CVEs published June 3, 2022
51 CVEs were published on June 3, 2022: 3 critical, 6 high. 1 is now in CISA KEV.
- Published
- 51
- Critical
- 3
- High
- 6
- Medium
- 12
- Low
- 9
- Unrated
- 21
- Now in CISA KEV
- 1
- Fix available
- 9
Most affected products
- SevOne Network Management System
- 3
- Demokratian
- 2
- Klapp App
- 2
- aleksis-core
- 1
- Atlassian Confluence Data Center · Atlassian Confluence Ser…
- 1
- bfabiszewski/libmobi
- 1
- Brandbugle
- 1
- com.xuxueli:xxl-job
- 1
- cookiecutter
- 1
- Countdown Timer
- 1
Critical 3
- CVE-2022-26134In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attackAtlassian Confluence Data Center · Atlassian Confluence Ser…
- CVE-2022-21122Arbitrary Code Executionmetacalc
- CVE-2022-26493miniOrange SAML Authentication BypassXecuify Drupal 8 miniOrange SAML SP · Xecuify Drupal 9 m… +1
High 6
- CVE-2022-29778D-Link DIR-890L 1.20b01 allows attackers to execute arbitrary code due to the hardcoded option Wake-On-Lan for the parameter 'descriptor' at
- CVE-2022-24065Command Injectioncookiecutter
- CVE-2020-36542Demokratian install3.php privileges managementDemokratian
- CVE-2020-36541Demokratian genera_select.php sql injectionDemokratian
- CVE-2020-36529SevOne Network Management System Traceroute traceroute.php command injectionSevOne Network Management System
- CVE-2022-31028Possible DDOS by establishing keep-alive connections with anonymous HTTP clients in MinIOminio
Medium, low and unrated 42
- CVE-2022-1703Improper neutralization of special elements in the SonicWall SSL-VPN SMA100 series management interface allows a remote authenticated attackSonicWall SMA100
- CVE-2022-29784PublicCMS V4.0.202204.a and below contains an information leak via the component /views/directive/sys/SysConfigDataDirective.java.
- CVE-2022-29773An access control issue in aleksis/core/util/auth_helpers.py: ClientProtectedResourceMixin of AlekSIS-Core v2.8.1 and below allows attackersaleksis-core
- CVE-2022-29770XXL-Job v2.3.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via /xxl-job-admin/jobinfo.com.xuxueli:xxl-job
- CVE-2021-43271Riverbed AppResponse 11.8.0, 11.8.5, 11.8.5a, 11.9.0, 11.9.0a, 11.10.0, 11.11.0, 11.11.0a, 11.11.1, 11.11.1a, 11.11.5, and 11.11.5a (when co
- CVE-2020-36540Neetai Tech product.php sql injectionNeetai Tech
- CVE-2020-36539Lógico y Creativo sql injectionLógico y Creativo
- CVE-2020-36538Eatan CMS sql injectionEatan CMS
- CVE-2020-36537Everywhere CMS sql injectionEverywhere CMS
- CVE-2020-36536Brandbugle main.php sql injectionBrandbugle
- CVE-2020-36535MINMAX newsDia.php sql injectionMINMAX
- CVE-2020-36534easyii CMS out cross-site request forgeryeasyii CMS · noumo/easyii
- CVE-2020-36533Klapp App JSON Web Token improper authenticationKlapp App
- CVE-2020-36532Klapp App Authorization Credentials information disclosureKlapp App
- CVE-2020-36531SevOne Network Management System Device Manager Page injectionSevOne Network Management System
- CVE-2020-36530SevOne Network Management System Alert Summary sql injectionSevOne Network Management System
- CVE-2021-42893In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can obtain sensitive information (wifikey, etc.) without authorization through getSysStatusCf
- CVE-2021-42892In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can start telnet without authorization because the default username and password exists in th
- CVE-2021-42891In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can obtain sensitive information (wifikey, etc.) without authorization.
- CVE-2021-42890TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function NTPSyncWithHost of the file system.so which can
- CVE-2020-36528Platinum Mobile MobileHandler.ashx access controlPlatinum Mobile
- CVE-2020-36527Server Status HTTP Status/SMTP Status cross site scriptingServer Status
- CVE-2020-36526Countdown Timer Macro cross site scriptingCountdown Timer
- CVE-2020-36525Linking New Windows Macro cross site scriptingLinking
- CVE-2020-36524Refined Toolkit UI-Image/UI-Button cross site scriptingRefined Toolkit
- CVE-2020-36523PlantUML Database Information Macro cross site scriptingPlantUML
- CVE-2022-31025Invite bypasses user approval in Discoursediscourse
- CVE-2022-1991Fast Food Ordering System Master List Master.php cross site scriptingFast Food Ordering System
- CVE-2021-42889In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can obtain sensitive information (wifikey, wifiname, etc.) without authorization.
- CVE-2021-42888TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function setLanguageCfg of the file global.so which can
- CVE-2021-42887In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm.
- CVE-2021-42886TOTOLINK EX1200T V4.1.2cu.5215 contains an information disclosure vulnerability where an attacker can get the apmib configuration file witho
- CVE-2021-42885TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function setDeviceMac of the file global.so which can co
- CVE-2021-42884TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function setDeviceName of the file global.so which can c
- CVE-2022-1988Cross-site Scripting (XSS) - Generic in neorazorx/facturascriptsneorazorx/facturascripts · facturascripts/facturascripts
- CVE-2022-1987Buffer Over-read in bfabiszewski/libmobibfabiszewski/libmobi
- CVE-2022-32270In Real Player 20.0.7.309 and 20.0.8.310, external::Import() allows download of arbitrary file types and Directory Traversal, leading to Rem
- CVE-2022-32271In Real Player 20.0.8.310, there is a DCP:// URI Remote Arbitrary Code Execution Vulnerability.
- CVE-2022-32269In Real Player 20.0.8.310, the G2 Control allows injection of unsafe javascript: URIs in local HTTP error pages (displayed by Internet Explo
- CVE-2022-32268StarWind SAN and NAS v0.2 build 1914 allow remote code execution.
- CVE-2022-32265qDecoder before 12.1.0 does not ensure that the percent character is followed by two hex digits for URL decoding.
- CVE-2022-29767adbyby v2.7 allows external users to make connections via port 8118.