# CVEs published 2022-07-29

38 CVEs were published on July 29, 2022: 2 critical, 1 high. Days are UTC.

- [CVE-2021-27785](https://cve.now/CVE-2021-27785.md): HCL Commerce could allow a local attacker to obtain sensitive personal information (CVE-2021-27785) (CVSS 3.9, HCL Software HCL Commerce)
- [CVE-2022-30083](https://cve.now/CVE-2022-30083.md): EllieGrid Android Application version 3.4.1 is vulnerable to Code Injection. (no CVSS)
- [CVE-2022-36336](https://cve.now/CVE-2022-36336.md): A link following vulnerability in the scanning function of Trend Micro Apex One and Worry-Free Business Security agents could allow a local (no CVSS, Trend Micro Apex One · Trend Micro Worry-Free Business Secu…)
- [CVE-2022-35234](https://cve.now/CVE-2022-35234.md): Trend Micro Security 2021 and 2022 (Consumer) is vulnerable to an Out-Of-Bounds Read Information Disclosure Vulnerability that could allow a (no CVSS, Trend Micro Security)
- [CVE-2022-33158](https://cve.now/CVE-2022-33158.md): Trend Micro VPN Proxy Pro version 5.2.1026 and below contains a vulnerability involving some overly permissive folders in a key directory wh (no CVSS, Trend Micro VPN Proxy One Pro)
- [CVE-2022-34531](https://cve.now/CVE-2022-34531.md): DedeCMS v5.7.95 was discovered to contain a remote code execution (RCE) vulnerability via the component mytag\_ main.php. (no CVSS)
- [CVE-2022-34528](https://cve.now/CVE-2022-34528.md): D-Link DSL-3782 v1.03 and below was discovered to contain a stack overflow via the function getAttrValue. (no CVSS)
- [CVE-2022-34527](https://cve.now/CVE-2022-34527.md): D-Link DSL-3782 v1.03 and below was discovered to contain a command injection vulnerability via the function byte\_4C0160. (no CVSS)
- [CVE-2022-34496](https://cve.now/CVE-2022-34496.md): Hiby R3 PRO firmware v1.5 to v1.7 was discovered to contain a file upload vulnerability via the file upload feature. (no CVSS)
- [CVE-2022-2324](https://cve.now/CVE-2022-2324.md): Improperly Implemented Security Check vulnerability in the SonicWall Hosted Email Security leads to bypass of Capture ATP security service i (no CVSS, SonicWall Email Security)
- [CVE-2022-22280](https://cve.now/CVE-2022-22280.md): Improper Neutralization of Special Elements used in an SQL Command leading to Unauthenticated SQL Injection vulnerability, impacting SonicWa (no CVSS, SonicWall GMS · SonicWall Analytics On-Prem)
- [CVE-2022-36447](https://cve.now/CVE-2022-36447.md): An inflation issue was discovered in Chia Network CAT1 Standard 1.0.0. (no CVSS, chia-blockchain)
- [CVE-2022-2323](https://cve.now/CVE-2022-2323.md): Improper neutralization of special elements used in a user input allows an authenticated malicious user to perform remote code execution in (no CVSS, SonicWall Switch)
- [CVE-2022-27864](https://cve.now/CVE-2022-27864.md): A Double Free vulnerability allows remote attackers to execute arbitrary code through DesignReview.exe application on PDF files within affec (no CVSS, Autodesk Design Review)
- [CVE-2022-27866](https://cve.now/CVE-2022-27866.md): A maliciously crafted TIFF file when consumed through DesignReview.exe application can be forced to read beyond allocated boundaries when pa (no CVSS, Autodesk Design Review)
- [CVE-2022-27865](https://cve.now/CVE-2022-27865.md): A maliciously crafted TGA or PCX file may be used to write beyond the allocated buffer through DesignReview.exe application while parsing TG (no CVSS, Autodesk Design Review)
- [CVE-2022-2414](https://cve.now/CVE-2022-2414.md): Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. (no CVSS, Dogtag PKI)
- [CVE-2022-36378](https://cve.now/CVE-2022-36378.md): WordPress Floating Div plugin \<= 3.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, PluginlySpeaking Floating Div)
- [CVE-2022-23004](https://cve.now/CVE-2022-23004.md): Algorithm incorrectly returning error and Invalid unreduced value written to output buffer (CVSS 5.3, Western Digital Sweet B Library)
- [CVE-2022-23003](https://cve.now/CVE-2022-23003.md): Shared secret or Point multiplication of NIST P-256 points with X coordinate of zero (CVSS 5.3, Western Digital Sweet B Library)
- [CVE-2022-23002](https://cve.now/CVE-2022-23002.md): Point Compression/Decompression of NIST P-256 points with X coordinate of zero (CVSS 5.3, Western Digital Sweet B Library)
- [CVE-2022-23001](https://cve.now/CVE-2022-23001.md): Sweet-B Library: Point compress/decompress using the wrong bit for sign (CVSS 5.3, Western Digital Sweet B Library)
- [CVE-2022-35632](https://cve.now/CVE-2022-35632.md): XSS in User Interface (no CVSS, Rapid7 Velociraptor)
- [CVE-2022-35631](https://cve.now/CVE-2022-35631.md): Filesystem race on temporary files (no CVSS, Rapid7 Velociraptor)
- [CVE-2022-35630](https://cve.now/CVE-2022-35630.md): Unsafe HTML Injection in Artifact Collection Report (no CVSS, Rapid7 Velociraptor)
- [CVE-2022-35629](https://cve.now/CVE-2022-35629.md): Velociraptor Client ID Spoofing (no CVSS, Rapid7 Velociraptor)
- [CVE-2022-2579](https://cve.now/CVE-2022-2579.md): SourceCodester Garage Management System createUser.php cross site scripting (CVSS 3.5, SourceCodester Garage Management System)
- [CVE-2022-2578](https://cve.now/CVE-2022-2578.md): SourceCodester Garage Management System createUser.php access control (CVSS 6.3, SourceCodester Garage Management System)
- [CVE-2022-2577](https://cve.now/CVE-2022-2577.md): SourceCodester Garage Management System edituser.php sql injection (CVSS 6.3, SourceCodester Garage Management System)
- [CVE-2022-33881](https://cve.now/CVE-2022-33881.md): Parsing a maliciously crafted PRT file can force Autodesk AutoCAD 2023 to read beyond allocated boundaries. (no CVSS, Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, Aut…)
- [CVE-2022-27873](https://cve.now/CVE-2022-27873.md): An attacker can force the victim’s device to perform arbitrary HTTP requests in WAN through a malicious SVG file being parsed by Autodesk Fu (no CVSS, Fusion360)
- [CVE-2022-35643](https://cve.now/CVE-2022-35643.md): IBM PowerVM VIOS 3.1 could allow a remote attacker to tamper with system configuration or cause a denial of service. (CVSS 9.1, IBM PowerVM VIOS)
- [CVE-2022-36123](https://cve.now/CVE-2022-36123.md): The Linux kernel before 5.18.13 lacks a certain clear operation for the block starting symbol (.bss). (no CVSS)
- [CVE-2022-2576](https://cve.now/CVE-2022-2576.md): In Eclipse Californium version 2.0.0 to 2.7.2 and 3.0.0-3.5.0 a DTLS resumption handshake falls back to a DTLS full handshake on a parameter (no CVSS, The Eclipse Foundation Eclipse Californium · org.eclipse.ca…)
- [CVE-2022-1277](https://cve.now/CVE-2022-1277.md): SQL Injection in Inavitas Solar Log (CVSS 9.4, Inavitas Solar Log)
- [CVE-2022-24912](https://cve.now/CVE-2022-24912.md): Timing Attack (CVSS 7.5, github.com/runatlantis/atlantis/server/controllers/events ·…)
- [CVE-2022-1799](https://cve.now/CVE-2022-1799.md): Incorrect signature verification on Google play-services-basement in Google Play SDK (CVSS 5.7, Google Play Services SDK)
- [CVE-2022-34526](https://cve.now/CVE-2022-34526.md): A stack overflow was discovered in the \_TIFFVGetField function of Tiffsplit v4.4.0. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-07-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.