Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: July 2022

90 records · 8 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2022-2274
    53Plan

    RSA implementation bug in AVX512IFMA instructions

    CriticalCVSS 9.8Proof of conceptEPSS 48%

    openssl · opensslJul 1, 2022

  • CVE-2022-2185
    58Plan

    A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 pr

    HighCVSS 8.8Proof of conceptEPSS 76%

    gitlab · gitlabJul 1, 2022

  • CVE-2022-2230
    36Monitor

    A Stored Cross-Site Scripting vulnerability in the project settings page in GitLab CE/EE affecting all versions from 14.4 prior to 14.10.5,

    MediumCVSS 4.8No exploitEPSS 57%

    gitlab · gitlabJul 1, 2022

  • CVE-2022-32032
    42Plan

    Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the deviceList parameter in the function formAddMacfilterRule.

    CriticalCVSS 9.8No exploitEPSS 10%

    tenda · ax1806 firmwareJul 1, 2022

  • CVE-2022-32035
    34Monitor

    Tenda M3 V1.0.0.12 was discovered to contain a stack overflow via the function formMasterMng.

    HighCVSS 7.5No exploitEPSS 14%

    tenda · m3 firmwareJul 1, 2022

  • CVE-2022-32420
    41Plan

    College Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via /College/admin/teacher.php.

    HighCVSS 8.8No exploitEPSS 20%

    college management system project · college management systemJul 1, 2022

  • CVE-2022-33171
    45Plan

    The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object.

    CriticalCVSS 9.8Proof of conceptEPSS 21%

    typeorm · typeormJul 4, 2022

  • CVE-2022-34265
    61This week

    An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6.

    CriticalCVSS 9.8Proof of conceptEPSS 73%

    djangoproject · djangoJul 4, 2022

  • CVE-2022-34918
    40Plan

    An issue was discovered in the Linux kernel through 5.18.9.

    HighCVSS 7.8WeaponizedEPSS 5%

    linux · linux kernelJul 4, 2022

  • CVE-2022-34876
    40Plan

    VICIDial 2.14b0.5 SVN 3550 was discovered to contain multiple SQL injection vulnerability at /vicidial/admin.php.

    HighCVSS 8.8WeaponizedEPSS 3%

    vicidial · vicidialJul 5, 2022

  • CVE-2022-34877
    40Plan

    VICIDial 2.14b0.5 SVN 3550 was discovered to contains a SQL injection vulnerability at /vicidial/AST_agent_time_sheet.php.

    HighCVSS 8.8WeaponizedEPSS 3%

    vicidial · vicidialJul 5, 2022

  • CVE-2022-34878
    40Plan

    VICIDial 2.14b0.5 SVN 3550 was discovered to contain a SQL injection vulnerability at /vicidial/user_stats.php.

    HighCVSS 8.8WeaponizedEPSS 3%

    vicidial · vicidialJul 5, 2022

  • CVE-2022-32386
    42Plan

    Tenda AC23 v16.03.07.44 was discovered to contain a buffer overflow via fromAdvSetMacMtuWan.

    CriticalCVSS 9.8No exploitEPSS 10%

    tendacn · ac23 ac2100 firmwareJul 6, 2022

  • CVE-2022-33980
    52Plan

    Apache Commons Configuration insecure interpolation defaults

    CriticalCVSS 9.8Proof of conceptEPSS 44%

    apache · commons configurationJul 6, 2022

  • CVE-2022-31125
    45Plan

    Authentication Bypass in Roxy-wi

    CriticalCVSS 9.8Proof of conceptEPSS 20%

    roxy-wi · roxy-wiJul 6, 2022

  • CVE-2022-31126
    55Plan

    Unauthenticated Remote Code Execution in Roxy-wi

    CriticalCVSS 9.8Proof of conceptEPSS 52%

    roxy-wi · roxy-wiJul 6, 2022

  • CVE-2022-25046
    56Plan

    A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted POST request.

    CriticalCVSS 9.8No exploitEPSS 57%

    control-webpanel · webpanelJul 7, 2022

  • CVE-2022-25048
    41Plan

    Command injection vulnerability in CWP v0.9.8.1126 that allows normal users to run commands as the root user.

    HighCVSS 8.8No exploitEPSS 19%

    control-webpanel · webpanelJul 7, 2022

  • CVE-2022-31854
    38Monitor

    Codoforum v5.1 was discovered to contain an arbitrary file upload vulnerability via the logo change option in the admin panel.

    HighCVSS 7.2Proof of conceptEPSS 32%

    codologic · codoforumJul 7, 2022

  • CVE-2022-32205
    26Monitor

    A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them.

    MediumCVSS 4.3No exploitEPSS 31%

    haxx · curlJul 7, 2022

  • CVE-2022-32206
    37Monitor

    curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially

    MediumCVSS 6.5No exploitEPSS 36%

    haxx · curlJul 7, 2022

  • CVE-2022-32207
    43Plan

    When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a ren

    CriticalCVSS 9.8No exploitEPSS 12%

    haxx · curlJul 7, 2022

  • CVE-2022-32054
    49Plan

    Tenda AC10 US_AC10V1.0RTL_V15.03.06.26_multi_TD01 was discovered to contain a remote code execution (RCE) vulnerability via the lanIp parame

    CriticalCVSS 9.8No exploitEPSS 34%

    tenda · ac10 firmwareJul 7, 2022

  • CVE-2022-32449
    45Plan

    TOTOLINK EX300_V2 V4.0.3c.7484 was discovered to contain a command injection vulnerability via the langType parameter in the setLanguageCfg

    CriticalCVSS 9.8No exploitEPSS 19%

    totolink · ex300 v2 firmwareJul 7, 2022

  • CVE-2022-33098
    40Plan

    Magnolia CMS v6.2.19 was discovered to contain a cross-site scripting (XSS) vulnerability via the Edit Contact function.

    MediumCVSS 6.1Proof of conceptEPSS 53%

    magnolia-cms · magnolia cmsJul 7, 2022

  • CVE-2022-35411
    53Plan

    rpc.py through 0.6.0 allows Remote Code Execution because an unpickle occurs when the "serializer: pickle" HTTP header is sent.

    CriticalCVSS 9.8Proof of conceptEPSS 45%

    rpc.py project · rpc.pyJul 8, 2022

  • CVE-2022-31137
    66This week

    Unauthenticated Remote Code Execution in Roxy-WI

    CriticalCVSS 9.8WeaponizedEPSS 90%

    roxy-wi · roxy-wiJul 8, 2022

  • CVE-2022-32294
    40Plan

    Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly created password (from the "zmprove ca" command).

    CriticalCVSS 9.8No exploitEPSS 2%

    zimbra · collaborationJul 10, 2022

  • CVE-2022-1952
    46Plan

    eaSYNC < 1.1.16 - Unauthenticated Arbitrary File Upload

    CriticalCVSS 9.8Proof of conceptEPSS 24%

    syntacticsinc · easyncJul 11, 2022

  • CVE-2022-2297
    40Plan

    SourceCodester Clinics Patient Management System unrestricted upload

    HighCVSS 8.8WeaponizedEPSS 3%

    oretnom23 · clinic\'s patient management systemJul 12, 2022

  • CVE-2022-22025
    40Plan

    Windows Internet Information Services Cachuri Module Denial of Service Vulnerability

    HighCVSS 7.5No exploitEPSS 32%

    microsoft · windows 10Jul 12, 2022

  • CVE-2022-22047
    67This week

    Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 18%

    microsoft · windows 10 1507Jul 12, 2022

  • CVE-2022-30216
    62This week

    Windows Server Service Tampering Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 88%

    microsoft · windows 10Jul 12, 2022

  • CVE-2022-35628
    47Plan

    A SQL injection issue was discovered in the lux extension before 17.6.1, and 18.x through 24.x before 24.0.2, for TYPO3.

    CriticalCVSS 9.8No exploitEPSS 26%

    in2code · living user experienceJul 12, 2022

  • CVE-2022-34753
    56Plan

    A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause r

    HighCVSS 8.8Proof of conceptEPSS 70%

    schneider-electric · spacelogic c-bus home controller firmwareJul 13, 2022

  • CVE-2022-29593
    27Monitor

    relay_cgi.cgi on Dingtian DT-R002 2CH relay devices with firmware 3.1.276A allows an attacker to replay HTTP post requests without the need

    MediumCVSS 5.9Proof of conceptEPSS 14%

    dingtian-tech · dt-r004 firmwareJul 14, 2022

  • CVE-2022-32213
    40Plan

    The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding he

    MediumCVSS 6.5No exploitEPSS 45%

    llhttp · llhttpJul 14, 2022

  • CVE-2022-32214
    51Plan

    The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP re

    MediumCVSS 6.5No exploitEPSS 81%

    llhttp · llhttpJul 14, 2022

  • CVE-2022-32215
    47Plan

    The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding hea

    MediumCVSS 6.5No exploitEPSS 70%

    llhttp · llhttpJul 14, 2022

  • CVE-2022-32409
    43Plan

    A local file inclusion (LFI) vulnerability in the component codemirror.php of Portal do Software Publico Brasileiro i3geo v7.0.5 allows atta

    CriticalCVSS 9.8Proof of conceptEPSS 13%

    softwarepublico · i3geoJul 14, 2022

  • CVE-2022-32417
    50Plan

    PbootCMS v3.1.2 was discovered to contain a remote code execution (RCE) vulnerability via the function parserIfLabel at function.php.

    CriticalCVSS 9.8No exploitEPSS 35%

    pbootcms · pbootcmsJul 14, 2022

  • CVE-2022-2419
    36Monitor

    URVE Web Manager upload.php unrestricted upload

    HighCVSS 8.0No exploitEPSS 12%

    eveo · urve web managerJul 15, 2022

  • CVE-2022-31097
    55Plan

    Stored XSS in Grafana's Unified Alerting

    HighCVSS 8.7No exploitEPSS 70%

    grafana · grafanaJul 15, 2022

  • CVE-2022-34221
    34Monitor

    Adobe Acrobat Reader Type Confusion vulnerability could lead to Arbitrary code execution

    HighCVSS 7.8No exploitEPSS 11%

    adobe · acrobat dcJul 15, 2022

  • CVE-2022-31161
    48Plan

    Roxy-WI Vulnerable to Unauthenticated Remote Code Execution via ssl_cert Upload

    CriticalCVSS 9.8Proof of conceptEPSS 28%

    roxy-wi · roxy-wiJul 15, 2022

  • CVE-2021-36711
    44Plan

    WebInterface in OctoBot before 0.4.4 allows remote code execution because Tentacles upload is mishandled.

    CriticalCVSS 9.8Proof of conceptEPSS 16%

    octobot · octobotJul 16, 2022

  • CVE-2022-26352
    96Now

    An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02.

    CriticalCVSS 9.8KEVWeaponizedEPSS 91%

    dotcms · dotcmsJul 17, 2022

  • CVE-2022-26482
    35Monitor

    An issue was discovered in Poly EagleEye Director II before 2.2.2.1.

    HighCVSS 7.2No exploitEPSS 23%

    poly · eagleeye director ii firmwareJul 17, 2022

  • CVE-2022-33891
    93Now

    Apache Spark shell command injection vulnerability via Spark UI

    HighCVSS 8.8KEVWeaponizedEPSS 93%

    apache · sparkJul 18, 2022

  • CVE-2022-1565
    33Monitor

    Import any XML or CSV File to WordPress <= 3.6.7 - Admin+ Malicious File Upload

    HighCVSS 7.2Proof of conceptEPSS 15%

    wpallimport · wp all importJul 18, 2022

  • CVE-2022-23745
    35Monitor

    A potential memory corruption issue was found in Capsule Workspace Android app (running on GrapheneOS).

    HighCVSS 7.5No exploitEPSS 16%

    checkpoint · capsule workspaceJul 18, 2022

  • CVE-2022-30526
    40Plan

    A privilege escalation vulnerability was identified in the CLI command of Zyxel USG FLEX 100(W) firmware versions 4.50 through 5.30, USG FLE

    HighCVSS 7.8WeaponizedEPSS 1%

    zyxel · usg flex 100w firmwareJul 19, 2022

  • CVE-2022-24082
    43Plan

    If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filter

    CriticalCVSS 9.8Proof of conceptEPSS 12%

    pega · infinityJul 19, 2022

  • CVE-2022-35405
    99Now

    Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution.

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    zohocorp · manageengine access manager plusJul 19, 2022

  • CVE-2022-34169
    55Plan

    Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets

    HighCVSS 7.5Proof of conceptEPSS 81%

    apache · xalan-javaJul 19, 2022

  • CVE-2022-21550
    40Plan

    Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).

    MediumCVSS 6.3No exploitEPSS 50%

    oracle · mysql clusterJul 19, 2022

  • CVE-2022-2486
    48Plan

    WAVLINK WN535K2/WN535K3 os command injection

    CriticalCVSS 9.8Proof of conceptEPSS 30%

    wavlink · wl-wn535k2 firmwareJul 20, 2022

  • CVE-2022-2487
    63This week

    WAVLINK WN535K2/WN535K3 nightled.cgi os command injection

    CriticalCVSS 9.8Proof of conceptEPSS 79%

    wavlink · wl-wn535k2 firmwareJul 20, 2022

  • CVE-2022-2488
    49Plan

    WAVLINK WN535K2/WN535K3 touchlist_sync.cgi os command injection

    CriticalCVSS 9.8Proof of conceptEPSS 33%

    wavlink · wl-wn535k2 firmwareJul 20, 2022

  • CVE-2022-34607
    43Plan

    H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the HOST parameter at /doping.asp.

    CriticalCVSS 9.8No exploitEPSS 14%

    h3c · magic r200 firmwareJul 20, 2022

  • CVE-2022-33318
    54Plan

    Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digi

    CriticalCVSS 9.8No exploitEPSS 50%

    iconics · genesis64Jul 20, 2022

  • CVE-2022-34046
    36Monitor

    An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via view-source:http://IP_A

    HighCVSS 7.5Proof of conceptEPSS 21%

    wavlink · wn533a8 firmwareJul 20, 2022

  • CVE-2022-34047
    37Monitor

    An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows attackers to obtain usernames and passwords via view-source:http://IP

    HighCVSS 7.5Proof of conceptEPSS 22%

    wavlink · wl-wn530hg4 firmwareJul 20, 2022

  • CVE-2022-26138
    98Now

    The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users g

    CriticalCVSS 9.8KEVWeaponizedEPSS 98%

    atlassian · questions for confluenceJul 20, 2022

  • CVE-2022-0902
    44Plan

    ABB Flow Computer and Remote Controllers Path Traversal Vulnerability in Totalflow TCP protocol can lead to root access

    CriticalCVSS 9.8No exploitEPSS 16%

    abb · rmc-100 firmwareJul 21, 2022

  • CVE-2022-2135
    33Monitor

    The affected product is vulnerable to multiple SQL injections, which may allow an unauthorized attacker to disclose information.

    HighCVSS 7.5No exploitEPSS 10%

    advantech · iviewJul 22, 2022

  • CVE-2022-2138
    33Monitor

    The affected product is vulnerable due to missing authentication, which may allow an attacker to read or modify sensitive data and execute a

    HighCVSS 7.5No exploitEPSS 11%

    advantech · iviewJul 22, 2022

  • CVE-2022-2139
    44Plan

    The affected product is vulnerable to directory traversal, which may allow an attacker to access unauthorized files and execute arbitrary co

    CriticalCVSS 9.8No exploitEPSS 16%

    advantech · iviewJul 22, 2022

  • CVE-2022-2143
    60This week

    The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code.

    CriticalCVSS 9.8WeaponizedEPSS 60%

    advantech · iviewJul 22, 2022

  • CVE-2022-25759
    42Plan

    Remote Code Injection

    CriticalCVSS 9.8No exploitEPSS 11%

    convert-svg-core project · convert-svg-coreJul 22, 2022

  • CVE-2022-1096
    72This week

    Type confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote attacker to potentially exploit heap corruption via a crafted H

    HighCVSS 8.8KEVWeaponizedEPSS 24%

    google · chromeJul 22, 2022

  • CVE-2022-36446
    68This week

    software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command.

    CriticalCVSS 9.8WeaponizedEPSS 95%

    webmin · webminJul 25, 2022

  • CVE-2022-36450
    45Plan

    Obsidian 0.14.x and 0.15.x before 0.15.5 allows obsidian://hook-get-address remote code execution because window.open is used without checki

    CriticalCVSS 9.8No exploitEPSS 20%

    obsidian · obsidianJul 25, 2022

  • CVE-2022-1232
    40Plan

    Type confusion in V8 in Google Chrome prior to 100.0.4896.75 allowed a remote attacker to potentially exploit heap corruption via a crafted

    HighCVSS 8.8No exploitEPSS 17%

    google · chromeJul 25, 2022

  • CVE-2022-35650
    46Plan

    The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions.

    HighCVSS 7.5Proof of conceptEPSS 53%

    moodle · moodleJul 25, 2022

  • CVE-2022-35869
    57Plan

    This vulnerability allows remote attackers to bypass authentication on affected installations of Inductive Automation Ignition 8.1.15 (b2022

    CriticalCVSS 9.8No exploitEPSS 59%

    inductiveautomation · ignitionJul 25, 2022

  • CVE-2022-35870
    44Plan

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b202

    HighCVSS 7.8No exploitEPSS 44%

    inductiveautomation · ignitionJul 25, 2022

  • CVE-2022-35871
    43Plan

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b202

    HighCVSS 7.8No exploitEPSS 40%

    inductiveautomation · ignitionJul 25, 2022

  • CVE-2022-34906
    33Monitor

    A hard-coded cryptographic key is used in FileWave before 14.6.3 and 14.7.x before 14.7.2.

    HighCVSS 7.5No exploitEPSS 10%

    filewave · filewaveJul 25, 2022

  • CVE-2022-34907
    44Plan

    An authentication bypass vulnerability exists in FileWave before 14.6.3 and 14.7.x before 14.7.2.

    CriticalCVSS 9.8No exploitEPSS 16%

    filewave · filewaveJul 25, 2022

  • CVE-2022-1364
    69This week

    Type confusion in V8 Turbofan in Google Chrome prior to 100.0.4896.127 allowed a remote attacker to potentially exploit heap corruption via

    HighCVSS 8.8KEVWeaponizedEPSS 13%

    google · chromeJul 26, 2022

  • CVE-2022-2550
    50Plan

    OS Command Injection in hestiacp/hestiacp

    HighCVSS 8.8No exploitEPSS 49%

    hestiacp · control panelJul 27, 2022

  • CVE-2022-34120
    34Monitor

    Barangay Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the module editing function at /pa

    HighCVSS 7.2No exploitEPSS 19%

    barangay management system project · barangay management systemJul 27, 2022

  • CVE-2022-2294
    86Now

    Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via

    HighCVSS 8.8KEVWeaponizedEPSS 70%

    google · chromeJul 27, 2022

  • CVE-2022-2480
    41Plan

    Use after free in Service Worker API in Google Chrome prior to 103.0.5060.134 allowed a remote attacker to potentially exploit heap corrupti

    HighCVSS 8.8No exploitEPSS 18%

    google · chromeJul 27, 2022

  • CVE-2022-2564
    48Plan

    Prototype Pollution in automattic/mongoose

    CriticalCVSS 9.8No exploitEPSS 31%

    mongoosejs · mongooseJul 28, 2022

  • CVE-2022-30287
    53Plan

    Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class

    HighCVSS 8.0No exploitEPSS 69%

    horde · groupwareJul 28, 2022

  • CVE-2022-34555
    46Plan

    TP-LINK TL-R473G 2.0.1 Build 220529 Rel.65574n was discovered to contain a remote code execution vulnerability which is exploited via a craf

    CriticalCVSS 9.8No exploitEPSS 23%

    tp-link · tl-r473g firmwareJul 28, 2022

  • CVE-2022-2414
    56Plan

    Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks.

    HighCVSS 7.5Proof of conceptEPSS 85%

    dogtagpki · dogtagpkiJul 29, 2022

  • CVE-2022-34531
    46Plan

    DedeCMS v5.7.95 was discovered to contain a remote code execution (RCE) vulnerability via the component mytag_ main.php.

    CriticalCVSS 9.8No exploitEPSS 24%

    dedecms · dedecmsJul 29, 2022