CVEs published June 9, 2022
62 CVEs were published on June 9, 2022: 4 critical, 10 high.
- Published
- 62
- Critical
- 4
- High
- 10
- Medium
- 20
- Low
- 1
- Unrated
- 27
- Now in CISA KEV
- 0
- Fix available
- 15
Most affected products
- Solare Solar-Log
- 7
- envoyproxy envoy
- 5
- HumHub
- 3
- xen
- 3
- Axios Italia Axios RE
- 2
- glpi-project glpi
- 2
- guzzle · guzzlehttp/guzzle +1
- 2
- Trend Micro Security
- 2
- ajenti
- 1
- CoreHR Core Portal
- 1
Critical 4
- CVE-2022-29226Trivial authentication bypass in Envoyenvoyproxy envoy
- CVE-2022-2037Excessive Attack Surface in tooljet/tooljettooljet/tooljet
- CVE-2022-2036Cross-site Scripting (XSS) - Stored in francoisjacquet/rosariosisfrancoisjacquet/rosariosis
- CVE-2022-1986OS Command Injection in gogs/gogsgogs/gogs · gogs.io/gogs
High 10
- CVE-2017-20025Solare Solar-Log Flash Memory privileges managementSolare Solar-Log
- CVE-2017-20022Solare Solar-Log information disclosureSolare Solar-Log
- CVE-2022-31045Ill-formed headers may lead to unexpected behavior in Istioistio · istio.io/istio
- CVE-2022-29250SQL injection in GLPIglpi-project glpi
- CVE-2022-29227Use after free in Envoyenvoyproxy envoy
- CVE-2022-29228Reachable assertion in Envoyenvoyproxy envoy
- CVE-2022-29225Zip bomb vulnerability in Envoyenvoyproxy envoy
- CVE-2016-15002MONyog Ultimate Cookie privileges managementMONyog Ultimate
- CVE-2022-31042Failure to strip the Cookie header on change in host or HTTP downgrade in Guzzleguzzle · guzzlehttp/guzzle +1
- CVE-2022-31043Fix failure to strip Authorization header on HTTP downgrade in Guzzleguzzle · guzzlehttp/guzzle +1
Medium, low and unrated 48
- CVE-2017-20028HumHub privileges managementHumHub
- CVE-2017-20027HumHub DOM cross site scritingHumHub
- CVE-2017-20026HumHub Reflected cross site scritingHumHub
- CVE-2017-20024Solare Solar-Log denial of serviceSolare Solar-Log
- CVE-2017-20023Solare Solar-Log Network Config privileges managementSolare Solar-Log
- CVE-2017-20021Solare Solar-Log File Upload privileges managementSolare Solar-Log
- CVE-2017-20020Solare Solar-Log cross-site request forgerySolare Solar-Log
- CVE-2017-20019Solare Solar-Log Config information disclosureSolare Solar-Log
- CVE-2017-20018XAMPP Installer uncontrolled search pathXAMPP
- CVE-2022-21499KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown.Oracle Linux · Oracle VM
- CVE-2022-30703Trend Micro Security 2021 and 2022 (Consumer) is vulnerable to an exposed dangerous method vulnerability that could allow an attacker to obtTrend Micro Security
- CVE-2022-30702Trend Micro Security 2022 and 2021 (Consumer) is vulnerable to an Out-Of-Bounds Read Information Disclosure vulnerability that could allow aTrend Micro Security
- CVE-2022-31051Exposure of Sensitive Information to an Unauthorized Actor in semantic-releasesemantic-release
- CVE-2022-31033Authorization header leak in rubygem Mechanizesparklemotion mechanize · mechanize
- CVE-2022-29224Segmentation fault leading to crash in Envoyenvoyproxy envoy
- CVE-2022-30898A Cross-site request forgery (CSRF) vulnerability in Cscms music portal system v4.2 allows remote attackers to change the administrator's us
- CVE-2022-24876Stored cross site scrpting in GLPI's Kanbanglpi-project glpi
- CVE-2022-30760An Insecure Direct Object Reference (IDOR) issue in fn2Web in ihb eG FlexNow before 2.04.09.016 allows remote authenticated attackers to obt
- CVE-2022-1998A use after free in the Linux kernel File System notify functionality was found in the way user triggers copy_info_records_to_user() call toKernel
- CVE-2022-23138ZTE's MF297D product has cryptographic issues vulnerability.MF297D
- CVE-2022-2035A reflected cross-site scripting (XSS) vulnerability exists in the playerConfUrl parameter in the /defaultui/player/modern.html file for SCORustici Software SCORM Engine
- CVE-2022-31827MonstaFTP v2.10.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the function performFetchRequest at HTTPFetcher.php.
- CVE-2022-31830Kity Minder v1.3.5 was discovered to contain a Server-Side Request Forgery (SSRF) via the init function at ImageCapture.class.php.kityminder
- CVE-2022-31393Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Index function in app/admin/c/PluginsCo
- CVE-2022-31390Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Update function in app/admin/c/Template
- CVE-2022-31386A Server-Side Request Forgery (SSRF) in the getFileBinary function of nbnbk cms 3 allows attackers to force the application to make arbitrar
- CVE-2019-25070WolfCMS User Add cross site scriptingWolfCMS
- CVE-2019-25069Axios Italia Axios RE Error Message ASP.NET information disclosureAxios Italia Axios RE
- CVE-2019-25068Axios Italia Axios RE Connection REDefault.aspx privileges managementAxios Italia Axios RE
- CVE-2019-25067Podman/Varlink API Privilege EscalationPodman · Varlink
- CVE-2019-25066ajenti API privileges managementajenti
- CVE-2019-25065OpenNetAdmin os command injectionOpenNetAdmin
- CVE-2019-25064CoreHR Core Portal cross-site request forgeryCoreHR Core Portal
- CVE-2021-40668The Android application HTTP File Server (Version 1.4.1) by 'slowscript' is affected by a path traversal vulnerability that permits arbitrar
- CVE-2022-26362x86 pv: Race condition in typeref acquisition Xen maintains a type reference count for pages, in addition to a regular reference count.xen
- CVE-2022-26364x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple CVEs; the text explains which aspects/xen
- CVE-2022-26363x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple CVEs; the text explains which aspects/xen
- CVE-2021-40610Emlog Pro v 1.0.4 cross-site scripting (XSS) in Emlog Pro background management.
- CVE-2022-30075In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to remote code execution due
- CVE-2022-31649ownCloud owncloud/core before 10.10.0 Improperly Removes Sensitive Information Before Storage or Transfer.
- CVE-2022-25804An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100.
- CVE-2022-25805An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100.
- CVE-2022-25806An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100.
- CVE-2022-25807An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100.
- CVE-2022-32195Open edX platform before 2022-06-06 allows XSS via the "next" parameter in the logout URL.
- CVE-2021-40961CMS Made Simple <=2.2.15 is affected by SQL injection in modules/News/function.admin_articlestab.php.
- CVE-2022-31214A Privilege Context Switching issue was discovered in join.c in Firejail 0.9.68.
- CVE-2022-32272OPSWAT MetaDefender Core before 5.1.2, MetaDefender ICAP before 4.12.1, and MetaDefender Email Gateway Security before 5.6.1 have incorrect