CVEs published June 6, 2022
103 CVEs were published on June 6, 2022: 6 critical, 9 high.
- Published
- 103
- Critical
- 6
- High
- 9
- Medium
- 14
- Low
- 2
- Unrated
- 72
- Now in CISA KEV
- 0
- Fix available
- 52
Most affected products
- LenelS2 LNL-X2210 · LenelS2 LNL-X2220 +12
- 8
- GitLab
- 7
- MediaTek MT6580, MT6735, MT6739, MT6761, MT6765, MT6768, MT…
- 3
- MediaTek MT6853, MT6853T, MT6873, MT6875, MT6877, MT6883, M…
- 3
- Note Press
- 3
- Ask me
- 2
- Discy
- 2
- Five Minute Webshop
- 2
- MediaTek MT6771, MT6779, MT6781, MT6785, MT6833, MT6853, MT…
- 2
- WPQA Builder
- 2
Critical 6
- CVE-2022-24840Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in django-s3filecodingjoe django-s3file · django-s3file
- CVE-2022-1680An account takeover issue has been discovered in GitLab EE affecting all versions starting from 11.10 before 14.9.5, all versions starting fGitLab
- CVE-2022-31483Arbitrary file write via authenticated OSDP file uploadLenelS2 LNL-X2210 · LenelS2 LNL-X2220 +12
- CVE-2022-31481Remote Code Execution via buffer overflow in firmware update processLenelS2 LNL-X2210 · LenelS2 LNL-X2220 +12
- CVE-2022-31479Remote Code Execution via command injection of the hostnameLenelS2 LNL-X2210 · LenelS2 LNL-X2220 +12
- CVE-2022-1996Authorization Bypass Through User-Controlled Key in emicklei/go-restfulemicklei/go-restful · github.com/emicklei/go-restful +2
High 9
- CVE-2022-31019DoS Vulnerability in URLEncodedFormDecoder in Vaporvapor
- CVE-2022-29255Multiple evaluation of contract address in call in vypervyperlang vyper · vyper
- CVE-2022-32275Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/..
- CVE-2022-1940A Stored Cross-Site Scripting vulnerability in Jira integration in GitLab EE affecting all versions from 13.11 prior to 14.9.5, 14.10 prior GitLab
- CVE-2022-31486Command injection via Advanced Networking route add functionalityLenelS2 LNL-X2210 · LenelS2 LNL-X2220 +12
- CVE-2022-31484User Account Deletion UnauthenticatedLenelS2 LNL-X2210 · LenelS2 LNL-X2220 +12
- CVE-2022-31482Denial-of-Service via internal structure overflowLenelS2 LNL-X2210 · LenelS2 LNL-X2220 +12
- CVE-2022-31480Unauthenticated Firmware Upload and Arbitrary RebootLenelS2 LNL-X2210 · LenelS2 LNL-X2220 +12
- CVE-2022-1997Cross-site Scripting (XSS) - Stored in francoisjacquet/rosariosisfrancoisjacquet/rosariosis
Medium, low and unrated 88
- CVE-2022-29296A reflected cross-site scripting (XSS) vulnerability in the login portal of Avantune Genialcloud ProJ - 10 allows attackers to execute arbit
- CVE-2022-31494LibreHealth EHR Base 2.0.0 allows gacl/admin/acl_admin.php action XSS.
- CVE-2022-27438Caphyon Ltd Advanced Installer 19.3 and earlier and many products that use the updater from Advanced Installer (Advanced Updater) are affect
- CVE-2022-28051The "Add category" functionality inside the "Global Keywords" menu in "SeedDMS" version 6.0.18 and 5.1.25, is prone to stored XSS which allo
- CVE-2022-28478SeedDMS 6.0.17 and 5.1.24 are vulnerable to Directory Traversal.
- CVE-2022-28479SeedDMS versions 6.0.18 and 5.1.25 and below are vulnerable to stored XSS.
- CVE-2022-30927A SQL injection vulnerability exists in Simple Task Scheduling System 1.0 when MySQL is being used as the application database.
- CVE-2022-24969bypass of CVE-2021-25640Apache Software Foundation Apache Dubbo · org.apache.dub… +1
- CVE-2022-32511jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable.jmespath
- CVE-2022-31027Authorization Bypass Through User-Controlled Key when using CILogonOAuthenticator in oauthenticatorjupyterhub oauthenticator · oauthenticator
- CVE-2022-31026Use of Uninitialized Variable in trilogygithub trilogy · trilogy
- CVE-2022-31498LibreHealth EHR Base 2.0.0 allows interface/orders/patient_match_dialog.php key XSS.
- CVE-2022-30469In Afian Filerun 20220202, lack of sanitization of the POST parameter "metadata[]" in `/?module=fileman§ion=get&page=grid` leads to SQL
- CVE-2022-29631Jodd HTTP v6.0.9 was discovered to contain multiple CLRF injection vulnerabilities via the components jodd.http.HttpRequest#set and `jodd.htorg.jodd:jodd-http
- CVE-2022-31492Cross Site scripting (XSS) vulnerability inLibreHealth EHR Base 2.0.0 via interface/usergroup/usergroup_admin_add.php Username.
- CVE-2022-30587Gradle Enterprise through 2022.2.2 has Incorrect Access Control that leads to information disclosure.
- CVE-2020-6220BI Launchpad and CMC in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, does not sufficiently encode user-controlledSAP SE SAP Business Objects Business Intelligence Platform
- CVE-2022-29617Due to improper error handling an authenticated user can crash CLA assistant instance.SAP SE CLA Assistant
- CVE-2022-29254Failed payment recorded has completed in silverstripe/silverstripe-omnipaysilverstripe-omnipay · silverstripe/silverstripe-omnipay
- CVE-2022-24896Tracker report renderer and chart widgets leak information in TuleapEnalean tuleap
- CVE-2022-30586Gradle Enterprise through 2022.2.2 has Incorrect Access Control that leads to code execution.
- CVE-2022-31493LibreHealth EHR Base 2.0.0 allows gacl/admin/acl_admin.php acl_id XSS.
- CVE-2022-21762In apusys driver, there is a possible system crash due to an integer overflow.MediaTek MT6853, MT6853T, MT6873, MT6875, MT6877, MT6883, M…
- CVE-2022-21761In apusys driver, there is a possible system crash due to an integer overflow.MediaTek MT6853, MT6853T, MT6873, MT6875, MT6877, MT6883, M…
- CVE-2022-21760In apusys driver, there is a possible system crash due to an integer overflow.MediaTek MT6853, MT6853T, MT6873, MT6875, MT6877, MT6883, M…
- CVE-2022-21759In power service, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6580, MT6735, MT6739, MT6761, MT6765, MT6768, MT…
- CVE-2022-21758In ccu, there is a possible memory corruption due to a double free.MediaTek MT6833, MT6853, MT6873, MT6877, MT6885, MT6893
- CVE-2022-21757In WIFI Firmware, there is a possible system crash due to a missing count check.MediaTek MT6833, MT6853, MT6877, MT6885, MT6889, MT6983, MT…
- CVE-2022-21756In WLAN driver, there is a possible out of bounds read due to an incorrect bounds check.MediaTek MT6833, MT6853, MT6853T, MT6873, MT6875, MT6877, M…
- CVE-2022-21755In WLAN driver, there is a possible out of bounds read due to an incorrect bounds check.MediaTek MT6731, MT6732, MT6735, MT6737, MT6739, MT6750, MT…
- CVE-2022-21754In WLAN driver, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6761, MT6762, MT6765, MT6768, MT6779, MT6781, MT…
- CVE-2022-21753In WLAN driver, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6580, MT6735, MT6739, MT6761, MT6765, MT6768, MT…
- CVE-2022-21752In WLAN driver, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6580, MT6735, MT6739, MT6761, MT6765, MT6768, MT…
- CVE-2022-21751In WLAN driver, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6771, MT8167S, MT8168, MT8175, MT8183, MT8185, M…
- CVE-2022-21750In WLAN driver, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6761, MT6779, MT6781, MT6833, MT6853, MT6873, MT…
- CVE-2022-21749In telephony, there is a possible information disclosure due to a missing permission check.MediaTek MT6739, MT6750, MT6750S, MT6752, MT6753, MT6755, M…
- CVE-2022-21748In telephony, there is a possible information disclosure due to a missing permission check.MediaTek MT6580, MT6735, MT6737, MT6739, MT6753, MT6761, MT…
- CVE-2022-21747In imgsensor, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6771, MT6779, MT6781, MT6785, MT6833, MT6853, MT…
- CVE-2022-21746In imgsensor, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6771, MT6779, MT6781, MT6785, MT6833, MT6853, MT…
- CVE-2022-21745In WIFI Firmware, there is a possible memory corruption due to a use after free.MediaTek MT6761, MT6762, MT6765, MT6768, MT6769, MT6779, MT…
- CVE-2022-28224Calico and Calico Enterprise may be vulnerable to route hijacking with the floating IP featureTigera Calico Enterprise · Project Calico Calico +1
- CVE-2022-23712A Denial of Service flaw was discovered in Elasticsearch.elasticsearch · org.elasticsearch:elasticsearch
- CVE-2022-1783An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 14.9.5, all versions starting from 14.10 beforGitLab
- CVE-2022-1944When the feature is configured, improper authorization in the Interactive Web Terminal in GitLab CE/EE affecting all versions from 11.3 prioGitLab
- CVE-2022-1821An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.8 before 14.9.5, all versions starting from 14.10 beforGitLab
- CVE-2022-1936Incorrect authorization in GitLab EE affecting all versions from 12.0 before 14.9.5, all versions starting from 14.10 before 14.10.4, all veGitLab
- CVE-2022-1935Incorrect authorization in GitLab EE affecting all versions from 12.0 before 14.9.5, all versions starting from 14.10 before 14.10.4, all veGitLab
- CVE-2021-39947In specific circumstances, trace file buffers in GitLab Runner versions up to 14.3.4, 14.4 to 14.4.2, and 14.5 to 14.5.2 would re-use the fiGitLab Runner
- CVE-2022-31485Unauthenticated homepage note modificationLenelS2 LNL-X2210 · LenelS2 LNL-X2220 +12
- CVE-2022-22396Credentials are printed in clear text in the IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.3 virgo log file in certain cases.IBM Spectrum Protect Plus
- CVE-2022-31768IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection.IBM InfoSphere Information Server
- CVE-2021-41932A blind SQL injection vulnerability in search form in TeamMate+ Audit version 28.0.19.0 allows any authenticated user to create malicious SQ
- CVE-2022-30863FUDForum 3.1.2 is vulnerable to Cross Site Scripting (XSS) via page_title param in Page Manager in the Admin Control Panel.
- CVE-2022-30861FUDforum 3.1.2 is vulnerable to Stored XSS via Forum Name field in Forum Manager Feature.
- CVE-2022-30860FUDforum 3.1.2 is vulnerable to Remote Code Execution through Upload File feature of File Administration System in Admin Control Panel.
- CVE-2021-42245FlatCore-CMS 2.0.9 has a cross-site scripting (XSS) vulnerability in pages.edit.php through meta tags and content sections.
- CVE-2022-1712LiveSync for WordPress <= 1.0 - Arbitrary Settings Update via CSRFLiveSync for WordPress
- CVE-2022-1709Throws SPAM Away < 3.3.1 - Comment Deletion via CSRFThrows SPAM Away
- CVE-2022-1695WP Simple Adsense Insertion < 2.1 - Inject ads and javascript via CSRFWP Simple Adsense Insertion
- CVE-2022-1692CP Image Store with Slideshow < 1.0.68 - Unauthenticated SQLiCP Image Store with Slideshow
- CVE-2022-1691Realty Workstation < 1.0.15 - Agent SQLiRealty Workstation
- CVE-2022-1690Note Press <= 0.1.10 - Admin+ SQLi via Bulk ActionsNote Press
- CVE-2022-1689Note Press <= 0.1.10 - Admin+ SQLi via UpdateNote Press
- CVE-2022-1688Note Press <= 0.1.10 - Admin+ SQLi via idNote Press
- CVE-2022-1687Logo Slider <= 1.4.8 - Admin+ SQLiLogo Slider
- CVE-2022-1686Five Minute Webshop <= 1.3.2 - Admin+ SQLi via idFive Minute Webshop
- CVE-2022-1685Five Minute Webshop <= 1.3.2 - Admin+ SQLi via orderbyFive Minute Webshop
- CVE-2022-1684Cube Slider <= 1.2 - Admin+ SQLiCUBE SLIDER
- CVE-2022-1683amtyThumb <= 4.2.0 - Subscriber+ SQLiamtyThumb
- CVE-2022-1673WooCommerce Green Wallet Gateway < 1.0.2 - Reflected Cross Site Scripting in checkout pageWooCommerce Green Wallet Gateway
- CVE-2022-1647FormCraft Basic < 1.2.6 - Admin+ Stored Cross Site ScriptingFormCraft – Contact Form Builder for WordPress
- CVE-2022-1598WPQA < 5.5 - Unauthenticated Private Message DisclosureWPQA Builder
- CVE-2022-1597WPQA < 5.4 - Reflected Cross-Site ScriptingWPQA Builder
- CVE-2022-1577Database Backup for WordPress < 2.5.2 - Arbitrary Schedule Settings Update via CSRFDatabase Backup for WordPress
- CVE-2022-1570Files Download Delay < 1.0.7 - Subscriber+ Settings ResetFiles Download Delay
- CVE-2022-1569WordPress Forms by Pie Forms < 1.4.9.4 - Admin+ Stored Cross-Site ScriptingDrag & Drop Builder, Human Face Detector, Pre-built Templat…
- CVE-2022-1541Video Slider - Slider Carousel < 1.4.8 - Admin+ Stored Cross-Site ScriptingVideo Slider – Slider Carousel
- CVE-2022-1506WP Born Babies <= 1.0 - Contributor+ Stored Cross-Site ScriptingWP BORN BABIES PLUGIN
- CVE-2022-1469FiboSearch < 1.18.0 - Admin+ Stored Cross-Site ScriptingFiboSearch – Ajax Search for WooCommerce
- CVE-2022-1424Ask Me < 6.8.2 - Multiple CSRF in AJAX ActionsAsk me
- CVE-2022-1422Discy < 5.2 - Restore Default Settings via CSRFDiscy
- CVE-2022-1421Discy < 5.2 - Settings Update via CSRFDiscy
- CVE-2022-1394Photo Gallery < 1.6.4 - Admin+ Stored Cross-Site ScriptingPhoto Gallery by 10Web – Mobile-Friendly Image Gallery
- CVE-2022-1241Ask Me < 6.8.2 - Reflected Cross-Site ScriptingAsk me
- CVE-2022-1005WP Statistics < 13.2.2 - Reflected Cross-Site ScriptingWP Statistics
- CVE-2022-0788WP Fundraising Donation and Crowdfunding Platform < 1.5.0 - Unauthenticated SQLiWP Fundraising Donation and Crowdfunding Platform
- CVE-2022-0779User Meta < 2.4.4 - Subscriber+ Local File Enumeration via Path TraversalUser Meta – User Profile Builder and User management plugin
- CVE-2022-31030containerd CRI plugin: Host memory exhaustion through ExecSynccontainerd · github.com/containerd/containerd