CVEs published June 21, 2022
63 CVEs were published on June 21, 2022: 3 critical, 1 high.
- Published
- 63
- Critical
- 3
- High
- 1
- Medium
- 18
- Low
- 0
- Unrated
- 41
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- Hindu Matrimonial Script
- 15
- Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, Aut…
- 3
- recipes
- 3
- Nessus
- 2
- ABB REX640 PCL1 · ABB REX640 PCL2 +1
- 1
- AMQ Broker Operator
- 1
- AtlasVPN
- 1
- Autodesk AutoCAD product suite, Revit, Design Review and Na…
- 1
- Autodesk Inventor, Advanced Steel, Civil 3D, AutoCAD, AutoC…
- 1
- discourse-chat
- 1
Critical 3
- CVE-2022-2068The c_rehash script allows command injectionOpenSSL
- CVE-2022-31801Insufficient Verification of Data Vulnerability in ProConOS/ProConOS eCLR SDK and MULTIPROG Engineering toolPHOENIX CONTACT MULTIPROG · PHOENIX CONTACT ProConOS
- CVE-2022-31800Insufficient Verification of Data Vulnerability in PHOENIX CONTACT classic line industrial controllersPHOENIX CONTACT ILC 1x0 · PHOENIX CONTACT ILC 1x1 +12
High 1
Medium, low and unrated 59
- CVE-2022-31095Exposure of Sensitive Information in discourse-chatdiscourse-chat
- CVE-2021-40510XML eXternal Entity (XXE) in OBDA systems’ Mastro 1.0 allows remote attackers to read system files via custom DTDs.
- CVE-2021-40511OBDA systems’ Mastro 1.0 is vulnerable to XML Entity Expansion (aka “billion laughs”) attack allowing denial of service.
- CVE-2021-36761The GeoAnalytics feature in Qlik Sense April 2020 patch 4 allows SSRF.
- CVE-2021-39006IBM QRadar WinCollect Agent 10.0 and 10.0.1 could allow an attacker to obtain sensitive information due to missing best practices.IBM QRadar WinCollect Agent
- CVE-2022-33995A path traversal issue in entry attachments in Devolutions Remote Desktop Manager before 2022.2 allows attackers to create or overwrite file
- CVE-2022-30874There is a Cross Site Scripting Stored (XSS) vulnerability in NukeViet CMS before 4.5.02.nukeviet/nukeviet
- CVE-2022-26147The Quectel RG502Q-EA modem before 2022-02-23 allow OS Command Injection.
- CVE-2022-1596ABB Relion REX640 Insufficient file access controlABB REX640 PCL1 · ABB REX640 PCL2 +1
- CVE-2022-1833A flaw was found in AMQ Broker Operator 7.9.4 installed via UI using OperatorHub where a low-privilege user that has access to the namespaceAMQ Broker Operator
- CVE-2022-1665A set of pre-production kernel packages of Red Hat Enterprise Linux for IBM Power architecture can be booted by the grub in Secure Boot modeRed Hat Enterprise Linux
- CVE-2022-23171AtlasVPN - Privilege EscalationAtlasVPN
- CVE-2022-22979In Spring Cloud Function versions prior to 3.2.6, it is possible for a user who directly interacts with framework provided lookup functionalSpring Cloud Function · org.springframework.cloud:spring-cl…
- CVE-2022-27872A maliciously crafted PDF file may be used to dereference a pointer for read or write operation while parsing PDF files in Autodesk NavisworNavisworks
- CVE-2022-27870A maliciously crafted TGA file in Autodesk AutoCAD 2023 may be used to write beyond the allocated buffer while parsing TGA file.Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, Aut…
- CVE-2022-27868A maliciously crafted CAT file in Autodesk AutoCAD 2023 can be used to trigger use-after-free vulnerability.Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, Aut…
- CVE-2022-27867A maliciously crafted JT file in Autodesk AutoCAD 2022, 2021, 2020, 2019 can be used to trigger use-after-free vulnerability.Autodesk Inventor, Advanced Steel, Civil 3D, AutoCAD, AutoC…
- CVE-2022-27871Autodesk AutoCAD product suite, Revit, Design Review and Navisworks releases using PDFTron prior to 9.1.17 version may be used to write beyoAutodesk AutoCAD product suite, Revit, Design Review and Na…
- CVE-2022-27869A maliciously crafted TIFF file in Autodesk AutoCAD 2023 can be forced to read and write beyond allocated boundaries when parsing the TIFF fAutodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, Aut…
- CVE-2022-32974An authenticated attacker could read arbitrary files from the underlying operating system of the scanner using a custom crafted compliance aNessus
- CVE-2022-32973An authenticated attacker could create an audit file that bypasses PowerShell cmdlet checks and executes commands with administrator privileNessus
- CVE-2022-34008Comodo Antivirus 12.2.2.8012 has a quarantine flaw that allows privilege escalation.
- CVE-2021-41924Webkul krayin crm before 1.2.2 is vulnerable to Cross Site Scripting (XSS).krayin/laravel-crm
- CVE-2022-31786IdeaLMS 2022 allows reflected Cross Site Scripting (XSS) via the IdeaLMS/Class/Assessment/ PATH_INFO.
- CVE-2022-29774iSpy v7.2.2.0 is vulnerable to remote command execution via path traversal.
- CVE-2022-29775iSpyConnect iSpy v7.2.2.0 allows attackers to bypass authentication via a crafted URL.
- CVE-2022-31478The UserTakeOver plugin before 4.0.1 for ILIAS allows an attacker to list all users via the search function.
- CVE-2022-23342The Hyland Onbase Application Server releases prior to 20.3.58.1000 and OnBase releases 21.1.1.1000 through 21.1.15.1000 are vulnerable to a
- CVE-2022-33056Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /orrs/admin/schedules
- CVE-2022-33055Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /orrs/admin/trains/ma
- CVE-2022-25585Unioncms v1.0.13 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Default settings.
- CVE-2022-33049Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /orrs/admin/?page=use
- CVE-2022-33048Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /orrs/admin/reservati
- CVE-2022-33119NUUO Network Video Recorder NVRsolo v03.06.02 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via login.php.
- CVE-2022-31373SolarView Compact v6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Solar_AiConf.php.
- CVE-2022-31374An arbitrary file upload vulnerability /images/background/1.php in of SolarView Compact 6.0 allows attackers to execute arbitrary code via a
- CVE-2022-32414Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_vmcode_interpreter at src/njs_vmcode.c.
- CVE-2022-31307Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_string_offset at src/njs_string.c.
- CVE-2022-31306Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_array_convert_to_slow_array at src/njs_array.c.
- CVE-2022-31303maccms10 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Server Group text field.
- CVE-2022-31302maccms8 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Server Group text field.
- CVE-2022-23074Recipes - Stored XSS in Name Parameterrecipes
- CVE-2022-23073Recipes - Stored XSS in Clipboardrecipes
- CVE-2022-23072Recipes - Stored XSS in Add to Cartrecipes
- CVE-2017-20081Hindu Matrimonial Script reports.php privileges managementHindu Matrimonial Script
- CVE-2017-20080Hindu Matrimonial Script googleads.php privileges managementHindu Matrimonial Script
- CVE-2017-20079Hindu Matrimonial Script photo.php privileges managementHindu Matrimonial Script
- CVE-2017-20078Hindu Matrimonial Script featured.php privileges managementHindu Matrimonial Script
- CVE-2017-20077Hindu Matrimonial Script success_story.php privileges managementHindu Matrimonial Script
- CVE-2017-20076Hindu Matrimonial Script searchview.php privileges managementHindu Matrimonial Script
- CVE-2017-20075Hindu Matrimonial Script payment.php privileges managementHindu Matrimonial Script
- CVE-2017-20074Hindu Matrimonial Script newsletter1.php privileges managementHindu Matrimonial Script
- CVE-2017-20073Hindu Matrimonial Script cms.php privileges managementHindu Matrimonial Script
- CVE-2017-20072Hindu Matrimonial Script generalsettings.php privileges managementHindu Matrimonial Script
- CVE-2017-20071Hindu Matrimonial Script renewaldue.php privileges managementHindu Matrimonial Script
- CVE-2017-20070Hindu Matrimonial Script communitymanagement.php privileges managementHindu Matrimonial Script
- CVE-2017-20069Hindu Matrimonial Script countrymanagement.php privileges managementHindu Matrimonial Script
- CVE-2017-20068Hindu Matrimonial Script usermanagement.php privileges managementHindu Matrimonial Script
- CVE-2022-33139A vulnerability has been identified in Cerberus DMS (All versions), Desigo CC (All versions), Desigo CC Compact (All versions), SIMATIC WinCSiemens Cerberus DMS · Siemens Desigo CC +1