CVEs published June 8, 2022
61 CVEs were published on June 8, 2022: 4 critical, 7 high.
- Published
- 61
- Critical
- 4
- High
- 7
- Medium
- 2
- Low
- 0
- Unrated
- 48
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- Apache Software Foundation Apache HTTP Server
- 8
- kromitgmbh/titra
- 4
- gogs/gogs · gogs.io/gogs
- 2
- jgraph/drawio
- 2
- Air Conditioning System G-150AD; Air Conditioning System AG…
- 1
- api-res-py
- 1
- dolibarr/dolibarr
- 1
- gogs · gogs.io/gogs
- 1
- ITarian Endpoint Manager Communication Client for Windows
- 1
- ITarian platform
- 1
Critical 4
- CVE-2022-1992Path Traversal in gogs/gogsgogs/gogs · gogs.io/gogs
- CVE-2022-28615Read beyond bounds in ap_strcmp_match()Apache Software Foundation Apache HTTP Server
- CVE-2022-2014Code Injection in jgraph/drawiojgraph/drawio
- CVE-2022-25152ITarian - Any user with a valid session token can create and execute agent procedures and bypass mandatory approvalsITarian platform
High 7
- CVE-2022-1993Path Traversal in gogs/gogsgogs/gogs · gogs.io/gogs
- CVE-2022-2026Cross-site Scripting (XSS) - Stored in kromitgmbh/titrakromitgmbh/titra
- CVE-2022-2027Improper Neutralization of Formula Elements in a CSV File in kromitgmbh/titrakromitgmbh/titra
- CVE-2022-2028Cross-site Scripting (XSS) - Generic in kromitgmbh/titrakromitgmbh/titra
- CVE-2022-2029Cross-site Scripting (XSS) - DOM in kromitgmbh/titrakromitgmbh/titra
- CVE-2022-25151ITarian - Session cookie not protected by HttpOnly flagITarian SaaS platform / on-premise
- CVE-2022-25153ITarian - Local privilege escalation in Endpoint Manager agent on WindowsITarian Endpoint Manager Communication Client for Windows
Medium, low and unrated 50
- CVE-2022-31496LibreHealth EHR Base 2.0.0 allows incorrect interface/super/manage_site_files.php access.
- CVE-2022-29014A local file inclusion vulnerability in Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to read arbitrary files.
- CVE-2022-29013A command injection in the command parameter of Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to execute arbitrary commands
- CVE-2022-31313api-res-py package in PyPI 0.1 is vulnerable to a code execution backdoor in the request package.api-res-py
- CVE-2022-30882pyanxdns package in PyPI version 0.2 is vulnerable to code execution backdoor.
- CVE-2021-40589ZAngband zangband-data 2.7.5 is affected by an integer underflow vulnerability in src/tk/plat.c through the variable fileheader.bfOffBits.
- CVE-2022-31038XSS vulnerability in repository issue list in Gogsgogs · gogs.io/gogs
- CVE-2022-30877The keep for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party.keep
- CVE-2022-30875Dolibarr 12.0.5 is vulnerable to Cross Site Scripting (XSS) via Sql Error Page.dolibarr/dolibarr
- CVE-2022-31325There is a SQL Injection vulnerability in ChurchCRM 4.4.5 via the 'PersonID' field in /churchcrm/WhyCameEditor.php.
- CVE-2022-30899A Cross Site Scripting vulnerabilty exists in PartKeepr 1.4.0 via the 'name' field in /api/part_categories.
- CVE-2022-28385An issue was discovered in certain Verbatim drives through 2022-03-31.
- CVE-2022-28387An issue was discovered in certain Verbatim drives through 2022-03-31.
- CVE-2022-32273As a result of an observable discrepancy in returned messages, OPSWAT MetaDefender Core (MDCore) before 5.1.2 could allow an authenticated u
- CVE-2021-36710ToaruOS 1.99.2 is affected by incorrect access control via the kernel.
- CVE-2020-14125A denial of service vulnerability exists in some Xiaomi models of phones.Redmi Note 11 ,Redmi Note
- CVE-2022-24296Use of a Broken or Risky Cryptographic Algorithm vulnerability in Air Conditioning System G-150AD Ver.Air Conditioning System G-150AD; Air Conditioning System AG…
- CVE-2022-30926H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the EditMacList parameter at /goform/aspForm.
- CVE-2022-30925H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the AddMacList parameter at /goform/aspForm.
- CVE-2022-30924H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the SetAPWifiorLedInfoById parameter at /goform/asp
- CVE-2022-30922H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the EditWlanMacList parameter at /goform/aspForm.
- CVE-2022-30923H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Asp_SetTimingtimeWifiAndLed parameter at /gofor
- CVE-2022-30921H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the SetMobileAPInfoById parameter at /goform/aspFor
- CVE-2022-30920H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Edit_BasicSSID parameter at /goform/aspForm.
- CVE-2022-30918H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Asp_SetTelnet parameter at /goform/aspForm.
- CVE-2022-30919H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Edit_BasicSSID_5G parameter at /goform/aspForm.
- CVE-2022-30917H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the AddWlanMacList parameter at /goform/aspForm.
- CVE-2022-30916H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Asp_SetTelnetDebug parameter at /goform/aspForm
- CVE-2022-30914H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the UpdateMacClone parameter at /goform/aspForm.
- CVE-2022-30915H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the UpdateSnat parameter at /goform/aspForm.
- CVE-2022-30913H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the ipqos_set_bandwidth parameter at /goform/aspFor
- CVE-2022-30912H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the UpdateWanParams parameter at /goform/aspForm.
- CVE-2022-30910H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the GO parameter at /goform/aspForm.
- CVE-2022-30909H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the CMD parameter at /goform/aspForm.
- CVE-2022-30552Das U-Boot 2022.01 has a Buffer Overflow.
- CVE-2022-30790Das U-Boot 2022.01 has a Buffer Overflow, a different issue than CVE-2022-30552.
- CVE-2022-31497LibreHealth EHR Base 2.0.0 allows interface/main/finder/finder_navigation.php patient XSS.
- CVE-2022-31813mod_proxy X-Forwarded-For dropped by hop-by-hop mechanismApache Software Foundation Apache HTTP Server
- CVE-2022-30556Information Disclosure in mod_lua with websocketsApache Software Foundation Apache HTTP Server
- CVE-2022-30522mod_sed denial of serviceApache Software Foundation Apache HTTP Server
- CVE-2022-29404Denial of service in mod_lua r:parsebodyApache Software Foundation Apache HTTP Server
- CVE-2022-28614read beyond bounds via ap_rwrite()Apache Software Foundation Apache HTTP Server
- CVE-2022-28330read beyond bounds in mod_isapiApache Software Foundation Apache HTTP Server
- CVE-2022-26377mod_proxy_ajp: Possible request smugglingApache Software Foundation Apache HTTP Server
- CVE-2022-2015Cross-site Scripting (XSS) - Stored in jgraph/drawiojgraph/drawio
- CVE-2021-40592GPAC version before commit 71460d72ec07df766dab0a4d52687529f3efcf0a (version v1.0.1 onwards) contains loop with unreachable exit condition (
- CVE-2022-28382An issue was discovered in certain Verbatim drives through 2022-03-31.
- CVE-2022-28383An issue was discovered in certain Verbatim drives through 2022-03-31.
- CVE-2022-28384An issue was discovered in certain Verbatim drives through 2022-03-31.
- CVE-2022-28386An issue was discovered in certain Verbatim drives through 2022-03-31.