# CVEs published 2022-07-19

136 CVEs were published on July 19, 2022: 3 critical, 27 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2022-21586](https://cve.now/CVE-2022-21586.md): Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). (CVSS 6.4, Oracle Banking Trade Finance)
- [CVE-2022-21585](https://cve.now/CVE-2022-21585.md): Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). (CVSS 6.7, Oracle Banking Trade Finance)
- [CVE-2022-21584](https://cve.now/CVE-2022-21584.md): Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). (CVSS 6.4, Oracle Banking Trade Finance)
- [CVE-2022-21583](https://cve.now/CVE-2022-21583.md): Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). (CVSS 6.4, Oracle Banking Trade Finance)
- [CVE-2022-21582](https://cve.now/CVE-2022-21582.md): Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). (CVSS 6.7, Oracle Banking Trade Finance)
- [CVE-2022-21581](https://cve.now/CVE-2022-21581.md): Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). (CVSS 5.9, Oracle Banking Trade Finance)
- [CVE-2022-21580](https://cve.now/CVE-2022-21580.md): Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Applications (component: (CVSS 5.9, Oracle Financial Services Revenue Management and Billing)
- [CVE-2022-21579](https://cve.now/CVE-2022-21579.md): Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure). (CVSS 6.4, Oracle FLEXCUBE Universal Banking)
- [CVE-2022-21578](https://cve.now/CVE-2022-21578.md): Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure). (CVSS 6.7, Oracle FLEXCUBE Universal Banking)
- [CVE-2022-21577](https://cve.now/CVE-2022-21577.md): Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure). (CVSS 6.4, Oracle FLEXCUBE Universal Banking)
- [CVE-2022-21576](https://cve.now/CVE-2022-21576.md): Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure). (CVSS 6.4, Oracle FLEXCUBE Universal Banking)
- [CVE-2022-21575](https://cve.now/CVE-2022-21575.md): Vulnerability in the Oracle WebCenter Sites Support Tools product of Oracle Fusion Middleware (component: User Interface). (CVSS 6.0, Oracle WebCenter Sites)
- [CVE-2022-21574](https://cve.now/CVE-2022-21574.md): Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: Connecti (CVSS 5.3, Oracle Communications Billing and Revenue Management)
- [CVE-2022-21573](https://cve.now/CVE-2022-21573.md): Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: Billing (CVSS 6.5, Oracle Communications Billing and Revenue Management)
- [CVE-2022-21572](https://cve.now/CVE-2022-21572.md): Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: Billing (CVSS 5.4, Oracle Communications Billing and Revenue Management)
- [CVE-2022-21571](https://cve.now/CVE-2022-21571.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 8.2, Oracle VM VirtualBox)
- [CVE-2022-21570](https://cve.now/CVE-2022-21570.md): Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). (CVSS 7.5, Oracle Coherence)
- [CVE-2022-21569](https://cve.now/CVE-2022-21569.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 6.5, Oracle MySQL Server)
- [CVE-2022-21568](https://cve.now/CVE-2022-21568.md): Vulnerability in the Oracle iReceivables product of Oracle E-Business Suite (component: Access Request). (CVSS 6.5, Oracle iReceivables)
- [CVE-2022-21567](https://cve.now/CVE-2022-21567.md): Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Worklist). (CVSS 7.5, Oracle Workflow)
- [CVE-2022-21566](https://cve.now/CVE-2022-21566.md): Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Diagnostics). (CVSS 7.5, Oracle Applications Framework)
- [CVE-2022-21565](https://cve.now/CVE-2022-21565.md): Vulnerability in the Java VM component of Oracle Database Server. (CVSS 6.5, Oracle Database - Enterprise Edition)
- [CVE-2022-21564](https://cve.now/CVE-2022-21564.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). (CVSS 5.3, Oracle WebLogic Server)
- [CVE-2022-21563](https://cve.now/CVE-2022-21563.md): Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). (CVSS 3.4, Oracle Sun ZFS Storage Appliance Kit (AK) Software)
- [CVE-2022-21562](https://cve.now/CVE-2022-21562.md): Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). (CVSS 7.5, Oracle SOA Suite)
- [CVE-2022-21561](https://cve.now/CVE-2022-21561.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime). (CVSS 6.5, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2022-21560](https://cve.now/CVE-2022-21560.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 5.3, Oracle WebLogic Server)
- [CVE-2022-21559](https://cve.now/CVE-2022-21559.md): Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). (CVSS 5.5, Oracle Commerce Platform)
- [CVE-2022-21558](https://cve.now/CVE-2022-21558.md): Vulnerability in the Oracle Crystal Ball product of Oracle Construction and Engineering (component: Installation). (CVSS 7.8, Oracle Crystal Ball)
- [CVE-2022-21557](https://cve.now/CVE-2022-21557.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). (CVSS 5.7, Oracle WebLogic Server)
- [CVE-2022-21556](https://cve.now/CVE-2022-21556.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 6.5, Oracle MySQL Server)
- [CVE-2022-21555](https://cve.now/CVE-2022-21555.md): Vulnerability in the MySQL Shell for VS Code product of Oracle MySQL (component: Shell: GUI). (CVSS 4.2, Oracle MySQL Server)
- [CVE-2022-21554](https://cve.now/CVE-2022-21554.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 4.4, Oracle VM VirtualBox)
- [CVE-2022-21553](https://cve.now/CVE-2022-21553.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2022-21552](https://cve.now/CVE-2022-21552.md): Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Search). (CVSS 7.2, Oracle WebCenter Content)
- [CVE-2022-21551](https://cve.now/CVE-2022-21551.md): Vulnerability in Oracle GoldenGate (component: Oracle GoldenGate). (CVSS 6.8, Oracle GoldenGate)
- [CVE-2022-21550](https://cve.now/CVE-2022-21550.md): Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). (CVSS 6.3, Oracle MySQL Cluster)
- [CVE-2022-21548](https://cve.now/CVE-2022-21548.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 6.5, Oracle WebLogic Server)
- [CVE-2022-21547](https://cve.now/CVE-2022-21547.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Federated). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2022-21545](https://cve.now/CVE-2022-21545.md): Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite (component: Candidate Self Service Registration). (CVSS 5.3, Oracle iRecruitment)
- [CVE-2022-21544](https://cve.now/CVE-2022-21544.md): Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure). (CVSS 7.1, Oracle FLEXCUBE Universal Banking)
- [CVE-2022-21543](https://cve.now/CVE-2022-21543.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mgmt). (CVSS 9.8, Oracle PeopleSoft Enterprise PT PeopleTools)
- [CVE-2022-21542](https://cve.now/CVE-2022-21542.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime). (CVSS 7.4, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2022-21539](https://cve.now/CVE-2022-21539.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 5.0, Oracle MySQL Server)
- [CVE-2022-21538](https://cve.now/CVE-2022-21538.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). (CVSS 3.1, Oracle MySQL Server)
- [CVE-2022-21537](https://cve.now/CVE-2022-21537.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2022-21536](https://cve.now/CVE-2022-21536.md): Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Policy Framework). (CVSS 8.1, Oracle Enterprise Manager Base Platform)
- [CVE-2022-21535](https://cve.now/CVE-2022-21535.md): Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: General/Core Client). (CVSS 2.5, Oracle MySQL Server)
- [CVE-2022-21534](https://cve.now/CVE-2022-21534.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2022-21533](https://cve.now/CVE-2022-21533.md): Vulnerability in the Oracle Solaris product of Oracle Systems (component: SMB Server). (CVSS 5.5, Oracle Solaris Operating System)
- [CVE-2022-21532](https://cve.now/CVE-2022-21532.md): Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator). (CVSS 4.3, Oracle JD Edwards EnterpriseOne Orchestrator)
- [CVE-2022-21531](https://cve.now/CVE-2022-21531.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2022-21530](https://cve.now/CVE-2022-21530.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2022-21529](https://cve.now/CVE-2022-21529.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2022-21528](https://cve.now/CVE-2022-21528.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 5.5, Oracle MySQL Server)
- [CVE-2022-21527](https://cve.now/CVE-2022-21527.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 5.5, Oracle MySQL Server)
- [CVE-2022-21526](https://cve.now/CVE-2022-21526.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2022-21525](https://cve.now/CVE-2022-21525.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2022-21524](https://cve.now/CVE-2022-21524.md): Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). (CVSS 7.6, Oracle Solaris Operating System)
- [CVE-2022-21523](https://cve.now/CVE-2022-21523.md): Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: BI Publisher Security). (CVSS 4.3, Oracle BI Publisher)
- [CVE-2022-21522](https://cve.now/CVE-2022-21522.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). (CVSS 4.4, Oracle MySQL Server)
- [CVE-2022-21521](https://cve.now/CVE-2022-21521.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: XML Publisher). (CVSS 4.9, Oracle PeopleSoft Enterprise PT PeopleTools)
- [CVE-2022-21520](https://cve.now/CVE-2022-21520.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Fluid Core). (CVSS 6.1, Oracle PeopleSoft Enterprise PT PeopleTools)
- [CVE-2022-21519](https://cve.now/CVE-2022-21519.md): Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). (CVSS 5.9, Oracle MySQL Cluster)
- [CVE-2022-21518](https://cve.now/CVE-2022-21518.md): Vulnerability in the Oracle Health Sciences Data Management Workbench product of Oracle Health Sciences Applications (component: User Interf (CVSS 6.5, Oracle Health Sciences Data Management Workbench)
- [CVE-2022-21517](https://cve.now/CVE-2022-21517.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2022-21516](https://cve.now/CVE-2022-21516.md): Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Manager Install). (CVSS 7.3, Oracle Enterprise Manager Base Platform)
- [CVE-2022-21515](https://cve.now/CVE-2022-21515.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2022-21514](https://cve.now/CVE-2022-21514.md): Vulnerability in the Oracle Solaris product of Oracle Systems (component: Remote Administration Daemon). (CVSS 7.5, Oracle Solaris Operating System)
- [CVE-2022-21513](https://cve.now/CVE-2022-21513.md): Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). (CVSS 8.2, Oracle Sun ZFS Storage Appliance Kit (AK) Software)
- [CVE-2022-21512](https://cve.now/CVE-2022-21512.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Integration Broker). (CVSS 4.4, Oracle PeopleSoft Enterprise PT PeopleTools)
- [CVE-2022-21511](https://cve.now/CVE-2022-21511.md): Vulnerability in the Oracle Database - Enterprise Edition Recovery component of Oracle Database Server. (CVSS 7.2, Oracle Database - Enterprise Edition)
- [CVE-2022-21510](https://cve.now/CVE-2022-21510.md): Vulnerability in the Oracle Database - Enterprise Edition Sharding component of Oracle Database Server. (CVSS 8.8, Oracle Database - Enterprise Edition)
- [CVE-2022-21509](https://cve.now/CVE-2022-21509.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 5.5, Oracle MySQL Server)
- [CVE-2022-21508](https://cve.now/CVE-2022-21508.md): Vulnerability in Oracle Essbase (component: Security and Provisioning). (CVSS 5.8, Oracle Hyperion Essbase)
- [CVE-2022-21455](https://cve.now/CVE-2022-21455.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PAM Auth Plugin). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2022-21439](https://cve.now/CVE-2022-21439.md): Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). (CVSS 4.2, Oracle Solaris Operating System)
- [CVE-2022-21432](https://cve.now/CVE-2022-21432.md): Vulnerability in the Oracle Database - Enterprise Edition RDBMS Security component of Oracle Database Server. (CVSS 2.7, Oracle Text)
- [CVE-2022-21429](https://cve.now/CVE-2022-21429.md): Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: Billing (CVSS 8.1, Oracle Communications Billing and Revenue Management)
- [CVE-2022-21428](https://cve.now/CVE-2022-21428.md): Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure). (CVSS 6.7, Oracle FLEXCUBE Universal Banking)
- [CVE-2022-31150](https://cve.now/CVE-2022-31150.md): CRLF injection in request headers (CVSS 5.3, nodejs undici · undici)
- [CVE-2022-31144](https://cve.now/CVE-2022-31144.md): Potential heap overflow in Redis (CVSS 7.0, redis)
- [CVE-2022-34266](https://cve.now/CVE-2022-34266.md): The libtiff-4.0.3-35.amzn2.0.1 package for LibTIFF on Amazon Linux 2 allows attackers to cause a denial of service (application crash), a di (CVSS 5.5)
- [CVE-2022-1924](https://cve.now/CVE-2022-1924.md): DOS / potential heap overwrite in mkv demuxing using lzo decompression. (no CVSS, GStreamer)
- [CVE-2022-1923](https://cve.now/CVE-2022-1923.md): DOS / potential heap overwrite in mkv demuxing using bzip decompression. (no CVSS, GStreamer)
- [CVE-2022-2122](https://cve.now/CVE-2022-2122.md): DOS / potential heap overwrite in qtdemux using zlib decompression. (no CVSS, GStreamer)
- [CVE-2022-1925](https://cve.now/CVE-2022-1925.md): DOS / potential heap overwrite in mkv demuxing using HEADERSTRIP decompression. (no CVSS, GStreamer)
- [CVE-2022-1922](https://cve.now/CVE-2022-1922.md): DOS / potential heap overwrite in mkv demuxing using zlib decompression. (no CVSS, GStreamer)
- [CVE-2022-1920](https://cve.now/CVE-2022-1920.md): Integer overflow in matroskademux element in gst\_matroska\_demux\_add\_wvpk\_header function which allows a heap overwrite while parsing matrosk (no CVSS, GStreamer)
- [CVE-2022-34539](https://cve.now/CVE-2022-34539.md): Digital Watchdog DW MEGApix IP cameras A7.2.2\_20211029 was discovered to contain a command injection vulnerability in the component /admin/c (no CVSS)
- [CVE-2022-34540](https://cve.now/CVE-2022-34540.md): Digital Watchdog DW MEGApix IP cameras A7.2.2\_20211029 was discovered to contain a command injection vulnerability in the component /admin/v (no CVSS)
- [CVE-2022-34538](https://cve.now/CVE-2022-34538.md): Digital Watchdog DW MEGApix IP cameras A7.2.2\_20211029 was discovered to contain a command injection vulnerability in the component /admin/v (no CVSS)
- [CVE-2022-34537](https://cve.now/CVE-2022-34537.md): Digital Watchdog DW MEGApix IP cameras A7.2.2\_20211029 was discovered to contain a cross-site scripting (XSS) vulnerability via the componen (no CVSS)
- [CVE-2022-34536](https://cve.now/CVE-2022-34536.md): Digital Watchdog DW MEGApix IP cameras A7.2.2\_20211029 allows attackers to access the core log file and perform session hijacking via a craf (no CVSS)
- [CVE-2022-34534](https://cve.now/CVE-2022-34534.md): Digital Watchdog DW Spectrum Server 4.2.0.32842 allows attackers to access sensitive infromation via a crafted API call. (no CVSS)
- [CVE-2022-34535](https://cve.now/CVE-2022-34535.md): Digital Watchdog DW MEGApix IP cameras A7.2.2\_20211029 allows unauthenticated attackers to view internal paths and scripts via web files. (no CVSS)
- [CVE-2022-36305](https://cve.now/CVE-2022-36305.md): Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the body function at /web/api/v1/upload/UploadHandle (no CVSS)
- [CVE-2022-36303](https://cve.now/CVE-2022-36303.md): Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the handle\_file\_upload function at /web/api/v1/uploa (no CVSS)
- [CVE-2022-36304](https://cve.now/CVE-2022-36304.md): Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the generate\_response function at /web/api/v1/upload (no CVSS)
- [CVE-2022-34025](https://cve.now/CVE-2022-34025.md): Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the post function at /web/api/v1/upload/UploadHandle (no CVSS)
- [CVE-2022-30570](https://cve.now/CVE-2022-30570.md): TIBCO Data Virtualization Access Control Vulnerability (CVSS 6.5, TIBCO Software TIBCO Data Virtualization)
- [CVE-2022-2394](https://cve.now/CVE-2022-2394.md): Sensitive Parameter Exposure in Puppet Bolt prior to 3.24 (CVSS 4.1, Puppet Bolt)
- [CVE-2022-27373](https://cve.now/CVE-2022-27373.md): Shanghai Feixun Data Communication Technology Co., Ltd router fir302b A2 was discovered to contain a remote command execution (RCE) vulnerab (no CVSS)
- [CVE-2022-34024](https://cve.now/CVE-2022-34024.md): Barangay Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the resident module editing function at (no CVSS)
- [CVE-2022-34023](https://cve.now/CVE-2022-34023.md): Barangay Management System v1.0 was discovered to contain a SQL injection vulnerability via the hidden\_id parameter at /officials/officials. (no CVSS)
- [CVE-2022-22417](https://cve.now/CVE-2022-22417.md): IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Sterling Partner Engagement Manager on Cloud · IBM Ster…)
- [CVE-2022-22416](https://cve.now/CVE-2022-22416.md): IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to server-side request forgery (SSRF). (CVSS 5.4, IBM Sterling Partner Engagement Manager on Cloud · IBM Ster…)
- [CVE-2022-22360](https://cve.now/CVE-2022-22360.md): IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 could allow a remote authenticated attacker to conduct an LDAP injec (CVSS 7.5, IBM Sterling Partner Engagement Manager)
- [CVE-2022-22359](https://cve.now/CVE-2022-22359.md): IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to cross-site request forgery which could allow an att (CVSS 4.3, IBM Sterling Partner Engagement Manager on Cloud · IBM Ster…)
- [CVE-2022-22358](https://cve.now/CVE-2022-22358.md): IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to an XML External Entity Injection (XXE) attack when (CVSS 7.1, IBM Sterling Partner Engagement Manager)
- [CVE-2022-34001](https://cve.now/CVE-2022-34001.md): Unit4 ERP through 7.9 allows XXE via ExecuteServerProcessAsynchronously. (no CVSS)
- [CVE-2022-35912](https://cve.now/CVE-2022-35912.md): In grails-databinding in Grails before 3.3.15, 4.x before 4.1.1, 5.x before 5.1.9, and 5.2.x before 5.2.1 (at least when certain Java 8 conf (no CVSS, org.grails:grails-databinding)
- [CVE-2022-2469](https://cve.now/CVE-2022-2469.md): GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API client (CVSS 3.8, GNU SASL)
- [CVE-2022-27580](https://cve.now/CVE-2022-27580.md): A deserialization vulnerability in a .NET framework class used and not properly checked by Safety Designer all versions up to and including (no CVSS, SICK Safety Designer)
- [CVE-2022-27579](https://cve.now/CVE-2022-27579.md): A deserialization vulnerability in a .NET framework class used and not properly checked by Flexi Soft Designer in all versions up to and inc (no CVSS, SICK Flexi Soft Designer)
- [CVE-2022-27545](https://cve.now/CVE-2022-27545.md): HCL BigFix Web Reports authorized users may perform HTML injection. (CVSS 4.6, HCL Software HCL BigFix)
- [CVE-2022-27544](https://cve.now/CVE-2022-27544.md): HCL BigFix Web Reports authorized users may see sensitive information in clear text (CVSS 5.0, HCL Software HCL BigFix)
- [CVE-2022-35405](https://cve.now/CVE-2022-35405.md): Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (CVSS 9.8, KEV)
- [CVE-2021-32504](https://cve.now/CVE-2021-32504.md): Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance users only. (no CVSS, SICK FTMg)
- [CVE-2022-2193](https://cve.now/CVE-2022-2193.md): Insecure Direct Object Reference vulnerability in HYPR Server before version 6.14.1 allows remote authenticated attackers to add a FIDO2 aut (CVSS 7.5, HYPR Server)
- [CVE-2022-1984](https://cve.now/CVE-2022-1984.md): This issue affects: HYPR Windows WFA versions prior to 7.2; Unsafe Deserialization vulnerability in HYPR Workforce Access (WFA) before versi (CVSS 4.5, HYPR Windows WFA)
- [CVE-2022-2192](https://cve.now/CVE-2022-2192.md): Forced Browsing vulnerability in HYPR Server version 6.10 to 6.15.1 allows remote attackers with a valid one-time recovery token to elevate (CVSS 7.5, HYPR Server)
- [CVE-2022-2453](https://cve.now/CVE-2022-2453.md): Use After Free in gpac/gpac (CVSS 7.8, gpac/gpac)
- [CVE-2022-2468](https://cve.now/CVE-2022-2468.md): SourceCodester Garage Management System editbrand.php sql injection (CVSS 6.3, SourceCodester Garage Management System)
- [CVE-2022-2467](https://cve.now/CVE-2022-2467.md): SourceCodester Garage Management System login.php sql injection (CVSS 7.3, SourceCodester Garage Management System)
- [CVE-2022-30532](https://cve.now/CVE-2022-30532.md): In affected versions of Octopus Deploy, there is no logging of changes to artifacts within Octopus Deploy. (no CVSS, Octopus Deploy Octopus Server)
- [CVE-2022-2030](https://cve.now/CVE-2022-2030.md): A directory traversal vulnerability caused by specific character sequences within an improperly sanitized URL was identified in some CGI pro (CVSS 6.5, Zyxel USG FLEX 100(W) firmware · Zyxel USG FLEX 200 firm… +7)
- [CVE-2022-30526](https://cve.now/CVE-2022-30526.md): A privilege escalation vulnerability was identified in the CLI command of Zyxel USG FLEX 100(W) firmware versions 4.50 through 5.30, USG FLE (CVSS 7.8, Zyxel USG FLEX 100(W) firmware · Zyxel USG FLEX 200 firm… +7)
- [CVE-2022-1921](https://cve.now/CVE-2022-1921.md): Integer overflow in avidemux element in gst\_avi\_demux\_invert function which allows a heap overwrite while parsing avi files. (no CVSS, GStreamer)
- [CVE-2022-21540](https://cve.now/CVE-2022-21540.md): Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). (CVSS 5.3, Oracle Java SE JDK and JRE)
- [CVE-2022-21541](https://cve.now/CVE-2022-21541.md): Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). (CVSS 5.9, Oracle Java SE JDK and JRE)
- [CVE-2022-21549](https://cve.now/CVE-2022-21549.md): Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). (CVSS 5.3, Oracle Java SE JDK and JRE)
- [CVE-2022-24082](https://cve.now/CVE-2022-24082.md): If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filter (CVSS 9.8, Pegasystems Pega Infinity)
- [CVE-2022-2454](https://cve.now/CVE-2022-2454.md): Integer Overflow or Wraparound in gpac/gpac (CVSS 7.8, gpac/gpac)
- [CVE-2022-2476](https://cve.now/CVE-2022-2476.md): A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ===================== (no CVSS, Wavpack)
- [CVE-2022-34169](https://cve.now/CVE-2022-34169.md): Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets (CVSS 7.5, Apache Software Foundation Apache Xalan-J · xalan:xalan)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-07-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.