CVEs published June 16, 2022
99 CVEs were published on June 16, 2022: 0 critical, 20 high.
- Published
- 99
- Critical
- 0
- High
- 20
- Medium
- 4
- Low
- 3
- Unrated
- 72
- Now in CISA KEV
- 0
- Fix available
- 14
Most affected products
- Adobe InCopy
- 8
- Adobe InDesign
- 7
- CA Automic Automation
- 7
- OPCFoundation.NetStandard.Opc.Ua.Core
- 5
- ImageMagick
- 3
- Autodesk 3ds Max
- 2
- Citrix Application Delivery Management
- 2
- FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT
- 2
- PHP Group PHP
- 2
- XYZScripts Contact Form Manager Plugin
- 2
High 20
- CVE-2022-30664Adobe Animate SVG File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Animate
- CVE-2022-30657Adobe InCopy Font Parsing Use-After-Free Remote Code Execution VulnerabilityAdobe InCopy
- CVE-2022-30656Adobe InCopy PDF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe InCopy
- CVE-2022-30655Adobe InCopy Font Parsing Use-After-Free Remote Code Execution VulnerabilityAdobe InCopy
- CVE-2022-30654Adobe InCopy Font Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityAdobe InCopy
- CVE-2022-30653Adobe InCopy Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe InCopy
- CVE-2022-30652Adobe InCopy SVG File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe InCopy
- CVE-2022-30651Adobe InCopy Font Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe InCopy
- CVE-2022-30650Adobe InCopy Font Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityAdobe InCopy
- CVE-2022-30665Adobe InDesign Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe InDesign
- CVE-2022-30663Adobe InDesign SVG File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe InDesign
- CVE-2022-30662Adobe InDesign Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe InDesign
- CVE-2022-30661Adobe InDesign Font Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityAdobe InDesign
- CVE-2022-30660Adobe InDesign PDF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe InDesign
- CVE-2022-30659Adobe InDesign Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe InDesign
- CVE-2022-30658Adobe InDesign Font Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityAdobe InDesign
- CVE-2022-30670Escalate Privileges to Server Admin - Robohelp ServerAdobe RoboHelp
- CVE-2022-2098Weak Password Requirements in kromitgmbh/titrakromitgmbh/titra
- CVE-2022-31626mysqlnd/pdo password buffer overflowPHP Group PHP
- CVE-2022-31625Freeing unallocated memory in php_pgsql_free_params()PHP Group PHP
Medium, low and unrated 79
- CVE-2022-30326An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices.
- CVE-2022-30327An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices.
- CVE-2022-30328An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices.
- CVE-2022-30329An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices.
- CVE-2022-30325An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices.
- CVE-2022-26173JForum v2.8.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via http://target_host:port/jforum-2.8.0/jforum.page, which allo
- CVE-2018-18907An issue was discovered on D-Link DIR-850L 1.21WW devices.
- CVE-2022-33739CA Clarity 15.8 and below and 15.9.0 contain an insecure XML parsing vulnerability that could allow a remote attacker to potentially view thCA Clarity
- CVE-2022-33756CA Automic Automation 12.2 and 12.3 contain an entropy weakness vulnerability in the Automic AutomationEngine that could allow a remote attaCA Automic Automation
- CVE-2022-33755CA Automic Automation 12.2 and 12.3 contain an insecure input handling vulnerability in the Automic Agent that could allow a remote attackerCA Automic Automation
- CVE-2022-33754CA Automic Automation 12.2 and 12.3 contain an insufficient input validation vulnerability in the Automic agent that could allow a remote atCA Automic Automation
- CVE-2022-31299Haraj v3.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the User Upgrade Form.
- CVE-2022-33753CA Automic Automation 12.2 and 12.3 contain an insecure file creation and handling vulnerability in the Automic agent that could allow a useCA Automic Automation
- CVE-2022-33752CA Automic Automation 12.2 and 12.3 contain an insufficient input validation vulnerability in the Automic agent that could allow a remote atCA Automic Automation
- CVE-2022-33751CA Automic Automation 12.2 and 12.3 contain an insecure memory handling vulnerability in the Automic agent that could allow a remote attackeCA Automic Automation
- CVE-2022-33750CA Automic Automation 12.2 and 12.3 contain an authentication error vulnerability in the Automic agent that could allow a remote attacker toCA Automic Automation
- CVE-2020-25459An issue was discovered in function sync_tree in hetero_decision_tree_guest.py in WeBank FATE (Federated AI Technology Enabler) 0.1 through
- CVE-2021-36608Cross Site Scripting (XSS) vulnerability in webTareas 2.2p1 via the Name field to /projects/editproject.php.
- CVE-2021-46820Arbitrary File Deletion vulnerability in XOS-Shop xos_shop_system 1.0.9 via current_manufacturer_image parameter to /shop/admin/categories.p
- CVE-2021-37764Arbitrary File Deletion vulnerability in XOS-Shop xos_shop_system 1.0.9 via current_manufacturer_image parameter to /shop/admin/manufacturer
- CVE-2021-36609Cross Site Scripting (XSS) vulnerability in webTareas 2.2p1 via the Name field to /linkedcontent/editfolder.php.
- CVE-2020-28865An issue was discovered in PowerJob through 3.2.2, allows attackers to change arbitrary user passwords via the id parameter to /appinfo/savecom.github.kfcfans:powerjob
- CVE-2021-33295Cross Site Scripting (XSS) vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code due to improper sanitijoplin
- CVE-2022-31295An issue in the delete_post() function of Online Discussion Forum Site 1 allows unauthenticated attackers to arbitrarily delete posts.
- CVE-2022-27512Temporary disruption of the ADM license serviceCitrix Application Delivery Management
- CVE-2022-27511Corruption of the system by a remote, unauthenticated user potentially leading to the reset of the administrator passwordCitrix Application Delivery Management
- CVE-2022-24562In IOBit IOTransfer 4.3.1.1561, an unauthenticated attacker can send GET and POST requests to Airserv and gain arbitrary read/write access t
- CVE-2020-35597Victor CMS 1.0 is vulnerable to SQL injection via c_id parameter of admin_edit_comment.php, p_id parameter of admin_edit_post.php, u_id para
- CVE-2022-31464Insecure permissions configuration in Adaware Protect v1.2.439.4251 allows attackers to escalate privileges via changing the service binary
- CVE-2022-31294An issue in the save_users() function of Online Discussion Forum Site 1 allows unauthenticated attackers to arbitrarily create or update use
- CVE-2022-29866OPC UA .NET Standard Stack 1.04.368 allows a remote attacker to exhaust the memory resources of a server via a crafted request that triggersOPCFoundation.NetStandard.Opc.Ua.Core
- CVE-2021-41487NOKIA VitalSuite SPM 2020 is affected by SQL injection through UserName'.
- CVE-2022-31301Haraj v3.7 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Post Ads component.
- CVE-2021-36827WordPress Ninja Forms Contact Form plugin <= 3.6.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilitySaturday Drive Ninja Forms Contact Form
- CVE-2022-29863OPC UA .NET Standard Stack 1.04.368 allows remote attacker to cause a crash via a crafted message that triggers excessive memory allocation.OPCFoundation.NetStandard.Opc.Ua.Core
- CVE-2022-29864OPC UA .NET Standard Stack 1.04.368 allows a remote attacker to cause a server to crash via a large number of messages that trigger UncontroOPCFoundation.NetStandard.Opc.Ua.Core
- CVE-2022-29862An infinite loop in OPC UA .NET Standard Stack 1.04.368 allows a remote attackers to cause the application to hang via a crafted message.OPCFoundation.NetStandard.Opc.Ua.Core
- CVE-2022-31298A cross-site scripting vulnerability in the ads comment section of Haraj v3.7 allows attackers to execute arbitrary web scripts or HTML via
- CVE-2021-41421A PHP code injection vulnerability in MaianAffiliate v.1.0 allows an authenticated attacker to gain RCE through the MaianAffiliate admin pan
- CVE-2022-29865OPC UA .NET Standard Stack allows a remote attacker to bypass the application authentication check via crafted fake credentials.OPCFoundation.NetStandard.Opc.Ua.Core
- CVE-2022-31382Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the searchdata parameter in search-dirctory.php
- CVE-2021-41420A stored XSS vulnerability in MaianAffiliate v.1.0 allows an authenticated attacker for arbitrary JavaScript code execution in the context o
- CVE-2022-31383Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in view-directory.php.
- CVE-2022-1642A program using swift-corelibs-foundation is vulnerable to a denial of service attack caused by a potentially malicious source producing a JSwift Project Swift Corelib-Foundation
- CVE-2022-31384Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the fullname parameter in add-directory.php.
- CVE-2021-3675synaTEE.signed.dll Out-Of-Bounds Heap WriteSynaptics Fingerprint Driver
- CVE-2022-22953VMware HCX update addresses an information disclosure vulnerability.VMware HCX
- CVE-2022-27532A maliciously crafted TIF file in Autodesk 3ds Max 2022 and 2021 can be used to write beyond the allocated buffer while parsing TIF files.Autodesk 3ds Max
- CVE-2022-27531A maliciously crafted TIF file can be forced to read beyond allocated boundaries in Autodesk 3ds Max 2022, and 2021 when parsing the TIF filAutodesk 3ds Max
- CVE-2022-31914Zoo Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via zms/admin/public_html/save_animal?an_id=24.
- CVE-2022-31913Online Discussion Forum Site v1.0 is vulnerable to Cross Site Scripting (XSS) via /odfs/classes/Master.php?f=save_category, name.
- CVE-2022-31912Online Tutor Portal Site v1.0 is vulnerable to SQL Injection via /otps/classes/Master.php?f=delete_team.
- CVE-2022-31911Online Discussion Forum Site v1.0 is vulnerable to SQL Injection via /odfs/classes/Master.php?f=delete_team.
- CVE-2022-31910Online Tutor Portal Site v1.0 is vulnerable to Cross Site Scripting (XSS).
- CVE-2022-31849MERCURY MIPC451-4 1.0.22 Build 220105 Rel.55642n was discovered to contain a remote code execution (RCE) vulnerability which is exploitable
- CVE-2022-31277Xiaomi Lamp 1 v2.0.4_0066 was discovered to be vulnerable to replay attacks.
- CVE-2022-31908Student Registration and Fee Payment System v1.0 is vulnerable to SQL Injection via /scms/student.php.
- CVE-2022-31906Online Fire Reporting System v1.0 is vulnerable to Cross Site Scripting (XSS) via /ofrs/classes/Master.php.
- CVE-2022-30023Tenda ONT GPON AC1200 Dual band WiFi HG9 v1.0.1 is vulnerable to Command Injection via the Ping function.
- CVE-2022-31300A cross-site scripting vulnerability in the DM Section component of Haraj v3.7 allows attackers to execute arbitrary web scripts or HTML via
- CVE-2022-31372Wiris Mathtype v7.28.0 was discovered to contain a path traversal vulnerability in the resourceFile parameter.
- CVE-2017-20056weblizar User Login Log Plugin Stored cross site scritingweblizar User Login Log Plugin
- CVE-2017-20055BestWebSoft Contact Form Plugin Stored cross site scritingBestWebSoft Contact Form Plugin
- CVE-2017-20054XYZScripts Contact Form Manager Plugin cross site scritingXYZScripts Contact Form Manager Plugin
- CVE-2017-20053XYZScripts Contact Form Manager Plugin cross-site request forgeryXYZScripts Contact Form Manager Plugin
- CVE-2021-41654SQL injection vulnerabilities exist in Wuzhicms v4.1.0 which allows attackers to execute arbitrary SQL commands via the $keyValue parameter
- CVE-2021-41411drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java.org.drools:drools-core
- CVE-2021-41402flatCore-CMS v2.0.8 has a code execution vulnerability, which could let a remote malicious user execute arbitrary PHP code.
- CVE-2021-41458In GPAC MP4Box v1.1.0, there is a stack buffer overflow at src/utils/error.c:1769 which leads to a denial of service vulnerability.
- CVE-2017-20052Python pgAdmin4 uncontrolled search pathPython
- CVE-2022-30549Out-of-bounds read vulnerability exists in V-Server v4.0.11.0 and earlier and V-Server Lite v4.0.13.0 and earlier, which may allow an attackFUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-Server an…
- CVE-2022-30546Out-of-bounds read vulnerability exists in the simulator module contained in the graphic editor 'V-SFT' versions prior to v6.1.6.0, which maFUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT
- CVE-2022-30538Out-of-bounds write vulnerability exists in the simulator module contained in the graphic editor 'V-SFT' versions prior to v6.1.6.0, which mFUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT
- CVE-2022-30533Cross-site scripting vulnerability in Modern Events Calendar Lite versions prior to 6.3.0 allows remote an authenticated attacker to inject Webnus Modern Events Calendar Lite
- CVE-2022-2085A NULL pointer dereference vulnerability was found in Ghostscript, which occurs when it tries to render a large number of bits in memory.GhostScript
- CVE-2022-31291An issue in dlt_config_file_parser.c of dlt-daemon v2.18.8 allows attackers to cause a double free via crafted TCP packets.
- CVE-2022-32545A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned char' at coders/psd.c, whenImageMagick
- CVE-2022-32546A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned long' at coders/pcl.c, whenImageMagick
- CVE-2022-32547In ImageMagick, there is load of misaligned address for type 'double', which requires 8 byte alignment and for type 'float', which requires ImageMagick