CVEs published July 28, 2022
93 CVEs were published on July 28, 2022: 4 critical, 25 high. 1 is now in CISA KEV.
- Published
- 93
- Critical
- 4
- High
- 25
- Medium
- 10
- Low
- 2
- Unrated
- 52
- Now in CISA KEV
- 1
- Fix available
- 40
Most affected products
- Google Chrome
- 24
- Ovarro TBox
- 6
- JetBrains IntelliJ IDEA
- 2
- kippo-graph
- 2
- Synology Audio Station
- 2
- Synology Media Server
- 2
- zulip
- 2
- Apache Software Foundation Apache Calcite Avatica · org.apa…
- 1
- automattic/mongoose · mongoose
- 1
- Booth
- 1
Critical 4
- CVE-2021-41556sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read (in the core interpreter) that can lead to Code Execu
- CVE-2022-22683Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Media Server before 1.8.1-Synology Media Server
- CVE-2022-36990An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1
- CVE-2022-36992An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1
High 25
- CVE-2021-39088IBM QRadar SIEM 7.3, 7.4, and 7.5 is vulnerable to local privilege escalation if this could be combined with other unknown vulnerabilities tIBM QRadar SIEM
- CVE-2022-2564Prototype Pollution in automattic/mongooseautomattic/mongoose · mongoose
- CVE-2022-1948An issue has been discovered in GitLab affecting all versions starting from 15.0 before 15.0.1.GitLab
- CVE-2021-22646Ovarro TBox Code InjectionOvarro TBox
- CVE-2021-22644Ovarro TBox Use of Hard-coded Cryptographic KeyOvarro TBox
- CVE-2021-22648Ovarro TBox Incorrect Permission Assignment for Critical ResourceOvarro TBox
- CVE-2021-22650Ovarro TBox Relative Path TraversalOvarro TBox
- CVE-2021-22640Ovarro TBox Insufficiently Protected CredentialsOvarro TBox
- CVE-2021-22642Ovarro TBox Uncontrolled Resource ConsumptionOvarro TBox
- CVE-2022-27612Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Audio Station before 6.5.4Synology Audio Station
- CVE-2022-22685Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology WebDAV Server bSynology WebDAV Server
- CVE-2022-27613Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in webapi component in Synology CardDAV SSynology CardDAV Server
- CVE-2022-22684Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in task management component in SynSynology DiskStation Manager
- CVE-2022-31627Heap buffer overflow in finfo_bufferPHP Group PHP
- CVE-2022-27615Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in cgi component in Synology DNS Server before Synology DNS Server
- CVE-2022-36984An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1
- CVE-2022-36985An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1
- CVE-2022-36986An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1
- CVE-2022-36987An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1
- CVE-2022-36988An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1
- CVE-2022-36989An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1
- CVE-2022-36991An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1
- CVE-2022-36993An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1
- CVE-2022-36997An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1
- CVE-2022-2294Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption viaGoogle Chrome
Medium, low and unrated 64
- CVE-2022-34555TP-LINK TL-R473G 2.0.1 Build 220529 Rel.65574n was discovered to contain a remote code execution vulnerability which is exploited via a craf
- CVE-2022-36234SimpleNetwork TCP Server commit 29bc615f0d9910eb2f59aa8dff1f54f0e3af4496 was discovered to contain a double free vulnerability which is expl
- CVE-2022-36752png2webp v1.0.4 was discovered to contain an out-of-bounds write via the function w2p.
- CVE-2022-34556PicoC v3.2.2 was discovered to contain a NULL pointer dereference at variable.c.
- CVE-2022-34557Barangay Management System v1.0 was discovered to contain a SQL injection vulnerability via the hidden_id parameter at /pages/permit/permit.
- CVE-2022-34558WMAgent v1.3.3rc2 and 1.3.3rc1, reqmgr 2 1.4.1rc5 and 1.4.0rc2, reqmon 1.4.1rc5, and global-workqueue 1.4.1rc5 allows attackers to execute areqmon · global-workqueue +2
- CVE-2022-2399Use after free in WebGPU in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2022-29558Realtek rtl819x-SDK before v3.6.1 allows command injection over the web interface.
- CVE-2022-34580Advanced School Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the address parameter at ip/
- CVE-2022-30287Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class
- CVE-2022-34593DPTech VPN v8.1.28.0 was discovered to contain an arbitrary file read vulnerability.
- CVE-2022-34578Open Source Point of Sale v3.3.7 was discovered to contain an arbitrary file upload vulnerability via the Update Branding Settings page.
- CVE-2016-3709Possible cross-site scripting vulnerability in libxml after commit 960f0e2.libxml2
- CVE-2016-0796WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files is prone to multiple vulnerabilities, including open proxy and WordPress Plugin mb.miniAudioPlayer-an
- CVE-2016-4991Input passed to the Pdf() function is shell escaped and passed to child_process.exec() during PDF rendering.nodepdf
- CVE-2016-4427In zulip before 1.3.12, deactivated users could access messages if SSO was enabled.zulip
- CVE-2016-4426In zulip before 1.3.12, bot API keys were accessible to other users in the same realm.zulip
- CVE-2022-30319Saia Burgess Controls (SBC) PCD through 2022-05-06 allows Authentication bypass.
- CVE-2022-30320Saia Burgess Controls (SBC) PCD through 2022-05-06 uses a Broken or Risky Cryptographic Algorithm.
- CVE-2022-30313Honeywell Experion PKS Safety Manager through 2022-05-06 has Missing Authentication for a Critical Function.
- CVE-2022-30314Honeywell Experion PKS Safety Manager 5.02 uses Hard-coded Credentials.
- CVE-2022-30315Honeywell Experion PKS Safety Manager (SM and FSC) through 2022-05-06 has Insufficient Verification of Data Authenticity.
- CVE-2022-30316Honeywell Experion PKS Safety Manager 5.02 has Insufficient Verification of Data Authenticity.
- CVE-2016-2139In kippo-graph before version 1.5.1, there is a cross-site scripting vulnerability in $file_link in class/KippoInput.class.php.kippo-graph
- CVE-2016-2138In kippo-graph before version 1.5.1, there is a cross-site scripting vulnerability in xss_clean() in class/KippoInput.class.php.kippo-graph
- CVE-2022-35882WordPress GS Testimonial Slider plugin <= 1.9.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityGS Plugins GS Testimonial Slider
- CVE-2022-1805When connecting to Amazon Workspaces, the SHA256 presented by AWS connection provisioner is not fully verified by Zero Clients.Tera2 Zero Client
- CVE-2022-27509Unauthenticated redirection to a malicious websiteCitirx Citrix Application Delivery Management (Citrix ADC)…
- CVE-2022-37010In JetBrains IntelliJ IDEA before 2022.2 email address validation in the "Git User Name Is Not Defined" dialog was missedJetBrains IntelliJ IDEA
- CVE-2022-37009In JetBrains IntelliJ IDEA before 2022.2 local code execution via a Vagrant executable was possibleJetBrains IntelliJ IDEA
- CVE-2022-36364Apache Calcite Avatica JDBC driver `httpclient_impl` connection property can be used as an RCE vectorApache Software Foundation Apache Calcite Avatica · org.apa…
- CVE-2022-27611Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Audio Station bSynology Audio Station
- CVE-2022-27614Exposure of sensitive information to an unauthorized actor vulnerability in web server in Synology Media Server before 1.8.1-2876 allows remSynology Media Server
- CVE-2022-2296Use after free in Chrome OS Shell in Google Chrome on Chrome OS prior to 103.0.5060.114 allowed a remote attacker who convinced a user to enGoogle Chrome
- CVE-2022-2295Type confusion in V8 in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a craftedGoogle Chrome
- CVE-2022-2163Use after free in Cast UI and Toolbar in Google Chrome prior to 103.0.5060.134 allowed an attacker who convinced a user to install a malicioGoogle Chrome
- CVE-2022-36994An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1
- CVE-2022-36995An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1
- CVE-2022-36996An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1
- CVE-2022-36998An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1
- CVE-2022-36999An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1
- CVE-2022-37000An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1
- CVE-2022-2415Heap buffer overflow in WebGL in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to potentially exploit heap corruption via aGoogle Chrome
- CVE-2022-2165Insufficient data validation in URL formatting in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to perform domain spoofing Google Chrome
- CVE-2022-2164Inappropriate implementation in Extensions API in Google Chrome prior to 103.0.5060.53 allowed an attacker who convinced a user to install aGoogle Chrome
- CVE-2022-2162Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 103.0.5060.53 allowed a remote attacker to bypass fiGoogle Chrome
- CVE-2022-2161Use after free in WebApp Provider in Google Chrome prior to 103.0.5060.53 allowed a remote attacker who convinced the user to engage in specGoogle Chrome
- CVE-2022-2160Insufficient policy enforcement in DevTools in Google Chrome on Windows prior to 103.0.5060.53 allowed an attacker who convinced a user to iGoogle Chrome
- CVE-2022-2158Type confusion in V8 in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2022-2157Use after free in Interest groups in Google Chrome prior to 103.0.5060.53 allowed a remote attacker who had compromised the renderer processGoogle Chrome
- CVE-2022-2156Use after free in Core in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to potentially exploit heap corruption via a crafteGoogle Chrome
- CVE-2022-2011Use after free in ANGLE in Google Chrome prior to 102.0.5005.115 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2022-2010Out of bounds read in compositing in Google Chrome prior to 102.0.5005.115 allowed a remote attacker who had compromised the renderer procesGoogle Chrome
- CVE-2022-2008Double free in WebGL in Google Chrome prior to 102.0.5005.115 allowed a remote attacker to potentially exploit heap corruption via a craftedGoogle Chrome
- CVE-2022-2007Use after free in WebGPU in Google Chrome prior to 102.0.5005.115 allowed a remote attacker to potentially exploit heap corruption via a craGoogle Chrome
- CVE-2022-1919Use after free in Codecs in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2022-2477Use after free in Guest View in Google Chrome prior to 103.0.5060.134 allowed an attacker who convinced a user to install a malicious extensGoogle Chrome
- CVE-2022-2478Use after free in PDF in Google Chrome prior to 103.0.5060.134 allowed a remote attacker to potentially exploit heap corruption via a crafteGoogle Chrome
- CVE-2022-2479Insufficient validation of untrusted input in File in Google Chrome on Android prior to 103.0.5060.134 allowed an attacker who convinced a uGoogle Chrome
- CVE-2022-2480Use after free in Service Worker API in Google Chrome prior to 103.0.5060.134 allowed a remote attacker to potentially exploit heap corruptiGoogle Chrome
- CVE-2022-2481Use after free in Views in Google Chrome prior to 103.0.5060.134 allowed a remote attacker who convinced a user to engage in specific user iGoogle Chrome
- CVE-2022-2553The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node.Booth
- CVE-2022-29360The Email Viewer in RainLoop through 1.6.0 allows XSS via a crafted email message.
- CVE-2022-34568SDL v1.2 was discovered to contain a use-after-free via the XFree function at /src/video/x11/SDL_x11yuv.c.