# CVEs published 2022-07-26

115 CVEs were published on July 26, 2022: 2 critical, 5 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-33057](https://cve.now/CVE-2021-33057.md): The QQ application 8.7.1 for Android and iOS does not enforce the permission requirements (e.g., android.permission.ACCESS\_FINE\_LOCATION) fo (no CVSS)
- [CVE-2021-40180](https://cve.now/CVE-2021-40180.md): In the WeChat application 8.0.10 for Android and iOS, a mini program can obtain sensitive information from a user's address book via wx.sear (no CVSS)
- [CVE-2022-36129](https://cve.now/CVE-2022-36129.md): HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using Integrated Storage expose an unauthenticated API endpoint (no CVSS)
- [CVE-2022-30276](https://cve.now/CVE-2022-30276.md): The Motorola MOSCAD and ACE line of RTUs through 2022-05-02 omit an authentication requirement. (no CVSS)
- [CVE-2022-30269](https://cve.now/CVE-2022-30269.md): Motorola ACE1000 RTUs through 2022-05-02 mishandle application integrity. (no CVSS)
- [CVE-2022-30270](https://cve.now/CVE-2022-30270.md): The Motorola ACE1000 RTU through 2022-05-02 has default credentials. (no CVSS)
- [CVE-2022-30271](https://cve.now/CVE-2022-30271.md): The Motorola ACE1000 RTU through 2022-05-02 ships with a hardcoded SSH private key and initialization scripts (such as /etc/init.d/sshd\_serv (CVSS 9.8)
- [CVE-2022-30272](https://cve.now/CVE-2022-30272.md): The Motorola ACE1000 RTU through 2022-05-02 mishandles firmware integrity. (no CVSS)
- [CVE-2022-30274](https://cve.now/CVE-2022-30274.md): The Motorola ACE1000 RTU through 2022-05-02 uses ECB encryption unsafely. (no CVSS)
- [CVE-2022-1641](https://cve.now/CVE-2022-1641.md): Use after free in Web UI Diagnostics in Google Chrome on Chrome OS prior to 101.0.4951.64 allowed a remote attacker who convinced a user to (no CVSS, Google Chrome)
- [CVE-2022-1640](https://cve.now/CVE-2022-1640.md): Use after free in Sharing in Google Chrome prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UI in (no CVSS, Google Chrome)
- [CVE-2022-1639](https://cve.now/CVE-2022-1639.md): Use after free in ANGLE in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome)
- [CVE-2022-1638](https://cve.now/CVE-2022-1638.md): Heap buffer overflow in V8 Internationalization in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to potentially exploit hea (no CVSS, Google Chrome)
- [CVE-2022-1637](https://cve.now/CVE-2022-1637.md): Inappropriate implementation in Web Contents in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to leak cross-origin data via (no CVSS, Google Chrome)
- [CVE-2022-1636](https://cve.now/CVE-2022-1636.md): Use after free in Performance APIs in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to potentially exploit heap corruption (no CVSS, Google Chrome)
- [CVE-2022-1635](https://cve.now/CVE-2022-1635.md): Use after free in Permission Prompts in Google Chrome prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in spe (no CVSS, Google Chrome)
- [CVE-2022-1634](https://cve.now/CVE-2022-1634.md): Use after free in Browser UI in Google Chrome prior to 101.0.4951.64 allowed a remote attacker who had convinced a user to engage in specifi (no CVSS, Google Chrome)
- [CVE-2022-1633](https://cve.now/CVE-2022-1633.md): Use after free in Sharesheet in Google Chrome on Chrome OS prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage i (no CVSS, Google Chrome)
- [CVE-2022-29953](https://cve.now/CVE-2022-29953.md): The Bently Nevada 3700 series of condition monitoring equipment through 2022-04-29 has a maintenance interface on port 4001/TCP with undocum (no CVSS)
- [CVE-2022-29952](https://cve.now/CVE-2022-29952.md): Bently Nevada condition monitoring equipment through 2022-04-29 mishandles authentication. (no CVSS)
- [CVE-2022-1501](https://cve.now/CVE-2022-1501.md): Inappropriate implementation in iframe in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to leak cross-origin data via a cra (no CVSS, Google Chrome)
- [CVE-2022-1500](https://cve.now/CVE-2022-1500.md): Insufficient data validation in Dev Tools in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass content security polic (no CVSS, Google Chrome)
- [CVE-2022-1499](https://cve.now/CVE-2022-1499.md): Inappropriate implementation in WebAuthentication in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass same origin po (no CVSS, Google Chrome)
- [CVE-2022-1498](https://cve.now/CVE-2022-1498.md): Inappropriate implementation in HTML Parser in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to leak cross-origin data via (no CVSS, Google Chrome)
- [CVE-2022-1497](https://cve.now/CVE-2022-1497.md): Inappropriate implementation in Input in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to spoof the contents of cross-origi (no CVSS, Google Chrome)
- [CVE-2022-1496](https://cve.now/CVE-2022-1496.md): Use after free in File Manager in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via (no CVSS, Google Chrome)
- [CVE-2022-1495](https://cve.now/CVE-2022-1495.md): Incorrect security UI in Downloads in Google Chrome on Android prior to 101.0.4951.41 allowed a remote attacker to spoof the APK downloads d (no CVSS, Google Chrome)
- [CVE-2022-1494](https://cve.now/CVE-2022-1494.md): Insufficient data validation in Trusted Types in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass trusted types poli (no CVSS, Google Chrome)
- [CVE-2022-1493](https://cve.now/CVE-2022-1493.md): Use after free in Dev Tools in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via spe (no CVSS, Google Chrome)
- [CVE-2022-1492](https://cve.now/CVE-2022-1492.md): Insufficient data validation in Blink Editing in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to inject arbitrary scripts (no CVSS, Google Chrome)
- [CVE-2022-1491](https://cve.now/CVE-2022-1491.md): Use after free in Bookmarks in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via spe (no CVSS, Google Chrome)
- [CVE-2022-1490](https://cve.now/CVE-2022-1490.md): Use after free in Browser Switcher in Google Chrome prior to 101.0.4951.41 allowed a remote attacker who convinced a user to engage in speci (no CVSS, Google Chrome)
- [CVE-2022-1489](https://cve.now/CVE-2022-1489.md): Out of bounds memory access in UI Shelf in Google Chrome on Chrome OS, Lacros prior to 101.0.4951.41 allowed a remote attacker to potentiall (no CVSS, Google Chrome)
- [CVE-2022-1488](https://cve.now/CVE-2022-1488.md): Inappropriate implementation in Extensions API in Google Chrome prior to 101.0.4951.41 allowed an attacker who convinced a user to install a (no CVSS, Google Chrome)
- [CVE-2022-1487](https://cve.now/CVE-2022-1487.md): Use after free in Ozone in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via running (no CVSS, Google Chrome)
- [CVE-2022-1486](https://cve.now/CVE-2022-1486.md): Type confusion in V8 in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to obtain potentially sensitive information from proc (no CVSS, Google Chrome)
- [CVE-2022-1485](https://cve.now/CVE-2022-1485.md): Use after free in File System API in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption v (no CVSS, Google Chrome)
- [CVE-2022-1484](https://cve.now/CVE-2022-1484.md): Heap buffer overflow in Web UI Settings in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corrup (no CVSS, Google Chrome)
- [CVE-2022-1483](https://cve.now/CVE-2022-1483.md): Heap buffer overflow in WebGPU in Google Chrome prior to 101.0.4951.41 allowed a remote attacker who had compromised the renderer process to (no CVSS, Google Chrome)
- [CVE-2022-1482](https://cve.now/CVE-2022-1482.md): Inappropriate implementation in WebGL in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corrupti (no CVSS, Google Chrome)
- [CVE-2022-1481](https://cve.now/CVE-2022-1481.md): Use after free in Sharing in Google Chrome on Mac prior to 101.0.4951.41 allowed a remote attacker who convinced a user to engage in specifi (no CVSS, Google Chrome)
- [CVE-2022-1479](https://cve.now/CVE-2022-1479.md): Use after free in ANGLE in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome)
- [CVE-2022-1478](https://cve.now/CVE-2022-1478.md): Use after free in SwiftShader in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a (no CVSS, Google Chrome)
- [CVE-2022-1477](https://cve.now/CVE-2022-1477.md): Use after free in Vulkan in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a craf (no CVSS, Google Chrome)
- [CVE-2022-1364](https://cve.now/CVE-2022-1364.md): Type confusion in V8 Turbofan in Google Chrome prior to 100.0.4896.127 allowed a remote attacker to potentially exploit heap corruption via (CVSS 8.8, KEV, Google Chrome)
- [CVE-2022-31207](https://cve.now/CVE-2022-31207.md): The Omron SYSMAC Cx product family PLCs (CS series, CJ series, and CP series) through 2022-05-18 lack cryptographic authentication. (no CVSS)
- [CVE-2022-31205](https://cve.now/CVE-2022-31205.md): In Omron CS series, CJ series, and CP series PLCs through 2022-05-18, the password for access to the Web UI is stored in memory area D1449.. (no CVSS)
- [CVE-2022-31206](https://cve.now/CVE-2022-31206.md): The Omron SYSMAC Nx product family PLCs (NJ series, NY series, NX series, and PMAC series) through 2022-005-18 lack cryptographic authentica (no CVSS)
- [CVE-2022-31204](https://cve.now/CVE-2022-31204.md): Omron CS series, CJ series, and CP series PLCs through 2022-05-18 use cleartext passwords. (no CVSS)
- [CVE-2022-30275](https://cve.now/CVE-2022-30275.md): The Motorola MOSCAD Toolbox software through 2022-05-02 relies on a cleartext password. (no CVSS)
- [CVE-2022-30273](https://cve.now/CVE-2022-30273.md): The Motorola MDLC protocol through 2022-05-02 mishandles message integrity. (no CVSS)
- [CVE-2022-29957](https://cve.now/CVE-2022-29957.md): The Emerson DeltaV Distributed Control System (DCS) through 2022-04-29 mishandles authentication. (no CVSS)
- [CVE-2022-29960](https://cve.now/CVE-2022-29960.md): Emerson OpenBSI through 2022-04-29 uses weak cryptography. (no CVSS)
- [CVE-2022-29962](https://cve.now/CVE-2022-29962.md): The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. (no CVSS)
- [CVE-2022-29963](https://cve.now/CVE-2022-29963.md): The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. (no CVSS)
- [CVE-2022-29964](https://cve.now/CVE-2022-29964.md): The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. (no CVSS)
- [CVE-2022-29965](https://cve.now/CVE-2022-29965.md): The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. (no CVSS)
- [CVE-2022-27105](https://cve.now/CVE-2022-27105.md): InMailX Outlook Plugin \< 3.22.0101 is vulnerable to Cross Site Scripting (XSS). (no CVSS)
- [CVE-2022-29951](https://cve.now/CVE-2022-29951.md): JTEKT TOYOPUC PLCs through 2022-04-29 mishandle authentication. (CVSS 9.1)
- [CVE-2022-29958](https://cve.now/CVE-2022-29958.md): JTEKT TOYOPUC PLCs through 2022-04-29 do not ensure data integrity. (no CVSS)
- [CVE-2022-1651](https://cve.now/CVE-2022-1651.md): A memory leak flaw was found in the Linux kernel in acrn\_dev\_ioctl in the drivers/virt/acrn/hsm.c function in how the ACRN Device Model emul (no CVSS, Kernel)
- [CVE-2022-1671](https://cve.now/CVE-2022-1671.md): A NULL pointer dereference flaw was found in rxrpc\_preparse\_s in net/rxrpc/server\_key.c in the Linux kernel. (no CVSS, Kernel)
- [CVE-2022-35639](https://cve.now/CVE-2022-35639.md): IBM Sterling Partner Engagement Manager 6.1, 6.2, and Cloud 22.2 do not limit the length of a connection which could cause the server to bec (CVSS 7.5, IBM Sterling Partner Engagement Manager)
- [CVE-2022-35286](https://cve.now/CVE-2022-35286.md): IBM Security Verify Information Queue 10.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious (CVSS 3.1, IBM Security Verify Information Queue)
- [CVE-2022-22412](https://cve.now/CVE-2022-22412.md): IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a user with access to the local host (client machine) to obtain a logi (CVSS 4.2, IBM Robotic Process Automation)
- [CVE-2022-1648](https://cve.now/CVE-2022-1648.md): Relative Path Traversal to Remote Code Execution in File Manager (CVSS 5.7, Artica PFMS Pandora FMS)
- [CVE-2022-36412](https://cve.now/CVE-2022-36412.md): In Zoho ManageEngine SupportCenter Plus before 11023, V3 API requests are vulnerable to authentication bypass. (no CVSS)
- [CVE-2022-34988](https://cve.now/CVE-2022-34988.md): Inout Blockchain AltExchanger v1.2.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/js. (no CVSS)
- [CVE-2022-34991](https://cve.now/CVE-2022-34991.md): Paymoney v3.3 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities via the first\_name and last\_name param (no CVSS)
- [CVE-2022-34989](https://cve.now/CVE-2022-34989.md): Fruits Bazar v1.0 was discovered to contain a SQL injection vulnerability via the recover\_email parameter at user\_password\_recover.php. (no CVSS)
- [CVE-2022-36161](https://cve.now/CVE-2022-36161.md): Orange Station 1.0 was discovered to contain a SQL injection vulnerability via the username parameter. (no CVSS)
- [CVE-2022-34067](https://cve.now/CVE-2022-34067.md): Warehouse Management System v1.0 was discovered to contain a SQL injection vulnerability via the cari parameter. (no CVSS)
- [CVE-2022-31879](https://cve.now/CVE-2022-31879.md): Online Fire Reporting System 1.0 is vulnerable to SQL Injection via the date parameter. (no CVSS)
- [CVE-2021-33461](https://cve.now/CVE-2021-33461.md): An issue was discovered in yasm version 1.3.0. (no CVSS)
- [CVE-2021-33462](https://cve.now/CVE-2021-33462.md): An issue was discovered in yasm version 1.3.0. (no CVSS)
- [CVE-2021-33463](https://cve.now/CVE-2021-33463.md): An issue was discovered in yasm version 1.3.0. (no CVSS)
- [CVE-2021-33464](https://cve.now/CVE-2021-33464.md): An issue was discovered in yasm version 1.3.0. (no CVSS)
- [CVE-2021-33465](https://cve.now/CVE-2021-33465.md): An issue was discovered in yasm version 1.3.0. (no CVSS)
- [CVE-2021-33466](https://cve.now/CVE-2021-33466.md): An issue was discovered in yasm version 1.3.0. (no CVSS)
- [CVE-2021-33467](https://cve.now/CVE-2021-33467.md): An issue was discovered in yasm version 1.3.0. (no CVSS)
- [CVE-2021-33468](https://cve.now/CVE-2021-33468.md): An issue was discovered in yasm version 1.3.0. (no CVSS)
- [CVE-2021-33460](https://cve.now/CVE-2021-33460.md): An issue was discovered in yasm version 1.3.0. (no CVSS)
- [CVE-2021-33459](https://cve.now/CVE-2021-33459.md): An issue was discovered in yasm version 1.3.0. (no CVSS)
- [CVE-2021-33458](https://cve.now/CVE-2021-33458.md): An issue was discovered in yasm version 1.3.0. (no CVSS)
- [CVE-2021-33457](https://cve.now/CVE-2021-33457.md): An issue was discovered in yasm version 1.3.0. (no CVSS)
- [CVE-2021-33456](https://cve.now/CVE-2021-33456.md): An issue was discovered in yasm version 1.3.0. (no CVSS)
- [CVE-2021-33455](https://cve.now/CVE-2021-33455.md): An issue was discovered in yasm version 1.3.0. (no CVSS)
- [CVE-2021-33454](https://cve.now/CVE-2021-33454.md): An issue was discovered in yasm version 1.3.0. (no CVSS)
- [CVE-2021-33453](https://cve.now/CVE-2021-33453.md): An issue was discovered in lrzip version 0.641. (no CVSS)
- [CVE-2021-33452](https://cve.now/CVE-2021-33452.md): An issue was discovered in NASM version 2.16rc0. (no CVSS)
- [CVE-2021-33451](https://cve.now/CVE-2021-33451.md): An issue was discovered in lrzip version 0.641. (no CVSS)
- [CVE-2021-33443](https://cve.now/CVE-2021-33443.md): An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). (no CVSS)
- [CVE-2021-33444](https://cve.now/CVE-2021-33444.md): An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). (no CVSS)
- [CVE-2021-33445](https://cve.now/CVE-2021-33445.md): An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). (no CVSS)
- [CVE-2021-33446](https://cve.now/CVE-2021-33446.md): An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). (no CVSS)
- [CVE-2021-33447](https://cve.now/CVE-2021-33447.md): An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). (no CVSS)
- [CVE-2021-33448](https://cve.now/CVE-2021-33448.md): An issue was discovered in mjs(mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). (no CVSS)
- [CVE-2021-33449](https://cve.now/CVE-2021-33449.md): An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). (no CVSS)
- [CVE-2021-33450](https://cve.now/CVE-2021-33450.md): An issue was discovered in NASM version 2.16rc0. (no CVSS)
- [CVE-2021-33442](https://cve.now/CVE-2021-33442.md): An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). (no CVSS)
- [CVE-2021-33441](https://cve.now/CVE-2021-33441.md): An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). (no CVSS)
- [CVE-2021-33440](https://cve.now/CVE-2021-33440.md): An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). (no CVSS)
- [CVE-2021-33439](https://cve.now/CVE-2021-33439.md): An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). (no CVSS)
- [CVE-2021-33438](https://cve.now/CVE-2021-33438.md): An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). (no CVSS)
- [CVE-2021-33437](https://cve.now/CVE-2021-33437.md): An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). (no CVSS)
- [CVE-2022-2225](https://cve.now/CVE-2022-2225.md): Zero Trust Secure Web Gateway policies bypass using WARP client subcommands (CVSS 8.1, Cloudflare WARP)
- [CVE-2021-43959](https://cve.now/CVE-2021-43959.md): Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to access the content of (no CVSS, Atlassian Jira Service Management Server · Atlassian Jira S…)
- [CVE-2022-33977](https://cve.now/CVE-2022-33977.md): untangle is a python library to convert XML data to python objects. (no CVSS, Christian Stefanescu untangle · untangle)
- [CVE-2022-31471](https://cve.now/CVE-2022-31471.md): untangle is a python library to convert XML data to python objects. (no CVSS, Christian Stefanescu untangle · untangle)
- [CVE-2022-30706](https://cve.now/CVE-2022-30706.md): Open redirect vulnerability in Booked versions prior to 3.3 allows a remote unauthenticated attacker to redirect a user to an arbitrary web (no CVSS, Twinkle Toes Software Booked)
- [CVE-2022-1042](https://cve.now/CVE-2022-1042.md): Out-of-bound write vulnerability in the Bluetooth mesh core stack can be triggered during provisioning (CVSS 8.2, zephyrproject-rtos zephyr)
- [CVE-2022-1041](https://cve.now/CVE-2022-1041.md): Out-of-bound write vulnerability in the Bluetooth mesh core stack can be triggered during provisioning (CVSS 8.2, zephyrproject-rtos zephyr)
- [CVE-2020-36290](https://cve.now/CVE-2020-36290.md): The Livesearch macro in Confluence Server and Data Center before version 7.4.5, from version 7.5.0 before 7.6.3, and from version 7.7.0 befo (no CVSS, Atlassian Confluence Server · Atlassian Confluence Data Cen…)
- [CVE-2022-22686](https://cve.now/CVE-2022-22686.md): Cross-Site Request Forgery (CSRF) vulnerability in webapi component in Synology Calendar before 2.3.4-0631 allows remote authenticated users (CVSS 6.5, Synology Calendar)
- [CVE-2022-33745](https://cve.now/CVE-2022-33745.md): insufficient TLB flush for x86 PV guests in shadow mode For migration as well as to work around kernels unaware of L1TF (see XSA-273), PV gu (no CVSS, xen)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-07-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.