CVEs published June 17, 2022
56 CVEs were published on June 17, 2022: 4 critical, 9 high.
- Published
- 56
- Critical
- 4
- High
- 9
- Medium
- 12
- Low
- 1
- Unrated
- 30
- Now in CISA KEV
- 0
- Fix available
- 8
Most affected products
- uTorrent
- 4
- GE Voluson S8
- 3
- fast-string-search
- 2
- inventree/inventree · inventree
- 2
- @discordjs/opus
- 1
- Anker Eufy Homebase
- 1
- Bachmann Visutec Atvise
- 1
- Blynk-Library
- 1
- github.com/argoproj/argo-events/sensors/artifacts · github.…
- 1
- IBM Robotic Process Automation
- 1
Critical 4
- CVE-2022-29496A stack-based buffer overflow vulnerability exists in the BlynkConsole.h runCommand functionality of Blynk -Library v1.0.1.Blynk-Library
- CVE-2022-21806A use-after-free vulnerability exists in the mips_collector appsrv_server functionality of Anker Eufy Homebase 2 2.1.8.5h.Anker Eufy Homebase
- CVE-2022-2112Improper Neutralization of Formula Elements in a CSV File in inventree/inventreeinventree/inventree · inventree
- CVE-2022-2111Unrestricted Upload of File with Dangerous Type in inventree/inventreeinventree/inventree · inventree
High 9
- CVE-2022-25852Denial of Service (DoS)pg-native · libpq
- CVE-2022-22138Denial of Service (DoS)fast-string-search
- CVE-2022-21213Prototype Pollutionmout
- CVE-2022-25345Denial of Service (DoS)@discordjs/opus
- CVE-2022-25856Directory Traversalgithub.com/argoproj/argo-events/sensors/artifacts · github.…
- CVE-2022-31083Authentication bypass in Parse Server Apple Game Center auth adapter parse-community parse-server · parse-server
- CVE-2020-36549GE Voluson S8 Windows Operating System Patches privileges managementGE Voluson S8
- CVE-2022-2113Cross-site Scripting (XSS) - Stored in inventree/inventreeinventree/inventree
- CVE-2022-33915Versions of the Amazon AWS Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.3.5 are affected by a race condition that co
Medium, low and unrated 43
- CVE-2022-21503Vulnerability in the Oracle Cloud Infrastructure product of Oracle Cloud Services.Oracle Cloud Infrastructure
- CVE-2022-25871Prototype Pollutionquerymen
- CVE-2022-25872Out-of-bounds Readfast-string-search
- CVE-2022-31874ASUS RT-N53 3.0.0.4.376.3754 has a command injection vulnerability in the SystemCmd parameter of the apply.cgi interface.
- CVE-2022-31873Trendnet IP-110wn camera fw_tv-ip110wn_v2(1.2.2.68) has an XSS vulnerability via the prefix parameter in /admin/general.cgi.
- CVE-2022-31875Trendnet IP-110wn camera fw_tv-ip110wn_v2(1.2.2.68) has an xss vulnerability via the proname parameter in /admin/scheprofile.cgi
- CVE-2022-31876netgear wnap320 router WNAP320_V2.0.3_firmware is vulnerable to Incorrect Access Control via /recreate.php, which can leak all users cookies
- CVE-2022-31941Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via \rdms\admin?page=user\manage_user&id=.
- CVE-2022-21184An information disclosure vulnerability exists in the License registration functionality of Bachmann Visutec GmbH Atvise 3.5.4, 3.6 and 3.7.Bachmann Visutec Atvise
- CVE-2022-30422Proietti Tech srl Planet Time Enterprise 4.2.0.1,4.2.0.0,4.1.0.0,4.0.0.0,3.3.1.0,3.3.0.0 is vulnerable to Remote code execution via the View
- CVE-2022-32442u5cms version 8.3.5 is vulnerable to Cross Site Scripting (XSS).
- CVE-2022-30607IBM Robotic Process Automation 20.10.0, 20.12.5, 21.0.0, 21.0.1, and 21.0.2 contains a vulnerability that could allow a user to obtain sensiIBM Robotic Process Automation
- CVE-2022-22485In some cases, an unsuccessful attempt to log into IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.14.000 does not cause the adIBM Spectrum Protect Server
- CVE-2022-32444An issue was discovered in u5cms verion 8.3.5 There is a URL redirection vulnerability that can cause a user's browser to be redirected to a
- CVE-2021-40903A vulnerability in Antminer Monitor 0.50.0 exists because of backdoor or misconfiguration inside a settings file in flask server.
- CVE-2022-31246paymentrequest.py in Electrum before 4.2.2 allows a file:// URL in the r parameter of a payment request (e.g., within QR code data).
- CVE-2022-31355Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/index.php?q=category&search=.
- CVE-2022-31356Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/admin/store/index.php?view=edit&id=.
- CVE-2022-31357Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/admin/inventory/index.php?view=edit&id=.
- CVE-2020-36548GE Voluson S8 Service Browser users.cgi improper authenticationGE Voluson S8
- CVE-2020-36547GE Voluson S8 Service Browser hard-coded credentialsGE Voluson S8
- CVE-2022-31296Online Discussion Forum Site 1 was discovered to contain a blind SQL injection vulnerability via the component /odfs/posts/view_post.php.
- CVE-2019-12352An issue was discovered in zzcms 2019.
- CVE-2019-12353An issue was discovered in zzcms 2019.
- CVE-2019-12354An issue was discovered in zzcms 2019.
- CVE-2019-12355An issue was discovered in zzcms 2019.
- CVE-2019-12356An issue was discovered in zzcms 2019.
- CVE-2019-12357An issue was discovered in zzcms 2019.
- CVE-2019-12358An issue was discovered in zzcms 2019.
- CVE-2019-12359An issue was discovered in zzcms 2019.
- CVE-2021-45026ASG technologies ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to Cross Site Scripting (XSS).
- CVE-2021-45025ASG technologies ( A Rocket Software Company) ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to Cleartext Storage of
- CVE-2021-45024ASG technologies ( A Rocket Software Company) ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to XML External Entity (
- CVE-2022-31784A vulnerability in the management interface of MiVoice Business through 9.3 PR1 and MiVoice Business Express through 8.0 SP3 PR3 could allow
- CVE-2022-32276Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/*?orgId=0 URI.
- CVE-2021-41490Memory leaks in LazyPRM.cpp of OMPL v1.5.0 can cause unexpected behavior.
- CVE-2021-41408VoIPmonitor WEB GUI up to version 24.61 is affected by SQL injection through the "api.php" file and "user" parameter.
- CVE-2022-33912A permission issue affects users that deployed the shipped version of the Checkmk Debian package.
- CVE-2018-25044uTorrent Guest Account privileges managementuTorrent
- CVE-2018-25043uTorrent PRNG improper authenticationuTorrent
- CVE-2018-25042uTorrent memory corruptionuTorrent
- CVE-2018-25041uTorrent JSON RPC Server privileges managementuTorrent
- CVE-2018-25040uTorrent Web HTTP RPC Server privileges managementuTorrent Web