# CVEs published 2022-06-24

135 CVEs were published on June 24, 2022: 13 critical, 14 high. Days are UTC.

- [CVE-2021-40894](https://cve.now/CVE-2021-40894.md): A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in underscore-99xp v1.7.2 when the deepValueSearch function is c (no CVSS)
- [CVE-2022-33122](https://cve.now/CVE-2022-33122.md): A stored cross-site scripting (XSS) vulnerability in eyoucms v1.5.6 allows attackers to execute arbitrary web scripts or HTML via a crafted (no CVSS)
- [CVE-2022-33121](https://cve.now/CVE-2022-33121.md): A Cross-Site Request Forgery (CSRF) in MiniCMS v1.11 allows attackers to arbitrarily delete local .dat files via clicking on a malicious lin (no CVSS)
- [CVE-2022-30885](https://cve.now/CVE-2022-30885.md): The pyesasky for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party. (no CVSS, pyesasky)
- [CVE-2022-34066](https://cve.now/CVE-2022-34066.md): The Texercise package in PyPI v0.0.1 to v0.0.12 was discovered to contain a code execution backdoor. (no CVSS)
- [CVE-2022-34065](https://cve.now/CVE-2022-34065.md): The Rondolu-YT-Concate package in PyPI v0.1.0 was discovered to contain a code execution backdoor. (no CVSS)
- [CVE-2022-34061](https://cve.now/CVE-2022-34061.md): The Catly-Translate package in PyPI v0.0.3 to v0.0.5 was discovered to contain a code execution backdoor. (no CVSS, catly-translate)
- [CVE-2022-34064](https://cve.now/CVE-2022-34064.md): The Zibal package in PyPI v1.0.0 was discovered to contain a code execution backdoor. (no CVSS)
- [CVE-2022-34060](https://cve.now/CVE-2022-34060.md): The Togglee package in PyPI version v0.0.8 was discovered to contain a code execution backdoor. (no CVSS)
- [CVE-2022-34059](https://cve.now/CVE-2022-34059.md): The Sixfab-Tool in PyPI v0.0.2 to v0.0.3 was discovered to contain a code execution backdoor via the request package. (no CVSS)
- [CVE-2022-34056](https://cve.now/CVE-2022-34056.md): The Watertools package in PyPI v0.0.0 was discovered to contain a code execution backdoor via the request package. (no CVSS)
- [CVE-2022-34057](https://cve.now/CVE-2022-34057.md): The Scoptrial package in PyPI version v0.0.5 was discovered to contain a code execution backdoor via the request package. (no CVSS)
- [CVE-2022-34054](https://cve.now/CVE-2022-34054.md): The Perdido package in PyPI v0.0.1 to v0.0.2 was discovered to contain a code execution backdoor via the request package. (no CVSS, perdido)
- [CVE-2022-34055](https://cve.now/CVE-2022-34055.md): The drxhello package in PyPI v0.0.1 was discovered to contain a code execution backdoor via the request package. (no CVSS)
- [CVE-2022-34053](https://cve.now/CVE-2022-34053.md): The DR-Web-Engine package in PyPI v0.2.0b0 was discovered to contain a code execution backdoor via the request package. (no CVSS)
- [CVE-2022-33004](https://cve.now/CVE-2022-33004.md): The Beginner package in PyPI v0.0.2 to v0.0.4 was discovered to contain a code execution backdoor via the request package. (no CVSS, beginner)
- [CVE-2022-33002](https://cve.now/CVE-2022-33002.md): The KGExplore package in PyPI v0.1.1 to v0.1.2 was discovered to contain a code execution backdoor via the request package. (no CVSS)
- [CVE-2022-33003](https://cve.now/CVE-2022-33003.md): The watools package in PyPI v0.0.1 to v0.0.8 was discovered to contain a code execution backdoor via the request package. (no CVSS)
- [CVE-2022-33000](https://cve.now/CVE-2022-33000.md): The ML-Scanner package in PyPI v0.1.0 to v0.1.5 was discovered to contain a code execution backdoor via the request package. (no CVSS, ml-scanner)
- [CVE-2022-33001](https://cve.now/CVE-2022-33001.md): The AAmiles package in PyPI v0.1.0 was discovered to contain a code execution backdoor via the request package. (no CVSS)
- [CVE-2022-32998](https://cve.now/CVE-2022-32998.md): The cryptoasset-data-downloader package in PyPI v1.0.0 to v1.0.1 was discovered to contain a code execution backdoor via the request package (no CVSS, cryptoasset-data-downloader)
- [CVE-2022-32999](https://cve.now/CVE-2022-32999.md): The cloudlabeling package in PyPI v0.0.1 was discovered to contain a code execution backdoor via the request package. (no CVSS)
- [CVE-2022-32997](https://cve.now/CVE-2022-32997.md): The RootInteractive package in PyPI v0.0.5 to v0.0.19b0 was discovered to contain a code execution backdoor via the request package. (no CVSS, rootinteractive)
- [CVE-2022-32996](https://cve.now/CVE-2022-32996.md): The django-navbar-client package of v0.9.50 to v1.0.1 was discovered to contain a code execution backdoor via the request package. (no CVSS, django-navbar-client)
- [CVE-2022-21231](https://cve.now/CVE-2022-21231.md): Prototype Pollution (CVSS 7.5, deep-get-set)
- [CVE-2022-29097](https://cve.now/CVE-2022-29097.md): Dell WMS 3.6.1 and below contains a Path Traversal vulnerability in Device API. (CVSS 4.9, Dell Wyse Management Suite)
- [CVE-2022-29096](https://cve.now/CVE-2022-29096.md): Dell Wyse Management Suite 3.6.1 and below contains a Reflected Cross-Site Scripting Vulnerability in saveGroupConfigurations page. (CVSS 6.1, Dell Wyse Management Suite)
- [CVE-2022-33910](https://cve.now/CVE-2022-33910.md): An XSS vulnerability in MantisBT before 2.25.5 allows remote attackers to attach crafted SVG documents to issue reports or bugnotes. (no CVSS, mantisbt/mantisbt)
- [CVE-2022-22390](https://cve.now/CVE-2022-22390.md): IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 may be vulnerable to an information disclosure caused by improper privil (CVSS 6.2, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2022-22389](https://cve.now/CVE-2022-22389.md): IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may terminate abnorma (CVSS 6.5, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2022-29578](https://cve.now/CVE-2022-29578.md): Meridian Cooperative Utility Software versions 22.02 and 22.03 allows remote attackers to obtain sensitive information such as name, address (no CVSS)
- [CVE-2022-30028](https://cve.now/CVE-2022-30028.md): Dradis Professional Edition before 4.3.0 allows attackers to change an account password via reusing a password reset token. (no CVSS)
- [CVE-2021-39409](https://cve.now/CVE-2021-39409.md): A vulnerability exists in Online Student Rate System v1.0 that allows any user to register as an administrator without needing to be authent (no CVSS)
- [CVE-2021-39408](https://cve.now/CVE-2021-39408.md): Cross Site Scripting (XSS) vulnerability exists in Online Student Rate System 1.0 via the page parameter on the index.php file (no CVSS)
- [CVE-2021-38879](https://cve.now/CVE-2021-38879.md): IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to obtain sensitive information, caused by the fail (CVSS 3.7, IBM Jazz Team Server)
- [CVE-2021-38871](https://cve.now/CVE-2021-38871.md): IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Jazz Team Server)
- [CVE-2021-29865](https://cve.now/CVE-2021-29865.md): IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to hijack the clicking action of the victim. (CVSS 5.4, IBM Jazz Team Server)
- [CVE-2021-20551](https://cve.now/CVE-2021-20551.md): IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 allows web pages to be stored locally which can be read by another user on the sy (CVSS 4.0, IBM Jazz Team Server)
- [CVE-2021-20544](https://cve.now/CVE-2021-20544.md): IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to server-side request forgery (SSRF). (CVSS 5.4, IBM Jazz Team Server)
- [CVE-2021-20543](https://cve.now/CVE-2021-20543.md): IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to HTML injection. (CVSS 5.4, IBM Jazz Team Server)
- [CVE-2021-20421](https://cve.now/CVE-2021-20421.md): IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to server-side request forgery (SSRF). (CVSS 5.4, IBM Jazz Team Server)
- [CVE-2021-20355](https://cve.now/CVE-2021-20355.md): IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to obtain sensitive information, caused by the fail (CVSS 3.7, IBM Jazz Team Server)
- [CVE-2021-42056](https://cve.now/CVE-2021-42056.md): Thales Safenet Authentication Client (SAC) for Linux and Windows through 10.7.7 creates insecure temporary hid and lock files allowing a loc (no CVSS)
- [CVE-2021-40893](https://cve.now/CVE-2021-40893.md): A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in validate-data v0.1.1 when validating crafted invalid emails. (no CVSS)
- [CVE-2022-33953](https://cve.now/CVE-2022-33953.md): IBM Robotic Process Automation 21.0.1 and 21.0.2 could allow a user with psychical access to the system to obtain sensitive information due (CVSS 4.6, IBM Robotic Process Automation)
- [CVE-2022-31767](https://cve.now/CVE-2022-31767.md): IBM CICS TX Standard and Advanced 11.1 could allow a remote attacker to execute arbitrary commands on the system by sending a specially craf (CVSS 9.8, IBM CICS TX Advanced · IBM CICS TX Standard)
- [CVE-2022-22502](https://cve.now/CVE-2022-22502.md): IBM Robotic Process Automation 21.0.1 and 21.0.2 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Robotic Process Automation)
- [CVE-2021-39047](https://cve.now/CVE-2021-39047.md): IBM Planning Analytics 2.0 and IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 are vulnerable to cross-site scripting. (CVSS 6.1, IBM Cognos Analytics)
- [CVE-2021-38945](https://cve.now/CVE-2021-38945.md): IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 could allow a remote attacker to upload arbitrary files, caused by improper content validati (CVSS 6.3, IBM Cognos Analytics)
- [CVE-2021-29768](https://cve.now/CVE-2021-29768.md): IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a low level user to obtain sensitive information from the details of the 'Cloud (CVSS 4.3, IBM Cognos Analytics)
- [CVE-2022-20828](https://cve.now/CVE-2022-20828.md): Cisco FirePOWER Software for ASA FirePOWER Module Command Injection Vulnerability (CVSS 6.5, Cisco FirePOWER Services Software for ASA)
- [CVE-2022-20829](https://cve.now/CVE-2022-20829.md): Cisco Adaptive Security Device Manager and Adaptive Security Appliance Software Client-side Arbitrary Code Execution Vulnerability (CVSS 9.1, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2022-29330](https://cve.now/CVE-2022-29330.md): Missing access control in the backup system of Telesoft VitalPBX before 3.2.1 allows attackers to access the PJSIP and SIP extension credent (no CVSS)
- [CVE-2022-27238](https://cve.now/CVE-2022-27238.md): BigBlueButton version 2.4.7 (or earlier) is vulnerable to stored Cross-Site Scripting (XSS) in the private chat functionality. (no CVSS)
- [CVE-2020-21046](https://cve.now/CVE-2020-21046.md): A local privilege escalation vulnerability was identified within the "luminati\_net\_updater\_win\_eagleget\_com" service in EagleGet Downloader (no CVSS)
- [CVE-2022-2102](https://cve.now/CVE-2022-2102.md): Secheron SEPCOS Control and Protection Relay (CVSS 9.4, Secheron SEPCOS Control and Protection Relay firmware packa…)
- [CVE-2022-1668](https://cve.now/CVE-2022-1668.md): Secheron SEPCOS Control and Protection Relay (CVSS 9.8, Secheron SEPCOS Control and Protection Relay firmware packa…)
- [CVE-2022-2105](https://cve.now/CVE-2022-2105.md): Secheron SEPCOS Control and Protection Relay (CVSS 9.4, Secheron SEPCOS Control and Protection Relay firmware packa…)
- [CVE-2022-2104](https://cve.now/CVE-2022-2104.md): Secheron SEPCOS Control and Protection Relay (CVSS 9.9, Secheron SEPCOS Control and Protection Relay firmware packa…)
- [CVE-2022-1667](https://cve.now/CVE-2022-1667.md): Secheron SEPCOS Control and Protection Relay (CVSS 7.5, Secheron SEPCOS Control and Protection Relay firmware packa…)
- [CVE-2022-1666](https://cve.now/CVE-2022-1666.md): Secheron SEPCOS Control and Protection Relay (CVSS 6.5, Secheron SEPCOS Control and Protection Relay firmware packa…)
- [CVE-2022-2103](https://cve.now/CVE-2022-2103.md): Secheron SEPCOS Control and Protection Relay (CVSS 9.8, Secheron SEPCOS Control and Protection Relay firmware packa…)
- [CVE-2022-1745](https://cve.now/CVE-2022-1745.md): 2.2.7 AUTHENTICATION BYPASS BY SPOOFING CWE-290 (CVSS 6.8, Dominion Voting Systems ImageCast X application · Dominion…)
- [CVE-2022-1740](https://cve.now/CVE-2022-1740.md): 2.2.2 MUTABLE ATTESTATION OR MEASUREMENT REPORTING DATA CWE-1283 (CVSS 4.6, Dominion Voting Systems ImageCast X application · Dominion…)
- [CVE-2022-1742](https://cve.now/CVE-2022-1742.md): 2.2.4 IMPROPER PROTECTION OF ALTERNATE PATH CWE-424 (CVSS 6.8, Dominion Voting Systems ImageCast X application · Dominion…)
- [CVE-2022-1743](https://cve.now/CVE-2022-1743.md): 2.2.5 PATH TRAVERSAL: '../FILEDIR' CWE-24 (CVSS 6.8, Dominion Voting System ImageCast X application · Dominion V…)
- [CVE-2022-1741](https://cve.now/CVE-2022-1741.md): 2.2.3 HIDDEN FUNCTIONALITY CWE-912 (CVSS 6.8, Dominion Voting Systems ImageCast X application · Dominion…)
- [CVE-2022-1744](https://cve.now/CVE-2022-1744.md): 2.2.6 EXECUTION WITH UNNECESSARY PRIVILEGES CWE-250 (CVSS 6.8, Dominion Voting System ImageCast X application · Dominion V…)
- [CVE-2022-1747](https://cve.now/CVE-2022-1747.md): The authentication mechanism used by voters to activate a voting session on the tested version of Dominion Voting Systems ImageCast X is sus (CVSS 4.6, Dominion Voting Systems ImageCast X firmware · Dominion Vot…)
- [CVE-2022-1739](https://cve.now/CVE-2022-1739.md): 2.2.1 IMPROPER VERIFICATION OF CRYPTOGRAPHIC SIGNATURE CWE-347 (CVSS 6.8, Dominion Voting Systems ImageCast X firmware · Dominion Vot…)
- [CVE-2022-1746](https://cve.now/CVE-2022-1746.md): 2.2.8 INCORRECT PRIVILEGE ASSIGNMENT CWE-266 (CVSS 7.6, Dominion Voting Systems ImageCast X application · Dominion…)
- [CVE-2022-2119](https://cve.now/CVE-2022-2119.md): OFFIS DCMTK Path Traversal (CVSS 7.5, OFFIS DCMTK)
- [CVE-2022-2121](https://cve.now/CVE-2022-2121.md): OFFIS DCMTK NULL Pointer Dereference (CVSS 7.5, OFFIS DCMTK)
- [CVE-2022-2120](https://cve.now/CVE-2022-2120.md): OFFIS DCMTK Path Traversal (CVSS 7.5, OFFIS DCMTK)
- [CVE-2013-1891](https://cve.now/CVE-2013-1891.md): In OpenCart 1.4.7 to 1.5.5.1, implemented anti-traversal code in filemanager.php is ineffective and can be bypassed. (no CVSS, opencart)
- [CVE-2013-1916](https://cve.now/CVE-2013-1916.md): In WordPress Plugin User Photo 0.9.4, when a photo is uploaded, it is only partially validated and it is possible to upload a backdoor on th (no CVSS, WordPress Plugin User Photo)
- [CVE-2022-1524](https://cve.now/CVE-2022-1524.md): 3.2.5 CLEARTEXT TRANSMISSION OF SENSITIVE INFORMATION CWE-319 (CVSS 7.4, Illumina NextSeq 550Dx · Illumina MiSeq Dx +5)
- [CVE-2022-1521](https://cve.now/CVE-2022-1521.md): 3.2.4 IMPROPER ACCESS CONTROL CWE-284 (CVSS 9.1, Illumina NextSeq 550Dx · Illumina MiSeq Dx +5)
- [CVE-2022-1518](https://cve.now/CVE-2022-1518.md): 3.2.2 IMPROPER LIMITATION OF A PATHNAME TO A RESTRICTED DIRECTORY ('PATH TRAVERSAL') CWE-22 (CVSS 10.0, Illumina NextSeq 550Dx · Illumina MiSeq Dx +5)
- [CVE-2022-1519](https://cve.now/CVE-2022-1519.md): LRM does not restrict the types of files that can be uploaded to the affected product. (CVSS 10.0, Illumina NextSeq 550Dx · Illumina MiSeq Dx +5)
- [CVE-2022-1517](https://cve.now/CVE-2022-1517.md): 3.2.1 EXECUTION WITH UNNECESSARY PRIVILEGES CWE-250 (CVSS 10.0, Illumina NextSeq 550Dx · Illumina MiSeq Dx +5)
- [CVE-2021-30651](https://cve.now/CVE-2021-30651.md): A malicious authenticated SMG administrator user can obtain passwords for external LDAP/Active Directory servers that they might not otherwi (no CVSS, Symantec Messaging Gateway)
- [CVE-2022-23170](https://cve.now/CVE-2022-23170.md): SysAid - Okta SSO integration (CVSS 5.9, SysAid - Okta SSO integration)
- [CVE-2022-28620](https://cve.now/CVE-2022-28620.md): A remote authentication bypass vulnerability was discovered in HPE Cray Legacy Shasta System Solutions; HPE Slingshot; and HPE Cray EX super (no CVSS, Cray Legacy Shasta System Solutions; HPE Slingshot; HPE Cra…)
- [CVE-2022-28619](https://cve.now/CVE-2022-28619.md): A potential security vulnerability has been identified in the installer of HPE Version Control Repository Manager. (no CVSS, HPE)
- [CVE-2022-30118](https://cve.now/CVE-2022-30118.md): Title for CVE: XSS in /dashboard/system/express/entities/forms/save\_control/\[GUID\]: old browsers only.Description: When using Internet Explo (no CVSS, https://github.com/concrete5/concrete5)
- [CVE-2022-30120](https://cve.now/CVE-2022-30120.md): XSS in /dashboard/blocks/stacks/view\_details/ - old browsers only. (no CVSS, https://github.com/concrete5/concrete5 · concrete5/core)
- [CVE-2022-21829](https://cve.now/CVE-2022-21829.md): Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which c (no CVSS, https://github.com/concrete5/concrete5 · concrete5/core)
- [CVE-2022-30117](https://cve.now/CVE-2022-30117.md): Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload which could result in an (no CVSS, https://github.com/concrete5/concrete5 · concrete5/core)
- [CVE-2022-30119](https://cve.now/CVE-2022-30119.md): XSS in /dashboard/reports/logs/view - old browsers only. (no CVSS, https://github.com/concrete5/concrete5)
- [CVE-2021-40892](https://cve.now/CVE-2021-40892.md): A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in validate-color v2.1.0 when handling crafted invalid rgb(a) st (no CVSS)
- [CVE-2022-32990](https://cve.now/CVE-2022-32990.md): An issue in gimp\_layer\_invalidate\_boundary of GNOME GIMP 2.10.30 allows attackers to trigger an unhandled exception via a crafted XCF file, (no CVSS)
- [CVE-2022-32530](https://cve.now/CVE-2022-32530.md): A CWE-668 Exposure of Resource to Wrong Sphere vulnerability exists that could cause users to be misled, hiding alarms, showing the wrong se (CVSS 4.8, Schneider Electric Geo SCADA Mobile)
- [CVE-2021-41634](https://cve.now/CVE-2021-41634.md): A user enumeration vulnerability in MELAG FTP Server 2.2.0.4 allows an attacker to identify valid FTP usernames. (no CVSS)
- [CVE-2021-41635](https://cve.now/CVE-2021-41635.md): When installed as Windows service MELAG FTP Server 2.2.0.4 is run as SYSTEM user, which grants remote attackers to abuse misconfigurations o (no CVSS)
- [CVE-2021-41636](https://cve.now/CVE-2021-41636.md): MELAG FTP Server 2.2.0.4 allows an attacker to use the CWD command to break out of the FTP servers root directory and operate on the entire (no CVSS)
- [CVE-2021-41637](https://cve.now/CVE-2021-41637.md): Weak access control permissions in MELAG FTP Server 2.2.0.4 allow the "Everyone" group to read the local FTP configuration file, which inclu (no CVSS)
- [CVE-2021-41638](https://cve.now/CVE-2021-41638.md): The authentication checks of the MELAG FTP Server in version 2.2.0.4 are incomplete, which allows a remote attacker to access local files on (no CVSS)
- [CVE-2021-41639](https://cve.now/CVE-2021-41639.md): MELAG FTP Server 2.2.0.4 stores unencrpyted passwords of FTP users in a local configuration file. (no CVSS)
- [CVE-2022-32143](https://cve.now/CVE-2022-32143.md): CODESYS runtime system prone to directory acces (CVSS 8.8, CODESYS Runtime Toolkit · CODESYS PLCWinNT)
- [CVE-2022-32142](https://cve.now/CVE-2022-32142.md): CODESYS runtime system prone to denial of service due to use of out of range pointer (CVSS 8.1, CODESYS Runtime Toolkit · CODESYS PLCWinNT)
- [CVE-2022-32141](https://cve.now/CVE-2022-32141.md): CODESYS runtime system prone to denial of service due to buffer over read (CVSS 6.5, CODESYS Runtime Toolkit · CODESYS PLCWinNT)
- [CVE-2022-32140](https://cve.now/CVE-2022-32140.md): CODESYS runtime system prone to denial of service due to buffer copy (CVSS 6.5, CODESYS Runtime Toolkit · CODESYS PLCWinNT)
- [CVE-2022-32139](https://cve.now/CVE-2022-32139.md): CODESYS runtime system prone to denial of service due to out of bounds read (CVSS 6.5, CODESYS Runtime Toolkit · CODESYS PLCWinNT)
- [CVE-2022-32138](https://cve.now/CVE-2022-32138.md): CODESYS runtime system prone to denial of service due to Unexpected Sign Extension (CVSS 8.8, CODESYS Runtime Toolkit · CODESYS PLCWinNT)
- [CVE-2022-32137](https://cve.now/CVE-2022-32137.md): CODESYS Runtime System prone to heap based buffer overflow (CVSS 8.8, CODESYS Runtime Toolkit · CODESYS PLCWinNT)
- [CVE-2022-32136](https://cve.now/CVE-2022-32136.md): Codesys runtime systems: Access of uninitialised pointer lead to denial of service. (CVSS 6.5, CODESYS Runtime Toolkit · CODESYS PLCWinNT)
- [CVE-2022-31806](https://cve.now/CVE-2022-31806.md): Insecure default settings in CODESYS Runtime Toolkit 32 bit full and CODESYS PLCWinNT (CVSS 9.8, CODESYS PLCWinNT · CODESYS Runtime Toolkit 32 bit full)
- [CVE-2022-31805](https://cve.now/CVE-2022-31805.md): Insecure transmission of credentials (CVSS 7.5, CODESYS Development System · CODESYS Gateway Client +10)
- [CVE-2022-31804](https://cve.now/CVE-2022-31804.md): CODESYS Gateway server prone to denial of service attack due to excessive memory allocation (CVSS 7.5, CODESYS Gateway Server)
- [CVE-2022-31803](https://cve.now/CVE-2022-31803.md): CODESYS Gateway Server V2 prone to Denial of Service Attack (CVSS 5.3, CODESYS Gateway Server)
- [CVE-2022-31802](https://cve.now/CVE-2022-31802.md): Partial string comparison in CODESYS gateway server (CVSS 9.8, CODESYS Gateway Server)
- [CVE-2022-1965](https://cve.now/CVE-2022-1965.md): CODESYS runtime system prone to file deletion due to improper error handling (CVSS 8.1, CODESYS Runtime Toolkit · CODESYS PLCWinNT)
- [CVE-2017-20097](https://cve.now/CVE-2017-20097.md): WP-Filebase Download Manager Plugin cross site scriting (CVSS 3.5, WP-Filebase Download Manager Plugin)
- [CVE-2017-20096](https://cve.now/CVE-2017-20096.md): WP-SpamFree Anti-Spam Plugin cross site scriting (CVSS 3.5, WP-SpamFree Anti-Spam Plugin)
- [CVE-2017-20095](https://cve.now/CVE-2017-20095.md): Simple Ads Manager Plugin code injection (CVSS 6.3, Simple Ads Manager Plugin)
- [CVE-2017-20094](https://cve.now/CVE-2017-20094.md): NewStatPress Plugin Persistent cross site scriting (CVSS 3.5, NewStatPress Plugin)
- [CVE-2017-20093](https://cve.now/CVE-2017-20093.md): Download Manager Plugin cross-site request forgery (CVSS 4.3, Download Manager Plugin)
- [CVE-2017-20092](https://cve.now/CVE-2017-20092.md): Google Analytics Dashboard Plugin cross site scriting (CVSS 3.5, Google Analytics Dashboard Plugin)
- [CVE-2022-32405](https://cve.now/CVE-2022-32405.md): Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/prisons/view\_pris (no CVSS)
- [CVE-2022-32404](https://cve.now/CVE-2022-32404.md): Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/inmates/manage\_in (no CVSS)
- [CVE-2022-32403](https://cve.now/CVE-2022-32403.md): Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/inmates/manage\_re (no CVSS)
- [CVE-2022-32402](https://cve.now/CVE-2022-32402.md): Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/prisons/manage\_pr (no CVSS)
- [CVE-2022-32401](https://cve.now/CVE-2022-32401.md): Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/inmates/manage\_pr (no CVSS)
- [CVE-2022-32400](https://cve.now/CVE-2022-32400.md): Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/user/manage\_user. (no CVSS)
- [CVE-2022-32399](https://cve.now/CVE-2022-32399.md): Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/crimes/view\_crime (no CVSS)
- [CVE-2022-32398](https://cve.now/CVE-2022-32398.md): Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/cells/manage\_cell (no CVSS)
- [CVE-2022-32397](https://cve.now/CVE-2022-32397.md): Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/visits/view\_visit (no CVSS)
- [CVE-2022-32396](https://cve.now/CVE-2022-32396.md): Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/visits/manage\_vis (no CVSS)
- [CVE-2022-32395](https://cve.now/CVE-2022-32395.md): Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/crimes/manage\_cri (no CVSS)
- [CVE-2022-32394](https://cve.now/CVE-2022-32394.md): Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/inmates/view\_inma (no CVSS)
- [CVE-2022-32393](https://cve.now/CVE-2022-32393.md): Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/cells/view\_cell.p (no CVSS)
- [CVE-2022-32392](https://cve.now/CVE-2022-32392.md): Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/actions/manage\_ac (no CVSS)
- [CVE-2022-32391](https://cve.now/CVE-2022-32391.md): Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/actions/view\_acti (no CVSS)
- [CVE-2022-32209](https://cve.now/CVE-2022-32209.md): # Possible XSS Vulnerability in Rails::Html::SanitizerThere is a possible XSS vulnerability with certain configurations of Rails::Html::Sani (no CVSS, https://github.com/rails/rails-html-sanitizer · rails-html-…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-06-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.