CVEs published June 27, 2022
129 CVEs were published on June 27, 2022: 6 critical, 17 high.
- Published
- 129
- Critical
- 6
- High
- 17
- Medium
- 22
- Low
- 5
- Unrated
- 79
- Now in CISA KEV
- 0
- Fix available
- 72
Most affected products
- openEuler:mindspore
- 8
- LDAPAccountManager lam
- 5
- ionicabizau/parse-url · parse-url
- 4
- argoproj argo-cd · github.com/argoproj/argo-cd +1
- 3
- Brocade SANnav
- 3
- Elcomplus SmartICS
- 3
- HTML2WP
- 3
- SourceCodester Library Management System
- 3
- vim/vim
- 3
- bigbluebutton
- 2
Critical 6
- CVE-2022-31098Weave GitOps leaked cluster credentials into logs on connection errorsweaveworks weave-gitops · github.com/weaveworks/weave-gitops
- CVE-2022-31084Unauthenticated Remote Code Execution in ldap-account-managerLDAPAccountManager lam
- CVE-2022-31035External URLs for Deployments can include javascript in argo-cdargoproj argo-cd · github.com/argoproj/argo-cd +1
- CVE-2022-2216Server-Side Request Forgery (SSRF) in ionicabizau/parse-urlionicabizau/parse-url · parse-url
- CVE-2022-2218Cross-site Scripting (XSS) - Stored in ionicabizau/parse-urlionicabizau/parse-url · parse-url
- CVE-2022-2217Cross-site Scripting (XSS) - Generic in ionicabizau/parse-urlionicabizau/parse-url · parse-url
High 17
- CVE-2022-31103Improper handling of CSS at-rules in lettersanitizermat-sz lettersanitizer · lettersanitizer
- CVE-2022-31101SQL Injection in prestashop/blockwishlistPrestaShop blockwishlist · prestashop/blockwishlist
- CVE-2022-31093Improper Handling of `callbackUrl` parameter in next-authnextauthjs next-auth · next-auth
- CVE-2022-31092SQL injection in pimcorepimcore · pimcore/pimcore
- CVE-2022-31089Invalid file request can crashe parse-serverparse-community parse-server · parse-server
- CVE-2022-31094Cross site scripting vulnerability in ScratchToolsSTForScratch ScratchTools
- CVE-2022-31087Incorrect Default Permissions in ldap-account-managerLDAPAccountManager lam
- CVE-2022-31034Insecure entropy in argo-cdargoproj argo-cd · github.com/argoproj/argo-cd +1
- CVE-2017-20099Analytics Stats Counter Statistics Plugin code injectionAnalytics Stats Counter Statistics Plugin
- CVE-2022-28171The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability.hikvision DS-A71024/48/72R,DS-A80624S,DS-A81016S,DS-A72024/…
- CVE-2022-2140Elcomplus SmartICS Cross-site ScriptingElcomplus SmartICS
- CVE-2022-2207Heap-based Buffer Overflow in vim/vimvim/vim
- CVE-2022-2208NULL Pointer Dereference in vim/vimvim/vim
- CVE-2022-2210Out-of-bounds Write in vim/vimvim/vim
- CVE-2022-31081Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in HTTP::Daemonlibwww-perl HTTP-Daemon
- CVE-2022-31090CURLOPT_HTTPAUTH option not cleared on change of origin in Guzzleguzzle · guzzlehttp/guzzle
- CVE-2022-31091Change in port should be considered a change in origin in Guzzleguzzle · guzzlehttp/guzzle
Medium, low and unrated 106
- CVE-2022-31104Miscompilation of `i8x16.swizzle` and `select` with v128 inputs in Wasmtimebytecodealliance wasmtime · wasmtime +1
- CVE-2022-34132Jorani v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at application/controllers/Leaves.php.
- CVE-2022-34133Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Comment parameter at application/controllers/Leaves
- CVE-2022-34134Jorani v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /application/controllers/Users.php.
- CVE-2022-33009A stored cross-site scripting (XSS) vulnerability in LightCMS v1.3.11 allows attackers to execute arbitrary web scripts or HTML via uploadin
- CVE-2022-32995Halo CMS v1.5.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the template remote download function.
- CVE-2022-32994Halo CMS v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the component /api/admin/attachments/upload.
- CVE-2022-31099Uncontrolled Recursion in rulexrulex-rs rulex · rulex
- CVE-2022-31100Reachable Assertion in rulexrulex-rs rulex · rulex
- CVE-2017-20103Kama Click Counter Plugin admin.php Blind sql injectionKama Click Counter Plugin
- CVE-2022-33879Incomplete fix and new regex DoS in StandardsExtractingContentHandlerApache Software Foundation Apache Tika · org.apache.tika:ti…
- CVE-2022-32092D-Link DIR-645 v1.03 was discovered to contain a command injection vulnerability via the QUERY_STRING parameter at __ajax_explorer.sgi.
- CVE-2022-33007TRENDnet Wi-Fi routers TEW751DR v1.03 and TEW-752DRU v1.03 were discovered to contain a stack overflow via the function genacgi_main.
- CVE-2022-31096Invites restricted to an email or invite links restricted to an email domain may be bypassed by a under certain conditions in Discoursediscourse
- CVE-2022-33005A cross-site scripting (XSS) vulnerability in the System Settings/IOT Settings module of Delta Electronics DIAEnergie v1.08.00 allows attack
- CVE-2022-31085Missing Encryption of Sensitive Data in ldap-account-managerLDAPAccountManager lam
- CVE-2022-31086Incorrect Regular Expressions in ldap-account-managerLDAPAccountManager lam
- CVE-2022-31088Unauthenticated LDAP Injection in ldap-account-managerLDAPAccountManager lam
- CVE-2022-33116An issue in the jmpath variable in /modules/mindmap/index.php of GUnet Open eClass Platform (aka openeclass) v3.12.4 and below allows attack
- CVE-2022-31082SQL Injection via package deployment tasks in glpi-inventory-pluginglpi-project glpi-inventory-plugin
- CVE-2021-40942In GPAC MP4Box v1.1.0, there is a heap-buffer-overflow in the function filter_parse_dyn_args function in filter_core/filter.c:1454, as demon
- CVE-2022-31077Malicious response from KubeEdge can crash CSI Driver controller serverkubeedge · github.com/kubeedge/kubeedge
- CVE-2022-31076Malicious Message can crash CloudCore in KubeEdgekubeedge · github.com/kubeedge/kubeedge
- CVE-2022-31064Cross site scripting in username that will trigger by sending chatbigbluebutton
- CVE-2022-31065Cross site scripting vulnerability for private chat in bigbluebuttonbigbluebutton
- CVE-2022-31057Authenticated Stored XSS in Shopware Administrationshopware · shopware/shopware
- CVE-2022-31039Improper privilege management - Anyone can view room settings in GreenLightbigbluebutton greenlight
- CVE-2022-31036Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-serverargoproj argo-cd · github.com/argoproj/argo-cd +1
- CVE-2022-28622A potential security vulnerability has been identified in HPE StoreOnce Software.HPE StoreOnce Software
- CVE-2022-2221Information Exposure vulnerability in My Account Settings of Devolutions Remote Desktop Manager before 2022.1.8 allows authenticated users tDevolutions Remote Desktop Manager
- CVE-2017-20098Admin Custom Login Plugin Persistent cross site scriptingAdmin Custom Login Plugin
- CVE-2022-28168In Brocade SANnav before Brocade SANnav v2.2.0.2 and Brocade SANnav2.1.1.8, encoded scp-server passwords are stored using Base64 encoding, wBrocade SANnav
- CVE-2022-28167Brocade SANnav before Brocade SANvav v.Brocade SANnav
- CVE-2022-28166In Brocade SANnav version before SANN2.2.0.2 and Brocade SANNav before 2.1.1.8, the implementation of TLS/SSL Server Supports the Use of StaBrocade SANnav
- CVE-2022-28172The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability.hikvision DS-A71024/48/72R,DS-A80624S,DS-A81016S,DS-A72024/…
- CVE-2021-40941In Bento4 1.6.0-638, there is an allocator is out of memory in the function AP4_Array<AP4_TrunAtom::Entry>::EnsureCapacity in Ap4Array.h:172
- CVE-2022-26477Denial of service in readExternal methodApache Software Foundation Apache SystemDS · org.apache.… +1
- CVE-2021-33654When performing the initialization operation of the Split operator, if a dimension in the input shape is 0, it will cause a division by 0 exopenEuler:mindspore
- CVE-2021-33653When performing the derivation shape operation of the SpaceToBatch operator, if there is a value of 0 in the parameter block_shape element, openEuler:mindspore
- CVE-2021-33650When performing the inference shape operation of the SparseToDense operator, if the number of inputs is less than three, it will access dataopenEuler:mindspore
- CVE-2021-33651When performing the analytical operation of the DepthwiseConv2D operator, if the attribute depth_multiplier is 0, it will cause a division bopenEuler:mindspore
- CVE-2021-33652When the Reduce operator run operation is executed, if there is a value of 0 in the parameter axis_sizes element, it will cause a division bopenEuler:mindspore
- CVE-2021-33649When performing the inference shape operation of the Transpose operator, if the value in the perm element is greater than or equal to the siopenEuler:mindspore
- CVE-2021-33647When performing the inference shape operation of the Tile operator, if the input data type is not int or int32, it will access data outside openEuler:mindspore
- CVE-2021-33648When performing the inference shape operation of Affine, Concat, MatMul, ArgMinMax, EmbeddingLookup, and Gather operators, if the input shapopenEuler:mindspore
- CVE-2022-2106Elcomplus SmartICS Path TraversalElcomplus SmartICS
- CVE-2022-2088Elcomplus SmartICS Access ControlElcomplus SmartICS
- CVE-2020-21161Cross Site Scripting (XSS) vulnerability in Ruckus Wireless ZoneDirector 9.8.3.0.
- CVE-2017-20102Album Lock getImage path traversalAlbum Lock
- CVE-2017-20101ProjectSend information disclosureProjectSend
- CVE-2017-20100Air Transfer cross site scriptingAir Transfer
- CVE-2021-40901A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in scniro-validator v1.0.1 when validating crafted invalid email
- CVE-2021-40900A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in regexfn v1.0.5 when validating crafted invalid emails.
- CVE-2021-40899A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in repo-git-downloader v0.1.1 when downloading crafted invalid g
- CVE-2022-0722Exposure of Sensitive Information to an Unauthorized Actor in ionicabizau/parse-urlionicabizau/parse-url · parse-url
- CVE-2021-40898A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in scaffold-helper v1.2.0 when copying crafted invalid files.
- CVE-2021-40897A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in split-html-to-chars v1.0.5 when splitting crafted invalid htm
- CVE-2021-40896A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in that-value v0.1.3 when validating crafted invalid emails.
- CVE-2021-40895A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in todo-regex v0.1.1 when matching crafted invalid TODO statemen
- CVE-2022-2041Brizy Page Builder < 2.4.2 - Contributor+ Stored Cross-Site Scripting via Element ContentBrizy – Page Builder
- CVE-2022-2040Brizy Page Builder < 2.4.2 - Contributor+ Stored Cross-Site Scripting via Element URLBrizy – Page Builder
- CVE-2022-1995miniOrange's Malware Scanner < 4.5.2 - Admin+ Stored Cross-Site ScriptingMalware Scanner
- CVE-2022-1994Google Authenticator < 1.0.8 - Admin+ Stored Cross-Site ScriptingLogin With OTP Over SMS, Email, WhatsApp and Google Authent…
- CVE-2022-1990Nested Pages < 3.1.21 - Admin+ Stored Cross Site ScriptingNested Pages
- CVE-2022-1977WP Ultimate CSV Importer < 6.5.3 - Admin+ Blind SSRFImport Export All WordPress Images, Users & Post Types
- CVE-2022-1971NextCellent Gallery <= 1.9.35 - Admin+ Stored XSSNextCellent Gallery – NextGEN Legacy
- CVE-2022-1964Easy SVG Support < 3.3.0 - Author+ Stored Cross Site Scripting via SVGEasy SVG Support
- CVE-2022-1960MyCSS <= 1.1 - Arbitrary Settings Update via CSRFMyCSS
- CVE-2022-1953Product Configurator for WooCommerce < 1.2.32 - Unauthenticated Arbitrary File DeletionProduct Configurator for WooCommerce
- CVE-2022-1916Active Products Tables for WooCommerce < 1.0.5 - Reflected Cross-Site-ScriptingActive Products Tables for WooCommerce. Professional produc…
- CVE-2022-1914Clean-Contact <= 1.6 - Arbitrary Settings Update to Stored XSS via CSRFClean-Contact
- CVE-2022-1913Add Post URL <= 2.1.0 - Arbitrary Settings Update to Stored XSS via CSRFAdd Post URL
- CVE-2022-1904Easy Pricing Tables < 3.2.1 - Reflected Cross-Site-ScriptingPricing Tables WordPress Plugin – Easy Pricing Tables
- CVE-2022-1903ARMember < 3.4.8 - Unauthenticated Admin Account TakeoverARMember – Membership Plugin, Content Restriction, Member L…
- CVE-2022-1885Cimy Header Image Rotator <= 6.1.1 - Arbitrary Settings Update via CSRFCimy Header Image Rotator
- CVE-2022-1847Rotating Posts <= 1.11 - Arbitrary Settings Update to Stored XSS via CSRFRotating Posts
- CVE-2022-1846Tiny Contact Form <= 0.7 - Arbitrary Settings Update via CSRFTiny Contact Form
- CVE-2022-1845WP Post Styling < 1.3.1 - Multiple CSRFWP Post Styling
- CVE-2022-1844WP Sentry <= 1.0 - Arbitrary Settings Update to Stored XSS via CSRFWP Sentry
- CVE-2022-1843MailPress <= 7.2.1 - Arbitrary Settings Update & Log Files Purge via CSRFMailPress
- CVE-2022-1842OpenBook Book Data <= 3.5.2 - Arbitrary Settings Update to Stored XSS via CSRFOpenBook Book Data
- CVE-2022-1776Icegram < 2.1.8 - Contributor+ Stored Cross-Site ScriptingPopups, Welcome Bar, Optins and Lead Generation Plugin – Ic…
- CVE-2022-1653Social Share Buttons by Supsystic < 2.2.4 - Multiple CSRFSocial Share Buttons by Supsystic
- CVE-2022-1627My Private Site < 3.0.8 - Arbitrary Settings Update via CSRFMy Private Site
- CVE-2022-1625New User Approve < 2.4 - Arbitrary Settings Update & Invitation Code Creation via CSRFNew User Approve
- CVE-2022-1593Site Offline or Coming Soon <= 1.6.6 - Stored Cross-Site Scripting via CSRFSite Offline or Coming Soon
- CVE-2022-1574HTML2WP <= 1.0.0 - Unauthenticated Arbitrary File UploadHTML2WP
- CVE-2022-1573HTML2WP <= 1.0.0 - Arbitrary Settings Update via CSRFHTML2WP
- CVE-2022-1572HTML2WP <= 1.0.0 - Subscriber+ Arbitrary File DeletionHTML2WP
- CVE-2022-1470Ultimate WooCommerce CSV Importer <= 2.0 - Reflected Cross-Site ScriptingUltimate WooCommerce CSV Importer
- CVE-2022-1327Image Gallery - Grid Gallery < 1.1.6 - Admin+ Stored Cross-Site ScriptingImage Gallery – Grid Gallery
- CVE-2022-1326Form - Contact Form <= 1.2.0 - Admin+ Stored Cross-Site ScriptingForm – Contact Form
- CVE-2022-1321miniOrange's Google Authenticator < 5.5.6 - Admin+ Stored Cross-Site ScriptingminiOrange's Google Authenticator – WordPress Two Factor Au…
- CVE-2022-1113Flower Delivery by Florist One <= 3.7 - Admin+ Stored Cross-Site ScriptingFlower Delivery by Florist One
- CVE-2022-1095Mihdan: No External Links < 5.0.2 - Admin+ Stored Cross-Site ScriptingMihdan: No External Links
- CVE-2022-1029Limit Login Attempts < 4.0.72 - Admin+ Stored Cross-Site ScriptingLimit Login Attempts
- CVE-2022-1028WordPress Security < 4.2.1 - Admin+ Stored Cross-Site ScriptingWordPress Security – Firewall, Malware Scanner, Secure Logi…
- CVE-2022-1010Login using WordPress Users < 1.13.4 - Admin+ Stored Cross-Site ScriptingLogin using WordPress Users
- CVE-2022-0875miniOrange Google Authenticator < 1.0.5 - CSRF to Stored Cross-Site ScriptingGoogle Authenticator
- CVE-2022-0444XCloner < 4.3.6 - Plugin Settings ResetBackup, Restore and Migrate WordPress Sites With the XClone…
- CVE-2022-2214SourceCodester Library Management System bookdetails.php sql injectionSourceCodester Library Management System
- CVE-2022-2213SourceCodester Library Management System cross site scriptingSourceCodester Library Management System
- CVE-2022-2212SourceCodester Library Management System /card/index.php unrestricted uploadSourceCodester Library Management System
- CVE-2020-9754NAVER Whale browser mobile app before 1.10.6.2 allows the attacker to bypass its browser unlock function via incognito mode.NAVER Whale browser
- CVE-2022-33202Authentication bypass vulnerability in the setup screen of L2Blocker(on-premise) Ver4.8.5 and earlier and L2Blocker(Cloud) Ver4.8.5 and earlSOFTCREATE L2Blocker
- CVE-2022-33146Open redirect vulnerability in web2py versions prior to 2.22.5 allows a remote attacker to redirect a user to an arbitrary web site and condweb2py