CVEs published June 20, 2022
59 CVEs were published on June 20, 2022: 3 critical, 6 high.
- Published
- 59
- Critical
- 3
- High
- 6
- Medium
- 14
- Low
- 2
- Unrated
- 34
- Now in CISA KEV
- 0
- Fix available
- 35
Most affected products
- Elefant CMS · elefant/cms
- 8
- ASUS Control Center
- 2
- IBM Curam Social Program Management
- 2
- McAfee Consumer Product Removal Tool
- 2
- polonel/trudesk
- 2
- underConstruction
- 2
- WP-EMail
- 2
- Adminer Login
- 1
- Allow svg files
- 1
- Amazon Einzeltitellinks
- 1
Critical 3
- CVE-2022-2128Unrestricted Upload of File with Dangerous Type in polonel/trudeskpolonel/trudesk
- CVE-2022-2023Incorrect Use of Privileged APIs in polonel/trudeskpolonel/trudesk
- CVE-2022-25772A cross-site scripting (XSS) vulnerability in the web tracking component of Mautic before 4.3.0 allows remote attackers to inject executableMautic · mautic/core
High 6
- CVE-2022-1823McAfee MCPR privilege escalationMcAfee Consumer Product Removal Tool
- CVE-2022-1824McAfee MCPR privilege escalationMcAfee Consumer Product Removal Tool
- CVE-2022-26669ASUS Control Center - SQL InjectionASUS Control Center
- CVE-2022-26668ASUS Control Center - Broken Access ControlASUS Control Center
- CVE-2021-45918NHI’s health insurance web service component – Heap-based Buffer OverflowNHI health insurance web service component
- CVE-2022-2134Allocation of Resources Without Limits or Throttling in inventree/inventreeinventree/inventree
Medium, low and unrated 50
- CVE-2017-20066Adminer Login access controlAdminer Login
- CVE-2017-20065Supsystic Popup Plugin cross-site request forgerySupsystic Popup Plugin
- CVE-2022-22414IBM Robotic Process Automation 21.0.2 could allow a local user to obtain sensitive web service configuration credentials from system memory.IBM Robotic Process Automation
- CVE-2022-22318IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authenticated user to impeIBM Curam Social Program Management
- CVE-2022-22317IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authenticated user to impeIBM Curam Social Program Management
- CVE-2022-33913In Mahara 21.04 before 21.04.6, 21.10 before 21.10.4, and 22.04.2, files can sometimes be downloaded through thumb.php with no permission ch
- CVE-2022-32983Knot Resolver through 5.5.1 may allow DNS cache poisoning when there is an attempt to limit forwarding actions by filters.
- CVE-2022-31795An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 (Control Center) devices before 8.1A SP02 P04.
- CVE-2022-31794An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 (Control Center) devices before 8.1A SP02 P04.
- CVE-2021-41683There is a stack-overflow at ecma-helpers.c:326 in ecma_get_lex_env_type in JerryScript 2.4.0
- CVE-2021-41682There is a heap-use-after-free at ecma-helpers-string.c:1940 in ecma_compare_ecma_non_direct_strings in JerryScript 2.4.0
- CVE-2022-1945Coming Soon and Maintenance by Colorlib < 1.0.99 - Admin+ Stored Cross Site ScriptingComing Soon & Maintenance Mode by Colorlib
- CVE-2022-1939Allow SVG Files < 1.1 - Admin+ Arbitrary File UploadAllow svg files
- CVE-2022-1915WP Zillow Review Slider < 2.4 - Admin+ Stored Cross-Site ScriptingWP Zillow Review Slider
- CVE-2022-1905Events Made Easy < 2.2.81 - Unauthenticated SQLiEvents Made Easy
- CVE-2022-1896underConstruction < 1.21 - Admin+ Stored Cross-Site ScriptingunderConstruction
- CVE-2022-1895underConstruction < 1.20 - Construction Mode Deactivation via CSRFunderConstruction
- CVE-2022-1889Newsletter < 7.4.6 - Admin+ Stored Cross-Site ScriptingNewsletter – Send awesome emails from WordPress
- CVE-2022-1832CaPa Protect <= 0.5.8.2 - Arbitrary Settings Update via CSRFCaPa Protect
- CVE-2022-1831WPlite <= 1.3.1 - Arbitrary Settings Update via CSRFWPlite
- CVE-2022-1830Amazon Einzeltitellinks <= 1.3.3 - Arbitrary Settings Update to Stored XSS via CSRFAmazon Einzeltitellinks
- CVE-2022-1829Inline Google Maps <= 5.11 - Arbitrary Settings Update to Stored XSS via CSRFInline Google Maps
- CVE-2022-1828PDF24 Articles To PDF <= 4.2.2 - Arbitrary Settings Update via CSRFPDF24 Articles To PDF
- CVE-2022-1827PDF24 Article To PDF <= 4.2.2 - Arbitrary Settings Update via CSRFPDF24 Article To PDF
- CVE-2022-1826Cross-Linker <= 3.0.1.9 - Arbitrary Cross-Link Creation via CSRFCross-Linker
- CVE-2022-1818Multi-page Toolkit <= 2.6 - Arbitrary Settings Update to Stored XSS via CSRFMulti-page Toolkit
- CVE-2022-1801Very Simple Contact Form < 11.6 - Captcha bypassVery Simple Contact Form
- CVE-2022-1717Custom Share Buttons with Floating Sidebar < 4.2 - Admin+ Stored XSSCustom Share Buttons with Floating Sidebar
- CVE-2022-1630WP-Email < 2.69.0 - Log Deletion via CSRFWP-EMail
- CVE-2022-1614WP-Email < 2.69.0 - Anti-Spam Protection Bypass via IP SpoofingWP-EMail
- CVE-2022-1610Seamless Donations < 5.1.9 - Arbitrary Settings Update via CSRFSeamless Donations: A Platform for Global Fundraising and R…
- CVE-2022-1603Mail Subscribe List < 2.1.4 - Arbitrary Subscribed User Deletion via CSRFMail Subscribe List
- CVE-2022-1472Better Find and Replace < 1.3.6 - Admin+ SQLiBetter Find and Replace
- CVE-2022-1266Post Grid, Slider & Carousel Ultimate < 1.5.0 - Admin+ Stored XSSPost Grid, Slider & Carousel Ultimate
- CVE-2022-0663Print, PDF, Email by PrintFriendly < 5.2.3 - Admin+ Stored Cross-Site ScriptingPrint, PDF, Email by PrintFriendly
- CVE-2021-25121Rating by BestWebSoft < 1.6 - Rating Denial of ServiceRating by BestWebSoft
- CVE-2021-25104Ocean Extra < 1.9.5 - Reflected Cross-Site ScriptingOcean Extra
- CVE-2021-25088Google XML Sitemaps < 4.1.3 - Admin+ Stored Cross-Site ScriptingXML Sitemaps
- CVE-2022-31734Cisco Catalyst 2940 Series Switches provided by Cisco Systems, Inc.Cisco Systems Cisco Catalyst 2940 Series Switches
- CVE-2022-2130Cross-site Scripting (XSS) - Reflected in microweber/microwebermicroweber/microweber
- CVE-2022-21742Realtek USB FE/1GbE/2.5GbE/5GbE NIC Family - Buffer OverflowRealtek USB FE/1GbE/2.5GbE/5GbE NIC Family
- CVE-2017-20064Elefant CMS layout code injectionElefant CMS · elefant/cms
- CVE-2017-20063Elefant CMS File Upload drop privileges managementElefant CMS · elefant/cms
- CVE-2017-20062Elefant CMS cross-site request forgeryElefant CMS · elefant/cms
- CVE-2017-20061Elefant CMS extended Reflected cross site scritingElefant CMS · elefant/cms
- CVE-2017-20060Elefant CMS Blog Post Persistent cross site scritingElefant CMS · elefant/cms
- CVE-2017-20059Elefant CMS Title Persistent cross site scritingElefant CMS · elefant/cms
- CVE-2017-20058Elefant CMS Version Comparison Persistent cross site scritingElefant CMS · elefant/cms
- CVE-2017-20057Elefant CMS Persistent cross site scritingElefant CMS · elefant/cms
- CVE-2022-31062Unauthenticated Local File Inclusionglpi-project glpi-inventory-plugin