Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: June 2022

75 records · 3 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2022-30190
    91Now

    Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 99%

    microsoft · windows 10 1507Jun 1, 2022

  • CVE-2021-44080
    35Monitor

    A Command Injection vulnerability in httpd web server (setup.cgi) in SerComm h500s, FW: lowi-h500s-v3.4.22 allows logged in administrators t

    HighCVSS 7.2No exploitEPSS 24%

    sercomm · h500s firmwareJun 2, 2022

  • CVE-2022-1660
    44Plan

    Keysight N6854A Geolocation server and N6841A RF Sensor software

    CriticalCVSS 9.8No exploitEPSS 16%

    keysight · n6854a firmwareJun 2, 2022

  • CVE-2022-1661
    35Monitor

    Keysight N6854A Geolocation server and N6841A RF Sensor software

    HighCVSS 7.5No exploitEPSS 15%

    keysight · n6854a firmwareJun 2, 2022

  • CVE-2022-25237
    56Plan

    Bonita Web 2021.2 is affected by a authentication/authorization bypass vulnerability due to an overly broad exclude pattern used in the Rest

    CriticalCVSS 9.8Proof of conceptEPSS 56%

    bonitasoft · bonita webJun 2, 2022

  • CVE-2022-28799
    40Plan

    The TikTok application before 23.7.3 for Android allows account takeover.

    HighCVSS 8.8No exploitEPSS 16%

    tiktok · tiktokJun 2, 2022

  • CVE-2022-30425
    41Plan

    Tenda Technology Co.,Ltd HG6 3.3.0-210926 was discovered to contain a command injection vulnerability via the pingAddr and traceAddr paramet

    HighCVSS 8.8No exploitEPSS 19%

    tenda · hg6 firmwareJun 2, 2022

  • CVE-2022-30521
    44Plan

    The LAN-side Web-Configuration Interface has Stack-based Buffer Overflow vulnerability in the D-Link Wi-Fi router firmware DIR-890L DIR890LA

    CriticalCVSS 9.8No exploitEPSS 15%

    dlink · dir-890l firmwareJun 2, 2022

  • CVE-2022-30808
    44Plan

    elitecms 1.0.1 is vulnerable to Arbitrary code execution via admin/manage_uploads.php.

    CriticalCVSS 9.8No exploitEPSS 17%

    elitecms · elite cmsJun 2, 2022

  • CVE-2021-42887
    52Plan

    In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm.

    CriticalCVSS 9.8Proof of conceptEPSS 44%

    totolink · ex1200t firmwareJun 3, 2022

  • CVE-2022-26134
    99Now

    In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attack

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    atlassian · confluence data centerJun 3, 2022

  • CVE-2022-30860
    35Monitor

    FUDforum 3.1.2 is vulnerable to Remote Code Execution through Upload File feature of File Administration System in Admin Control Panel.

    HighCVSS 7.2No exploitEPSS 24%

    fudforum · fudforumJun 6, 2022

  • CVE-2022-1680
    40Plan

    An account takeover issue has been discovered in GitLab EE affecting all versions starting from 11.10 before 14.9.5, all versions starting f

    HighCVSS 8.8No exploitEPSS 15%

    gitlab · gitlabJun 6, 2022

  • CVE-2021-37589
    40Plan

    Virtua Cobranca before 12R allows SQL Injection on the login page.

    HighCVSS 7.5Proof of conceptEPSS 32%

    virtuasoftware · cobrancaJun 7, 2022

  • CVE-2022-31470
    40Plan

    An XSS vulnerability in the index_mobile_changepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12 and 10.3.x before 1

    MediumCVSS 6.1Proof of conceptEPSS 52%

    axigen · axigen mobile webmailJun 7, 2022

  • CVE-2022-1703
    39Monitor

    Improper neutralization of special elements in the SonicWall SSL-VPN SMA100 series management interface allows a remote authenticated attack

    HighCVSS 8.8No exploitEPSS 12%

    sonicwall · sma 210 firmwareJun 8, 2022

  • CVE-2022-1692
    42Plan

    CP Image Store with Slideshow < 1.0.68 - Unauthenticated SQLi

    CriticalCVSS 9.8Proof of conceptEPSS 10%

    dwbooster · cp image store with slideshowJun 8, 2022

  • CVE-2022-29013
    62This week

    A command injection in the command parameter of Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to execute arbitrary commands

    CriticalCVSS 9.8Proof of conceptEPSS 77%

    razer · sila firmwareJun 8, 2022

  • CVE-2022-29014
    34Monitor

    A local file inclusion vulnerability in Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to read arbitrary files.

    HighCVSS 7.5Proof of conceptEPSS 11%

    razer · sila firmwareJun 8, 2022

  • CVE-2022-30075
    45Plan

    In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to remote code execution due

    HighCVSS 8.8Proof of conceptEPSS 34%

    tp-link · archer ax50 firmwareJun 9, 2022

  • CVE-2022-31827
    43Plan

    MonstaFTP v2.10.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the function performFetchRequest at HTTPFetcher.php.

    CriticalCVSS 9.1No exploitEPSS 21%

    monstaftp · monstaftpJun 9, 2022

  • CVE-2022-31830
    41Plan

    Kity Minder v1.3.5 was discovered to contain a Server-Side Request Forgery (SSRF) via the init function at ImageCapture.class.php.

    CriticalCVSS 9.1No exploitEPSS 16%

    baidu · kity minderJun 9, 2022

  • CVE-2019-25065
    60This week

    OpenNetAdmin os command injection

    CriticalCVSS 9.8WeaponizedEPSS 6%

    opennetadmin · opennetadminJun 9, 2022

  • CVE-2019-25066
    40Plan

    ajenti API privileges management

    HighCVSS 8.8WeaponizedEPSS 5%

    ajenti · ajentiJun 9, 2022

  • CVE-2022-1993
    43Plan

    Path Traversal in gogs/gogs

    HighCVSS 8.1No exploitEPSS 36%

    gogs · gogsJun 9, 2022

  • CVE-2022-26377
    36Monitor

    mod_proxy_ajp: Possible request smuggling

    HighCVSS 7.5Proof of conceptEPSS 21%

    apache · http serverJun 9, 2022

  • CVE-2022-30522
    57Plan

    mod_sed denial of service

    HighCVSS 7.5No exploitEPSS 89%

    apache · http serverJun 9, 2022

  • CVE-2017-20029
    45Plan

    PHPList Edit Subscription index.php sql injection

    CriticalCVSS 9.8No exploitEPSS 21%

    phplist · phplistJun 10, 2022

  • CVE-2022-31788
    43Plan

    IdeaLMS 2022 allows SQL injection via the IdeaLMS/ChatRoom/ClassAccessControl/6?isBigBlueButton=0&ClassID= pathname.

    CriticalCVSS 9.8No exploitEPSS 14%

    ideaco · idealmsJun 10, 2022

  • CVE-2022-25845
    45Plan

    Deserialization of Untrusted Data

    CriticalCVSS 9.8Proof of conceptEPSS 18%

    alibaba · fastjsonJun 10, 2022

  • CVE-2022-30780
    47Plan

    Lighttpd 1.4.56 through 1.4.58 allows a remote attacker to cause a denial of service (CPU consumption from stuck connections) because connec

    HighCVSS 7.5Proof of conceptEPSS 56%

    lighttpd · lighttpdJun 11, 2022

  • CVE-2021-41749
    44Plan

    In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injectio

    CriticalCVSS 9.8Proof of conceptEPSS 16%

    nystudio107 · seomaticJun 12, 2022

  • CVE-2022-0786
    43Plan

    KiviCare < 2.3.9 - Unauthenticated SQLi

    CriticalCVSS 9.8Proof of conceptEPSS 13%

    iqonic · kivicareJun 13, 2022

  • CVE-2022-0863
    35Monitor

    WP SVG Icons <= 3.2.3 - Admin+ Remote Code Execution (RCE)

    HighCVSS 7.2No exploitEPSS 23%

    wp svg icons project · wp svg iconsJun 13, 2022

  • CVE-2022-1707
    51Plan

    Google Tag Manager for WordPress <= 1.15 - Reflected Cross-Site Scripting via Site Search

    MediumCVSS 6.1No exploitEPSS 89%

    gtm4wp · google tag managerJun 13, 2022

  • CVE-2022-1768
    34Monitor

    RSVPMaker <= 9.3.2 - Unauthenticated SQL Injection

    HighCVSS 7.5Proof of conceptEPSS 12%

    carrcommunications · rsvpmakerJun 13, 2022

  • CVE-2022-29455
    31Monitor

    WordPress Elementor plugin <= 3.5.5 - Unauthenticated DOM-based Reflected Cross-Site Scripting (XSS) vulnerability

    MediumCVSS 6.1Proof of conceptEPSS 23%

    elementor · website builderJun 13, 2022

  • CVE-2022-33174
    34Monitor

    Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 allows remote authorization bypass in the web interfa

    HighCVSS 7.5Proof of conceptEPSS 14%

    powertekpdus · basic pdu firmwareJun 13, 2022

  • CVE-2022-31446
    49Plan

    Tenda AC18 router V15.03.05.19 and V15.03.05.05 was discovered to contain a remote code execution (RCE) vulnerability via the Mac parameter

    CriticalCVSS 9.8No exploitEPSS 34%

    tendacn · ac18 firmwareJun 13, 2022

  • CVE-2022-22071
    61This week

    Possible use after free when process shell memory is freed using IOCTL munmap call and process initialization is in progress in Snapdragon A

    HighCVSS 7.8KEVWeaponizedEPSS 0%

    qualcomm · apq8053 firmwareJun 14, 2022

  • CVE-2022-29034
    33Monitor

    A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1).

    MediumCVSS 6.1No exploitEPSS 28%

    siemens · sinema remote connect serverJun 14, 2022

  • CVE-2022-2086
    41Plan

    SourceCodester Bank Management System login.php sql injection

    HighCVSS 8.8No exploitEPSS 19%

    bank management system project · bank management systemJun 15, 2022

  • CVE-2022-24436
    30Monitor

    Observable behavioral in power management throttling for some Intel(R) Processors may allow an authenticated user to potentially enable info

    MediumCVSS 6.5No exploitEPSS 12%

    intel · *Jun 15, 2022

  • CVE-2021-41403
    45Plan

    flatCore-CMS version 2.0.8 calls dangerous functions, causing server-side request forgery vulnerabilities.

    CriticalCVSS 9.8No exploitEPSS 19%

    flatcore · flatcore-cmsJun 15, 2022

  • CVE-2022-30136
    61This week

    Windows Network File System Remote Code Execution Vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 72%

    microsoft · windows server 2012Jun 15, 2022

  • CVE-2022-31626
    52Plan

    mysqlnd/pdo password buffer overflow

    HighCVSS 8.8Proof of conceptEPSS 58%

    php · phpJun 16, 2022

  • CVE-2022-30023
    47Plan

    Tenda ONT GPON AC1200 Dual band WiFi HG9 v1.0.1 is vulnerable to Command Injection via the Ping function.

    HighCVSS 8.8Proof of conceptEPSS 39%

    tenda · hg9 firmwareJun 16, 2022

  • CVE-2022-24562
    55Plan

    In IOBit IOTransfer 4.3.1.1561, an unauthenticated attacker can send GET and POST requests to Airserv and gain arbitrary read/write access t

    CriticalCVSS 9.8Proof of conceptEPSS 54%

    iobit · iotransferJun 16, 2022

  • CVE-2022-27511
    36Monitor

    Corruption of the system by a remote, unauthenticated user potentially leading to the reset of the administrator password

    HighCVSS 8.1No exploitEPSS 12%

    citrix · application delivery managementJun 16, 2022

  • CVE-2022-31874
    45Plan

    ASUS RT-N53 3.0.0.4.376.3754 has a command injection vulnerability in the SystemCmd parameter of the apply.cgi interface.

    CriticalCVSS 9.8No exploitEPSS 19%

    asus · rt-n53 firmwareJun 17, 2022

  • CVE-2022-1905
    50Plan

    Events Made Easy < 2.2.81 - Unauthenticated SQLi

    CriticalCVSS 9.8No exploitEPSS 37%

    e-dynamics · events made easyJun 20, 2022

  • CVE-2022-25772
    43Plan

    A cross-site scripting (XSS) vulnerability in the web tracking component of Mautic before 4.3.0 allows remote attackers to inject executable

    MediumCVSS 6.1No exploitEPSS 63%

    acquia · mauticJun 20, 2022

  • CVE-2022-29775
    57Plan

    iSpyConnect iSpy v7.2.2.0 allows attackers to bypass authentication via a crafted URL.

    CriticalCVSS 9.8Proof of conceptEPSS 60%

    ispyconnect · ispyJun 21, 2022

  • CVE-2022-2068
    58Plan

    The c_rehash script allows command injection

    HighCVSS 7.3No exploitEPSS 96%

    openssl · opensslJun 21, 2022

  • CVE-2022-22980
    44Plan

    A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expres

    CriticalCVSS 9.8Proof of conceptEPSS 17%

    vmware · spring data mongodbJun 23, 2022

  • CVE-2022-31362
    40Plan

    Docebo Community Edition v4.0.5 and below was discovered to contain an arbitrary file upload vulnerability.

    HighCVSS 8.8No exploitEPSS 18%

    docebo · doceboJun 23, 2022

  • CVE-2022-34176
    44Plan

    Jenkins JUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results, resulting in a stored cross-site script

    MediumCVSS 5.4No exploitEPSS 77%

    jenkins · junitJun 23, 2022

  • CVE-2013-1916
    39Monitor

    In WordPress Plugin User Photo 0.9.4, when a photo is uploaded, it is only partially validated and it is possible to upload a backdoor on th

    HighCVSS 8.8Proof of conceptEPSS 12%

    user photo project · user photoJun 24, 2022

  • CVE-2022-32209
    33Monitor

    # Possible XSS Vulnerability in Rails::Html::SanitizerThere is a possible XSS vulnerability with certain configurations of Rails::Html::Sani

    MediumCVSS 6.1No exploitEPSS 30%

    rubyonrails · rails html sanitizersJun 24, 2022

  • CVE-2022-20828
    43Plan

    Cisco FirePOWER Software for ASA FirePOWER Module Command Injection Vulnerability

    HighCVSS 7.2WeaponizedEPSS 49%

    cisco · asa firepowerJun 24, 2022

  • CVE-2022-1574
    43Plan

    HTML2WP <= 1.0.0 - Unauthenticated Arbitrary File Upload

    CriticalCVSS 9.8Proof of conceptEPSS 12%

    html2wp project · html2wpJun 27, 2022

  • CVE-2022-28171
    54Plan

    The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability.

    CriticalCVSS 9.8Proof of conceptEPSS 51%

    hikvision · ds-a71024 firmwareJun 27, 2022

  • CVE-2022-31101
    42Plan

    SQL Injection in prestashop/blockwishlist

    HighCVSS 8.8Proof of conceptEPSS 23%

    prestashop · blockwishlistJun 27, 2022

  • CVE-2022-32994
    45Plan

    Halo CMS v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the component /api/admin/attachments/upload.

    CriticalCVSS 9.8No exploitEPSS 18%

    halo · haloJun 27, 2022

  • CVE-2022-32995
    44Plan

    Halo CMS v1.5.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the template remote download function.

    CriticalCVSS 9.8No exploitEPSS 17%

    halo · haloJun 27, 2022

  • CVE-2022-31056
    42Plan

    SQL injection with _actor parameter in GLPI

    CriticalCVSS 9.8Proof of conceptEPSS 9%

    glpi-project · glpiJun 28, 2022

  • CVE-2022-31061
    54Plan

    SQL injection on login page in GLPI

    CriticalCVSS 9.8Proof of conceptEPSS 51%

    glpi-project · glpiJun 28, 2022

  • CVE-2022-31885
    49Plan

    Marval MSM v14.19.0.12476 is vulnerable to OS Command Injection due to the insecure handling of VBScripts.

    CriticalCVSS 9.8Proof of conceptEPSS 32%

    marvalglobal · marval msmJun 28, 2022

  • CVE-2022-32532
    47Plan

    Authentication Bypass Vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 25%

    apache · shiroJun 28, 2022

  • CVE-2022-33107
    46Plan

    ThinkPHP v6.0.12 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Stor

    CriticalCVSS 9.8No exploitEPSS 23%

    thinkphp · thinkphpJun 29, 2022

  • CVE-2022-2073
    31Monitor

    Code Injection in getgrav/grav

    HighCVSS 7.2No exploitEPSS 10%

    getgrav · gravJun 29, 2022

  • CVE-2022-26135
    47Plan

    A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the si

    MediumCVSS 6.5Proof of conceptEPSS 71%

    atlassian · jira data centerJun 30, 2022

  • CVE-2022-34777
    43Plan

    Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of webhook-triggered builds, resultin

    MediumCVSS 5.4No exploitEPSS 73%

    jenkins · gitlabJun 30, 2022

  • CVE-2022-34783
    45Plan

    Jenkins Plot Plugin 2.1.10 and earlier does not escape plot descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exp

    MediumCVSS 5.4No exploitEPSS 81%

    jenkins · plotJun 30, 2022

  • CVE-2022-28127
    47Plan

    A data removal vulnerability exists in the web_server /action/remove/ API functionality of Robustel R1510 3.3.0.

    CriticalCVSS 9.1No exploitEPSS 37%

    robustel · r1510 firmwareJun 30, 2022