Skip to content
OpenAdvisories

Archive

July 2022

Vulnerabilities first published in this month (UTC), newest first.

← June 2022 2022 / July August 2022 →
  1. 184
  2. 28
  3. 33
  4. 438
  5. 532
  6. 695
  7. 748
  8. 825
  9. 91
  10. 102
  11. 11205
  12. 12186
  13. 1354
  14. 1468
  15. 1581
  16. 1612
  17. 1776
  18. 18100
  19. 19136
  20. 2097
  21. 2183
  22. 2273
  23. 234
  24. 243
  25. 25102
  26. 26115
  27. 27115
  28. 2893
  29. 2941
  30. 301
  31. 3112
All Critical High Medium Low Exploited only Public exploit

90 results · Clear filters · Feed

  • Critical 9.1
    CVE-2022-35643

    IBM PowerVM VIOS 3.1 could allow a remote attacker to tamper with system configuration or cause a denial of service. IB…

    IBM PowerVM VIOS
  • Critical 9.4
    CVE-2022-1277

    SQL Injection in Inavitas Solar Log

    Inavitas Solar Log product has an unauthenticated SQL Injection vulnerability.

    Inavitas Inavitas Solar Log
  • Critical 9.8
    CVE-2022-34558

    WMAgent arbitrary code execution via a crafted dbs-client package

    WMAgent v1.3.3rc2 and 1.3.3rc1, reqmgr 2 1.4.1rc5 and 1.4.0rc2, reqmon 1.4.1rc5, and global-workqueue 1.4.1rc5 allows attackers to execute arbitrary code via a crafted dbs-client package.

    global-workqueue wmagent reqmon reqmgr2 PyPI
  • Critical 10.0
    CVE-2021-41556

    sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read (in the core interpreter) that c…

    squirrel3 squirrel3 Debian Ubuntu
  • Critical 10.0
    CVE-2022-22683

    Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Media…

    Synology Media Server
  • Critical 9.6
    CVE-2022-36990

    An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and …

  • Critical 9.9
    CVE-2022-36992

    An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and …

  • Critical 9.3
    CVE-2022-36949

    In Veritas NetBackup OpsCenter, an attacker with local access to a NetBackup OpsCenter server could potentially escalat…

  • Critical 9.8
    CVE-2022-36950

    In Veritas NetBackup OpsCenter, an unauthenticated remote attacker may be able to perform remote command execution thro…

  • Critical 9.8
    CVE-2022-36951

    In Veritas NetBackup OpsCenter, an unauthenticated remote attacker may compromise the host by exploiting an incorrectly…

  • Critical 9.9
    CVE-2022-36954

    In Veritas NetBackup OpsCenter, under specific conditions, an authenticated remote attacker may be able to create or mo…

  • Critical 9.0
    CVE-2022-36956

    In Veritas NetBackup, the NetBackup Client allows arbitrary command execution from any remote host that has access to a…

  • Critical 9.9
    CVE-2022-2550 EPSS 49%

    OS Command Injection in hestiacp/hestiacp

    OS Command Injection in GitHub repository hestiacp/hestiacp prior to 1.6.5.

    hestiacp hestiacp/hestiacp
  • Critical 10.0
    CVE-2022-2310

    Skyhigh SWG Authentication bypass vulnerability

    An authentication bypass vulnerability in Skyhigh SWG in main releases 10.x prior to 10.2.12, 9.x prior to 9.2.23, 8.x prior to 8.2.28, and controlled release 11.x prior to 11.2.1 allows a remote attacker to bypass authentication into the administration User …

    Skyhigh Security Skyhigh Secure Web Gateway (SWG)
  • Critical 9.8
    CVE-2022-30271

    The Motorola ACE1000 RTU through 2022-05-02 ships with a hardcoded SSH private key and initialization scripts (such as …

  • Critical 9.1
    CVE-2022-29951

    JTEKT TOYOPUC PLCs through 2022-04-29 mishandle authentication. They utilize the CMPLink/TCP protocol (configurable on …

  • Critical 9.0
    CVE-2022-35131 Public exploit

    Joplin is vulnerable to arbitrary code execution

    Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles.

    joplin npm
  • Critical 9.8
    CVE-2022-24083

    Password authentication bypass vulnerability for local accounts can be used to bypass local authentication checks.

    Pega Systems Pega Infinity
  • Critical 9.8
    CVE-2022-35649 Public exploit

    Moodle PostScript Code Injection

    The vulnerability was found in Moodle, occurs due to improper input validation when parsing PostScript code. An omitted execution parameter results in a remote code execution risk for sites running GhostScript versions older than 9.50. Successful exploitation…

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Critical 9.8
    CVE-2020-28447

    Command Injection

    This affects all versions of package xopen. The injection point is located in line 14 in index.js in the exported function xopen(filepath)

    xopen npm
  • Critical 9.4
    CVE-2020-28435

    Command Injection

    This affects all versions of package ffmpeg-sdk. The injection point is located in line 9 in index.js.

    ffmpeg-sdk npm
  • Critical 9.8
    CVE-2020-28445

    Command Injection

    This affects all versions of package npm-help. The injection point is located in line 13 in index.js file in export.latestVersion() function.

  • Critical 9.8
    CVE-2020-28438

    Command Injection

    This affects all versions of package deferred-exec. The injection point is located in line 42 in lib/deferred-exec.js

    deferred-exec npm
  • Critical 9.8
    CVE-2020-28446

    Command Injection

    The package ntesseract before 0.2.9 are vulnerable to Command Injection via lib/tesseract.js.

    ntesseract npm
  • Critical 9.8
    CVE-2020-28443

    Command Injection

    This affects all versions of package sonar-wrapper. The injection point is located in lib/sonarRunner.js.

    sonar-wrapper npm
  • Critical 9.3
    CVE-2022-33965 Scanner template

    WordPress WP Visitor Statistics plugin <= 5.7 - Multiple Unauthenticated SQL Injection (SQLi) vulnerabilities

    Multiple Unauthenticated SQL Injection (SQLi) vulnerabilities in Osamaesh WP Visitor Statistics plugin <= 5.7 at WordPress.

    osamaesh WP Visitor Statistics (WordPress plugin) Web / CMS
  • Critical 9.8
    CVE-2022-34113

    Dataease before 1.11.2 allows arbitrary code execution via crafter plugin

    An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin.

    io.dataease:dataease-plugin-common Maven
  • Critical 9.8
    CVE-2022-34115

    Dataease v1.11.1 SQL Injection via parameter dataSourceId

    DataEase v1.11.1 was discovered to contain a arbitrary file write vulnerability via the parameter dataSourceId.

    io.dataease:dataease-plugin-common Maven
  • Critical 9.9
    CVE-2022-25759 EPSS 12%

    Remote Code Injection

    The package convert-svg-core before 0.6.2 are vulnerable to Remote Code Injection via sending an SVG file containing the payload.

    convert-svg-core npm
  • Critical 9.1
    CVE-2022-30998

    WordPress Homepage Product Organizer for WooCommerce plugin <= 1.1 - Multiple Authenticated SQL Injection (SQLi) vulnerabilities

    Multiple Authenticated (subscriber or higher user role) SQL Injection (SQLi) vulnerabilities in WooPlugins.co's Homepage Product Organizer for WooCommerce plugin <= 1.1 at WordPress.

    WooPlugins.co Homepage Product Organizer for WooCommerce (WordPress plugin) Web / CMS
  • Critical 9.8
    CVE-2022-2143 Public exploit EPSS 63%

    Advantech iView

    The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code.

    Advantech iView iView
  • Critical 9.8
    CVE-2022-34983

    The scu-captcha package in PyPI v0.0.1 to v0.0.4 included a code execution backdoor inserted by a third party.

    scu-captcha PyPI
  • Critical 10.0
    GHSA-m58q-qq5h-mgqq

    Islandora 2.0 before 2.4.1 could allow any user to upload content into a repository

    ### Impact This vulnerability would allow any user, regardless of permissions, to upload content into a repository. This affects installations of Islandora core 2.0 or greater. ### Patches Upgrade immediately to the [latest release](https://github.com/Islando…

    islandora/islandora Packagist
  • Critical 9.8
    CVE-2022-34487 Scanner template

    WordPress Shortcode Addons plugin <= 3.0.2 - Unauthenticated Arbitrary Option Update vulnerability

    Unauthenticated Arbitrary Option Update vulnerability in biplob018's Shortcode Addons plugin <= 3.0.2 at WordPress.

    biplob018 Shortcode Addons (WordPress plugin) Web / CMS
  • Critical 9.8
    CVE-2022-33198 Scanner template

    WordPress Accordions plugin <= 2.0.2 - Unauthenticated WordPress Options Change vulnerability

    Unauthenticated WordPress Options Change vulnerability in Biplob Adhikari's Accordions plugin <= 2.0.2 at WordPress.

    Biplob Adhikari Accordions (WordPress plugin) Web / CMS
  • Critical 9.1
    CVE-2022-28700

    WordPress GiveWP plugin <= 2.20.2 - Authenticated Arbitrary File Creation via Export function vulnerability

    Authenticated Arbitrary File Creation via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress.

    GiveWP GiveWP (WordPress plugin) Web / CMS
  • Critical 9.8
    CVE-2022-20857

    Cisco Nexus Dashboard Unauthorized Access Vulnerabilities

    Multiple vulnerabilities in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to execute arbitrary commands, read or upload container image files, or perform a cross-site request forgery attack. For more information about these vulnerabili…

    Cisco Cisco Nexus Dashboard Network devices
  • Critical 9.8
    CVE-2022-20858

    Cisco Nexus Dashboard Unauthorized Access Vulnerabilities

    Multiple vulnerabilities in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to execute arbitrary commands, read or upload container image files, or perform a cross-site request forgery attack. For more information about these vulnerabili…

    Cisco Cisco Nexus Dashboard Network devices
  • Critical 9.8
    CVE-2022-20861

    Cisco Nexus Dashboard Unauthorized Access Vulnerabilities

    Multiple vulnerabilities in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to execute arbitrary commands, read or upload container image files, or perform a cross-site request forgery attack. For more information about these vulnerabili…

    Cisco Cisco Nexus Dashboard Network devices
  • Critical 9.8
    CVE-2022-26138 Exploited Public exploit Scanner template EPSS 98%

    The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in t…

    Atlassian Questions For Confluence Web / CMS
    KEV Jul 29, 2022