Skip to content
OpenAdvisories

Archive

July 2022

Vulnerabilities first published in this month (UTC), newest first.

← June 2022 2022 / July August 2022 →
  1. 184
  2. 28
  3. 33
  4. 438
  5. 532
  6. 695
  7. 748
  8. 825
  9. 91
  10. 102
  11. 11205
  12. 12186
  13. 1354
  14. 1468
  15. 1581
  16. 1612
  17. 1776
  18. 18100
  19. 19136
  20. 2097
  21. 2183
  22. 2273
  23. 234
  24. 243
  25. 25102
  26. 26115
  27. 27115
  28. 2893
  29. 2941
  30. 301
  31. 3112
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • Medium 5.4
    CVE-2022-34140 Public exploit

    Feehi CMS Cross-site Scripting

    A stored cross-site scripting (XSS) vulnerability in /index.php?r=site%2Fsignup of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username field.

    feehi/cms Packagist
  • Medium 6.5
    CVE-2022-36883 Public exploit

    Lack of authentication mechanism in Jenkins Git Plugin webhook

    A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.

    Jenkins Project Jenkins Git Plugin org.jenkins-ci.plugins:git Web / CMS Maven
  • Medium 6.0
    CVE-2022-22555 Public exploit

    Dell EMC PowerStore, contains an OS command injection Vulnerability. A locally authenticated attacker could potentially…

    Dell PowerStore
  • Medium 6.1
    CVE-2022-31160 Public exploit

    jQuery UI contains potential XSS vulnerability when refreshing a checkboxradio with an HTML-like initial text label

    jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a labe…

    jquery jquery-ui jquery-ui jquery-ui-rails Debian Ubuntu npm Maven NuGet RubyGems
  • Medium 4.2
    CVE-2022-25869 Public exploit

    Angular (deprecated package) Cross-site Scripting

    All versions of the package angular; all versions of the package angularjs.core; all versions of the package angularjs are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of <t…

    angular.js angular.js angular Debian Ubuntu npm
  • Medium 5.9
    CVE-2022-29593 Public exploit EPSS 13%

    relay_cgi.cgi on Dingtian DT-R002 2CH relay devices with firmware 3.1.276A allows an attacker to replay HTTP post reque…

  • Medium 4.6
    CVE-2022-32114 Public exploit

    Strapi 4.1.12 Cross-site Scripting via crafted file

    An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file. NOTE: the project documentation suggests that a user with the Media Library "Create (upload)" permission …

    @strapi/strapi npm
  • Medium 6.3
    CVE-2022-2297 Public exploit

    SourceCodester Clinics Patient Management System unrestricted upload

    A vulnerability, which was classified as critical, was found in SourceCodester Clinics Patient Management System 2.0. Affected is an unknown function of the file /pms/update_user.php?user_id=1. The manipulation of the argument profile_picture with the input <…

    SourceCodester Clinics Patient Management System
  • Medium 4.8
    CVE-2022-32060 Public exploit

    Snipe-IT 6.0.2 vulnerable to Cross-site Scripting via arbitrary file upload in Update Branding Settings

    An arbitrary file upload vulnerability in the Update Branding Settings component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file.

    snipe/snipe-it Packagist
  • Medium 5.5
    CVE-2022-34878 Public exploit

    VICIDial 2.14b0.5 SVN 3550 was discovered to contain a SQL injection vulnerability at /vicidial/user_stats.php.

    SQL Injection vulnerability in User Stats interface (/vicidial/user_stats.php) of VICIdial via the file_download parameter allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all data on the system, destroy the data …

    VICIdial VICIdial
  • Medium 6.4
    CVE-2022-34877 Public exploit

    VICIDial 2.14b0.5 SVN 3550 was discovered to contains a SQL injection vulnerability at /vicidial/AST_agent_time_sheet.php.

    SQL Injection vulnerability in AST Agent Time Sheet interface ((/vicidial/AST_agent_time_sheet.php) of VICIdial via the agent parameter allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all data on the system, dest…

    VICIdial VICIdial
  • Medium 5.5
    CVE-2022-34876 Public exploit

    VICIDial 2.14b0.5 SVN 3550 was discovered to contain multiple SQL injection vulnerability at /vicidial/admin.php.

    SQL Injection vulnerability in admin interface (/vicidial/admin.php) of VICIdial via modify_email_accounts, access_recordings, and agentcall_email parameters allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all da…

    VICIdial VICIdial