Skip to content
OpenAdvisories

Archive

20 July 2022

Vulnerabilities first published on this day (UTC), newest first.

← June 2022 2022 / July /20 August 2022 →
  1. 184
  2. 28
  3. 33
  4. 438
  5. 532
  6. 695
  7. 748
  8. 825
  9. 91
  10. 102
  11. 11205
  12. 12186
  13. 1354
  14. 1468
  15. 1581
  16. 1612
  17. 1776
  18. 18100
  19. 19136
  20. 2097
  21. 2183
  22. 2273
  23. 234
  24. 243
  25. 25102
  26. 26115
  27. 27115
  28. 2893
  29. 2941
  30. 301
  31. 3112
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 9.8
    CVE-2022-26138 Exploited Public exploit Scanner template EPSS 98%

    The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in t…

    Atlassian Questions For Confluence Web / CMS
    KEV Jul 29, 2022
  • Critical 9.8
    CVE-2022-26136

    A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used…

    Atlassian Confluence Data Center Confluence Server Crucible Web / CMS
  • Critical 9.8
    CVE-2022-33318 EPSS 50%

    Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi …

    Mitsubishi Electric Mitsubishi Electric Iconics Digital Solutions MC Works64 GENESIS64 ICS / OT
  • Critical 9.8
    CVE-2022-2107

    ICSA-22-200-01 MiCODUS MV720 GPS tracker Use of Hard-coded Credentials

    The MiCODUS MV720 GPS tracker API server has an authentication mechanism that allows devices to use a hard-coded master password. This may allow an attacker to send SMS commands directly to the GPS tracker as if they were coming from the GPS owner’s mobile nu…

    MiCODUS MV720
  • Critical 9.8
    CVE-2022-2141

    ICSA-22-200-01 MiCODUS MV720 GPS tracker Improper Authentication

    SMS-based GPS commands can be executed by MiCODUS MV720 GPS tracker without authentication.

    MiCODUS MV720
  • Critical 9.8
    CVE-2022-32456

    Data Systems Consulting Co., Ltd. BPM - SQL Injection

    Digiwin BPM’s function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL command to access, modify, delete database or disrupt service.

    Data Systems Consulting BPM
  • Critical 10.0
    CVE-2016-1000273

    Java Melody vulnerable to cross-site scripting

    JavaMelody is a monitoring tool for JavaEE applications. Versions prior to 1.61.0 are vulnerable to a cross-site scripting (XSS) attack. This issue was patched in version 1.61.0, and users are recommended to upgrade to the latest version. There are no known w…

    net.bull.javamelody:javamelody-core Maven