CVEs published June 2, 2022
87 CVEs were published on June 2, 2022: 3 critical, 13 high.
- Published
- 87
- Critical
- 3
- High
- 13
- Medium
- 8
- Low
- 3
- Unrated
- 60
- Now in CISA KEV
- 0
- Fix available
- 22
Most affected products
- Dell PowerStore
- 6
- Schneider Electric Wiser Smart
- 6
- Dell Unity
- 2
- SourceCodester Product Show Room Site
- 2
- dragonfly
- 1
- github.com/caddyserver/caddy · github.com/caddyserver/caddy…
- 1
- Keep My Notes
- 1
- Mattermost · github.com/mattermost/mattermost-server
- 1
- Mitsubishi Electric MELSEC-Q Series QJ71E71-100; Mitsubishi…
- 1
- neos/neos
- 1
Critical 3
- CVE-2022-30234A CWE-798: Use of Hard-coded Credentials vulnerability exists that could allow arbitrary code to be executed when root level access is obtaiSchneider Electric Wiser Smart
- CVE-2022-31462Owl Labs Meeting Owl 5.2.0.15 allows attackers to control the device via a backdoor password (derived from the serial number) that can be fo
- CVE-2022-26869Dell PowerStore versions 2.0.0.x, 2.0.1.x and 2.1.0.x contains an open port vulnerability.Dell PowerStore
High 13
- CVE-2022-30238A CWE-287: Improper Authentication vulnerability exists that could allow an attacker to take over the admin account when an attacker hijacksSchneider Electric Wiser Smart
- CVE-2022-30237A CWE-311: Missing Encryption of Sensitive Data vulnerability exists that could allow authentication credentials to be recovered when an attSchneider Electric Wiser Smart
- CVE-2022-30236A CWE-669: Incorrect Resource Transfer Between Spheres vulnerability exists that could allow unauthorized access when an attacker uses crossSchneider Electric Wiser Smart
- CVE-2022-30235A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow unauthorized access when an attacSchneider Electric Wiser Smart
- CVE-2022-30232A CWE-20: Improper Input Validation vulnerability exists that could cause potential remote code execution when an attacker is able to intercSchneider Electric Power Logic ION Setup
- CVE-2022-31459Owl Labs Meeting Owl 5.2.0.15 allows attackers to retrieve the passcode hash via a certain c 10 value over Bluetooth.
- CVE-2022-31461Owl Labs Meeting Owl 5.2.0.15 allows attackers to deactivate the passcode protection mechanism via a certain c 11 message.
- CVE-2022-31463Owl Labs Meeting Owl 5.2.0.15 does not require a password for Bluetooth commands, because only client-side authentication is used.
- CVE-2022-31460Owl Labs Meeting Owl 5.2.0.15 allows attackers to activate Tethering Mode with hard-coded hoothoot credentials via a certain c 150 value.
- CVE-2022-29084Dell Unity, Dell UnityVSA, and Dell Unity XT versions before 5.2.0.0.5.173 do not restrict excessive authentication attempts in Unisphere GUDell Unity
- CVE-2022-22557PowerStore contains Plain-Text Password Storage Vulnerability in PowerStore X & T environments running versions 2.0.0.x and 2.0.1.x A locallDell PowerStore
- CVE-2022-31018Denial of service binding form from JSON in Play Frameworkplayframework · com.typesafe.play:play_2.13 +1
- CVE-2022-1968Use After Free in vim/vimvim/vim
Medium, low and unrated 71
- CVE-2022-30233A CWE-20: Improper Input Validation vulnerability exists that could allow the product to be maliciously manipulated when the user is trickedSchneider Electric Wiser Smart
- CVE-2022-29594eG Agent before 7.2 has weak file permissions that enable escalation of privileges to SYSTEM.
- CVE-2022-29085Dell Unity, Dell UnityVSA, and Dell Unity XT versions prior to 5.2.0.0.5.173 contain a plain-text password storage vulnerability when certaiDell Unity
- CVE-2022-26868Dell EMC PowerStore versions 2.0.0.x, 2.0.1.x, and 2.1.0.x are vulnerable to a command injection flaw.Dell PowerStore
- CVE-2022-26867PowerStore SW v2.1.1.0 supports the option to export data to either a CSV or an XLSX file.Dell PowerStore
- CVE-2022-26866Dell PowerStore Versions before v2.1.1.0.Dell PowerStore
- CVE-2022-22556Dell PowerStore contains an Uncontrolled Resource Consumption Vulnerability in PowerStore User Interface.Dell PowerStore
- CVE-2022-32250net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privil
- CVE-2021-33473An argument injection vulnerability in Dragonfly Ruby Gem v1.3.0 allows attackers to read and write arbitrary files when the verify_url optidragonfly
- CVE-2021-42877TOTOLINK EX1200T V4.1.2cu.5215 contains a denial of service vulnerability in function RebootSystem of the file lib/cste_modules/system which
- CVE-2021-42875TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in the function setDiagnosisCfg of the file lib/cste_module
- CVE-2022-31024Federated editing allows iframing remote servers by default in richdocumentsnextcloud security-advisories
- CVE-2022-31023Dev error stack trace leaking into prod in Play Frameworkplayframework · com.typesafe.play:play_2.12 +1
- CVE-2021-45983NetScout nGeniusONE 6.3.2 allows Java RMI Code Execution.
- CVE-2021-45982NetScout nGeniusONE 6.3.2 allows Arbitrary File Upload by a privileged user.
- CVE-2021-45981NetScout nGeniusONE 6.3.2 allows an XML External Entity (XXE) attack.
- CVE-2022-26944Percona XtraBackup 2.4.20 unintentionally writes the command line to any resulting backup file output.
- CVE-2021-38221bbs-go <= 3.3.0 including Custom Edition is vulnerable to stored XSS.
- CVE-2022-1980SourceCodester Product Show Room Site cross site scriptingSourceCodester Product Show Room Site
- CVE-2022-1979SourceCodester Product Show Room Site p=contact cross site scriptingSourceCodester Product Show Room Site
- CVE-2022-30429Multiple cross-site scripting (XSS) vulnerabilities in Neos CMS allow attackers with the editor role or higher to inject arbitrary script orneos/neos
- CVE-2022-29597Solutions Atlantic Regulatory Reporting System (RRS) v500 is vulnerable to Local File Inclusion (LFI).
- CVE-2022-1716Keep My Notes v1.80.147 allows an attacker with physical access to the victim's device to bypass the application's password/pin lock to acceKeep My Notes
- CVE-2022-1982A crafted SVG attachment can crash a Mattermost serverMattermost · github.com/mattermost/mattermost-server
- CVE-2022-25163Improper Input Validation vulnerability in Mitsubishi Electric MELSEC-Q Series QJ71E71-100 first 5 digits of serial number "24061" or prior,Mitsubishi Electric MELSEC-Q Series QJ71E71-100; Mitsubishi…
- CVE-2022-29704BrowsBox CMS v4.0 was discovered to contain a SQL injection vulnerability.
- CVE-2022-32019Car Rental Management System v1.0 is vulnerable to Arbitrary code execution via car-rental-management-system/admin/ajax.php?action=save_car.
- CVE-2022-32020Car Rental Management System v1.0 is vulnerable to Arbitrary code execution via ip/car-rental-management-system/admin/ajax.php?action=save_s
- CVE-2022-32021Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/manage_movement.php?id=.
- CVE-2022-32022Car Rental Management System v1.0 is vulnerable to SQL Injection via /ip/car-rental-management-system/admin/ajax.php?action=login.
- CVE-2022-32024Car Rental Management System v1.0 is vulnerable to SQL Injection via car-rental-management-system/booking.php?car_id=.
- CVE-2022-32025Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/view_car.php?id=.
- CVE-2022-32026Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/manage_booking.php?id=.
- CVE-2022-32027Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/index.php?page=manage_car&id=.
- CVE-2022-32028Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/manage_user.php?id=.
- CVE-2022-32007Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/admin/company/index.php?view=edit&id=.
- CVE-2022-32008Complete Online Job Search System v1.0 is vulnerable to SQL Injection via eris/admin/vacancy/index.php?view=edit&id=.
- CVE-2022-32010Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/admin/user/index.php?view=edit&id=.
- CVE-2022-32011Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/admin/applicants/index.php?view=view&id=.
- CVE-2022-32012Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/admin/employee/index.php?view=edit&id=.
- CVE-2022-32013Complete Online Job Search System v1.0 is vulnerable to SQL Injection via eris/admin/category/index.php?view=edit&id=.
- CVE-2022-32014Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/index.php?q=result&searchfor=byfunction.
- CVE-2022-32015Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/index.php?q=category&search=.
- CVE-2022-32016Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/index.php?q=result&searchfor=bycompany.
- CVE-2022-32017Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/index.php?q=result&searchfor=bytitle.
- CVE-2022-32018Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/index.php?q=hiring&search=.
- CVE-2022-31985Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/?page=reports/daily_sales_report&date=.
- CVE-2022-31986Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/?page=reports/daily_court_rental_report&date=.
- CVE-2022-31988Badminton Center Management System v1.0 is vulnerable to SQL Injection via bcms/admin/?page=reports/daily_services_report&date=.
- CVE-2022-31989Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/?page=user/manage_user&id=.
- CVE-2022-31990Badminton Center Management System v1.0 is vulnerable to SQL Injection via bcms/classes/Master.php?f=delete_product.
- CVE-2022-31991Badminton Center Management System v1.0 is vulnerable to SQL Injection via bcms/classes/Master.php?f=delete_court.
- CVE-2022-31992Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/?page=court_rentals/view_court_rental&id=.
- CVE-2022-31993Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/classes/Master.php?f=delete_service.
- CVE-2022-31994Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/?page=sales/view_details&id.
- CVE-2022-31996Badminton Center Management System v1.0 is vulnerable to SQL Injection via bcms/admin/?page=sales/manage_sale&id=.
- CVE-2022-31998Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/?page=service_transactions/view_details&id=.
- CVE-2022-32000Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/?page=service_transactions/manage_service_transaction
- CVE-2022-32001Badminton Center Management System v1.0 is vulnerable to SQL Injection via bcms/admin/products/view_product.php?id=.
- CVE-2022-32002Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/courts/manage_court.php?id=.
- CVE-2022-32003Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/courts/view_court.php?id=.
- CVE-2022-32004Badminton Center Management System v1.0 is vulnerable to SQL Injection via bcms/admin/products/manage_product.php?id=.
- CVE-2022-32005Badminton Center Management System v1.0 is vulnerable to SQL Injection via bcms/admin/services/manage_service.php?id=.
- CVE-2022-32006Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/services/view_service.php?id=.
- CVE-2022-29788libmobi before v0.10 contains a NULL pointer dereference via the component mobi_buffer_getpointer.
- CVE-2019-12350An issue was discovered in zzcms 2019.
- CVE-2019-12349An issue was discovered in zzcms 2019.
- CVE-2021-33615RSA Archer 6.8.00500.1003 P5 allows Unrestricted Upload of a File with a Dangerous Type.
- CVE-2019-12351An issue was discovered in zzcms 2019.
- CVE-2022-26497BigBlueButton Greenlight 2.11.1 allows XSS.
- CVE-2022-29718Caddy v2.4 was discovered to contain an open redirect vulnerability.github.com/caddyserver/caddy · github.com/caddyserver/caddy…