# CVEs published 2022-07-22

72 CVEs were published on July 22, 2022: 3 critical, 8 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2022-1146](https://cve.now/CVE-2022-1146.md): Inappropriate implementation in Resource Timing in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to leak cross-origin data (no CVSS, Google Chrome)
- [CVE-2022-1145](https://cve.now/CVE-2022-1145.md): Use after free in Extensions in Google Chrome prior to 100.0.4896.60 allowed an attacker who convinced a user to install a malicious extensi (no CVSS, Google Chrome)
- [CVE-2022-1144](https://cve.now/CVE-2022-1144.md): Use after free in WebUI in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific user in (no CVSS, Google Chrome)
- [CVE-2022-1143](https://cve.now/CVE-2022-1143.md): Heap buffer overflow in WebUI in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific u (no CVSS, Google Chrome)
- [CVE-2022-1142](https://cve.now/CVE-2022-1142.md): Heap buffer overflow in WebUI in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific u (no CVSS, Google Chrome)
- [CVE-2022-1141](https://cve.now/CVE-2022-1141.md): Use after free in File Manager in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific (no CVSS, Google Chrome)
- [CVE-2022-1139](https://cve.now/CVE-2022-1139.md): Inappropriate implementation in Background Fetch API in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to leak cross-origin (no CVSS, Google Chrome)
- [CVE-2022-1138](https://cve.now/CVE-2022-1138.md): Inappropriate implementation in Web Cursor in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who had compromised the rendere (no CVSS, Google Chrome)
- [CVE-2022-1137](https://cve.now/CVE-2022-1137.md): Inappropriate implementation in Extensions in Google Chrome prior to 100.0.4896.60 allowed an attacker who convinced a user to install a mal (no CVSS, Google Chrome)
- [CVE-2022-1136](https://cve.now/CVE-2022-1136.md): Use after free in Tab Strip in Google Chrome prior to 100.0.4896.60 allowed an attacker who convinced a user to install a malicious extensio (no CVSS, Google Chrome)
- [CVE-2022-1135](https://cve.now/CVE-2022-1135.md): Use after free in Shopping Cart in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to potentially exploit heap corruption via (no CVSS, Google Chrome)
- [CVE-2022-1133](https://cve.now/CVE-2022-1133.md): Use after free in WebRTC Perf in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to potentially exploit heap corruption via a (no CVSS, Google Chrome)
- [CVE-2022-1132](https://cve.now/CVE-2022-1132.md): Inappropriate implementation in Virtual Keyboard in Google Chrome on Chrome OS prior to 100.0.4896.60 allowed a local attacker to bypass nav (no CVSS, Google Chrome)
- [CVE-2022-1131](https://cve.now/CVE-2022-1131.md): Use after free in Cast UI in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to potentially exploit heap corruption via a cra (no CVSS, Google Chrome)
- [CVE-2022-1130](https://cve.now/CVE-2022-1130.md): Insufficient validation of trust input in WebOTP in Google Chrome on Android prior to 100.0.4896.60 allowed a remote attacker to send arbitr (no CVSS, Google Chrome)
- [CVE-2022-1129](https://cve.now/CVE-2022-1129.md): Inappropriate implementation in Full Screen Mode in Google Chrome on Android prior to 100.0.4896.60 allowed a remote attacker to spoof the c (no CVSS, Google Chrome)
- [CVE-2022-1128](https://cve.now/CVE-2022-1128.md): Inappropriate implementation in Web Share API in Google Chrome on Windows prior to 100.0.4896.60 allowed an attacker on the local network se (no CVSS, Google Chrome)
- [CVE-2022-1127](https://cve.now/CVE-2022-1127.md): Use after free in QR Code Generator in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in spec (no CVSS, Google Chrome)
- [CVE-2022-1125](https://cve.now/CVE-2022-1125.md): Use after free in Portals in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific user (no CVSS, Google Chrome)
- [CVE-2022-1096](https://cve.now/CVE-2022-1096.md): Type confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote attacker to potentially exploit heap corruption via a crafted H (CVSS 8.8, KEV, Google Chrome)
- [CVE-2022-34112](https://cve.now/CVE-2022-34112.md): An access control issue in the component /api/plugin/uninstall Dataease v1.11.1 allows attackers to arbitrarily uninstall the plugin, a righ (no CVSS, io.dataease:dataease-plugin-common)
- [CVE-2022-34114](https://cve.now/CVE-2022-34114.md): Dataease v1.11.1 was discovered to contain a SQL injection vulnerability via the parameter dataSourceId. (no CVSS, io.dataease:dataease-plugin-common)
- [CVE-2022-34113](https://cve.now/CVE-2022-34113.md): An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin. (no CVSS, io.dataease:dataease-plugin-common)
- [CVE-2022-34115](https://cve.now/CVE-2022-34115.md): DataEase v1.11.1 was discovered to contain a arbitrary file write vulnerability via the parameter dataSourceId. (no CVSS, io.dataease:dataease-plugin-common)
- [CVE-2022-25759](https://cve.now/CVE-2022-25759.md): Remote Code Injection (CVSS 9.9, convert-svg-core)
- [CVE-2017-20143](https://cve.now/CVE-2017-20143.md): Itech Movie Portal Script film-rating.php Error sql injection (CVSS 6.3, Itech Movie Portal Script)
- [CVE-2017-20142](https://cve.now/CVE-2017-20142.md): Itech Movie Portal Script artist-display.php Union sql injection (CVSS 6.3, Itech Movie Portal Script)
- [CVE-2017-20141](https://cve.now/CVE-2017-20141.md): Itech Movie Portal Script movie.php Union sql injection (CVSS 6.3, Itech Movie Portal Script)
- [CVE-2022-33901](https://cve.now/CVE-2022-33901.md): WordPress MultiSafepay plugin for WooCommerce plugin \<= 4.13.1 - Unauthenticated Arbitrary File Read vulnerability (CVSS 5.3, MultiSafepay plugin for WooCommerce)
- [CVE-2022-34650](https://cve.now/CVE-2022-34650.md): WordPress Team plugin \<= 1.2.6 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities (CVSS 4.1, wpWax Team)
- [CVE-2022-34853](https://cve.now/CVE-2022-34853.md): WordPress Team plugin \<= 1.2.6 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities (CVSS 4.1, wpWax Team)
- [CVE-2022-30998](https://cve.now/CVE-2022-30998.md): WordPress Homepage Product Organizer for WooCommerce plugin \<= 1.1 - Multiple Authenticated SQL Injection (SQLi) vulnerabilities (CVSS 9.1, WooPlugins.co Homepage Product Organizer for WooCommerce)
- [CVE-2022-33191](https://cve.now/CVE-2022-33191.md): WordPress Testimonials plugin \<= 3.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.1, Chinmoy Paul (chinmoy29) Testimonials)
- [CVE-2022-34839](https://cve.now/CVE-2022-34839.md): WordPress WP OAuth2 Server plugin \<= 1.0.1 - Authentication Bypass vulnerability (CVSS 5.9, CodexShaper WP OAuth2 Server)
- [CVE-2022-27235](https://cve.now/CVE-2022-27235.md): WordPress Social Share Buttons by Supsystic plugin \<= 2.2.3 - Multiple Broken Access Control vulnerabilities (CVSS 6.3, Social Share Buttons by Supsystic)
- [CVE-2022-33960](https://cve.now/CVE-2022-33960.md): WordPress Social Share Buttons by Supsystic plugin \<= 2.2.3 - Multiple Authenticated SQL Injection (SQLi) vulnerabilities (CVSS 8.5, Social Share Buttons by Supsystic)
- [CVE-2022-29495](https://cve.now/CVE-2022-29495.md): WordPress Popup Builder plugin \<= 4.1.11 - Cross-Site Request Forgery (CSRF) leading to plugin settings update (CVSS 5.4, Sygnoos Popup Builder)
- [CVE-2017-20140](https://cve.now/CVE-2017-20140.md): Itech Movie Portal Script movie.php Reflected cross site scripting (CVSS 4.3, Itech Movie Portal Script)
- [CVE-2017-20139](https://cve.now/CVE-2017-20139.md): Itech Movie Portal Script show\_news.php Error sql injection (CVSS 6.3, Itech Movie Portal Script)
- [CVE-2022-2510](https://cve.now/CVE-2022-2510.md): Potential XSS on Special:SearchCenter (CVSS 4.3, Hallo Welt! BlueSpice)
- [CVE-2022-2511](https://cve.now/CVE-2022-2511.md): Potential XSS in title URL parameter (CVSS 4.3, Hallo Welt! BlueSpice)
- [CVE-2020-14114](https://cve.now/CVE-2020-14114.md): information leakage vulnerability exists in the Xiaomi SmartHome APP. (no CVSS, Xiaomi SmartHome APP)
- [CVE-2020-14126](https://cve.now/CVE-2020-14126.md): Information leakage vulnerability exists in the Mi Sound APP. (no CVSS, Mi Sound APP)
- [CVE-2022-28878](https://cve.now/CVE-2022-28878.md): Denial-of-Service (DoS) Vulnerability (CVSS 4.3, All F-Secure and WithSecure Endpoint Protection products fo…)
- [CVE-2022-28879](https://cve.now/CVE-2022-28879.md): Denial-of-Service (DoS) Vulnerability (CVSS 4.3, All F-Secure and WithSecure Endpoint Protection products fo…)
- [CVE-2022-2142](https://cve.now/CVE-2022-2142.md): Advantech iView (CVSS 8.1, Advantech iView iView)
- [CVE-2022-2143](https://cve.now/CVE-2022-2143.md): Advantech iView (CVSS 9.8, Advantech iView iView)
- [CVE-2022-2136](https://cve.now/CVE-2022-2136.md): Advantech iView (CVSS 8.8, Advantech iView iView)
- [CVE-2022-2135](https://cve.now/CVE-2022-2135.md): Advantech iView (CVSS 7.5, Advantech iView iView)
- [CVE-2022-2138](https://cve.now/CVE-2022-2138.md): Advantech iView (CVSS 8.2, Advantech iView iView)
- [CVE-2022-2139](https://cve.now/CVE-2022-2139.md): Advantech iView (CVSS 6.5, Advantech iView iView)
- [CVE-2022-2137](https://cve.now/CVE-2022-2137.md): Advantech iView (CVSS 4.9, Advantech iView iView)
- [CVE-2021-36200](https://cve.now/CVE-2021-36200.md): Metasys ADS/ADX/OAS with MUI (CVSS 5.3, Johnson Controls Metasys ADS/ADX/OAS server)
- [CVE-2022-1655](https://cve.now/CVE-2022-1655.md): An Incorrect Permission Assignment for Critical Resource flaw was found in Horizon on Red Hat OpenStack. (no CVSS, OpenStack)
- [CVE-2022-2470](https://cve.now/CVE-2022-2470.md): Cross-site Scripting (XSS) - Reflected in microweber/microweber (CVSS 6.5, microweber/microweber)
- [CVE-2022-34982](https://cve.now/CVE-2022-34982.md): The eziod package in PyPI before v0.0.1 included a code execution backdoor inserted by a third party. (no CVSS, eziod)
- [CVE-2022-34983](https://cve.now/CVE-2022-34983.md): The scu-captcha package in PyPI v0.0.1 to v0.0.4 included a code execution backdoor inserted by a third party. (no CVSS, scu-captcha)
- [CVE-2022-34509](https://cve.now/CVE-2022-34509.md): The wikifaces package in PyPI v1.0 included a code execution backdoor inserted by a third party. (no CVSS)
- [CVE-2022-34981](https://cve.now/CVE-2022-34981.md): The PyCrowdTangle package in PyPI before v0.0.1 included a code execution backdoor inserted by a third party. (no CVSS, pycrowdtangle)
- [CVE-2022-34520](https://cve.now/CVE-2022-34520.md): Radare2 v5.7.2 was discovered to contain a NULL pointer dereference via the function r\_bin\_file\_xtr\_load\_buffer at bin/bfile.c. (no CVSS)
- [CVE-2022-34503](https://cve.now/CVE-2022-34503.md): QPDF v8.4.2 was discovered to contain a heap buffer overflow via the function QPDF::processXRefStream. (no CVSS)
- [CVE-2022-34502](https://cve.now/CVE-2022-34502.md): Radare2 v5.7.0 was discovered to contain a heap buffer overflow via the function consume\_encoded\_name\_new at format/wasm/wasm.c. (no CVSS)
- [CVE-2022-34500](https://cve.now/CVE-2022-34500.md): The bin-collect package in PyPI before v0.1 included a code execution backdoor inserted by a third party. (no CVSS)
- [CVE-2022-34501](https://cve.now/CVE-2022-34501.md): The bin-collection package in PyPI before v0.1 included a code execution backdoor inserted by a third party. (no CVSS)
- [CVE-2022-31168](https://cve.now/CVE-2022-31168.md): Zulip Server insufficient authorization for changing bot roles (CVSS 5.4, zulip)
- [CVE-2022-36131](https://cve.now/CVE-2022-36131.md): The Better PDF Exporter add-on 10.0.0 for Atlassian Jira is prone to stored XSS via a crafted description to the PDF Templates overview page (no CVSS)
- [CVE-2022-2495](https://cve.now/CVE-2022-2495.md): Cross-site Scripting (XSS) - Stored in microweber/microweber (CVSS 6.8, microweber/microweber)
- [CVE-2022-2494](https://cve.now/CVE-2022-2494.md): Cross-site Scripting (XSS) - Stored in openemr/openemr (CVSS 6.3, openemr/openemr)
- [CVE-2022-2493](https://cve.now/CVE-2022-2493.md): Data Access from Outside Expected Data Manager Component in openemr/openemr (CVSS 8.3, openemr/openemr)
- [CVE-2022-1134](https://cve.now/CVE-2022-1134.md): Type confusion in V8 in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to potentially exploit heap corruption via a crafted (no CVSS, Google Chrome)
- [CVE-2022-2327](https://cve.now/CVE-2022-2327.md): Use-after-free in io\_uring ad work\_flags in Linux Kernel (CVSS 7.5, Linux Kernel)
- [CVE-2022-34037](https://cve.now/CVE-2022-34037.md): An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-07-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.