CVEs published June 1, 2022
113 CVEs were published on June 1, 2022: 1 critical, 20 high. 1 is now in CISA KEV.
- Published
- 113
- Critical
- 1
- High
- 20
- Medium
- 14
- Low
- 1
- Unrated
- 77
- Now in CISA KEV
- 1
- Fix available
- 25
Most affected products
- https://github.com/curl/curl
- 9
- bigbluebutton
- 6
- Horner Automation Cscape Csfont
- 4
- Microsoft Edge
- 3
- Dell BSAFE Micro Edition Suite
- 2
- E-Series SANtricity OS Controller Software 11.x
- 2
- 389-ds-base
- 1
- Bandisoft International ark library
- 1
- Becton Dickinson (BD) BD Pyxis™ Anesthesia ES Station ·… +10
- 1
- Becton Dickinson (BD) BD Synapsys™
- 1
Critical 1
High 20
- CVE-2022-29169ReDoS on endpoint html5client/useragent in BigBlueButtonbigbluebutton
- CVE-2022-30190Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-30128Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2022-30127Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2022-24848SQL Injection in DHIS2's in OrgUnit program associationdhis2-core
- CVE-2022-22767BD Pyxis™ Products – Default CredentialsBecton Dickinson (BD) BD Pyxis™ Anesthesia ES Station ·… +10
- CVE-2021-27914A cross-site scripting (XSS) vulnerability in the installer component of Mautic before 4.3.0 allows admins to inject executable javascriptMautic
- CVE-2021-26635Bandisoft ARK Library buffer overflow vulnerabilityBandisoft International ark library
- CVE-2021-26633Maxboard SQL injection and LFI vulnerabilityMax Yi MaxBoard
- CVE-2022-29098Dell PowerScale OneFS versions 8.2.0.x through 9.3.0.x, contain a weak password requirement vulnerability.Dell PowerScale OneFS
- CVE-2020-26185Dell BSAFE Micro Edition Suite, versions prior to 4.5.1, contain a Buffer Over-Read Vulnerability.Dell BSAFE Micro Edition Suite
- CVE-2020-26184Dell BSAFE Micro Edition Suite, versions prior to 4.5.1, contain an Improper Certificate Validation vulnerability.Dell BSAFE Micro Edition Suite
- CVE-2022-30540Horner Automation Cscape CsfontHorner Automation Cscape Csfont
- CVE-2022-29488Horner Automation Cscape CsfontHorner Automation Cscape Csfont
- CVE-2022-28690Horner Automation Cscape CsfontHorner Automation Cscape Csfont
- CVE-2022-27184Horner Automation Cscape CsfontHorner Automation Cscape Csfont
- CVE-2022-1285Server-Side Request Forgery (SSRF) in gogs/gogsgogs/gogs · gogs.io/gogs
- CVE-2022-27775An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connecthttps://github.com/curl/curl
- CVE-2022-27781libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Duehttps://github.com/curl/curl
- CVE-2022-27782libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.https://github.com/curl/curl
Medium, low and unrated 92
- CVE-2022-29235Limited data exposure for shared external videos in BigBlueButtonbigbluebutton
- CVE-2022-29236Improper access control for pencil annotations in BigBlueButtonbigbluebutton
- CVE-2022-29234Grace period for lock settings in public/private chats in BigBlueButtonbigbluebutton
- CVE-2022-29233Improper access control for breakout rooms in BigBlue Buttonbigbluebutton
- CVE-2022-29232Exposure of messages in BigBlueButton public chatsbigbluebutton
- CVE-2022-26905Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2022-31022Missing Role Based Access Control for the REST handlers in bleve/http packageblevesearch bleve · github.com/blevesearch/bleve +1
- CVE-2022-27778A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--rehttps://github.com/curl/curl
- CVE-2022-31973Online Fire Reporting System v1.0 is vulnerable to Delete any file via /ofrs/classes/Master.php?f=delete_img.
- CVE-2022-31974Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=reports&date=.
- CVE-2022-31975Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=user/manage_user&id=.
- CVE-2022-31976Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/classes/Master.php?f=delete_request.
- CVE-2022-31977Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/classes/Master.php?f=delete_team.
- CVE-2022-31978Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/classes/Master.php?f=delete_inquiry.
- CVE-2022-31980Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=teams/manage_team&id=.
- CVE-2022-31981Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=teams/view_team&id=.
- CVE-2022-31982Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=requests/view_request&id=.
- CVE-2022-31983Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=requests/manage_request&id=.
- CVE-2022-31984Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/requests/take_action.php?id=.
- CVE-2022-31966ChatBot App with Suggestion v1.0 is vulnerable to Delete any file via /simple_chat_bot/classes/Master.php?f=delete_img.
- CVE-2022-31969ChatBot App with Suggestion v1.0 is vulnerable to SQL Injection via /simple_chat_bot/admin/?page=user/manage_user&id=.
- CVE-2022-31970ChatBot App with Suggestion v1.0 is vulnerable to SQL Injection via /simple_chat_bot/admin/?page=responses/manage_response&id=.
- CVE-2022-31971ChatBot App with Suggestion v1.0 is vulnerable to SQL Injection via /simple_chat_bot/admin/?page=responses/view_response&id=.
- CVE-2022-31000CSRF allows attacker to finalize/unfinalize order adjustments in solidus_backendsolidusio solidus · solidus_backend
- CVE-2022-29659Responsive Online Blog v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at single.php.
- CVE-2022-1929Exponential ReDoS in devcertdevcert
- CVE-2021-43308Exponential ReDoS in markdown-link-extractormarkdown-link-extractor
- CVE-2021-43307Exponential ReDoS in semver-regexsemver-regex
- CVE-2021-43306Exponential ReDoS in jquery-validationjquery-validation
- CVE-2022-30277BD Synapsys™ – Insufficient Session ExpirationBecton Dickinson (BD) BD Synapsys™
- CVE-2022-31945Rescue Dispatch Management System v1.0 is vulnerable to Delete any file via /rdms/classes/Master.php?f=delete_img.
- CVE-2022-31946Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/classes/Master.php?f=delete_team.
- CVE-2022-31948Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/classes/Master.php?f=delete_report.
- CVE-2022-31951Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/classes/Master.php?f=delete_respondent_type.
- CVE-2022-31952Rescue Dispatch Management System v1.0 is vulnerable to SQL injection via /rdms/classes/Master.php?f=delete_incident.
- CVE-2022-31953Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/incident_reports/view_report.php?id=.
- CVE-2022-31956Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/incident_reports/manage_report.php?id=.
- CVE-2022-31957Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via rdms/admin/teams/view_team.php?id=.
- CVE-2022-31959Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/teams/manage_team.php?id=.
- CVE-2022-31961Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/incidents/manage_incident.php?id=.
- CVE-2022-31962Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/incidents/view_incident.php?id=.
- CVE-2022-31964Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via rdms/admin/respondent_types/view_respondent_type.php?id=.
- CVE-2022-31965Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/respondent_types/manage_respondent_type.php?id=.
- CVE-2022-1949An access control bypass vulnerability found in 389-ds-base.389-ds-base
- CVE-2020-20971Cross Site Request Forgery (CSRF) vulnerability in PbootCMS v2.0.3 via /admin.php?p=/User/index.
- CVE-2021-33254An issue was discovered in src/http/httpLib.c in EmbedThis Appweb Community Edition 8.2.1, allows attackers to cause a denial of service via
- CVE-2021-34078lifion-verify-dependencies through 1.1.0 is vulnerable to OS command injection via a crafted dependency name on the scanned project's packaglifion-verify-deps
- CVE-2021-34079OS Command injection vulnerability in Mintzo Docker-Tester through 1.2.1 allows attackers to execute arbitrary commands via shell metacharacdocker-tester
- CVE-2021-34080OS Command Injection vulnerability in es128 ssl-utils 1.0.0 for Node.js allows attackers to execute arbitrary commands via unsanitized shellssl-utils
- CVE-2021-34081OS Command Injection vulnerability in bbultman gitsome through 0.2.3 allows attackers to execute arbitrary commands via a crafted tag name ogitsome
- CVE-2021-34082OS Command Injection vulnerability in allenhwkim proctree through 0.1.1 and commit 0ac10ae575459457838f14e21d5996f2fa5c7593 for Node.js, allproctree
- CVE-2021-34083Google-it is a Node.js package which allows its users to send search queries to Google and receive the results in a JSON format.google-it
- CVE-2021-34084OS command injection vulnerability in Turistforeningen node-s3-uploader through 2.0.3 for Node.js allows attackers to execute arbitrary comms3-uploader
- CVE-2022-30470In Afian Filerun 20220202 Changing the "search_tika_path" variable to a custom (and previously uploaded) jar file results in remote code exe
- CVE-2022-23237E-Series SANtricity OS Controller Software 11.x versions through 11.70.2 are vulnerable to host header injection attacks that could allow anE-Series SANtricity OS Controller Software 11.x
- CVE-2022-23236E-Series SANtricity OS Controller Software versions 11.40 through 11.70.2 store the LDAP BIND password in plaintext within a file accessibleE-Series SANtricity OS Controller Software 11.x
- CVE-2022-31342Online Car Wash Booking System v1.0 is vulnerable to Delete any file via /ocwbs/classes/Master.php?f=delete_img.
- CVE-2022-31343Online Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/admin/?page=bookings/view_details&id=.
- CVE-2022-31344Online Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/classes/Master.php?f=delete_booking.
- CVE-2022-31345Online Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/admin/?page=user/manage_user&id=.
- CVE-2022-31346Online Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/classes/Master.php?f=delete_service.
- CVE-2022-31347Online Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/classes/Master.php?f=delete_vehicle.
- CVE-2022-31348Online Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/admin/bookings/update_status.php?id=.
- CVE-2022-31350Online Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/admin/vehicles/manage_vehicle.php?id=.
- CVE-2022-31351Online Car Wash Booking System v1.0 by oretnom23 has SQL injection via /ocwbs/admin/services/manage_price.php?id=.
- CVE-2022-31352Online Car Wash Booking System v1.0 by oretnom23 has SQL injection in /ocwbs/admin/services/manage_service.php?id=.
- CVE-2022-31353Online Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/admin/services/view_service.php?id=.
- CVE-2022-31354Online Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/classes/Master.php?f=get_vehicle_service.
- CVE-2022-31339Simple Inventory System v1.0 is vulnerable to SQL Injection via /inventory/login.php.
- CVE-2022-31340Simple Inventory System v1.0 is vulnerable to SQL Injection via /inventory/table_edit_ajax.php.
- CVE-2022-29777Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a heap overflow via the component Desktop
- CVE-2022-29776Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a stack overflow via the component Deskto
- CVE-2022-26978Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a URL /checklogin.jsp endpoint.
- CVE-2022-26977Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism.
- CVE-2022-26976Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism.
- CVE-2022-26975Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing log files without authentication.
- CVE-2022-26974Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a file upload mechanism.
- CVE-2022-26973Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism.
- CVE-2022-26972Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a URL /cgi-bin endpoint.
- CVE-2022-26971Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism.
- CVE-2022-29875A vulnerability has been identified in Biograph Horizon PET/CT Systems (All VJ30 versions < VJ30C-UD01), MAGNETOM Family (NUMARIS X: VA12M, Siemens Biograph Horizon PET/CT Systems · Siemens MAGNE… +21
- CVE-2022-32200libdwarf 0.4.0 has a heap-based buffer over-read in _dwarf_check_string_valid in dwarf_util.c.
- CVE-2022-32201In libjpeg 1.63, there is a NULL pointer dereference in Component::SubXOf in component.hpp.
- CVE-2022-32202In libjpeg 1.63, there is a NULL pointer dereference in LineBuffer::FetchRegion in linebuffer.cpp.
- CVE-2021-44080A Command Injection vulnerability in httpd web server (setup.cgi) in SerComm h500s, FW: lowi-h500s-v3.4.22 allows logged in administrators t
- CVE-2022-30490Badminton Center Management System V1.0 is vulnerable to SQL Injection via parameter 'id' in /bcms/admin/court_rentals/update_status.php.
- CVE-2022-1943A flaw out of bounds memory write in the Linux kernel UDF file system functionality was found in the way user triggers some file operation wKernel
- CVE-2022-27774An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attackehttps://github.com/curl/curl
- CVE-2022-27776A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirechttps://github.com/curl/curl
- CVE-2022-27779libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to rehttps://github.com/curl/curl
- CVE-2022-27780The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *differenthttps://github.com/curl/curl
- CVE-2022-30115Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provhttps://github.com/curl/curl