# CVEs published 2022-06-16

99 CVEs were published on June 16, 2022: 0 critical, 20 high. Days are UTC.

- [CVE-2022-30326](https://cve.now/CVE-2022-30326.md): An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. (no CVSS)
- [CVE-2022-30327](https://cve.now/CVE-2022-30327.md): An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. (no CVSS)
- [CVE-2022-30328](https://cve.now/CVE-2022-30328.md): An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. (no CVSS)
- [CVE-2022-30329](https://cve.now/CVE-2022-30329.md): An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. (no CVSS)
- [CVE-2022-30325](https://cve.now/CVE-2022-30325.md): An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. (no CVSS)
- [CVE-2022-26173](https://cve.now/CVE-2022-26173.md): JForum v2.8.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via http://target\_host:port/jforum-2.8.0/jforum.page, which allo (no CVSS)
- [CVE-2018-18907](https://cve.now/CVE-2018-18907.md): An issue was discovered on D-Link DIR-850L 1.21WW devices. (no CVSS)
- [CVE-2022-33739](https://cve.now/CVE-2022-33739.md): CA Clarity 15.8 and below and 15.9.0 contain an insecure XML parsing vulnerability that could allow a remote attacker to potentially view th (no CVSS, CA Clarity)
- [CVE-2022-33756](https://cve.now/CVE-2022-33756.md): CA Automic Automation 12.2 and 12.3 contain an entropy weakness vulnerability in the Automic AutomationEngine that could allow a remote atta (no CVSS, CA Automic Automation)
- [CVE-2022-33755](https://cve.now/CVE-2022-33755.md): CA Automic Automation 12.2 and 12.3 contain an insecure input handling vulnerability in the Automic Agent that could allow a remote attacker (no CVSS, CA Automic Automation)
- [CVE-2022-33754](https://cve.now/CVE-2022-33754.md): CA Automic Automation 12.2 and 12.3 contain an insufficient input validation vulnerability in the Automic agent that could allow a remote at (no CVSS, CA Automic Automation)
- [CVE-2022-31299](https://cve.now/CVE-2022-31299.md): Haraj v3.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the User Upgrade Form. (no CVSS)
- [CVE-2022-33753](https://cve.now/CVE-2022-33753.md): CA Automic Automation 12.2 and 12.3 contain an insecure file creation and handling vulnerability in the Automic agent that could allow a use (no CVSS, CA Automic Automation)
- [CVE-2022-33752](https://cve.now/CVE-2022-33752.md): CA Automic Automation 12.2 and 12.3 contain an insufficient input validation vulnerability in the Automic agent that could allow a remote at (no CVSS, CA Automic Automation)
- [CVE-2022-33751](https://cve.now/CVE-2022-33751.md): CA Automic Automation 12.2 and 12.3 contain an insecure memory handling vulnerability in the Automic agent that could allow a remote attacke (no CVSS, CA Automic Automation)
- [CVE-2022-33750](https://cve.now/CVE-2022-33750.md): CA Automic Automation 12.2 and 12.3 contain an authentication error vulnerability in the Automic agent that could allow a remote attacker to (no CVSS, CA Automic Automation)
- [CVE-2020-25459](https://cve.now/CVE-2020-25459.md): An issue was discovered in function sync\_tree in hetero\_decision\_tree\_guest.py in WeBank FATE (Federated AI Technology Enabler) 0.1 through (no CVSS)
- [CVE-2021-36608](https://cve.now/CVE-2021-36608.md): Cross Site Scripting (XSS) vulnerability in webTareas 2.2p1 via the Name field to /projects/editproject.php. (no CVSS)
- [CVE-2021-46820](https://cve.now/CVE-2021-46820.md): Arbitrary File Deletion vulnerability in XOS-Shop xos\_shop\_system 1.0.9 via current\_manufacturer\_image parameter to /shop/admin/categories.p (no CVSS)
- [CVE-2021-37764](https://cve.now/CVE-2021-37764.md): Arbitrary File Deletion vulnerability in XOS-Shop xos\_shop\_system 1.0.9 via current\_manufacturer\_image parameter to /shop/admin/manufacturer (no CVSS)
- [CVE-2021-36609](https://cve.now/CVE-2021-36609.md): Cross Site Scripting (XSS) vulnerability in webTareas 2.2p1 via the Name field to /linkedcontent/editfolder.php. (no CVSS)
- [CVE-2020-28865](https://cve.now/CVE-2020-28865.md): An issue was discovered in PowerJob through 3.2.2, allows attackers to change arbitrary user passwords via the id parameter to /appinfo/save (no CVSS, com.github.kfcfans:powerjob)
- [CVE-2021-33295](https://cve.now/CVE-2021-33295.md): Cross Site Scripting (XSS) vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code due to improper saniti (no CVSS, joplin)
- [CVE-2022-31295](https://cve.now/CVE-2022-31295.md): An issue in the delete\_post() function of Online Discussion Forum Site 1 allows unauthenticated attackers to arbitrarily delete posts. (no CVSS)
- [CVE-2022-27512](https://cve.now/CVE-2022-27512.md): Temporary disruption of the ADM license service (no CVSS, Citrix Application Delivery Management)
- [CVE-2022-27511](https://cve.now/CVE-2022-27511.md): Corruption of the system by a remote, unauthenticated user potentially leading to the reset of the administrator password (no CVSS, Citrix Application Delivery Management)
- [CVE-2022-24562](https://cve.now/CVE-2022-24562.md): In IOBit IOTransfer 4.3.1.1561, an unauthenticated attacker can send GET and POST requests to Airserv and gain arbitrary read/write access t (no CVSS)
- [CVE-2020-35597](https://cve.now/CVE-2020-35597.md): Victor CMS 1.0 is vulnerable to SQL injection via c\_id parameter of admin\_edit\_comment.php, p\_id parameter of admin\_edit\_post.php, u\_id para (no CVSS)
- [CVE-2022-31464](https://cve.now/CVE-2022-31464.md): Insecure permissions configuration in Adaware Protect v1.2.439.4251 allows attackers to escalate privileges via changing the service binary (no CVSS)
- [CVE-2022-31294](https://cve.now/CVE-2022-31294.md): An issue in the save\_users() function of Online Discussion Forum Site 1 allows unauthenticated attackers to arbitrarily create or update use (no CVSS)
- [CVE-2022-29866](https://cve.now/CVE-2022-29866.md): OPC UA .NET Standard Stack 1.04.368 allows a remote attacker to exhaust the memory resources of a server via a crafted request that triggers (no CVSS, OPCFoundation.NetStandard.Opc.Ua.Core)
- [CVE-2021-41487](https://cve.now/CVE-2021-41487.md): NOKIA VitalSuite SPM 2020 is affected by SQL injection through UserName'. (no CVSS)
- [CVE-2022-31301](https://cve.now/CVE-2022-31301.md): Haraj v3.7 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Post Ads component. (no CVSS)
- [CVE-2021-36827](https://cve.now/CVE-2021-36827.md): WordPress Ninja Forms Contact Form plugin \<= 3.6.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, Saturday Drive Ninja Forms Contact Form)
- [CVE-2022-29863](https://cve.now/CVE-2022-29863.md): OPC UA .NET Standard Stack 1.04.368 allows remote attacker to cause a crash via a crafted message that triggers excessive memory allocation. (no CVSS, OPCFoundation.NetStandard.Opc.Ua.Core)
- [CVE-2022-30664](https://cve.now/CVE-2022-30664.md): Adobe Animate SVG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Animate)
- [CVE-2022-30657](https://cve.now/CVE-2022-30657.md): Adobe InCopy Font Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe InCopy)
- [CVE-2022-30656](https://cve.now/CVE-2022-30656.md): Adobe InCopy PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe InCopy)
- [CVE-2022-30655](https://cve.now/CVE-2022-30655.md): Adobe InCopy Font Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe InCopy)
- [CVE-2022-30654](https://cve.now/CVE-2022-30654.md): Adobe InCopy Font Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Adobe InCopy)
- [CVE-2022-29864](https://cve.now/CVE-2022-29864.md): OPC UA .NET Standard Stack 1.04.368 allows a remote attacker to cause a server to crash via a large number of messages that trigger Uncontro (no CVSS, OPCFoundation.NetStandard.Opc.Ua.Core)
- [CVE-2022-30653](https://cve.now/CVE-2022-30653.md): Adobe InCopy Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe InCopy)
- [CVE-2022-30652](https://cve.now/CVE-2022-30652.md): Adobe InCopy SVG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe InCopy)
- [CVE-2022-30651](https://cve.now/CVE-2022-30651.md): Adobe InCopy Font Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe InCopy)
- [CVE-2022-30650](https://cve.now/CVE-2022-30650.md): Adobe InCopy Font Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Adobe InCopy)
- [CVE-2022-30665](https://cve.now/CVE-2022-30665.md): Adobe InDesign Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe InDesign)
- [CVE-2022-29862](https://cve.now/CVE-2022-29862.md): An infinite loop in OPC UA .NET Standard Stack 1.04.368 allows a remote attackers to cause the application to hang via a crafted message. (no CVSS, OPCFoundation.NetStandard.Opc.Ua.Core)
- [CVE-2022-30663](https://cve.now/CVE-2022-30663.md): Adobe InDesign SVG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe InDesign)
- [CVE-2022-30662](https://cve.now/CVE-2022-30662.md): Adobe InDesign Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe InDesign)
- [CVE-2022-30661](https://cve.now/CVE-2022-30661.md): Adobe InDesign Font Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Adobe InDesign)
- [CVE-2022-30660](https://cve.now/CVE-2022-30660.md): Adobe InDesign PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe InDesign)
- [CVE-2022-30659](https://cve.now/CVE-2022-30659.md): Adobe InDesign Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe InDesign)
- [CVE-2022-30658](https://cve.now/CVE-2022-30658.md): Adobe InDesign Font Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Adobe InDesign)
- [CVE-2022-30670](https://cve.now/CVE-2022-30670.md): Escalate Privileges to Server Admin - Robohelp Server (CVSS 8.8, Adobe RoboHelp)
- [CVE-2022-31298](https://cve.now/CVE-2022-31298.md): A cross-site scripting vulnerability in the ads comment section of Haraj v3.7 allows attackers to execute arbitrary web scripts or HTML via (no CVSS)
- [CVE-2021-41421](https://cve.now/CVE-2021-41421.md): A PHP code injection vulnerability in MaianAffiliate v.1.0 allows an authenticated attacker to gain RCE through the MaianAffiliate admin pan (no CVSS)
- [CVE-2022-29865](https://cve.now/CVE-2022-29865.md): OPC UA .NET Standard Stack allows a remote attacker to bypass the application authentication check via crafted fake credentials. (no CVSS, OPCFoundation.NetStandard.Opc.Ua.Core)
- [CVE-2022-31382](https://cve.now/CVE-2022-31382.md): Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the searchdata parameter in search-dirctory.php (no CVSS)
- [CVE-2021-41420](https://cve.now/CVE-2021-41420.md): A stored XSS vulnerability in MaianAffiliate v.1.0 allows an authenticated attacker for arbitrary JavaScript code execution in the context o (no CVSS)
- [CVE-2022-31383](https://cve.now/CVE-2022-31383.md): Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in view-directory.php. (no CVSS)
- [CVE-2022-1642](https://cve.now/CVE-2022-1642.md): A program using swift-corelibs-foundation is vulnerable to a denial of service attack caused by a potentially malicious source producing a J (no CVSS, Swift Project Swift Corelib-Foundation)
- [CVE-2022-31384](https://cve.now/CVE-2022-31384.md): Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the fullname parameter in add-directory.php. (no CVSS)
- [CVE-2021-3675](https://cve.now/CVE-2021-3675.md): synaTEE.signed.dll Out-Of-Bounds Heap Write (CVSS 5.5, Synaptics Fingerprint Driver)
- [CVE-2022-22953](https://cve.now/CVE-2022-22953.md): VMware HCX update addresses an information disclosure vulnerability. (no CVSS, VMware HCX)
- [CVE-2022-27532](https://cve.now/CVE-2022-27532.md): A maliciously crafted TIF file in Autodesk 3ds Max 2022 and 2021 can be used to write beyond the allocated buffer while parsing TIF files. (no CVSS, Autodesk 3ds Max)
- [CVE-2022-27531](https://cve.now/CVE-2022-27531.md): A maliciously crafted TIF file can be forced to read beyond allocated boundaries in Autodesk 3ds Max 2022, and 2021 when parsing the TIF fil (no CVSS, Autodesk 3ds Max)
- [CVE-2022-31914](https://cve.now/CVE-2022-31914.md): Zoo Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via zms/admin/public\_html/save\_animal?an\_id=24. (no CVSS)
- [CVE-2022-31913](https://cve.now/CVE-2022-31913.md): Online Discussion Forum Site v1.0 is vulnerable to Cross Site Scripting (XSS) via /odfs/classes/Master.php?f=save\_category, name. (no CVSS)
- [CVE-2022-31912](https://cve.now/CVE-2022-31912.md): Online Tutor Portal Site v1.0 is vulnerable to SQL Injection via /otps/classes/Master.php?f=delete\_team. (no CVSS)
- [CVE-2022-31911](https://cve.now/CVE-2022-31911.md): Online Discussion Forum Site v1.0 is vulnerable to SQL Injection via /odfs/classes/Master.php?f=delete\_team. (no CVSS)
- [CVE-2022-31910](https://cve.now/CVE-2022-31910.md): Online Tutor Portal Site v1.0 is vulnerable to Cross Site Scripting (XSS). (no CVSS)
- [CVE-2022-31849](https://cve.now/CVE-2022-31849.md): MERCURY MIPC451-4 1.0.22 Build 220105 Rel.55642n was discovered to contain a remote code execution (RCE) vulnerability which is exploitable (no CVSS)
- [CVE-2022-31277](https://cve.now/CVE-2022-31277.md): Xiaomi Lamp 1 v2.0.4\_0066 was discovered to be vulnerable to replay attacks. (no CVSS)
- [CVE-2022-31908](https://cve.now/CVE-2022-31908.md): Student Registration and Fee Payment System v1.0 is vulnerable to SQL Injection via /scms/student.php. (no CVSS)
- [CVE-2022-31906](https://cve.now/CVE-2022-31906.md): Online Fire Reporting System v1.0 is vulnerable to Cross Site Scripting (XSS) via /ofrs/classes/Master.php. (no CVSS)
- [CVE-2022-30023](https://cve.now/CVE-2022-30023.md): Tenda ONT GPON AC1200 Dual band WiFi HG9 v1.0.1 is vulnerable to Command Injection via the Ping function. (no CVSS)
- [CVE-2022-31300](https://cve.now/CVE-2022-31300.md): A cross-site scripting vulnerability in the DM Section component of Haraj v3.7 allows attackers to execute arbitrary web scripts or HTML via (no CVSS)
- [CVE-2022-31372](https://cve.now/CVE-2022-31372.md): Wiris Mathtype v7.28.0 was discovered to contain a path traversal vulnerability in the resourceFile parameter. (no CVSS)
- [CVE-2017-20056](https://cve.now/CVE-2017-20056.md): weblizar User Login Log Plugin Stored cross site scriting (CVSS 3.5, weblizar User Login Log Plugin)
- [CVE-2017-20055](https://cve.now/CVE-2017-20055.md): BestWebSoft Contact Form Plugin Stored cross site scriting (CVSS 3.5, BestWebSoft Contact Form Plugin)
- [CVE-2017-20054](https://cve.now/CVE-2017-20054.md): XYZScripts Contact Form Manager Plugin cross site scriting (CVSS 3.5, XYZScripts Contact Form Manager Plugin)
- [CVE-2017-20053](https://cve.now/CVE-2017-20053.md): XYZScripts Contact Form Manager Plugin cross-site request forgery (CVSS 4.3, XYZScripts Contact Form Manager Plugin)
- [CVE-2021-41654](https://cve.now/CVE-2021-41654.md): SQL injection vulnerabilities exist in Wuzhicms v4.1.0 which allows attackers to execute arbitrary SQL commands via the $keyValue parameter (no CVSS)
- [CVE-2021-41411](https://cve.now/CVE-2021-41411.md): drools \<=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. (no CVSS, org.drools:drools-core)
- [CVE-2022-2098](https://cve.now/CVE-2022-2098.md): Weak Password Requirements in kromitgmbh/titra (CVSS 7.1, kromitgmbh/titra)
- [CVE-2021-41402](https://cve.now/CVE-2021-41402.md): flatCore-CMS v2.0.8 has a code execution vulnerability, which could let a remote malicious user execute arbitrary PHP code. (no CVSS)
- [CVE-2021-41458](https://cve.now/CVE-2021-41458.md): In GPAC MP4Box v1.1.0, there is a stack buffer overflow at src/utils/error.c:1769 which leads to a denial of service vulnerability. (no CVSS)
- [CVE-2017-20052](https://cve.now/CVE-2017-20052.md): Python pgAdmin4 uncontrolled search path (CVSS 5.0, Python)
- [CVE-2022-31626](https://cve.now/CVE-2022-31626.md): mysqlnd/pdo password buffer overflow (CVSS 7.5, PHP Group PHP)
- [CVE-2022-31625](https://cve.now/CVE-2022-31625.md): Freeing unallocated memory in php\_pgsql\_free\_params() (CVSS 8.1, PHP Group PHP)
- [CVE-2022-30549](https://cve.now/CVE-2022-30549.md): Out-of-bounds read vulnerability exists in V-Server v4.0.11.0 and earlier and V-Server Lite v4.0.13.0 and earlier, which may allow an attack (no CVSS, FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-Server an…)
- [CVE-2022-30546](https://cve.now/CVE-2022-30546.md): Out-of-bounds read vulnerability exists in the simulator module contained in the graphic editor 'V-SFT' versions prior to v6.1.6.0, which ma (no CVSS, FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT)
- [CVE-2022-30538](https://cve.now/CVE-2022-30538.md): Out-of-bounds write vulnerability exists in the simulator module contained in the graphic editor 'V-SFT' versions prior to v6.1.6.0, which m (no CVSS, FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT)
- [CVE-2022-30533](https://cve.now/CVE-2022-30533.md): Cross-site scripting vulnerability in Modern Events Calendar Lite versions prior to 6.3.0 allows remote an authenticated attacker to inject (no CVSS, Webnus Modern Events Calendar Lite)
- [CVE-2022-2085](https://cve.now/CVE-2022-2085.md): A NULL pointer dereference vulnerability was found in Ghostscript, which occurs when it tries to render a large number of bits in memory. (no CVSS, GhostScript)
- [CVE-2022-31291](https://cve.now/CVE-2022-31291.md): An issue in dlt\_config\_file\_parser.c of dlt-daemon v2.18.8 allows attackers to cause a double free via crafted TCP packets. (no CVSS)
- [CVE-2022-32545](https://cve.now/CVE-2022-32545.md): A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned char' at coders/psd.c, when (no CVSS, ImageMagick)
- [CVE-2022-32546](https://cve.now/CVE-2022-32546.md): A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned long' at coders/pcl.c, when (no CVSS, ImageMagick)
- [CVE-2022-32547](https://cve.now/CVE-2022-32547.md): In ImageMagick, there is load of misaligned address for type 'double', which requires 8 byte alignment and for type 'float', which requires (no CVSS, ImageMagick)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-06-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.