# CVEs published 2022-06-21

63 CVEs were published on June 21, 2022: 3 critical, 1 high. Days are UTC.

- [CVE-2022-31095](https://cve.now/CVE-2022-31095.md): Exposure of Sensitive Information in discourse-chat (CVSS 4.3, discourse-chat)
- [CVE-2021-40510](https://cve.now/CVE-2021-40510.md): XML eXternal Entity (XXE) in OBDA systems’ Mastro 1.0 allows remote attackers to read system files via custom DTDs. (no CVSS)
- [CVE-2021-40511](https://cve.now/CVE-2021-40511.md): OBDA systems’ Mastro 1.0 is vulnerable to XML Entity Expansion (aka “billion laughs”) attack allowing denial of service. (no CVSS)
- [CVE-2021-36761](https://cve.now/CVE-2021-36761.md): The GeoAnalytics feature in Qlik Sense April 2020 patch 4 allows SSRF. (no CVSS)
- [CVE-2021-39006](https://cve.now/CVE-2021-39006.md): IBM QRadar WinCollect Agent 10.0 and 10.0.1 could allow an attacker to obtain sensitive information due to missing best practices. (CVSS 5.3, IBM QRadar WinCollect Agent)
- [CVE-2022-2068](https://cve.now/CVE-2022-2068.md): The c\_rehash script allows command injection (CVSS 9.8, OpenSSL)
- [CVE-2022-33995](https://cve.now/CVE-2022-33995.md): A path traversal issue in entry attachments in Devolutions Remote Desktop Manager before 2022.2 allows attackers to create or overwrite file (no CVSS)
- [CVE-2022-30874](https://cve.now/CVE-2022-30874.md): There is a Cross Site Scripting Stored (XSS) vulnerability in NukeViet CMS before 4.5.02. (no CVSS, nukeviet/nukeviet)
- [CVE-2022-26147](https://cve.now/CVE-2022-26147.md): The Quectel RG502Q-EA modem before 2022-02-23 allow OS Command Injection. (no CVSS)
- [CVE-2022-1596](https://cve.now/CVE-2022-1596.md): ABB Relion REX640 Insufficient file access control (CVSS 6.5, ABB REX640 PCL1 · ABB REX640 PCL2 +1)
- [CVE-2022-1833](https://cve.now/CVE-2022-1833.md): A flaw was found in AMQ Broker Operator 7.9.4 installed via UI using OperatorHub where a low-privilege user that has access to the namespace (no CVSS, AMQ Broker Operator)
- [CVE-2022-1665](https://cve.now/CVE-2022-1665.md): A set of pre-production kernel packages of Red Hat Enterprise Linux for IBM Power architecture can be booted by the grub in Secure Boot mode (no CVSS, Red Hat Enterprise Linux)
- [CVE-2022-23171](https://cve.now/CVE-2022-23171.md): AtlasVPN - Privilege Escalation (CVSS 5.9, AtlasVPN)
- [CVE-2022-22979](https://cve.now/CVE-2022-22979.md): In Spring Cloud Function versions prior to 3.2.6, it is possible for a user who directly interacts with framework provided lookup functional (no CVSS, Spring Cloud Function · org.springframework.cloud:spring-cl…)
- [CVE-2022-27872](https://cve.now/CVE-2022-27872.md): A maliciously crafted PDF file may be used to dereference a pointer for read or write operation while parsing PDF files in Autodesk Naviswor (no CVSS, Navisworks)
- [CVE-2022-27870](https://cve.now/CVE-2022-27870.md): A maliciously crafted TGA file in Autodesk AutoCAD 2023 may be used to write beyond the allocated buffer while parsing TGA file. (no CVSS, Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, Aut…)
- [CVE-2022-27868](https://cve.now/CVE-2022-27868.md): A maliciously crafted CAT file in Autodesk AutoCAD 2023 can be used to trigger use-after-free vulnerability. (no CVSS, Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, Aut…)
- [CVE-2022-27867](https://cve.now/CVE-2022-27867.md): A maliciously crafted JT file in Autodesk AutoCAD 2022, 2021, 2020, 2019 can be used to trigger use-after-free vulnerability. (no CVSS, Autodesk Inventor, Advanced Steel, Civil 3D, AutoCAD, AutoC…)
- [CVE-2022-27871](https://cve.now/CVE-2022-27871.md): Autodesk AutoCAD product suite, Revit, Design Review and Navisworks releases using PDFTron prior to 9.1.17 version may be used to write beyo (no CVSS, Autodesk AutoCAD product suite, Revit, Design Review and Na…)
- [CVE-2022-27869](https://cve.now/CVE-2022-27869.md): A maliciously crafted TIFF file in Autodesk AutoCAD 2023 can be forced to read and write beyond allocated boundaries when parsing the TIFF f (no CVSS, Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, Aut…)
- [CVE-2022-32974](https://cve.now/CVE-2022-32974.md): An authenticated attacker could read arbitrary files from the underlying operating system of the scanner using a custom crafted compliance a (no CVSS, Nessus)
- [CVE-2022-32973](https://cve.now/CVE-2022-32973.md): An authenticated attacker could create an audit file that bypasses PowerShell cmdlet checks and executes commands with administrator privile (no CVSS, Nessus)
- [CVE-2022-34008](https://cve.now/CVE-2022-34008.md): Comodo Antivirus 12.2.2.8012 has a quarantine flaw that allows privilege escalation. (no CVSS)
- [CVE-2021-41924](https://cve.now/CVE-2021-41924.md): Webkul krayin crm before 1.2.2 is vulnerable to Cross Site Scripting (XSS). (no CVSS, krayin/laravel-crm)
- [CVE-2022-31786](https://cve.now/CVE-2022-31786.md): IdeaLMS 2022 allows reflected Cross Site Scripting (XSS) via the IdeaLMS/Class/Assessment/ PATH\_INFO. (no CVSS)
- [CVE-2022-29774](https://cve.now/CVE-2022-29774.md): iSpy v7.2.2.0 is vulnerable to remote command execution via path traversal. (no CVSS)
- [CVE-2022-29775](https://cve.now/CVE-2022-29775.md): iSpyConnect iSpy v7.2.2.0 allows attackers to bypass authentication via a crafted URL. (no CVSS)
- [CVE-2022-31478](https://cve.now/CVE-2022-31478.md): The UserTakeOver plugin before 4.0.1 for ILIAS allows an attacker to list all users via the search function. (no CVSS)
- [CVE-2022-23342](https://cve.now/CVE-2022-23342.md): The Hyland Onbase Application Server releases prior to 20.3.58.1000 and OnBase releases 21.1.1.1000 through 21.1.15.1000 are vulnerable to a (no CVSS)
- [CVE-2022-33056](https://cve.now/CVE-2022-33056.md): Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /orrs/admin/schedules (no CVSS)
- [CVE-2022-33055](https://cve.now/CVE-2022-33055.md): Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /orrs/admin/trains/ma (no CVSS)
- [CVE-2022-25585](https://cve.now/CVE-2022-25585.md): Unioncms v1.0.13 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Default settings. (no CVSS)
- [CVE-2022-33049](https://cve.now/CVE-2022-33049.md): Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /orrs/admin/?page=use (no CVSS)
- [CVE-2022-33048](https://cve.now/CVE-2022-33048.md): Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /orrs/admin/reservati (no CVSS)
- [CVE-2022-33119](https://cve.now/CVE-2022-33119.md): NUUO Network Video Recorder NVRsolo v03.06.02 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via login.php. (no CVSS)
- [CVE-2022-31373](https://cve.now/CVE-2022-31373.md): SolarView Compact v6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Solar\_AiConf.php. (no CVSS)
- [CVE-2022-31374](https://cve.now/CVE-2022-31374.md): An arbitrary file upload vulnerability /images/background/1.php in of SolarView Compact 6.0 allows attackers to execute arbitrary code via a (no CVSS)
- [CVE-2022-32414](https://cve.now/CVE-2022-32414.md): Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs\_vmcode\_interpreter at src/njs\_vmcode.c. (no CVSS)
- [CVE-2022-31307](https://cve.now/CVE-2022-31307.md): Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs\_string\_offset at src/njs\_string.c. (no CVSS)
- [CVE-2022-31306](https://cve.now/CVE-2022-31306.md): Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs\_array\_convert\_to\_slow\_array at src/njs\_array.c. (no CVSS)
- [CVE-2022-31303](https://cve.now/CVE-2022-31303.md): maccms10 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Server Group text field. (no CVSS)
- [CVE-2022-31302](https://cve.now/CVE-2022-31302.md): maccms8 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Server Group text field. (no CVSS)
- [CVE-2022-23074](https://cve.now/CVE-2022-23074.md): Recipes - Stored XSS in Name Parameter (no CVSS, recipes)
- [CVE-2022-23073](https://cve.now/CVE-2022-23073.md): Recipes - Stored XSS in Clipboard (no CVSS, recipes)
- [CVE-2022-23072](https://cve.now/CVE-2022-23072.md): Recipes - Stored XSS in Add to Cart (no CVSS, recipes)
- [CVE-2022-31801](https://cve.now/CVE-2022-31801.md): Insufficient Verification of Data Vulnerability in ProConOS/ProConOS eCLR SDK and MULTIPROG Engineering tool (CVSS 9.8, PHOENIX CONTACT MULTIPROG · PHOENIX CONTACT ProConOS)
- [CVE-2022-31800](https://cve.now/CVE-2022-31800.md): Insufficient Verification of Data Vulnerability in PHOENIX CONTACT classic line industrial controllers (CVSS 9.8, PHOENIX CONTACT ILC 1x0 · PHOENIX CONTACT ILC 1x1 +12)
- [CVE-2017-20081](https://cve.now/CVE-2017-20081.md): Hindu Matrimonial Script reports.php privileges management (CVSS 6.3, Hindu Matrimonial Script)
- [CVE-2017-20080](https://cve.now/CVE-2017-20080.md): Hindu Matrimonial Script googleads.php privileges management (CVSS 6.3, Hindu Matrimonial Script)
- [CVE-2017-20079](https://cve.now/CVE-2017-20079.md): Hindu Matrimonial Script photo.php privileges management (CVSS 6.3, Hindu Matrimonial Script)
- [CVE-2017-20078](https://cve.now/CVE-2017-20078.md): Hindu Matrimonial Script featured.php privileges management (CVSS 6.3, Hindu Matrimonial Script)
- [CVE-2017-20077](https://cve.now/CVE-2017-20077.md): Hindu Matrimonial Script success\_story.php privileges management (CVSS 6.3, Hindu Matrimonial Script)
- [CVE-2017-20076](https://cve.now/CVE-2017-20076.md): Hindu Matrimonial Script searchview.php privileges management (CVSS 6.3, Hindu Matrimonial Script)
- [CVE-2017-20075](https://cve.now/CVE-2017-20075.md): Hindu Matrimonial Script payment.php privileges management (CVSS 6.3, Hindu Matrimonial Script)
- [CVE-2017-20074](https://cve.now/CVE-2017-20074.md): Hindu Matrimonial Script newsletter1.php privileges management (CVSS 6.3, Hindu Matrimonial Script)
- [CVE-2017-20073](https://cve.now/CVE-2017-20073.md): Hindu Matrimonial Script cms.php privileges management (CVSS 6.3, Hindu Matrimonial Script)
- [CVE-2017-20072](https://cve.now/CVE-2017-20072.md): Hindu Matrimonial Script generalsettings.php privileges management (CVSS 6.3, Hindu Matrimonial Script)
- [CVE-2017-20071](https://cve.now/CVE-2017-20071.md): Hindu Matrimonial Script renewaldue.php privileges management (CVSS 6.3, Hindu Matrimonial Script)
- [CVE-2017-20070](https://cve.now/CVE-2017-20070.md): Hindu Matrimonial Script communitymanagement.php privileges management (CVSS 6.3, Hindu Matrimonial Script)
- [CVE-2017-20069](https://cve.now/CVE-2017-20069.md): Hindu Matrimonial Script countrymanagement.php privileges management (CVSS 6.3, Hindu Matrimonial Script)
- [CVE-2017-20068](https://cve.now/CVE-2017-20068.md): Hindu Matrimonial Script usermanagement.php privileges management (CVSS 6.3, Hindu Matrimonial Script)
- [CVE-2017-20067](https://cve.now/CVE-2017-20067.md): Hindu Matrimonial Script sql injection (CVSS 7.3, Hindu Matrimonial Script)
- [CVE-2022-33139](https://cve.now/CVE-2022-33139.md): A vulnerability has been identified in Cerberus DMS (All versions), Desigo CC (All versions), Desigo CC Compact (All versions), SIMATIC WinC (no CVSS, Siemens Cerberus DMS · Siemens Desigo CC +1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-06-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.