# CVEs published 2022-08-01

111 CVEs were published on August 1, 2022: 5 critical, 21 high. Days are UTC.

- [CVE-2022-37315](https://cve.now/CVE-2022-37315.md): graphql-go (aka GraphQL for Go) through 0.8.0 has infinite recursion in the type definition parser. (no CVSS, github.com/graphql-go/graphql)
- [CVE-2022-35921](https://cve.now/CVE-2022-35921.md): User preference to prevent private discussions not respected in fof/byobu (CVSS 3.5, FriendsOfFlarum byobu · fof/byobu)
- [CVE-2022-35920](https://cve.now/CVE-2022-35920.md): Improper Limitation of a Pathname to a Restricted Directory in sanic (CVSS 8.3, sanic-org sanic · sanic)
- [CVE-2022-35922](https://cve.now/CVE-2022-35922.md): Memory allocation based on untrusted length in rust-websocket (CVSS 7.5, websockets-rs rust-websocket · websocket)
- [CVE-2022-35918](https://cve.now/CVE-2022-35918.md): Streamlit directory traversal vulnerability (CVSS 6.5, streamlit)
- [CVE-2022-35917](https://cve.now/CVE-2022-35917.md): Weakness in Transfer Validation Logic in @solana/pay (CVSS 5.3, solana-labs solana-pay · @solana/pay)
- [CVE-2022-35915](https://cve.now/CVE-2022-35915.md): Unbounded gas consumption in @openzeppelin/contracts (CVSS 5.3, openzeppelin-contracts · @openzeppelin/contracts +3)
- [CVE-2022-35916](https://cve.now/CVE-2022-35916.md): Cross chain utilities for Arbitrum L2 see EOA calls as cross chain calls (CVSS 5.3, openzeppelin-contracts · @openzeppelin/contracts +1)
- [CVE-2022-31198](https://cve.now/CVE-2022-31198.md): GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts (CVSS 7.5, openzeppelin-contracts · @openzeppelin/contracts +1)
- [CVE-2022-31195](https://cve.now/CVE-2022-31195.md): Path traversal vulnerability in Simple Archive Format package import in DSpace (CVSS 7.2, DSpace · org.dspace:dspace-api)
- [CVE-2022-31192](https://cve.now/CVE-2022-31192.md): Cross Site Scripting possible in DSpace JSPUI "Request a Copy" feature (CVSS 7.1, DSpace · org.dspace:dspace-jspui)
- [CVE-2022-31191](https://cve.now/CVE-2022-31191.md): Cross Site Scripting possible in DSpace JSPUI spellcheck and autocomplete tools (CVSS 7.1, DSpace · org.dspace:dspace-jspui)
- [CVE-2022-31194](https://cve.now/CVE-2022-31194.md): Path traversal vulnerabilities in DSpace JSPUI submission upload (CVSS 8.2, DSpace · org.dspace:dspace-jspui)
- [CVE-2022-31193](https://cve.now/CVE-2022-31193.md): URL Redirection to Untrusted Site in Dspace JSPUI (CVSS 7.1, DSpace · org.dspace:dspace-jspui)
- [CVE-2022-31189](https://cve.now/CVE-2022-31189.md): "Internal System Error" page in DSpace JSPUI prints exceptions and stack traces without sanitization (CVSS 5.3, DSpace · org.dspace:dspace-jspui)
- [CVE-2022-31190](https://cve.now/CVE-2022-31190.md): Metadata of withdrawn Items is exposed to anonymous users in DSpace XMLUI (CVSS 5.3, DSpace · org.dspace:dspace-xmlui)
- [CVE-2022-31183](https://cve.now/CVE-2022-31183.md): mTLS client verification is skipped in fs2 on Node.js (CVSS 9.1, typelevel fs2 · co.fs2:fs2-io +5)
- [CVE-2022-31184](https://cve.now/CVE-2022-31184.md): Email activation route can be abused by spammers in Discourse (CVSS 6.5, discourse)
- [CVE-2022-31182](https://cve.now/CVE-2022-31182.md): Cache poisoning via maliciously-formed request in Discourse (CVSS 5.3, discourse)
- [CVE-2022-31181](https://cve.now/CVE-2022-31181.md): Remote code execution in prestashop (CVSS 9.8, PrestaShop · prestashop/prestashop)
- [CVE-2022-31186](https://cve.now/CVE-2022-31186.md): Leakage of excessive information into log in next-auth (CVSS 3.3, nextauthjs next-auth · next-auth)
- [CVE-2022-31185](https://cve.now/CVE-2022-31185.md): Email addresses are not hidden regardless of selected state in mprweb (CVSS 5.3, makedeb mprweb)
- [CVE-2022-35118](https://cve.now/CVE-2022-35118.md): PyroCMS v3.9 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities. (no CVSS)
- [CVE-2022-34530](https://cve.now/CVE-2022-34530.md): An issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows attackers to enumerate usernames via password reset re (no CVSS)
- [CVE-2022-31321](https://cve.now/CVE-2022-31321.md): The foldername parameter in Bolt 5.1.7 was discovered to have incorrect input validation, allowing attackers to perform directory enumeratio (no CVSS)
- [CVE-2022-31179](https://cve.now/CVE-2022-31179.md): Insufficient escaping of line feeds for CMD in shescape (CVSS 8.1, ericcornelissen shescape · shescape)
- [CVE-2022-31180](https://cve.now/CVE-2022-31180.md): Insufficient escaping of whitespace in shescape (CVSS 9.8, ericcornelissen shescape · shescape)
- [CVE-2022-31178](https://cve.now/CVE-2022-31178.md): Improper Authorization in eLabFTW (CVSS 4.3, elabftw)
- [CVE-2022-31177](https://cve.now/CVE-2022-31177.md): Possible to infer sensitive information through query strings in Flask-AppBuilder (CVSS 2.7, dpgaspar Flask-AppBuilder · flask-appbuilder)
- [CVE-2022-31173](https://cve.now/CVE-2022-31173.md): Juniper is vulnerable to @DOS GraphQL Nested Fragments overflow (CVSS 7.5, graphql-rust juniper · juniper)
- [CVE-2022-31155](https://cve.now/CVE-2022-31155.md): Unauthorized overwriting of saved searches in Sourcegraph (CVSS 4.3, sourcegraph)
- [CVE-2022-31154](https://cve.now/CVE-2022-31154.md): Indirect Object Access in Sourcegraph Code Monitoring (CVSS 6.4, sourcegraph)
- [CVE-2022-31148](https://cve.now/CVE-2022-31148.md): Persistent cross site scripting in customer module in Shopware (CVSS 5.4, shopware · shopware/shopware)
- [CVE-2022-31128](https://cve.now/CVE-2022-31128.md): Fine grained permissions are not checked in Tuleap (CVSS 5.4, Enalean tuleap)
- [CVE-2022-31109](https://cve.now/CVE-2022-31109.md): HTTP Host Header Attack Vulnerability in laminas-diactoros (CVSS 7.2, laminas-diactoros · laminas/laminas-diactoros)
- [CVE-2022-34307](https://cve.now/CVE-2022-34307.md): IBM CICS TX 11.1 does not set the secure attribute on authorization tokens or session cookies. (CVSS 4.3, IBM CICS TX Advanced · IBM CICS TX Standard)
- [CVE-2022-34164](https://cve.now/CVE-2022-34164.md): IBM CICS TX 11.1 could allow a local user to impersonate another legitimate user due to improper input validation. (CVSS 5.9, IBM CICS TX Standard · IBM CICS TX Advanced)
- [CVE-2022-34163](https://cve.now/CVE-2022-34163.md): IBM CICS TX 11.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. (CVSS 5.4, IBM CICS TX Standard · IBM CICS TX Advanced)
- [CVE-2022-34162](https://cve.now/CVE-2022-34162.md): IBM CICS TX 11.1 could allow a remote attacker to hijack the clicking action of the victim. (CVSS 5.4, IBM CICS TX Standard · IBM CICS TX Advanced)
- [CVE-2022-34161](https://cve.now/CVE-2022-34161.md): IBM CICS TX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions tra (CVSS 4.3, IBM CICS TX Advanced · IBM CICS TX Standard)
- [CVE-2022-33955](https://cve.now/CVE-2022-33955.md): IBM CICS TX 11.1 could allow allow an attacker with physical access to the system to execute code due using a back and refresh attack. (CVSS 4.3, IBM CICS TX Advanced · IBM CICS TX Standard)
- [CVE-2022-30699](https://cve.now/CVE-2022-30699.md): Novel "ghost domain names" attack by updating almost expired delegation information (no CVSS, NLnet Labs Unbound)
- [CVE-2022-30698](https://cve.now/CVE-2022-30698.md): Novel "ghost domain names" attack by introducing subdomain delegations (no CVSS, NLnet Labs Unbound)
- [CVE-2022-2596](https://cve.now/CVE-2022-2596.md): Inefficient Regular Expression Complexity in node-fetch/node-fetch (CVSS 5.9, node-fetch/node-fetch · node-fetch)
- [CVE-2022-2595](https://cve.now/CVE-2022-2595.md): Improper Authorization in kromitgmbh/titra (CVSS 9.8, kromitgmbh/titra)
- [CVE-2022-2581](https://cve.now/CVE-2022-2581.md): Out-of-bounds Read in vim/vim (CVSS 7.8, vim/vim)
- [CVE-2022-2580](https://cve.now/CVE-2022-2580.md): Heap-based Buffer Overflow in vim/vim (CVSS 7.3, vim/vim)
- [CVE-2022-2589](https://cve.now/CVE-2022-2589.md): Cross-site Scripting (XSS) - Reflected in beancount/fava (CVSS 6.9, beancount/fava · fava)
- [CVE-2022-2571](https://cve.now/CVE-2022-2571.md): Heap-based Buffer Overflow in vim/vim (CVSS 7.8, vim/vim)
- [CVE-2022-36302](https://cve.now/CVE-2022-36302.md): File path manipulation vulnerability in BF-OS version 3.00 up to and including 3.83 allows an attacker to modify the file path to access dif (CVSS 8.8, Bosch BF-OS)
- [CVE-2022-36301](https://cve.now/CVE-2022-36301.md): BF-OS version 3.x up to and including 3.83 do not enforce strong passwords which may allow a remote attacker to brute-force the device passw (CVSS 9.8, Bosch BF-OS)
- [CVE-2022-34567](https://cve.now/CVE-2022-34567.md): An issue in \\Roaming\\Mango\\Plugins of University of Texas Multi-image Analysis GUI (Mango) 4.1 allows attackers to escalate privileges via c (no CVSS)
- [CVE-2022-2509](https://cve.now/CVE-2022-2509.md): A vulnerability found in gnutls. (CVSS 7.5, GnuTLS)
- [CVE-2022-26445](https://cve.now/CVE-2022-26445.md): In wifi driver, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT7603, MT7610, MT7612, MT7613, MT7615, MT7620, MT…)
- [CVE-2022-26444](https://cve.now/CVE-2022-26444.md): In wifi driver, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT7603, MT7610, MT7612, MT7613, MT7615, MT7620, MT…)
- [CVE-2022-26443](https://cve.now/CVE-2022-26443.md): In wifi driver, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT7603, MT7610, MT7612, MT7613, MT7615, MT7620, MT…)
- [CVE-2022-26442](https://cve.now/CVE-2022-26442.md): In wifi driver, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT7603, MT7610, MT7612, MT7613, MT7615, MT7620, MT…)
- [CVE-2022-26441](https://cve.now/CVE-2022-26441.md): In wifi driver, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT7603, MT7610, MT7612, MT7613, MT7615, MT7620, MT…)
- [CVE-2022-26440](https://cve.now/CVE-2022-26440.md): In wifi driver, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT7603, MT7610, MT7612, MT7613, MT7615, MT7620, MT…)
- [CVE-2022-26439](https://cve.now/CVE-2022-26439.md): In wifi driver, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT7603, MT7610, MT7612, MT7613, MT7615, MT7620, MT…)
- [CVE-2022-26438](https://cve.now/CVE-2022-26438.md): In wifi driver, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT7603, MT7610, MT7612, MT7613, MT7615, MT7620, MT…)
- [CVE-2022-26436](https://cve.now/CVE-2022-26436.md): In emi mpu, there is a possible out of bounds read due to a missing bounds check. (no CVSS, MediaTek MT6855, MT6879, MT6895, MT6983)
- [CVE-2022-26435](https://cve.now/CVE-2022-26435.md): In mailbox, there is a possible out of bounds write due to type confusion. (no CVSS, MediaTek MT6833, MT6853, MT6873, MT6877, MT6879, MT6885, MT…)
- [CVE-2022-26434](https://cve.now/CVE-2022-26434.md): In mailbox, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT6833, MT6853, MT6873, MT6877, MT6879, MT6885, MT…)
- [CVE-2022-26433](https://cve.now/CVE-2022-26433.md): In mailbox, there is a possible out of bounds write due to type confusion. (no CVSS, MediaTek MT6833, MT6853, MT6873, MT6877, MT6879, MT6885, MT…)
- [CVE-2022-26432](https://cve.now/CVE-2022-26432.md): In mailbox, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT6833, MT6853, MT6873, MT6877, MT6879, MT6885, MT…)
- [CVE-2022-26431](https://cve.now/CVE-2022-26431.md): In mailbox, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT6833, MT6853, MT6873, MT6877, MT6879, MT6885, MT…)
- [CVE-2022-26430](https://cve.now/CVE-2022-26430.md): In mailbox, there is a possible out of bounds write due to type confusion. (no CVSS, MediaTek MT6833, MT6853, MT6873, MT6877, MT6879, MT6885, MT…)
- [CVE-2022-21788](https://cve.now/CVE-2022-21788.md): In scp, there is a possible undefined behavior due to incorrect error handling. (no CVSS, MediaTek MT6879, MT6895, MT6983)
- [CVE-2022-26429](https://cve.now/CVE-2022-26429.md): In cta, there is a possible way to write permission usage records of an app due to a missing permission check. (no CVSS, MediaTek MT6580, MT6735, MT6739, MT6757, MT6761, MT6762, MT…)
- [CVE-2022-26428](https://cve.now/CVE-2022-26428.md): In video codec, there is a possible memory corruption due to a race condition. (no CVSS, MediaTek MT6739, MT6761, MT6765, MT6771, MT8163, MT8167, MT…)
- [CVE-2022-26427](https://cve.now/CVE-2022-26427.md): In camera isp, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT6833, MT6853, MT6873, MT6877, MT6893)
- [CVE-2022-26426](https://cve.now/CVE-2022-26426.md): In camera isp, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT6833, MT6853, MT6873, MT6877, MT6893, MT8167, MT…)
- [CVE-2022-21792](https://cve.now/CVE-2022-21792.md): In camera isp, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT6833, MT6853, MT6853T, MT6873, MT6875, MT6877, M…)
- [CVE-2022-21791](https://cve.now/CVE-2022-21791.md): In camera isp, there is a possible out of bounds read due to a missing bounds check. (no CVSS, MediaTek MT6833, MT6853, MT6873, MT6877, MT6885, MT6893)
- [CVE-2022-21790](https://cve.now/CVE-2022-21790.md): In camera isp, there is a possible out of bounds read due to a missing bounds check. (no CVSS, MediaTek MT6833, MT6853, MT6873, MT6877, MT6893)
- [CVE-2022-21789](https://cve.now/CVE-2022-21789.md): In audio ipi, there is a possible memory corruption due to a race condition. (no CVSS, MediaTek MT6779, MT6781, MT6785, MT6853, MT6853T, MT6873, M…)
- [CVE-2022-26437](https://cve.now/CVE-2022-26437.md): In httpclient, there is a possible out of bounds write due to uninitialized data. (no CVSS, MediaTek MT2621, MT2625)
- [CVE-2022-34154](https://cve.now/CVE-2022-34154.md): WordPress Enable SVG, WebP & ICO Upload plugin \<= 1.0.1 - Authenticated Arbitrary File Upload vulnerability (CVSS 7.2, ideasToCode Enable SVG, WebP & ICO Upload)
- [CVE-2022-36343](https://cve.now/CVE-2022-36343.md): WordPress Enable SVG, WebP & ICO Upload plugin \<= 1.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 3.4, ideasToCode Enable SVG, WebP & ICO Upload)
- [CVE-2022-2370](https://cve.now/CVE-2022-2370.md): YaySMTP \< 2.2.1 - Subscriber+ SMTP Credentials Leak (no CVSS, YaySMTP)
- [CVE-2022-2369](https://cve.now/CVE-2022-2369.md): YaySMTP \< 2.2.1 - Subscriber+ Logs Disclosure (no CVSS, YaySMTP – Simple WP SMTP Mail)
- [CVE-2022-2328](https://cve.now/CVE-2022-2328.md): Flexi Quote Rotator \<= 0.9.4 - Admin+ Stored Cross-Site Scripting (no CVSS, Flexi Quote Rotator)
- [CVE-2022-2325](https://cve.now/CVE-2022-2325.md): Invitation Based Registrations \<= 2.2.84 - Admin+ Stored Cross-Site Scripting (no CVSS, Invitation Based Registrations)
- [CVE-2022-2317](https://cve.now/CVE-2022-2317.md): Simple Membership \< 4.1.3 - Unauthenticated Membership Privilege Escalation (no CVSS, Simple Membership)
- [CVE-2022-2305](https://cve.now/CVE-2022-2305.md): WordPress Popup \<= 1.9.3.8 - Admin+ Stored Cross-Site Scripting (no CVSS, Popups – WordPress Popup)
- [CVE-2022-2278](https://cve.now/CVE-2022-2278.md): Featured Image from URL \< 4.0.1 - Admin+ Stored Cross-Site Scripting (no CVSS, Featured Image from URL)
- [CVE-2022-2273](https://cve.now/CVE-2022-2273.md): Simple Membership \< 4.1.3 - Membership Privilege Escalation (no CVSS, Simple Membership)
- [CVE-2022-2260](https://cve.now/CVE-2022-2260.md): GiveWP \< 2.21.3 - DoS via CSRF (no CVSS, GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2022-2245](https://cve.now/CVE-2022-2245.md): Counter Box \< 1.2.1 - Arbitrary Counter Activation/Deactivation via CSRF (no CVSS, Counter Box – WordPress plugin for countdown, timer, count…)
- [CVE-2022-2241](https://cve.now/CVE-2022-2241.md): Featured Image from URL \< 4.0.0 - Arbitrary Settings Update to Stored XSS via CSRF (no CVSS, Featured Image from URL)
- [CVE-2022-2215](https://cve.now/CVE-2022-2215.md): GiveWP \< 2.21.3 - Admin+ Stored Cross-Site Scripting (no CVSS, GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2022-2184](https://cve.now/CVE-2022-2184.md): CAPTCHA 4WP \< 7.1.0 - Local File Inclusion via CSRF (no CVSS, CAPTCHA 4WP)
- [CVE-2022-2181](https://cve.now/CVE-2022-2181.md): Advanced WordPress Reset \< 1.6 - Reflected Cross-Site Scripting (no CVSS, Advanced WordPress Reset)
- [CVE-2022-2171](https://cve.now/CVE-2022-2171.md): Progressive License \<= 1.1.0 - CSRF to Stored XSS (no CVSS, Progressive License)
- [CVE-2022-2170](https://cve.now/CVE-2022-2170.md): Microsoft Advertising Universal Event Tracking \< 1.0.4 - Admin+ Stored Cross-Site Scripting (no CVSS, Microsoft Advertising Universal Event Tracking)
- [CVE-2022-1950](https://cve.now/CVE-2022-1950.md): Youzify \< 1.2.0 - Unauthenticated SQLi (no CVSS, Youzify – BuddyPress Community, User Profile, Social Networ…)
- [CVE-2022-1906](https://cve.now/CVE-2022-1906.md): Copyright Proof \<= 4.16 - Reflected Cross-Site-Scripting (no CVSS, Copyright Proof)
- [CVE-2022-1600](https://cve.now/CVE-2022-1600.md): YOP Poll \< 6.4.3 - IP Spoofing (no CVSS, YOP Poll)
- [CVE-2022-1585](https://cve.now/CVE-2022-1585.md): Project Source Code Download \<= 1.0.0 - Unauthenticated Backup Download (no CVSS, WordPress project source code download)
- [CVE-2022-1561](https://cve.now/CVE-2022-1561.md): Crafted backend URLs in Lura Project (CVSS 4.0, KrakenD Lura Project · KrakenD-CE +1)
- [CVE-2022-1324](https://cve.now/CVE-2022-1324.md): Event Timeline \<= 1.1.5 - Admin+ Stored Cross-Site Scripting (no CVSS, Event Timeline – Vertical Timeline)
- [CVE-2022-0598](https://cve.now/CVE-2022-0598.md): Login with phone number \< 1.3.8 - Multiple Admin+ Stored XSS (no CVSS, Login with phone number)
- [CVE-2022-26310](https://cve.now/CVE-2022-26310.md): Improper Authorization in User Management to Vertical Privilege Escalation (CVSS 7.3, Artica PFMS Pandora FMS)
- [CVE-2022-26309](https://cve.now/CVE-2022-26309.md): Cross-Site Request en Bulk operation (User operation) (CVSS 3.7, Artica PFMS Pandora FMS)
- [CVE-2022-26308](https://cve.now/CVE-2022-26308.md): Improper Access Control in Configuration (Credential store) (CVSS 3.7, Artica PFMS Pandora FMS)
- [CVE-2022-27255](https://cve.now/CVE-2022-27255.md): In Realtek eCos RSDK 1.5.7p1 and MSDK 4.9.4p1, the SIP ALG function that rewrites SDP data has a stack-based buffer overflow. (no CVSS)
- [CVE-2022-36799](https://cve.now/CVE-2022-36799.md): This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. (CVSS 7.2, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2022-2598](https://cve.now/CVE-2022-2598.md): Out-of-bounds Write to API in vim/vim (CVSS 6.5, vim/vim)
- [CVE-2022-31188](https://cve.now/CVE-2022-31188.md): Server-Side Request Forgery Vulnerability in Computer Vision Annotation Tool (CVAT) (CVSS 8.6, cvat-ai cvat)
- [CVE-2022-35919](https://cve.now/CVE-2022-35919.md): Authenticated requests for server update admin API allows path traversal in minio (CVSS 7.4, minio)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-08-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.