deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-26493
Published: 2022-06-03
Description: Xecurify's miniOrange Premium, Standard, and Enterprise Drupal SAML SP modules possess an authentication and authorization bypass vulnerability. An attacker with access to a HTTP-request intercepting method is able to bypass authentication and authorization by removing the SAML Assertion Signature - impersonating existing users and existing roles, including administrative users/roles. This vulnerability is not mitigated by configuring the module to enforce signatures or certificate checks. Xecurify recommends updating miniOrange modules to their most recent versions. This vulnerability is present in paid versions of the miniOrange Drupal SAML SP product affecting Drupal 7, 8, and 9.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-295
References: https://rafarmerjr1.github.io/2022/06/13/SAML-miniOrange.html; https://rafarmerjr1.github.io/2022/06/13/SAML-miniOrange.html
CVE: CVE-2021-43271
Published: 2022-06-03
Description: Riverbed AppResponse 11.8.0, 11.8.5, 11.8.5a, 11.9.0, 11.9.0a, 11.10.0, 11.11.0, 11.11.0a, 11.11.1, 11.11.1a, 11.11.5, and 11.11.5a (when configured to use local, RADIUS, or TACACS authentication) logs usernames and passwords if either is entered incorrectly. If a user enters an incorrect username and/or password when logging into the WebUI, these attempted credentials are included in an error message that is logged in the WebUI log file. A log entry does not appear if the username and password provided correctly match a valid set of credentials. This also does not happen if AppResponse is configured to use SAML authentication. The WebUI log file is included in subsequent diagnostic system dumps that are generated. (Only users with Full Control access to the System Configuration permission can generate system dumps. By default, only System Administrators have Full Control access to the System Configuration permission.)
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-532
References: https://supportkb.riverbed.com/support/index?page=content&id=S35806; https://supportkb.riverbed.com/support/index?page=content&id=S35806
CVE: CVE-2022-29770
Published: 2022-06-03
Description: XXL-Job v2.3.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via /xxl-job-admin/jobinfo.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/xuxueli/xxl-job/issues/2836; https://github.com/xuxueli/xxl-job/issues/2836
CVE: CVE-2022-29773
Published: 2022-06-03
Description: An access control issue in aleksis/core/util/auth_helpers.py: ClientProtectedResourceMixin of AlekSIS-Core v2.8.1 and below allows attackers to access arbitrary scopes if no allowed scopes are specifically set.
CVSS Score: 6.5 (MEDIUM)
References: https://aleksis.org/2022-05-04_advisory.html; https://edugit.org/AlekSIS/official/AlekSIS-Core/-/issues/688; https://aleksis.org/2022-05-04_advisory.html
CVE: CVE-2022-29778
Published: 2022-06-03
Description: D-Link DIR-890L 1.20b01 allows attackers to execute arbitrary code due to the hardcoded option Wake-On-Lan for the parameter 'descriptor' at SetVirtualServerSettings.php
CVSS Score: 8.8 (HIGH)
CWE: CWE-798
References: https://github.com/TyeYeah/DIR-890L-1.20-RCE; https://www.dlink.com/en/security-bulletin/; https://github.com/TyeYeah/DIR-890L-1.20-RCE
CVE: CVE-2022-29784
Published: 2022-06-03
Description: PublicCMS V4.0.202204.a and below contains an information leak via the component /views/directive/sys/SysConfigDataDirective.java.
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/JinYiTong/CVE-Req/blob/main/publiccms/publiccms.md; https://github.com/sanluan/PublicCMS/commit/d8d7626cf51e4968fb384e1637a3c0c9921f33e9; https://github.com/JinYiTong/CVE-Req/blob/main/publiccms/publiccms.md
CVE: CVE-2022-26134
Published: 2022-06-03
Description: In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-917, CWE-917
References: http://packetstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-Code-Execution.html; http://packetstormsecurity.com/files/167431/Through-The-Wire-CVE-2022-26134-Confluence-Proof-Of-Concept.html; http://packetstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.html
CVE: CVE-2022-32291
Published: 2022-06-05
Description: In Real Player through 20.1.0.312, attackers can execute arbitrary code by placing a UNC share pathname (for a DLL file) in a RAM file.
CVSS Score: 8.8 (HIGH)
References: https://github.com/Edubr2020/RP_RecordClip_DLL_Hijack; https://github.com/Edubr2020/RP_RecordClip_DLL_Hijack
CVE: CVE-2022-32296
Published: 2022-06-05
Description: The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are used. This occurs because of use of Algorithm 4 ("Double-Hash Port Selection Algorithm") of RFC 6056.
CVSS Score: 3.3 (LOW)
CWE: CWE-330
References: https://arxiv.org/abs/2209.12993; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.9; https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4c2c8f03a5ab7cb04ec64724d7d176d00bcc91e5
CVE: CVE-2021-42245
Published: 2022-06-06
Description: FlatCore-CMS 2.0.9 has a cross-site scripting (XSS) vulnerability in pages.edit.php through meta tags and content sections.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/flatCore/flatCore-CMS/issues/69; https://github.com/flatCore/flatCore-CMS/issues/69
CVE: CVE-2022-30860
Published: 2022-06-06
Description: FUDforum 3.1.2 is vulnerable to Remote Code Execution through Upload File feature of File Administration System in Admin Control Panel.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/fudforum/FUDforum/issues/23; https://github.com/fudforum/FUDforum/issues/23
CVE: CVE-2022-30861
Published: 2022-06-06
Description: FUDforum 3.1.2 is vulnerable to Stored XSS via Forum Name field in Forum Manager Feature.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/fudforum/FUDforum/issues/24; https://github.com/fudforum/FUDforum/issues/24
CVE: CVE-2022-30863
Published: 2022-06-06
Description: FUDForum 3.1.2 is vulnerable to Cross Site Scripting (XSS) via page_title param in Page Manager in the Admin Control Panel.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/fudforum/FUDforum/issues/24; https://github.com/fudforum/FUDforum/issues/24
CVE: CVE-2021-41932
Published: 2022-06-06
Description: A blind SQL injection vulnerability in search form in TeamMate+ Audit version 28.0.19.0 allows any authenticated user to create malicious SQL injections, which can result in complete database compromise, gaining information about other users, unauthorized access to audit data etc.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://mjilek.cz/blog/CVE-2021-41932/; https://mjilek.cz/blog/CVE-2021-41932/
CVE: CVE-2021-39947
Published: 2022-06-06
Description: In specific circumstances, trace file buffers in GitLab Runner versions up to 14.3.4, 14.4 to 14.4.2, and 14.5 to 14.5.2 would re-use the file descriptor 0 for multiple traces and mix the output of several jobs
CVSS Score: 5.3 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39947.json; https://gitlab.com/gitlab-org/gitlab-runner/-/issues/28732; https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39947.json
CVE: CVE-2022-1783
Published: 2022-06-06
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1. It may be possible for malicious group maintainers to add new members to a project within their group, through the REST API, even after their group owner enabled a setting to prevent members from being added to projects within that group.
CVSS Score: 2.7 (LOW)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1783.json; https://gitlab.com/gitlab-org/gitlab/-/issues/353121; https://hackerone.com/reports/1472109
CVE: CVE-2022-1821
Published: 2022-06-06
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.8 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1. It may be possible for a subgroup member to access the members list of their parent group.
CVSS Score: 4.3 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1821.json; https://gitlab.com/gitlab-org/gitlab/-/issues/353730; https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1821.json
CVE: CVE-2022-1935
Published: 2022-06-06
Description: Incorrect authorization in GitLab EE affecting all versions from 12.0 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1 allowed an attacker already in possession of a valid Project Trigger Token to misuse it from any location even when IP address restrictions were configured
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1935.json; https://gitlab.com/gitlab-org/gitlab/-/issues/363650; https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1935.json
CVE: CVE-2022-1936
Published: 2022-06-06
Description: Incorrect authorization in GitLab EE affecting all versions from 12.0 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1 allowed an attacker already in possession of a valid Project Deploy Token to misuse it from any location even when IP address restrictions were configured
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1936.json; https://gitlab.com/gitlab-org/gitlab/-/issues/363638; https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1936.json
CVE: CVE-2022-1940
Published: 2022-06-06
Description: A Stored Cross-Site Scripting vulnerability in Jira integration in GitLab EE affecting all versions from 13.11 prior to 14.9.5, 14.10 prior to 14.10.4, and 15.0 prior to 15.0.1 allows an attacker to execute arbitrary JavaScript code in GitLab on a victim's behalf via specially crafted Jira Issues
CVSS Score: 7.7 (HIGH)
CWE: CWE-79
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1940.json; https://gitlab.com/gitlab-org/gitlab/-/issues/359142; https://hackerone.com/reports/1533976
CVE: CVE-2022-1944
Published: 2022-06-06
Description: When the feature is configured, improper authorization in the Interactive Web Terminal in GitLab CE/EE affecting all versions from 11.3 prior to 14.9.5, 14.10 prior to 14.10.4, and 15.0 prior to 15.0.1 allows users with the Developer role to open terminals on other Developers' running jobs
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1944.json; https://gitlab.com/gitlab-org/gitlab/-/issues/349750; https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1944.json
CVE: CVE-2022-31479
Published: 2022-06-06
Description: An unauthenticated attacker can update the hostname with a specially crafted name that will allow for shell commands to be executed during the core collection process. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.302 for the LP series and 1.296 for the EP series. An attacker with this level of access on the device can monitor all communications sent to and from this device, modify onboard relays, change configuration files, or cause the device to become unstable. The injected commands only get executed during start up or when unsafe calls regarding the hostname are used. This allows the attacker to gain remote access to the device and can make their persistence permanent by modifying the filesystem.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-693, CWE-78
References: https://www.corporate.carrier.com/product-security/advisories-resources/; https://www.corporate.carrier.com/product-security/advisories-resources/
CVE: CVE-2022-31480
Published: 2022-06-06
Description: An unauthenticated attacker could arbitrarily upload firmware files to the target device, ultimately causing a Denial-of-Service (DoS). This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.302 for the LP series and 1.296 for the EP series. The attacker needs to have a properly signed and encrypted binary, loading the firmware to the device ultimately triggers a reboot.
CVSS Score: 7.5 (HIGH)
CWE: CWE-425, CWE-425
References: https://www.corporate.carrier.com/product-security/advisories-resources/; https://www.corporate.carrier.com/product-security/advisories-resources/
CVE: CVE-2022-31481
Published: 2022-06-06
Description: An unauthenticated attacker can send a specially crafted update file to the device that can overflow a buffer. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.302 for the LP series and 1.296 for the EP series. The overflowed data can allow the attacker to manipulate the “normal” code execution to that of their choosing. An attacker with this level of access on the device can monitor all communications sent to and from this device, modify onboard relays, change configuration files, or cause the device to become unstable.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://www.corporate.carrier.com/product-security/advisories-resources/; https://www.corporate.carrier.com/product-security/advisories-resources/
CVE: CVE-2022-31482
Published: 2022-06-06
Description: An unauthenticated attacker can send a specially crafted unauthenticated HTTP request to the device that can overflow a buffer. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.29. The overflowed data leads to segmentation fault and ultimately a denial-of-service condition, causing the device to reboot. The impact of this vulnerability is that an unauthenticated attacker could leverage this flaw to cause the target device to become unresponsive. An attacker could automate this attack to achieve persistent DoS, effectively rendering the target controller useless.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://www.corporate.carrier.com/product-security/advisories-resources/; https://www.corporate.carrier.com/product-security/advisories-resources/
CVE: CVE-2022-31483
Published: 2022-06-06
Description: An authenticated attacker can upload a file with a filename including “..” and “/” to achieve the ability to upload the desired file anywhere on the filesystem. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.271. This allows a malicious actor to overwrite sensitive system files and install a startup service to gain remote access to the underlaying Linux operating system with root privileges.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://www.corporate.carrier.com/product-security/advisories-resources/; https://www.corporate.carrier.com/product-security/advisories-resources/
CVE: CVE-2022-31484
Published: 2022-06-06
Description: An unauthenticated attacker can send a specially crafted network packet to delete a user from the web interface. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.29. The impact of this vulnerability is that an unauthenticated attacker could restrict access to the web interface to legitimate users and potentially requiring them to use the default user dip switch procedure to gain access back.
CVSS Score: 7.5 (HIGH)
CWE: CWE-425, CWE-425
References: https://www.corporate.carrier.com/product-security/advisories-resources/; https://www.corporate.carrier.com/product-security/advisories-resources/
CVE: CVE-2022-31485
Published: 2022-06-06
Description: An unauthenticated attacker can send a specially crafted packets to update the “notes” section of the home page of the web interface. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.29.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-425, CWE-425
References: https://www.corporate.carrier.com/product-security/advisories-resources/; https://www.corporate.carrier.com/product-security/advisories-resources/
CVE: CVE-2022-31486
Published: 2022-06-06
Description: An authenticated attacker can send a specially crafted route to the “edit_route.cgi” binary and have it execute shell commands. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.303 for the LP series and 1.297 for the EP series. An attacker with this level of access on the device can monitor all communications sent to and from this device, modify onboard relays, change configuration files, or cause the device to become unstable.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.corporate.carrier.com/product-security/advisories-resources/; https://www.corporate.carrier.com/product-security/advisories-resources/
CVE: CVE-2022-1680
Published: 2022-06-06
Description: An account takeover issue has been discovered in GitLab EE affecting all versions starting from 11.10 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1. When group SAML SSO is configured, the SCIM feature (available only on Premium+ subscriptions) may allow any owner of a Premium group to invite arbitrary users through their username and email, then change those users' email addresses via SCIM to an attacker controlled email address and thus - in the absence of 2FA - take over those accounts. It is also possible for the attacker to change the display name and username of the targeted account.
CVSS Score: 9.9 (CRITICAL)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1680.json; https://gitlab.com/gitlab-org/gitlab/-/issues/363058; https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1680.json
CVE: CVE-2022-1966
Published: 2022-06-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-32250. Reason: This candidate is a duplicate of CVE-2022-32250. Notes: All CVE users should reference CVE-2022-32250 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2022-21745
Published: 2022-06-06
Description: In WIFI Firmware, there is a possible memory corruption due to a use after free. This could lead to remote escalation of privilege, when devices are connecting to the attacker-controllable Wi-Fi hotspot, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06468872; Issue ID: ALPS06468872.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://corp.mediatek.com/product-security-bulletin/June-2022; https://corp.mediatek.com/product-security-bulletin/June-2022
CVE: CVE-2022-21746
Published: 2022-06-06
Description: In imgsensor, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06479698; Issue ID: ALPS06479698.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/June-2022; https://corp.mediatek.com/product-security-bulletin/June-2022
CVE: CVE-2022-21747
Published: 2022-06-06
Description: In imgsensor, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06478078; Issue ID: ALPS06478078.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/June-2022; https://corp.mediatek.com/product-security-bulletin/June-2022
CVE: CVE-2022-21748
Published: 2022-06-06
Description: In telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS06511030; Issue ID: ALPS06511030.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://corp.mediatek.com/product-security-bulletin/June-2022; https://corp.mediatek.com/product-security-bulletin/June-2022
CVE: CVE-2022-21749
Published: 2022-06-06
Description: In telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06511058; Issue ID: ALPS06511058.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://corp.mediatek.com/product-security-bulletin/June-2022; https://corp.mediatek.com/product-security-bulletin/June-2022
CVE: CVE-2022-21750
Published: 2022-06-06
Description: In WLAN driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06521283; Issue ID: ALPS06521283.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/June-2022; https://corp.mediatek.com/product-security-bulletin/June-2022
CVE: CVE-2022-21751
Published: 2022-06-06
Description: In WLAN driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06511132; Issue ID: ALPS06511132.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/June-2022; https://corp.mediatek.com/product-security-bulletin/June-2022
CVE: CVE-2022-21752
Published: 2022-06-06
Description: In WLAN driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06493873; Issue ID: ALPS06493873.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/June-2022; https://corp.mediatek.com/product-security-bulletin/June-2022
CVE: CVE-2022-21753
Published: 2022-06-06
Description: In WLAN driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06493873; Issue ID: ALPS06493899.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/June-2022; https://corp.mediatek.com/product-security-bulletin/June-2022
CVE: CVE-2022-21754
Published: 2022-06-06
Description: In WLAN driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06535953; Issue ID: ALPS06535953.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/June-2022; https://corp.mediatek.com/product-security-bulletin/June-2022