Skip to content
OpenAdvisories

Archive

21 June 2022

Vulnerabilities first published on this day (UTC), newest first.

← May 2022 2022 / June /21 July 2022 →
  1. 1113
  2. 293
  3. 351
  4. 44
  5. 53
  6. 6103
  7. 764
  8. 862
  9. 962
  10. 1043
  11. 118
  12. 1211
  13. 13146
  14. 14198
  15. 15256
  16. 16114
  17. 1771
  18. 1820
  19. 1916
  20. 2059
  21. 2163
  22. 22114
  23. 2327
  24. 24135
  25. 259
  26. 264
  27. 27129
  28. 2861
  29. 2951
  30. 30101
All Critical High Medium Low Exploited only Public exploit

63 results · Feed

  • Medium 4.3
    CVE-2022-31095

    Exposure of Sensitive Information in discourse-chat

    discourse-chat is a chat plugin for the Discourse application. Versions prior to 0.4 are vulnerable to an exposure of sensitive information, where an attacker who knows the message ID for a channel they do not have access to can view that message using the ch…

    Discourse discourse-chat
  • Unscored —
    CVE-2021-40510

    XML eXternal Entity (XXE) in OBDA systems’ Mastro 1.0 allows remote attackers to read system files via custom DTDs.

  • Unscored —
    CVE-2021-40511

    OBDA systems’ Mastro 1.0 is vulnerable to XML Entity Expansion (aka “billion laughs”) attack allowing denial of service.

  • Unscored —
    CVE-2021-36761

    The GeoAnalytics feature in Qlik Sense April 2020 patch 4 allows SSRF.

  • Medium 5.3
    CVE-2021-39006

    IBM QRadar WinCollect Agent 10.0 and 10.0.1 could allow an attacker to obtain sensitive information due to missing best…

    IBM QRadar WinCollect Agent
  • Critical 9.8
    CVE-2022-2068 EPSS 96%

    The c_rehash script allows command injection

    In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2022-33995

    A path traversal issue in entry attachments in Devolutions Remote Desktop Manager before 2022.2 allows attackers to cre…

  • Medium 5.4
    CVE-2022-30874

    Cross-site Scripting in NukeViet CMS

    There is a Cross Site Scripting Stored (XSS) vulnerability in NukeViet CMS before 4.5.02.

    nukeviet/nukeviet Packagist
  • Unscored —
    CVE-2022-26147

    The Quectel RG502Q-EA modem before 2022-02-23 allow OS Command Injection.

  • Medium 6.5
    CVE-2022-1596

    ABB Relion REX640 Insufficient file access control

    Incorrect Permission Assignment for Critical Resource vulnerability in ABB REX640 PCL1, REX640 PCL2, REX640 PCL3 allows an authenticated attacker to launch an attack against the user database file and try to take control of an affected system node.

    ABB REX640 PCL2 REX640 PCL1 REX640 PCL3 ICS / OT
  • Unscored —
    CVE-2022-1833

    A flaw was found in AMQ Broker Operator 7.9.4 installed via UI using OperatorHub where a low-privilege user that has ac…

  • Unscored —
    CVE-2022-1665

    A set of pre-production kernel packages of Red Hat Enterprise Linux for IBM Power architecture can be booted by the gru…

    Linux
  • Medium 5.9
    CVE-2022-23171

    AtlasVPN - Privilege Escalation

    AtlasVPN - Privilege Escalation Lack of proper security controls on named pipe messages can allow an attacker with low privileges to send a malicious payload and gain SYSTEM permissions on a windows computer where the AtlasVPN client is installed.

    AtlasVPN AtlasVPN
  • High 7.5
    CVE-2022-22979

    Denial of Service in Spring Cloud Function

    In Spring Cloud Function versions prior to 3.2.6, it is possible for a user who directly interacts with framework provided lookup functionality to cause a denial-of-service condition due to the caching issue in the Function Catalog component of the framework.

    org.springframework.cloud:spring-cloud-function-parent Maven
  • Unscored —
    CVE-2022-27872

    A maliciously crafted PDF file may be used to dereference a pointer for read or write operation while parsing PDF files…

  • Unscored —
    CVE-2022-27870

    A maliciously crafted TGA file in Autodesk AutoCAD 2023 may be used to write beyond the allocated buffer while parsing …

  • Unscored —
    CVE-2022-27868

    A maliciously crafted CAT file in Autodesk AutoCAD 2023 can be used to trigger use-after-free vulnerability. Exploitati…

  • Unscored —
    CVE-2022-27867

    A maliciously crafted JT file in Autodesk AutoCAD 2022, 2021, 2020, 2019 can be used to trigger use-after-free vulnerab…

  • Unscored —
    CVE-2022-27871

    Autodesk AutoCAD product suite, Revit, Design Review and Navisworks releases using PDFTron prior to 9.1.17 version may …

  • Unscored —
    CVE-2022-27869

    A maliciously crafted TIFF file in Autodesk AutoCAD 2023 can be forced to read and write beyond allocated boundaries wh…

  • Unscored —
    CVE-2022-32974

    An authenticated attacker could read arbitrary files from the underlying operating system of the scanner using a custom…

  • Unscored —
    CVE-2022-32973

    An authenticated attacker could create an audit file that bypasses PowerShell cmdlet checks and executes commands with …

  • Unscored —
    CVE-2022-34008

    Comodo Antivirus 12.2.2.8012 has a quarantine flaw that allows privilege escalation. To escalate privilege, a low-privi…

  • Medium 6.1
    CVE-2021-41924

    Cross-site Scripting in krayin/laravel-crm

    Webkul krayin crm before 1.2.2 is vulnerable to Cross Site Scripting (XSS).

    krayin/laravel-crm Packagist
  • Unscored —
    CVE-2022-31786

    IdeaLMS 2022 allows reflected Cross Site Scripting (XSS) via the IdeaLMS/Class/Assessment/ PATH_INFO.

  • Unscored —
    CVE-2022-29774

    iSpy v7.2.2.0 is vulnerable to remote command execution via path traversal.

  • Unscored —
    CVE-2022-29775 Scanner template EPSS 61%

    iSpyConnect iSpy v7.2.2.0 allows attackers to bypass authentication via a crafted URL.

  • Unscored —
    CVE-2022-31478

    The UserTakeOver plugin before 4.0.1 for ILIAS allows an attacker to list all users via the search function.

  • Unscored —
    CVE-2022-23342 Public exploit

    The Hyland Onbase Application Server releases prior to 20.3.58.1000 and OnBase releases 21.1.1.1000 through 21.1.15.100…

  • Unscored —
    CVE-2022-33056

    Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at …

  • Unscored —
    CVE-2022-33055

    Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at …

  • Unscored —
    CVE-2022-25585

    Unioncms v1.0.13 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Default settings.

  • Unscored —
    CVE-2022-33049

    Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at …

  • Unscored —
    CVE-2022-33048

    Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at …

  • Unscored —
    CVE-2022-33119 Scanner template

    NUUO Network Video Recorder NVRsolo v03.06.02 was discovered to contain a reflected cross-site scripting (XSS) vulnerab…

  • Unscored —
    CVE-2022-31373 Scanner template

    SolarView Compact v6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Solar_AiC…

  • Unscored —
    CVE-2022-31374

    An arbitrary file upload vulnerability /images/background/1.php in of SolarView Compact 6.0 allows attackers to execute…

  • Unscored —
    CVE-2022-32414

    Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_vmcode_interpreter at src/njs_v…

  • Unscored —
    CVE-2022-31307

    Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_string_offset at src/njs_string…

  • Unscored —
    CVE-2022-31306

    Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_array_convert_to_slow_array at …