CVEs published June 24, 2022
135 CVEs were published on June 24, 2022: 13 critical, 14 high.
- Published
- 135
- Critical
- 13
- High
- 14
- Medium
- 34
- Low
- 6
- Unrated
- 68
- Now in CISA KEV
- 0
- Fix available
- 39
Most affected products
- CODESYS Runtime Toolkit · CODESYS PLCWinNT
- 9
- IBM Jazz Team Server
- 8
- Secheron SEPCOS Control and Protection Relay firmware packa…
- 7
- Dominion Voting Systems ImageCast X application · Dominion…
- 5
- Illumina NextSeq 550Dx · Illumina MiSeq Dx +5
- 5
- CODESYS Gateway Server
- 3
- https://github.com/concrete5/concrete5 · concrete5/core
- 3
- IBM Cognos Analytics
- 3
- OFFIS DCMTK
- 3
- Dell Wyse Management Suite
- 2
Critical 13
- CVE-2022-31767IBM CICS TX Standard and Advanced 11.1 could allow a remote attacker to execute arbitrary commands on the system by sending a specially crafIBM CICS TX Advanced · IBM CICS TX Standard
- CVE-2022-20829Cisco Adaptive Security Device Manager and Adaptive Security Appliance Software Client-side Arbitrary Code Execution VulnerabilityCisco Adaptive Security Appliance (ASA) Software
- CVE-2022-2102Secheron SEPCOS Control and Protection RelaySecheron SEPCOS Control and Protection Relay firmware packa…
- CVE-2022-1668Secheron SEPCOS Control and Protection RelaySecheron SEPCOS Control and Protection Relay firmware packa…
- CVE-2022-2105Secheron SEPCOS Control and Protection RelaySecheron SEPCOS Control and Protection Relay firmware packa…
- CVE-2022-2104Secheron SEPCOS Control and Protection RelaySecheron SEPCOS Control and Protection Relay firmware packa…
- CVE-2022-2103Secheron SEPCOS Control and Protection RelaySecheron SEPCOS Control and Protection Relay firmware packa…
- CVE-2022-15213.2.4 IMPROPER ACCESS CONTROL CWE-284Illumina NextSeq 550Dx · Illumina MiSeq Dx +5
- CVE-2022-15183.2.2 IMPROPER LIMITATION OF A PATHNAME TO A RESTRICTED DIRECTORY ('PATH TRAVERSAL') CWE-22Illumina NextSeq 550Dx · Illumina MiSeq Dx +5
- CVE-2022-1519LRM does not restrict the types of files that can be uploaded to the affected product.Illumina NextSeq 550Dx · Illumina MiSeq Dx +5
- CVE-2022-15173.2.1 EXECUTION WITH UNNECESSARY PRIVILEGES CWE-250Illumina NextSeq 550Dx · Illumina MiSeq Dx +5
- CVE-2022-31806Insecure default settings in CODESYS Runtime Toolkit 32 bit full and CODESYS PLCWinNTCODESYS PLCWinNT · CODESYS Runtime Toolkit 32 bit full
- CVE-2022-31802Partial string comparison in CODESYS gateway serverCODESYS Gateway Server
High 14
- CVE-2022-21231Prototype Pollutiondeep-get-set
- CVE-2022-1667Secheron SEPCOS Control and Protection RelaySecheron SEPCOS Control and Protection Relay firmware packa…
- CVE-2022-17462.2.8 INCORRECT PRIVILEGE ASSIGNMENT CWE-266Dominion Voting Systems ImageCast X application · Dominion…
- CVE-2022-2119OFFIS DCMTK Path TraversalOFFIS DCMTK
- CVE-2022-2121OFFIS DCMTK NULL Pointer DereferenceOFFIS DCMTK
- CVE-2022-2120OFFIS DCMTK Path TraversalOFFIS DCMTK
- CVE-2022-15243.2.5 CLEARTEXT TRANSMISSION OF SENSITIVE INFORMATION CWE-319Illumina NextSeq 550Dx · Illumina MiSeq Dx +5
- CVE-2022-32143CODESYS runtime system prone to directory accesCODESYS Runtime Toolkit · CODESYS PLCWinNT
- CVE-2022-32142CODESYS runtime system prone to denial of service due to use of out of range pointerCODESYS Runtime Toolkit · CODESYS PLCWinNT
- CVE-2022-32138CODESYS runtime system prone to denial of service due to Unexpected Sign ExtensionCODESYS Runtime Toolkit · CODESYS PLCWinNT
- CVE-2022-32137CODESYS Runtime System prone to heap based buffer overflowCODESYS Runtime Toolkit · CODESYS PLCWinNT
- CVE-2022-31805Insecure transmission of credentialsCODESYS Development System · CODESYS Gateway Client +10
- CVE-2022-31804CODESYS Gateway server prone to denial of service attack due to excessive memory allocationCODESYS Gateway Server
- CVE-2022-1965CODESYS runtime system prone to file deletion due to improper error handlingCODESYS Runtime Toolkit · CODESYS PLCWinNT
Medium, low and unrated 108
- CVE-2021-40894A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in underscore-99xp v1.7.2 when the deepValueSearch function is c
- CVE-2022-33122A stored cross-site scripting (XSS) vulnerability in eyoucms v1.5.6 allows attackers to execute arbitrary web scripts or HTML via a crafted
- CVE-2022-33121A Cross-Site Request Forgery (CSRF) in MiniCMS v1.11 allows attackers to arbitrarily delete local .dat files via clicking on a malicious lin
- CVE-2022-30885The pyesasky for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party.pyesasky
- CVE-2022-34066The Texercise package in PyPI v0.0.1 to v0.0.12 was discovered to contain a code execution backdoor.
- CVE-2022-34065The Rondolu-YT-Concate package in PyPI v0.1.0 was discovered to contain a code execution backdoor.
- CVE-2022-34061The Catly-Translate package in PyPI v0.0.3 to v0.0.5 was discovered to contain a code execution backdoor.catly-translate
- CVE-2022-34064The Zibal package in PyPI v1.0.0 was discovered to contain a code execution backdoor.
- CVE-2022-34060The Togglee package in PyPI version v0.0.8 was discovered to contain a code execution backdoor.
- CVE-2022-34059The Sixfab-Tool in PyPI v0.0.2 to v0.0.3 was discovered to contain a code execution backdoor via the request package.
- CVE-2022-34056The Watertools package in PyPI v0.0.0 was discovered to contain a code execution backdoor via the request package.
- CVE-2022-34057The Scoptrial package in PyPI version v0.0.5 was discovered to contain a code execution backdoor via the request package.
- CVE-2022-34054The Perdido package in PyPI v0.0.1 to v0.0.2 was discovered to contain a code execution backdoor via the request package.perdido
- CVE-2022-34055The drxhello package in PyPI v0.0.1 was discovered to contain a code execution backdoor via the request package.
- CVE-2022-34053The DR-Web-Engine package in PyPI v0.2.0b0 was discovered to contain a code execution backdoor via the request package.
- CVE-2022-33004The Beginner package in PyPI v0.0.2 to v0.0.4 was discovered to contain a code execution backdoor via the request package.beginner
- CVE-2022-33002The KGExplore package in PyPI v0.1.1 to v0.1.2 was discovered to contain a code execution backdoor via the request package.
- CVE-2022-33003The watools package in PyPI v0.0.1 to v0.0.8 was discovered to contain a code execution backdoor via the request package.
- CVE-2022-33000The ML-Scanner package in PyPI v0.1.0 to v0.1.5 was discovered to contain a code execution backdoor via the request package.ml-scanner
- CVE-2022-33001The AAmiles package in PyPI v0.1.0 was discovered to contain a code execution backdoor via the request package.
- CVE-2022-32998The cryptoasset-data-downloader package in PyPI v1.0.0 to v1.0.1 was discovered to contain a code execution backdoor via the request packagecryptoasset-data-downloader
- CVE-2022-32999The cloudlabeling package in PyPI v0.0.1 was discovered to contain a code execution backdoor via the request package.
- CVE-2022-32997The RootInteractive package in PyPI v0.0.5 to v0.0.19b0 was discovered to contain a code execution backdoor via the request package.rootinteractive
- CVE-2022-32996The django-navbar-client package of v0.9.50 to v1.0.1 was discovered to contain a code execution backdoor via the request package.django-navbar-client
- CVE-2022-29097Dell WMS 3.6.1 and below contains a Path Traversal vulnerability in Device API.Dell Wyse Management Suite
- CVE-2022-29096Dell Wyse Management Suite 3.6.1 and below contains a Reflected Cross-Site Scripting Vulnerability in saveGroupConfigurations page.Dell Wyse Management Suite
- CVE-2022-33910An XSS vulnerability in MantisBT before 2.25.5 allows remote attackers to attach crafted SVG documents to issue reports or bugnotes.mantisbt/mantisbt
- CVE-2022-22390IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 may be vulnerable to an information disclosure caused by improper privilIBM DB2 for Linux, UNIX and Windows
- CVE-2022-22389IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may terminate abnormaIBM DB2 for Linux, UNIX and Windows
- CVE-2022-29578Meridian Cooperative Utility Software versions 22.02 and 22.03 allows remote attackers to obtain sensitive information such as name, address
- CVE-2022-30028Dradis Professional Edition before 4.3.0 allows attackers to change an account password via reusing a password reset token.
- CVE-2021-39409A vulnerability exists in Online Student Rate System v1.0 that allows any user to register as an administrator without needing to be authent
- CVE-2021-39408Cross Site Scripting (XSS) vulnerability exists in Online Student Rate System 1.0 via the page parameter on the index.php file
- CVE-2021-38879IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to obtain sensitive information, caused by the failIBM Jazz Team Server
- CVE-2021-38871IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting.IBM Jazz Team Server
- CVE-2021-29865IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to hijack the clicking action of the victim.IBM Jazz Team Server
- CVE-2021-20551IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 allows web pages to be stored locally which can be read by another user on the syIBM Jazz Team Server
- CVE-2021-20544IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to server-side request forgery (SSRF).IBM Jazz Team Server
- CVE-2021-20543IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to HTML injection.IBM Jazz Team Server
- CVE-2021-20421IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to server-side request forgery (SSRF).IBM Jazz Team Server
- CVE-2021-20355IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to obtain sensitive information, caused by the failIBM Jazz Team Server
- CVE-2021-42056Thales Safenet Authentication Client (SAC) for Linux and Windows through 10.7.7 creates insecure temporary hid and lock files allowing a loc
- CVE-2021-40893A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in validate-data v0.1.1 when validating crafted invalid emails.
- CVE-2022-33953IBM Robotic Process Automation 21.0.1 and 21.0.2 could allow a user with psychical access to the system to obtain sensitive information due IBM Robotic Process Automation
- CVE-2022-22502IBM Robotic Process Automation 21.0.1 and 21.0.2 is vulnerable to cross-site scripting.IBM Robotic Process Automation
- CVE-2021-39047IBM Planning Analytics 2.0 and IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 are vulnerable to cross-site scripting.IBM Cognos Analytics
- CVE-2021-38945IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 could allow a remote attacker to upload arbitrary files, caused by improper content validatiIBM Cognos Analytics
- CVE-2021-29768IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a low level user to obtain sensitive information from the details of the 'Cloud IBM Cognos Analytics
- CVE-2022-20828Cisco FirePOWER Software for ASA FirePOWER Module Command Injection VulnerabilityCisco FirePOWER Services Software for ASA
- CVE-2022-29330Missing access control in the backup system of Telesoft VitalPBX before 3.2.1 allows attackers to access the PJSIP and SIP extension credent
- CVE-2022-27238BigBlueButton version 2.4.7 (or earlier) is vulnerable to stored Cross-Site Scripting (XSS) in the private chat functionality.
- CVE-2020-21046A local privilege escalation vulnerability was identified within the "luminati_net_updater_win_eagleget_com" service in EagleGet Downloader
- CVE-2022-1666Secheron SEPCOS Control and Protection RelaySecheron SEPCOS Control and Protection Relay firmware packa…
- CVE-2022-17452.2.7 AUTHENTICATION BYPASS BY SPOOFING CWE-290Dominion Voting Systems ImageCast X application · Dominion…
- CVE-2022-17402.2.2 MUTABLE ATTESTATION OR MEASUREMENT REPORTING DATA CWE-1283Dominion Voting Systems ImageCast X application · Dominion…
- CVE-2022-17422.2.4 IMPROPER PROTECTION OF ALTERNATE PATH CWE-424Dominion Voting Systems ImageCast X application · Dominion…
- CVE-2022-17432.2.5 PATH TRAVERSAL: '../FILEDIR' CWE-24Dominion Voting System ImageCast X application · Dominion V…
- CVE-2022-17412.2.3 HIDDEN FUNCTIONALITY CWE-912Dominion Voting Systems ImageCast X application · Dominion…
- CVE-2022-17442.2.6 EXECUTION WITH UNNECESSARY PRIVILEGES CWE-250Dominion Voting System ImageCast X application · Dominion V…
- CVE-2022-1747The authentication mechanism used by voters to activate a voting session on the tested version of Dominion Voting Systems ImageCast X is susDominion Voting Systems ImageCast X firmware · Dominion Vot…
- CVE-2022-17392.2.1 IMPROPER VERIFICATION OF CRYPTOGRAPHIC SIGNATURE CWE-347Dominion Voting Systems ImageCast X firmware · Dominion Vot…
- CVE-2013-1891In OpenCart 1.4.7 to 1.5.5.1, implemented anti-traversal code in filemanager.php is ineffective and can be bypassed.opencart
- CVE-2013-1916In WordPress Plugin User Photo 0.9.4, when a photo is uploaded, it is only partially validated and it is possible to upload a backdoor on thWordPress Plugin User Photo
- CVE-2021-30651A malicious authenticated SMG administrator user can obtain passwords for external LDAP/Active Directory servers that they might not otherwiSymantec Messaging Gateway
- CVE-2022-23170SysAid - Okta SSO integrationSysAid - Okta SSO integration
- CVE-2022-28620A remote authentication bypass vulnerability was discovered in HPE Cray Legacy Shasta System Solutions; HPE Slingshot; and HPE Cray EX superCray Legacy Shasta System Solutions; HPE Slingshot; HPE Cra…
- CVE-2022-28619A potential security vulnerability has been identified in the installer of HPE Version Control Repository Manager.HPE
- CVE-2022-30118Title for CVE: XSS in /dashboard/system/express/entities/forms/save_control/[GUID]: old browsers only.Description: When using Internet Explohttps://github.com/concrete5/concrete5
- CVE-2022-30120XSS in /dashboard/blocks/stacks/view_details/ - old browsers only.https://github.com/concrete5/concrete5 · concrete5/core
- CVE-2022-21829Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which chttps://github.com/concrete5/concrete5 · concrete5/core
- CVE-2022-30117Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload which could result in anhttps://github.com/concrete5/concrete5 · concrete5/core
- CVE-2022-30119XSS in /dashboard/reports/logs/view - old browsers only.https://github.com/concrete5/concrete5
- CVE-2021-40892A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in validate-color v2.1.0 when handling crafted invalid rgb(a) st
- CVE-2022-32990An issue in gimp_layer_invalidate_boundary of GNOME GIMP 2.10.30 allows attackers to trigger an unhandled exception via a crafted XCF file,
- CVE-2022-32530A CWE-668 Exposure of Resource to Wrong Sphere vulnerability exists that could cause users to be misled, hiding alarms, showing the wrong seSchneider Electric Geo SCADA Mobile
- CVE-2021-41634A user enumeration vulnerability in MELAG FTP Server 2.2.0.4 allows an attacker to identify valid FTP usernames.
- CVE-2021-41635When installed as Windows service MELAG FTP Server 2.2.0.4 is run as SYSTEM user, which grants remote attackers to abuse misconfigurations o
- CVE-2021-41636MELAG FTP Server 2.2.0.4 allows an attacker to use the CWD command to break out of the FTP servers root directory and operate on the entire
- CVE-2021-41637Weak access control permissions in MELAG FTP Server 2.2.0.4 allow the "Everyone" group to read the local FTP configuration file, which inclu
- CVE-2021-41638The authentication checks of the MELAG FTP Server in version 2.2.0.4 are incomplete, which allows a remote attacker to access local files on
- CVE-2021-41639MELAG FTP Server 2.2.0.4 stores unencrpyted passwords of FTP users in a local configuration file.
- CVE-2022-32141CODESYS runtime system prone to denial of service due to buffer over readCODESYS Runtime Toolkit · CODESYS PLCWinNT
- CVE-2022-32140CODESYS runtime system prone to denial of service due to buffer copyCODESYS Runtime Toolkit · CODESYS PLCWinNT
- CVE-2022-32139CODESYS runtime system prone to denial of service due to out of bounds readCODESYS Runtime Toolkit · CODESYS PLCWinNT
- CVE-2022-32136Codesys runtime systems: Access of uninitialised pointer lead to denial of service.CODESYS Runtime Toolkit · CODESYS PLCWinNT
- CVE-2022-31803CODESYS Gateway Server V2 prone to Denial of Service AttackCODESYS Gateway Server
- CVE-2017-20097WP-Filebase Download Manager Plugin cross site scritingWP-Filebase Download Manager Plugin
- CVE-2017-20096WP-SpamFree Anti-Spam Plugin cross site scritingWP-SpamFree Anti-Spam Plugin
- CVE-2017-20095Simple Ads Manager Plugin code injectionSimple Ads Manager Plugin
- CVE-2017-20094NewStatPress Plugin Persistent cross site scritingNewStatPress Plugin
- CVE-2017-20093Download Manager Plugin cross-site request forgeryDownload Manager Plugin
- CVE-2017-20092Google Analytics Dashboard Plugin cross site scritingGoogle Analytics Dashboard Plugin
- CVE-2022-32405Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/prisons/view_pris
- CVE-2022-32404Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/inmates/manage_in
- CVE-2022-32403Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/inmates/manage_re
- CVE-2022-32402Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/prisons/manage_pr
- CVE-2022-32401Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/inmates/manage_pr
- CVE-2022-32400Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/user/manage_user.
- CVE-2022-32399Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/crimes/view_crime
- CVE-2022-32398Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/cells/manage_cell
- CVE-2022-32397Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/visits/view_visit
- CVE-2022-32396Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/visits/manage_vis
- CVE-2022-32395Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/crimes/manage_cri
- CVE-2022-32394Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/inmates/view_inma
- CVE-2022-32393Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/cells/view_cell.p
- CVE-2022-32392Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/actions/manage_ac
- CVE-2022-32391Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/actions/view_acti
- CVE-2022-32209# Possible XSS Vulnerability in Rails::Html::SanitizerThere is a possible XSS vulnerability with certain configurations of Rails::Html::Sanihttps://github.com/rails/rails-html-sanitizer · rails-html-…