CVEs published in June 2022
3,847 vulnerabilities, 331 critical, 3 exploited.
- envoyproxy envoyZip bomb vulnerability in Envoy7.5 High
- envoyproxy envoySegmentation fault leading to crash in Envoy5.9 Medium
- chshcms cscmsA Cross-site request forgery (CSRF) vulnerability in Cscms music portal system v4.2 allows remote...6.5 Medium
- glpi-project glpiStored cross site scrpting in GLPI's Kanban5.4 Medium
- ihb-eg fn2webAn Insecure Direct Object Reference (IDOR) issue in fn2Web in ihb eG FlexNow before 2.04.09.016...4.3 Medium
- zte mf297d firmwareZTE's MF297D product has cryptographic issues vulnerability. Due to the use of weak random values...7.5 High
- ltgplc rustici software scorm engineA reflected cross-site scripting (XSS) vulnerability exists in the playerConfUrl parameter in the...6.1 Medium
- monstaftpMonstaFTP v2.10.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the function...9.1 Critical
- baidu kity minderServer-Side Request Forgery in kityminder9.1 Critical
- jizhicmsJizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via...9.1 Critical
- jizhicmsJizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via...9.1 Critical
- nbnbk project nbnbkA Server-Side Request Forgery (SSRF) in the getFileBinary function of nbnbk cms 3 allows...9.1 Critical
- wolfcms wolf cmsWolfCMS User Add cross site scripting3.5 Low
- axios italia re, axiositalia registro elettronico +1 moreAxios Italia Axios RE Error Message ASP.NET information disclosure5.3 Medium
- axios italia re, axiositalia registro elettronico +1 moreAxios Italia Axios RE Connection REDefault.aspx privileges management6.3 Medium
- containers podman, varlink +1 morePodman/Varlink API Privilege Escalation6.3 Medium
- ajentiajenti API privileges management6.3 Medium
- opennetadminOpenNetAdmin os command injection6.3 Medium
- corehr core portal, theaccessgroup corehr core portal +1 moreCoreHR Core Portal cross-site request forgery4.3 Medium
- http file server project file serverThe Android application HTTP File Server (Version 1.4.1) by 'slowscript' is affected by a path...8.1 High
- xen, debian linux, fedoraproject fedora +2 morex86 pv: Race condition in typeref acquisition Xen maintains a type reference count for pages, in...6.4 Medium
- xen, debian linux, fedoraproject fedora +2 morex86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to...6.7 Medium
- xen, debian linux, fedoraproject fedora +2 morex86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to...6.7 Medium
- emlog pro project proEmlog Pro v 1.0.4 cross-site scripting (XSS) in Emlog Pro background management.5.4 Medium
- tooljet, tooljet tooljet/tooljet +1 moreExcessive Attack Surface in tooljet/tooljet9.8 Critical
- unspecified monyog ultimate, ideracorp webyog monyog ultimate +1 moreMONyog Ultimate Cookie privileges management7.3 High
- francoisjacquet francoisjacquet/rosariosis, rosariosis +1 moreCross-site Scripting (XSS) - Stored in francoisjacquet/rosariosis9.0 Critical
- tp-link archer ax50 firmwareIn TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web...8.8 High
- owncloudownCloud owncloud/core before 10.10.0 Improperly Removes Sensitive Information Before Storage or...7.5 High
- igel universal management suiteAn issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. Insecure...5.5 Medium
- igel universal management suiteAn issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. The transmission...6.5 Medium
- igel universal management suiteAn issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. A hardcoded DES...8.8 High
- igel universal management suiteAn issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. A hardcoded DES...5.5 Medium
- edx open edxOpen edX platform before 2022-06-06 allows XSS via the "next" parameter in the logout URL.6.1 Medium
- opswat metadefenderOPSWAT MetaDefender Core (MDCore) before 5.1.2 has incorrect access control, resulting in...9.8 Critical
- debian linux, firejail project firejail, fedoraproject fedora +2 moreA Privilege Context Switching issue was discovered in join.c in Firejail 0.9.68. By crafting a...7.8 High
- guzzle, debian linux, drupal +2 moreFix failure to strip Authorization header on HTTP downgrade in Guzzle7.5 High
- guzzle, debian linux, drupal +2 moreFailure to strip the Cookie header on change in host or HTTP downgrade in Guzzle7.5 High
- cmsmadesimple cms made simpleCMS Made Simple <=2.2.15 is affected by SQL injection in modules/News/function.admin_articlestab...8.8 High
- librehealth ehrLibreHealth EHR Base 2.0.0 allows incorrect interface/super/manage_site_files.php access.8.8 High
- razer sila firmwareA local file inclusion vulnerability in Razer Sila Gaming Router v2.0.441_api-2.0.418 allows...7.5 High
- razer sila firmwareA command injection in the command parameter of Razer Sila Gaming Router v2.0.441_api-2.0.418...9.8 Critical
- gogs, gogs gogs/gogs +1 moreOS Command Injection in gogs/gogs10.0 Critical
- api-res-py project api-res-pyBackdoor in api-res-py9.8 Critical
- pyanxdns project pyanxdnspyanxdns package in PyPI version 0.2 is vulnerable to code execution backdoor. The impact is:...9.8 Critical
- zangband-data project zangband-dataZAngband zangband-data 2.7.5 is affected by an integer underflow vulnerability in src/tk/plat.c...9.8 Critical
- gogsXSS vulnerability in repository issue list in Gogs5.4 Medium
- keep project keepThe keep for python, as distributed on PyPI, included a code-execution backdoor inserted by a...9.8 Critical
- dolibarr erp\/crmCross-site Scripting in Dolibarr6.1 Medium
- churchcrmThere is a SQL Injection vulnerability in ChurchCRM 4.4.5 via the 'PersonID' field in /churchcrm...7.2 High
- Show moreLoading…