Skip to content
OpenAdvisories

Archive

July 2022

Vulnerabilities first published in this month (UTC), newest first.

← June 2022 2022 / July August 2022 →
  1. 184
  2. 28
  3. 33
  4. 438
  5. 532
  6. 695
  7. 748
  8. 825
  9. 91
  10. 102
  11. 11205
  12. 12186
  13. 1354
  14. 1468
  15. 1581
  16. 1612
  17. 1776
  18. 18100
  19. 19136
  20. 2097
  21. 2183
  22. 2273
  23. 234
  24. 243
  25. 25102
  26. 26115
  27. 27115
  28. 2893
  29. 2941
  30. 301
  31. 3112
All Critical High Medium Low Exploited only Public exploit

1,993 results · Feed

  • Unscored —
    CVE-2022-20224 Public exploit

    In AT_SKIP_REST of bta_hf_client_at.cc, there is a possible out of bounds read due to an incorrect bounds check. This c…

    Android
  • Unscored —
    CVE-2022-20223 Public exploit

    In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible way to start a phone call witho…

    Android
  • Unscored —
    CVE-2022-20222

    In read_attr_value of gatt_db.cc, there is a possible out of bounds write due to a missing bounds check. This could lea…

    Android
  • Unscored —
    CVE-2022-20221

    In avrc_ctrl_pars_vendor_cmd of avrc_pars_ct.cc, there is a possible out of bounds read due to improper input validatio…

    Android
  • Unscored —
    CVE-2022-20220

    In openFile of CallLogProvider.java, there is a possible permission bypass due to a path traversal error. This could le…

    Android
  • Unscored —
    CVE-2022-20219

    In multiple functions of StorageManagerService.java and UserManagerService.java, there is a possible way to leave user'…

    Android
  • Unscored —
    CVE-2022-20218

    In PermissionController, there is a possible way to get and retain permissions without user's consent due to a logic er…

    Android
  • Unscored —
    CVE-2022-20217

    There is a unauthorized broadcast in the SprdContactsProvider. A third-party app could use this issue to delete Fdn con…

    Android
  • Unscored —
    CVE-2022-20216

    android exported is used to set third-party app access permissions, and the default value of intent-filter is true. com…

    Android
  • Unscored —
    CVE-2022-22982

    The vCenter Server contains a server-side request forgery (SSRF) vulnerability. A malicious actor with network access t…

    Virtualization
  • High 7.3
    CVE-2017-20128

    KB Messages PHP Script sql injection

    A vulnerability has been found in KB Messages PHP Script 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument username/password with the input 'or''=' leads to sql injection. The attack c…

  • High 7.3
    CVE-2017-20127

    KB Login Authentication Script sql injection

    A vulnerability was found in KB Login Authentication Script 1.1 and classified as critical. Affected by this issue is some unknown functionality. The manipulation of the argument username/password with the input 'or''=' leads to sql injection. The attack may …

  • High 7.3
    CVE-2017-20126

    KB Affiliate Referral Script index.php sql injection

    A vulnerability was found in KB Affiliate Referral Script 1.0. It has been classified as critical. This affects an unknown part of the file /index.php. The manipulation of the argument username/password with the input 'or''=' leads to sql injection. It is pos…

  • Medium 5.4
    CVE-2022-34358

    IBM i 7.2, 7.3, 7.4, and 7.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary …

    IBM i
  • Unscored —
    DRUPAL-CONTRIB-2022-048

    This module enables you to generate print versions of content. Some installations of the module make use of the dompdf/…

    drupal/entity_print Packagist
  • Unscored —
    CVE-2022-32096

    Rhonabwy before v1.1.5 was discovered to contain a buffer overflow via the component r_jwe_aesgcm_key_unwrap. This vuln…

    rhonabwy rhonabwy Debian Ubuntu
  • Unscored —
    CVE-2022-32074 Public exploit

    A stored cross-site scripting (XSS) vulnerability in the component audit/class.audit.php of osTicket-plugins - Storage-…

  • Unscored —
    CVE-2022-32073 Public exploit

    WolfSSH v1.4.7 was discovered to contain an integer overflow via the function wolfSSH_SFTP_RecvRMDIR.

  • Medium 5.4
    CVE-2022-32065

    RuoYi 4.7.3 vulnerable to arbitrary file upload in background management module

    An arbitrary file upload vulnerability in the background management module of RuoYi v4.7.3 and below allows attackers to execute arbitrary code via a crafted HTML file.

    com.ruoyi:ruoyi Maven
  • Unscored —
    CVE-2022-32274

    The Transition Scheduler add-on 6.5.0 for Atlassian Jira is prone to stored XSS via the project name to the creation fu…

  • Medium 6.5
    CVE-2019-10800

    Command Injection

    This affects the package codecov before 2.0.16. The vulnerability occurs due to not sanitizing gcov arguments before being being provided to the popen method.

    codecov PyPI
  • High 8.3
    CVE-2019-10761

    Sandbox Bypass

    This affects the package vm2 before 3.6.11. It is possible to trigger a RangeError exception from the host rather than the "sandboxed" context by reaching the stack call limit with an infinite recursion. The returned object is then used to reference the mainM…

    vm2 npm
  • High 7.5
    CVE-2022-31781

    Regular Expression Denial of Service (ReDoS) in ContentType.java. (GHSL-2022-022)

    Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles Content Types. Specially crafted Content Types may cause catastrophic backtracking, taking exponential time to complete. Specifically, this…

    Apache Software Foundation Apache Tapestry org.apache.tapestry:tapestry-core Maven
  • Unscored —
    CVE-2021-46827

    An issue was discovered in Oxygen XML WebHelp before 22.1 build 2021082006 and 23.x before 23.1 build 2021090310. An XS…

  • Unscored —
    CVE-2022-28888

    Spryker Commerce OS 1.4.2 allows Remote Command Execution.

  • Medium 4.6
    CVE-2022-32114 Public exploit

    Strapi 4.1.12 Cross-site Scripting via crafted file

    An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file. NOTE: the project documentation suggests that a user with the Media Library "Create (upload)" permission …

    @strapi/strapi npm
  • Unscored —
    CVE-2022-30517

    Mogu blog 5.2 is vulnerable to Cross Site Scripting (XSS).

  • Unscored —
    CVE-2022-29602

    The gridelements (aka Grid Elements) extension through 7.6.1, 8.x through 8.7.0, 9.x through 9.7.0, and 10.x through 10…

  • Medium 6.1
    CVE-2022-33156

    brotkrueml/typo3-matomo-integration vulnerable to Cross-Site Scripting

    The matomo_integration (aka Matomo Integration) extension before 1.3.2 for TYPO3 allows XSS.

    brotkrueml/typo3-matomo-integration Packagist
  • High 7.2
    CVE-2022-33678

    Azure Site Recovery Remote Code Execution Vulnerability

    Azure Site Recovery Remote Code Execution Vulnerability

    Microsoft Azure Site Recovery VMWare to Azure
  • High 7.2
    CVE-2022-33677

    Azure Site Recovery Elevation of Privilege Vulnerability

    Azure Site Recovery Elevation of Privilege Vulnerability

    Microsoft Azure Site Recovery VMWare to Azure
  • High 7.2
    CVE-2022-33676

    Azure Site Recovery Remote Code Execution Vulnerability

    Azure Site Recovery Remote Code Execution Vulnerability

    Microsoft Azure Site Recovery VMWare to Azure
  • High 7.8
    CVE-2022-33675

    Azure Site Recovery Elevation of Privilege Vulnerability

    Azure Site Recovery Elevation of Privilege Vulnerability

    Microsoft Azure Site Recovery VMWare to Azure
  • High 8.3
    CVE-2022-33674

    Azure Site Recovery Elevation of Privilege Vulnerability

    Azure Site Recovery Elevation of Privilege Vulnerability

    Microsoft Azure Site Recovery VMWare to Azure
  • Medium 6.5
    CVE-2022-33673

    Azure Site Recovery Elevation of Privilege Vulnerability

    Azure Site Recovery Elevation of Privilege Vulnerability

    Microsoft Azure Site Recovery VMWare to Azure
  • Medium 6.5
    CVE-2022-33672

    Azure Site Recovery Elevation of Privilege Vulnerability

    Azure Site Recovery Elevation of Privilege Vulnerability

    Microsoft Azure Site Recovery VMWare to Azure
  • Medium 4.9
    CVE-2022-33671

    Azure Site Recovery Elevation of Privilege Vulnerability

    Azure Site Recovery Elevation of Privilege Vulnerability

    Microsoft Azure Site Recovery VMWare to Azure
  • Medium 4.9
    CVE-2022-33669

    Azure Site Recovery Elevation of Privilege Vulnerability

    Azure Site Recovery Elevation of Privilege Vulnerability

    Microsoft Azure Site Recovery VMWare to Azure
  • Medium 4.9
    CVE-2022-33668

    Azure Site Recovery Elevation of Privilege Vulnerability

    Azure Site Recovery Elevation of Privilege Vulnerability

    Microsoft Azure Site Recovery VMWare to Azure
  • Medium 6.5
    CVE-2022-33667

    Azure Site Recovery Elevation of Privilege Vulnerability

    Azure Site Recovery Elevation of Privilege Vulnerability

    Microsoft Azure Site Recovery VMWare to Azure