# CVEs published 2022-06-13

146 CVEs were published on June 13, 2022: 11 critical, 19 high. Days are UTC.

- [CVE-2021-41662](https://cve.now/CVE-2021-41662.md): The South Gate Inn Online Reservation System v1.0 contains an SQL injection vulnerability that can be chained with a malicious PHP file uplo (no CVSS)
- [CVE-2021-41661](https://cve.now/CVE-2021-41661.md): Church Management System version 1.0 is affected by a SQL anjection vulnerability through creating a user with a PHP file as an avatar image (no CVSS)
- [CVE-2022-32565](https://cve.now/CVE-2022-32565.md): An issue was discovered in Couchbase Server before 7.0.4. (no CVSS)
- [CVE-2022-32562](https://cve.now/CVE-2022-32562.md): An issue was discovered in Couchbase Server before 7.0.4. (no CVSS)
- [CVE-2022-32192](https://cve.now/CVE-2022-32192.md): Couchbase Server 5.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor. (no CVSS)
- [CVE-2022-32278](https://cve.now/CVE-2022-32278.md): XFCE 4.16 allows attackers to execute arbitrary code because xdg-open can execute a .desktop file on an attacker-controlled FTP server. (no CVSS)
- [CVE-2022-29257](https://cve.now/CVE-2022-29257.md): Electron's AutoUpdater module fails to validate certain nested components of the bundle (CVSS 6.6, electron)
- [CVE-2022-29247](https://cve.now/CVE-2022-29247.md): Exposure of Resource to Wrong Sphere in Electron (CVSS 2.2, electron)
- [CVE-2022-32193](https://cve.now/CVE-2022-32193.md): Couchbase Server 6.6.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor. (no CVSS)
- [CVE-2022-32558](https://cve.now/CVE-2022-32558.md): An issue was discovered in Couchbase Server before 7.0.4. (no CVSS)
- [CVE-2022-32560](https://cve.now/CVE-2022-32560.md): An issue was discovered in Couchbase Server before 7.0.4. (no CVSS)
- [CVE-2022-32564](https://cve.now/CVE-2022-32564.md): An issue was discovered in Couchbase Server before 7.0.4. (no CVSS)
- [CVE-2022-31054](https://cve.now/CVE-2022-31054.md): Uses of deprecated API can be used to cause DoS in user-facing endpoints in Argo Events (CVSS 7.5, argoproj argo-events · github.com/argoproj/argo-events)
- [CVE-2022-31053](https://cve.now/CVE-2022-31053.md): Signature forgery in Biscuit (CVSS 9.8, biscuit-auth biscuit · github.com/biscuit-auth/biscuit-go +2)
- [CVE-2022-22259](https://cve.now/CVE-2022-22259.md): There is an improper authentication vulnerability in FLMG-10 10.0.1.0(H100SP22C00). (no CVSS, FLMG-10)
- [CVE-2022-29797](https://cve.now/CVE-2022-29797.md): There is a buffer overflow vulnerability in CV81-WDM FW 01.70.49.29.46. (no CVSS, CV81-WDM FW)
- [CVE-2022-29798](https://cve.now/CVE-2022-29798.md): There is a denial of service vulnerability in CV81-WDM FW versions 01.70.49.29.46. (no CVSS, CV81-WDM FW)
- [CVE-2021-40036](https://cve.now/CVE-2021-40036.md): The bone voice ID TA has a memory overwrite vulnerability. (no CVSS, HarmonyOS)
- [CVE-2021-40604](https://cve.now/CVE-2021-40604.md): A Server-Side Request Forgery (SSRF) vulnerability in IPS Community Suite before 4.6.2 allows remote authenticated users to request arbitrar (no CVSS)
- [CVE-2021-41663](https://cve.now/CVE-2021-41663.md): A cross-site scripting (XSS) vulnerability exists in Mini CMS V1.11. (no CVSS)
- [CVE-2022-33174](https://cve.now/CVE-2022-33174.md): Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 allows remote authorization bypass in the web interfa (CVSS 9.8)
- [CVE-2022-33175](https://cve.now/CVE-2022-33175.md): Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 have an insecure permissions setting on the user.toke (CVSS 9.8)
- [CVE-2022-23169](https://cve.now/CVE-2022-23169.md): Amodat - Mobile Application Gateway SQL Injection (SQLi) (CVSS 5.9, Amodat)
- [CVE-2022-23168](https://cve.now/CVE-2022-23168.md): Amodat - Mobile Application Gateway SQL Injection (SQLi) (CVSS 5.9, Amodat)
- [CVE-2022-23167](https://cve.now/CVE-2022-23167.md): Amodat - Mobile Application Gateway Local File Inclusion (LFI) (CVSS 5.3, Amodat)
- [CVE-2022-29455](https://cve.now/CVE-2022-29455.md): WordPress Elementor plugin \<= 3.5.5 - Unauthenticated DOM-based Reflected Cross-Site Scripting (XSS) vulnerability (CVSS 4.7, Elementor Website Builder)
- [CVE-2022-28217](https://cve.now/CVE-2022-28217.md): Some part of SAP NetWeaver (EP Web Page Composer) does not sufficiently validate an XML document accepted from an untrusted source, which al (no CVSS, SAP SE SAP NetWeaver)
- [CVE-2022-31055](https://cve.now/CVE-2022-31055.md): Improper Access Control in kctf (CVSS 7.5, google kctf)
- [CVE-2022-31752](https://cve.now/CVE-2022-31752.md): Missing authorization vulnerability in the system components. (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2022-31761](https://cve.now/CVE-2022-31761.md): Configuration defects in the secure OS module. (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-46813](https://cve.now/CVE-2021-46813.md): Vulnerability of residual files not being deleted after an update in the ChinaDRM module. (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2022-31754](https://cve.now/CVE-2022-31754.md): Logical defects in code implementation in some products. (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-46811](https://cve.now/CVE-2021-46811.md): HwSEServiceAPP has a vulnerability in permission management. (no CVSS, Huawei HarmonyOS · Huawei EMUI +1)
- [CVE-2022-31753](https://cve.now/CVE-2022-31753.md): The voice wakeup module has a vulnerability of using externally-controlled format strings. (no CVSS, Huawei HarmonyOS · Huawei EMUI +1)
- [CVE-2022-31757](https://cve.now/CVE-2022-31757.md): The setting module has a vulnerability of improper use of APIs. (no CVSS, Huawei HarmonyOS · Huawei EMUI +1)
- [CVE-2021-46812](https://cve.now/CVE-2021-46812.md): The Device Manager has a vulnerability in multi-device interaction. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-31760](https://cve.now/CVE-2022-31760.md): Dialog boxes can still be displayed even if the screen is locked in carrier-customized USSD services. (no CVSS, Huawei HarmonyOS · Huawei EMUI +1)
- [CVE-2022-31762](https://cve.now/CVE-2022-31762.md): The AMS module has a vulnerability in input validation. (no CVSS, Huawei HarmonyOS · Huawei EMUI +1)
- [CVE-2022-31759](https://cve.now/CVE-2022-31759.md): AppLink has a vulnerability of accessing uninitialized pointers. (no CVSS, Huawei HarmonyOS · Huawei EMUI +1)
- [CVE-2022-31755](https://cve.now/CVE-2022-31755.md): The communication module has a vulnerability of improper permission preservation. (no CVSS, Huawei HarmonyOS · Huawei EMUI +1)
- [CVE-2022-31756](https://cve.now/CVE-2022-31756.md): The fingerprint sensor module has design defects. (no CVSS, Huawei HarmonyOS · Huawei EMUI +1)
- [CVE-2022-31751](https://cve.now/CVE-2022-31751.md): The kernel emcom module has multi-thread contention. (no CVSS, Huawei HarmonyOS · Huawei EMUI +1)
- [CVE-2022-31758](https://cve.now/CVE-2022-31758.md): The kernel module has the race condition vulnerability. (no CVSS, Huawei HarmonyOS · Huawei EMUI +1)
- [CVE-2022-31763](https://cve.now/CVE-2022-31763.md): The kernel module has the null pointer and out-of-bounds array vulnerabilities. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2021-46814](https://cve.now/CVE-2021-46814.md): The video framework has an out-of-bounds memory read/write vulnerability. (no CVSS, Huawei HarmonyOS · Huawei EMUI +1)
- [CVE-2022-30311](https://cve.now/CVE-2022-30311.md): FESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerability (CVSS 9.8, Festo Controller CECC-X-M1 · Festo Controller CECC-X-M1-… +6)
- [CVE-2022-30310](https://cve.now/CVE-2022-30310.md): FESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerability (CVSS 9.8, Festo Controller CECC-X-M1 · Festo Controller CECC-X-M1-… +6)
- [CVE-2022-30309](https://cve.now/CVE-2022-30309.md): FESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerability (CVSS 9.8, Festo Controller CECC-X-M1 · Festo Controller CECC-X-M1-… +6)
- [CVE-2022-30308](https://cve.now/CVE-2022-30308.md): FESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerability (CVSS 9.8, Festo Controller CECC-X-M1 · Festo Controller CECC-X-M1-… +6)
- [CVE-2022-29244](https://cve.now/CVE-2022-29244.md): npm packing does not respect root-level ignore files in workspaces (CVSS 7.5, npm)
- [CVE-2022-24077](https://cve.now/CVE-2022-24077.md): Naver Cloud Explorer Beta allows the attacker to execute arbitrary code as System privilege via malicious DLL injection. (no CVSS, NAVER Cloud Explorer Beta)
- [CVE-2022-1750](https://cve.now/CVE-2022-1750.md): Sticky Popup \<= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 5.5, numixtech Sticky Popup)
- [CVE-2022-1659](https://cve.now/CVE-2022-1659.md): JupiterX Core \<= 2.0.6 - Information Disclosure, Modification, and Denial of Service (CVSS 5.4, ArtBees Jupiter X Core)
- [CVE-2022-1654](https://cve.now/CVE-2022-1654.md): Jupiter Theme \<= 6.10.1 and JupiterX Core Plugin \<= 2.0.7 - Authenticated Privilege Escalation (CVSS 8.8, ArtBees Jupiter X Core · ArtBees Jupiter)
- [CVE-2022-1969](https://cve.now/CVE-2022-1969.md): Mobile browser color select \<= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 8.8, scriptcoil Mobile browser color select)
- [CVE-2022-1658](https://cve.now/CVE-2022-1658.md): Jupiter Theme \<= 6.10.1 - Authenticated Arbitrary Plugin Deletion (CVSS 5.4, ArtBees Jupiter)
- [CVE-2022-1749](https://cve.now/CVE-2022-1749.md): WPMK Ajax Finder \<= 1.0.1 - Cross-Site Request Forgery to Cross-Site Scripting (CVSS 8.8, createplugin WPMK Ajax Finder)
- [CVE-2022-1961](https://cve.now/CVE-2022-1961.md): Google Tag Manager for WordPress (GTM4WP) \<= 1.15.1 - Stored Cross-Site Scripting via Content Element ID (CVSS 5.5, duracelltomi GTM4WP – A Google Tag Manager (GTM) plugin for…)
- [CVE-2022-0209](https://cve.now/CVE-2022-0209.md): Mitsol Social Post Feed \< 1.11 - Admin+ Stored Cross-Site Scripting (CVSS 4.8, Mitsol Social Post Feed)
- [CVE-2022-1820](https://cve.now/CVE-2022-1820.md): Keep Backup Daily \<= 2.0.2 - Reflected Cross-Site Scripting (CVSS 6.1, fahadmahmood Keep Backup Daily)
- [CVE-2022-1768](https://cve.now/CVE-2022-1768.md): RSVPMaker \<= 9.3.2 - Unauthenticated SQL Injection (CVSS 9.8, davidfcarr RSVPMaker)
- [CVE-2022-1657](https://cve.now/CVE-2022-1657.md): JupiterX Theme \<= 2.0.6 and Jupiter Theme \<= 6.10.1 - Authenticated Path Traversal and Local File Inclusion (CVSS 8.8, ArtBees Jupiter)
- [CVE-2022-31400](https://cve.now/CVE-2022-31400.md): A cross-site scripting (XSS) vulnerability in /staff/setup/email-addresses of Helpdeskz v2.0.2 allows attackers to execute arbitrary web scr (no CVSS)
- [CVE-2022-31398](https://cve.now/CVE-2022-31398.md): A cross-site scripting (XSS) vulnerability in /staff/tools/custom-fields of Helpdeskz v2.0.2 allows attackers to execute arbitrary web scrip (no CVSS)
- [CVE-2022-1900](https://cve.now/CVE-2022-1900.md): Copify \<= 1.3.0 - Cross-Site Request Forgery to Cross-Site Scripting (CVSS 8.8, robmcvey Copify)
- [CVE-2022-1918](https://cve.now/CVE-2022-1918.md): ToolBar to Share \<= 2.0 - Cross-Site Request Forgery to Cross-Site Scripting (CVSS 8.8, miguelo2008 ToolBar to Share)
- [CVE-2022-1707](https://cve.now/CVE-2022-1707.md): Google Tag Manager for WordPress \<= 1.15 - Reflected Cross-Site Scripting via Site Search (CVSS 6.1, duracelltomi GTM4WP – A Google Tag Manager (GTM) plugin for…)
- [CVE-2022-1985](https://cve.now/CVE-2022-1985.md): Download Manager \<= 3.2.42 - Reflected Cross-Site Scripting (CVSS 6.1, codename065 Download Manager)
- [CVE-2022-1208](https://cve.now/CVE-2022-1208.md): Ultimate Member \<= 2.3.2 - Stored Cross-Site Scripting (CVSS 6.4, ultimatemember Ultimate Member – User Profile, Registration…)
- [CVE-2022-1814](https://cve.now/CVE-2022-1814.md): WP Admin Style \<= 0.1.2 - Admin+ Stored Cross-Site Scripting (no CVSS, WP Admin Style)
- [CVE-2022-1800](https://cve.now/CVE-2022-1800.md): Export any WordPress data to XML/CSV \< 1.3.5 - Admin+ SQL Injection (no CVSS, Export any WordPress data to XML/CSV)
- [CVE-2022-1793](https://cve.now/CVE-2022-1793.md): Private Files \<= 0.40 - Protection Disabling via CSRF (no CVSS, Private Files)
- [CVE-2022-1792](https://cve.now/CVE-2022-1792.md): Quick Subscribe \<= 1.7.1 - Arbitrary Settings Update via CSRF to Stored XSS (no CVSS, Quick Subscribe)
- [CVE-2022-1791](https://cve.now/CVE-2022-1791.md): One Click Plugin Updater \<= 2.4.14 - Arbitrary Settings Update via CSRF (no CVSS, One Click Plugin Updater)
- [CVE-2022-1790](https://cve.now/CVE-2022-1790.md): New User Email Set Up \<= 0.5.2 - Arbitrary Settings Update via CSRF (no CVSS, New User Email Set Up)
- [CVE-2022-1788](https://cve.now/CVE-2022-1788.md): Change Uploaded File Permissions \<= 4.0.0 - File Permission Update via CSRF (no CVSS, Change Uploaded File Permissions)
- [CVE-2022-1787](https://cve.now/CVE-2022-1787.md): Sideblog \<= 6.0 - Arbitrary Settings Update via CSRF to Stored XSS (no CVSS, Sideblog WordPress Plugin)
- [CVE-2022-1781](https://cve.now/CVE-2022-1781.md): postTabs \<= 2.10.6 - Arbitrary Settings Update via CSRF to Stored XSS (no CVSS, postTabs)
- [CVE-2022-1780](https://cve.now/CVE-2022-1780.md): LaTeX for WordPress \<= 3.4.10 - Arbitrary Settings Update via CSRF to Stored XSS (no CVSS, LaTeX for WordPress)
- [CVE-2022-1779](https://cve.now/CVE-2022-1779.md): Auto Delete Posts \<= 1.3.0 - Arbitrary Settings Update via CSRF (no CVSS, Auto Delete Posts)
- [CVE-2022-1777](https://cve.now/CVE-2022-1777.md): Filr - Secure Document Library \< 1.2.2.1 - Subscriber+ AJAX Calls (no CVSS, Filr – Secure document library)
- [CVE-2022-1773](https://cve.now/CVE-2022-1773.md): WP Athletics \<= 1.1.7 - Reflected Cross-Site Scripting (no CVSS, WP Athletics)
- [CVE-2022-1772](https://cve.now/CVE-2022-1772.md): Google Places Review \< 2.0.0 - Admin+ Stored Cross Site Scripting (no CVSS, Google Places Reviews)
- [CVE-2022-1765](https://cve.now/CVE-2022-1765.md): Hot Linked Image Cacher \<= 1.16 - Image upload/cache abuse via CSRF (no CVSS, Hot Linked Image Cacher)
- [CVE-2022-1764](https://cve.now/CVE-2022-1764.md): WP-chgFontSize \<= 1.8 - Arbitrary Settings Update via CSRF to Stored XSS (no CVSS, WP-chgFontSize)
- [CVE-2022-1763](https://cve.now/CVE-2022-1763.md): Static Page eXtended \<= 2.1 - Arbitrary Settings Update via CSRF to Stored XSS (no CVSS, Static Page eXtended)
- [CVE-2022-1762](https://cve.now/CVE-2022-1762.md): iQ Block Country \< 1.2.20 - Protection Bypass due to IP Spoofing (no CVSS, iQ Block Country)
- [CVE-2022-1761](https://cve.now/CVE-2022-1761.md): Peter’s Collaboration E-mails \<= 2.2.0 - Arbitrary Settings Update via CSRF (no CVSS, Peter’s Collaboration E-mails)
- [CVE-2022-1759](https://cve.now/CVE-2022-1759.md): RB Internal Links \<= 2.0.16 - Stored Cross-Site Scripting via CSRF (no CVSS, RB Internal Links)
- [CVE-2022-1758](https://cve.now/CVE-2022-1758.md): Genki Pre-Publish Reminder \<= 1.4.1 - Stored XSS & RCE via CSRF (no CVSS, Genki Pre-Publish Reminder)
- [CVE-2022-1756](https://cve.now/CVE-2022-1756.md): Newsletter \< 7.4.5 - Reflected Cross-Site Scripting (no CVSS, Newsletter – Send awesome emails from WordPress)
- [CVE-2022-1724](https://cve.now/CVE-2022-1724.md): Simple Membership \< 4.1.1 - Reflected Cross-Site Scripting (no CVSS, Simple Membership)
- [CVE-2022-1710](https://cve.now/CVE-2022-1710.md): Appointment Hour Booking \< 1.3.56 - Admin+ Stored Cross-Site Scripting (no CVSS, Appointment Hour Booking – WordPress Booking Plugin)
- [CVE-2022-1694](https://cve.now/CVE-2022-1694.md): Useful Banner Manager \<= 1.6.1 - Modify banners via CSRF (no CVSS, Useful Banner Manager)
- [CVE-2022-1624](https://cve.now/CVE-2022-1624.md): Latest Tweets Widget \<= 1.1.4 - Arbitrary Settings Update via CSRF (no CVSS, Latest Tweets Widget)
- [CVE-2022-1612](https://cve.now/CVE-2022-1612.md): Webriti SMTP Mail \<= 1.0 - Arbitrary Settings Update via CSRF (no CVSS, Webriti SMTP Mail)
- [CVE-2022-1608](https://cve.now/CVE-2022-1608.md): OnePress Social Locker \<= 5.6.2 - Arbitrary Settings Update via CSRF (no CVSS, OnePress Social Locker)
- [CVE-2022-1605](https://cve.now/CVE-2022-1605.md): Email Users \<= 4.8.8 - Arbitrary Settings Update via CSRF (no CVSS, Email Users)
- [CVE-2022-1604](https://cve.now/CVE-2022-1604.md): MailerLite \< 1.5.4 - Reflected Cross-Site Scripting (no CVSS, MailerLite – Signup forms)
- [CVE-2022-1595](https://cve.now/CVE-2022-1595.md): HC Custom WP-Admin URL \<= 1.4 - Unauthenticated Secret URL Disclosure (no CVSS, HC Custom WP-Admin URL)
- [CVE-2022-1594](https://cve.now/CVE-2022-1594.md): HC Custom WP-Admin URL \<= 1.4 - Arbitrary Settings Update via CSRF (no CVSS, HC Custom WP-Admin URL)
- [CVE-2022-1549](https://cve.now/CVE-2022-1549.md): WP Athletics \<= 1.1.7 - Subscriber+ Stored Cross-Site Scripting (no CVSS, WP Athletics)
- [CVE-2022-1532](https://cve.now/CVE-2022-1532.md): Themify - WooCommerce Product Filter \< 1.3.8 - Reflected Cross-Site Scripting (no CVSS, Themify – WooCommerce Product Filter)
- [CVE-2022-1412](https://cve.now/CVE-2022-1412.md): Log WP\_Mail \<= 0.1 - Email Logs Publicly Accessible (no CVSS, Log WP\_Mail)
- [CVE-2022-1336](https://cve.now/CVE-2022-1336.md): Carousel CK \<= 1.1.0 - Admin+ Stored Cross-Site Scripting (no CVSS, Carousel CK)
- [CVE-2022-1335](https://cve.now/CVE-2022-1335.md): Slideshow CK \< 1.4.10 - Admin+ Stored Cross-Site Scripting (no CVSS, Slideshow CK)
- [CVE-2022-1202](https://cve.now/CVE-2022-1202.md): WP-CRM \<= 1.2.1 - CSV Injection (no CVSS, WP-CRM – Customer Relations Management for WordPress)
- [CVE-2022-0885](https://cve.now/CVE-2022-0885.md): Member Hero \<= 1.0.9 - Unauthenticated RCE (no CVSS, Member Hero)
- [CVE-2022-0863](https://cve.now/CVE-2022-0863.md): WP SVG Icons \<= 3.2.3 - Admin+ Remote Code Execution (RCE) (no CVSS, WP SVG Icons)
- [CVE-2022-0827](https://cve.now/CVE-2022-0827.md): Bestbooks \<= 2.6.3 - Unauthenticated SQLi (no CVSS, Bestbooks)
- [CVE-2022-0786](https://cve.now/CVE-2022-0786.md): KiviCare \< 2.3.9 - Unauthenticated SQLi (no CVSS, KiviCare – Clinic & Patient Management System)
- [CVE-2022-1656](https://cve.now/CVE-2022-1656.md): JupiterX Theme \<= 2.0.6 and JupiterX Core \<= 2.0.6 - Authenticated Arbitrary Plugin Deactivation and Settings Modification (CVSS 5.4, ArtBees Jupiter X Core · ArtBees Jupiter X)
- [CVE-2022-0745](https://cve.now/CVE-2022-0745.md): Like Button Rating \< 2.6.45 - Arbitrary e-mail Sending (no CVSS, Like Button Rating ♥ LikeBtn)
- [CVE-2022-0626](https://cve.now/CVE-2022-0626.md): Advanced Admin Search \< 1.1.6 - Reflected Cross-Site Scripting (no CVSS, Advanced Admin Search)
- [CVE-2021-25116](https://cve.now/CVE-2021-25116.md): Enqueue Anything \<= 1.0.1 - Subscriber+ Arbitrary Asset/Post Deletion (no CVSS, Enqueue Anything)
- [CVE-2022-31041](https://cve.now/CVE-2022-31041.md): Insufficient content-type validation for uploaded files in open-forms (CVSS 7.6, open-formulieren open-forms)
- [CVE-2022-1822](https://cve.now/CVE-2022-1822.md): Zephyr Project Manager \<= 3.2.40 - Reflected Cross-Site Scripting (CVSS 6.1, dylanjkotze Zephyr Project Manager)
- [CVE-2022-2067](https://cve.now/CVE-2022-2067.md): SQL Injection in francoisjacquet/rosariosis (CVSS 8.8, francoisjacquet/rosariosis)
- [CVE-2021-40902](https://cve.now/CVE-2021-40902.md): flatCore-CMS version 2.0.8 is affected by Cross Site Scripting (XSS) in the "Create New Page" option through the index page. (no CVSS)
- [CVE-2021-46816](https://cve.now/CVE-2021-46816.md): Adobe Premiere Pro M4A file memory corruption vulnerability could lead to remote code execution (CVSS 7.8, Adobe Premiere)
- [CVE-2021-46817](https://cve.now/CVE-2021-46817.md): Adobe Media Encoder M4A file memory corruption vulnerability could lead to remote code execution (CVSS 7.8, Adobe Media Encoder)
- [CVE-2022-2066](https://cve.now/CVE-2022-2066.md): Cross-site Scripting (XSS) - Reflected in neorazorx/facturascripts (CVSS 7.1, neorazorx/facturascripts · facturascripts/facturascripts)
- [CVE-2022-2065](https://cve.now/CVE-2022-2065.md): Cross-site Scripting (XSS) - Stored in neorazorx/facturascripts (CVSS 8.6, neorazorx/facturascripts · facturascripts/facturascripts)
- [CVE-2022-31040](https://cve.now/CVE-2022-31040.md): Open Redirect in open-forms (CVSS 7.1, open-formulieren open-forms)
- [CVE-2021-46818](https://cve.now/CVE-2021-46818.md): Adobe Media Encoder M4A file memory corruption vulnerability could lead to remote code execution (CVSS 7.8, Adobe Media Encoder)
- [CVE-2022-2064](https://cve.now/CVE-2022-2064.md): Insufficient Session Expiration in nocodb/nocodb (CVSS 9.1, nocodb/nocodb · nocodb)
- [CVE-2022-2061](https://cve.now/CVE-2022-2061.md): Heap-based Buffer Overflow in hpjansson/chafa (CVSS 2.8, hpjansson/chafa)
- [CVE-2022-2063](https://cve.now/CVE-2022-2063.md): Improper Privilege Management in nocodb/nocodb (CVSS 9.0, nocodb/nocodb · nocodb)
- [CVE-2022-2060](https://cve.now/CVE-2022-2060.md): Cross-site Scripting (XSS) - Stored in dolibarr/dolibarr (CVSS 8.4, dolibarr/dolibarr)
- [CVE-2022-32741](https://cve.now/CVE-2022-32741.md): Information disclosure in Request New Password feature (CVSS 5.3, OTRS AG OTRS)
- [CVE-2022-32740](https://cve.now/CVE-2022-32740.md): Information disclosure in the External Interface (CVSS 3.5, OTRS AG OTRS)
- [CVE-2022-32739](https://cve.now/CVE-2022-32739.md): OTRS version number is always in the exported ICS files (CVSS 3.5, OTRS AG OTRS · OTRS AG OTRSCalendarResourcePlanning)
- [CVE-2021-37404](https://cve.now/CVE-2021-37404.md): Heap buffer overflow in libhdfs native library (no CVSS, Apache Software Foundation Apache Hadoop · org.apache.hadoo…)
- [CVE-2017-20045](https://cve.now/CVE-2017-20045.md): Navetti PricePoint cross-site request forgery (CVSS 7.3, Navetti PricePoint)
- [CVE-2017-20044](https://cve.now/CVE-2017-20044.md): Navetti PricePoint Reflected cross site scriting (CVSS 4.3, Navetti PricePoint)
- [CVE-2017-20043](https://cve.now/CVE-2017-20043.md): Navetti PricePoint Persistent cross site scriting (CVSS 4.3, Navetti PricePoint)
- [CVE-2017-20042](https://cve.now/CVE-2017-20042.md): Navetti PricePoint Blind sql injection (CVSS 6.3, Navetti PricePoint)
- [CVE-2017-20041](https://cve.now/CVE-2017-20041.md): Ucweb UC Browser HTML URL improper restriction of rendered ui layers (CVSS 5.4, Ucweb UC Browser)
- [CVE-2022-29894](https://cve.now/CVE-2022-29894.md): Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function. (no CVSS, Strapi)
- [CVE-2022-29525](https://cve.now/CVE-2022-29525.md): Rakuten Casa version AP\_F\_V1\_4\_1 or AP\_F\_V2\_0\_0 uses a hard-coded credential which may allow a remote unauthenticated attacker to log in wit (no CVSS, Rakuten Mobile Rakuten Casa)
- [CVE-2022-28704](https://cve.now/CVE-2022-28704.md): Improper access control vulnerability in Rakuten Casa version AP\_F\_V1\_4\_1 or AP\_F\_V2\_0\_0 allows a remote attacker to log in with the root pr (no CVSS, Rakuten Mobile Rakuten Casa)
- [CVE-2022-27231](https://cve.now/CVE-2022-27231.md): Cross-site scripting vulnerability exists in WP Statistics versions prior to 13.2.0 because it improperly processes a platform parameter. (no CVSS, VeronaLabs WP Statistics)
- [CVE-2022-27174](https://cve.now/CVE-2022-27174.md): Cross-site request forgery (CSRF) vulnerability in Easy Blog for EC-CUBE4 Ver.1.0.1 and earlier allows a remote unauthenticated attacker to (no CVSS, COREMOBILE Co. Easy Blog for EC-CUBE4)
- [CVE-2022-26834](https://cve.now/CVE-2022-26834.md): Improper access control vulnerability in Rakuten Casa version AP\_F\_V1\_4\_1 or AP\_F\_V2\_0\_0 allows a remote attacker to obtain the information (no CVSS, Rakuten Mobile Rakuten Casa)
- [CVE-2022-26041](https://cve.now/CVE-2022-26041.md): Directory traversal vulnerability in RCCMD 4.26 and earlier allows a remote authenticated attacker with an administrative privilege to read (no CVSS, GENEREX SYSTEMS Computervertriebsgesellschaft mbH RCCMD)
- [CVE-2022-2062](https://cve.now/CVE-2022-2062.md): Generation of Error Message Containing Sensitive Information in nocodb/nocodb (CVSS 9.1, nocodb/nocodb · nocodb)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-06-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.