# CVEs published 2022-06-20

59 CVEs were published on June 20, 2022: 3 critical, 6 high. Days are UTC.

- [CVE-2017-20066](https://cve.now/CVE-2017-20066.md): Adminer Login access control (CVSS 5.3, Adminer Login)
- [CVE-2017-20065](https://cve.now/CVE-2017-20065.md): Supsystic Popup Plugin cross-site request forgery (CVSS 4.3, Supsystic Popup Plugin)
- [CVE-2022-2128](https://cve.now/CVE-2022-2128.md): Unrestricted Upload of File with Dangerous Type in polonel/trudesk (CVSS 9.6, polonel/trudesk)
- [CVE-2022-22414](https://cve.now/CVE-2022-22414.md): IBM Robotic Process Automation 21.0.2 could allow a local user to obtain sensitive web service configuration credentials from system memory. (CVSS 5.1, IBM Robotic Process Automation)
- [CVE-2022-22318](https://cve.now/CVE-2022-22318.md): IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authenticated user to impe (CVSS 5.9, IBM Curam Social Program Management)
- [CVE-2022-22317](https://cve.now/CVE-2022-22317.md): IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authenticated user to impe (CVSS 5.9, IBM Curam Social Program Management)
- [CVE-2022-33913](https://cve.now/CVE-2022-33913.md): In Mahara 21.04 before 21.04.6, 21.10 before 21.10.4, and 22.04.2, files can sometimes be downloaded through thumb.php with no permission ch (no CVSS)
- [CVE-2022-32983](https://cve.now/CVE-2022-32983.md): Knot Resolver through 5.5.1 may allow DNS cache poisoning when there is an attempt to limit forwarding actions by filters. (no CVSS)
- [CVE-2022-31795](https://cve.now/CVE-2022-31795.md): An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 (Control Center) devices before 8.1A SP02 P04. (no CVSS)
- [CVE-2022-31794](https://cve.now/CVE-2022-31794.md): An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 (Control Center) devices before 8.1A SP02 P04. (no CVSS)
- [CVE-2021-41683](https://cve.now/CVE-2021-41683.md): There is a stack-overflow at ecma-helpers.c:326 in ecma\_get\_lex\_env\_type in JerryScript 2.4.0 (no CVSS)
- [CVE-2021-41682](https://cve.now/CVE-2021-41682.md): There is a heap-use-after-free at ecma-helpers-string.c:1940 in ecma\_compare\_ecma\_non\_direct\_strings in JerryScript 2.4.0 (no CVSS)
- [CVE-2022-1945](https://cve.now/CVE-2022-1945.md): Coming Soon and Maintenance by Colorlib \< 1.0.99 - Admin+ Stored Cross Site Scripting (no CVSS, Coming Soon & Maintenance Mode by Colorlib)
- [CVE-2022-1939](https://cve.now/CVE-2022-1939.md): Allow SVG Files \< 1.1 - Admin+ Arbitrary File Upload (no CVSS, Allow svg files)
- [CVE-2022-1915](https://cve.now/CVE-2022-1915.md): WP Zillow Review Slider \< 2.4 - Admin+ Stored Cross-Site Scripting (no CVSS, WP Zillow Review Slider)
- [CVE-2022-1905](https://cve.now/CVE-2022-1905.md): Events Made Easy \< 2.2.81 - Unauthenticated SQLi (no CVSS, Events Made Easy)
- [CVE-2022-1896](https://cve.now/CVE-2022-1896.md): underConstruction \< 1.21 - Admin+ Stored Cross-Site Scripting (no CVSS, underConstruction)
- [CVE-2022-1895](https://cve.now/CVE-2022-1895.md): underConstruction \< 1.20 - Construction Mode Deactivation via CSRF (no CVSS, underConstruction)
- [CVE-2022-1889](https://cve.now/CVE-2022-1889.md): Newsletter \< 7.4.6 - Admin+ Stored Cross-Site Scripting (no CVSS, Newsletter – Send awesome emails from WordPress)
- [CVE-2022-1832](https://cve.now/CVE-2022-1832.md): CaPa Protect \<= 0.5.8.2 - Arbitrary Settings Update via CSRF (no CVSS, CaPa Protect)
- [CVE-2022-1831](https://cve.now/CVE-2022-1831.md): WPlite \<= 1.3.1 - Arbitrary Settings Update via CSRF (no CVSS, WPlite)
- [CVE-2022-1830](https://cve.now/CVE-2022-1830.md): Amazon Einzeltitellinks \<= 1.3.3 - Arbitrary Settings Update to Stored XSS via CSRF (no CVSS, Amazon Einzeltitellinks)
- [CVE-2022-1829](https://cve.now/CVE-2022-1829.md): Inline Google Maps \<= 5.11 - Arbitrary Settings Update to Stored XSS via CSRF (no CVSS, Inline Google Maps)
- [CVE-2022-1828](https://cve.now/CVE-2022-1828.md): PDF24 Articles To PDF \<= 4.2.2 - Arbitrary Settings Update via CSRF (no CVSS, PDF24 Articles To PDF)
- [CVE-2022-1827](https://cve.now/CVE-2022-1827.md): PDF24 Article To PDF \<= 4.2.2 - Arbitrary Settings Update via CSRF (no CVSS, PDF24 Article To PDF)
- [CVE-2022-1826](https://cve.now/CVE-2022-1826.md): Cross-Linker \<= 3.0.1.9 - Arbitrary Cross-Link Creation via CSRF (no CVSS, Cross-Linker)
- [CVE-2022-1818](https://cve.now/CVE-2022-1818.md): Multi-page Toolkit \<= 2.6 - Arbitrary Settings Update to Stored XSS via CSRF (no CVSS, Multi-page Toolkit)
- [CVE-2022-1801](https://cve.now/CVE-2022-1801.md): Very Simple Contact Form \< 11.6 - Captcha bypass (no CVSS, Very Simple Contact Form)
- [CVE-2022-1717](https://cve.now/CVE-2022-1717.md): Custom Share Buttons with Floating Sidebar \< 4.2 - Admin+ Stored XSS (no CVSS, Custom Share Buttons with Floating Sidebar)
- [CVE-2022-1630](https://cve.now/CVE-2022-1630.md): WP-Email \< 2.69.0 - Log Deletion via CSRF (no CVSS, WP-EMail)
- [CVE-2022-1614](https://cve.now/CVE-2022-1614.md): WP-Email \< 2.69.0 - Anti-Spam Protection Bypass via IP Spoofing (no CVSS, WP-EMail)
- [CVE-2022-1610](https://cve.now/CVE-2022-1610.md): Seamless Donations \< 5.1.9 - Arbitrary Settings Update via CSRF (no CVSS, Seamless Donations: A Platform for Global Fundraising and R…)
- [CVE-2022-1603](https://cve.now/CVE-2022-1603.md): Mail Subscribe List \< 2.1.4 - Arbitrary Subscribed User Deletion via CSRF (no CVSS, Mail Subscribe List)
- [CVE-2022-1472](https://cve.now/CVE-2022-1472.md): Better Find and Replace \< 1.3.6 - Admin+ SQLi (no CVSS, Better Find and Replace)
- [CVE-2022-1266](https://cve.now/CVE-2022-1266.md): Post Grid, Slider & Carousel Ultimate \< 1.5.0 - Admin+ Stored XSS (no CVSS, Post Grid, Slider & Carousel Ultimate)
- [CVE-2022-0663](https://cve.now/CVE-2022-0663.md): Print, PDF, Email by PrintFriendly \< 5.2.3 - Admin+ Stored Cross-Site Scripting (no CVSS, Print, PDF, Email by PrintFriendly)
- [CVE-2021-25121](https://cve.now/CVE-2021-25121.md): Rating by BestWebSoft \< 1.6 - Rating Denial of Service (no CVSS, Rating by BestWebSoft)
- [CVE-2021-25104](https://cve.now/CVE-2021-25104.md): Ocean Extra \< 1.9.5 - Reflected Cross-Site Scripting (no CVSS, Ocean Extra)
- [CVE-2021-25088](https://cve.now/CVE-2021-25088.md): Google XML Sitemaps \< 4.1.3 - Admin+ Stored Cross-Site Scripting (no CVSS, XML Sitemaps)
- [CVE-2022-1823](https://cve.now/CVE-2022-1823.md): McAfee MCPR privilege escalation (CVSS 7.9, McAfee Consumer Product Removal Tool)
- [CVE-2022-1824](https://cve.now/CVE-2022-1824.md): McAfee MCPR privilege escalation (CVSS 7.9, McAfee Consumer Product Removal Tool)
- [CVE-2022-31734](https://cve.now/CVE-2022-31734.md): Cisco Catalyst 2940 Series Switches provided by Cisco Systems, Inc. (no CVSS, Cisco Systems Cisco Catalyst 2940 Series Switches)
- [CVE-2022-2130](https://cve.now/CVE-2022-2130.md): Cross-site Scripting (XSS) - Reflected in microweber/microweber (CVSS 6.5, microweber/microweber)
- [CVE-2022-26669](https://cve.now/CVE-2022-26669.md): ASUS Control Center - SQL Injection (CVSS 8.8, ASUS Control Center)
- [CVE-2022-26668](https://cve.now/CVE-2022-26668.md): ASUS Control Center - Broken Access Control (CVSS 7.3, ASUS Control Center)
- [CVE-2022-21742](https://cve.now/CVE-2022-21742.md): Realtek USB FE/1GbE/2.5GbE/5GbE NIC Family - Buffer Overflow (CVSS 6.2, Realtek USB FE/1GbE/2.5GbE/5GbE NIC Family)
- [CVE-2021-45918](https://cve.now/CVE-2021-45918.md): NHI’s health insurance web service component – Heap-based Buffer Overflow (CVSS 7.5, NHI health insurance web service component)
- [CVE-2017-20064](https://cve.now/CVE-2017-20064.md): Elefant CMS layout code injection (CVSS 6.3, Elefant CMS · elefant/cms)
- [CVE-2017-20063](https://cve.now/CVE-2017-20063.md): Elefant CMS File Upload drop privileges management (CVSS 6.3, Elefant CMS · elefant/cms)
- [CVE-2017-20062](https://cve.now/CVE-2017-20062.md): Elefant CMS cross-site request forgery (CVSS 5.0, Elefant CMS · elefant/cms)
- [CVE-2017-20061](https://cve.now/CVE-2017-20061.md): Elefant CMS extended Reflected cross site scriting (CVSS 4.3, Elefant CMS · elefant/cms)
- [CVE-2017-20060](https://cve.now/CVE-2017-20060.md): Elefant CMS Blog Post Persistent cross site scriting (CVSS 3.5, Elefant CMS · elefant/cms)
- [CVE-2017-20059](https://cve.now/CVE-2017-20059.md): Elefant CMS Title Persistent cross site scriting (CVSS 3.5, Elefant CMS · elefant/cms)
- [CVE-2017-20058](https://cve.now/CVE-2017-20058.md): Elefant CMS Version Comparison Persistent cross site scriting (CVSS 4.3, Elefant CMS · elefant/cms)
- [CVE-2017-20057](https://cve.now/CVE-2017-20057.md): Elefant CMS Persistent cross site scriting (CVSS 4.3, Elefant CMS · elefant/cms)
- [CVE-2022-2023](https://cve.now/CVE-2022-2023.md): Incorrect Use of Privileged APIs in polonel/trudesk (CVSS 10.0, polonel/trudesk)
- [CVE-2022-2134](https://cve.now/CVE-2022-2134.md): Allocation of Resources Without Limits or Throttling in inventree/inventree (CVSS 7.1, inventree/inventree)
- [CVE-2022-25772](https://cve.now/CVE-2022-25772.md): A cross-site scripting (XSS) vulnerability in the web tracking component of Mautic before 4.3.0 allows remote attackers to inject executable (CVSS 9.6, Mautic · mautic/core)
- [CVE-2022-31062](https://cve.now/CVE-2022-31062.md): Unauthenticated Local File Inclusion (CVSS 5.3, glpi-project glpi-inventory-plugin)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-06-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.