CVEs published July 19, 2022
136 CVEs were published on July 19, 2022: 3 critical, 27 high. 1 is now in CISA KEV.
- Published
- 136
- Critical
- 3
- High
- 27
- Medium
- 73
- Low
- 5
- Unrated
- 28
- Now in CISA KEV
- 1
- Fix available
- 14
Most affected products
- Oracle MySQL Server
- 22
- GStreamer
- 7
- Oracle Banking Trade Finance
- 6
- Oracle FLEXCUBE Universal Banking
- 6
- Oracle Communications Billing and Revenue Management
- 4
- Oracle PeopleSoft Enterprise PT PeopleTools
- 4
- Oracle Solaris Operating System
- 4
- Oracle WebLogic Server
- 4
- IBM Sterling Partner Engagement Manager on Cloud · IBM Ster…
- 3
- Oracle Database - Enterprise Edition
- 3
Critical 3
- CVE-2022-21543Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mgmt).Oracle PeopleSoft Enterprise PT PeopleTools
- CVE-2022-35405Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution.
- CVE-2022-24082If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filterPegasystems Pega Infinity
High 27
- CVE-2022-21571Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2022-21570Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core).Oracle Coherence
- CVE-2022-21567Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Worklist).Oracle Workflow
- CVE-2022-21566Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Diagnostics).Oracle Applications Framework
- CVE-2022-21562Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).Oracle SOA Suite
- CVE-2022-21558Vulnerability in the Oracle Crystal Ball product of Oracle Construction and Engineering (component: Installation).Oracle Crystal Ball
- CVE-2022-21552Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Search).Oracle WebCenter Content
- CVE-2022-21544Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure).Oracle FLEXCUBE Universal Banking
- CVE-2022-21542Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime).Oracle JD Edwards EnterpriseOne Tools
- CVE-2022-21536Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Policy Framework).Oracle Enterprise Manager Base Platform
- CVE-2022-21524Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem).Oracle Solaris Operating System
- CVE-2022-21516Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Manager Install).Oracle Enterprise Manager Base Platform
- CVE-2022-21514Vulnerability in the Oracle Solaris product of Oracle Systems (component: Remote Administration Daemon).Oracle Solaris Operating System
- CVE-2022-21513Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core).Oracle Sun ZFS Storage Appliance Kit (AK) Software
- CVE-2022-21511Vulnerability in the Oracle Database - Enterprise Edition Recovery component of Oracle Database Server.Oracle Database - Enterprise Edition
- CVE-2022-21510Vulnerability in the Oracle Database - Enterprise Edition Sharding component of Oracle Database Server.Oracle Database - Enterprise Edition
- CVE-2022-21429Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: Billing Oracle Communications Billing and Revenue Management
- CVE-2022-31144Potential heap overflow in Redis redis
- CVE-2022-22360IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 could allow a remote authenticated attacker to conduct an LDAP injecIBM Sterling Partner Engagement Manager
- CVE-2022-22358IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to an XML External Entity Injection (XXE) attack when IBM Sterling Partner Engagement Manager
- CVE-2022-2193Insecure Direct Object Reference vulnerability in HYPR Server before version 6.14.1 allows remote authenticated attackers to add a FIDO2 autHYPR Server
- CVE-2022-2192Forced Browsing vulnerability in HYPR Server version 6.10 to 6.15.1 allows remote attackers with a valid one-time recovery token to elevate HYPR Server
- CVE-2022-2453Use After Free in gpac/gpacgpac/gpac
- CVE-2022-2467SourceCodester Garage Management System login.php sql injectionSourceCodester Garage Management System
- CVE-2022-30526A privilege escalation vulnerability was identified in the CLI command of Zyxel USG FLEX 100(W) firmware versions 4.50 through 5.30, USG FLEZyxel USG FLEX 100(W) firmware · Zyxel USG FLEX 200 firm… +7
- CVE-2022-2454Integer Overflow or Wraparound in gpac/gpacgpac/gpac
- CVE-2022-34169Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheetsApache Software Foundation Apache Xalan-J · xalan:xalan
Medium, low and unrated 106
- CVE-2022-21586Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure).Oracle Banking Trade Finance
- CVE-2022-21585Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure).Oracle Banking Trade Finance
- CVE-2022-21584Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure).Oracle Banking Trade Finance
- CVE-2022-21583Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure).Oracle Banking Trade Finance
- CVE-2022-21582Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure).Oracle Banking Trade Finance
- CVE-2022-21581Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure).Oracle Banking Trade Finance
- CVE-2022-21580Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Applications (component: Oracle Financial Services Revenue Management and Billing
- CVE-2022-21579Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure).Oracle FLEXCUBE Universal Banking
- CVE-2022-21578Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure).Oracle FLEXCUBE Universal Banking
- CVE-2022-21577Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure).Oracle FLEXCUBE Universal Banking
- CVE-2022-21576Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure).Oracle FLEXCUBE Universal Banking
- CVE-2022-21575Vulnerability in the Oracle WebCenter Sites Support Tools product of Oracle Fusion Middleware (component: User Interface).Oracle WebCenter Sites
- CVE-2022-21574Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: ConnectiOracle Communications Billing and Revenue Management
- CVE-2022-21573Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: Billing Oracle Communications Billing and Revenue Management
- CVE-2022-21572Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: Billing Oracle Communications Billing and Revenue Management
- CVE-2022-21569Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2022-21568Vulnerability in the Oracle iReceivables product of Oracle E-Business Suite (component: Access Request).Oracle iReceivables
- CVE-2022-21565Vulnerability in the Java VM component of Oracle Database Server.Oracle Database - Enterprise Edition
- CVE-2022-21564Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services).Oracle WebLogic Server
- CVE-2022-21563Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core).Oracle Sun ZFS Storage Appliance Kit (AK) Software
- CVE-2022-21561Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime).Oracle JD Edwards EnterpriseOne Tools
- CVE-2022-21560Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).Oracle WebLogic Server
- CVE-2022-21559Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework).Oracle Commerce Platform
- CVE-2022-21557Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container).Oracle WebLogic Server
- CVE-2022-21556Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2022-21555Vulnerability in the MySQL Shell for VS Code product of Oracle MySQL (component: Shell: GUI).Oracle MySQL Server
- CVE-2022-21554Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2022-21553Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2022-21551Vulnerability in Oracle GoldenGate (component: Oracle GoldenGate).Oracle GoldenGate
- CVE-2022-21550Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).Oracle MySQL Cluster
- CVE-2022-21548Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).Oracle WebLogic Server
- CVE-2022-21547Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Federated).Oracle MySQL Server
- CVE-2022-21545Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite (component: Candidate Self Service Registration).Oracle iRecruitment
- CVE-2022-21539Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).Oracle MySQL Server
- CVE-2022-21538Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption).Oracle MySQL Server
- CVE-2022-21537Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).Oracle MySQL Server
- CVE-2022-21535Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: General/Core Client).Oracle MySQL Server
- CVE-2022-21534Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure).Oracle MySQL Server
- CVE-2022-21533Vulnerability in the Oracle Solaris product of Oracle Systems (component: SMB Server).Oracle Solaris Operating System
- CVE-2022-21532Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator).Oracle JD Edwards EnterpriseOne Orchestrator
- CVE-2022-21531Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2022-21530Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2022-21529Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2022-21528Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2022-21527Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2022-21526Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2022-21525Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2022-21523Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: BI Publisher Security).Oracle BI Publisher
- CVE-2022-21522Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure).Oracle MySQL Server
- CVE-2022-21521Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: XML Publisher).Oracle PeopleSoft Enterprise PT PeopleTools
- CVE-2022-21520Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Fluid Core).Oracle PeopleSoft Enterprise PT PeopleTools
- CVE-2022-21519Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).Oracle MySQL Cluster
- CVE-2022-21518Vulnerability in the Oracle Health Sciences Data Management Workbench product of Oracle Health Sciences Applications (component: User InterfOracle Health Sciences Data Management Workbench
- CVE-2022-21517Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).Oracle MySQL Server
- CVE-2022-21515Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options).Oracle MySQL Server
- CVE-2022-21512Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Integration Broker).Oracle PeopleSoft Enterprise PT PeopleTools
- CVE-2022-21509Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2022-21508Vulnerability in Oracle Essbase (component: Security and Provisioning).Oracle Hyperion Essbase
- CVE-2022-21455Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PAM Auth Plugin).Oracle MySQL Server
- CVE-2022-21439Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel).Oracle Solaris Operating System
- CVE-2022-21432Vulnerability in the Oracle Database - Enterprise Edition RDBMS Security component of Oracle Database Server.Oracle Text
- CVE-2022-21428Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure).Oracle FLEXCUBE Universal Banking
- CVE-2022-31150CRLF injection in request headersnodejs undici · undici
- CVE-2022-34266The libtiff-4.0.3-35.amzn2.0.1 package for LibTIFF on Amazon Linux 2 allows attackers to cause a denial of service (application crash), a di
- CVE-2022-1924DOS / potential heap overwrite in mkv demuxing using lzo decompression.GStreamer
- CVE-2022-1923DOS / potential heap overwrite in mkv demuxing using bzip decompression.GStreamer
- CVE-2022-2122DOS / potential heap overwrite in qtdemux using zlib decompression.GStreamer
- CVE-2022-1925DOS / potential heap overwrite in mkv demuxing using HEADERSTRIP decompression.GStreamer
- CVE-2022-1922DOS / potential heap overwrite in mkv demuxing using zlib decompression.GStreamer
- CVE-2022-1920Integer overflow in matroskademux element in gst_matroska_demux_add_wvpk_header function which allows a heap overwrite while parsing matroskGStreamer
- CVE-2022-34539Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 was discovered to contain a command injection vulnerability in the component /admin/c
- CVE-2022-34540Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 was discovered to contain a command injection vulnerability in the component /admin/v
- CVE-2022-34538Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 was discovered to contain a command injection vulnerability in the component /admin/v
- CVE-2022-34537Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 was discovered to contain a cross-site scripting (XSS) vulnerability via the componen
- CVE-2022-34536Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 allows attackers to access the core log file and perform session hijacking via a craf
- CVE-2022-34534Digital Watchdog DW Spectrum Server 4.2.0.32842 allows attackers to access sensitive infromation via a crafted API call.
- CVE-2022-34535Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 allows unauthenticated attackers to view internal paths and scripts via web files.
- CVE-2022-36305Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the body function at /web/api/v1/upload/UploadHandle
- CVE-2022-36303Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the handle_file_upload function at /web/api/v1/uploa
- CVE-2022-36304Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the generate_response function at /web/api/v1/upload
- CVE-2022-34025Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the post function at /web/api/v1/upload/UploadHandle
- CVE-2022-30570TIBCO Data Virtualization Access Control VulnerabilityTIBCO Software TIBCO Data Virtualization
- CVE-2022-2394Sensitive Parameter Exposure in Puppet Bolt prior to 3.24Puppet Bolt
- CVE-2022-27373Shanghai Feixun Data Communication Technology Co., Ltd router fir302b A2 was discovered to contain a remote command execution (RCE) vulnerab
- CVE-2022-34024Barangay Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the resident module editing function at
- CVE-2022-34023Barangay Management System v1.0 was discovered to contain a SQL injection vulnerability via the hidden_id parameter at /officials/officials.
- CVE-2022-22417IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to cross-site scripting.IBM Sterling Partner Engagement Manager on Cloud · IBM Ster…
- CVE-2022-22416IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to server-side request forgery (SSRF).IBM Sterling Partner Engagement Manager on Cloud · IBM Ster…
- CVE-2022-22359IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to cross-site request forgery which could allow an attIBM Sterling Partner Engagement Manager on Cloud · IBM Ster…
- CVE-2022-34001Unit4 ERP through 7.9 allows XXE via ExecuteServerProcessAsynchronously.
- CVE-2022-35912In grails-databinding in Grails before 3.3.15, 4.x before 4.1.1, 5.x before 5.1.9, and 5.2.x before 5.2.1 (at least when certain Java 8 conforg.grails:grails-databinding
- CVE-2022-2469GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API clientGNU SASL
- CVE-2022-27580A deserialization vulnerability in a .NET framework class used and not properly checked by Safety Designer all versions up to and including SICK Safety Designer
- CVE-2022-27579A deserialization vulnerability in a .NET framework class used and not properly checked by Flexi Soft Designer in all versions up to and incSICK Flexi Soft Designer
- CVE-2022-27545HCL BigFix Web Reports authorized users may perform HTML injection.HCL Software HCL BigFix
- CVE-2022-27544HCL BigFix Web Reports authorized users may see sensitive information in clear textHCL Software HCL BigFix
- CVE-2021-32504Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance users only.SICK FTMg
- CVE-2022-1984This issue affects: HYPR Windows WFA versions prior to 7.2; Unsafe Deserialization vulnerability in HYPR Workforce Access (WFA) before versiHYPR Windows WFA
- CVE-2022-2468SourceCodester Garage Management System editbrand.php sql injectionSourceCodester Garage Management System
- CVE-2022-30532In affected versions of Octopus Deploy, there is no logging of changes to artifacts within Octopus Deploy.Octopus Deploy Octopus Server
- CVE-2022-2030A directory traversal vulnerability caused by specific character sequences within an improperly sanitized URL was identified in some CGI proZyxel USG FLEX 100(W) firmware · Zyxel USG FLEX 200 firm… +7
- CVE-2022-1921Integer overflow in avidemux element in gst_avi_demux_invert function which allows a heap overwrite while parsing avi files.GStreamer
- CVE-2022-21540Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).Oracle Java SE JDK and JRE
- CVE-2022-21541Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).Oracle Java SE JDK and JRE
- CVE-2022-21549Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).Oracle Java SE JDK and JRE
- CVE-2022-2476A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL =====================Wavpack