CVEs published July 26, 2022
115 CVEs were published on July 26, 2022: 2 critical, 5 high. 1 is now in CISA KEV.
- Published
- 115
- Critical
- 2
- High
- 5
- Medium
- 3
- Low
- 1
- Unrated
- 104
- Now in CISA KEV
- 1
- Fix available
- 40
Most affected products
- Google Chrome
- 34
- Christian Stefanescu untangle · untangle
- 2
- Kernel
- 2
- zephyrproject-rtos zephyr
- 2
- Artica PFMS Pandora FMS
- 1
- Atlassian Confluence Server · Atlassian Confluence Data Cen…
- 1
- Atlassian Jira Service Management Server · Atlassian Jira S…
- 1
- Cloudflare WARP
- 1
- IBM Robotic Process Automation
- 1
- IBM Security Verify Information Queue
- 1
Critical 2
High 5
- CVE-2022-1364Type confusion in V8 Turbofan in Google Chrome prior to 100.0.4896.127 allowed a remote attacker to potentially exploit heap corruption via Google Chrome
- CVE-2022-35639IBM Sterling Partner Engagement Manager 6.1, 6.2, and Cloud 22.2 do not limit the length of a connection which could cause the server to becIBM Sterling Partner Engagement Manager
- CVE-2022-2225Zero Trust Secure Web Gateway policies bypass using WARP client subcommandsCloudflare WARP
- CVE-2022-1042Out-of-bound write vulnerability in the Bluetooth mesh core stack can be triggered during provisioningzephyrproject-rtos zephyr
- CVE-2022-1041Out-of-bound write vulnerability in the Bluetooth mesh core stack can be triggered during provisioningzephyrproject-rtos zephyr
Medium, low and unrated 108
- CVE-2021-33057The QQ application 8.7.1 for Android and iOS does not enforce the permission requirements (e.g., android.permission.ACCESS_FINE_LOCATION) fo
- CVE-2021-40180In the WeChat application 8.0.10 for Android and iOS, a mini program can obtain sensitive information from a user's address book via wx.sear
- CVE-2022-36129HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using Integrated Storage expose an unauthenticated API endpoint
- CVE-2022-30276The Motorola MOSCAD and ACE line of RTUs through 2022-05-02 omit an authentication requirement.
- CVE-2022-30269Motorola ACE1000 RTUs through 2022-05-02 mishandle application integrity.
- CVE-2022-30270The Motorola ACE1000 RTU through 2022-05-02 has default credentials.
- CVE-2022-30272The Motorola ACE1000 RTU through 2022-05-02 mishandles firmware integrity.
- CVE-2022-30274The Motorola ACE1000 RTU through 2022-05-02 uses ECB encryption unsafely.
- CVE-2022-1641Use after free in Web UI Diagnostics in Google Chrome on Chrome OS prior to 101.0.4951.64 allowed a remote attacker who convinced a user to Google Chrome
- CVE-2022-1640Use after free in Sharing in Google Chrome prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UI inGoogle Chrome
- CVE-2022-1639Use after free in ANGLE in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2022-1638Heap buffer overflow in V8 Internationalization in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to potentially exploit heaGoogle Chrome
- CVE-2022-1637Inappropriate implementation in Web Contents in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to leak cross-origin data viaGoogle Chrome
- CVE-2022-1636Use after free in Performance APIs in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to potentially exploit heap corruption Google Chrome
- CVE-2022-1635Use after free in Permission Prompts in Google Chrome prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in speGoogle Chrome
- CVE-2022-1634Use after free in Browser UI in Google Chrome prior to 101.0.4951.64 allowed a remote attacker who had convinced a user to engage in specifiGoogle Chrome
- CVE-2022-1633Use after free in Sharesheet in Google Chrome on Chrome OS prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage iGoogle Chrome
- CVE-2022-29953The Bently Nevada 3700 series of condition monitoring equipment through 2022-04-29 has a maintenance interface on port 4001/TCP with undocum
- CVE-2022-29952Bently Nevada condition monitoring equipment through 2022-04-29 mishandles authentication.
- CVE-2022-1501Inappropriate implementation in iframe in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to leak cross-origin data via a craGoogle Chrome
- CVE-2022-1500Insufficient data validation in Dev Tools in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass content security policGoogle Chrome
- CVE-2022-1499Inappropriate implementation in WebAuthentication in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass same origin poGoogle Chrome
- CVE-2022-1498Inappropriate implementation in HTML Parser in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to leak cross-origin data via Google Chrome
- CVE-2022-1497Inappropriate implementation in Input in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to spoof the contents of cross-origiGoogle Chrome
- CVE-2022-1496Use after free in File Manager in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via Google Chrome
- CVE-2022-1495Incorrect security UI in Downloads in Google Chrome on Android prior to 101.0.4951.41 allowed a remote attacker to spoof the APK downloads dGoogle Chrome
- CVE-2022-1494Insufficient data validation in Trusted Types in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass trusted types poliGoogle Chrome
- CVE-2022-1493Use after free in Dev Tools in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via speGoogle Chrome
- CVE-2022-1492Insufficient data validation in Blink Editing in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to inject arbitrary scripts Google Chrome
- CVE-2022-1491Use after free in Bookmarks in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via speGoogle Chrome
- CVE-2022-1490Use after free in Browser Switcher in Google Chrome prior to 101.0.4951.41 allowed a remote attacker who convinced a user to engage in speciGoogle Chrome
- CVE-2022-1489Out of bounds memory access in UI Shelf in Google Chrome on Chrome OS, Lacros prior to 101.0.4951.41 allowed a remote attacker to potentiallGoogle Chrome
- CVE-2022-1488Inappropriate implementation in Extensions API in Google Chrome prior to 101.0.4951.41 allowed an attacker who convinced a user to install aGoogle Chrome
- CVE-2022-1487Use after free in Ozone in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via runningGoogle Chrome
- CVE-2022-1486Type confusion in V8 in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to obtain potentially sensitive information from procGoogle Chrome
- CVE-2022-1485Use after free in File System API in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption vGoogle Chrome
- CVE-2022-1484Heap buffer overflow in Web UI Settings in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corrupGoogle Chrome
- CVE-2022-1483Heap buffer overflow in WebGPU in Google Chrome prior to 101.0.4951.41 allowed a remote attacker who had compromised the renderer process toGoogle Chrome
- CVE-2022-1482Inappropriate implementation in WebGL in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruptiGoogle Chrome
- CVE-2022-1481Use after free in Sharing in Google Chrome on Mac prior to 101.0.4951.41 allowed a remote attacker who convinced a user to engage in specifiGoogle Chrome
- CVE-2022-1479Use after free in ANGLE in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2022-1478Use after free in SwiftShader in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via aGoogle Chrome
- CVE-2022-1477Use after free in Vulkan in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2022-31207The Omron SYSMAC Cx product family PLCs (CS series, CJ series, and CP series) through 2022-05-18 lack cryptographic authentication.
- CVE-2022-31205In Omron CS series, CJ series, and CP series PLCs through 2022-05-18, the password for access to the Web UI is stored in memory area D1449..
- CVE-2022-31206The Omron SYSMAC Nx product family PLCs (NJ series, NY series, NX series, and PMAC series) through 2022-005-18 lack cryptographic authentica
- CVE-2022-31204Omron CS series, CJ series, and CP series PLCs through 2022-05-18 use cleartext passwords.
- CVE-2022-30275The Motorola MOSCAD Toolbox software through 2022-05-02 relies on a cleartext password.
- CVE-2022-30273The Motorola MDLC protocol through 2022-05-02 mishandles message integrity.
- CVE-2022-29957The Emerson DeltaV Distributed Control System (DCS) through 2022-04-29 mishandles authentication.
- CVE-2022-29960Emerson OpenBSI through 2022-04-29 uses weak cryptography.
- CVE-2022-29962The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords.
- CVE-2022-29963The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords.
- CVE-2022-29964The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords.
- CVE-2022-29965The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords.
- CVE-2022-27105InMailX Outlook Plugin < 3.22.0101 is vulnerable to Cross Site Scripting (XSS).
- CVE-2022-29958JTEKT TOYOPUC PLCs through 2022-04-29 do not ensure data integrity.
- CVE-2022-1651A memory leak flaw was found in the Linux kernel in acrn_dev_ioctl in the drivers/virt/acrn/hsm.c function in how the ACRN Device Model emulKernel
- CVE-2022-1671A NULL pointer dereference flaw was found in rxrpc_preparse_s in net/rxrpc/server_key.c in the Linux kernel.Kernel
- CVE-2022-35286IBM Security Verify Information Queue 10.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious IBM Security Verify Information Queue
- CVE-2022-22412IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a user with access to the local host (client machine) to obtain a logiIBM Robotic Process Automation
- CVE-2022-1648Relative Path Traversal to Remote Code Execution in File ManagerArtica PFMS Pandora FMS
- CVE-2022-36412In Zoho ManageEngine SupportCenter Plus before 11023, V3 API requests are vulnerable to authentication bypass.
- CVE-2022-34988Inout Blockchain AltExchanger v1.2.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/js.
- CVE-2022-34991Paymoney v3.3 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities via the first_name and last_name param
- CVE-2022-34989Fruits Bazar v1.0 was discovered to contain a SQL injection vulnerability via the recover_email parameter at user_password_recover.php.
- CVE-2022-36161Orange Station 1.0 was discovered to contain a SQL injection vulnerability via the username parameter.
- CVE-2022-34067Warehouse Management System v1.0 was discovered to contain a SQL injection vulnerability via the cari parameter.
- CVE-2022-31879Online Fire Reporting System 1.0 is vulnerable to SQL Injection via the date parameter.
- CVE-2021-33461An issue was discovered in yasm version 1.3.0.
- CVE-2021-33462An issue was discovered in yasm version 1.3.0.
- CVE-2021-33463An issue was discovered in yasm version 1.3.0.
- CVE-2021-33464An issue was discovered in yasm version 1.3.0.
- CVE-2021-33465An issue was discovered in yasm version 1.3.0.
- CVE-2021-33466An issue was discovered in yasm version 1.3.0.
- CVE-2021-33467An issue was discovered in yasm version 1.3.0.
- CVE-2021-33468An issue was discovered in yasm version 1.3.0.
- CVE-2021-33460An issue was discovered in yasm version 1.3.0.
- CVE-2021-33459An issue was discovered in yasm version 1.3.0.
- CVE-2021-33458An issue was discovered in yasm version 1.3.0.
- CVE-2021-33457An issue was discovered in yasm version 1.3.0.
- CVE-2021-33456An issue was discovered in yasm version 1.3.0.
- CVE-2021-33455An issue was discovered in yasm version 1.3.0.
- CVE-2021-33454An issue was discovered in yasm version 1.3.0.
- CVE-2021-33453An issue was discovered in lrzip version 0.641.
- CVE-2021-33452An issue was discovered in NASM version 2.16rc0.
- CVE-2021-33451An issue was discovered in lrzip version 0.641.
- CVE-2021-33443An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6).
- CVE-2021-33444An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6).
- CVE-2021-33445An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6).
- CVE-2021-33446An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6).
- CVE-2021-33447An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6).
- CVE-2021-33448An issue was discovered in mjs(mJS: Restricted JavaScript engine), ES6 (JavaScript version 6).
- CVE-2021-33449An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6).
- CVE-2021-33450An issue was discovered in NASM version 2.16rc0.
- CVE-2021-33442An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6).
- CVE-2021-33441An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6).
- CVE-2021-33440An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6).
- CVE-2021-33439An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6).
- CVE-2021-33438An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6).
- CVE-2021-33437An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6).
- CVE-2021-43959Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to access the content of Atlassian Jira Service Management Server · Atlassian Jira S…
- CVE-2022-33977untangle is a python library to convert XML data to python objects.Christian Stefanescu untangle · untangle
- CVE-2022-31471untangle is a python library to convert XML data to python objects.Christian Stefanescu untangle · untangle
- CVE-2022-30706Open redirect vulnerability in Booked versions prior to 3.3 allows a remote unauthenticated attacker to redirect a user to an arbitrary web Twinkle Toes Software Booked
- CVE-2020-36290The Livesearch macro in Confluence Server and Data Center before version 7.4.5, from version 7.5.0 before 7.6.3, and from version 7.7.0 befoAtlassian Confluence Server · Atlassian Confluence Data Cen…
- CVE-2022-22686Cross-Site Request Forgery (CSRF) vulnerability in webapi component in Synology Calendar before 2.3.4-0631 allows remote authenticated usersSynology Calendar
- CVE-2022-33745insufficient TLB flush for x86 PV guests in shadow mode For migration as well as to work around kernels unaware of L1TF (see XSA-273), PV guxen