CVEs published August 1, 2022
111 CVEs were published on August 1, 2022: 5 critical, 21 high.
- Published
- 111
- Critical
- 5
- High
- 21
- Medium
- 24
- Low
- 6
- Unrated
- 55
- Now in CISA KEV
- 0
- Fix available
- 56
Most affected products
- MediaTek MT7603, MT7610, MT7612, MT7613, MT7615, MT7620, MT…
- 8
- MediaTek MT6833, MT6853, MT6873, MT6877, MT6879, MT6885, MT…
- 6
- DSpace · org.dspace:dspace-jspui
- 5
- vim/vim
- 4
- Artica PFMS Pandora FMS
- 3
- IBM CICS TX Advanced · IBM CICS TX Standard
- 3
- IBM CICS TX Standard · IBM CICS TX Advanced
- 3
- Bosch BF-OS
- 2
- discourse
- 2
- ericcornelissen shescape · shescape
- 2
Critical 5
- CVE-2022-31183mTLS client verification is skipped in fs2 on Node.jstypelevel fs2 · co.fs2:fs2-io +5
- CVE-2022-31181Remote code execution in prestashopPrestaShop · prestashop/prestashop
- CVE-2022-31180Insufficient escaping of whitespace in shescapeericcornelissen shescape · shescape
- CVE-2022-2595Improper Authorization in kromitgmbh/titrakromitgmbh/titra
- CVE-2022-36301BF-OS version 3.x up to and including 3.83 do not enforce strong passwords which may allow a remote attacker to brute-force the device passwBosch BF-OS
High 21
- CVE-2022-35920Improper Limitation of a Pathname to a Restricted Directory in sanicsanic-org sanic · sanic
- CVE-2022-35922Memory allocation based on untrusted length in rust-websocketwebsockets-rs rust-websocket · websocket
- CVE-2022-31198GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contractsopenzeppelin-contracts · @openzeppelin/contracts +1
- CVE-2022-31195Path traversal vulnerability in Simple Archive Format package import in DSpaceDSpace · org.dspace:dspace-api
- CVE-2022-31192Cross Site Scripting possible in DSpace JSPUI "Request a Copy" featureDSpace · org.dspace:dspace-jspui
- CVE-2022-31191Cross Site Scripting possible in DSpace JSPUI spellcheck and autocomplete toolsDSpace · org.dspace:dspace-jspui
- CVE-2022-31194Path traversal vulnerabilities in DSpace JSPUI submission uploadDSpace · org.dspace:dspace-jspui
- CVE-2022-31193URL Redirection to Untrusted Site in Dspace JSPUIDSpace · org.dspace:dspace-jspui
- CVE-2022-31179Insufficient escaping of line feeds for CMD in shescapeericcornelissen shescape · shescape
- CVE-2022-31173Juniper is vulnerable to @DOS GraphQL Nested Fragments overflowgraphql-rust juniper · juniper
- CVE-2022-31109HTTP Host Header Attack Vulnerability in laminas-diactoroslaminas-diactoros · laminas/laminas-diactoros
- CVE-2022-2581Out-of-bounds Read in vim/vimvim/vim
- CVE-2022-2580Heap-based Buffer Overflow in vim/vimvim/vim
- CVE-2022-2571Heap-based Buffer Overflow in vim/vimvim/vim
- CVE-2022-36302File path manipulation vulnerability in BF-OS version 3.00 up to and including 3.83 allows an attacker to modify the file path to access difBosch BF-OS
- CVE-2022-2509A vulnerability found in gnutls.GnuTLS
- CVE-2022-34154WordPress Enable SVG, WebP & ICO Upload plugin <= 1.0.1 - Authenticated Arbitrary File Upload vulnerabilityideasToCode Enable SVG, WebP & ICO Upload
- CVE-2022-26310Improper Authorization in User Management to Vertical Privilege EscalationArtica PFMS Pandora FMS
- CVE-2022-36799This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented.Atlassian Jira Server · Atlassian Jira Data Center
- CVE-2022-31188Server-Side Request Forgery Vulnerability in Computer Vision Annotation Tool (CVAT)cvat-ai cvat
- CVE-2022-35919Authenticated requests for server update admin API allows path traversal in miniominio
Medium, low and unrated 85
- CVE-2022-37315graphql-go (aka GraphQL for Go) through 0.8.0 has infinite recursion in the type definition parser.github.com/graphql-go/graphql
- CVE-2022-35921User preference to prevent private discussions not respected in fof/byobuFriendsOfFlarum byobu · fof/byobu
- CVE-2022-35918Streamlit directory traversal vulnerabilitystreamlit
- CVE-2022-35917Weakness in Transfer Validation Logic in @solana/paysolana-labs solana-pay · @solana/pay
- CVE-2022-35915Unbounded gas consumption in @openzeppelin/contractsopenzeppelin-contracts · @openzeppelin/contracts +3
- CVE-2022-35916Cross chain utilities for Arbitrum L2 see EOA calls as cross chain callsopenzeppelin-contracts · @openzeppelin/contracts +1
- CVE-2022-31189"Internal System Error" page in DSpace JSPUI prints exceptions and stack traces without sanitizationDSpace · org.dspace:dspace-jspui
- CVE-2022-31190Metadata of withdrawn Items is exposed to anonymous users in DSpace XMLUIDSpace · org.dspace:dspace-xmlui
- CVE-2022-31184Email activation route can be abused by spammers in Discoursediscourse
- CVE-2022-31182Cache poisoning via maliciously-formed request in Discoursediscourse
- CVE-2022-31186Leakage of excessive information into log in next-authnextauthjs next-auth · next-auth
- CVE-2022-31185Email addresses are not hidden regardless of selected state in mprwebmakedeb mprweb
- CVE-2022-35118PyroCMS v3.9 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities.
- CVE-2022-34530An issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows attackers to enumerate usernames via password reset re
- CVE-2022-31321The foldername parameter in Bolt 5.1.7 was discovered to have incorrect input validation, allowing attackers to perform directory enumeratio
- CVE-2022-31178Improper Authorization in eLabFTWelabftw
- CVE-2022-31177Possible to infer sensitive information through query strings in Flask-AppBuilderdpgaspar Flask-AppBuilder · flask-appbuilder
- CVE-2022-31155Unauthorized overwriting of saved searches in Sourcegraphsourcegraph
- CVE-2022-31154Indirect Object Access in Sourcegraph Code Monitoringsourcegraph
- CVE-2022-31148Persistent cross site scripting in customer module in Shopwareshopware · shopware/shopware
- CVE-2022-31128Fine grained permissions are not checked in TuleapEnalean tuleap
- CVE-2022-34307IBM CICS TX 11.1 does not set the secure attribute on authorization tokens or session cookies.IBM CICS TX Advanced · IBM CICS TX Standard
- CVE-2022-34164IBM CICS TX 11.1 could allow a local user to impersonate another legitimate user due to improper input validation.IBM CICS TX Standard · IBM CICS TX Advanced
- CVE-2022-34163IBM CICS TX 11.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers.IBM CICS TX Standard · IBM CICS TX Advanced
- CVE-2022-34162IBM CICS TX 11.1 could allow a remote attacker to hijack the clicking action of the victim.IBM CICS TX Standard · IBM CICS TX Advanced
- CVE-2022-34161IBM CICS TX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions traIBM CICS TX Advanced · IBM CICS TX Standard
- CVE-2022-33955IBM CICS TX 11.1 could allow allow an attacker with physical access to the system to execute code due using a back and refresh attack.IBM CICS TX Advanced · IBM CICS TX Standard
- CVE-2022-30699Novel "ghost domain names" attack by updating almost expired delegation informationNLnet Labs Unbound
- CVE-2022-30698Novel "ghost domain names" attack by introducing subdomain delegationsNLnet Labs Unbound
- CVE-2022-2596Inefficient Regular Expression Complexity in node-fetch/node-fetchnode-fetch/node-fetch · node-fetch
- CVE-2022-2589Cross-site Scripting (XSS) - Reflected in beancount/favabeancount/fava · fava
- CVE-2022-34567An issue in \Roaming\Mango\Plugins of University of Texas Multi-image Analysis GUI (Mango) 4.1 allows attackers to escalate privileges via c
- CVE-2022-26445In wifi driver, there is a possible out of bounds write due to a missing bounds check.MediaTek MT7603, MT7610, MT7612, MT7613, MT7615, MT7620, MT…
- CVE-2022-26444In wifi driver, there is a possible out of bounds write due to a missing bounds check.MediaTek MT7603, MT7610, MT7612, MT7613, MT7615, MT7620, MT…
- CVE-2022-26443In wifi driver, there is a possible out of bounds write due to a missing bounds check.MediaTek MT7603, MT7610, MT7612, MT7613, MT7615, MT7620, MT…
- CVE-2022-26442In wifi driver, there is a possible out of bounds write due to a missing bounds check.MediaTek MT7603, MT7610, MT7612, MT7613, MT7615, MT7620, MT…
- CVE-2022-26441In wifi driver, there is a possible out of bounds write due to a missing bounds check.MediaTek MT7603, MT7610, MT7612, MT7613, MT7615, MT7620, MT…
- CVE-2022-26440In wifi driver, there is a possible out of bounds write due to a missing bounds check.MediaTek MT7603, MT7610, MT7612, MT7613, MT7615, MT7620, MT…
- CVE-2022-26439In wifi driver, there is a possible out of bounds write due to a missing bounds check.MediaTek MT7603, MT7610, MT7612, MT7613, MT7615, MT7620, MT…
- CVE-2022-26438In wifi driver, there is a possible out of bounds write due to a missing bounds check.MediaTek MT7603, MT7610, MT7612, MT7613, MT7615, MT7620, MT…
- CVE-2022-26436In emi mpu, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6855, MT6879, MT6895, MT6983
- CVE-2022-26435In mailbox, there is a possible out of bounds write due to type confusion.MediaTek MT6833, MT6853, MT6873, MT6877, MT6879, MT6885, MT…
- CVE-2022-26434In mailbox, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6833, MT6853, MT6873, MT6877, MT6879, MT6885, MT…
- CVE-2022-26433In mailbox, there is a possible out of bounds write due to type confusion.MediaTek MT6833, MT6853, MT6873, MT6877, MT6879, MT6885, MT…
- CVE-2022-26432In mailbox, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6833, MT6853, MT6873, MT6877, MT6879, MT6885, MT…
- CVE-2022-26431In mailbox, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6833, MT6853, MT6873, MT6877, MT6879, MT6885, MT…
- CVE-2022-26430In mailbox, there is a possible out of bounds write due to type confusion.MediaTek MT6833, MT6853, MT6873, MT6877, MT6879, MT6885, MT…
- CVE-2022-21788In scp, there is a possible undefined behavior due to incorrect error handling.MediaTek MT6879, MT6895, MT6983
- CVE-2022-26429In cta, there is a possible way to write permission usage records of an app due to a missing permission check.MediaTek MT6580, MT6735, MT6739, MT6757, MT6761, MT6762, MT…
- CVE-2022-26428In video codec, there is a possible memory corruption due to a race condition.MediaTek MT6739, MT6761, MT6765, MT6771, MT8163, MT8167, MT…
- CVE-2022-26427In camera isp, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6833, MT6853, MT6873, MT6877, MT6893
- CVE-2022-26426In camera isp, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6833, MT6853, MT6873, MT6877, MT6893, MT8167, MT…
- CVE-2022-21792In camera isp, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6833, MT6853, MT6853T, MT6873, MT6875, MT6877, M…
- CVE-2022-21791In camera isp, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6833, MT6853, MT6873, MT6877, MT6885, MT6893
- CVE-2022-21790In camera isp, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6833, MT6853, MT6873, MT6877, MT6893
- CVE-2022-21789In audio ipi, there is a possible memory corruption due to a race condition.MediaTek MT6779, MT6781, MT6785, MT6853, MT6853T, MT6873, M…
- CVE-2022-26437In httpclient, there is a possible out of bounds write due to uninitialized data.MediaTek MT2621, MT2625
- CVE-2022-36343WordPress Enable SVG, WebP & ICO Upload plugin <= 1.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityideasToCode Enable SVG, WebP & ICO Upload
- CVE-2022-2370YaySMTP < 2.2.1 - Subscriber+ SMTP Credentials LeakYaySMTP
- CVE-2022-2369YaySMTP < 2.2.1 - Subscriber+ Logs DisclosureYaySMTP – Simple WP SMTP Mail
- CVE-2022-2328Flexi Quote Rotator <= 0.9.4 - Admin+ Stored Cross-Site ScriptingFlexi Quote Rotator
- CVE-2022-2325Invitation Based Registrations <= 2.2.84 - Admin+ Stored Cross-Site ScriptingInvitation Based Registrations
- CVE-2022-2317Simple Membership < 4.1.3 - Unauthenticated Membership Privilege EscalationSimple Membership
- CVE-2022-2305WordPress Popup <= 1.9.3.8 - Admin+ Stored Cross-Site ScriptingPopups – WordPress Popup
- CVE-2022-2278Featured Image from URL < 4.0.1 - Admin+ Stored Cross-Site ScriptingFeatured Image from URL
- CVE-2022-2273Simple Membership < 4.1.3 - Membership Privilege EscalationSimple Membership
- CVE-2022-2260GiveWP < 2.21.3 - DoS via CSRFGiveWP – Donation Plugin and Fundraising Platform
- CVE-2022-2245Counter Box < 1.2.1 - Arbitrary Counter Activation/Deactivation via CSRFCounter Box – WordPress plugin for countdown, timer, count…
- CVE-2022-2241Featured Image from URL < 4.0.0 - Arbitrary Settings Update to Stored XSS via CSRFFeatured Image from URL
- CVE-2022-2215GiveWP < 2.21.3 - Admin+ Stored Cross-Site ScriptingGiveWP – Donation Plugin and Fundraising Platform
- CVE-2022-2184CAPTCHA 4WP < 7.1.0 - Local File Inclusion via CSRFCAPTCHA 4WP
- CVE-2022-2181Advanced WordPress Reset < 1.6 - Reflected Cross-Site ScriptingAdvanced WordPress Reset
- CVE-2022-2171Progressive License <= 1.1.0 - CSRF to Stored XSSProgressive License
- CVE-2022-2170Microsoft Advertising Universal Event Tracking < 1.0.4 - Admin+ Stored Cross-Site ScriptingMicrosoft Advertising Universal Event Tracking
- CVE-2022-1950Youzify < 1.2.0 - Unauthenticated SQLiYouzify – BuddyPress Community, User Profile, Social Networ…
- CVE-2022-1906Copyright Proof <= 4.16 - Reflected Cross-Site-ScriptingCopyright Proof
- CVE-2022-1600YOP Poll < 6.4.3 - IP SpoofingYOP Poll
- CVE-2022-1585Project Source Code Download <= 1.0.0 - Unauthenticated Backup DownloadWordPress project source code download
- CVE-2022-1561Crafted backend URLs in Lura ProjectKrakenD Lura Project · KrakenD-CE +1
- CVE-2022-1324Event Timeline <= 1.1.5 - Admin+ Stored Cross-Site ScriptingEvent Timeline – Vertical Timeline
- CVE-2022-0598Login with phone number < 1.3.8 - Multiple Admin+ Stored XSSLogin with phone number
- CVE-2022-26309Cross-Site Request en Bulk operation (User operation)Artica PFMS Pandora FMS
- CVE-2022-26308Improper Access Control in Configuration (Credential store)Artica PFMS Pandora FMS
- CVE-2022-27255In Realtek eCos RSDK 1.5.7p1 and MSDK 4.9.4p1, the SIP ALG function that rewrites SDP data has a stack-based buffer overflow.
- CVE-2022-2598Out-of-bounds Write to API in vim/vimvim/vim