Skip to content
OpenAdvisories

Archive

6 June 2022

Vulnerabilities first published on this day (UTC), newest first.

← May 2022 2022 / June /6 July 2022 →
  1. 1113
  2. 293
  3. 351
  4. 44
  5. 53
  6. 6103
  7. 764
  8. 862
  9. 962
  10. 1043
  11. 118
  12. 1211
  13. 13146
  14. 14198
  15. 15256
  16. 16114
  17. 1771
  18. 1820
  19. 1916
  20. 2059
  21. 2163
  22. 22114
  23. 2327
  24. 24135
  25. 259
  26. 264
  27. 27129
  28. 2861
  29. 2951
  30. 30101
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 9.8
    CVE-2022-32511

    JMESPath for Ruby uses unsafe JSON.load when safe JSON.parse is preferable

    jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable.

    ruby-jmespath ruby-jmespath jmespath Debian Ubuntu RubyGems
  • Critical 9.1
    CVE-2022-24840

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in django-s3file

    django-s3file is a lightweight file upload input for Django and Amazon S3 . In versions prior to 5.5.1 it was possible to traverse the entire AWS S3 bucket and in most cases to access or delete files. If the `AWS_LOCATION` setting was set, traversal was limit…

    codingjoe django-s3file django-s3file PyPI
  • Critical 9.9
    CVE-2022-1680 EPSS 16%

    An account takeover issue has been discovered in GitLab EE affecting all versions starting from 11.10 before 14.9.5, al…

    GitLab GitLab Web / CMS
  • Critical 9.1
    CVE-2022-31483

    Arbitrary file write via authenticated OSDP file upload

    An authenticated attacker can upload a file with a filename including “..” and “/” to achieve the ability to upload the desired file anywhere on the filesystem. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, L…

    LenelS2 HID Mercury LNL-X3300 LP1502
  • Critical 10.0
    CVE-2022-31481

    Remote Code Execution via buffer overflow in firmware update process

    An unauthenticated attacker can send a specially crafted update file to the device that can overflow a buffer. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware v…

    LenelS2 HID Mercury LNL-X3300 LP1502
  • Critical 9.6
    CVE-2022-31479

    Remote Code Execution via command injection of the hostname

    An unauthenticated attacker can update the hostname with a specially crafted name that will allow for shell commands to be executed during the core collection process. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP…

    LenelS2 HID Mercury LNL-X3300 LP1502
  • Critical 9.3
    CVE-2022-1996

    Authorization Bypass Through User-Controlled Key in emicklei/go-restful

    Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.

    emicklei emicklei/go-restful kubeflow-profile-controller kubeflow-access-management Debian Ubuntu Azure Linux Alpine Wolfi Go