CVEs published June 13, 2022
146 CVEs were published on June 13, 2022: 11 critical, 19 high.
- Published
- 146
- Critical
- 11
- High
- 19
- Medium
- 21
- Low
- 4
- Unrated
- 91
- Now in CISA KEV
- 0
- Fix available
- 31
Most affected products
- Huawei HarmonyOS · Huawei EMUI +1
- 11
- Festo Controller CECC-X-M1 · Festo Controller CECC-X-M1-… +6
- 4
- Huawei EMUI · Huawei Magic UI
- 4
- Navetti PricePoint
- 4
- Amodat
- 3
- nocodb/nocodb · nocodb
- 3
- Rakuten Mobile Rakuten Casa
- 3
- Adobe Media Encoder
- 2
- ArtBees Jupiter
- 2
- CV81-WDM FW
- 2
Critical 11
- CVE-2022-31053Signature forgery in Biscuitbiscuit-auth biscuit · github.com/biscuit-auth/biscuit-go +2
- CVE-2022-33174Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 allows remote authorization bypass in the web interfa
- CVE-2022-33175Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 have an insecure permissions setting on the user.toke
- CVE-2022-30311FESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerabilityFesto Controller CECC-X-M1 · Festo Controller CECC-X-M1-… +6
- CVE-2022-30310FESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerabilityFesto Controller CECC-X-M1 · Festo Controller CECC-X-M1-… +6
- CVE-2022-30309FESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerabilityFesto Controller CECC-X-M1 · Festo Controller CECC-X-M1-… +6
- CVE-2022-30308FESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerabilityFesto Controller CECC-X-M1 · Festo Controller CECC-X-M1-… +6
- CVE-2022-1768RSVPMaker <= 9.3.2 - Unauthenticated SQL Injectiondavidfcarr RSVPMaker
- CVE-2022-2064Insufficient Session Expiration in nocodb/nocodbnocodb/nocodb · nocodb
- CVE-2022-2063Improper Privilege Management in nocodb/nocodbnocodb/nocodb · nocodb
- CVE-2022-2062Generation of Error Message Containing Sensitive Information in nocodb/nocodbnocodb/nocodb · nocodb
High 19
- CVE-2022-31054Uses of deprecated API can be used to cause DoS in user-facing endpoints in Argo Eventsargoproj argo-events · github.com/argoproj/argo-events
- CVE-2022-31055Improper Access Control in kctfgoogle kctf
- CVE-2022-29244npm packing does not respect root-level ignore files in workspacesnpm
- CVE-2022-1654Jupiter Theme <= 6.10.1 and JupiterX Core Plugin <= 2.0.7 - Authenticated Privilege EscalationArtBees Jupiter X Core · ArtBees Jupiter
- CVE-2022-1969Mobile browser color select <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scriptingscriptcoil Mobile browser color select
- CVE-2022-1749WPMK Ajax Finder <= 1.0.1 - Cross-Site Request Forgery to Cross-Site Scriptingcreateplugin WPMK Ajax Finder
- CVE-2022-1657JupiterX Theme <= 2.0.6 and Jupiter Theme <= 6.10.1 - Authenticated Path Traversal and Local File InclusionArtBees Jupiter
- CVE-2022-1900Copify <= 1.3.0 - Cross-Site Request Forgery to Cross-Site Scriptingrobmcvey Copify
- CVE-2022-1918ToolBar to Share <= 2.0 - Cross-Site Request Forgery to Cross-Site Scriptingmiguelo2008 ToolBar to Share
- CVE-2022-31041Insufficient content-type validation for uploaded files in open-formsopen-formulieren open-forms
- CVE-2022-2067SQL Injection in francoisjacquet/rosariosisfrancoisjacquet/rosariosis
- CVE-2021-46816Adobe Premiere Pro M4A file memory corruption vulnerability could lead to remote code executionAdobe Premiere
- CVE-2021-46817Adobe Media Encoder M4A file memory corruption vulnerability could lead to remote code executionAdobe Media Encoder
- CVE-2022-2066Cross-site Scripting (XSS) - Reflected in neorazorx/facturascriptsneorazorx/facturascripts · facturascripts/facturascripts
- CVE-2022-2065Cross-site Scripting (XSS) - Stored in neorazorx/facturascriptsneorazorx/facturascripts · facturascripts/facturascripts
- CVE-2022-31040Open Redirect in open-formsopen-formulieren open-forms
- CVE-2021-46818Adobe Media Encoder M4A file memory corruption vulnerability could lead to remote code executionAdobe Media Encoder
- CVE-2022-2060Cross-site Scripting (XSS) - Stored in dolibarr/dolibarrdolibarr/dolibarr
- CVE-2017-20045Navetti PricePoint cross-site request forgeryNavetti PricePoint
Medium, low and unrated 116
- CVE-2021-41662The South Gate Inn Online Reservation System v1.0 contains an SQL injection vulnerability that can be chained with a malicious PHP file uplo
- CVE-2021-41661Church Management System version 1.0 is affected by a SQL anjection vulnerability through creating a user with a PHP file as an avatar image
- CVE-2022-32565An issue was discovered in Couchbase Server before 7.0.4.
- CVE-2022-32562An issue was discovered in Couchbase Server before 7.0.4.
- CVE-2022-32192Couchbase Server 5.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor.
- CVE-2022-32278XFCE 4.16 allows attackers to execute arbitrary code because xdg-open can execute a .desktop file on an attacker-controlled FTP server.
- CVE-2022-29257Electron's AutoUpdater module fails to validate certain nested components of the bundleelectron
- CVE-2022-29247Exposure of Resource to Wrong Sphere in Electronelectron
- CVE-2022-32193Couchbase Server 6.6.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor.
- CVE-2022-32558An issue was discovered in Couchbase Server before 7.0.4.
- CVE-2022-32560An issue was discovered in Couchbase Server before 7.0.4.
- CVE-2022-32564An issue was discovered in Couchbase Server before 7.0.4.
- CVE-2022-22259There is an improper authentication vulnerability in FLMG-10 10.0.1.0(H100SP22C00).FLMG-10
- CVE-2022-29797There is a buffer overflow vulnerability in CV81-WDM FW 01.70.49.29.46.CV81-WDM FW
- CVE-2022-29798There is a denial of service vulnerability in CV81-WDM FW versions 01.70.49.29.46.CV81-WDM FW
- CVE-2021-40036The bone voice ID TA has a memory overwrite vulnerability.HarmonyOS
- CVE-2021-40604A Server-Side Request Forgery (SSRF) vulnerability in IPS Community Suite before 4.6.2 allows remote authenticated users to request arbitrar
- CVE-2021-41663A cross-site scripting (XSS) vulnerability exists in Mini CMS V1.11.
- CVE-2022-23169Amodat - Mobile Application Gateway SQL Injection (SQLi)Amodat
- CVE-2022-23168Amodat - Mobile Application Gateway SQL Injection (SQLi)Amodat
- CVE-2022-23167Amodat - Mobile Application Gateway Local File Inclusion (LFI)Amodat
- CVE-2022-29455WordPress Elementor plugin <= 3.5.5 - Unauthenticated DOM-based Reflected Cross-Site Scripting (XSS) vulnerabilityElementor Website Builder
- CVE-2022-28217Some part of SAP NetWeaver (EP Web Page Composer) does not sufficiently validate an XML document accepted from an untrusted source, which alSAP SE SAP NetWeaver
- CVE-2022-31752Missing authorization vulnerability in the system components.Huawei EMUI · Huawei Magic UI
- CVE-2022-31761Configuration defects in the secure OS module.Huawei EMUI · Huawei Magic UI
- CVE-2021-46813Vulnerability of residual files not being deleted after an update in the ChinaDRM module.Huawei EMUI · Huawei Magic UI
- CVE-2022-31754Logical defects in code implementation in some products.Huawei EMUI · Huawei Magic UI
- CVE-2021-46811HwSEServiceAPP has a vulnerability in permission management.Huawei HarmonyOS · Huawei EMUI +1
- CVE-2022-31753The voice wakeup module has a vulnerability of using externally-controlled format strings.Huawei HarmonyOS · Huawei EMUI +1
- CVE-2022-31757The setting module has a vulnerability of improper use of APIs.Huawei HarmonyOS · Huawei EMUI +1
- CVE-2021-46812The Device Manager has a vulnerability in multi-device interaction.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-31760Dialog boxes can still be displayed even if the screen is locked in carrier-customized USSD services.Huawei HarmonyOS · Huawei EMUI +1
- CVE-2022-31762The AMS module has a vulnerability in input validation.Huawei HarmonyOS · Huawei EMUI +1
- CVE-2022-31759AppLink has a vulnerability of accessing uninitialized pointers.Huawei HarmonyOS · Huawei EMUI +1
- CVE-2022-31755The communication module has a vulnerability of improper permission preservation.Huawei HarmonyOS · Huawei EMUI +1
- CVE-2022-31756The fingerprint sensor module has design defects.Huawei HarmonyOS · Huawei EMUI +1
- CVE-2022-31751The kernel emcom module has multi-thread contention.Huawei HarmonyOS · Huawei EMUI +1
- CVE-2022-31758The kernel module has the race condition vulnerability.Huawei HarmonyOS · Huawei EMUI +1
- CVE-2022-31763The kernel module has the null pointer and out-of-bounds array vulnerabilities.Huawei HarmonyOS · Huawei EMUI
- CVE-2021-46814The video framework has an out-of-bounds memory read/write vulnerability.Huawei HarmonyOS · Huawei EMUI +1
- CVE-2022-24077Naver Cloud Explorer Beta allows the attacker to execute arbitrary code as System privilege via malicious DLL injection.NAVER Cloud Explorer Beta
- CVE-2022-1750Sticky Popup <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scriptingnumixtech Sticky Popup
- CVE-2022-1659JupiterX Core <= 2.0.6 - Information Disclosure, Modification, and Denial of ServiceArtBees Jupiter X Core
- CVE-2022-1658Jupiter Theme <= 6.10.1 - Authenticated Arbitrary Plugin DeletionArtBees Jupiter
- CVE-2022-1961Google Tag Manager for WordPress (GTM4WP) <= 1.15.1 - Stored Cross-Site Scripting via Content Element IDduracelltomi GTM4WP – A Google Tag Manager (GTM) plugin for…
- CVE-2022-0209Mitsol Social Post Feed < 1.11 - Admin+ Stored Cross-Site ScriptingMitsol Social Post Feed
- CVE-2022-1820Keep Backup Daily <= 2.0.2 - Reflected Cross-Site Scriptingfahadmahmood Keep Backup Daily
- CVE-2022-31400A cross-site scripting (XSS) vulnerability in /staff/setup/email-addresses of Helpdeskz v2.0.2 allows attackers to execute arbitrary web scr
- CVE-2022-31398A cross-site scripting (XSS) vulnerability in /staff/tools/custom-fields of Helpdeskz v2.0.2 allows attackers to execute arbitrary web scrip
- CVE-2022-1707Google Tag Manager for WordPress <= 1.15 - Reflected Cross-Site Scripting via Site Searchduracelltomi GTM4WP – A Google Tag Manager (GTM) plugin for…
- CVE-2022-1985Download Manager <= 3.2.42 - Reflected Cross-Site Scriptingcodename065 Download Manager
- CVE-2022-1208Ultimate Member <= 2.3.2 - Stored Cross-Site Scriptingultimatemember Ultimate Member – User Profile, Registration…
- CVE-2022-1814WP Admin Style <= 0.1.2 - Admin+ Stored Cross-Site ScriptingWP Admin Style
- CVE-2022-1800Export any WordPress data to XML/CSV < 1.3.5 - Admin+ SQL InjectionExport any WordPress data to XML/CSV
- CVE-2022-1793Private Files <= 0.40 - Protection Disabling via CSRFPrivate Files
- CVE-2022-1792Quick Subscribe <= 1.7.1 - Arbitrary Settings Update via CSRF to Stored XSSQuick Subscribe
- CVE-2022-1791One Click Plugin Updater <= 2.4.14 - Arbitrary Settings Update via CSRFOne Click Plugin Updater
- CVE-2022-1790New User Email Set Up <= 0.5.2 - Arbitrary Settings Update via CSRFNew User Email Set Up
- CVE-2022-1788Change Uploaded File Permissions <= 4.0.0 - File Permission Update via CSRFChange Uploaded File Permissions
- CVE-2022-1787Sideblog <= 6.0 - Arbitrary Settings Update via CSRF to Stored XSSSideblog WordPress Plugin
- CVE-2022-1781postTabs <= 2.10.6 - Arbitrary Settings Update via CSRF to Stored XSSpostTabs
- CVE-2022-1780LaTeX for WordPress <= 3.4.10 - Arbitrary Settings Update via CSRF to Stored XSSLaTeX for WordPress
- CVE-2022-1779Auto Delete Posts <= 1.3.0 - Arbitrary Settings Update via CSRFAuto Delete Posts
- CVE-2022-1777Filr - Secure Document Library < 1.2.2.1 - Subscriber+ AJAX CallsFilr – Secure document library
- CVE-2022-1773WP Athletics <= 1.1.7 - Reflected Cross-Site ScriptingWP Athletics
- CVE-2022-1772Google Places Review < 2.0.0 - Admin+ Stored Cross Site ScriptingGoogle Places Reviews
- CVE-2022-1765Hot Linked Image Cacher <= 1.16 - Image upload/cache abuse via CSRFHot Linked Image Cacher
- CVE-2022-1764WP-chgFontSize <= 1.8 - Arbitrary Settings Update via CSRF to Stored XSSWP-chgFontSize
- CVE-2022-1763Static Page eXtended <= 2.1 - Arbitrary Settings Update via CSRF to Stored XSSStatic Page eXtended
- CVE-2022-1762iQ Block Country < 1.2.20 - Protection Bypass due to IP SpoofingiQ Block Country
- CVE-2022-1761Peter’s Collaboration E-mails <= 2.2.0 - Arbitrary Settings Update via CSRFPeter’s Collaboration E-mails
- CVE-2022-1759RB Internal Links <= 2.0.16 - Stored Cross-Site Scripting via CSRFRB Internal Links
- CVE-2022-1758Genki Pre-Publish Reminder <= 1.4.1 - Stored XSS & RCE via CSRFGenki Pre-Publish Reminder
- CVE-2022-1756Newsletter < 7.4.5 - Reflected Cross-Site ScriptingNewsletter – Send awesome emails from WordPress
- CVE-2022-1724Simple Membership < 4.1.1 - Reflected Cross-Site ScriptingSimple Membership
- CVE-2022-1710Appointment Hour Booking < 1.3.56 - Admin+ Stored Cross-Site ScriptingAppointment Hour Booking – WordPress Booking Plugin
- CVE-2022-1694Useful Banner Manager <= 1.6.1 - Modify banners via CSRFUseful Banner Manager
- CVE-2022-1624Latest Tweets Widget <= 1.1.4 - Arbitrary Settings Update via CSRFLatest Tweets Widget
- CVE-2022-1612Webriti SMTP Mail <= 1.0 - Arbitrary Settings Update via CSRFWebriti SMTP Mail
- CVE-2022-1608OnePress Social Locker <= 5.6.2 - Arbitrary Settings Update via CSRFOnePress Social Locker
- CVE-2022-1605Email Users <= 4.8.8 - Arbitrary Settings Update via CSRFEmail Users
- CVE-2022-1604MailerLite < 1.5.4 - Reflected Cross-Site ScriptingMailerLite – Signup forms
- CVE-2022-1595HC Custom WP-Admin URL <= 1.4 - Unauthenticated Secret URL DisclosureHC Custom WP-Admin URL
- CVE-2022-1594HC Custom WP-Admin URL <= 1.4 - Arbitrary Settings Update via CSRFHC Custom WP-Admin URL
- CVE-2022-1549WP Athletics <= 1.1.7 - Subscriber+ Stored Cross-Site ScriptingWP Athletics
- CVE-2022-1532Themify - WooCommerce Product Filter < 1.3.8 - Reflected Cross-Site ScriptingThemify – WooCommerce Product Filter
- CVE-2022-1412Log WP_Mail <= 0.1 - Email Logs Publicly AccessibleLog WP_Mail
- CVE-2022-1336Carousel CK <= 1.1.0 - Admin+ Stored Cross-Site ScriptingCarousel CK
- CVE-2022-1335Slideshow CK < 1.4.10 - Admin+ Stored Cross-Site ScriptingSlideshow CK
- CVE-2022-1202WP-CRM <= 1.2.1 - CSV InjectionWP-CRM – Customer Relations Management for WordPress
- CVE-2022-0885Member Hero <= 1.0.9 - Unauthenticated RCEMember Hero
- CVE-2022-0863WP SVG Icons <= 3.2.3 - Admin+ Remote Code Execution (RCE)WP SVG Icons
- CVE-2022-0827Bestbooks <= 2.6.3 - Unauthenticated SQLiBestbooks
- CVE-2022-0786KiviCare < 2.3.9 - Unauthenticated SQLiKiviCare – Clinic & Patient Management System
- CVE-2022-1656JupiterX Theme <= 2.0.6 and JupiterX Core <= 2.0.6 - Authenticated Arbitrary Plugin Deactivation and Settings ModificationArtBees Jupiter X Core · ArtBees Jupiter X
- CVE-2022-0745Like Button Rating < 2.6.45 - Arbitrary e-mail SendingLike Button Rating ♥ LikeBtn
- CVE-2022-0626Advanced Admin Search < 1.1.6 - Reflected Cross-Site ScriptingAdvanced Admin Search
- CVE-2021-25116Enqueue Anything <= 1.0.1 - Subscriber+ Arbitrary Asset/Post DeletionEnqueue Anything
- CVE-2022-1822Zephyr Project Manager <= 3.2.40 - Reflected Cross-Site Scriptingdylanjkotze Zephyr Project Manager
- CVE-2021-40902flatCore-CMS version 2.0.8 is affected by Cross Site Scripting (XSS) in the "Create New Page" option through the index page.
- CVE-2022-2061Heap-based Buffer Overflow in hpjansson/chafahpjansson/chafa
- CVE-2022-32741Information disclosure in Request New Password featureOTRS AG OTRS
- CVE-2022-32740Information disclosure in the External InterfaceOTRS AG OTRS
- CVE-2022-32739OTRS version number is always in the exported ICS filesOTRS AG OTRS · OTRS AG OTRSCalendarResourcePlanning
- CVE-2021-37404Heap buffer overflow in libhdfs native libraryApache Software Foundation Apache Hadoop · org.apache.hadoo…
- CVE-2017-20044Navetti PricePoint Reflected cross site scritingNavetti PricePoint
- CVE-2017-20043Navetti PricePoint Persistent cross site scritingNavetti PricePoint
- CVE-2017-20042Navetti PricePoint Blind sql injectionNavetti PricePoint
- CVE-2017-20041Ucweb UC Browser HTML URL improper restriction of rendered ui layersUcweb UC Browser
- CVE-2022-29894Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function.Strapi
- CVE-2022-29525Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 uses a hard-coded credential which may allow a remote unauthenticated attacker to log in witRakuten Mobile Rakuten Casa
- CVE-2022-28704Improper access control vulnerability in Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 allows a remote attacker to log in with the root prRakuten Mobile Rakuten Casa
- CVE-2022-27231Cross-site scripting vulnerability exists in WP Statistics versions prior to 13.2.0 because it improperly processes a platform parameter.VeronaLabs WP Statistics
- CVE-2022-27174Cross-site request forgery (CSRF) vulnerability in Easy Blog for EC-CUBE4 Ver.1.0.1 and earlier allows a remote unauthenticated attacker to COREMOBILE Co. Easy Blog for EC-CUBE4
- CVE-2022-26834Improper access control vulnerability in Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 allows a remote attacker to obtain the information Rakuten Mobile Rakuten Casa
- CVE-2022-26041Directory traversal vulnerability in RCCMD 4.26 and earlier allows a remote authenticated attacker with an administrative privilege to read GENEREX SYSTEMS Computervertriebsgesellschaft mbH RCCMD