# CVEs published 2022-07-25

102 CVEs were published on July 25, 2022: 8 critical, 26 high. Days are UTC.

- [CVE-2022-34577](https://cve.now/CVE-2022-34577.md): A vulnerability in adm.cgi of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to execute arbitrary code via a crafted POST request. (no CVSS)
- [CVE-2022-34576](https://cve.now/CVE-2022-34576.md): A vulnerability in /cgi-bin/ExportAllSettings.sh of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to execute arbitrary code via a cr (no CVSS)
- [CVE-2022-34574](https://cve.now/CVE-2022-34574.md): An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the key information of the devic (no CVSS)
- [CVE-2022-34575](https://cve.now/CVE-2022-34575.md): An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the key information of the devic (no CVSS)
- [CVE-2022-34573](https://cve.now/CVE-2022-34573.md): An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to arbitrarily configure device settings v (no CVSS)
- [CVE-2022-34571](https://cve.now/CVE-2022-34571.md): An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the system key information and e (no CVSS)
- [CVE-2022-34572](https://cve.now/CVE-2022-34572.md): An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the telnet password via accessin (no CVSS)
- [CVE-2022-34570](https://cve.now/CVE-2022-34570.md): WAVLINK WN579 X3 M79X3.V5030.191012/M79X3.V5030.191012 contains an information leak which allows attackers to obtain the key information via (no CVSS)
- [CVE-2022-35131](https://cve.now/CVE-2022-35131.md): Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles. (no CVSS, joplin)
- [CVE-2022-34906](https://cve.now/CVE-2022-34906.md): A hard-coded cryptographic key is used in FileWave before 14.6.3 and 14.7.x before 14.7.2. (no CVSS)
- [CVE-2022-34907](https://cve.now/CVE-2022-34907.md): An authentication bypass vulnerability exists in FileWave before 14.6.3 and 14.7.x before 14.7.2. (no CVSS)
- [CVE-2022-36375](https://cve.now/CVE-2022-36375.md): WordPress Tabs plugin \<= 3.6.0 - Authenticated WordPress Options Change vulnerability (CVSS 7.2, Biplob Adhikari Tabs)
- [CVE-2022-22999](https://cve.now/CVE-2022-22999.md): Cross-site Scripting Vulnerability in USB Backups App (CVSS 8.2, Western Digital My Cloud)
- [CVE-2022-23000](https://cve.now/CVE-2022-23000.md): Weak Default SSL use in Port Forwarding Service (CVSS 7.3, Western Digital My Cloud)
- [CVE-2022-34966](https://cve.now/CVE-2022-34966.md): OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain an HTML injection vulnerability via the location parameter (no CVSS)
- [CVE-2022-35873](https://cve.now/CVE-2022-35873.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b202 (CVSS 7.8, Inductive Automation Ignition)
- [CVE-2022-35872](https://cve.now/CVE-2022-35872.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b202 (CVSS 7.8, Inductive Automation Ignition)
- [CVE-2022-35871](https://cve.now/CVE-2022-35871.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b202 (CVSS 8.1, Inductive Automation Ignition)
- [CVE-2022-35870](https://cve.now/CVE-2022-35870.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b202 (CVSS 8.8, Inductive Automation Ignition)
- [CVE-2022-35869](https://cve.now/CVE-2022-35869.md): This vulnerability allows remote attackers to bypass authentication on affected installations of Inductive Automation Ignition 8.1.15 (b2022 (CVSS 7.5, Inductive Automation Ignition)
- [CVE-2022-2059](https://cve.now/CVE-2022-2059.md): Stored Cross Site-Scripting in Agent Manager (CVSS 3.5, Artica PFMS Pandora FMS)
- [CVE-2022-2032](https://cve.now/CVE-2022-2032.md): Stored Cross Site-Scripting in File Manager (CVSS 3.5, Artica PFMS Pandora FMS)
- [CVE-2022-33969](https://cve.now/CVE-2022-33969.md): WordPress Flipbox plugin \<= 2.6.0 - Authenticated WordPress Options Change vulnerability (CVSS 7.2, Biplob Adhikari Flipbox)
- [CVE-2022-24992](https://cve.now/CVE-2022-24992.md): A vulnerability in the component process.php of QR Code Generator v5.2.7 allows attackers to perform directory traversal. (no CVSS)
- [CVE-2022-35288](https://cve.now/CVE-2022-35288.md): IBM Security Verify Information Queue 10.0.2 could allow a user to obtain sensitive information that could be used in further attacks agains (CVSS 5.3, IBM Security Verify Information Queue)
- [CVE-2022-35287](https://cve.now/CVE-2022-35287.md): IBM Security Verify Information Queue 10.0.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its (CVSS 6.8, IBM Security Verify Information Queue)
- [CVE-2022-35285](https://cve.now/CVE-2022-35285.md): IBM Security Verify Information Queue 10.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious (CVSS 6.5, IBM Security Verify Information Queue)
- [CVE-2022-35284](https://cve.now/CVE-2022-35284.md): IBM Security Verify Information Queue 10.0.2 could disclose sensitive information due to a missing or insecure SameSite attribute for a sens (CVSS 5.3, IBM Security Verify Information Queue)
- [CVE-2022-34962](https://cve.now/CVE-2022-34962.md): OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain a stored cross-site scripting (XSS) vulnerability via the (no CVSS)
- [CVE-2022-24083](https://cve.now/CVE-2022-24083.md): Password authentication bypass vulnerability for local accounts can be used to bypass local authentication checks. (CVSS 9.8, Pegasystems Pega Infinity)
- [CVE-2022-35653](https://cve.now/CVE-2022-35653.md): A reflected XSS issue was identified in the LTI module of Moodle. (no CVSS, Moodle · moodle/moodle)
- [CVE-2022-35652](https://cve.now/CVE-2022-35652.md): An open redirect issue was found in Moodle due to improper sanitization of user-supplied data in mobile auto-login feature. (no CVSS, Moodle · moodle/moodle)
- [CVE-2022-35651](https://cve.now/CVE-2022-35651.md): A stored XSS and blind SSRF vulnerability was found in Moodle, occurs due to insufficient sanitization of user-supplied data in the SCORM tr (no CVSS, Moodle · moodle/moodle)
- [CVE-2022-35650](https://cve.now/CVE-2022-35650.md): The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions. (no CVSS, Moodle · moodle/moodle)
- [CVE-2022-35649](https://cve.now/CVE-2022-35649.md): The vulnerability was found in Moodle, occurs due to improper input validation when parsing PostScript code. (no CVSS, Moodle · moodle/moodle)
- [CVE-2022-34964](https://cve.now/CVE-2022-34964.md): OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain a stored cross-site scripting (XSS) vulnerability via the (no CVSS)
- [CVE-2022-34961](https://cve.now/CVE-2022-34961.md): OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain a stored cross-site scripting (XSS) vulnerability via the (no CVSS)
- [CVE-2021-40336](https://cve.now/CVE-2021-40336.md): HTTP Response Splitting in Hitachi Energy’s MSM Product (CVSS 5.0, Hitachi Energy MSM)
- [CVE-2021-40335](https://cve.now/CVE-2021-40335.md): Cross Site Request Forgery (CSRF) in Hitachi Energy’s MSM Product (CVSS 5.0, Hitachi Energy MSM)
- [CVE-2022-34963](https://cve.now/CVE-2022-34963.md): OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain a stored cross-site scripting (XSS) vulnerability via the (no CVSS)
- [CVE-2022-2131](https://cve.now/CVE-2022-2131.md): OpenKM XXE Injection (CVSS 8.5, OpenKM Document Management Community)
- [CVE-2020-28447](https://cve.now/CVE-2020-28447.md): Command Injection (CVSS 9.8, xopen)
- [CVE-2021-23451](https://cve.now/CVE-2021-23451.md): Insecure Randomness (CVSS 6.5, otp-generator)
- [CVE-2021-23373](https://cve.now/CVE-2021-23373.md): Prototype Pollution (CVSS 7.5, set-deep-prop)
- [CVE-2020-28455](https://cve.now/CVE-2020-28455.md): Cross-site Scripting (XSS) (CVSS 7.3, markdown-it-toc)
- [CVE-2020-28435](https://cve.now/CVE-2020-28435.md): Command Injection (CVSS 9.4, ffmpeg-sdk)
- [CVE-2020-28445](https://cve.now/CVE-2020-28445.md): Command Injection (CVSS 9.8, npm-help)
- [CVE-2020-28436](https://cve.now/CVE-2020-28436.md): Command Injection (CVSS 7.3, google-cloudstorage-commands)
- [CVE-2020-28471](https://cve.now/CVE-2020-28471.md): Prototype Pollution (CVSS 7.3, properties-reader)
- [CVE-2020-7677](https://cve.now/CVE-2020-7677.md): Arbitrary Code Execution (CVSS 8.6, thenify · org.webjars.npm:thenify)
- [CVE-2020-7678](https://cve.now/CVE-2020-7678.md): Arbitrary Code Execution (CVSS 8.6, node-import)
- [CVE-2021-23397](https://cve.now/CVE-2021-23397.md): Prototype Pollution (CVSS 5.6, @ianwalter/merge)
- [CVE-2020-7649](https://cve.now/CVE-2020-7649.md): Directory Traversal (CVSS 4.9, snyk-broker)
- [CVE-2020-28462](https://cve.now/CVE-2020-28462.md): Prototype Pollution (CVSS 7.3, ion-parser)
- [CVE-2020-28461](https://cve.now/CVE-2020-28461.md): Prototype Pollution (CVSS 7.3, js-ini)
- [CVE-2020-28441](https://cve.now/CVE-2020-28441.md): Prototype Pollution (CVSS 7.3, conf-cfg-ini)
- [CVE-2020-28422](https://cve.now/CVE-2020-28422.md): Command Injection (CVSS 6.4, git-archive)
- [CVE-2020-28438](https://cve.now/CVE-2020-28438.md): Command Injection (CVSS 9.8, deferred-exec)
- [CVE-2020-28459](https://cve.now/CVE-2020-28459.md): Cross-site Scripting (XSS) (CVSS 7.3, markdown-it-decorate)
- [CVE-2020-28446](https://cve.now/CVE-2020-28446.md): Command Injection (CVSS 9.8, ntesseract)
- [CVE-2020-28443](https://cve.now/CVE-2020-28443.md): Command Injection (CVSS 9.8, sonar-wrapper)
- [CVE-2022-33965](https://cve.now/CVE-2022-33965.md): WordPress WP Visitor Statistics plugin \<= 5.7 - Multiple Unauthenticated SQL Injection (SQLi) vulnerabilities (CVSS 9.3, Osamaesh WP Visitor Statistics)
- [CVE-2022-0670](https://cve.now/CVE-2022-0670.md): A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner to read/write any manilla share or entire f (no CVSS, Ceph)
- [CVE-2022-21802](https://cve.now/CVE-2022-21802.md): Cross-site Scripting (XSS) (CVSS 5.4, grapesjs)
- [CVE-2022-2523](https://cve.now/CVE-2022-2523.md): Cross-site Scripting (XSS) - Reflected in beancount/fava (CVSS 8.0, beancount/fava · fava)
- [CVE-2022-2514](https://cve.now/CVE-2022-2514.md): Cross-site Scripting (XSS) - Reflected in beancount/fava (CVSS 8.0, beancount/fava · fava)
- [CVE-2022-1313](https://cve.now/CVE-2022-1313.md): Use after free in tab groups in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a (no CVSS, Google Chrome)
- [CVE-2022-1312](https://cve.now/CVE-2022-1312.md): Use after free in storage in Google Chrome prior to 100.0.4896.88 allowed an attacker who convinced a user to install a malicious extension (no CVSS, Google Chrome)
- [CVE-2022-1311](https://cve.now/CVE-2022-1311.md): Use after free in shell in Google Chrome on ChromeOS prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption (no CVSS, Google Chrome)
- [CVE-2022-1310](https://cve.now/CVE-2022-1310.md): Use after free in regular expressions in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corrupti (no CVSS, Google Chrome)
- [CVE-2022-1309](https://cve.now/CVE-2022-1309.md): Insufficient policy enforcement in developer tools in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially perform (no CVSS, Google Chrome)
- [CVE-2022-1308](https://cve.now/CVE-2022-1308.md): Use after free in BFCache in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a cra (no CVSS, Google Chrome)
- [CVE-2022-1307](https://cve.now/CVE-2022-1307.md): Inappropriate implementation in full screen in Google Chrome on Android prior to 100.0.4896.88 allowed a remote attacker to spoof the conten (no CVSS, Google Chrome)
- [CVE-2022-1306](https://cve.now/CVE-2022-1306.md): Inappropriate implementation in compositing in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to spoof the contents of the O (no CVSS, Google Chrome)
- [CVE-2022-1305](https://cve.now/CVE-2022-1305.md): Use after free in storage in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a cra (no CVSS, Google Chrome)
- [CVE-2022-1232](https://cve.now/CVE-2022-1232.md): Type confusion in V8 in Google Chrome prior to 100.0.4896.75 allowed a remote attacker to potentially exploit heap corruption via a crafted (no CVSS, Google Chrome)
- [CVE-2022-2341](https://cve.now/CVE-2022-2341.md): Simple Page Transition \<= 1.4.1 - Admin+ Stored Cross-Site Scripting (no CVSS, Simple Page Transition)
- [CVE-2022-2340](https://cve.now/CVE-2022-2340.md): W-DALIL \<= 2.0 - Admin+ Stored Cross-Site Scripting (no CVSS, W-DALIL)
- [CVE-2022-2299](https://cve.now/CVE-2022-2299.md): Allow SVG Files \<= 1.1 - Author+ Stored Cross Site Scripting via SVG (no CVSS, Allow svg files)
- [CVE-2022-2240](https://cve.now/CVE-2022-2240.md): Request a Quote \<= 2.3.7 - CSV Injection (no CVSS, Request a Quote)
- [CVE-2022-2239](https://cve.now/CVE-2022-2239.md): Request a Quote \< 2.3.9 - Admin+ Stored Cross-Site Scripting (no CVSS, Request a Quote)
- [CVE-2022-2219](https://cve.now/CVE-2022-2219.md): Unyson \< 2.7.27 - Reflected Cross-Site Scripting (no CVSS, Unyson)
- [CVE-2022-2189](https://cve.now/CVE-2022-2189.md): WP Video Lightbox \< 1.9.5 - Reflected Cross-Site Scripting (no CVSS, WP Video Lightbox)
- [CVE-2022-2115](https://cve.now/CVE-2022-2115.md): Popup Anything \< 2.1.7 - Reflected Cross-Site Scripting (no CVSS, Popup Anything – A Marketing Popup and Lead Generation Conv…)
- [CVE-2022-2072](https://cve.now/CVE-2022-2072.md): Name Directory \< 1.25.3 - Reflected Cross-Site Scripting (no CVSS, Name Directory)
- [CVE-2022-2071](https://cve.now/CVE-2022-2071.md): Name Directory \< 1.25.4 - Stored Cross-Site Scripting via CSRF (no CVSS, Name Directory)
- [CVE-2022-1551](https://cve.now/CVE-2022-1551.md): SP Project & Document Manager \< 4.58 - Sensitive File Disclosure (no CVSS, SP Project & Document Manager)
- [CVE-2022-1539](https://cve.now/CVE-2022-1539.md): Exports and Reports \< 0.9.2 - Contributor+ CSV Injection (no CVSS, Exports and Reports)
- [CVE-2022-0899](https://cve.now/CVE-2022-0899.md): Header Footer Code Manager \< 1.1.24 - Reflected Cross-Site Scripting (no CVSS, Header Footer Code Manager)
- [CVE-2022-0594](https://cve.now/CVE-2022-0594.md): Shareaholic \< 9.7.6 - Information Disclosure (no CVSS, Professional Social Sharing Buttons, Icons & Related Posts…)
- [CVE-2022-29709](https://cve.now/CVE-2022-29709.md): CommuniLink Internet Limited CLink Office v2.0 was discovered to contain multiple SQL injection vulnerabilities via the username and passwor (no CVSS)
- [CVE-2022-36450](https://cve.now/CVE-2022-36450.md): Obsidian 0.14.x and 0.15.x before 0.15.5 allows obsidian://hook-get-address remote code execution because window.open is used without checki (CVSS 8.0)
- [CVE-2022-36446](https://cve.now/CVE-2022-36446.md): software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command. (no CVSS)
- [CVE-2022-36444](https://cve.now/CVE-2022-36444.md): An issue was discovered in Atos Unify OpenScape SBC 9 and 10 before 10R2.2.1, Atos Unify OpenScape Branch 9 and 10 before version 10R2.1.1, (CVSS 8.6)
- [CVE-2017-20145](https://cve.now/CVE-2017-20145.md): Tecrail Responsive Filemanger path traversal (CVSS 6.3, Tecrail Responsive Filemanger)
- [CVE-2022-1314](https://cve.now/CVE-2022-1314.md): Type confusion in V8 in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafted (no CVSS, Google Chrome)
- [CVE-2022-2522](https://cve.now/CVE-2022-2522.md): Heap-based Buffer Overflow in vim/vim (CVSS 7.8, vim/vim)
- [CVE-2022-26305](https://cve.now/CVE-2022-26305.md): Execution of Untrusted Macros Due to Improper Certificate Validation (no CVSS, The Document Foundation LibreOffice)
- [CVE-2022-26306](https://cve.now/CVE-2022-26306.md): Execution of Untrusted Macros Due to Improper Certificate Validation (no CVSS, The Document Foundation LibreOffice)
- [CVE-2022-26307](https://cve.now/CVE-2022-26307.md): Weak Master Keys (no CVSS, The Document Foundation LibreOffice)
- [CVE-2022-34749](https://cve.now/CVE-2022-34749.md): In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtrackin (no CVSS, mistune)
- [CVE-2022-34965](https://cve.now/CVE-2022-34965.md): OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain an arbitrary file upload vulnerability via the component / (CVSS 7.2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-07-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.