CVEs published in June 2022
3,847 vulnerabilities, 331 critical, 3 exploited.
- google android, samsung mobile devices +1 moreImproper validation vulnerability in RemoteViews prior to SMR Jun-2022 Release 1 allows attackers...8.5 High
- google android, samsung mobile devices +1 moreImproper input validation check logic vulnerability in SECRIL prior to SMR Jun-2022 Release 1...2.5 Low
- google android, samsung mobile devices +1 moreSensitive information exposure in low-battery dumpstate log prior to SMR Jun-2022 Release 1...2.2 Low
- hcl software onetest serverHCL OneTest Server is vulnerable to Cross Origin Resource Sharing: Arbitrary Origin Trusted4.6 Medium
- nocodb, nocodb nocodb/nocodb +1 moreCross-site Scripting (XSS) - Stored in nocodb/nocodb9.0 Critical
- go standard library crypto/rand, golang go, netapp cloud insights telegraf agent +2 moreIndefinite hang with large buffers on Windows in crypto/rand7.5 High
- go standard library crypto/tls, golang go +1 moreSession tickets lack random ticket_age_add in crypto/tls3.1 Low
- go standard library os/exec, golang go +1 moreEmpty Cmd.Path can trigger unintended binary in os/exec on Windows7.8 High
- go standard library path/filepath, golang go +1 morePath traversal via Clean on Windows in path/filepath7.5 High
- librehealth ehrLibreHealth EHR Base 2.0.0 allows gacl/admin/acl_admin.php return_page XSS.6.1 Medium
- virtuasoftware cobrancaVirtua Cobranca before 12R allows SQL Injection on the login page.7.5 High
- watchguard firewareWatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to delete...9.1 Critical
- jamf private accessJamf Private Access before 2022-05-16 has Incorrect Access Control, in which an unauthorized user...7.5 High
crossbeamcrates.io`MsQueue` `push`/`pop` use the wrong orderingsNo score- prison management system project management system, sourcecodester prison management system +1 moreSourceCodester Prison Management System System Name cross site scripting2.4 Low
- prison management system project management system, sourcecodester prison management system +1 moreSourceCodester Prison Management System New User Creation improper authorization7.3 High
- prison management system project management system, sourcecodester prison management system +1 moreSourceCodester Prison Management System Inmate sql injection4.7 Medium
- prison management system project management system, sourcecodester prison management system +1 moreSourceCodester Prison Management System Visit view_visit.php sql injection4.7 Medium
- facturascripts, neorazorx neorazorx/facturascripts +1 moreCross-site Scripting (XSS) - Reflected in neorazorx/facturascripts6.8 Medium
- zyxel gs1200-5 firmware, gs1200-5hp firmware, gs1200-8 firmware +2 more +4 moreAn improper control of interaction frequency vulnerability in Zyxel GS1200 series switches could...6.2 Medium
espeak-ngOSS-FuzzStack-buffer-overflow in strcatNo score- axigen mobile webmailAn XSS vulnerability in the index_mobile_changepass.hsp reset-password section of Axigen Mobile...6.1 Medium
- teluu pjsip, debian linux, pjsip pjproject +2 morePotential stack buffer overflow when parsing message as a STUN client9.8 Critical
- vim, vim vim/vim, apple macos +2 more +4 moreOut-of-bounds Write in vim/vim7.8 High
- avantune genialcloud projA reflected cross-site scripting (XSS) vulnerability in the login portal of Avantune Genialcloud...6.1 Medium
- librehealth ehrLibreHealth EHR Base 2.0.0 allows gacl/admin/acl_admin.php action XSS.6.1 Medium
- caphyon advanced installer, 3cx call flow designer, crm template generator +67 more +69 moreCaphyon Ltd Advanced Installer 19.2 was discovered to contain a remote code execution (RCE)...8.1 High
- seeddmsThe "Add category" functionality inside the "Global Keywords" menu in "SeedDMS" version 6.0.18...5.4 Medium
- seeddmsSeedDMS 6.0.17 and 5.1.24 are vulnerable to Directory Traversal. The "Remove file" functionality...6.5 Medium
- seeddmsSeedDMS versions 6.0.18 and 5.1.25 and below are vulnerable to stored XSS. An attacker with admin...4.8 Medium
- simple task scheduling system project task scheduling systemA SQL injection vulnerability exists in Simple Task Scheduling System 1.0 when MySQL is being...9.8 Critical
- apache dubbobypass of CVE-2021-256406.1 Medium
- jmespath, fedoraproject fedora +1 moreJMESPath for Ruby uses unsafe JSON.load when safe JSON.parse is preferable9.8 Critical
- kubernetes cri-o, fedoraproject fedora, redhat enterprise linux +1 more +3 moreNode DOS by way of memory exhaustion through ExecSync request in CRI-O7.5 High
- jupyter oauthenticatorAuthorization Bypass Through User-Controlled Key when using CILogonOAuthenticator in oauthenticator4.2 Medium
- vaporDoS Vulnerability in URLEncodedFormDecoder in Vapor7.5 High
- github trilogyUse of Uninitialized Variable in trilogy5.9 Medium
- librehealth ehrLibreHealth EHR Base 2.0.0 allows interface/orders/patient_match_dialog.php key XSS.6.1 Medium
- afian filerunIn Afian Filerun 20220202, lack of sanitization of the POST parameter "metadata[]" in `/?module...8.8 High
- jodd httpServer-Side Request Forgery in Jodd HTTP7.5 High
- librehealth ehrCross Site scripting (XSS) vulnerability inLibreHealth EHR Base 2.0.0 via interface/usergroup...6.1 Medium
- vyperlang vyperMultiple evaluation of contract address in call in vyper8.2 High
- gradle enterpriseGradle Enterprise through 2022.2.2 has Incorrect Access Control that leads to information...7.5 High
- sap business objects business intelligence platformBI Launchpad and CMC in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2,...4.4 Medium
- sap se cla assistant, sap contributor license agreement assistant +1 moreDue to improper error handling an authenticated user can crash CLA assistant instance. This could impact the availability of the application.6.5 Medium
- silverstripe silverstripe-omnipayFailed payment recorded has completed in silverstripe/silverstripe-omnipay3.7 Low
- enalean tuleapTracker report renderer and chart widgets leak information in Tuleap4.3 Medium
- codingjoe django-s3fileImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in django-s3file9.1 Critical
- gradleGradle Enterprise through 2022.2.2 has Incorrect Access Control that leads to code execution.7.2 High
- grafanaGrafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor...7.5 High
- Show moreLoading…