CVEs published July 25, 2022
102 CVEs were published on July 25, 2022: 8 critical, 26 high.
- Published
- 102
- Critical
- 8
- High
- 26
- Medium
- 12
- Low
- 2
- Unrated
- 54
- Now in CISA KEV
- 0
- Fix available
- 45
Most affected products
- Google Chrome
- 11
- Inductive Automation Ignition
- 5
- Moodle · moodle/moodle
- 5
- IBM Security Verify Information Queue
- 4
- The Document Foundation LibreOffice
- 3
- Artica PFMS Pandora FMS
- 2
- beancount/fava · fava
- 2
- Hitachi Energy MSM
- 2
- Name Directory
- 2
- Request a Quote
- 2
Critical 8
- CVE-2022-24083Password authentication bypass vulnerability for local accounts can be used to bypass local authentication checks.Pegasystems Pega Infinity
- CVE-2020-28447Command Injectionxopen
- CVE-2020-28435Command Injectionffmpeg-sdk
- CVE-2020-28445Command Injectionnpm-help
- CVE-2020-28438Command Injectiondeferred-exec
- CVE-2020-28446Command Injectionntesseract
- CVE-2020-28443Command Injectionsonar-wrapper
- CVE-2022-33965WordPress WP Visitor Statistics plugin <= 5.7 - Multiple Unauthenticated SQL Injection (SQLi) vulnerabilitiesOsamaesh WP Visitor Statistics
High 26
- CVE-2022-36375WordPress Tabs plugin <= 3.6.0 - Authenticated WordPress Options Change vulnerabilityBiplob Adhikari Tabs
- CVE-2022-22999Cross-site Scripting Vulnerability in USB Backups AppWestern Digital My Cloud
- CVE-2022-23000Weak Default SSL use in Port Forwarding ServiceWestern Digital My Cloud
- CVE-2022-35873This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b202Inductive Automation Ignition
- CVE-2022-35872This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b202Inductive Automation Ignition
- CVE-2022-35871This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b202Inductive Automation Ignition
- CVE-2022-35870This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b202Inductive Automation Ignition
- CVE-2022-35869This vulnerability allows remote attackers to bypass authentication on affected installations of Inductive Automation Ignition 8.1.15 (b2022Inductive Automation Ignition
- CVE-2022-33969WordPress Flipbox plugin <= 2.6.0 - Authenticated WordPress Options Change vulnerabilityBiplob Adhikari Flipbox
- CVE-2022-2131OpenKM XXE InjectionOpenKM Document Management Community
- CVE-2021-23373Prototype Pollutionset-deep-prop
- CVE-2020-28455Cross-site Scripting (XSS)markdown-it-toc
- CVE-2020-28436Command Injectiongoogle-cloudstorage-commands
- CVE-2020-28471Prototype Pollutionproperties-reader
- CVE-2020-7677Arbitrary Code Executionthenify · org.webjars.npm:thenify
- CVE-2020-7678Arbitrary Code Executionnode-import
- CVE-2020-28462Prototype Pollutionion-parser
- CVE-2020-28461Prototype Pollutionjs-ini
- CVE-2020-28441Prototype Pollutionconf-cfg-ini
- CVE-2020-28459Cross-site Scripting (XSS)markdown-it-decorate
- CVE-2022-2523Cross-site Scripting (XSS) - Reflected in beancount/favabeancount/fava · fava
- CVE-2022-2514Cross-site Scripting (XSS) - Reflected in beancount/favabeancount/fava · fava
- CVE-2022-36450Obsidian 0.14.x and 0.15.x before 0.15.5 allows obsidian://hook-get-address remote code execution because window.open is used without checki
- CVE-2022-36444An issue was discovered in Atos Unify OpenScape SBC 9 and 10 before 10R2.2.1, Atos Unify OpenScape Branch 9 and 10 before version 10R2.1.1,
- CVE-2022-2522Heap-based Buffer Overflow in vim/vimvim/vim
- CVE-2022-34965OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain an arbitrary file upload vulnerability via the component /
Medium, low and unrated 68
- CVE-2022-34577A vulnerability in adm.cgi of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to execute arbitrary code via a crafted POST request.
- CVE-2022-34576A vulnerability in /cgi-bin/ExportAllSettings.sh of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to execute arbitrary code via a cr
- CVE-2022-34574An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the key information of the devic
- CVE-2022-34575An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the key information of the devic
- CVE-2022-34573An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to arbitrarily configure device settings v
- CVE-2022-34571An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the system key information and e
- CVE-2022-34572An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the telnet password via accessin
- CVE-2022-34570WAVLINK WN579 X3 M79X3.V5030.191012/M79X3.V5030.191012 contains an information leak which allows attackers to obtain the key information via
- CVE-2022-35131Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles.joplin
- CVE-2022-34906A hard-coded cryptographic key is used in FileWave before 14.6.3 and 14.7.x before 14.7.2.
- CVE-2022-34907An authentication bypass vulnerability exists in FileWave before 14.6.3 and 14.7.x before 14.7.2.
- CVE-2022-34966OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain an HTML injection vulnerability via the location parameter
- CVE-2022-2059Stored Cross Site-Scripting in Agent ManagerArtica PFMS Pandora FMS
- CVE-2022-2032Stored Cross Site-Scripting in File ManagerArtica PFMS Pandora FMS
- CVE-2022-24992A vulnerability in the component process.php of QR Code Generator v5.2.7 allows attackers to perform directory traversal.
- CVE-2022-35288IBM Security Verify Information Queue 10.0.2 could allow a user to obtain sensitive information that could be used in further attacks againsIBM Security Verify Information Queue
- CVE-2022-35287IBM Security Verify Information Queue 10.0.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for itsIBM Security Verify Information Queue
- CVE-2022-35285IBM Security Verify Information Queue 10.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious IBM Security Verify Information Queue
- CVE-2022-35284IBM Security Verify Information Queue 10.0.2 could disclose sensitive information due to a missing or insecure SameSite attribute for a sensIBM Security Verify Information Queue
- CVE-2022-34962OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain a stored cross-site scripting (XSS) vulnerability via the
- CVE-2022-35653A reflected XSS issue was identified in the LTI module of Moodle.Moodle · moodle/moodle
- CVE-2022-35652An open redirect issue was found in Moodle due to improper sanitization of user-supplied data in mobile auto-login feature.Moodle · moodle/moodle
- CVE-2022-35651A stored XSS and blind SSRF vulnerability was found in Moodle, occurs due to insufficient sanitization of user-supplied data in the SCORM trMoodle · moodle/moodle
- CVE-2022-35650The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions.Moodle · moodle/moodle
- CVE-2022-35649The vulnerability was found in Moodle, occurs due to improper input validation when parsing PostScript code.Moodle · moodle/moodle
- CVE-2022-34964OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain a stored cross-site scripting (XSS) vulnerability via the
- CVE-2022-34961OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain a stored cross-site scripting (XSS) vulnerability via the
- CVE-2021-40336HTTP Response Splitting in Hitachi Energy’s MSM ProductHitachi Energy MSM
- CVE-2021-40335Cross Site Request Forgery (CSRF) in Hitachi Energy’s MSM ProductHitachi Energy MSM
- CVE-2022-34963OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain a stored cross-site scripting (XSS) vulnerability via the
- CVE-2021-23451Insecure Randomnessotp-generator
- CVE-2021-23397Prototype Pollution@ianwalter/merge
- CVE-2020-7649Directory Traversalsnyk-broker
- CVE-2020-28422Command Injectiongit-archive
- CVE-2022-0670A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner to read/write any manilla share or entire fCeph
- CVE-2022-21802Cross-site Scripting (XSS)grapesjs
- CVE-2022-1313Use after free in tab groups in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a Google Chrome
- CVE-2022-1312Use after free in storage in Google Chrome prior to 100.0.4896.88 allowed an attacker who convinced a user to install a malicious extension Google Chrome
- CVE-2022-1311Use after free in shell in Google Chrome on ChromeOS prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruptionGoogle Chrome
- CVE-2022-1310Use after free in regular expressions in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruptiGoogle Chrome
- CVE-2022-1309Insufficient policy enforcement in developer tools in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially perform Google Chrome
- CVE-2022-1308Use after free in BFCache in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a craGoogle Chrome
- CVE-2022-1307Inappropriate implementation in full screen in Google Chrome on Android prior to 100.0.4896.88 allowed a remote attacker to spoof the contenGoogle Chrome
- CVE-2022-1306Inappropriate implementation in compositing in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to spoof the contents of the OGoogle Chrome
- CVE-2022-1305Use after free in storage in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a craGoogle Chrome
- CVE-2022-1232Type confusion in V8 in Google Chrome prior to 100.0.4896.75 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2022-2341Simple Page Transition <= 1.4.1 - Admin+ Stored Cross-Site ScriptingSimple Page Transition
- CVE-2022-2340W-DALIL <= 2.0 - Admin+ Stored Cross-Site ScriptingW-DALIL
- CVE-2022-2299Allow SVG Files <= 1.1 - Author+ Stored Cross Site Scripting via SVGAllow svg files
- CVE-2022-2240Request a Quote <= 2.3.7 - CSV InjectionRequest a Quote
- CVE-2022-2239Request a Quote < 2.3.9 - Admin+ Stored Cross-Site ScriptingRequest a Quote
- CVE-2022-2219Unyson < 2.7.27 - Reflected Cross-Site ScriptingUnyson
- CVE-2022-2189WP Video Lightbox < 1.9.5 - Reflected Cross-Site ScriptingWP Video Lightbox
- CVE-2022-2115Popup Anything < 2.1.7 - Reflected Cross-Site ScriptingPopup Anything – A Marketing Popup and Lead Generation Conv…
- CVE-2022-2072Name Directory < 1.25.3 - Reflected Cross-Site ScriptingName Directory
- CVE-2022-2071Name Directory < 1.25.4 - Stored Cross-Site Scripting via CSRFName Directory
- CVE-2022-1551SP Project & Document Manager < 4.58 - Sensitive File DisclosureSP Project & Document Manager
- CVE-2022-1539Exports and Reports < 0.9.2 - Contributor+ CSV InjectionExports and Reports
- CVE-2022-0899Header Footer Code Manager < 1.1.24 - Reflected Cross-Site ScriptingHeader Footer Code Manager
- CVE-2022-0594Shareaholic < 9.7.6 - Information DisclosureProfessional Social Sharing Buttons, Icons & Related Posts…
- CVE-2022-29709CommuniLink Internet Limited CLink Office v2.0 was discovered to contain multiple SQL injection vulnerabilities via the username and passwor
- CVE-2022-36446software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command.
- CVE-2017-20145Tecrail Responsive Filemanger path traversalTecrail Responsive Filemanger
- CVE-2022-1314Type confusion in V8 in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2022-26305Execution of Untrusted Macros Due to Improper Certificate ValidationThe Document Foundation LibreOffice
- CVE-2022-26306Execution of Untrusted Macros Due to Improper Certificate ValidationThe Document Foundation LibreOffice
- CVE-2022-26307Weak Master KeysThe Document Foundation LibreOffice
- CVE-2022-34749In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtrackinmistune