CVEs published July 20, 2022
96 CVEs were published on July 20, 2022: 6 critical, 23 high. 1 is now in CISA KEV.
- Published
- 96
- Critical
- 6
- High
- 23
- Medium
- 33
- Low
- 3
- Unrated
- 31
- Now in CISA KEV
- 1
- Fix available
- 28
Most affected products
- Juniper Networks Junos OS
- 14
- MiCODUS MV720
- 5
- Dell PowerStore
- 4
- HINET HiCOS’ client-side citizen digital certificate
- 4
- Mitsubishi Electric GENESIS64 · Mitsubishi Electric Icon… +3
- 4
- Data Systems Consulting Co. BPM
- 3
- IBM QRadar SIEM
- 3
- WAVLINK WN535K2 · WAVLINK WN535K3
- 3
- Atlassian Bamboo Server · Atlassian Bamboo Data Center +13
- 2
- JetBrains TeamCity
- 2
Critical 6
- CVE-2022-26138The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users gAtlassian Questions For Confluence
- CVE-2022-26136A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third pAtlassian Bamboo Server · Atlassian Bamboo Data Center +13
- CVE-2022-33318Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics DigiMitsubishi Electric GENESIS64 · Mitsubishi Electric Icon… +5
- CVE-2022-2107ICSA-22-200-01 MiCODUS MV720 GPS tracker Use of Hard-coded CredentialsMiCODUS MV720
- CVE-2022-2141ICSA-22-200-01 MiCODUS MV720 GPS tracker Improper AuthenticationMiCODUS MV720
- CVE-2022-32456Data Systems Consulting Co., Ltd. BPM - SQL InjectionData Systems Consulting Co. BPM
High 23
- CVE-2022-31234Dell EMC PowerStore, contain(s) an Improper Restriction of Excessive Authentication Attempts Vulnerability in PowerStore Manager GUI.Dell PowerStore
- CVE-2022-26137A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked wAtlassian Bamboo Server · Atlassian Bamboo Data Center +13
- CVE-2022-33319Out-of-bounds Read vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GMitsubishi Electric GENESIS64 · Mitsubishi Electric Icon… +5
- CVE-2022-33320Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics DigiMitsubishi Electric GENESIS64 · Mitsubishi Electric Icon… +3
- CVE-2022-33315Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics DigiMitsubishi Electric GENESIS64 · Mitsubishi Electric Icon… +3
- CVE-2022-33317Inclusion of Functionality from Untrusted Control Sphere vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, MitsubishMitsubishi Electric GENESIS64 · Mitsubishi Electric Icon… +3
- CVE-2022-33316Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics DigiMitsubishi Electric GENESIS64 · Mitsubishi Electric Icon… +3
- CVE-2022-29834Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mitsubishi Electric GENESIS64 versions 10.97Mitsubishi Electric GENESIS64 · Mitsubishi Electric Icon… +2
- CVE-2022-2199ICSA-22-200-01 MiCODUS MV720 GPS tracker Cross-site ScriptingMiCODUS MV720
- CVE-2022-34150ICSA-22-200-01 MiCODUS MV720 GPS tracker Authorization Bypass Through User-Controlled KeyMiCODUS MV720
- CVE-2022-22221Junos OS: SRX and EX Series: Local privilege escalation flaw in "download" functionalityJuniper Networks Junos OS
- CVE-2022-22212Junos OS Evolved: A high rate of specific hostbound traffic will cause unexpected hostbound traffic delays or dropsJuniper Networks Junos OS Evolved
- CVE-2022-22209Junos OS: RIB and PFEs can get out of sync due to a memory leak caused by interface flaps or route churnJuniper Networks Junos OS
- CVE-2022-22207Junos OS: MX Series with MPC11: In a GNF / node slicing scenario gathering AF interface statistics can lead to a kernel crashJuniper Networks Junos OS
- CVE-2022-22206Junos OS: SRX series: The PFE will crash when specific traffic is scanned by Enhanced Web Filtering safe-searchJuniper Networks Junos OS
- CVE-2022-22205Junos OS: SRX Series: An FPC memory leak can occur in an APBR scenarioJuniper Networks Junos OS
- CVE-2022-2488WAVLINK WN535K2/WN535K3 touchlist_sync.cgi os command injectionWAVLINK WN535K2 · WAVLINK WN535K3
- CVE-2022-2487WAVLINK WN535K2/WN535K3 nightled.cgi os command injectionWAVLINK WN535K2 · WAVLINK WN535K3
- CVE-2022-2486WAVLINK WN535K2/WN535K3 os command injectionWAVLINK WN535K2 · WAVLINK WN535K3
- CVE-2022-31250keylime %post scriplet allows for privilege escalation from keylime user to rootopenSUSE Tumbleweed
- CVE-2022-32958TEAMPLUS TECHNOLOGY INC. Teamplus Pro - Allocation of Resources Without Limits or ThrottlingTEAMPLUS TECHNOLOGY Teamplus Pro
- CVE-2022-32458Data Systems Consulting Co., Ltd. BPM - XML External Entity (XXE) InjectionData Systems Consulting Co. BPM
- CVE-2021-46828In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connection
Medium, low and unrated 67
- CVE-2022-31151Uncleared cookies on cross-host/cross-origin redirect in undicinodejs undici · undici
- CVE-2022-31146Use After Free in Wasmtimebytecodealliance wasmtime · wasmtime +1
- CVE-2022-34367Dell EMC Data Protection Central versions 19.1, 19.2, 19.3, 19.4, 19.5, 19.6, contain(s) a Cross-Site Request Forgery Vulnerability.Dell Data Protection Central
- CVE-2022-33923Dell PowerStore, versions prior to 3.0.0.0, contains an OS Command Injection vulnerability in PowerStore T environment.Dell PowerStore
- CVE-2022-32498Dell EMC PowerStore, Versions prior to v3.0.0.0 contain a DLL Hijacking vulnerability in PSTCLI.Dell PowerStore
- CVE-2022-22555Dell EMC PowerStore, contains an OS command injection Vulnerability.Dell PowerStore
- CVE-2022-34590Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in /HMS/admin.php.
- CVE-2022-34586itsourcecode Advanced School Management System v1.0 is vulnerable to SQL Injection via the grade parameter at /school/view/student_grade_wis
- CVE-2022-34588itsourcecode Advanced School Management System v1.0 is vulnerable to SQL Injection via the grade parameter at /school/view/timetable_insert_
- CVE-2020-21406An issue was discovered in RK Smart TV Box MAX and V88 SmartTV box that allows attackers to cause a denial of service via the switchNextDisp
- CVE-2020-21405An issue was discovered in H96 Smart TV Box H96 Pro Plus allows attackers to corrupt files via calls to the saveDeepColorAttr service.unk
- CVE-2022-29923WordPress Quick Restaurant Reservations plugin <= 1.4.1 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilityThingsForRestaurants Quick Restaurant Reservations
- CVE-2022-29454WordPress Better Messages plugin <= 1.9.9.148 - Cross-Site Request Forgery (CSRF) vulnerabilityWordPlus Better Messages
- CVE-2021-36849WordPress Social Media Share Buttons plugin <= 3.8.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityRené Hermenau Social Media Share Buttons | MashShare
- CVE-2022-35569Blogifier v3.0 was discovered to contain an arbitrary file upload vulnerability at /api/storage/upload/PostImage.
- CVE-2022-22424IBM QRadar SIEM 7.3, 7.4, and 7.5 could allow a local user to obtain sensitive information from the TLS key file due to incorrect file permiIBM QRadar SIEM
- CVE-2021-38936IBM QRadar SIEM 7.3, 7.4, and 7.5 could disclose highly sensitive information to a privileged user.IBM QRadar SIEM
- CVE-2021-29755IBM QRadar SIEM 7.3, 7.4, and 7.5 does not preform proper certificate validation for some inter-host communications.IBM QRadar SIEM
- CVE-2022-34046An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via view-source:http://IP_A
- CVE-2022-34049An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows unauthenticated attackers to download log files and configuration dat
- CVE-2022-34047An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows attackers to obtain usernames and passwords via view-source:http://IP
- CVE-2022-34048Wavlink WN533A8 M33A8.V5030.190716 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the login_page paramet
- CVE-2022-34045Wavlink WN530HG4 M30HG4.V5030.191116 was discovered to contain a hardcoded encryption/decryption key for its configuration files at /etc_ro/
- CVE-2022-1766Anchore Enterprise anchorectl version 0.1.4 improperly stored credentials when generating a Software Bill of Materials.Anchore Enterprise · AnchoreCTL
- CVE-2022-34042Barangay Management System v1.0 was discovered to contain a SQL injection vulnerability via the hidden_id parameter at /pages/household/hous
- CVE-2022-2179ICSA-22-188-01 Rockwell Automation MicroLogix Improper Restriction of Rendered UI Layers or FramesRockwell Automation MicroLogix
- CVE-2022-1264Inductive Automation IgnitionInductive Automation Ignition
- CVE-2022-33944ICSA-22-200-01 MiCODUS MV720 GPS tracker Authorization Bypass Through User-Controlled KeyMiCODUS MV720
- CVE-2022-22217Junos OS: QFX10K Series: Denial of Service (DoS) upon receipt of crafted MLD packets on multi-homing ESI in VXLANJuniper Networks Junos OS
- CVE-2022-22216Junos OS: PTX Series and QFX10000 Series: 'Etherleak' memory disclosure in Ethernet padding dataJuniper Networks Junos OS
- CVE-2022-22215Junos OS and Junos OS Evolved: /var/run/<pid>.env files are potentially not deleted during termination of a gRPC connection causing inode exhaustionJuniper Networks Junos OS
- CVE-2022-22214Junos OS and Junos OS Evolved: In an MPLS scenario upon receipt of a specific IPv6 packet an FPC will crashJuniper Networks Junos OS
- CVE-2022-22213Junos OS and Junos OS Evolved: Denial of Service (DoS) vulnerability in RPD upon receipt of specific BGP updateJuniper Networks Junos OS
- CVE-2022-22210Junos OS: QFX5000 Series and MX Series: An l2alm crash leading to an FPC crash can be observed in VxLAN scenarioJuniper Networks Junos OS
- CVE-2022-22204Junos OS: MX Series and SRX Series: When receiving a specific SIP packets stale call table entries are created which eventually leads to a DoS for all SIP trafficJuniper Networks Junos OS
- CVE-2022-22203Junos OS: EX4600 Series and QFX5000 Series: Receipt of specific traffic will lead to an fxpc process crash followed by an FPC rebootJuniper Networks Junos OS
- CVE-2022-22202Junos OS: PTX Series: FPCs may restart unexpectedly upon receipt of specific MPLS packets with certain multi-unit interface configurationsJuniper Networks Junos OS
- CVE-2022-34610H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the URL /ihomers/app.
- CVE-2022-34609H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the INTF parameter at /doping.asp.
- CVE-2022-34607H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the HOST parameter at /doping.asp.
- CVE-2022-34608H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the ajaxmsg parameter at /AJAX/ajaxget.
- CVE-2022-34605H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the HOST parameter at /dotrace.asp.
- CVE-2022-34606H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the EditvsList parameter at /dotrace.asp.
- CVE-2022-34604H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the INTF parameter at /dotrace.asp.
- CVE-2022-34602H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the ipqos_lanip_editlist interface at /goform/aspForm.
- CVE-2022-34603H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the DelDNSHnList interface at /goform/aspForm.
- CVE-2022-34601H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the Delstlist interface at /goform/aspForm.
- CVE-2022-34600H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the EditSTList interface at /goform/aspForm.
- CVE-2022-34599H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the EdittriggerList interface at /goform/aspForm.
- CVE-2021-31858DotNetNuke (DNN) 9.9.1 CMS is vulnerable to a Stored Cross-Site Scripting vulnerability in the user profile biography section which allows r
- CVE-2022-24660The debug interface of Goldshell ASIC Miners v2.2.1 and below was discovered to be exposed publicly on the web interface, allowing attackers
- CVE-2022-24659Goldshell ASIC Miners v2.2.1 and below was discovered to contain a path traversal vulnerability which allows unauthenticated attackers to re
- CVE-2022-24657Goldshell ASIC Miners v2.1.x was discovered to contain hardcoded credentials which allow attackers to remotely connect via the SSH protocol
- CVE-2022-36322In JetBrains TeamCity before 2022.04.2 build parameter injection was possibleJetBrains TeamCity
- CVE-2022-36321In JetBrains TeamCity before 2022.04.2 the private SSH key could be written to the build log in some casesJetBrains TeamCity
- CVE-2022-2492SourceCodester Library Management System index.php sql injectionSourceCodester Library Management System
- CVE-2022-2491SourceCodester Library Management System lab.php sql injectionSourceCodester Library Management System
- CVE-2022-2490SourceCodester Simple E-Learning System search.php sql injectionSourceCodester Simple E-Learning System
- CVE-2022-2489SourceCodester Simple E-Learning System classRoom.php sql injectionSourceCodester Simple E-Learning System
- CVE-2022-34866Passage Drive versions v1.4.0 to v1.5.1.0 and Passage Drive for Box version v1.0.0 contain an insufficient data verification vulnerability fYokogawa Rental & Lease Passage Drive
- CVE-2022-33967squashfs filesystem implementation of U-Boot versions from v2020.10-rc2 to v2022.07-rc5 contains a heap-based buffer overflow vulnerability DENX Software Engineering U-Boot
- CVE-2022-32962HiCOS’ client-side citizen digital certificate - Double FreeHINET HiCOS’ client-side citizen digital certificate
- CVE-2022-32961HiCOS’ client-side citizen digital certificate - Stack Buffer OverflowHINET HiCOS’ client-side citizen digital certificate
- CVE-2022-32960HiCOS’ client-side citizen digital certificate - Stack Buffer OverflowHINET HiCOS’ client-side citizen digital certificate
- CVE-2022-32959HiCOS’ client-side citizen digital certificate - Stack Buffer OverflowHINET HiCOS’ client-side citizen digital certificate
- CVE-2022-32457Data Systems Consulting Co., Ltd. BPM - Blind Server-Side Request Forgery (SSRF)Data Systems Consulting Co. BPM
- CVE-2022-31160jQuery UI contains potential XSS vulnerability when refreshing a checkboxradio with an HTML-like initial text labeljquery-ui · org.webjars.npm:jquery-ui +2