Skip to content
OpenAdvisories

Archive

1 June 2022

Vulnerabilities first published on this day (UTC), newest first.

← May 2022 2022 / June /1 July 2022 →
  1. 1113
  2. 293
  3. 351
  4. 44
  5. 53
  6. 6103
  7. 764
  8. 862
  9. 962
  10. 1043
  11. 118
  12. 1211
  13. 13146
  14. 14198
  15. 15256
  16. 16114
  17. 1771
  18. 1820
  19. 1916
  20. 2059
  21. 2163
  22. 22114
  23. 2327
  24. 24135
  25. 259
  26. 264
  27. 27129
  28. 2861
  29. 2951
  30. 30101
All Critical High Medium Low Exploited only Public exploit

113 results · Feed

  • Medium 5.3
    CVE-2022-29235

    Limited data exposure for shared external videos in BigBlueButton

    BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4-rc-6, an attacker who is able to obtain the meeting identifier for a meeting on a server can find information related to an external video be…

    bigbluebutton bigbluebutton
  • Medium 4.3
    CVE-2022-29236

    Improper access control for pencil annotations in BigBlueButton

    BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4-rc-6, an attacker can circumvent access restrictions for drawing on the whiteboard. The permission check is inadvertently skipped on the serv…

    bigbluebutton bigbluebutton
  • Medium 4.3
    CVE-2022-29234

    Grace period for lock settings in public/private chats in BigBlueButton

    BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4.1, an attacker could send messages to a locked chat within a grace period of 5s any lock setting in the meeting was changed. The attacker nee…

    bigbluebutton bigbluebutton
  • Medium 4.3
    CVE-2022-29233

    Improper access control for breakout rooms in BigBlue Button

    BigBlueButton is an open source web conferencing system. In BigBlueButton starting with 2.2 but before 2.3.18 and 2.4-rc-1, an attacker can circumvent access controls to gain access to all breakout rooms of the meeting they are in. The permission checks rely …

    bigbluebutton bigbluebutton
  • Medium 6.5
    CVE-2022-29232

    Exposure of messages in BigBlueButton public chats

    BigBlueButton is an open source web conferencing system. Starting with version 2.2 and prior to versions 2.3.9 and 2.4-beta-1, an attacker can circumvent access controls to obtain the content of public chat messages from different meetings on the server. The …

    bigbluebutton bigbluebutton
  • High 7.5
    CVE-2022-29169

    ReDoS on endpoint html5client/useragent in BigBlueButton

    BigBlueButton is an open source web conferencing system. Versions starting with 2.2 and prior to 2.3.19, 2.4.7, and 2.5.0-beta.2 are vulnerable to regular expression denial of service (ReDoS) attacks. By using specific a RegularExpression, an attacker can cau…

    bigbluebutton bigbluebutton
  • High 7.8
    CVE-2022-30190 Exploited · Ransomware Public exploit EPSS 99%

    Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

    A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. Th…

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV Jun 14, 2022
  • High 8.3
    CVE-2022-30128

    Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

    Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

    Microsoft Microsoft Edge (Chromium-based) Browsers
  • High 8.3
    CVE-2022-30127

    Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

    Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

    Microsoft Microsoft Edge (Chromium-based) Browsers
  • Medium 4.3
    CVE-2022-26905

    Microsoft Edge (Chromium-based) Spoofing Vulnerability

    Microsoft Edge (Chromium-based) Spoofing Vulnerability

    Microsoft Microsoft Edge (Chromium-based) Browsers
  • Medium 6.2
    CVE-2022-31022

    Missing Role Based Access Control for the REST handlers in bleve/http package

    Bleve is a text indexing library for go. Bleve includes HTTP utilities under bleve/http package, that are used by its sample application. These HTTP methods pave way for exploitation of a node’s filesystem where the bleve index resides, if the user has used b…

    blevesearch bleve gitness gitea Debian Ubuntu Wolfi Go
  • Unscored —
    CVE-2022-27778

    A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is use…

    curl curl curl Debian Azure Linux Alpine
  • Unscored —
    CVE-2022-31973

    Online Fire Reporting System v1.0 is vulnerable to Delete any file via /ofrs/classes/Master.php?f=delete_img.

  • Unscored —
    CVE-2022-31974 Scanner template

    Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=reports&date=.

  • Unscored —
    CVE-2022-31975 Scanner template

    Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=user/manage_user&id=.

  • Unscored —
    CVE-2022-31976 Scanner template

    Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/classes/Master.php?f=delete_request.

  • Unscored —
    CVE-2022-31977 Scanner template

    Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/classes/Master.php?f=delete_team.

  • Unscored —
    CVE-2022-31978 Scanner template

    Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/classes/Master.php?f=delete_inquiry.

  • Unscored —
    CVE-2022-31980

    Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=teams/manage_team&id=.

  • Unscored —
    CVE-2022-31981

    Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=teams/view_team&id=.

  • Unscored —
    CVE-2022-31982

    Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=requests/view_request&id=.

  • Unscored —
    CVE-2022-31983 Public exploit

    Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=requests/manage_request&id=.

  • Unscored —
    CVE-2022-31984 Scanner template

    Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/requests/take_action.php?id=.

  • Unscored —
    CVE-2022-31966

    ChatBot App with Suggestion v1.0 is vulnerable to Delete any file via /simple_chat_bot/classes/Master.php?f=delete_img.

  • Unscored —
    CVE-2022-31969

    ChatBot App with Suggestion v1.0 is vulnerable to SQL Injection via /simple_chat_bot/admin/?page=user/manage_user&id=.

  • Unscored —
    CVE-2022-31970

    ChatBot App with Suggestion v1.0 is vulnerable to SQL Injection via /simple_chat_bot/admin/?page=responses/manage_respo…

  • Unscored —
    CVE-2022-31971

    ChatBot App with Suggestion v1.0 is vulnerable to SQL Injection via /simple_chat_bot/admin/?page=responses/view_respons…

  • Low 2.3
    CVE-2022-31000

    CSRF allows attacker to finalize/unfinalize order adjustments in solidus_backend

    solidus_backend is the admin interface for the Solidus e-commerce framework. Versions prior to 3.1.6, 3.0.6, and 2.11.16 contain a cross-site request forgery (CSRF) vulnerability. The vulnerability allows attackers to change the state of an order's adjustment…

    solidusio solidus solidus_backend RubyGems
  • High 8.8
    CVE-2022-24848

    SQL Injection in DHIS2's in OrgUnit program association

    DHIS2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security vulnerability affects the `/api/programs/orgUnits?programs=` API endpoint in DHIS2 versions prior to 2.36.10.1 and 2.37.6.1. The sys…

    dhis2 dhis2-core
  • Unscored —
    CVE-2022-29659

    Responsive Online Blog v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at single.php.

  • Medium 5.9
    CVE-2022-1929

    Exponential ReDoS in devcert

    An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the devcert npm package, when an attacker is able to supply arbitrary input to the certificateFor method

    devcert devcert devcert npm
  • Medium 5.9
    CVE-2021-43308

    Exponential ReDoS in markdown-link-extractor

    An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the markdown-link-extractor npm package, when an attacker is able to supply arbitrary input to the module's exported function

    markdown-link-extractor markdown-link-extractor markdown-link-extractor npm
  • Medium 5.9
    CVE-2021-43307

    Exponential ReDoS in semver-regex

    An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input to the test() method

    semver-regex semver-regex semver-regex npm
  • Medium 5.9
    CVE-2021-43306

    Exponential ReDoS in jquery-validation

    An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the jquery-validation npm package, when an attacker is able to supply arbitrary input to the url2 method

    jquery-validation jquery-validation civicrm jquery-validation Ubuntu npm
  • Medium 5.7
    CVE-2022-30277

    BD Synapsys™ – Insufficient Session Expiration

    BD Synapsys™, versions 4.20, 4.20 SR1, and 4.30, contain an insufficient session expiration vulnerability. If exploited, threat actors may be able to access, modify or delete sensitive information, including electronic protected health information (ePHI), pro…

    Becton Dickinson (BD) BD Synapsys™
  • High 8.8
    CVE-2022-22767

    BD Pyxis™ Products – Default Credentials

    Specific BD Pyxis™ products were installed with default credentials and may presently still operate with these credentials. There may be scenarios where BD Pyxis™ products are installed with the same default local operating system credentials or domain-joined…

    Becton Dickinson (BD) BD Pyxis™ MedStation™ ES BD Pyxis™ ParAssist BD Pyxis™ StockStation
  • Unscored —
    CVE-2022-31945

    Rescue Dispatch Management System v1.0 is vulnerable to Delete any file via /rdms/classes/Master.php?f=delete_img.

  • Unscored —
    CVE-2022-31946

    Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/classes/Master.php?f=delete_team.

  • Unscored —
    CVE-2022-31948

    Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/classes/Master.php?f=delete_report.

  • Unscored —
    CVE-2022-31951

    Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/classes/Master.php?f=delete_respondent_…