CVEs published July 27, 2022
113 CVEs were published on July 27, 2022: 7 critical, 9 high.
- Published
- 113
- Critical
- 7
- High
- 9
- Medium
- 11
- Low
- 0
- Unrated
- 86
- Now in CISA KEV
- 0
- Fix available
- 53
Most affected products
- Google Chrome
- 24
- Jenkins project Jenkins OpenShift Deployer Plugin · org.jen…
- 4
- Jenkins project Jenkins Coverity Plugin · org.jenkins-ci.pl…
- 3
- Jenkins project Jenkins Deployer Framework Plugin · org.jen…
- 3
- Jenkins project Jenkins Git Plugin · org.jenkins-ci.plugins…
- 3
- Jenkins project Jenkins Openstack Heat Plugin · org.jenkins…
- 3
- VISAM VBASE Pro-RT/ Server-RT
- 3
- Adobe Acrobat Reader
- 2
- feehi/cms
- 2
- Jenkins project Jenkins Compuware ISPW Operations Plugin ·…
- 2
Critical 7
- CVE-2022-36949In Veritas NetBackup OpsCenter, an attacker with local access to a NetBackup OpsCenter server could potentially escalate their privileges.
- CVE-2022-36950In Veritas NetBackup OpsCenter, an unauthenticated remote attacker may be able to perform remote command execution through a Java classloade
- CVE-2022-36951In Veritas NetBackup OpsCenter, an unauthenticated remote attacker may compromise the host by exploiting an incorrectly patched vulnerabilit
- CVE-2022-36954In Veritas NetBackup OpsCenter, under specific conditions, an authenticated remote attacker may be able to create or modify OpsCenter user a
- CVE-2022-36956In Veritas NetBackup, the NetBackup Client allows arbitrary command execution from any remote host that has access to a valid host-id NetBac
- CVE-2022-2550OS Command Injection in hestiacp/hestiacphestiacp/hestiacp
- CVE-2022-2310Skyhigh SWG Authentication bypass vulnerabilitySkyhigh Security Skyhigh Secure Web Gateway
High 9
- CVE-2022-36952In Veritas NetBackup OpsCenter, a hard-coded credential exists that could be used to exploit the underlying VxSS subsystem.
- CVE-2022-36955In Veritas NetBackup, an attacker with unprivileged local access to a NetBackup Client may send specific commands to escalate their privileg
- CVE-2021-38410AVEVA PCS Portal Uncontrolled Search Path ElementAVEVA Platform Common Services (PCS) Portal
- CVE-2021-38417VISAM VBASE Editor Improper Access ControlVISAM VBASE Pro-RT/ Server-RT
- CVE-2022-35672Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2022-35291Privilege escalation vulnerability in SAP SuccessFactors attachment API for Mobile Application(Android & iOS)SAP SuccessFactors Mobile Application for Android & iOS dev…
- CVE-2022-33970WordPress Shortcode Addons plugin <= 3.1.2 - Authenticated WordPress Options Change vulnerabilityBiplob018 Shortcode Addons
- CVE-2022-2313DLL high jacking in Trellix AgentTrellix Agent
- CVE-2022-36946nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (pa
Medium, low and unrated 97
- CVE-2022-34140A stored cross-site scripting (XSS) vulnerability in /index.php?r=site%2Fsignup of Feehi CMS v2.1.1 allows attackers to execute arbitrary wefeehi/cms
- CVE-2022-34009Fossil 2.18 on Windows allows attackers to cause a denial of service (daemon crash) via an XSS payload in a ticket.
- CVE-2021-33371A stored cross-site scripting (XSS) vulnerability in /nav_bar_action.php of Student Management System v1.0 allows attackers to execute arbit
- CVE-2021-46830A path traversal vulnerability exists within GoAnywhere MFT before 6.8.3 that utilize self-registration for the GoAnywhere Web Client.
- CVE-2022-1876Heap buffer overflow in DevTools in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extGoogle Chrome
- CVE-2022-1875Inappropriate implementation in PDF in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to leak cross-origin data via a crafteGoogle Chrome
- CVE-2022-1874Insufficient policy enforcement in Safe Browsing in Google Chrome on Mac prior to 102.0.5005.61 allowed a remote attacker to bypass downloadGoogle Chrome
- CVE-2022-1873Insufficient policy enforcement in COOP in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to leak cross-origin data via a crGoogle Chrome
- CVE-2022-1872Insufficient policy enforcement in Extensions API in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to instalGoogle Chrome
- CVE-2022-1871Insufficient policy enforcement in File System API in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to instaGoogle Chrome
- CVE-2022-1870Use after free in App Service in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extensGoogle Chrome
- CVE-2022-1869Type Confusion in V8 in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2022-1868Inappropriate implementation in Extensions API in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install aGoogle Chrome
- CVE-2022-1867Insufficient validation of untrusted input in Data Transfer in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to bypass sameGoogle Chrome
- CVE-2022-1866Use after free in Tablet Mode in Google Chrome on Chrome OS prior to 102.0.5005.61 allowed a remote attacker who convinced a user to engage Google Chrome
- CVE-2022-1865Use after free in Bookmarks in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extensioGoogle Chrome
- CVE-2022-1864Use after free in WebApp Installs in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious exGoogle Chrome
- CVE-2022-1863Use after free in Tab Groups in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extensiGoogle Chrome
- CVE-2022-1862Inappropriate implementation in Extensions in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malGoogle Chrome
- CVE-2022-1861Use after free in Sharing in Google Chrome on Chrome OS prior to 102.0.5005.61 allowed a remote attacker who convinced a user to enage in spGoogle Chrome
- CVE-2022-1860Use after free in UI Foundations in Google Chrome on Chrome OS prior to 102.0.5005.61 allowed a remote attacker who convinced a user to engaGoogle Chrome
- CVE-2022-1859Use after free in Performance Manager in Google Chrome prior to 102.0.5005.61 allowed a remote attacker who convinced a user to engage in spGoogle Chrome
- CVE-2022-1858Out of bounds read in DevTools in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to perform an out of bounds memory read viaGoogle Chrome
- CVE-2022-1857Insufficient policy enforcement in File System API in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to bypass file system rGoogle Chrome
- CVE-2022-1856Use after free in User Education in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extGoogle Chrome
- CVE-2022-1855Use after free in Messaging in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially exploit heap corruption via a cGoogle Chrome
- CVE-2022-1854Use after free in ANGLE in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2022-1853Use after free in Indexed DB in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially perform a sandbox escape via aGoogle Chrome
- CVE-2022-36948In Veritas NetBackup OpsCenter, a DOM XSS attack can occur.
- CVE-2022-36953In Veritas NetBackup OpsCenter, certain endpoints could allow an unauthenticated remote attacker to gain sensitive information.
- CVE-2021-42535VISAM VBASE Editor Cross Site ScriptingVISAM VBASE Pro-RT/ Server-RT
- CVE-2021-42537VISAM VBASE Editor Improper Restriction of XMLVISAM VBASE Pro-RT/ Server-RT
- CVE-2020-6998Rockwell Automation CompactLogix 5370 and ControlLogix 5570 Controllers Improper Input ValidationRockwell Automation Armor Compact GuardLogix 5370 contro… +5
- CVE-2022-35911On Patlite NH-FB series devices through 1.46, remote attackers can cause a denial of service by omitting the query string.
- CVE-2022-34121Cuppa CMS v1.0 was discovered to contain a local file inclusion (LFI) vulnerability via the component /templates/default/html/windows/right.
- CVE-2022-34120Barangay Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the module editing function at /pa
- CVE-2022-33943WordPress BxSlider WP plugin <= 2.0.0 - Authenticated Cross-Site Scripting (XSS) vulnerabilityNico Amarilla BxSlider WP
- CVE-2022-35669Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Acrobat Reader
- CVE-2022-2549NULL Pointer Dereference in gpac/gpacgpac/gpac
- CVE-2022-36922Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not escape the search query parameter displayed on the 'search' result page,Jenkins project Jenkins Lucene-Search Plugin · org.jenkins-…
- CVE-2022-36921A missing permission check in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers with Overall/Read permission to connect to an attaJenkins project Jenkins Coverity Plugin · org.jenkins-ci.pl…
- CVE-2022-36920A cross-site request forgery (CSRF) vulnerability in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers to connect to an attacker-sJenkins project Jenkins Coverity Plugin · org.jenkins-ci.pl…
- CVE-2022-36919A missing permission check in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers with Overall/Read permission to enumerate credentiJenkins project Jenkins Coverity Plugin · org.jenkins-ci.pl…
- CVE-2022-36918Jenkins Buckminster Plugin 1.1.1 and earlier does not perform a permission check in a method implementing form validation, allowing attackerJenkins project Jenkins Buckminster Plugin · org.jenkins-ci…
- CVE-2022-36917A missing permission check in Jenkins Google Cloud Backup Plugin 0.6 and earlier allows attackers with Overall/Read permission to request a Jenkins project Jenkins Google Cloud Backup Plugin · org.je…
- CVE-2022-36916A cross-site request forgery (CSRF) vulnerability in Jenkins Google Cloud Backup Plugin 0.6 and earlier allows attackers to request a manualJenkins project Jenkins Google Cloud Backup Plugin · org.je…
- CVE-2022-36915Jenkins Android Signing Plugin 2.2.5 and earlier does not perform a permission check in a method implementing form validation, allowing attaJenkins project Jenkins Android Signing Plugin · org.jenkin…
- CVE-2022-36914Jenkins Files Found Trigger Plugin 1.5 and earlier does not perform a permission check in a method implementing form validation, allowing atJenkins project Jenkins Files Found Trigger Plugin · org.je…
- CVE-2022-36913Jenkins Openstack Heat Plugin 1.5 and earlier does not perform permission checks in methods implementing form validation, allowing attackersJenkins project Jenkins Openstack Heat Plugin · org.jenkins…
- CVE-2022-36912A missing permission check in Jenkins Openstack Heat Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an aJenkins project Jenkins Openstack Heat Plugin · org.jenkins…
- CVE-2022-36911A cross-site request forgery (CSRF) vulnerability in Jenkins Openstack Heat Plugin 1.5 and earlier allows attackers to connect to an attackeJenkins project Jenkins Openstack Heat Plugin · org.jenkins…
- CVE-2022-36910Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not perform a permission check in several HTTP endpoints, allowing attackersJenkins project Jenkins Lucene-Search Plugin · org.jenkins-…
- CVE-2022-36909A missing permission check in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers with Overall/Read permission to check forJenkins project Jenkins OpenShift Deployer Plugin · org.jen…
- CVE-2022-36908A cross-site request forgery (CSRF) vulnerability in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers to check for the eJenkins project Jenkins OpenShift Deployer Plugin · org.jen…
- CVE-2022-36907A missing permission check in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers with Overall/Read permission to connect tJenkins project Jenkins OpenShift Deployer Plugin · org.jen…
- CVE-2022-36906A cross-site request forgery (CSRF) vulnerability in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers to connect to an aJenkins project Jenkins OpenShift Deployer Plugin · org.jen…
- CVE-2022-36905Jenkins Maven Metadata Plugin for Jenkins CI server Plugin 2.2 and earlier does not perform URL validation for the Repository Base URL of LiJenkins project Jenkins Maven Metadata Plugin for Jenkins C…
- CVE-2022-36904Jenkins Repository Connector Plugin 2.2.0 and earlier does not perform a permission check in a method implementing form validation, allowingJenkins project Jenkins Repository Connector Plugin · org.j…
- CVE-2022-36903A missing permission check in Jenkins Repository Connector Plugin 2.2.0 and earlier allows attackers with Overall/Read permission to enumeraJenkins project Jenkins Repository Connector Plugin · org.j…
- CVE-2022-36902Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape several fields of Moded Extended Choice parameters, resulJenkins project Jenkins Dynamic Extended Choice Parameter P…
- CVE-2022-36901Jenkins HTTP Request Plugin 1.15 and earlier stores HTTP Request passwords unencrypted in its global configuration file on the Jenkins contrJenkins project Jenkins HTTP Request Plugin · org.jenkins-c…
- CVE-2022-36900Jenkins Compuware zAdviser API Plugin 1.0.3 and earlier does not restrict execution of a controller/agent message to agents, allowing attackJenkins project Jenkins Compuware zAdviser API Plugin · com…
- CVE-2022-36899Jenkins Compuware ISPW Operations Plugin 1.0.8 and earlier does not restrict execution of a controller/agent message to agents, allowing attJenkins project Jenkins Compuware ISPW Operations Plugin ·…
- CVE-2022-36898A missing permission check in Jenkins Compuware ISPW Operations Plugin 1.0.8 and earlier allows attackers with Overall/Read permission to enJenkins project Jenkins Compuware ISPW Operations Plugin ·…
- CVE-2022-36897A missing permission check in Jenkins Compuware Xpediter Code Coverage Plugin 1.0.7 and earlier allows attackers with Overall/Read permissioJenkins project Jenkins Compuware Xpediter Code Coverage Pl…
- CVE-2022-36896A missing permission check in Jenkins Compuware Source Code Download for Endevor, PDS, and ISPW Plugin 2.0.12 and earlier allows attackers wJenkins project Jenkins Compuware Source Code Download for…
- CVE-2022-36895A missing permission check in Jenkins Compuware Topaz Utilities Plugin 1.0.8 and earlier allows attackers with Overall/Read permission to enJenkins project Jenkins Compuware Topaz Utilities Plugin ·…
- CVE-2022-36894An arbitrary file write vulnerability in Jenkins CLIF Performance Testing Plugin 64.vc0d66de1dfb_f and earlier allows attackers with OverallJenkins project Jenkins CLIF Performance Testing Plugin · o…
- CVE-2022-36893Jenkins rpmsign-plugin Plugin 0.5.0 and earlier does not perform a permission check in a method implementing form validation, allowing attacJenkins project Jenkins rpmsign-plugin Plugin · org.jenkins…
- CVE-2022-36892Jenkins rhnpush-plugin Plugin 0.5.1 and earlier does not perform a permission check in a method implementing form validation, allowing attacJenkins project Jenkins rhnpush-plugin Plugin · org.jenkins…
- CVE-2022-36891A missing permission check in Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier allows attackers with Item/Read permission but Jenkins project Jenkins Deployer Framework Plugin · org.jen…
- CVE-2022-36890Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the name of files in methods implementing form validation, Jenkins project Jenkins Deployer Framework Plugin · org.jen…
- CVE-2022-36889Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the application path of the applications when configuring aJenkins project Jenkins Deployer Framework Plugin · org.jen…
- CVE-2022-36888A missing permission check in Jenkins HashiCorp Vault Plugin 354.vdb_858fd6b_f48 and earlier allows attackers with Overall/Read permission tJenkins project Jenkins HashiCorp Vault Plugin · com.datapi…
- CVE-2022-36887A cross-site request forgery (CSRF) vulnerability in Jenkins Job Configuration History Plugin 1155.v28a_46a_cc06a_5 and earlier allows attacJenkins project Jenkins Job Configuration History Plugin ·…
- CVE-2022-36886A cross-site request forgery (CSRF) vulnerability in Jenkins External Monitor Job Type Plugin 191.v363d0d1efdf8 and earlier allows attackersJenkins project Jenkins External Monitor Job Type Plugin ·…
- CVE-2022-36885Jenkins GitHub Plugin 1.34.4 and earlier uses a non-constant time comparison function when checking whether the provided and computed webhooJenkins project Jenkins GitHub Plugin · com.coravy.hudson.p…
- CVE-2022-36884The webhook endpoint in Jenkins Git Plugin 4.11.3 and earlier provide unauthenticated attackers information about the existence of jobs confJenkins project Jenkins Git Plugin · org.jenkins-ci.plugins…
- CVE-2022-36883A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured toJenkins project Jenkins Git Plugin · org.jenkins-ci.plugins…
- CVE-2022-36882A cross-site request forgery (CSRF) vulnerability in Jenkins Git Plugin 4.11.3 and earlier allows attackers to trigger builds of jobs configJenkins project Jenkins Git Plugin · org.jenkins-ci.plugins…
- CVE-2022-36881Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enablinJenkins project Jenkins Git client Plugin · org.jenkins-ci.…
- CVE-2022-24406OX App Suite through 7.10.6 allows SSRF because multipart/form-data boundaries are predictable, and this can lead to injection into internal
- CVE-2022-24405OX App Suite through 7.10.6 allows OS Command Injection via a serialized Java class to the Documentconverter API.
- CVE-2022-23101OX App Suite through 7.10.6 allows XSS via appHandler in a deep link in an e-mail message.
- CVE-2022-23099OX App Suite through 7.10.6 allows XSS by forcing block-wise read.
- CVE-2022-23100OX App Suite through 7.10.6 allows OS Command Injection via Documentconverter (e.g., through an email attachment).
- CVE-2022-34551Sims v1.0 was discovered to allow path traversal when downloading attachments.
- CVE-2022-34549Sims v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /uploadServlet.
- CVE-2022-34550Sims v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /addNotifyServlet.
- CVE-2022-34529WASM3 v0.5.0 was discovered to contain a segmentation fault via the component Compile_Memory_CopyFill.pywasm3 · wasm3
- CVE-2022-27610Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology DiskStation ManSynology DiskStation Manager
- CVE-2022-36880The Read Mail module in Webmin 1.995 and Usermin through 1.850 allows XSS via a crafted HTML e-mail message.
- CVE-2022-36879An issue was discovered in the Linux kernel through 5.18.14.
- CVE-2022-34594Advanced School Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component ip/school/moud
- CVE-2022-34611A cross-site scripting (XSS) vulnerability in /index.php/?p=report of Online Fire Reporting System v1.0 allows attackers to execute arbitrar
- CVE-2022-34971An arbitrary file upload vulnerability in the Advertising Management module of Feehi CMS v2.1.1 allows attackers to execute arbitrary code vfeehi/cms
- CVE-2022-34612Rizin v0.4.0 and below was discovered to contain an integer overflow via the function get_long_object().