# CVEs published 2022-06-22

114 CVEs were published on June 22, 2022: 0 critical, 7 high. Days are UTC.

- [CVE-2022-33124](https://cve.now/CVE-2022-33124.md): AIOHTTP 3.8.1 can report a "ValueError: Invalid IPv6 URL" outcome, which can lead to a Denial of Service (DoS). (no CVSS)
- [CVE-2022-33127](https://cve.now/CVE-2022-33127.md): The function that calls the diff tool in Diffy 3.4.1 does not properly handle double quotes in a filename when run in a windows environment. (no CVSS, diffy)
- [CVE-2022-34328](https://cve.now/CVE-2022-34328.md): PMB 7.3.10 allows reflected XSS via the id parameter in an lvl=author\_see request to index.php. (no CVSS)
- [CVE-2022-33097](https://cve.now/CVE-2022-33097.md): 74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/campus/campus\_job. (no CVSS)
- [CVE-2022-33095](https://cve.now/CVE-2022-33095.md): 74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/jobfairol/resumelist. (no CVSS)
- [CVE-2022-33096](https://cve.now/CVE-2022-33096.md): 74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/resume/index. (no CVSS)
- [CVE-2022-33094](https://cve.now/CVE-2022-33094.md): 74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/job/map. (no CVSS)
- [CVE-2022-33092](https://cve.now/CVE-2022-33092.md): 74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/job/index. (no CVSS)
- [CVE-2022-33093](https://cve.now/CVE-2022-33093.md): 74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the key parameter at /freelance/resume\_list. (no CVSS)
- [CVE-2022-32131](https://cve.now/CVE-2022-32131.md): 74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /index/notice/show. (no CVSS)
- [CVE-2022-32130](https://cve.now/CVE-2022-32130.md): 74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company/down\_resume/total/natur (no CVSS)
- [CVE-2022-32129](https://cve.now/CVE-2022-32129.md): 74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company/account/safety/trade. (no CVSS)
- [CVE-2022-32128](https://cve.now/CVE-2022-32128.md): 74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company/service/increment/add/i (no CVSS)
- [CVE-2022-32126](https://cve.now/CVE-2022-32126.md): 74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company. (no CVSS)
- [CVE-2022-32127](https://cve.now/CVE-2022-32127.md): 74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company/view\_be\_browsed/total. (no CVSS)
- [CVE-2022-32125](https://cve.now/CVE-2022-32125.md): 74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /job. (no CVSS)
- [CVE-2022-32124](https://cve.now/CVE-2022-32124.md): 74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component /index/jobfairol/show/. (no CVSS)
- [CVE-2021-41432](https://cve.now/CVE-2021-41432.md): A stored cross-site scripting (XSS) vulnerability exists in FlatPress 1.2.1 that allows for arbitrary execution of JavaScript commands throu (no CVSS)
- [CVE-2022-32159](https://cve.now/CVE-2022-32159.md): Openlibrary - Stored XSS (no CVSS, infogami)
- [CVE-2022-23081](https://cve.now/CVE-2022-23081.md): Openlibrary - Reflected XSS (no CVSS, openlibrary)
- [CVE-2022-31361](https://cve.now/CVE-2022-31361.md): Docebo Community Edition v4.0.5 and below was discovered to contain a SQL injection vulnerability. (no CVSS)
- [CVE-2022-31362](https://cve.now/CVE-2022-31362.md): Docebo Community Edition v4.0.5 and below was discovered to contain an arbitrary file upload vulnerability. (no CVSS)
- [CVE-2022-23080](https://cve.now/CVE-2022-23080.md): directus - SSRF which leads to internal port scan (no CVSS, directus)
- [CVE-2022-34295](https://cve.now/CVE-2022-34295.md): totd before 1.5.3 does not properly randomize mesg IDs. (no CVSS)
- [CVE-2022-34213](https://cve.now/CVE-2022-34213.md): Jenkins Squash TM Publisher (Squash4Jenkins) Plugin 1.0.0 and earlier stores passwords unencrypted in its global configuration file on the J (no CVSS, Jenkins project Jenkins Squash TM Publisher (Squash4Jenkins…)
- [CVE-2022-34212](https://cve.now/CVE-2022-34212.md): A missing permission check in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers with Overall/Read permission to send an (no CVSS, Jenkins project Jenkins vRealize Orchestrator Plugin · org.…)
- [CVE-2022-34211](https://cve.now/CVE-2022-34211.md): A cross-site request forgery (CSRF) vulnerability in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers to send an HTTP P (no CVSS, Jenkins project Jenkins vRealize Orchestrator Plugin · org.…)
- [CVE-2022-34210](https://cve.now/CVE-2022-34210.md): A missing permission check in Jenkins ThreadFix Plugin 1.5.4 and earlier allows attackers with Overall/Read permission to connect to an atta (no CVSS, Jenkins project Jenkins ThreadFix Plugin · org.jenkins-ci.p…)
- [CVE-2022-34209](https://cve.now/CVE-2022-34209.md): A cross-site request forgery (CSRF) vulnerability in Jenkins ThreadFix Plugin 1.5.4 and earlier allows attackers to connect to an attacker-s (no CVSS, Jenkins project Jenkins ThreadFix Plugin · org.jenkins-ci.p…)
- [CVE-2022-34208](https://cve.now/CVE-2022-34208.md): A missing permission check in Jenkins Beaker builder Plugin 1.10 and earlier allows attackers with Overall/Read permission to connect to an (no CVSS, Jenkins project Jenkins Beaker builder Plugin · org.jenkins…)
- [CVE-2022-34207](https://cve.now/CVE-2022-34207.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Beaker builder Plugin 1.10 and earlier allows attackers to connect to an attack (no CVSS, Jenkins project Jenkins Beaker builder Plugin · org.jenkins…)
- [CVE-2022-34206](https://cve.now/CVE-2022-34206.md): A missing permission check in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers with Overall/Read permission to send HTT (no CVSS, Jenkins project Jenkins Jianliao Notification Plugin · org.…)
- [CVE-2022-34205](https://cve.now/CVE-2022-34205.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers to send HTTP POST (no CVSS, Jenkins project Jenkins Jianliao Notification Plugin · org.…)
- [CVE-2022-34204](https://cve.now/CVE-2022-34204.md): A missing permission check in Jenkins EasyQA Plugin 1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker- (no CVSS, Jenkins project Jenkins EasyQA Plugin · com.geteasyqa:easyqa)
- [CVE-2022-34203](https://cve.now/CVE-2022-34203.md): A cross-site request forgery (CSRF) vulnerability in Jenkins EasyQA Plugin 1.0 and earlier allows attackers to connect to an attacker-specif (no CVSS, Jenkins project Jenkins EasyQA Plugin · com.geteasyqa:easyqa)
- [CVE-2022-34202](https://cve.now/CVE-2022-34202.md): Jenkins EasyQA Plugin 1.0 and earlier stores user passwords unencrypted in its global configuration file on the Jenkins controller where the (no CVSS, Jenkins project Jenkins EasyQA Plugin · com.geteasyqa:easyqa)
- [CVE-2022-34201](https://cve.now/CVE-2022-34201.md): A missing permission check in Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier allows attackers with Overall/Read permission to con (no CVSS, Jenkins project Jenkins Convertigo Mobile Platform Plugin ·…)
- [CVE-2022-34200](https://cve.now/CVE-2022-34200.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier allows attackers to connect t (no CVSS, Jenkins project Jenkins Convertigo Mobile Platform Plugin ·…)
- [CVE-2022-34199](https://cve.now/CVE-2022-34199.md): Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller whe (no CVSS, Jenkins project Jenkins Convertigo Mobile Platform Plugin ·…)
- [CVE-2022-34198](https://cve.now/CVE-2022-34198.md): Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier does not escape the name and description of Stash Branch parameters on views display (no CVSS, Jenkins project Jenkins Stash Branch Parameter Plugin · org…)
- [CVE-2022-34197](https://cve.now/CVE-2022-34197.md): Jenkins Sauce OnDemand Plugin 1.204 and earlier does not escape the name and description of Sauce Labs Browsers parameters on views displayi (no CVSS, Jenkins project Jenkins Sauce OnDemand Plugin · org.jenkins…)
- [CVE-2022-34196](https://cve.now/CVE-2022-34196.md): Jenkins REST List Parameter Plugin 1.5.2 and earlier does not escape the name and description of REST list parameters on views displaying pa (no CVSS, Jenkins project Jenkins REST List Parameter Plugin · io.jen…)
- [CVE-2022-34195](https://cve.now/CVE-2022-34195.md): Jenkins Repository Connector Plugin 2.2.0 and earlier does not escape the name and description of Maven Repository Artifact parameters on vi (no CVSS, Jenkins project Jenkins Repository Connector Plugin · org.j…)
- [CVE-2022-34194](https://cve.now/CVE-2022-34194.md): Jenkins Readonly Parameter Plugin 1.0.0 and earlier does not escape the name and description of Readonly String and Readonly Text parameters (no CVSS, Jenkins project Jenkins Readonly Parameter Plugin · org.jen…)
- [CVE-2022-34193](https://cve.now/CVE-2022-34193.md): Jenkins Package Version Plugin 1.0.1 and earlier does not escape the name of Package version parameters on views displaying parameters, resu (no CVSS, Jenkins project Jenkins Package · org.lilicurroad.jenkins:p…)
- [CVE-2022-34192](https://cve.now/CVE-2022-34192.md): Jenkins ontrack Jenkins Plugin 4.0.0 and earlier does not escape the name of Ontrack: Multi Parameter choice, Ontrack: Parameter choice, and (no CVSS, Jenkins project Jenkins ontrack Jenkins Plugin · org.jenkin…)
- [CVE-2022-34191](https://cve.now/CVE-2022-34191.md): Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.77 and earlier does not escape the name of NetStorm Test parameters on views di (no CVSS, Jenkins project Jenkins NS-ND Integration Performance Publi…)
- [CVE-2022-34190](https://cve.now/CVE-2022-34190.md): Jenkins Maven Metadata Plugin for Jenkins CI server Plugin 2.1 and earlier does not escape the name and description of List maven artifact v (no CVSS, Jenkins project Jenkins Maven Metadata Plugin for Jenkins C…)
- [CVE-2022-34189](https://cve.now/CVE-2022-34189.md): Jenkins Image Tag Parameter Plugin 1.10 and earlier does not escape the name and description of Image Tag parameters on views displaying par (no CVSS, Jenkins project Jenkins Image Tag Parameter Plugin · org.je…)
- [CVE-2022-34188](https://cve.now/CVE-2022-34188.md): Jenkins Hidden Parameter Plugin 0.0.4 and earlier does not escape the name and description of Hidden Parameter parameters on views displayin (no CVSS, Jenkins project Jenkins Hidden Parameter Plugin · org.jenki…)
- [CVE-2022-34187](https://cve.now/CVE-2022-34187.md): Jenkins Filesystem List Parameter Plugin 0.0.7 and earlier does not escape the name and description of File system objects list parameters o (no CVSS, Jenkins project Jenkins Filesystem List Parameter Plugin ·…)
- [CVE-2022-34186](https://cve.now/CVE-2022-34186.md): Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape the name and description of Moded Extended Choice paramet (no CVSS, Jenkins project Jenkins Dynamic Extended Choice Parameter P…)
- [CVE-2022-34185](https://cve.now/CVE-2022-34185.md): Jenkins Date Parameter Plugin 0.0.4 and earlier does not escape the name and description of Date parameters on views displaying parameters, (no CVSS, Jenkins project Jenkins Date Parameter Plugin · me.leejay.j…)
- [CVE-2022-34184](https://cve.now/CVE-2022-34184.md): Jenkins CRX Content Package Deployer Plugin 1.9 and earlier does not escape the name and description of CRX Content Package Choice parameter (no CVSS, Jenkins project Jenkins CRX Content Package Deployer Plugin…)
- [CVE-2022-34183](https://cve.now/CVE-2022-34183.md): Jenkins Agent Server Parameter Plugin 1.1 and earlier does not escape the name and description of Agent Server parameters on views displayin (no CVSS, Jenkins project Jenkins Agent Server Parameter Plugin · io.…)
- [CVE-2022-34182](https://cve.now/CVE-2022-34182.md): Jenkins Nested View Plugin 1.20 through 1.25 (both inclusive) does not escape search parameters, resulting in a reflected cross-site scripti (no CVSS, Jenkins project Jenkins Nested View Plugin · org.jenkins-ci…)
- [CVE-2022-34181](https://cve.now/CVE-2022-34181.md): Jenkins xUnit Plugin 3.0.8 and earlier implements an agent-to-controller message that creates a user-specified directory if it doesn't exist (no CVSS, Jenkins project Jenkins xUnit Plugin · org.jenkins-ci.plugi…)
- [CVE-2022-34180](https://cve.now/CVE-2022-34180.md): Jenkins Embeddable Build Status Plugin 2.0.3 and earlier does not correctly perform the ViewStatus permission check in the HTTP endpoint it (no CVSS, Jenkins project Jenkins Embeddable Build Status Plugin · or…)
- [CVE-2022-34179](https://cve.now/CVE-2022-34179.md): Jenkins Embeddable Build Status Plugin 2.0.3 and earlier allows specifying a \`style\` query parameter that is used to choose a different SVG (no CVSS, Jenkins project Jenkins Embeddable Build Status Plugin · or…)
- [CVE-2022-34178](https://cve.now/CVE-2022-34178.md): Jenkins Embeddable Build Status Plugin 2.0.3 allows specifying a 'link' query parameter that build status badges will link to, without restr (no CVSS, Jenkins project Jenkins Embeddable Build Status Plugin · or…)
- [CVE-2022-34175](https://cve.now/CVE-2022-34175.md): Jenkins 2.335 through 2.355 (both inclusive) allows attackers in some cases to bypass a protection mechanism, thereby directly accessing som (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2022-34174](https://cve.now/CVE-2022-34174.md): In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between logi (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2022-34173](https://cve.now/CVE-2022-34173.md): In Jenkins 2.340 through 2.355 (both inclusive) the tooltip of the build button in list views supports HTML without escaping the job display (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2022-34172](https://cve.now/CVE-2022-34172.md): In Jenkins 2.340 through 2.355 (both inclusive) symbol-based icons unescape previously escaped values of 'tooltip' parameters, resulting in (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2022-34171](https://cve.now/CVE-2022-34171.md): In Jenkins 2.321 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the HTML output generated for new symbo (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2022-34170](https://cve.now/CVE-2022-34170.md): In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the featu (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2022-31787](https://cve.now/CVE-2022-31787.md): IdeaTMS 2022 is vulnerable to SQL Injection via the PATH\_INFO (no CVSS)
- [CVE-2022-34299](https://cve.now/CVE-2022-34299.md): There is a heap-based buffer over-read in libdwarf 0.4.0. (no CVSS)
- [CVE-2022-32554](https://cve.now/CVE-2022-32554.md): Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FA (no CVSS)
- [CVE-2022-32549](https://cve.now/CVE-2022-32549.md): log injection in Sling logging (no CVSS, Apache Software Foundation Apache Sling · org.apache.sli… +1)
- [CVE-2022-32552](https://cve.now/CVE-2022-32552.md): Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FA (no CVSS)
- [CVE-2022-32553](https://cve.now/CVE-2022-32553.md): Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FA (no CVSS)
- [CVE-2022-22980](https://cve.now/CVE-2022-22980.md): A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expres (no CVSS, Spring Data MongoDB · org.springframework.data:spring-data-…)
- [CVE-2021-26638](https://cve.now/CVE-2021-26638.md): Xi Smarthome wallpad authentication bypass vulnerability (CVSS 7.3, Xi S&D S&D smarthome)
- [CVE-2021-26637](https://cve.now/CVE-2021-26637.md): SiHAS Improper Authentication vulnerability (CVSS 8.8, Shina System Co. SiHAS firmware · Shina System Co. SiHAS ol…)
- [CVE-2021-26636](https://cve.now/CVE-2021-26636.md): Maxboard Remote Code Execution (CVSS 8.8, MaxBoard)
- [CVE-2022-32534](https://cve.now/CVE-2022-32534.md): OS Command Injection (CVSS 8.8, Bosch PRA-ES8P2S)
- [CVE-2022-32536](https://cve.now/CVE-2022-32536.md): Privilege Escalation (CVSS 8.8, Bosch PRA-ES8P2S)
- [CVE-2022-32535](https://cve.now/CVE-2022-32535.md): Web server runs as root (CVSS 4.8, Bosch PRA-ES8P2S)
- [CVE-2022-20651](https://cve.now/CVE-2022-20651.md): Cisco Adaptive Security Device Manager Information Disclosure Vulnerability (CVSS 5.5, Cisco Adaptive Security Device Manager)
- [CVE-2022-31395](https://cve.now/CVE-2022-31395.md): Algo Communication Products Ltd. (no CVSS)
- [CVE-2022-33034](https://cve.now/CVE-2022-33034.md): LibreDWG v0.12.4.4608 was discovered to contain a stack overflow via the function copy\_bytes at decode\_r2007.c. (no CVSS)
- [CVE-2022-33033](https://cve.now/CVE-2022-33033.md): LibreDWG v0.12.4.4608 was discovered to contain a double-free via the function dwg\_read\_file at dwg.c. (no CVSS)
- [CVE-2022-33032](https://cve.now/CVE-2022-33032.md): LibreDWG v0.12.4.4608 was discovered to contain a heap-buffer-overflow via the function decode\_preR13\_section\_hdr at decode\_r11.c. (no CVSS)
- [CVE-2022-33025](https://cve.now/CVE-2022-33025.md): LibreDWG v0.12.4.4608 was discovered to contain a heap-use-after-free via the function decode\_preR13\_section at decode\_r11.c. (no CVSS)
- [CVE-2022-33028](https://cve.now/CVE-2022-33028.md): LibreDWG v0.12.4.4608 was discovered to contain a heap buffer overflow via the function dwg\_add\_object at decode.c. (no CVSS)
- [CVE-2022-33027](https://cve.now/CVE-2022-33027.md): LibreDWG v0.12.4.4608 was discovered to contain a heap-use-after-free via the function dwg\_add\_handleref at dwg.c. (no CVSS)
- [CVE-2022-33026](https://cve.now/CVE-2022-33026.md): LibreDWG v0.12.4.4608 was discovered to contain a heap buffer overflow via the function bit\_calc\_CRC at bits.c. (no CVSS)
- [CVE-2022-33024](https://cve.now/CVE-2022-33024.md): There is an Assertion \`int decode\_preR13\_entities(BITCODE\_RL, BITCODE\_RL, unsigned int, BITCODE\_RL, BITCODE\_RL, Bit\_Chain \*, Dwg\_Data \*' fai (no CVSS)
- [CVE-2022-33070](https://cve.now/CVE-2022-33070.md): Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function parse\_tag\_and\_wiretype in protobuf-c/protobuf-c.c. (no CVSS)
- [CVE-2022-33069](https://cve.now/CVE-2022-33069.md): Ethereum Solidity v0.8.14 contains an assertion failure via SMTEncoder::indexOrMemberAssignment() at SMTEncoder.cpp. (no CVSS)
- [CVE-2022-33068](https://cve.now/CVE-2022-33068.md): An integer overflow in the component hb-ot-shape-fallback.cc of Harfbuzz v4.3.0 allows attackers to cause a Denial of Service (DoS) via unsp (no CVSS)
- [CVE-2022-33067](https://cve.now/CVE-2022-33067.md): Lrzip v0.651 was discovered to contain multiple invalid arithmetic shifts via the functions get\_magic in lrzip.c and Predictor::init in libz (no CVSS)
- [CVE-2022-34298](https://cve.now/CVE-2022-34298.md): The NT auth module in OpenAM before 14.6.6 allows a "replace Samba username attack." (no CVSS, org.openidentityplatform.openam:openam-core)
- [CVE-2022-29526](https://cve.now/CVE-2022-29526.md): Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. (no CVSS, golang.org/x/sys · stdlib)
- [CVE-2022-33105](https://cve.now/CVE-2022-33105.md): Redis v7.0 was discovered to contain a memory leak via the component streamGetEdgeID. (no CVSS)
- [CVE-2022-23079](https://cve.now/CVE-2022-23079.md): motoradmin - host header Injection in the reset password functionality (no CVSS, motor-admin)
- [CVE-2022-34296](https://cve.now/CVE-2022-34296.md): In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request. (no CVSS, github.com/zalando/skipper)
- [CVE-2022-2174](https://cve.now/CVE-2022-2174.md): Cross-site Scripting (XSS) - Reflected in microweber/microweber (CVSS 6.5, microweber/microweber)
- [CVE-2022-23078](https://cve.now/CVE-2022-23078.md): Habitica - Open redirect in login page (no CVSS, habitica)
- [CVE-2022-23077](https://cve.now/CVE-2022-23077.md): Habitica - DOM XSS in login page (no CVSS, habitica)
- [CVE-2022-31248](https://cve.now/CVE-2022-31248.md): SUMA user enumeration via weak error message (CVSS 5.3, SUSE Manager Server)
- [CVE-2022-21952](https://cve.now/CVE-2022-21952.md): SUMA unauthenticated remote DoS via resource exhaustion (CVSS 7.5, SUSE Manager Server)
- [CVE-2022-23055](https://cve.now/CVE-2022-23055.md): ERPNext - Improper user access conrol (no CVSS, frappe)
- [CVE-2022-23058](https://cve.now/CVE-2022-23058.md): ERPNext - Stored XSS in My Settings (no CVSS, frappe)
- [CVE-2022-23056](https://cve.now/CVE-2022-23056.md): ERPNext - Stored XSS leads to account takover (no CVSS, erpnext)
- [CVE-2022-23057](https://cve.now/CVE-2022-23057.md): ERPNext - Stored XSS in My Profile (no CVSS, frappe)
- [CVE-2017-20084](https://cve.now/CVE-2017-20084.md): JUNG Smart Visu Server KNX Group Address backdoor (CVSS 5.3, JUNG Smart Visu Server)
- [CVE-2017-20083](https://cve.now/CVE-2017-20083.md): JUNG Smart Visu Server SSH Server backdoor (CVSS 5.3, JUNG Smart Visu Server)
- [CVE-2017-20082](https://cve.now/CVE-2017-20082.md): JUNG Smart Visu Server backdoor (CVSS 5.5, JUNG Smart Visu Server)
- [CVE-2022-22967](https://cve.now/CVE-2022-22967.md): An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. (CVSS 8.8, SaltStack Salt · salt)
- [CVE-2022-34176](https://cve.now/CVE-2022-34176.md): Jenkins JUnit Plugin 1119.va\_a\_5e9068da\_d7 and earlier does not escape descriptions of test results, resulting in a stored cross-site script (no CVSS, Jenkins project Jenkins JUnit Plugin · org.jenkins-ci.plugi…)
- [CVE-2022-34177](https://cve.now/CVE-2022-34177.md): Jenkins Pipeline: Input Step Plugin 448.v37cea\_9a\_10a\_70 and earlier archives files uploaded for \`file\` parameters for Pipeline \`input\` step (no CVSS, Jenkins project Jenkins Pipeline: Input Step Plugin · org.j…)
- [CVE-2022-34300](https://cve.now/CVE-2022-34300.md): In tinyexr 1.0.1, there is a heap-based buffer over-read in tinyexr::DecodePixelData. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-06-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.