# CVEs published 2022-07-20

96 CVEs were published on July 20, 2022: 6 critical, 23 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2022-31151](https://cve.now/CVE-2022-31151.md): Uncleared cookies on cross-host/cross-origin redirect in undici (CVSS 3.7, nodejs undici · undici)
- [CVE-2022-31146](https://cve.now/CVE-2022-31146.md): Use After Free in Wasmtime (CVSS 6.4, bytecodealliance wasmtime · wasmtime +1)
- [CVE-2022-34367](https://cve.now/CVE-2022-34367.md): Dell EMC Data Protection Central versions 19.1, 19.2, 19.3, 19.4, 19.5, 19.6, contain(s) a Cross-Site Request Forgery Vulnerability. (CVSS 5.4, Dell Data Protection Central)
- [CVE-2022-33923](https://cve.now/CVE-2022-33923.md): Dell PowerStore, versions prior to 3.0.0.0, contains an OS Command Injection vulnerability in PowerStore T environment. (CVSS 6.4, Dell PowerStore)
- [CVE-2022-32498](https://cve.now/CVE-2022-32498.md): Dell EMC PowerStore, Versions prior to v3.0.0.0 contain a DLL Hijacking vulnerability in PSTCLI. (CVSS 5.5, Dell PowerStore)
- [CVE-2022-31234](https://cve.now/CVE-2022-31234.md): Dell EMC PowerStore, contain(s) an Improper Restriction of Excessive Authentication Attempts Vulnerability in PowerStore Manager GUI. (CVSS 8.1, Dell PowerStore)
- [CVE-2022-22555](https://cve.now/CVE-2022-22555.md): Dell EMC PowerStore, contains an OS command injection Vulnerability. (CVSS 6.0, Dell PowerStore)
- [CVE-2022-34590](https://cve.now/CVE-2022-34590.md): Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in /HMS/admin.php. (no CVSS)
- [CVE-2022-34586](https://cve.now/CVE-2022-34586.md): itsourcecode Advanced School Management System v1.0 is vulnerable to SQL Injection via the grade parameter at /school/view/student\_grade\_wis (no CVSS)
- [CVE-2022-34588](https://cve.now/CVE-2022-34588.md): itsourcecode Advanced School Management System v1.0 is vulnerable to SQL Injection via the grade parameter at /school/view/timetable\_insert\_ (no CVSS)
- [CVE-2020-21406](https://cve.now/CVE-2020-21406.md): An issue was discovered in RK Smart TV Box MAX and V88 SmartTV box that allows attackers to cause a denial of service via the switchNextDisp (no CVSS)
- [CVE-2020-21405](https://cve.now/CVE-2020-21405.md): An issue was discovered in H96 Smart TV Box H96 Pro Plus allows attackers to corrupt files via calls to the saveDeepColorAttr service.unk (no CVSS)
- [CVE-2022-29923](https://cve.now/CVE-2022-29923.md): WordPress Quick Restaurant Reservations plugin \<= 1.4.1 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability (CVSS 5.9, ThingsForRestaurants Quick Restaurant Reservations)
- [CVE-2022-29454](https://cve.now/CVE-2022-29454.md): WordPress Better Messages plugin \<= 1.9.9.148 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 3.1, WordPlus Better Messages)
- [CVE-2021-36849](https://cve.now/CVE-2021-36849.md): WordPress Social Media Share Buttons plugin \<= 3.8.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 3.4, René Hermenau Social Media Share Buttons | MashShare)
- [CVE-2022-35569](https://cve.now/CVE-2022-35569.md): Blogifier v3.0 was discovered to contain an arbitrary file upload vulnerability at /api/storage/upload/PostImage. (no CVSS)
- [CVE-2022-22424](https://cve.now/CVE-2022-22424.md): IBM QRadar SIEM 7.3, 7.4, and 7.5 could allow a local user to obtain sensitive information from the TLS key file due to incorrect file permi (CVSS 5.1, IBM QRadar SIEM)
- [CVE-2021-38936](https://cve.now/CVE-2021-38936.md): IBM QRadar SIEM 7.3, 7.4, and 7.5 could disclose highly sensitive information to a privileged user. (CVSS 4.9, IBM QRadar SIEM)
- [CVE-2021-29755](https://cve.now/CVE-2021-29755.md): IBM QRadar SIEM 7.3, 7.4, and 7.5 does not preform proper certificate validation for some inter-host communications. (CVSS 5.9, IBM QRadar SIEM)
- [CVE-2022-26138](https://cve.now/CVE-2022-26138.md): The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users g (CVSS 9.8, KEV, Atlassian Questions For Confluence)
- [CVE-2022-26137](https://cve.now/CVE-2022-26137.md): A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked w (CVSS 8.8, Atlassian Bamboo Server · Atlassian Bamboo Data Center +13)
- [CVE-2022-26136](https://cve.now/CVE-2022-26136.md): A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third p (CVSS 9.8, Atlassian Bamboo Server · Atlassian Bamboo Data Center +13)
- [CVE-2022-33319](https://cve.now/CVE-2022-33319.md): Out-of-bounds Read vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions G (CVSS 8.2, Mitsubishi Electric GENESIS64 · Mitsubishi Electric Icon… +5)
- [CVE-2022-33318](https://cve.now/CVE-2022-33318.md): Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digi (CVSS 9.8, Mitsubishi Electric GENESIS64 · Mitsubishi Electric Icon… +5)
- [CVE-2022-33320](https://cve.now/CVE-2022-33320.md): Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digi (CVSS 7.8, Mitsubishi Electric GENESIS64 · Mitsubishi Electric Icon… +3)
- [CVE-2022-33315](https://cve.now/CVE-2022-33315.md): Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digi (CVSS 7.8, Mitsubishi Electric GENESIS64 · Mitsubishi Electric Icon… +3)
- [CVE-2022-33317](https://cve.now/CVE-2022-33317.md): Inclusion of Functionality from Untrusted Control Sphere vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubish (CVSS 7.8, Mitsubishi Electric GENESIS64 · Mitsubishi Electric Icon… +3)
- [CVE-2022-33316](https://cve.now/CVE-2022-33316.md): Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digi (CVSS 7.8, Mitsubishi Electric GENESIS64 · Mitsubishi Electric Icon… +3)
- [CVE-2022-34046](https://cve.now/CVE-2022-34046.md): An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via view-source:http://IP\_A (no CVSS)
- [CVE-2022-34049](https://cve.now/CVE-2022-34049.md): An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows unauthenticated attackers to download log files and configuration dat (no CVSS)
- [CVE-2022-34047](https://cve.now/CVE-2022-34047.md): An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows attackers to obtain usernames and passwords via view-source:http://IP (no CVSS)
- [CVE-2022-34048](https://cve.now/CVE-2022-34048.md): Wavlink WN533A8 M33A8.V5030.190716 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the login\_page paramet (no CVSS)
- [CVE-2022-34045](https://cve.now/CVE-2022-34045.md): Wavlink WN530HG4 M30HG4.V5030.191116 was discovered to contain a hardcoded encryption/decryption key for its configuration files at /etc\_ro/ (no CVSS)
- [CVE-2022-29834](https://cve.now/CVE-2022-29834.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 (CVSS 7.5, Mitsubishi Electric GENESIS64 · Mitsubishi Electric Icon… +2)
- [CVE-2022-1766](https://cve.now/CVE-2022-1766.md): Anchore Enterprise anchorectl version 0.1.4 improperly stored credentials when generating a Software Bill of Materials. (no CVSS, Anchore Enterprise · AnchoreCTL)
- [CVE-2022-34042](https://cve.now/CVE-2022-34042.md): Barangay Management System v1.0 was discovered to contain a SQL injection vulnerability via the hidden\_id parameter at /pages/household/hous (no CVSS)
- [CVE-2022-2179](https://cve.now/CVE-2022-2179.md): ICSA-22-188-01 Rockwell Automation MicroLogix Improper Restriction of Rendered UI Layers or Frames (CVSS 6.5, Rockwell Automation MicroLogix)
- [CVE-2022-1264](https://cve.now/CVE-2022-1264.md): Inductive Automation Ignition (CVSS 6.8, Inductive Automation Ignition)
- [CVE-2022-2107](https://cve.now/CVE-2022-2107.md): ICSA-22-200-01 MiCODUS MV720 GPS tracker Use of Hard-coded Credentials (CVSS 9.8, MiCODUS MV720)
- [CVE-2022-33944](https://cve.now/CVE-2022-33944.md): ICSA-22-200-01 MiCODUS MV720 GPS tracker Authorization Bypass Through User-Controlled Key (CVSS 6.5, MiCODUS MV720)
- [CVE-2022-2141](https://cve.now/CVE-2022-2141.md): ICSA-22-200-01 MiCODUS MV720 GPS tracker Improper Authentication (CVSS 9.8, MiCODUS MV720)
- [CVE-2022-2199](https://cve.now/CVE-2022-2199.md): ICSA-22-200-01 MiCODUS MV720 GPS tracker Cross-site Scripting (CVSS 7.5, MiCODUS MV720)
- [CVE-2022-34150](https://cve.now/CVE-2022-34150.md): ICSA-22-200-01 MiCODUS MV720 GPS tracker Authorization Bypass Through User-Controlled Key (CVSS 7.1, MiCODUS MV720)
- [CVE-2022-22221](https://cve.now/CVE-2022-22221.md): Junos OS: SRX and EX Series: Local privilege escalation flaw in "download" functionality (CVSS 7.8, Juniper Networks Junos OS)
- [CVE-2022-22217](https://cve.now/CVE-2022-22217.md): Junos OS: QFX10K Series: Denial of Service (DoS) upon receipt of crafted MLD packets on multi-homing ESI in VXLAN (CVSS 6.1, Juniper Networks Junos OS)
- [CVE-2022-22216](https://cve.now/CVE-2022-22216.md): Junos OS: PTX Series and QFX10000 Series: 'Etherleak' memory disclosure in Ethernet padding data (CVSS 4.3, Juniper Networks Junos OS)
- [CVE-2022-22215](https://cve.now/CVE-2022-22215.md): Junos OS and Junos OS Evolved: /var/run/\<pid\>.env files are potentially not deleted during termination of a gRPC connection causing inode exhaustion (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2022-22214](https://cve.now/CVE-2022-22214.md): Junos OS and Junos OS Evolved: In an MPLS scenario upon receipt of a specific IPv6 packet an FPC will crash (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2022-22213](https://cve.now/CVE-2022-22213.md): Junos OS and Junos OS Evolved: Denial of Service (DoS) vulnerability in RPD upon receipt of specific BGP update (CVSS 5.9, Juniper Networks Junos OS)
- [CVE-2022-22212](https://cve.now/CVE-2022-22212.md): Junos OS Evolved: A high rate of specific hostbound traffic will cause unexpected hostbound traffic delays or drops (CVSS 7.5, Juniper Networks Junos OS Evolved)
- [CVE-2022-22210](https://cve.now/CVE-2022-22210.md): Junos OS: QFX5000 Series and MX Series: An l2alm crash leading to an FPC crash can be observed in VxLAN scenario (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2022-22209](https://cve.now/CVE-2022-22209.md): Junos OS: RIB and PFEs can get out of sync due to a memory leak caused by interface flaps or route churn (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2022-22207](https://cve.now/CVE-2022-22207.md): Junos OS: MX Series with MPC11: In a GNF / node slicing scenario gathering AF interface statistics can lead to a kernel crash (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2022-22206](https://cve.now/CVE-2022-22206.md): Junos OS: SRX series: The PFE will crash when specific traffic is scanned by Enhanced Web Filtering safe-search (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2022-22205](https://cve.now/CVE-2022-22205.md): Junos OS: SRX Series: An FPC memory leak can occur in an APBR scenario (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2022-22204](https://cve.now/CVE-2022-22204.md): Junos OS: MX Series and SRX Series: When receiving a specific SIP packets stale call table entries are created which eventually leads to a DoS for all SIP traffic (CVSS 5.3, Juniper Networks Junos OS)
- [CVE-2022-22203](https://cve.now/CVE-2022-22203.md): Junos OS: EX4600 Series and QFX5000 Series: Receipt of specific traffic will lead to an fxpc process crash followed by an FPC reboot (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2022-22202](https://cve.now/CVE-2022-22202.md): Junos OS: PTX Series: FPCs may restart unexpectedly upon receipt of specific MPLS packets with certain multi-unit interface configurations (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2022-34610](https://cve.now/CVE-2022-34610.md): H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the URL /ihomers/app. (no CVSS)
- [CVE-2022-34609](https://cve.now/CVE-2022-34609.md): H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the INTF parameter at /doping.asp. (no CVSS)
- [CVE-2022-34607](https://cve.now/CVE-2022-34607.md): H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the HOST parameter at /doping.asp. (no CVSS)
- [CVE-2022-34608](https://cve.now/CVE-2022-34608.md): H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the ajaxmsg parameter at /AJAX/ajaxget. (no CVSS)
- [CVE-2022-34605](https://cve.now/CVE-2022-34605.md): H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the HOST parameter at /dotrace.asp. (no CVSS)
- [CVE-2022-34606](https://cve.now/CVE-2022-34606.md): H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the EditvsList parameter at /dotrace.asp. (no CVSS)
- [CVE-2022-34604](https://cve.now/CVE-2022-34604.md): H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the INTF parameter at /dotrace.asp. (no CVSS)
- [CVE-2022-34602](https://cve.now/CVE-2022-34602.md): H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the ipqos\_lanip\_editlist interface at /goform/aspForm. (no CVSS)
- [CVE-2022-34603](https://cve.now/CVE-2022-34603.md): H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the DelDNSHnList interface at /goform/aspForm. (no CVSS)
- [CVE-2022-34601](https://cve.now/CVE-2022-34601.md): H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the Delstlist interface at /goform/aspForm. (no CVSS)
- [CVE-2022-34600](https://cve.now/CVE-2022-34600.md): H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the EditSTList interface at /goform/aspForm. (no CVSS)
- [CVE-2022-34599](https://cve.now/CVE-2022-34599.md): H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the EdittriggerList interface at /goform/aspForm. (no CVSS)
- [CVE-2021-31858](https://cve.now/CVE-2021-31858.md): DotNetNuke (DNN) 9.9.1 CMS is vulnerable to a Stored Cross-Site Scripting vulnerability in the user profile biography section which allows r (no CVSS)
- [CVE-2022-24660](https://cve.now/CVE-2022-24660.md): The debug interface of Goldshell ASIC Miners v2.2.1 and below was discovered to be exposed publicly on the web interface, allowing attackers (no CVSS)
- [CVE-2022-24659](https://cve.now/CVE-2022-24659.md): Goldshell ASIC Miners v2.2.1 and below was discovered to contain a path traversal vulnerability which allows unauthenticated attackers to re (no CVSS)
- [CVE-2022-24657](https://cve.now/CVE-2022-24657.md): Goldshell ASIC Miners v2.1.x was discovered to contain hardcoded credentials which allow attackers to remotely connect via the SSH protocol (no CVSS)
- [CVE-2022-36322](https://cve.now/CVE-2022-36322.md): In JetBrains TeamCity before 2022.04.2 build parameter injection was possible (CVSS 5.4, JetBrains TeamCity)
- [CVE-2022-36321](https://cve.now/CVE-2022-36321.md): In JetBrains TeamCity before 2022.04.2 the private SSH key could be written to the build log in some cases (CVSS 4.1, JetBrains TeamCity)
- [CVE-2022-2492](https://cve.now/CVE-2022-2492.md): SourceCodester Library Management System index.php sql injection (CVSS 6.3, SourceCodester Library Management System)
- [CVE-2022-2491](https://cve.now/CVE-2022-2491.md): SourceCodester Library Management System lab.php sql injection (CVSS 6.3, SourceCodester Library Management System)
- [CVE-2022-2490](https://cve.now/CVE-2022-2490.md): SourceCodester Simple E-Learning System search.php sql injection (CVSS 6.3, SourceCodester Simple E-Learning System)
- [CVE-2022-2489](https://cve.now/CVE-2022-2489.md): SourceCodester Simple E-Learning System classRoom.php sql injection (CVSS 6.3, SourceCodester Simple E-Learning System)
- [CVE-2022-2488](https://cve.now/CVE-2022-2488.md): WAVLINK WN535K2/WN535K3 touchlist\_sync.cgi os command injection (CVSS 8.0, WAVLINK WN535K2 · WAVLINK WN535K3)
- [CVE-2022-2487](https://cve.now/CVE-2022-2487.md): WAVLINK WN535K2/WN535K3 nightled.cgi os command injection (CVSS 8.0, WAVLINK WN535K2 · WAVLINK WN535K3)
- [CVE-2022-2486](https://cve.now/CVE-2022-2486.md): WAVLINK WN535K2/WN535K3 os command injection (CVSS 8.0, WAVLINK WN535K2 · WAVLINK WN535K3)
- [CVE-2022-31250](https://cve.now/CVE-2022-31250.md): keylime %post scriplet allows for privilege escalation from keylime user to root (CVSS 7.1, openSUSE Tumbleweed)
- [CVE-2022-34866](https://cve.now/CVE-2022-34866.md): Passage Drive versions v1.4.0 to v1.5.1.0 and Passage Drive for Box version v1.0.0 contain an insufficient data verification vulnerability f (no CVSS, Yokogawa Rental & Lease Passage Drive)
- [CVE-2022-33967](https://cve.now/CVE-2022-33967.md): squashfs filesystem implementation of U-Boot versions from v2020.10-rc2 to v2022.07-rc5 contains a heap-based buffer overflow vulnerability (no CVSS, DENX Software Engineering U-Boot)
- [CVE-2022-32962](https://cve.now/CVE-2022-32962.md): HiCOS’ client-side citizen digital certificate - Double Free (CVSS 6.8, HINET HiCOS’ client-side citizen digital certificate)
- [CVE-2022-32961](https://cve.now/CVE-2022-32961.md): HiCOS’ client-side citizen digital certificate - Stack Buffer Overflow (CVSS 6.8, HINET HiCOS’ client-side citizen digital certificate)
- [CVE-2022-32960](https://cve.now/CVE-2022-32960.md): HiCOS’ client-side citizen digital certificate - Stack Buffer Overflow (CVSS 6.8, HINET HiCOS’ client-side citizen digital certificate)
- [CVE-2022-32959](https://cve.now/CVE-2022-32959.md): HiCOS’ client-side citizen digital certificate - Stack Buffer Overflow (CVSS 6.8, HINET HiCOS’ client-side citizen digital certificate)
- [CVE-2022-32958](https://cve.now/CVE-2022-32958.md): TEAMPLUS TECHNOLOGY INC. Teamplus Pro - Allocation of Resources Without Limits or Throttling (CVSS 7.7, TEAMPLUS TECHNOLOGY Teamplus Pro)
- [CVE-2022-32458](https://cve.now/CVE-2022-32458.md): Data Systems Consulting Co., Ltd. BPM - XML External Entity (XXE) Injection (CVSS 7.5, Data Systems Consulting Co. BPM)
- [CVE-2022-32457](https://cve.now/CVE-2022-32457.md): Data Systems Consulting Co., Ltd. BPM - Blind Server-Side Request Forgery (SSRF) (CVSS 5.3, Data Systems Consulting Co. BPM)
- [CVE-2022-32456](https://cve.now/CVE-2022-32456.md): Data Systems Consulting Co., Ltd. BPM - SQL Injection (CVSS 9.8, Data Systems Consulting Co. BPM)
- [CVE-2021-46828](https://cve.now/CVE-2021-46828.md): In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connection (CVSS 7.5)
- [CVE-2022-31160](https://cve.now/CVE-2022-31160.md): jQuery UI contains potential XSS vulnerability when refreshing a checkboxradio with an HTML-like initial text label (CVSS 6.1, jquery-ui · org.webjars.npm:jquery-ui +2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-07-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.