CVEs published June 29, 2022
49 CVEs were published on June 29, 2022: 1 critical, 6 high.
- Published
- 49
- Critical
- 1
- High
- 6
- Medium
- 8
- Low
- 8
- Unrated
- 26
- Now in CISA KEV
- 0
- Fix available
- 9
Most affected products
- TrueConf Server
- 8
- Enalean tuleap
- 3
- Microsoft Edge
- 3
- Teleopti WFM
- 3
- DIYgod RSSHub · rsshub
- 1
- Easy Table Plugin
- 1
- getgrav/grav
- 1
- IBM Security Guardium
- 1
- IVPN Client
- 1
- microweber/microweber
- 1
Critical 1
High 6
- CVE-2022-31058SQL injection via the field name of a tracker in TuleapEnalean tuleap
- CVE-2022-33638Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2022-30192Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2017-20112IVPN Client privileges managementIVPN Client
- CVE-2017-20111Teleopti WFM Administration privileges managementTeleopti WFM
- CVE-2022-33639Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
Medium, low and unrated 42
- CVE-2022-34835In Das U-Boot through 2022.07-rc5, an integer signedness error and resultant stack-based buffer overflow in the "i2c md" command enables the
- CVE-2021-40597The firmware of EDIMAX IC-3140W Version 3.11 is hardcoded with Administrator username and password.
- CVE-2022-30467Joy ebike Wolf Manufacturing year 2022 is vulnerable to Denial of service, which allows remote attackers to jam the key fob request via RF.
- CVE-2022-31110Denial of Service (DoS) vulnerability in RSSHubDIYgod RSSHub · rsshub
- CVE-2022-31063Cross site scripting via the title of a document in TuleapEnalean tuleap
- CVE-2022-31032Resources of private projects can be exposed in TuleapEnalean tuleap
- CVE-2022-33060Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f
- CVE-2022-33061Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f
- CVE-2022-33059Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f
- CVE-2022-33058Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f
- CVE-2022-33057Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f
- CVE-2022-33042Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/inquiries/view
- CVE-2017-20120TrueConf Server cross-site request forgeryTrueConf Server
- CVE-2017-20119TrueConf Server change-lang redirectTrueConf Server
- CVE-2017-20118TrueConf Server DOM cross site scriptingTrueConf Server
- CVE-2017-20117TrueConf Server group DOM cross site scriptingTrueConf Server
- CVE-2017-20116TrueConf Server Reflected cross site scriptingTrueConf Server
- CVE-2017-20115TrueConf Server Reflected cross site scriptingTrueConf Server
- CVE-2017-20114TrueConf Server Reflected cross site scriptingTrueConf Server
- CVE-2017-20113TrueConf Server Stored cross site scriptingTrueConf Server
- CVE-2021-39074IBM Security Guardium 11.4 is vulnerable to cross-site scripting.IBM Security Guardium
- CVE-2022-2252Open Redirect in microweber/microwebermicroweber/microweber
- CVE-2022-32969MetaMask before 10.11.3 might allow an attacker to access a user's secret recovery phrase because an input field is used for a BIP39 mnemoni
- CVE-2020-26877ApiFest OAuth 2.0 Server 0.3.1 does not validate the redirect URI in accordance with RFC 6749 and is susceptible to an open redirector attac
- CVE-2022-33037A binary hijack in Orwell-Dev-Cpp v5.11 allows attackers to execute arbitrary code via a crafted .exe file.
- CVE-2022-34043Incorrect permissions for the folder C:\ProgramData\NoMachine\var\uninstall of Nomachine v7.9.2 allows attackers to perform a DLL hijacking
- CVE-2022-33036A binary hijack in Embarcadero Dev-CPP v6.3 allows attackers to execute arbitrary code via a crafted .exe file.
- CVE-2022-33035XLPD v7.0.0094 and below contains an unquoted service path vulnerability which allows local users to launch processes with elevated privileg
- CVE-2022-33023CVA6 commit 909d85a gives incorrect permission to use special multiplication units when the format of instructions is wrong.
- CVE-2022-33021CVA6 commit 909d85a accesses invalid memory when reading the value of MHPMCOUNTER30.
- CVE-2022-33107ThinkPHP v6.0.12 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Stortopthink/framework
- CVE-2021-40642Textpattern CMS v4.8.7 and older vulnerability exists through Sensitive Cookie in HTTPS Session Without 'Secure' Attribute via textpattern/l
- CVE-2017-20110Teleopti WFM Administration Credentials information disclosureTeleopti WFM
- CVE-2017-20109Teleopti WFM Administration GetOneTenant Credentials information disclosureTeleopti WFM
- CVE-2017-20108Easy Table Plugin options-general.php cross site scriptingEasy Table Plugin
- CVE-2022-29272In Nagios XI through 5.8.5, an open redirect vulnerability exists in the login function that could lead to spoofing.
- CVE-2022-29271In Nagios XI through 5.8.5, a read-only Nagios user (due to an incorrect permission check) is able to schedule downtime for any host/service
- CVE-2022-29270In Nagios XI through 5.8.5, it is possible for a user without password verification to change his e-mail address.
- CVE-2022-29269In Nagios XI through 5.8.5, in the schedule report function, an authenticated attacker is able to inject HTML tags that lead to the reformat
- CVE-2022-28803In SilverStripe Framework through 2022-04-07, Stored XSS can occur in javascript link tags added via XMLHttpRequest (XHR).silverstripe/framework
- CVE-2022-31266In ILIAS through 7.10, lack of verification when changing an email address (on the Profile Page) allows remote attackers to take over accoun
- CVE-2022-31897SourceCodester Zoo Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via public_html/register_visitor?msg=.