# CVEs published 2022-07-27

113 CVEs were published on July 27, 2022: 7 critical, 9 high. Days are UTC.

- [CVE-2022-34140](https://cve.now/CVE-2022-34140.md): A stored cross-site scripting (XSS) vulnerability in /index.php?r=site%2Fsignup of Feehi CMS v2.1.1 allows attackers to execute arbitrary we (no CVSS, feehi/cms)
- [CVE-2022-34009](https://cve.now/CVE-2022-34009.md): Fossil 2.18 on Windows allows attackers to cause a denial of service (daemon crash) via an XSS payload in a ticket. (no CVSS)
- [CVE-2021-33371](https://cve.now/CVE-2021-33371.md): A stored cross-site scripting (XSS) vulnerability in /nav\_bar\_action.php of Student Management System v1.0 allows attackers to execute arbit (no CVSS)
- [CVE-2021-46830](https://cve.now/CVE-2021-46830.md): A path traversal vulnerability exists within GoAnywhere MFT before 6.8.3 that utilize self-registration for the GoAnywhere Web Client. (no CVSS)
- [CVE-2022-1876](https://cve.now/CVE-2022-1876.md): Heap buffer overflow in DevTools in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious ext (no CVSS, Google Chrome)
- [CVE-2022-1875](https://cve.now/CVE-2022-1875.md): Inappropriate implementation in PDF in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to leak cross-origin data via a crafte (no CVSS, Google Chrome)
- [CVE-2022-1874](https://cve.now/CVE-2022-1874.md): Insufficient policy enforcement in Safe Browsing in Google Chrome on Mac prior to 102.0.5005.61 allowed a remote attacker to bypass download (no CVSS, Google Chrome)
- [CVE-2022-1873](https://cve.now/CVE-2022-1873.md): Insufficient policy enforcement in COOP in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to leak cross-origin data via a cr (no CVSS, Google Chrome)
- [CVE-2022-1872](https://cve.now/CVE-2022-1872.md): Insufficient policy enforcement in Extensions API in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to instal (no CVSS, Google Chrome)
- [CVE-2022-1871](https://cve.now/CVE-2022-1871.md): Insufficient policy enforcement in File System API in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to insta (no CVSS, Google Chrome)
- [CVE-2022-1870](https://cve.now/CVE-2022-1870.md): Use after free in App Service in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extens (no CVSS, Google Chrome)
- [CVE-2022-1869](https://cve.now/CVE-2022-1869.md): Type Confusion in V8 in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially exploit heap corruption via a crafted (no CVSS, Google Chrome)
- [CVE-2022-1868](https://cve.now/CVE-2022-1868.md): Inappropriate implementation in Extensions API in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a (no CVSS, Google Chrome)
- [CVE-2022-1867](https://cve.now/CVE-2022-1867.md): Insufficient validation of untrusted input in Data Transfer in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to bypass same (no CVSS, Google Chrome)
- [CVE-2022-1866](https://cve.now/CVE-2022-1866.md): Use after free in Tablet Mode in Google Chrome on Chrome OS prior to 102.0.5005.61 allowed a remote attacker who convinced a user to engage (no CVSS, Google Chrome)
- [CVE-2022-1865](https://cve.now/CVE-2022-1865.md): Use after free in Bookmarks in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extensio (no CVSS, Google Chrome)
- [CVE-2022-1864](https://cve.now/CVE-2022-1864.md): Use after free in WebApp Installs in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious ex (no CVSS, Google Chrome)
- [CVE-2022-1863](https://cve.now/CVE-2022-1863.md): Use after free in Tab Groups in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extensi (no CVSS, Google Chrome)
- [CVE-2022-1862](https://cve.now/CVE-2022-1862.md): Inappropriate implementation in Extensions in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a mal (no CVSS, Google Chrome)
- [CVE-2022-1861](https://cve.now/CVE-2022-1861.md): Use after free in Sharing in Google Chrome on Chrome OS prior to 102.0.5005.61 allowed a remote attacker who convinced a user to enage in sp (no CVSS, Google Chrome)
- [CVE-2022-1860](https://cve.now/CVE-2022-1860.md): Use after free in UI Foundations in Google Chrome on Chrome OS prior to 102.0.5005.61 allowed a remote attacker who convinced a user to enga (no CVSS, Google Chrome)
- [CVE-2022-1859](https://cve.now/CVE-2022-1859.md): Use after free in Performance Manager in Google Chrome prior to 102.0.5005.61 allowed a remote attacker who convinced a user to engage in sp (no CVSS, Google Chrome)
- [CVE-2022-1858](https://cve.now/CVE-2022-1858.md): Out of bounds read in DevTools in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to perform an out of bounds memory read via (no CVSS, Google Chrome)
- [CVE-2022-1857](https://cve.now/CVE-2022-1857.md): Insufficient policy enforcement in File System API in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to bypass file system r (no CVSS, Google Chrome)
- [CVE-2022-1856](https://cve.now/CVE-2022-1856.md): Use after free in User Education in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious ext (no CVSS, Google Chrome)
- [CVE-2022-1855](https://cve.now/CVE-2022-1855.md): Use after free in Messaging in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially exploit heap corruption via a c (no CVSS, Google Chrome)
- [CVE-2022-1854](https://cve.now/CVE-2022-1854.md): Use after free in ANGLE in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome)
- [CVE-2022-1853](https://cve.now/CVE-2022-1853.md): Use after free in Indexed DB in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially perform a sandbox escape via a (no CVSS, Google Chrome)
- [CVE-2022-36948](https://cve.now/CVE-2022-36948.md): In Veritas NetBackup OpsCenter, a DOM XSS attack can occur. (CVSS 5.4)
- [CVE-2022-36949](https://cve.now/CVE-2022-36949.md): In Veritas NetBackup OpsCenter, an attacker with local access to a NetBackup OpsCenter server could potentially escalate their privileges. (CVSS 9.3)
- [CVE-2022-36950](https://cve.now/CVE-2022-36950.md): In Veritas NetBackup OpsCenter, an unauthenticated remote attacker may be able to perform remote command execution through a Java classloade (CVSS 9.8)
- [CVE-2022-36951](https://cve.now/CVE-2022-36951.md): In Veritas NetBackup OpsCenter, an unauthenticated remote attacker may compromise the host by exploiting an incorrectly patched vulnerabilit (CVSS 9.8)
- [CVE-2022-36952](https://cve.now/CVE-2022-36952.md): In Veritas NetBackup OpsCenter, a hard-coded credential exists that could be used to exploit the underlying VxSS subsystem. (CVSS 8.4)
- [CVE-2022-36953](https://cve.now/CVE-2022-36953.md): In Veritas NetBackup OpsCenter, certain endpoints could allow an unauthenticated remote attacker to gain sensitive information. (CVSS 4.3)
- [CVE-2022-36954](https://cve.now/CVE-2022-36954.md): In Veritas NetBackup OpsCenter, under specific conditions, an authenticated remote attacker may be able to create or modify OpsCenter user a (CVSS 9.9)
- [CVE-2022-36955](https://cve.now/CVE-2022-36955.md): In Veritas NetBackup, an attacker with unprivileged local access to a NetBackup Client may send specific commands to escalate their privileg (CVSS 7.8)
- [CVE-2022-36956](https://cve.now/CVE-2022-36956.md): In Veritas NetBackup, the NetBackup Client allows arbitrary command execution from any remote host that has access to a valid host-id NetBac (CVSS 9.0)
- [CVE-2021-38410](https://cve.now/CVE-2021-38410.md): AVEVA PCS Portal Uncontrolled Search Path Element (CVSS 7.3, AVEVA Platform Common Services (PCS) Portal)
- [CVE-2021-42535](https://cve.now/CVE-2021-42535.md): VISAM VBASE Editor Cross Site Scripting (CVSS 5.3, VISAM VBASE Pro-RT/ Server-RT)
- [CVE-2021-38417](https://cve.now/CVE-2021-38417.md): VISAM VBASE Editor Improper Access Control (CVSS 7.4, VISAM VBASE Pro-RT/ Server-RT)
- [CVE-2021-42537](https://cve.now/CVE-2021-42537.md): VISAM VBASE Editor Improper Restriction of XML (CVSS 5.9, VISAM VBASE Pro-RT/ Server-RT)
- [CVE-2020-6998](https://cve.now/CVE-2020-6998.md): Rockwell Automation CompactLogix 5370 and ControlLogix 5570 Controllers Improper Input Validation (CVSS 5.8, Rockwell Automation Armor Compact GuardLogix 5370 contro… +5)
- [CVE-2022-35911](https://cve.now/CVE-2022-35911.md): On Patlite NH-FB series devices through 1.46, remote attackers can cause a denial of service by omitting the query string. (no CVSS)
- [CVE-2022-34121](https://cve.now/CVE-2022-34121.md): Cuppa CMS v1.0 was discovered to contain a local file inclusion (LFI) vulnerability via the component /templates/default/html/windows/right. (no CVSS)
- [CVE-2022-34120](https://cve.now/CVE-2022-34120.md): Barangay Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the module editing function at /pa (no CVSS)
- [CVE-2022-33943](https://cve.now/CVE-2022-33943.md): WordPress BxSlider WP plugin \<= 2.0.0 - Authenticated Cross-Site Scripting (XSS) vulnerability (CVSS 5.4, Nico Amarilla BxSlider WP)
- [CVE-2022-35672](https://cve.now/CVE-2022-35672.md): Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-35669](https://cve.now/CVE-2022-35669.md): Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2022-2550](https://cve.now/CVE-2022-2550.md): OS Command Injection in hestiacp/hestiacp (CVSS 9.9, hestiacp/hestiacp)
- [CVE-2022-2549](https://cve.now/CVE-2022-2549.md): NULL Pointer Dereference in gpac/gpac (CVSS 5.7, gpac/gpac)
- [CVE-2022-36922](https://cve.now/CVE-2022-36922.md): Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not escape the search query parameter displayed on the 'search' result page, (no CVSS, Jenkins project Jenkins Lucene-Search Plugin · org.jenkins-…)
- [CVE-2022-36921](https://cve.now/CVE-2022-36921.md): A missing permission check in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers with Overall/Read permission to connect to an atta (no CVSS, Jenkins project Jenkins Coverity Plugin · org.jenkins-ci.pl…)
- [CVE-2022-36920](https://cve.now/CVE-2022-36920.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers to connect to an attacker-s (no CVSS, Jenkins project Jenkins Coverity Plugin · org.jenkins-ci.pl…)
- [CVE-2022-36919](https://cve.now/CVE-2022-36919.md): A missing permission check in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers with Overall/Read permission to enumerate credenti (no CVSS, Jenkins project Jenkins Coverity Plugin · org.jenkins-ci.pl…)
- [CVE-2022-36918](https://cve.now/CVE-2022-36918.md): Jenkins Buckminster Plugin 1.1.1 and earlier does not perform a permission check in a method implementing form validation, allowing attacker (no CVSS, Jenkins project Jenkins Buckminster Plugin · org.jenkins-ci…)
- [CVE-2022-36917](https://cve.now/CVE-2022-36917.md): A missing permission check in Jenkins Google Cloud Backup Plugin 0.6 and earlier allows attackers with Overall/Read permission to request a (no CVSS, Jenkins project Jenkins Google Cloud Backup Plugin · org.je…)
- [CVE-2022-36916](https://cve.now/CVE-2022-36916.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Google Cloud Backup Plugin 0.6 and earlier allows attackers to request a manual (no CVSS, Jenkins project Jenkins Google Cloud Backup Plugin · org.je…)
- [CVE-2022-36915](https://cve.now/CVE-2022-36915.md): Jenkins Android Signing Plugin 2.2.5 and earlier does not perform a permission check in a method implementing form validation, allowing atta (no CVSS, Jenkins project Jenkins Android Signing Plugin · org.jenkin…)
- [CVE-2022-36914](https://cve.now/CVE-2022-36914.md): Jenkins Files Found Trigger Plugin 1.5 and earlier does not perform a permission check in a method implementing form validation, allowing at (no CVSS, Jenkins project Jenkins Files Found Trigger Plugin · org.je…)
- [CVE-2022-36913](https://cve.now/CVE-2022-36913.md): Jenkins Openstack Heat Plugin 1.5 and earlier does not perform permission checks in methods implementing form validation, allowing attackers (no CVSS, Jenkins project Jenkins Openstack Heat Plugin · org.jenkins…)
- [CVE-2022-36912](https://cve.now/CVE-2022-36912.md): A missing permission check in Jenkins Openstack Heat Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an a (CVSS 4.3, Jenkins project Jenkins Openstack Heat Plugin · org.jenkins…)
- [CVE-2022-36911](https://cve.now/CVE-2022-36911.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Openstack Heat Plugin 1.5 and earlier allows attackers to connect to an attacke (no CVSS, Jenkins project Jenkins Openstack Heat Plugin · org.jenkins…)
- [CVE-2022-36910](https://cve.now/CVE-2022-36910.md): Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not perform a permission check in several HTTP endpoints, allowing attackers (no CVSS, Jenkins project Jenkins Lucene-Search Plugin · org.jenkins-…)
- [CVE-2022-36909](https://cve.now/CVE-2022-36909.md): A missing permission check in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers with Overall/Read permission to check for (no CVSS, Jenkins project Jenkins OpenShift Deployer Plugin · org.jen…)
- [CVE-2022-36908](https://cve.now/CVE-2022-36908.md): A cross-site request forgery (CSRF) vulnerability in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers to check for the e (no CVSS, Jenkins project Jenkins OpenShift Deployer Plugin · org.jen…)
- [CVE-2022-36907](https://cve.now/CVE-2022-36907.md): A missing permission check in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers with Overall/Read permission to connect t (no CVSS, Jenkins project Jenkins OpenShift Deployer Plugin · org.jen…)
- [CVE-2022-36906](https://cve.now/CVE-2022-36906.md): A cross-site request forgery (CSRF) vulnerability in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers to connect to an a (no CVSS, Jenkins project Jenkins OpenShift Deployer Plugin · org.jen…)
- [CVE-2022-36905](https://cve.now/CVE-2022-36905.md): Jenkins Maven Metadata Plugin for Jenkins CI server Plugin 2.2 and earlier does not perform URL validation for the Repository Base URL of Li (no CVSS, Jenkins project Jenkins Maven Metadata Plugin for Jenkins C…)
- [CVE-2022-36904](https://cve.now/CVE-2022-36904.md): Jenkins Repository Connector Plugin 2.2.0 and earlier does not perform a permission check in a method implementing form validation, allowing (no CVSS, Jenkins project Jenkins Repository Connector Plugin · org.j…)
- [CVE-2022-36903](https://cve.now/CVE-2022-36903.md): A missing permission check in Jenkins Repository Connector Plugin 2.2.0 and earlier allows attackers with Overall/Read permission to enumera (no CVSS, Jenkins project Jenkins Repository Connector Plugin · org.j…)
- [CVE-2022-36902](https://cve.now/CVE-2022-36902.md): Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape several fields of Moded Extended Choice parameters, resul (no CVSS, Jenkins project Jenkins Dynamic Extended Choice Parameter P…)
- [CVE-2022-36901](https://cve.now/CVE-2022-36901.md): Jenkins HTTP Request Plugin 1.15 and earlier stores HTTP Request passwords unencrypted in its global configuration file on the Jenkins contr (no CVSS, Jenkins project Jenkins HTTP Request Plugin · org.jenkins-c…)
- [CVE-2022-36900](https://cve.now/CVE-2022-36900.md): Jenkins Compuware zAdviser API Plugin 1.0.3 and earlier does not restrict execution of a controller/agent message to agents, allowing attack (no CVSS, Jenkins project Jenkins Compuware zAdviser API Plugin · com…)
- [CVE-2022-36899](https://cve.now/CVE-2022-36899.md): Jenkins Compuware ISPW Operations Plugin 1.0.8 and earlier does not restrict execution of a controller/agent message to agents, allowing att (no CVSS, Jenkins project Jenkins Compuware ISPW Operations Plugin ·…)
- [CVE-2022-36898](https://cve.now/CVE-2022-36898.md): A missing permission check in Jenkins Compuware ISPW Operations Plugin 1.0.8 and earlier allows attackers with Overall/Read permission to en (no CVSS, Jenkins project Jenkins Compuware ISPW Operations Plugin ·…)
- [CVE-2022-36897](https://cve.now/CVE-2022-36897.md): A missing permission check in Jenkins Compuware Xpediter Code Coverage Plugin 1.0.7 and earlier allows attackers with Overall/Read permissio (no CVSS, Jenkins project Jenkins Compuware Xpediter Code Coverage Pl…)
- [CVE-2022-36896](https://cve.now/CVE-2022-36896.md): A missing permission check in Jenkins Compuware Source Code Download for Endevor, PDS, and ISPW Plugin 2.0.12 and earlier allows attackers w (no CVSS, Jenkins project Jenkins Compuware Source Code Download for…)
- [CVE-2022-36895](https://cve.now/CVE-2022-36895.md): A missing permission check in Jenkins Compuware Topaz Utilities Plugin 1.0.8 and earlier allows attackers with Overall/Read permission to en (no CVSS, Jenkins project Jenkins Compuware Topaz Utilities Plugin ·…)
- [CVE-2022-36894](https://cve.now/CVE-2022-36894.md): An arbitrary file write vulnerability in Jenkins CLIF Performance Testing Plugin 64.vc0d66de1dfb\_f and earlier allows attackers with Overall (no CVSS, Jenkins project Jenkins CLIF Performance Testing Plugin · o…)
- [CVE-2022-36893](https://cve.now/CVE-2022-36893.md): Jenkins rpmsign-plugin Plugin 0.5.0 and earlier does not perform a permission check in a method implementing form validation, allowing attac (no CVSS, Jenkins project Jenkins rpmsign-plugin Plugin · org.jenkins…)
- [CVE-2022-36892](https://cve.now/CVE-2022-36892.md): Jenkins rhnpush-plugin Plugin 0.5.1 and earlier does not perform a permission check in a method implementing form validation, allowing attac (no CVSS, Jenkins project Jenkins rhnpush-plugin Plugin · org.jenkins…)
- [CVE-2022-36891](https://cve.now/CVE-2022-36891.md): A missing permission check in Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier allows attackers with Item/Read permission but (no CVSS, Jenkins project Jenkins Deployer Framework Plugin · org.jen…)
- [CVE-2022-36890](https://cve.now/CVE-2022-36890.md): Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the name of files in methods implementing form validation, (no CVSS, Jenkins project Jenkins Deployer Framework Plugin · org.jen…)
- [CVE-2022-36889](https://cve.now/CVE-2022-36889.md): Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the application path of the applications when configuring a (no CVSS, Jenkins project Jenkins Deployer Framework Plugin · org.jen…)
- [CVE-2022-36888](https://cve.now/CVE-2022-36888.md): A missing permission check in Jenkins HashiCorp Vault Plugin 354.vdb\_858fd6b\_f48 and earlier allows attackers with Overall/Read permission t (no CVSS, Jenkins project Jenkins HashiCorp Vault Plugin · com.datapi…)
- [CVE-2022-36887](https://cve.now/CVE-2022-36887.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Job Configuration History Plugin 1155.v28a\_46a\_cc06a\_5 and earlier allows attac (no CVSS, Jenkins project Jenkins Job Configuration History Plugin ·…)
- [CVE-2022-36886](https://cve.now/CVE-2022-36886.md): A cross-site request forgery (CSRF) vulnerability in Jenkins External Monitor Job Type Plugin 191.v363d0d1efdf8 and earlier allows attackers (no CVSS, Jenkins project Jenkins External Monitor Job Type Plugin ·…)
- [CVE-2022-36885](https://cve.now/CVE-2022-36885.md): Jenkins GitHub Plugin 1.34.4 and earlier uses a non-constant time comparison function when checking whether the provided and computed webhoo (no CVSS, Jenkins project Jenkins GitHub Plugin · com.coravy.hudson.p…)
- [CVE-2022-36884](https://cve.now/CVE-2022-36884.md): The webhook endpoint in Jenkins Git Plugin 4.11.3 and earlier provide unauthenticated attackers information about the existence of jobs conf (no CVSS, Jenkins project Jenkins Git Plugin · org.jenkins-ci.plugins…)
- [CVE-2022-36883](https://cve.now/CVE-2022-36883.md): A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to (no CVSS, Jenkins project Jenkins Git Plugin · org.jenkins-ci.plugins…)
- [CVE-2022-36882](https://cve.now/CVE-2022-36882.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Git Plugin 4.11.3 and earlier allows attackers to trigger builds of jobs config (no CVSS, Jenkins project Jenkins Git Plugin · org.jenkins-ci.plugins…)
- [CVE-2022-36881](https://cve.now/CVE-2022-36881.md): Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enablin (no CVSS, Jenkins project Jenkins Git client Plugin · org.jenkins-ci.…)
- [CVE-2022-24406](https://cve.now/CVE-2022-24406.md): OX App Suite through 7.10.6 allows SSRF because multipart/form-data boundaries are predictable, and this can lead to injection into internal (no CVSS)
- [CVE-2022-24405](https://cve.now/CVE-2022-24405.md): OX App Suite through 7.10.6 allows OS Command Injection via a serialized Java class to the Documentconverter API. (no CVSS)
- [CVE-2022-23101](https://cve.now/CVE-2022-23101.md): OX App Suite through 7.10.6 allows XSS via appHandler in a deep link in an e-mail message. (no CVSS)
- [CVE-2022-35291](https://cve.now/CVE-2022-35291.md): Privilege escalation vulnerability in SAP SuccessFactors attachment API for Mobile Application(Android & iOS) (CVSS 8.1, SAP SuccessFactors Mobile Application for Android & iOS dev…)
- [CVE-2022-33970](https://cve.now/CVE-2022-33970.md): WordPress Shortcode Addons plugin \<= 3.1.2 - Authenticated WordPress Options Change vulnerability (CVSS 7.2, Biplob018 Shortcode Addons)
- [CVE-2022-23099](https://cve.now/CVE-2022-23099.md): OX App Suite through 7.10.6 allows XSS by forcing block-wise read. (no CVSS)
- [CVE-2022-23100](https://cve.now/CVE-2022-23100.md): OX App Suite through 7.10.6 allows OS Command Injection via Documentconverter (e.g., through an email attachment). (no CVSS)
- [CVE-2022-34551](https://cve.now/CVE-2022-34551.md): Sims v1.0 was discovered to allow path traversal when downloading attachments. (no CVSS)
- [CVE-2022-34549](https://cve.now/CVE-2022-34549.md): Sims v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /uploadServlet. (no CVSS)
- [CVE-2022-34550](https://cve.now/CVE-2022-34550.md): Sims v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /addNotifyServlet. (no CVSS)
- [CVE-2022-34529](https://cve.now/CVE-2022-34529.md): WASM3 v0.5.0 was discovered to contain a segmentation fault via the component Compile\_Memory\_CopyFill. (no CVSS, pywasm3 · wasm3)
- [CVE-2022-2313](https://cve.now/CVE-2022-2313.md): DLL high jacking in Trellix Agent (CVSS 8.2, Trellix Agent)
- [CVE-2022-2310](https://cve.now/CVE-2022-2310.md): Skyhigh SWG Authentication bypass vulnerability (CVSS 10.0, Skyhigh Security Skyhigh Secure Web Gateway)
- [CVE-2022-27610](https://cve.now/CVE-2022-27610.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology DiskStation Man (CVSS 6.5, Synology DiskStation Manager)
- [CVE-2022-36880](https://cve.now/CVE-2022-36880.md): The Read Mail module in Webmin 1.995 and Usermin through 1.850 allows XSS via a crafted HTML e-mail message. (no CVSS)
- [CVE-2022-36879](https://cve.now/CVE-2022-36879.md): An issue was discovered in the Linux kernel through 5.18.14. (CVSS 5.5)
- [CVE-2022-34594](https://cve.now/CVE-2022-34594.md): Advanced School Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component ip/school/moud (no CVSS)
- [CVE-2022-34611](https://cve.now/CVE-2022-34611.md): A cross-site scripting (XSS) vulnerability in /index.php/?p=report of Online Fire Reporting System v1.0 allows attackers to execute arbitrar (no CVSS)
- [CVE-2022-34971](https://cve.now/CVE-2022-34971.md): An arbitrary file upload vulnerability in the Advertising Management module of Feehi CMS v2.1.1 allows attackers to execute arbitrary code v (no CVSS, feehi/cms)
- [CVE-2022-34612](https://cve.now/CVE-2022-34612.md): Rizin v0.4.0 and below was discovered to contain an integer overflow via the function get\_long\_object(). (no CVSS)
- [CVE-2022-36946](https://cve.now/CVE-2022-36946.md): nfqnl\_mangle in net/netfilter/nfnetlink\_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (pa (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-07-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.