022-29060](https://cve.now/CVE-2022-29060.md): A use of hard-coded cryptographic key vulnerability \[CWE-321\] in FortiDDoS API 5.5.0 through 5.5.1, 5.4.0 through 5.4.2, 5.3.0 through 5.3.1 (CVSS 8.1, Fortinet FortiDDoS)
- [CVE-2022-22304](https://cve.now/CVE-2022-22304.md): An improper neutralization of input during web page generation vulnerability \[CWE-79\] in FortiAuthenticator OWA Agent for Microsoft version (CVSS 6.1, Fortinet FortiAuthenticator OutlookAgent)
- [CVE-2021-42755](https://cve.now/CVE-2021-42755.md): An integer overflow / wraparound vulnerability \[CWE-190\] in FortiSwitch 7.0.2 and below, 6.4.9 and below, 6.2.x, 6.0.x; FortiRecorder 6.4.2 (CVSS 4.3, Fortinet FortiSwitch, FortiRecorder, FortiVoiceEnterprise,…)
- [CVE-2021-44170](https://cve.now/CVE-2021-44170.md): A stack-based buffer overflow vulnerability \[CWE-121\] in the command line interpreter of FortiOS before 7.0.4 and FortiProxy before 2.0.8 ma (CVSS 6.7, Fortinet FortiProxy, FortiOS)
- [CVE-2022-2224](https://cve.now/CVE-2022-2224.md): Gallery for Social Photo \<= 1.0.0.27 - Cross-Site Request Forgery to Post Duplication (CVSS 5.4, ghozylab Gallery for Social Photo)
- [CVE-2022-2443](https://cve.now/CVE-2022-2443.md): FreeMind WP Browser \<= 1.2 - Cross-Site Request Forgery to Cross-Site Scripting (CVSS 8.8, kusbandono FreeMind WP Browser)
- [CVE-2022-2001](https://cve.now/CVE-2022-2001.md): DX Share Selection \<= 1.4 - Cross-Site Request Forgery to Cross-Site Scripting (CVSS 8.8, nofearinc DX Share Selection)
- [CVE-2022-2117](https://cve.now/CVE-2022-2117.md): GiveWP – Donation Plugin and Fundraising Platform \<= 2.20.2 - Sensitive Information Disclosure (CVSS 5.3, stellarwp GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2022-1912](https://cve.now/CVE-2022-1912.md): Button Widget Smartsoft \<= 1.0.1 - Cross-Site Request Forgery to Cross-Site Scripting (CVSS 8.8, smartsoftbuttonwidget Button Widget Smartsoft)
- [CVE-2022-2437](https://cve.now/CVE-2022-2437.md): Feed Them Social – for Twitter feed, Youtube and more \<= 2.9.8.5 - Unauthenticated PHAR Deserialization (CVSS 9.8, slickremix Feed Them Social – Social Media Feeds, Video, an…)
- [CVE-2022-2444](https://cve.now/CVE-2022-2444.md): Visualizer: Tables and Charts Manager for WordPress \<= 3.7.9 - Authenticated (Contributor+) PHAR Deserialization (CVSS 8.8, themeisle Visualizer: Tables and Charts Manager for WordPre…)
- [CVE-2022-2435](https://cve.now/CVE-2022-2435.md): AnyMind Widget \<= 1.1 - Cross-Site Request Forgery to Cross-Site Scripting (CVSS 8.8, mbeltwski AnyMind Widget)
- [CVE-2022-2101](https://cve.now/CVE-2022-2101.md): Download Manager \<= 3.2.46 - Contributor+ Cross-Site Scripting (CVSS 6.4, codename065 Download Manager)
- [CVE-2022-2223](https://cve.now/CVE-2022-2223.md): Image Slider \<= 1.1.121 - Cross-Site Request Forgery to Post Duplication (CVSS 5.4, ghozylab Image Slider)
- [CVE-2022-2108](https://cve.now/CVE-2022-2108.md): Wbcom Designs – BuddyPress Group Reviews \<= 2.8.3 - Unauthorized AJAX Actions due to Nonce Bypass (CVSS 6.5, wbcomdesigns Wbcom Designs – BuddyPress Group Reviews)
- [CVE-2022-2039](https://cve.now/CVE-2022-2039.md): Free Live Chat Support \<= 1.0.11 - Cross-Site Request Forgery to Cross-Site Scripting (CVSS 8.8, livesupporti Free Live Chat Support)
- [CVE-2022-23745](https://cve.now/CVE-2022-23745.md): A potential memory corruption issue was found in Capsule Workspace Android app (running on GrapheneOS). (no CVSS, Checkpoint Harmony Capsule Workspace)
- [CVE-2022-32387](https://cve.now/CVE-2022-32387.md): In Kentico before 13.0.66, attackers can achieve Denial of Service via a crafted request to the GetResource handler. (no CVSS)
- [CVE-2022-23142](https://cve.now/CVE-2022-23142.md): ZXEN CG200 has a DoS vulnerability. (no CVSS, ZXEN CG200)
- [CVE-2021-33655](https://cve.now/CVE-2021-33655.md): When sending malicous data to kernel by ioctl cmd FBIOPUT\_VSCREENINFO,kernel will write memory out of bounds. (no CVSS, kernel · :linux\_kernel:)
- [CVE-2021-33656](https://cve.now/CVE-2021-33656.md): When setting font with malicous data by ioctl cmd PIO\_FONT,kernel will write memory out of bounds. (no CVSS, openEuler:kernel)
- [CVE-2022-35741](https://cve.now/CVE-2022-35741.md): Apache CloudStack SAML Single Sign-On XXE (no CVSS, Apache Software Foundation Apache CloudStack)
- [CVE-2022-34902](https://cve.now/CVE-2022-34902.md): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 (39316) Agent. (CVSS 7.8, Parallels Access)
- [CVE-2022-34901](https://cve.now/CVE-2022-34901.md): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 (39316) Agent. (CVSS 7.8, Parallels Access)
- [CVE-2022-34900](https://cve.now/CVE-2022-34900.md): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.3 (39313) Agent. (CVSS 7.8, Parallels Access)
- [CVE-2022-34899](https://cve.now/CVE-2022-34899.md): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 (39316) Agent. (CVSS 7.0, Parallels Access)
- [CVE-2022-34892](https://cve.now/CVE-2022-34892.md): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop Parallels Desktop 17.1.1. (CVSS 7.8, Parallels Desktop)
- [CVE-2022-30623](https://cve.now/CVE-2022-30623.md): Chcnav - P5E GNSS Authentication bypass (CVSS 5.9, Chcnav - P5E GNSS)
- [CVE-2022-30625](https://cve.now/CVE-2022-30625.md): Chcnav - P5E GNSS Directory listing (CVSS 5.7, Chcnav - P5E GNSS)
- [CVE-2022-30626](https://cve.now/CVE-2022-30626.md): Chcnav - P5E GNSS API not secure (CVSS 6.3, Chcnav - P5E GNSS)
- [CVE-2022-30624](https://cve.now/CVE-2022-30624.md): Chcnav - P5E GNSS Authentication bypass admin password reset (CVSS 6.8, Chcnav - P5E GNSS)
- [CVE-2022-30627](https://cve.now/CVE-2022-30627.md): Chcnav - P5E GNSS Information disclosure hard coded credentials. (CVSS 5.7, Chcnav - P5E GNSS)
- [CVE-2022-30621](https://cve.now/CVE-2022-30621.md): Cellinx NVT – IP PTZ Camera local file inclusion (CVSS 7.6, Cellinx NVT - IP PTZ Camera)
- [CVE-2022-30620](https://cve.now/CVE-2022-30620.md): Cellinx NVT – IP PTZ Camera Privilege Escalation (CVSS 8.2, Cellinx NVT - IP PTZ Camera)
- [CVE-2022-24692](https://cve.now/CVE-2022-24692.md): An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. (no CVSS)
- [CVE-2022-24691](https://cve.now/CVE-2022-24691.md): An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. (no CVSS)
- [CVE-2022-24690](https://cve.now/CVE-2022-24690.md): An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. (no CVSS)
- [CVE-2022-24689](https://cve.now/CVE-2022-24689.md): An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. (no CVSS)
- [CVE-2022-24688](https://cve.now/CVE-2022-24688.md): An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. (no CVSS)
- [CVE-2022-35404](https://cve.now/CVE-2022-35404.md): ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are vulnerable to unauthorized file and directory creation (no CVSS)
- [CVE-2022-32450](https://cve.now/CVE-2022-32450.md): AnyDesk 7.0.9 allows a local user to gain SYSTEM privileges via a symbolic link because the user can write to their own %APPDATA% folder (us (no CVSS)
- [CVE-2022-36127](https://cve.now/CVE-2022-36127.md): Service unavailability impact in NodeJS agent(version \<= 0.5.0) (no CVSS, Apache Software Foundation Apache SkyWalking NodeJS Agent ·…)
- [CVE-2016-15003](https://cve.now/CVE-2016-15003.md): FileZilla Client Installer uninstall.exe unquoted search path (CVSS 6.3, FileZilla Client)
- [CVE-2022-1565](https://cve.now/CVE-2022-1565.md): Import any XML or CSV File to WordPress \<= 3.6.7 - Admin+ Malicious File Upload (CVSS 7.2, wpallimport WP All Import – Drag & Drop Import for CSV, XML…)
- [CVE-2022-2400](https://cve.now/CVE-2022-2400.md): External Control of File Name or Path in dompdf/dompdf (CVSS 5.3, dompdf/dompdf)
- [CVE-2022-26117](https://cve.now/CVE-2022-26117.md): An empty password in configuration file vulnerability \[CWE-258\] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 an (CVSS 8.8, Fortinet FortiNAC)
- [CVE-2022-33891](https://cve.now/CVE-2022-33891.md): Apache Spark shell command injection vulnerability via Spark UI (CVSS 8.8, KEV, Apache Software Foundation Apache Spark · org.apache.spa… +1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-07-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.