# CVEs published 2022-07-28

93 CVEs were published on July 28, 2022: 4 critical, 25 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2022-34555](https://cve.now/CVE-2022-34555.md): TP-LINK TL-R473G 2.0.1 Build 220529 Rel.65574n was discovered to contain a remote code execution vulnerability which is exploited via a craf (no CVSS)
- [CVE-2022-36234](https://cve.now/CVE-2022-36234.md): SimpleNetwork TCP Server commit 29bc615f0d9910eb2f59aa8dff1f54f0e3af4496 was discovered to contain a double free vulnerability which is expl (no CVSS)
- [CVE-2022-36752](https://cve.now/CVE-2022-36752.md): png2webp v1.0.4 was discovered to contain an out-of-bounds write via the function w2p. (no CVSS)
- [CVE-2022-34556](https://cve.now/CVE-2022-34556.md): PicoC v3.2.2 was discovered to contain a NULL pointer dereference at variable.c. (no CVSS)
- [CVE-2022-34557](https://cve.now/CVE-2022-34557.md): Barangay Management System v1.0 was discovered to contain a SQL injection vulnerability via the hidden\_id parameter at /pages/permit/permit. (no CVSS)
- [CVE-2022-34558](https://cve.now/CVE-2022-34558.md): WMAgent v1.3.3rc2 and 1.3.3rc1, reqmgr 2 1.4.1rc5 and 1.4.0rc2, reqmon 1.4.1rc5, and global-workqueue 1.4.1rc5 allows attackers to execute a (no CVSS, reqmon · global-workqueue +2)
- [CVE-2021-39088](https://cve.now/CVE-2021-39088.md): IBM QRadar SIEM 7.3, 7.4, and 7.5 is vulnerable to local privilege escalation if this could be combined with other unknown vulnerabilities t (CVSS 7.4, IBM QRadar SIEM)
- [CVE-2022-2399](https://cve.now/CVE-2022-2399.md): Use after free in WebGPU in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a craf (no CVSS, Google Chrome)
- [CVE-2022-29558](https://cve.now/CVE-2022-29558.md): Realtek rtl819x-SDK before v3.6.1 allows command injection over the web interface. (no CVSS)
- [CVE-2022-34580](https://cve.now/CVE-2022-34580.md): Advanced School Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the address parameter at ip/ (no CVSS)
- [CVE-2022-30287](https://cve.now/CVE-2022-30287.md): Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class (no CVSS)
- [CVE-2021-41556](https://cve.now/CVE-2021-41556.md): sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read (in the core interpreter) that can lead to Code Execu (CVSS 10.0)
- [CVE-2022-34593](https://cve.now/CVE-2022-34593.md): DPTech VPN v8.1.28.0 was discovered to contain an arbitrary file read vulnerability. (no CVSS)
- [CVE-2022-34578](https://cve.now/CVE-2022-34578.md): Open Source Point of Sale v3.3.7 was discovered to contain an arbitrary file upload vulnerability via the Update Branding Settings page. (no CVSS)
- [CVE-2016-3709](https://cve.now/CVE-2016-3709.md): Possible cross-site scripting vulnerability in libxml after commit 960f0e2. (no CVSS, libxml2)
- [CVE-2016-0796](https://cve.now/CVE-2016-0796.md): WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files is prone to multiple vulnerabilities, including open proxy and (no CVSS, WordPress Plugin mb.miniAudioPlayer-an)
- [CVE-2016-4991](https://cve.now/CVE-2016-4991.md): Input passed to the Pdf() function is shell escaped and passed to child\_process.exec() during PDF rendering. (no CVSS, nodepdf)
- [CVE-2016-4427](https://cve.now/CVE-2016-4427.md): In zulip before 1.3.12, deactivated users could access messages if SSO was enabled. (no CVSS, zulip)
- [CVE-2016-4426](https://cve.now/CVE-2016-4426.md): In zulip before 1.3.12, bot API keys were accessible to other users in the same realm. (no CVSS, zulip)
- [CVE-2022-30319](https://cve.now/CVE-2022-30319.md): Saia Burgess Controls (SBC) PCD through 2022-05-06 allows Authentication bypass. (no CVSS)
- [CVE-2022-30320](https://cve.now/CVE-2022-30320.md): Saia Burgess Controls (SBC) PCD through 2022-05-06 uses a Broken or Risky Cryptographic Algorithm. (no CVSS)
- [CVE-2022-30313](https://cve.now/CVE-2022-30313.md): Honeywell Experion PKS Safety Manager through 2022-05-06 has Missing Authentication for a Critical Function. (no CVSS)
- [CVE-2022-30314](https://cve.now/CVE-2022-30314.md): Honeywell Experion PKS Safety Manager 5.02 uses Hard-coded Credentials. (no CVSS)
- [CVE-2022-30315](https://cve.now/CVE-2022-30315.md): Honeywell Experion PKS Safety Manager (SM and FSC) through 2022-05-06 has Insufficient Verification of Data Authenticity. (no CVSS)
- [CVE-2022-30316](https://cve.now/CVE-2022-30316.md): Honeywell Experion PKS Safety Manager 5.02 has Insufficient Verification of Data Authenticity. (no CVSS)
- [CVE-2022-2564](https://cve.now/CVE-2022-2564.md): Prototype Pollution in automattic/mongoose (CVSS 7.0, automattic/mongoose · mongoose)
- [CVE-2016-2139](https://cve.now/CVE-2016-2139.md): In kippo-graph before version 1.5.1, there is a cross-site scripting vulnerability in $file\_link in class/KippoInput.class.php. (no CVSS, kippo-graph)
- [CVE-2016-2138](https://cve.now/CVE-2016-2138.md): In kippo-graph before version 1.5.1, there is a cross-site scripting vulnerability in xss\_clean() in class/KippoInput.class.php. (no CVSS, kippo-graph)
- [CVE-2022-1948](https://cve.now/CVE-2022-1948.md): An issue has been discovered in GitLab affecting all versions starting from 15.0 before 15.0.1. (CVSS 8.7, GitLab)
- [CVE-2022-35882](https://cve.now/CVE-2022-35882.md): WordPress GS Testimonial Slider plugin \<= 1.9.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, GS Plugins GS Testimonial Slider)
- [CVE-2022-1805](https://cve.now/CVE-2022-1805.md): When connecting to Amazon Workspaces, the SHA256 presented by AWS connection provisioner is not fully verified by Zero Clients. (no CVSS, Tera2 Zero Client)
- [CVE-2021-22646](https://cve.now/CVE-2021-22646.md): Ovarro TBox Code Injection (CVSS 8.8, Ovarro TBox)
- [CVE-2021-22644](https://cve.now/CVE-2021-22644.md): Ovarro TBox Use of Hard-coded Cryptographic Key (CVSS 7.5, Ovarro TBox)
- [CVE-2021-22648](https://cve.now/CVE-2021-22648.md): Ovarro TBox Incorrect Permission Assignment for Critical Resource (CVSS 8.8, Ovarro TBox)
- [CVE-2021-22650](https://cve.now/CVE-2021-22650.md): Ovarro TBox Relative Path Traversal (CVSS 7.5, Ovarro TBox)
- [CVE-2021-22640](https://cve.now/CVE-2021-22640.md): Ovarro TBox Insufficiently Protected Credentials (CVSS 7.5, Ovarro TBox)
- [CVE-2021-22642](https://cve.now/CVE-2021-22642.md): Ovarro TBox Uncontrolled Resource Consumption (CVSS 7.5, Ovarro TBox)
- [CVE-2022-27509](https://cve.now/CVE-2022-27509.md): Unauthenticated redirection to a malicious website (no CVSS, Citirx Citrix Application Delivery Management (Citrix ADC)…)
- [CVE-2022-37010](https://cve.now/CVE-2022-37010.md): In JetBrains IntelliJ IDEA before 2022.2 email address validation in the "Git User Name Is Not Defined" dialog was missed (CVSS 3.6, JetBrains IntelliJ IDEA)
- [CVE-2022-37009](https://cve.now/CVE-2022-37009.md): In JetBrains IntelliJ IDEA before 2022.2 local code execution via a Vagrant executable was possible (CVSS 3.9, JetBrains IntelliJ IDEA)
- [CVE-2022-36364](https://cve.now/CVE-2022-36364.md): Apache Calcite Avatica JDBC driver \`httpclient\_impl\` connection property can be used as an RCE vector (no CVSS, Apache Software Foundation Apache Calcite Avatica · org.apa…)
- [CVE-2022-27611](https://cve.now/CVE-2022-27611.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Audio Station b (CVSS 5.4, Synology Audio Station)
- [CVE-2022-27612](https://cve.now/CVE-2022-27612.md): Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Audio Station before 6.5.4 (CVSS 7.3, Synology Audio Station)
- [CVE-2022-22683](https://cve.now/CVE-2022-22683.md): Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Media Server before 1.8.1- (CVSS 10.0, Synology Media Server)
- [CVE-2022-27614](https://cve.now/CVE-2022-27614.md): Exposure of sensitive information to an unauthorized actor vulnerability in web server in Synology Media Server before 1.8.1-2876 allows rem (CVSS 5.3, Synology Media Server)
- [CVE-2022-22685](https://cve.now/CVE-2022-22685.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology WebDAV Server b (CVSS 8.7, Synology WebDAV Server)
- [CVE-2022-27613](https://cve.now/CVE-2022-27613.md): Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in webapi component in Synology CardDAV S (CVSS 8.3, Synology CardDAV Server)
- [CVE-2022-22684](https://cve.now/CVE-2022-22684.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in task management component in Syn (CVSS 7.2, Synology DiskStation Manager)
- [CVE-2022-31627](https://cve.now/CVE-2022-31627.md): Heap buffer overflow in finfo\_buffer (CVSS 7.7, PHP Group PHP)
- [CVE-2022-27615](https://cve.now/CVE-2022-27615.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in cgi component in Synology DNS Server before (CVSS 7.7, Synology DNS Server)
- [CVE-2022-2296](https://cve.now/CVE-2022-2296.md): Use after free in Chrome OS Shell in Google Chrome on Chrome OS prior to 103.0.5060.114 allowed a remote attacker who convinced a user to en (no CVSS, Google Chrome)
- [CVE-2022-2295](https://cve.now/CVE-2022-2295.md): Type confusion in V8 in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted (no CVSS, Google Chrome)
- [CVE-2022-2163](https://cve.now/CVE-2022-2163.md): Use after free in Cast UI and Toolbar in Google Chrome prior to 103.0.5060.134 allowed an attacker who convinced a user to install a malicio (no CVSS, Google Chrome)
- [CVE-2022-36984](https://cve.now/CVE-2022-36984.md): An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (CVSS 7.7)
- [CVE-2022-36985](https://cve.now/CVE-2022-36985.md): An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (CVSS 7.8)
- [CVE-2022-36986](https://cve.now/CVE-2022-36986.md): An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (CVSS 8.6)
- [CVE-2022-36987](https://cve.now/CVE-2022-36987.md): An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (CVSS 8.5)
- [CVE-2022-36988](https://cve.now/CVE-2022-36988.md): An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (CVSS 8.0)
- [CVE-2022-36989](https://cve.now/CVE-2022-36989.md): An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (CVSS 8.8)
- [CVE-2022-36990](https://cve.now/CVE-2022-36990.md): An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (CVSS 9.6)
- [CVE-2022-36991](https://cve.now/CVE-2022-36991.md): An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (CVSS 8.1)
- [CVE-2022-36992](https://cve.now/CVE-2022-36992.md): An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (CVSS 9.9)
- [CVE-2022-36993](https://cve.now/CVE-2022-36993.md): An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (CVSS 8.8)
- [CVE-2022-36994](https://cve.now/CVE-2022-36994.md): An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (CVSS 6.3)
- [CVE-2022-36995](https://cve.now/CVE-2022-36995.md): An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (CVSS 4.3)
- [CVE-2022-36996](https://cve.now/CVE-2022-36996.md): An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (CVSS 4.3)
- [CVE-2022-36997](https://cve.now/CVE-2022-36997.md): An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (CVSS 7.1)
- [CVE-2022-36998](https://cve.now/CVE-2022-36998.md): An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (CVSS 6.3)
- [CVE-2022-36999](https://cve.now/CVE-2022-36999.md): An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (CVSS 6.5)
- [CVE-2022-37000](https://cve.now/CVE-2022-37000.md): An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (CVSS 6.5)
- [CVE-2022-2415](https://cve.now/CVE-2022-2415.md): Heap buffer overflow in WebGL in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to potentially exploit heap corruption via a (no CVSS, Google Chrome)
- [CVE-2022-2165](https://cve.now/CVE-2022-2165.md): Insufficient data validation in URL formatting in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to perform domain spoofing (no CVSS, Google Chrome)
- [CVE-2022-2164](https://cve.now/CVE-2022-2164.md): Inappropriate implementation in Extensions API in Google Chrome prior to 103.0.5060.53 allowed an attacker who convinced a user to install a (no CVSS, Google Chrome)
- [CVE-2022-2162](https://cve.now/CVE-2022-2162.md): Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 103.0.5060.53 allowed a remote attacker to bypass fi (no CVSS, Google Chrome)
- [CVE-2022-2161](https://cve.now/CVE-2022-2161.md): Use after free in WebApp Provider in Google Chrome prior to 103.0.5060.53 allowed a remote attacker who convinced the user to engage in spec (no CVSS, Google Chrome)
- [CVE-2022-2160](https://cve.now/CVE-2022-2160.md): Insufficient policy enforcement in DevTools in Google Chrome on Windows prior to 103.0.5060.53 allowed an attacker who convinced a user to i (CVSS 6.5, Google Chrome)
- [CVE-2022-2158](https://cve.now/CVE-2022-2158.md): Type confusion in V8 in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to potentially exploit heap corruption via a crafted (no CVSS, Google Chrome)
- [CVE-2022-2157](https://cve.now/CVE-2022-2157.md): Use after free in Interest groups in Google Chrome prior to 103.0.5060.53 allowed a remote attacker who had compromised the renderer process (no CVSS, Google Chrome)
- [CVE-2022-2156](https://cve.now/CVE-2022-2156.md): Use after free in Core in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to potentially exploit heap corruption via a crafte (no CVSS, Google Chrome)
- [CVE-2022-2011](https://cve.now/CVE-2022-2011.md): Use after free in ANGLE in Google Chrome prior to 102.0.5005.115 allowed a remote attacker to potentially exploit heap corruption via a craf (no CVSS, Google Chrome)
- [CVE-2022-2010](https://cve.now/CVE-2022-2010.md): Out of bounds read in compositing in Google Chrome prior to 102.0.5005.115 allowed a remote attacker who had compromised the renderer proces (no CVSS, Google Chrome)
- [CVE-2022-2008](https://cve.now/CVE-2022-2008.md): Double free in WebGL in Google Chrome prior to 102.0.5005.115 allowed a remote attacker to potentially exploit heap corruption via a crafted (no CVSS, Google Chrome)
- [CVE-2022-2007](https://cve.now/CVE-2022-2007.md): Use after free in WebGPU in Google Chrome prior to 102.0.5005.115 allowed a remote attacker to potentially exploit heap corruption via a cra (no CVSS, Google Chrome)
- [CVE-2022-1919](https://cve.now/CVE-2022-1919.md): Use after free in Codecs in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a craf (no CVSS, Google Chrome)
- [CVE-2022-2294](https://cve.now/CVE-2022-2294.md): Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via (CVSS 8.8, KEV, Google Chrome)
- [CVE-2022-2477](https://cve.now/CVE-2022-2477.md): Use after free in Guest View in Google Chrome prior to 103.0.5060.134 allowed an attacker who convinced a user to install a malicious extens (no CVSS, Google Chrome)
- [CVE-2022-2478](https://cve.now/CVE-2022-2478.md): Use after free in PDF in Google Chrome prior to 103.0.5060.134 allowed a remote attacker to potentially exploit heap corruption via a crafte (no CVSS, Google Chrome)
- [CVE-2022-2479](https://cve.now/CVE-2022-2479.md): Insufficient validation of untrusted input in File in Google Chrome on Android prior to 103.0.5060.134 allowed an attacker who convinced a u (no CVSS, Google Chrome)
- [CVE-2022-2480](https://cve.now/CVE-2022-2480.md): Use after free in Service Worker API in Google Chrome prior to 103.0.5060.134 allowed a remote attacker to potentially exploit heap corrupti (no CVSS, Google Chrome)
- [CVE-2022-2481](https://cve.now/CVE-2022-2481.md): Use after free in Views in Google Chrome prior to 103.0.5060.134 allowed a remote attacker who convinced a user to engage in specific user i (no CVSS, Google Chrome)
- [CVE-2022-2553](https://cve.now/CVE-2022-2553.md): The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. (no CVSS, Booth)
- [CVE-2022-29360](https://cve.now/CVE-2022-29360.md): The Email Viewer in RainLoop through 1.6.0 allows XSS via a crafted email message. (no CVSS)
- [CVE-2022-34568](https://cve.now/CVE-2022-34568.md): SDL v1.2 was discovered to contain a use-after-free via the XFree function at /src/video/x11/SDL\_x11yuv.c. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-07-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.