Skip to content
OpenAdvisories

Archive

July 2022

Vulnerabilities first published in this month (UTC), newest first.

← June 2022 2022 / July August 2022 →
  1. 184
  2. 28
  3. 33
  4. 438
  5. 532
  6. 695
  7. 748
  8. 825
  9. 91
  10. 102
  11. 11205
  12. 12186
  13. 1354
  14. 1468
  15. 1581
  16. 1612
  17. 1776
  18. 18100
  19. 19136
  20. 2097
  21. 2183
  22. 2273
  23. 234
  24. 243
  25. 25102
  26. 26115
  27. 27115
  28. 2893
  29. 2941
  30. 301
  31. 3112
All Critical High Medium Low Exploited only Public exploit

1,993 results · Feed

  • Medium 6.3
    CVE-2022-2490

    SourceCodester Simple E-Learning System search.php sql injection

    A vulnerability classified as critical has been found in SourceCodester Simple E-Learning System 1.0. Affected is an unknown function of the file search.php. The manipulation of the argument classCode with the input 1'||(SELECT 0x74666264 WHERE 5610=5610 AND …

    SourceCodester Simple E-learning System
  • Medium 6.3
    CVE-2022-2489

    SourceCodester Simple E-Learning System classRoom.php sql injection

    A vulnerability was found in SourceCodester Simple E-Learning System 1.0. It has been rated as critical. This issue affects some unknown processing of the file classRoom.php. The manipulation of the argument classCode with the input 1'||(SELECT 0x6770715a WHE…

    SourceCodester Simple E-learning System
  • High 8.0
    CVE-2022-2488 Scanner template EPSS 33%

    WAVLINK WN535K2/WN535K3 touchlist_sync.cgi os command injection

    A vulnerability was found in WAVLINK WN535K2 and WN535K3 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/touchlist_sync.cgi. The manipulation of the argument IP leads to os command injection. The exploit has been di…

    WAVLINK WN535K3 WN535K2
  • High 8.0
    CVE-2022-2487 Scanner template EPSS 79%

    WAVLINK WN535K2/WN535K3 nightled.cgi os command injection

    A vulnerability has been found in WAVLINK WN535K2 and WN535K3 and classified as critical. This vulnerability affects unknown code of the file /cgi-bin/nightled.cgi. The manipulation of the argument start_hour leads to os command injection. The exploit has bee…

    WAVLINK WN535K3 WN535K2
  • High 8.0
    CVE-2022-2486 Scanner template EPSS 30%

    WAVLINK WN535K2/WN535K3 os command injection

    A vulnerability, which was classified as critical, was found in WAVLINK WN535K2 and WN535K3. This affects an unknown part of the file /cgi-bin/mesh.cgi?page=upgrade. The manipulation of the argument key leads to os command injection. The exploit has been disc…

    WAVLINK WN535K2 WN535K3
  • High 7.1
    CVE-2022-31250

    keylime %post scriplet allows for privilege escalation from keylime user to root

    A UNIX Symbolic Link (Symlink) Following vulnerability in keylime of openSUSE Tumbleweed allows local attackers to escalate from the keylime user to root. This issue affects: openSUSE Tumbleweed keylime versions prior to 6.4.2-1.1.

    openSUSE Tumbleweed
  • Unscored —
    CVE-2022-34866

    Passage Drive versions v1.4.0 to v1.5.1.0 and Passage Drive for Box version v1.0.0 contain an insufficient data verific…

    Yokogawa Rental & Lease Passage Drive ICS / OT
  • Unscored —
    CVE-2022-33967

    squashfs filesystem implementation of U-Boot versions from v2020.10-rc2 to v2022.07-rc5 contains a heap-based buffer ov…

    DENX Software Engineering U-Boot u-boot u-boot Debian Ubuntu
  • Medium 6.8
    CVE-2022-32962

    HiCOS’ client-side citizen digital certificate - Double Free

    HiCOS’ client-side citizen certificate component has a double free vulnerability. An unauthenticated physical attacker can exploit this vulnerability to corrupt memory and execute arbitrary code, manipulate system data or terminate service.

    HiNET HiCOS’ client-side citizen digital certificate
  • Medium 6.8
    CVE-2022-32961

    HiCOS’ client-side citizen digital certificate - Stack Buffer Overflow

    HICOS’ client-side citizen digital certificate component has a stack-based buffer overflow vulnerability when reading IC card due to insufficient parameter length validation for token information. An unauthenticated physical attacker can exploit this vulnerab…

    HiNET HiCOS’ client-side citizen digital certificate
  • Medium 6.8
    CVE-2022-32960

    HiCOS’ client-side citizen digital certificate - Stack Buffer Overflow

    HiCOS’ client-side citizen digital certificate component has a stack-based buffer overflow vulnerability when reading IC card due to insufficient parameter length validation for card number. An unauthenticated physical attacker can exploit this vulnerability …

    HiNET HiCOS’ client-side citizen digital certificate
  • Medium 6.8
    CVE-2022-32959

    HiCOS’ client-side citizen digital certificate - Stack Buffer Overflow

    HiCOS’ client-side citizen digital certificate component has a stack-based buffer overflow vulnerability when reading IC card due to insufficient parameter length validation for OS information. An unauthenticated physical attacker can exploit this vulnerabili…

    HiNET HiCOS’ client-side citizen digital certificate
  • High 7.7
    CVE-2022-32958

    TEAMPLUS TECHNOLOGY INC. Teamplus Pro - Allocation of Resources Without Limits or Throttling

    A remote attacker with general user privilege can send a message to Teamplus Pro’s chat group that exceeds message size limit, to terminate other recipients’ Teamplus Pro chat process.

    TEAMPLUS TECHNOLOGY Teamplus Pro (Private cloud)
  • High 7.5
    CVE-2022-32458

    Data Systems Consulting Co., Ltd. BPM - XML External Entity (XXE) Injection

    Digiwin BPM has a XML External Entity Injection (XXE) vulnerability due to insufficient validation for user input. An unauthenticated remote attacker can perform XML injection attack to access arbitrary system files.

    Data Systems Consulting BPM
  • Medium 5.3
    CVE-2022-32457

    Data Systems Consulting Co., Ltd. BPM - Blind Server-Side Request Forgery (SSRF)

    Digiwin BPM has inadequate filtering for URL parameter. An unauthenticated remote attacker can perform Blind SSRF attack to discover internal network topology base on URL error response.

    Data Systems Consulting BPM
  • Critical 9.8
    CVE-2022-32456

    Data Systems Consulting Co., Ltd. BPM - SQL Injection

    Digiwin BPM’s function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL command to access, modify, delete database or disrupt service.

    Data Systems Consulting BPM
  • Critical 10.0
    CVE-2016-1000273

    Java Melody vulnerable to cross-site scripting

    JavaMelody is a monitoring tool for JavaEE applications. Versions prior to 1.61.0 are vulnerable to a cross-site scripting (XSS) attack. This issue was patched in version 1.61.0, and users are recommended to upgrade to the latest version. There are no known w…

    net.bull.javamelody:javamelody-core Maven
  • Medium 6.1
    CVE-2022-31160 Public exploit

    jQuery UI contains potential XSS vulnerability when refreshing a checkboxradio with an HTML-like initial text label

    jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a labe…

    jquery jquery-ui jquery-ui jquery-ui-rails Debian Ubuntu npm Maven NuGet RubyGems
  • High 7.5
    CVE-2021-46828

    In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc becaus…

    libtirpc libtirpc ntirpc libtirpc Debian Ubuntu Alpine
  • Medium 6.4
    CVE-2022-21586

    Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrast…

    Oracle Banking Trade Finance
  • Medium 6.7
    CVE-2022-21585

    Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrast…

    Oracle Banking Trade Finance
  • Medium 6.4
    CVE-2022-21584

    Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrast…

    Oracle Banking Trade Finance
  • Medium 6.4
    CVE-2022-21583

    Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrast…

    Oracle Banking Trade Finance
  • Medium 6.7
    CVE-2022-21582

    Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrast…

    Oracle Banking Trade Finance
  • Medium 5.9
    CVE-2022-21581

    Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrast…

    Oracle Banking Trade Finance
  • Medium 5.9
    CVE-2022-21580

    Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Appl…

    Oracle Financial Services Revenue Management and Billing
  • Medium 6.4
    CVE-2022-21579

    Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: In…

    Oracle FLEXCUBE Universal Banking
  • Medium 6.7
    CVE-2022-21578

    Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: In…

    Oracle FLEXCUBE Universal Banking
  • Medium 6.4
    CVE-2022-21577

    Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: In…

    Oracle FLEXCUBE Universal Banking
  • Medium 6.4
    CVE-2022-21576

    Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: In…

    Oracle FLEXCUBE Universal Banking
  • Medium 6.0
    CVE-2022-21575

    Vulnerability in the Oracle WebCenter Sites Support Tools product of Oracle Fusion Middleware (component: User Interfac…

    Oracle WebCenter Sites
  • Medium 5.3
    CVE-2022-21574

    Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications…

    Oracle Communications Billing and Revenue Management
  • Medium 6.5
    CVE-2022-21573

    Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications…

    Oracle Communications Billing and Revenue Management
  • Medium 5.4
    CVE-2022-21572

    Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications…

    Oracle Communications Billing and Revenue Management
  • High 8.2
    CVE-2022-21571

    Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version tha…

    Oracle VM VirtualBox virtualbox virtualbox-guest-additions Virtualization Ubuntu Alpine
  • High 7.5
    CVE-2022-21570

    Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that ar…

    Oracle Coherence
  • Medium 6.5
    CVE-2022-21569

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

    Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  • Medium 6.5
    CVE-2022-21568

    Vulnerability in the Oracle iReceivables product of Oracle E-Business Suite (component: Access Request). Supported vers…

    Oracle iReceivables
  • High 7.5
    CVE-2022-21567

    Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Worklist). Supported versions that …

    Oracle Workflow
  • High 7.5
    CVE-2022-21566

    Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Diagnostics). Support…

    Oracle Applications Framework