CVEs published June 28, 2022
60 CVEs were published on June 28, 2022: 3 critical, 6 high.
- Published
- 60
- Critical
- 3
- High
- 6
- Medium
- 15
- Low
- 1
- Unrated
- 35
- Now in CISA KEV
- 0
- Fix available
- 17
Most affected products
- zephyrproject-rtos zephyr
- 6
- glpi-project glpi
- 3
- IPCHDBW2XXX IPCHFW2XXX ASI7XXXX
- 3
- Dell PowerScale OneFS
- 2
- silverstripe/framework
- 2
- Simplessus
- 2
- Yokogawa Electric STARDOM Controller
- 2
- admidio/admidio
- 1
- Apache Software Foundation Apache Shiro · org.apache.shiro:…
- 1
- Clever underscore.deep
- 1
Critical 3
High 6
- CVE-2022-31230Dell PowerScale OneFS, versions 8.2.x-9.2.x, contain broken or risky cryptographic algorithm.Dell PowerScale OneFS
- CVE-2022-31106Prototype Pollution in underscore.deepClever underscore.deep
- CVE-2022-23763DOUZONE BIZON NeoRS file download and execute vulnerabilityDOUZONE BIZON Co. NeoRS
- CVE-2021-41689DCMTK through 3.6.6 does not handle string copy properly.
- CVE-2017-20104Simplessus Cookie Time sql injectionSimplessus
- CVE-2022-2231NULL Pointer Dereference in vim/vimvim/vim
Medium, low and unrated 51
- CVE-2022-32532Authentication Bypass VulnerabilityApache Software Foundation Apache Shiro · org.apache.shiro:…
- CVE-2022-25238Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that can can be added to website content via XHR by an silverstripe/framework
- CVE-2022-29858Silverstripe silverstripe/assets through 1.10 is vulnerable to improper access control that allows protected images to be published by changsilverstripe/assets
- CVE-2022-24444Silverstripe silverstripe/framework through 4.10 allows Session Fixation.silverstripe/hybridsessions
- CVE-2021-41559Silverstripe silverstripe/framework 4.8.1 has a quadratic blowup in Convert::xml2array() that enables a remote attack via a crafted XML docusilverstripe/framework
- CVE-2020-19897A reflected Cross Site Scripting (XSS) in wuzhicms v4.1.0 allows remote attackers to execute arbitrary web script or HTML via the imgurl par
- CVE-2020-19896File inclusion vulnerability in Minicms v1.9 allows remote attackers to execute arbitary PHP code via post-edit.php.
- CVE-2022-31887Marval MSM v14.19.0.12476 has a 0-Click Account Takeover vulnerability which allows an attacker to change any user's password in the organiz
- CVE-2022-31884Marval MSM v14.19.0.12476 has an Improper Access Control vulnerability which allows a low privilege user to delete other users API Keys incl
- CVE-2022-31883Marval MSM v14.19.0.12476 is has an Insecure Direct Object Reference (IDOR) vulnerability.
- CVE-2022-31886Marval MSM v14.19.0.12476 is vulnerable to Cross Site Request Forgery (CSRF).
- CVE-2022-31885Marval MSM v14.19.0.12476 is vulnerable to OS Command Injection due to the insecure handling of VBScripts.
- CVE-2021-3435L2CAP: Information leakage in le_ecred_conn_req()zephyrproject-rtos zephyr
- CVE-2021-3434L2CAP: Stack based buffer overflow in le_ecred_conn_req()zephyrproject-rtos zephyr
- CVE-2021-3433BT: Invalid channel map in CONNECT_IND results to Deadlockzephyrproject-rtos zephyr
- CVE-2021-3432BT: Invalid interval in CONNECT_IND leads to Division by Zerozephyrproject-rtos zephyr
- CVE-2021-3431BT: Assertion failure on repeated LL_FEATURE_REQzephyrproject-rtos zephyr
- CVE-2021-3430BT: Assertion failure on repeated LL_CONNECTION_PARAM_REQzephyrproject-rtos zephyr
- CVE-2022-31108Arbitrary `CSS` injection into the generated graph affecting the container HTML in mermaid.jsmermaid-js mermaid · mermaid
- CVE-2022-31068Sensitive Data Exposure on Refused Inventory Files in GLPIglpi-project glpi
- CVE-2022-28621A remote disclosure of sensitive information vulnerability was discovered in HPE NonStop DSM/SCM version: T6031H03^ADP.HPE NonStop DSM/SCM T6031
- CVE-2022-2145Cloudlfare WARP Arbitrary File OverwriteCloudflare WARP
- CVE-2022-31052URL previews can crash Synapse media repositories or Synapse monolithsmatrix-org synapse · matrix-synapse
- CVE-2022-33108XPDF v4.04 was discovered to contain a stack overflow vulnerability via the Object::Copy class of object.cc files.
- CVE-2021-3779Ruby-MySQL Gem Client File ReadTomita Masahiro ruby-mysql · ruby-mysql
- CVE-2021-40553piwigo 11.5.0 is affected by a remote code execution (RCE) vulnerability in the LocalFiles Editor.
- CVE-2022-0987A flaw was found in PackageKit in the way some of the methods exposed by the Transaction interface examines files.PackageKit
- CVE-2022-0085Server-Side Request Forgery (SSRF) in dompdf/dompdfdompdf/dompdf
- CVE-2022-30563When an attacker uses a man-in-the-middle attack to sniff the request packets with success logging in through ONVIF, he can log in to the deIPCHDBW2XXX[IPCHFW2XXX[ASI7XXXX
- CVE-2022-30562If the user enables the https function on the device, an attacker can modify the user’s request data packet through a man-in-the-middle attaIPCHDBW2XXX IPCHFW2XXX ASI7XXXX
- CVE-2022-30561When an attacker uses a man-in-the-middle attack to sniff the request packets with success logging in, the attacker could log in to the deviIPCHDBW2XXX IPCHFW2XXX ASI7XXXX
- CVE-2022-30560When an attacker obtaining the administrative account and password, or through a man-in-the-middle attack, the attacker could send a specifiIPCHDBW2XXX IPCHFW2XXX ASI7XXXX
- CVE-2021-41460ECShop 4.1.0 has SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information.
- CVE-2022-34750An issue was discovered in MediaWiki through 1.38.1.
- CVE-2022-23896Admidio 4.1.2 version is affected by stored cross-site scripting (XSS).admidio/admidio
- CVE-2021-40607The schm_box_size function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box command.
- CVE-2022-30997Use of hard-coded credentials vulnerability exists in STARDOM FCN Controller and FCJ Controller R4.10 to R4.31, which may allow an attacker Yokogawa Electric STARDOM Controller
- CVE-2022-30707Violation of secure design principles exists in the communication of CAMS for HIS.Yokogawa Electric CAMS for HIS
- CVE-2022-29519Cleartext transmission of sensitive information vulnerability exists in STARDOM FCN Controller and FCJ Controller R1.01 to R4.31, which may Yokogawa Electric STARDOM Controller
- CVE-2021-40943In Bento4 1.6.0-638, there is a null pointer reference in the function AP4_DescriptorListInspector::Action function in Ap4Descriptor.h:124 ,
- CVE-2021-41687DCMTK through 3.6.6 does not handle memory free properly.
- CVE-2021-41688DCMTK through 3.6.6 does not handle memory free properly.
- CVE-2021-41690DCMTK through 3.6.6 does not handle memory free properly.
- CVE-2022-0624Authorization Bypass Through User-Controlled Key in ionicabizau/parse-pathionicabizau/parse-path · parse-path
- CVE-2017-20107ShadeYouVPN.com Client privileges managementShadeYouVPN.com Client
- CVE-2017-20106Lithium Forum Compose Message server-side request forgeryLithium Forum
- CVE-2017-20105Simplessus path traversalSimplessus
- CVE-2021-40606The gf_bs_write_data function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box command.
- CVE-2021-40608The gf_hinter_track_finalize function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box command.
- CVE-2021-40609The GetHintFormat function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box command.
- CVE-2021-40944In GPAC MP4Box 1.1.0, there is a Null pointer reference in the function gf_filter_pid_get_packet function in src/filter_core/filter_pid.c:53