CVEs published July 22, 2022
72 CVEs were published on July 22, 2022: 3 critical, 8 high. 1 is now in CISA KEV.
- Published
- 72
- Critical
- 3
- High
- 8
- Medium
- 23
- Low
- 0
- Unrated
- 38
- Now in CISA KEV
- 1
- Fix available
- 45
Most affected products
- Google Chrome
- 21
- Advantech iView iView
- 7
- Itech Movie Portal Script
- 5
- io.dataease:dataease-plugin-common
- 4
- All F-Secure and WithSecure Endpoint Protection products fo…
- 2
- Hallo Welt! BlueSpice
- 2
- microweber/microweber
- 2
- openemr/openemr
- 2
- Social Share Buttons by Supsystic
- 2
- wpWax Team
- 2
Critical 3
High 8
- CVE-2022-1096Type confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HGoogle Chrome
- CVE-2022-33960WordPress Social Share Buttons by Supsystic plugin <= 2.2.3 - Multiple Authenticated SQL Injection (SQLi) vulnerabilitiesSocial Share Buttons by Supsystic
- CVE-2022-2142Advantech iViewAdvantech iView iView
- CVE-2022-2136Advantech iViewAdvantech iView iView
- CVE-2022-2135Advantech iViewAdvantech iView iView
- CVE-2022-2138Advantech iViewAdvantech iView iView
- CVE-2022-2493Data Access from Outside Expected Data Manager Component in openemr/openemropenemr/openemr
- CVE-2022-2327Use-after-free in io_uring ad work_flags in Linux KernelLinux Kernel
Medium, low and unrated 61
- CVE-2022-1146Inappropriate implementation in Resource Timing in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to leak cross-origin data Google Chrome
- CVE-2022-1145Use after free in Extensions in Google Chrome prior to 100.0.4896.60 allowed an attacker who convinced a user to install a malicious extensiGoogle Chrome
- CVE-2022-1144Use after free in WebUI in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific user inGoogle Chrome
- CVE-2022-1143Heap buffer overflow in WebUI in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific uGoogle Chrome
- CVE-2022-1142Heap buffer overflow in WebUI in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific uGoogle Chrome
- CVE-2022-1141Use after free in File Manager in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific Google Chrome
- CVE-2022-1139Inappropriate implementation in Background Fetch API in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to leak cross-origin Google Chrome
- CVE-2022-1138Inappropriate implementation in Web Cursor in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who had compromised the rendereGoogle Chrome
- CVE-2022-1137Inappropriate implementation in Extensions in Google Chrome prior to 100.0.4896.60 allowed an attacker who convinced a user to install a malGoogle Chrome
- CVE-2022-1136Use after free in Tab Strip in Google Chrome prior to 100.0.4896.60 allowed an attacker who convinced a user to install a malicious extensioGoogle Chrome
- CVE-2022-1135Use after free in Shopping Cart in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to potentially exploit heap corruption viaGoogle Chrome
- CVE-2022-1133Use after free in WebRTC Perf in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to potentially exploit heap corruption via aGoogle Chrome
- CVE-2022-1132Inappropriate implementation in Virtual Keyboard in Google Chrome on Chrome OS prior to 100.0.4896.60 allowed a local attacker to bypass navGoogle Chrome
- CVE-2022-1131Use after free in Cast UI in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to potentially exploit heap corruption via a craGoogle Chrome
- CVE-2022-1130Insufficient validation of trust input in WebOTP in Google Chrome on Android prior to 100.0.4896.60 allowed a remote attacker to send arbitrGoogle Chrome
- CVE-2022-1129Inappropriate implementation in Full Screen Mode in Google Chrome on Android prior to 100.0.4896.60 allowed a remote attacker to spoof the cGoogle Chrome
- CVE-2022-1128Inappropriate implementation in Web Share API in Google Chrome on Windows prior to 100.0.4896.60 allowed an attacker on the local network seGoogle Chrome
- CVE-2022-1127Use after free in QR Code Generator in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specGoogle Chrome
- CVE-2022-1125Use after free in Portals in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific user Google Chrome
- CVE-2022-34112An access control issue in the component /api/plugin/uninstall Dataease v1.11.1 allows attackers to arbitrarily uninstall the plugin, a righio.dataease:dataease-plugin-common
- CVE-2022-34114Dataease v1.11.1 was discovered to contain a SQL injection vulnerability via the parameter dataSourceId.io.dataease:dataease-plugin-common
- CVE-2022-34113An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin.io.dataease:dataease-plugin-common
- CVE-2022-34115DataEase v1.11.1 was discovered to contain a arbitrary file write vulnerability via the parameter dataSourceId.io.dataease:dataease-plugin-common
- CVE-2017-20143Itech Movie Portal Script film-rating.php Error sql injectionItech Movie Portal Script
- CVE-2017-20142Itech Movie Portal Script artist-display.php Union sql injectionItech Movie Portal Script
- CVE-2017-20141Itech Movie Portal Script movie.php Union sql injectionItech Movie Portal Script
- CVE-2022-33901WordPress MultiSafepay plugin for WooCommerce plugin <= 4.13.1 - Unauthenticated Arbitrary File Read vulnerabilityMultiSafepay plugin for WooCommerce
- CVE-2022-34650WordPress Team plugin <= 1.2.6 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilitieswpWax Team
- CVE-2022-34853WordPress Team plugin <= 1.2.6 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilitieswpWax Team
- CVE-2022-33191WordPress Testimonials plugin <= 3.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityChinmoy Paul (chinmoy29) Testimonials
- CVE-2022-34839WordPress WP OAuth2 Server plugin <= 1.0.1 - Authentication Bypass vulnerabilityCodexShaper WP OAuth2 Server
- CVE-2022-27235WordPress Social Share Buttons by Supsystic plugin <= 2.2.3 - Multiple Broken Access Control vulnerabilitiesSocial Share Buttons by Supsystic
- CVE-2022-29495WordPress Popup Builder plugin <= 4.1.11 - Cross-Site Request Forgery (CSRF) leading to plugin settings updateSygnoos Popup Builder
- CVE-2017-20140Itech Movie Portal Script movie.php Reflected cross site scriptingItech Movie Portal Script
- CVE-2017-20139Itech Movie Portal Script show_news.php Error sql injectionItech Movie Portal Script
- CVE-2022-2510Potential XSS on Special:SearchCenterHallo Welt! BlueSpice
- CVE-2022-2511Potential XSS in title URL parameterHallo Welt! BlueSpice
- CVE-2020-14114information leakage vulnerability exists in the Xiaomi SmartHome APP.Xiaomi SmartHome APP
- CVE-2020-14126Information leakage vulnerability exists in the Mi Sound APP.Mi Sound APP
- CVE-2022-28878Denial-of-Service (DoS) VulnerabilityAll F-Secure and WithSecure Endpoint Protection products fo…
- CVE-2022-28879Denial-of-Service (DoS) VulnerabilityAll F-Secure and WithSecure Endpoint Protection products fo…
- CVE-2022-2139Advantech iViewAdvantech iView iView
- CVE-2022-2137Advantech iViewAdvantech iView iView
- CVE-2021-36200Metasys ADS/ADX/OAS with MUIJohnson Controls Metasys ADS/ADX/OAS server
- CVE-2022-1655An Incorrect Permission Assignment for Critical Resource flaw was found in Horizon on Red Hat OpenStack.OpenStack
- CVE-2022-2470Cross-site Scripting (XSS) - Reflected in microweber/microwebermicroweber/microweber
- CVE-2022-34982The eziod package in PyPI before v0.0.1 included a code execution backdoor inserted by a third party.eziod
- CVE-2022-34983The scu-captcha package in PyPI v0.0.1 to v0.0.4 included a code execution backdoor inserted by a third party.scu-captcha
- CVE-2022-34509The wikifaces package in PyPI v1.0 included a code execution backdoor inserted by a third party.
- CVE-2022-34981The PyCrowdTangle package in PyPI before v0.0.1 included a code execution backdoor inserted by a third party.pycrowdtangle
- CVE-2022-34520Radare2 v5.7.2 was discovered to contain a NULL pointer dereference via the function r_bin_file_xtr_load_buffer at bin/bfile.c.
- CVE-2022-34503QPDF v8.4.2 was discovered to contain a heap buffer overflow via the function QPDF::processXRefStream.
- CVE-2022-34502Radare2 v5.7.0 was discovered to contain a heap buffer overflow via the function consume_encoded_name_new at format/wasm/wasm.c.
- CVE-2022-34500The bin-collect package in PyPI before v0.1 included a code execution backdoor inserted by a third party.
- CVE-2022-34501The bin-collection package in PyPI before v0.1 included a code execution backdoor inserted by a third party.
- CVE-2022-31168Zulip Server insufficient authorization for changing bot roleszulip
- CVE-2022-36131The Better PDF Exporter add-on 10.0.0 for Atlassian Jira is prone to stored XSS via a crafted description to the PDF Templates overview page
- CVE-2022-2495Cross-site Scripting (XSS) - Stored in microweber/microwebermicroweber/microweber
- CVE-2022-2494Cross-site Scripting (XSS) - Stored in openemr/openemropenemr/openemr
- CVE-2022-1134Type confusion in V8 in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2022-34037An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of