CVEs published July 29, 2022
38 CVEs were published on July 29, 2022: 2 critical, 1 high.
- Published
- 38
- Critical
- 2
- High
- 1
- Medium
- 8
- Low
- 2
- Unrated
- 25
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- Rapid7 Velociraptor
- 4
- Western Digital Sweet B Library
- 4
- Autodesk Design Review
- 3
- SourceCodester Garage Management System
- 3
- Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, Aut…
- 1
- chia-blockchain
- 1
- Dogtag PKI
- 1
- Fusion360
- 1
- github.com/runatlantis/atlantis/server/controllers/events ·…
- 1
- Google Play Services SDK
- 1
Critical 2
High 1
Medium, low and unrated 35
- CVE-2021-27785HCL Commerce could allow a local attacker to obtain sensitive personal information (CVE-2021-27785)HCL Software HCL Commerce
- CVE-2022-30083EllieGrid Android Application version 3.4.1 is vulnerable to Code Injection.
- CVE-2022-36336A link following vulnerability in the scanning function of Trend Micro Apex One and Worry-Free Business Security agents could allow a local Trend Micro Apex One · Trend Micro Worry-Free Business Secu…
- CVE-2022-35234Trend Micro Security 2021 and 2022 (Consumer) is vulnerable to an Out-Of-Bounds Read Information Disclosure Vulnerability that could allow aTrend Micro Security
- CVE-2022-33158Trend Micro VPN Proxy Pro version 5.2.1026 and below contains a vulnerability involving some overly permissive folders in a key directory whTrend Micro VPN Proxy One Pro
- CVE-2022-34531DedeCMS v5.7.95 was discovered to contain a remote code execution (RCE) vulnerability via the component mytag_ main.php.
- CVE-2022-34528D-Link DSL-3782 v1.03 and below was discovered to contain a stack overflow via the function getAttrValue.
- CVE-2022-34527D-Link DSL-3782 v1.03 and below was discovered to contain a command injection vulnerability via the function byte_4C0160.
- CVE-2022-34496Hiby R3 PRO firmware v1.5 to v1.7 was discovered to contain a file upload vulnerability via the file upload feature.
- CVE-2022-2324Improperly Implemented Security Check vulnerability in the SonicWall Hosted Email Security leads to bypass of Capture ATP security service iSonicWall Email Security
- CVE-2022-22280Improper Neutralization of Special Elements used in an SQL Command leading to Unauthenticated SQL Injection vulnerability, impacting SonicWaSonicWall GMS · SonicWall Analytics On-Prem
- CVE-2022-36447An inflation issue was discovered in Chia Network CAT1 Standard 1.0.0.chia-blockchain
- CVE-2022-2323Improper neutralization of special elements used in a user input allows an authenticated malicious user to perform remote code execution in SonicWall Switch
- CVE-2022-27864A Double Free vulnerability allows remote attackers to execute arbitrary code through DesignReview.exe application on PDF files within affecAutodesk Design Review
- CVE-2022-27866A maliciously crafted TIFF file when consumed through DesignReview.exe application can be forced to read beyond allocated boundaries when paAutodesk Design Review
- CVE-2022-27865A maliciously crafted TGA or PCX file may be used to write beyond the allocated buffer through DesignReview.exe application while parsing TGAutodesk Design Review
- CVE-2022-2414Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks.Dogtag PKI
- CVE-2022-36378WordPress Floating Div plugin <= 3.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityPluginlySpeaking Floating Div
- CVE-2022-23004Algorithm incorrectly returning error and Invalid unreduced value written to output bufferWestern Digital Sweet B Library
- CVE-2022-23003Shared secret or Point multiplication of NIST P-256 points with X coordinate of zeroWestern Digital Sweet B Library
- CVE-2022-23002Point Compression/Decompression of NIST P-256 points with X coordinate of zeroWestern Digital Sweet B Library
- CVE-2022-23001Sweet-B Library: Point compress/decompress using the wrong bit for signWestern Digital Sweet B Library
- CVE-2022-35632XSS in User InterfaceRapid7 Velociraptor
- CVE-2022-35631Filesystem race on temporary filesRapid7 Velociraptor
- CVE-2022-35630Unsafe HTML Injection in Artifact Collection ReportRapid7 Velociraptor
- CVE-2022-35629Velociraptor Client ID SpoofingRapid7 Velociraptor
- CVE-2022-2579SourceCodester Garage Management System createUser.php cross site scriptingSourceCodester Garage Management System
- CVE-2022-2578SourceCodester Garage Management System createUser.php access controlSourceCodester Garage Management System
- CVE-2022-2577SourceCodester Garage Management System edituser.php sql injectionSourceCodester Garage Management System
- CVE-2022-33881Parsing a maliciously crafted PRT file can force Autodesk AutoCAD 2023 to read beyond allocated boundaries.Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, Aut…
- CVE-2022-27873An attacker can force the victim’s device to perform arbitrary HTTP requests in WAN through a malicious SVG file being parsed by Autodesk FuFusion360
- CVE-2022-36123The Linux kernel before 5.18.13 lacks a certain clear operation for the block starting symbol (.bss).
- CVE-2022-2576In Eclipse Californium version 2.0.0 to 2.7.2 and 3.0.0-3.5.0 a DTLS resumption handshake falls back to a DTLS full handshake on a parameterThe Eclipse Foundation Eclipse Californium · org.eclipse.ca…
- CVE-2022-1799Incorrect signature verification on Google play-services-basement in Google Play SDKGoogle Play Services SDK
- CVE-2022-34526A stack overflow was discovered in the _TIFFVGetField function of Tiffsplit v4.4.0.