Security Vulnerabilities - CVEs Published In June 2022
Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 19.0.2.
CVSS Score
6.1
EPSS Score
0.002
Published
2022-06-09
Cross-site Scripting (XSS) - Stored in GitHub repository kromitgmbh/titra prior to 0.77.0.
CVSS Score
8.2
EPSS Score
0.003
Published
2022-06-09
Improper Neutralization of Formula Elements in a CSV File in GitHub repository kromitgmbh/titra prior to 0.77.0.
CVSS Score
8.0
EPSS Score
0.004
Published
2022-06-09
Cross-site Scripting (XSS) - Generic in GitHub repository kromitgmbh/titra prior to 0.77.0.
CVSS Score
8.2
EPSS Score
0.003
Published
2022-06-09
Cross-site Scripting (XSS) - DOM in GitHub repository kromitgmbh/titra prior to 0.77.0.
CVSS Score
8.2
EPSS Score
0.003
Published
2022-06-09
Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0.1.
CVSS Score
9.0
EPSS Score
0.004
Published
2022-06-09
Excessive Attack Surface in GitHub repository tooljet/tooljet prior to v1.16.0.
CVSS Score
9.8
EPSS Score
0.003
Published
2022-06-09
If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort.
CVSS Score
7.5
EPSS Score
0.116
Published
2022-06-09
Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer.
CVSS Score
7.5
EPSS Score
0.005
Published
2022-06-09
Gogs is an open source self-hosted Git service. In versions of gogs prior to 0.12.9 `DisplayName` does not filter characters input from users, which leads to an XSS vulnerability when directly displayed in the issue list. This issue has been resolved in commit 155cae1d which sanitizes `DisplayName` prior to display to the user. All users of gogs are advised to upgrade. Users unable to upgrade should check their users' display names for malicious characters.
CVSS Score
5.4
EPSS Score
0.003
Published
2022-06-09