CVEs published June 30, 2022
101 CVEs were published on June 30, 2022: 10 critical, 11 high.
- Published
- 101
- Critical
- 10
- High
- 11
- Medium
- 14
- Low
- 2
- Unrated
- 64
- Now in CISA KEV
- 0
- Fix available
- 21
Most affected products
- Robustel R1510
- 10
- Jenkins project Jenkins Deployment Dashboard Plugin · org.j…
- 5
- Ping Identity PingID Windows Login
- 5
- Jenkins project Jenkins Recipe Plugin · org.jenkins-ci.plug…
- 3
- Jenkins project Jenkins XebiaLabs XL Release Plugin · com.x…
- 3
- Jenkins project Jenkins XPath Configuration Viewer Plugin ·…
- 3
- libtiff
- 3
- IBM Spectrum Protect Client
- 2
- IBM Spectrum Protect Server
- 2
- Jenkins project Jenkins Build Notifications Plugin · tools.…
- 2
Critical 10
- CVE-2022-33329Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0.Robustel R1510
- CVE-2022-33328Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0.Robustel R1510
- CVE-2022-33327Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0.Robustel R1510
- CVE-2022-33326Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0.Robustel R1510
- CVE-2022-33325Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0.Robustel R1510
- CVE-2022-33314Multiple command injection vulnerabilities exist in the web_server action endpoints functionalities of Robustel R1510 3.3.0.Robustel R1510
- CVE-2022-33313Multiple command injection vulnerabilities exist in the web_server action endpoints functionalities of Robustel R1510 3.3.0.Robustel R1510
- CVE-2022-33312Multiple command injection vulnerabilities exist in the web_server action endpoints functionalities of Robustel R1510 3.3.0.Robustel R1510
- CVE-2022-32585A command execution vulnerability exists in the clish art2 functionality of Robustel R1510 3.3.0.Robustel R1510
- CVE-2022-2197Exemys RME1Exemys RME1-AI firmware
High 11
- CVE-2022-31115Unsafe YAML deserialization in opensearch-rubyopensearch-project opensearch-ruby · opensearch-ruby
- CVE-2022-23725PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstancesPing Identity PingID Windows Login
- CVE-2022-23720PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties filePing Identity PingID Windows Login
- CVE-2022-23719PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requestsPing Identity PingID Windows Login
- CVE-2022-23718PingID Windows Login prior to 2.8 uses known vulnerable components that can lead to remote code executionPing Identity PingID Windows Login
- CVE-2021-41995PingID Mac Login prior to 1.1 vulnerable to pre-computed dictionary attacksPing Identity PingID Mac Login
- CVE-2022-28127A data removal vulnerability exists in the web_server /action/remove/ API functionality of Robustel R1510 3.3.0.Robustel R1510
- CVE-2022-31112Protected fields exposed via LiveQuery in parse-serverparse-community parse-server · parse-server
- CVE-2017-20123Viscosity DLL untrusted search pathViscosity
- CVE-2017-20121Teradici Management Console Database Management privileges managementTeradici Management Console
- CVE-2022-2257Out-of-bounds Read in vim/vimvim/vim
Medium, low and unrated 80
- CVE-2022-32295On Ampere Altra and AltraMax devices before SRP 1.09, the Altra reference design of UEFI accesses allows insecure access to SPI-NOR by the O
- CVE-2022-27904Automox Agent for macOS before version 39 was vulnerable to a time-of-check/time-of-use (TOCTOU) race-condition attack during the agent inst
- CVE-2021-32428SQL Injection vulnerability in viaviwebtech Android EBook App (Books App, PDF, ePub, Online Book Reading, Download Books) 10 via the author_
- CVE-2022-32988Cross Site Scripting (XSS) vulnerability in router Asus DSL-N14U-B1 1.1.2.3_805 via the "*list" parameters (e.g.
- CVE-2022-33087A stack overflow in the function DM_ In fillobjbystr() of TP-Link Archer C50&A5(US)_V5_200407 allows attackers to cause a Denial of Service
- CVE-2022-33085ESPCMS P8 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the fetch_filename function at \espcms_pu
- CVE-2022-33082An issue in the AST parser (ast/compile.go) of Open Policy Agent v0.10.2 allows attackers to cause a Denial of Service (DoS) via a crafted igithub.com/open-policy-agent/opa
- CVE-2014-0156Awesome spawn contains OS command injection vulnerability, which allows execution of additional commands passed to Awesome spawn as argumentawesome_spawn
- CVE-2014-0068It was reported that watchman in openshift node-utils creates /var/run/watchman.pid and /var/log/watchman.ouput with world writable permissiopenshift node-util
- CVE-2022-23717PingID Windows Login prior to 2.8 denial of service conditionPing Identity PingID Windows Login
- CVE-2013-4561In a openshift node, there is a cron job to update mcollective facts that mishandles a temporary file.openshift-origin-msg-node-mcollective
- CVE-2022-34818Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier does not perform permission checks in several views and HTTP endpoints, allowing attJenkins project Jenkins Failed Job Deactivator Plugin · de.…
- CVE-2022-34817A cross-site request forgery (CSRF) vulnerability in Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier allows attackers to disable jobJenkins project Jenkins Failed Job Deactivator Plugin · de.…
- CVE-2022-34816Jenkins HPE Network Virtualization Plugin 1.0 stores passwords unencrypted in its global configuration file on the Jenkins controller where Jenkins project Jenkins HPE Network Virtualization Plugin ·…
- CVE-2022-34815A cross-site request forgery (CSRF) vulnerability in Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier allows attackers to accept peJenkins project Jenkins Request Rename Or Delete Plugin · o…
- CVE-2022-34814Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier does not correctly perform a permission check in an HTTP endpoint, allowing attackJenkins project Jenkins Request Rename Or Delete Plugin · o…
- CVE-2022-34813A missing permission check in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to cJenkins project Jenkins XPath Configuration Viewer Plugin ·…
- CVE-2022-34812A cross-site request forgery (CSRF) vulnerability in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers to create Jenkins project Jenkins XPath Configuration Viewer Plugin ·…
- CVE-2022-34811A missing permission check in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to aJenkins project Jenkins XPath Configuration Viewer Plugin ·…
- CVE-2022-34810A missing check in Jenkins RQM Plugin 2.8 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentiJenkins project Jenkins RQM Plugin · net.praqma:rqm-plugin
- CVE-2022-34809Jenkins RQM Plugin 2.8 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be Jenkins project Jenkins RQM Plugin · net.praqma:rqm-plugin
- CVE-2022-34808Jenkins Cisco Spark Plugin 1.1.1 and earlier stores bearer tokens unencrypted in its global configuration file on the Jenkins controller wheJenkins project Jenkins Cisco Spark Plugin · org.jenkins-ci…
- CVE-2022-34807Jenkins Elasticsearch Query Plugin 1.2 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller Jenkins project Jenkins Elasticsearch Query Plugin · org.je…
- CVE-2022-34806Jenkins Jigomerge Plugin 0.9 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viJenkins project Jenkins Jigomerge Plugin · org.jenkins-ci.p…
- CVE-2022-34805Jenkins Skype notifier Plugin 1.1.0 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller wheJenkins project Jenkins Skype notifier Plugin · org.jenkins…
- CVE-2022-34804Jenkins OpsGenie Plugin 1.9 and earlier transmits API keys in plain text as part of the global Jenkins configuration form and job configuratJenkins project Jenkins OpsGenie Plugin · org.jenkins-ci.pl…
- CVE-2022-34803Jenkins OpsGenie Plugin 1.9 and earlier stores API keys unencrypted in its global configuration file and in job config.xml files on the JenkJenkins project Jenkins OpsGenie Plugin · org.jenkins-ci.pl…
- CVE-2022-34802Jenkins RocketChat Notifier Plugin 1.5.2 and earlier stores the login password and webhook token unencrypted in its global configuration filJenkins project Jenkins RocketChat Notifier Plugin · org.je…
- CVE-2022-34801Jenkins Build Notifications Plugin 1.5.0 and earlier transmits tokens in plain text as part of the global Jenkins configuration form, potentJenkins project Jenkins Build Notifications Plugin · tools.…
- CVE-2022-34800Jenkins Build Notifications Plugin 1.5.0 and earlier stores tokens unencrypted in its global configuration files on the Jenkins controller wJenkins project Jenkins Build Notifications Plugin · tools.…
- CVE-2022-34799Jenkins Deployment Dashboard Plugin 1.0.10 and earlier stores a password unencrypted in its global configuration file on the Jenkins controlJenkins project Jenkins Deployment Dashboard Plugin · org.j…
- CVE-2022-34798Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers witJenkins project Jenkins Deployment Dashboard Plugin · org.j…
- CVE-2022-34797A cross-site request forgery (CSRF) vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to connect to aJenkins project Jenkins Deployment Dashboard Plugin · org.j…
- CVE-2022-34796A missing permission check in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers with Overall/Read permission to enumerJenkins project Jenkins Deployment Dashboard Plugin · org.j…
- CVE-2022-34795Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not escape environment names on its Deployment Dashboard view, resulting in a stJenkins project Jenkins Deployment Dashboard Plugin · org.j…
- CVE-2022-34794Missing permission checks in Jenkins Recipe Plugin 1.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to aJenkins project Jenkins Recipe Plugin · org.jenkins-ci.plug…
- CVE-2022-34793Jenkins Recipe Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins project Jenkins Recipe Plugin · org.jenkins-ci.plug…
- CVE-2022-34792A cross-site request forgery (CSRF) vulnerability in Jenkins Recipe Plugin 1.2 and earlier allows attackers to send an HTTP request to an atJenkins project Jenkins Recipe Plugin · org.jenkins-ci.plug…
- CVE-2022-34791Jenkins Validating Email Parameter Plugin 1.10 and earlier does not escape the name and description of its parameter type, resulting in a stJenkins project Jenkins Validating Email Parameter Plugin ·…
- CVE-2022-34790Jenkins eXtreme Feedback Panel Plugin 2.0.1 and earlier does not escape the job names used in tooltips, resulting in a stored cross-site scrJenkins project Jenkins eXtreme Feedback Panel Plugin · org…
- CVE-2022-34789A cross-site request forgery (CSRF) vulnerability in Jenkins Matrix Reloaded Plugin 1.1.3 and earlier allows attackers to rebuild previous mJenkins project Jenkins Matrix Reloaded Plugin · net.praqma…
- CVE-2022-34788Jenkins Matrix Reloaded Plugin 1.1.3 and earlier does not escape the agent name in tooltips, resulting in a stored cross-site scripting (XSSJenkins project Jenkins Matrix Reloaded Plugin · net.praqma…
- CVE-2022-34787Jenkins Project Inheritance Plugin 21.04.03 and earlier does not escape the reason a build is blocked in tooltips, resulting in a cross-siteJenkins Project Inheritance Plugin · hudson.plugins:project…
- CVE-2022-34786Jenkins Rich Text Publisher Plugin 1.4 and earlier does not escape the HTML message set by its post-build step, resulting in a stored cross-Jenkins project Jenkins Rich Text Publisher Plugin · org.je…
- CVE-2022-34785Jenkins build-metrics Plugin 1.3 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Jenkins project Jenkins build-metrics Plugin · org.jenkins-…
- CVE-2022-34784Jenkins build-metrics Plugin 1.3 does not escape the build description on one of its views, resulting in a stored cross-site scripting (XSS)Jenkins project Jenkins build-metrics Plugin · org.jenkins-…
- CVE-2022-34783Jenkins Plot Plugin 2.1.10 and earlier does not escape plot descriptions, resulting in a stored cross-site scripting (XSS) vulnerability expJenkins project Jenkins Plot Plugin · org.jenkins-ci.plugin…
- CVE-2022-34782An incorrect permission check in Jenkins requests-plugin Plugin 2.2.16 and earlier allows attackers with Overall/Read permission to view theJenkins project Jenkins requests-plugin Plugin · org.jenkin…
- CVE-2022-34781Missing permission checks in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allow attackers with Overall/Read permission to connect Jenkins project Jenkins XebiaLabs XL Release Plugin · com.x…
- CVE-2022-34780A cross-site request forgery (CSRF) vulnerability in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allows attackers to connect to aJenkins project Jenkins XebiaLabs XL Release Plugin · com.x…
- CVE-2022-34779A missing permission check in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allows attackers with Overall/Read permission to enumerJenkins project Jenkins XebiaLabs XL Release Plugin · com.x…
- CVE-2022-34778Jenkins TestNG Results Plugin 554.va4a552116332 and earlier renders the unescaped test descriptions and exception messages provided in test Jenkins project Jenkins TestNG Results Plugin · org.jenkins…
- CVE-2022-34777Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of webhook-triggered builds, resultinJenkins project Jenkins GitLab Plugin · org.jenkins-ci.plug…
- CVE-2013-4144There is an object injection vulnerability in swfupload plugin for wordpress.swfupload wordpress plugin
- CVE-2022-22494IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.14 could allow a remote attacker to gain details of the database, such as type IBM Spectrum Protect Operations Center
- CVE-2022-22472IBM Spectrum Protect Plus Container Backup and Restore (10.1.5 through 10.1.10.2 for Kubernetes and 10.1.7 through 10.1.10.2 for Red Hat OpeIBM Spectrum Protect Plus
- CVE-2021-38954IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5 and 6.1.0.0 through 6.1.1.0 could disclose sensitive version informatioIBM Sterling B2B Integrator
- CVE-2021-38941IBM CloudPak for Multicloud Monitoring 2.0 and 2.3 has a few containers running in privileged mode which is vulnerable to host information lIBM Cloud Pak for Multicloud Management Monitoring
- CVE-2022-22496While a user account for the IBM Spectrum Protect Server 8.1.0.000 through 8.1.14 is being established, it may be configured to use SESSIONSIBM Spectrum Protect Server
- CVE-2022-22487An IBM Spectrum Protect storage agent could allow a remote attacker to perform a brute force attack by allowing unlimited attempts to login IBM Spectrum Protect Server
- CVE-2022-22478IBM Spectrum Protect Client 8.1.0.0 through 8.1.14.0 stores user credentials in plain clear text which can be read by a local user.IBM Spectrum Protect Client
- CVE-2022-22474IBM Spectrum Protect 8.1.0.0 through 8.1.14.0 dsmcad, dsmc, and dsmcsvc processes incorrectly handle certain read operations on TCP/IP sockeIBM Spectrum Protect Client
- CVE-2021-37791MyAdmin v1.0 is affected by an incorrect access control vulnerability in viewing personal center in /api/user/userData?userCode=admin.
- CVE-2022-1955Session 1.13.0 allows an attacker with physical access to the victim's device to bypass the application's password/pin lock to access user dSession
- CVE-2021-37778There is a buffer overflow in gps-sdr-sim v1.0 when parsing long command line parameters, which can lead to DoS or code execution.
- CVE-2021-37770Nucleus CMS v3.71 is affected by a file upload vulnerability.
- CVE-2021-41506Xiaongmai AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, HI3518_50H10L_S39 V4.02.R
- CVE-2022-1852A NULL pointer dereference flaw was found in the Linux kernel’s KVM module, which can lead to a denial of service in the x86_emulate_insn inkernel · :linux_kernel:
- CVE-2013-4170In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML.ember-source
- CVE-2022-33043A cross-site scripting (XSS) vulnerability in the batch add function of Urtracker Premium v4.0.1.1477 allows attackers to execute arbitrary
- CVE-2021-40663deep.assign npm package 0.0.0-alpha.0 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollutideep.assign
- CVE-2021-40643EyesOfNetwork before 07-07-2021 has a Remote Code Execution vulnerability on the mail options configuration page.
- CVE-2022-26135A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the siAtlassian Jira Core Server · Atlassian Jira Software Ser… +3
- CVE-2017-20125Online Hotel Booking System Pro roomtype-details.php sql injectionOnline Hotel Booking System Pro
- CVE-2017-20124Online Hotel Booking System Pro Plugin roomtype-details.php sql injectionOnline Hotel Booking System Pro Plugin
- CVE-2017-20122Bitrix Site Manager Contact Form cross site scriptingBitrix Site Manager
- CVE-2022-2056Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file.libtiff
- CVE-2022-2057Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file.libtiff
- CVE-2022-2058Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file.libtiff
- CVE-2022-2078A vulnerability was found in the Linux kernel's nft_set_desc_concat_parse() function .This flaw allows an attacker to trigger a buffer overfkernel