# CVEs published 2022-06-27

129 CVEs were published on June 27, 2022: 6 critical, 17 high. Days are UTC.

- [CVE-2022-31104](https://cve.now/CVE-2022-31104.md): Miscompilation of \`i8x16.swizzle\` and \`select\` with v128 inputs in Wasmtime (CVSS 4.8, bytecodealliance wasmtime · wasmtime +1)
- [CVE-2022-34132](https://cve.now/CVE-2022-34132.md): Jorani v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at application/controllers/Leaves.php. (no CVSS)
- [CVE-2022-34133](https://cve.now/CVE-2022-34133.md): Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Comment parameter at application/controllers/Leaves (no CVSS)
- [CVE-2022-34134](https://cve.now/CVE-2022-34134.md): Jorani v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /application/controllers/Users.php. (no CVSS)
- [CVE-2022-33009](https://cve.now/CVE-2022-33009.md): A stored cross-site scripting (XSS) vulnerability in LightCMS v1.3.11 allows attackers to execute arbitrary web scripts or HTML via uploadin (no CVSS)
- [CVE-2022-31103](https://cve.now/CVE-2022-31103.md): Improper handling of CSS at-rules in lettersanitizer (CVSS 7.5, mat-sz lettersanitizer · lettersanitizer)
- [CVE-2022-32995](https://cve.now/CVE-2022-32995.md): Halo CMS v1.5.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the template remote download function. (no CVSS)
- [CVE-2022-32994](https://cve.now/CVE-2022-32994.md): Halo CMS v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the component /api/admin/attachments/upload. (no CVSS)
- [CVE-2022-31101](https://cve.now/CVE-2022-31101.md): SQL Injection in prestashop/blockwishlist (CVSS 8.1, PrestaShop blockwishlist · prestashop/blockwishlist)
- [CVE-2022-31099](https://cve.now/CVE-2022-31099.md): Uncontrolled Recursion in rulex (CVSS 6.5, rulex-rs rulex · rulex)
- [CVE-2022-31100](https://cve.now/CVE-2022-31100.md): Reachable Assertion in rulex (CVSS 6.5, rulex-rs rulex · rulex)
- [CVE-2022-31098](https://cve.now/CVE-2022-31098.md): Weave GitOps leaked cluster credentials into logs on connection errors (CVSS 9.0, weaveworks weave-gitops · github.com/weaveworks/weave-gitops)
- [CVE-2017-20103](https://cve.now/CVE-2017-20103.md): Kama Click Counter Plugin admin.php Blind sql injection (CVSS 6.3, Kama Click Counter Plugin)
- [CVE-2022-33879](https://cve.now/CVE-2022-33879.md): Incomplete fix and new regex DoS in StandardsExtractingContentHandler (no CVSS, Apache Software Foundation Apache Tika · org.apache.tika:ti…)
- [CVE-2022-32092](https://cve.now/CVE-2022-32092.md): D-Link DIR-645 v1.03 was discovered to contain a command injection vulnerability via the QUERY\_STRING parameter at \_\_ajax\_explorer.sgi. (no CVSS)
- [CVE-2022-33007](https://cve.now/CVE-2022-33007.md): TRENDnet Wi-Fi routers TEW751DR v1.03 and TEW-752DRU v1.03 were discovered to contain a stack overflow via the function genacgi\_main. (no CVSS)
- [CVE-2022-31096](https://cve.now/CVE-2022-31096.md): Invites restricted to an email or invite links restricted to an email domain may be bypassed by a under certain conditions in Discourse (CVSS 5.7, discourse)
- [CVE-2022-31093](https://cve.now/CVE-2022-31093.md): Improper Handling of \`callbackUrl\` parameter in next-auth (CVSS 7.5, nextauthjs next-auth · next-auth)
- [CVE-2022-31092](https://cve.now/CVE-2022-31092.md): SQL injection in pimcore (CVSS 7.5, pimcore · pimcore/pimcore)
- [CVE-2022-31089](https://cve.now/CVE-2022-31089.md): Invalid file request can crashe parse-server (CVSS 7.5, parse-community parse-server · parse-server)
- [CVE-2022-31094](https://cve.now/CVE-2022-31094.md): Cross site scripting vulnerability in ScratchTools (CVSS 7.1, STForScratch ScratchTools)
- [CVE-2022-33005](https://cve.now/CVE-2022-33005.md): A cross-site scripting (XSS) vulnerability in the System Settings/IOT Settings module of Delta Electronics DIAEnergie v1.08.00 allows attack (no CVSS)
- [CVE-2022-31085](https://cve.now/CVE-2022-31085.md): Missing Encryption of Sensitive Data in ldap-account-manager (CVSS 5.5, LDAPAccountManager lam)
- [CVE-2022-31084](https://cve.now/CVE-2022-31084.md): Unauthenticated Remote Code Execution in ldap-account-manager (CVSS 9.0, LDAPAccountManager lam)
- [CVE-2022-31086](https://cve.now/CVE-2022-31086.md): Incorrect Regular Expressions in ldap-account-manager (CVSS 6.6, LDAPAccountManager lam)
- [CVE-2022-31087](https://cve.now/CVE-2022-31087.md): Incorrect Default Permissions in ldap-account-manager (CVSS 7.8, LDAPAccountManager lam)
- [CVE-2022-31088](https://cve.now/CVE-2022-31088.md): Unauthenticated LDAP Injection in ldap-account-manager (CVSS 6.5, LDAPAccountManager lam)
- [CVE-2022-33116](https://cve.now/CVE-2022-33116.md): An issue in the jmpath variable in /modules/mindmap/index.php of GUnet Open eClass Platform (aka openeclass) v3.12.4 and below allows attack (no CVSS)
- [CVE-2022-31082](https://cve.now/CVE-2022-31082.md): SQL Injection via package deployment tasks in glpi-inventory-plugin (CVSS 5.8, glpi-project glpi-inventory-plugin)
- [CVE-2021-40942](https://cve.now/CVE-2021-40942.md): In GPAC MP4Box v1.1.0, there is a heap-buffer-overflow in the function filter\_parse\_dyn\_args function in filter\_core/filter.c:1454, as demon (no CVSS)
- [CVE-2022-31077](https://cve.now/CVE-2022-31077.md): Malicious response from KubeEdge can crash CSI Driver controller server (CVSS 4.0, kubeedge · github.com/kubeedge/kubeedge)
- [CVE-2022-31076](https://cve.now/CVE-2022-31076.md): Malicious Message can crash CloudCore in KubeEdge (CVSS 4.2, kubeedge · github.com/kubeedge/kubeedge)
- [CVE-2022-31064](https://cve.now/CVE-2022-31064.md): Cross site scripting in username that will trigger by sending chat (CVSS 6.5, bigbluebutton)
- [CVE-2022-31065](https://cve.now/CVE-2022-31065.md): Cross site scripting vulnerability for private chat in bigbluebutton (CVSS 6.5, bigbluebutton)
- [CVE-2022-31057](https://cve.now/CVE-2022-31057.md): Authenticated Stored XSS in Shopware Administration (CVSS 6.5, shopware · shopware/shopware)
- [CVE-2022-31039](https://cve.now/CVE-2022-31039.md): Improper privilege management - Anyone can view room settings in GreenLight (CVSS 4.3, bigbluebutton greenlight)
- [CVE-2022-31036](https://cve.now/CVE-2022-31036.md): Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server (CVSS 4.3, argoproj argo-cd · github.com/argoproj/argo-cd +1)
- [CVE-2022-31035](https://cve.now/CVE-2022-31035.md): External URLs for Deployments can include javascript in argo-cd (CVSS 9.0, argoproj argo-cd · github.com/argoproj/argo-cd +1)
- [CVE-2022-31034](https://cve.now/CVE-2022-31034.md): Insecure entropy in argo-cd (CVSS 8.3, argoproj argo-cd · github.com/argoproj/argo-cd +1)
- [CVE-2022-28622](https://cve.now/CVE-2022-28622.md): A potential security vulnerability has been identified in HPE StoreOnce Software. (no CVSS, HPE StoreOnce Software)
- [CVE-2022-2221](https://cve.now/CVE-2022-2221.md): Information Exposure vulnerability in My Account Settings of Devolutions Remote Desktop Manager before 2022.1.8 allows authenticated users t (no CVSS, Devolutions Remote Desktop Manager)
- [CVE-2017-20098](https://cve.now/CVE-2017-20098.md): Admin Custom Login Plugin Persistent cross site scripting (CVSS 3.5, Admin Custom Login Plugin)
- [CVE-2017-20099](https://cve.now/CVE-2017-20099.md): Analytics Stats Counter Statistics Plugin code injection (CVSS 7.3, Analytics Stats Counter Statistics Plugin)
- [CVE-2022-28168](https://cve.now/CVE-2022-28168.md): In Brocade SANnav before Brocade SANnav v2.2.0.2 and Brocade SANnav2.1.1.8, encoded scp-server passwords are stored using Base64 encoding, w (no CVSS, Brocade SANnav)
- [CVE-2022-28167](https://cve.now/CVE-2022-28167.md): Brocade SANnav before Brocade SANvav v. (no CVSS, Brocade SANnav)
- [CVE-2022-28166](https://cve.now/CVE-2022-28166.md): In Brocade SANnav version before SANN2.2.0.2 and Brocade SANNav before 2.1.1.8, the implementation of TLS/SSL Server Supports the Use of Sta (no CVSS, Brocade SANnav)
- [CVE-2022-28172](https://cve.now/CVE-2022-28172.md): The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. (CVSS 6.5, hikvision DS-A71024/48/72R,DS-A80624S,DS-A81016S,DS-A72024/…)
- [CVE-2022-28171](https://cve.now/CVE-2022-28171.md): The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. (CVSS 7.5, hikvision DS-A71024/48/72R,DS-A80624S,DS-A81016S,DS-A72024/…)
- [CVE-2021-40941](https://cve.now/CVE-2021-40941.md): In Bento4 1.6.0-638, there is an allocator is out of memory in the function AP4\_Array\<AP4\_TrunAtom::Entry\>::EnsureCapacity in Ap4Array.h:172 (no CVSS)
- [CVE-2022-26477](https://cve.now/CVE-2022-26477.md): Denial of service in readExternal method (no CVSS, Apache Software Foundation Apache SystemDS · org.apache.… +1)
- [CVE-2021-33654](https://cve.now/CVE-2021-33654.md): When performing the initialization operation of the Split operator, if a dimension in the input shape is 0, it will cause a division by 0 ex (no CVSS, openEuler:mindspore)
- [CVE-2021-33653](https://cve.now/CVE-2021-33653.md): When performing the derivation shape operation of the SpaceToBatch operator, if there is a value of 0 in the parameter block\_shape element, (no CVSS, openEuler:mindspore)
- [CVE-2021-33650](https://cve.now/CVE-2021-33650.md): When performing the inference shape operation of the SparseToDense operator, if the number of inputs is less than three, it will access data (no CVSS, openEuler:mindspore)
- [CVE-2021-33651](https://cve.now/CVE-2021-33651.md): When performing the analytical operation of the DepthwiseConv2D operator, if the attribute depth\_multiplier is 0, it will cause a division b (no CVSS, openEuler:mindspore)
- [CVE-2021-33652](https://cve.now/CVE-2021-33652.md): When the Reduce operator run operation is executed, if there is a value of 0 in the parameter axis\_sizes element, it will cause a division b (no CVSS, openEuler:mindspore)
- [CVE-2021-33649](https://cve.now/CVE-2021-33649.md): When performing the inference shape operation of the Transpose operator, if the value in the perm element is greater than or equal to the si (no CVSS, openEuler:mindspore)
- [CVE-2021-33647](https://cve.now/CVE-2021-33647.md): When performing the inference shape operation of the Tile operator, if the input data type is not int or int32, it will access data outside (no CVSS, openEuler:mindspore)
- [CVE-2021-33648](https://cve.now/CVE-2021-33648.md): When performing the inference shape operation of Affine, Concat, MatMul, ArgMinMax, EmbeddingLookup, and Gather operators, if the input shap (no CVSS, openEuler:mindspore)
- [CVE-2022-2106](https://cve.now/CVE-2022-2106.md): Elcomplus SmartICS Path Traversal (CVSS 3.8, Elcomplus SmartICS)
- [CVE-2022-2140](https://cve.now/CVE-2022-2140.md): Elcomplus SmartICS Cross-site Scripting (CVSS 8.8, Elcomplus SmartICS)
- [CVE-2022-2088](https://cve.now/CVE-2022-2088.md): Elcomplus SmartICS Access Control (CVSS 6.8, Elcomplus SmartICS)
- [CVE-2020-21161](https://cve.now/CVE-2020-21161.md): Cross Site Scripting (XSS) vulnerability in Ruckus Wireless ZoneDirector 9.8.3.0. (no CVSS)
- [CVE-2017-20102](https://cve.now/CVE-2017-20102.md): Album Lock getImage path traversal (CVSS 4.4, Album Lock)
- [CVE-2017-20101](https://cve.now/CVE-2017-20101.md): ProjectSend information disclosure (CVSS 3.5, ProjectSend)
- [CVE-2017-20100](https://cve.now/CVE-2017-20100.md): Air Transfer cross site scripting (CVSS 3.5, Air Transfer)
- [CVE-2022-2216](https://cve.now/CVE-2022-2216.md): Server-Side Request Forgery (SSRF) in ionicabizau/parse-url (CVSS 9.4, ionicabizau/parse-url · parse-url)
- [CVE-2022-2218](https://cve.now/CVE-2022-2218.md): Cross-site Scripting (XSS) - Stored in ionicabizau/parse-url (CVSS 9.1, ionicabizau/parse-url · parse-url)
- [CVE-2021-40901](https://cve.now/CVE-2021-40901.md): A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in scniro-validator v1.0.1 when validating crafted invalid email (no CVSS)
- [CVE-2021-40900](https://cve.now/CVE-2021-40900.md): A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in regexfn v1.0.5 when validating crafted invalid emails. (no CVSS)
- [CVE-2021-40899](https://cve.now/CVE-2021-40899.md): A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in repo-git-downloader v0.1.1 when downloading crafted invalid g (no CVSS)
- [CVE-2022-0722](https://cve.now/CVE-2022-0722.md): Exposure of Sensitive Information to an Unauthorized Actor in ionicabizau/parse-url (CVSS 4.8, ionicabizau/parse-url · parse-url)
- [CVE-2021-40898](https://cve.now/CVE-2021-40898.md): A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in scaffold-helper v1.2.0 when copying crafted invalid files. (no CVSS)
- [CVE-2022-2217](https://cve.now/CVE-2022-2217.md): Cross-site Scripting (XSS) - Generic in ionicabizau/parse-url (CVSS 9.1, ionicabizau/parse-url · parse-url)
- [CVE-2021-40897](https://cve.now/CVE-2021-40897.md): A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in split-html-to-chars v1.0.5 when splitting crafted invalid htm (no CVSS)
- [CVE-2021-40896](https://cve.now/CVE-2021-40896.md): A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in that-value v0.1.3 when validating crafted invalid emails. (no CVSS)
- [CVE-2021-40895](https://cve.now/CVE-2021-40895.md): A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in todo-regex v0.1.1 when matching crafted invalid TODO statemen (no CVSS)
- [CVE-2022-2041](https://cve.now/CVE-2022-2041.md): Brizy Page Builder \< 2.4.2 - Contributor+ Stored Cross-Site Scripting via Element Content (no CVSS, Brizy – Page Builder)
- [CVE-2022-2040](https://cve.now/CVE-2022-2040.md): Brizy Page Builder \< 2.4.2 - Contributor+ Stored Cross-Site Scripting via Element URL (no CVSS, Brizy – Page Builder)
- [CVE-2022-1995](https://cve.now/CVE-2022-1995.md): miniOrange's Malware Scanner \< 4.5.2 - Admin+ Stored Cross-Site Scripting (no CVSS, Malware Scanner)
- [CVE-2022-1994](https://cve.now/CVE-2022-1994.md): Google Authenticator \< 1.0.8 - Admin+ Stored Cross-Site Scripting (no CVSS, Login With OTP Over SMS, Email, WhatsApp and Google Authent…)
- [CVE-2022-1990](https://cve.now/CVE-2022-1990.md): Nested Pages \< 3.1.21 - Admin+ Stored Cross Site Scripting (no CVSS, Nested Pages)
- [CVE-2022-1977](https://cve.now/CVE-2022-1977.md): WP Ultimate CSV Importer \< 6.5.3 - Admin+ Blind SSRF (no CVSS, Import Export All WordPress Images, Users & Post Types)
- [CVE-2022-1971](https://cve.now/CVE-2022-1971.md): NextCellent Gallery \<= 1.9.35 - Admin+ Stored XSS (no CVSS, NextCellent Gallery – NextGEN Legacy)
- [CVE-2022-1964](https://cve.now/CVE-2022-1964.md): Easy SVG Support \< 3.3.0 - Author+ Stored Cross Site Scripting via SVG (no CVSS, Easy SVG Support)
- [CVE-2022-1960](https://cve.now/CVE-2022-1960.md): MyCSS \<= 1.1 - Arbitrary Settings Update via CSRF (no CVSS, MyCSS)
- [CVE-2022-1953](https://cve.now/CVE-2022-1953.md): Product Configurator for WooCommerce \< 1.2.32 - Unauthenticated Arbitrary File Deletion (no CVSS, Product Configurator for WooCommerce)
- [CVE-2022-1916](https://cve.now/CVE-2022-1916.md): Active Products Tables for WooCommerce \< 1.0.5 - Reflected Cross-Site-Scripting (no CVSS, Active Products Tables for WooCommerce. Professional produc…)
- [CVE-2022-1914](https://cve.now/CVE-2022-1914.md): Clean-Contact \<= 1.6 - Arbitrary Settings Update to Stored XSS via CSRF (no CVSS, Clean-Contact)
- [CVE-2022-1913](https://cve.now/CVE-2022-1913.md): Add Post URL \<= 2.1.0 - Arbitrary Settings Update to Stored XSS via CSRF (no CVSS, Add Post URL)
- [CVE-2022-1904](https://cve.now/CVE-2022-1904.md): Easy Pricing Tables \< 3.2.1 - Reflected Cross-Site-Scripting (no CVSS, Pricing Tables WordPress Plugin – Easy Pricing Tables)
- [CVE-2022-1903](https://cve.now/CVE-2022-1903.md): ARMember \< 3.4.8 - Unauthenticated Admin Account Takeover (no CVSS, ARMember – Membership Plugin, Content Restriction, Member L…)
- [CVE-2022-1885](https://cve.now/CVE-2022-1885.md): Cimy Header Image Rotator \<= 6.1.1 - Arbitrary Settings Update via CSRF (no CVSS, Cimy Header Image Rotator)
- [CVE-2022-1847](https://cve.now/CVE-2022-1847.md): Rotating Posts \<= 1.11 - Arbitrary Settings Update to Stored XSS via CSRF (no CVSS, Rotating Posts)
- [CVE-2022-1846](https://cve.now/CVE-2022-1846.md): Tiny Contact Form \<= 0.7 - Arbitrary Settings Update via CSRF (no CVSS, Tiny Contact Form)
- [CVE-2022-1845](https://cve.now/CVE-2022-1845.md): WP Post Styling \< 1.3.1 - Multiple CSRF (no CVSS, WP Post Styling)
- [CVE-2022-1844](https://cve.now/CVE-2022-1844.md): WP Sentry \<= 1.0 - Arbitrary Settings Update to Stored XSS via CSRF (no CVSS, WP Sentry)
- [CVE-2022-1843](https://cve.now/CVE-2022-1843.md): MailPress \<= 7.2.1 - Arbitrary Settings Update & Log Files Purge via CSRF (no CVSS, MailPress)
- [CVE-2022-1842](https://cve.now/CVE-2022-1842.md): OpenBook Book Data \<= 3.5.2 - Arbitrary Settings Update to Stored XSS via CSRF (no CVSS, OpenBook Book Data)
- [CVE-2022-1776](https://cve.now/CVE-2022-1776.md): Icegram \< 2.1.8 - Contributor+ Stored Cross-Site Scripting (no CVSS, Popups, Welcome Bar, Optins and Lead Generation Plugin – Ic…)
- [CVE-2022-1653](https://cve.now/CVE-2022-1653.md): Social Share Buttons by Supsystic \< 2.2.4 - Multiple CSRF (no CVSS, Social Share Buttons by Supsystic)
- [CVE-2022-1627](https://cve.now/CVE-2022-1627.md): My Private Site \< 3.0.8 - Arbitrary Settings Update via CSRF (no CVSS, My Private Site)
- [CVE-2022-1625](https://cve.now/CVE-2022-1625.md): New User Approve \< 2.4 - Arbitrary Settings Update & Invitation Code Creation via CSRF (no CVSS, New User Approve)
- [CVE-2022-1593](https://cve.now/CVE-2022-1593.md): Site Offline or Coming Soon \<= 1.6.6 - Stored Cross-Site Scripting via CSRF (no CVSS, Site Offline or Coming Soon)
- [CVE-2022-1574](https://cve.now/CVE-2022-1574.md): HTML2WP \<= 1.0.0 - Unauthenticated Arbitrary File Upload (no CVSS, HTML2WP)
- [CVE-2022-1573](https://cve.now/CVE-2022-1573.md): HTML2WP \<= 1.0.0 - Arbitrary Settings Update via CSRF (no CVSS, HTML2WP)
- [CVE-2022-1572](https://cve.now/CVE-2022-1572.md): HTML2WP \<= 1.0.0 - Subscriber+ Arbitrary File Deletion (no CVSS, HTML2WP)
- [CVE-2022-1470](https://cve.now/CVE-2022-1470.md): Ultimate WooCommerce CSV Importer \<= 2.0 - Reflected Cross-Site Scripting (no CVSS, Ultimate WooCommerce CSV Importer)
- [CVE-2022-1327](https://cve.now/CVE-2022-1327.md): Image Gallery - Grid Gallery \< 1.1.6 - Admin+ Stored Cross-Site Scripting (no CVSS, Image Gallery – Grid Gallery)
- [CVE-2022-1326](https://cve.now/CVE-2022-1326.md): Form - Contact Form \<= 1.2.0 - Admin+ Stored Cross-Site Scripting (no CVSS, Form – Contact Form)
- [CVE-2022-1321](https://cve.now/CVE-2022-1321.md): miniOrange's Google Authenticator \< 5.5.6 - Admin+ Stored Cross-Site Scripting (no CVSS, miniOrange's Google Authenticator – WordPress Two Factor Au…)
- [CVE-2022-1113](https://cve.now/CVE-2022-1113.md): Flower Delivery by Florist One \<= 3.7 - Admin+ Stored Cross-Site Scripting (no CVSS, Flower Delivery by Florist One)
- [CVE-2022-1095](https://cve.now/CVE-2022-1095.md): Mihdan: No External Links \< 5.0.2 - Admin+ Stored Cross-Site Scripting (no CVSS, Mihdan: No External Links)
- [CVE-2022-1029](https://cve.now/CVE-2022-1029.md): Limit Login Attempts \< 4.0.72 - Admin+ Stored Cross-Site Scripting (no CVSS, Limit Login Attempts)
- [CVE-2022-1028](https://cve.now/CVE-2022-1028.md): WordPress Security \< 4.2.1 - Admin+ Stored Cross-Site Scripting (no CVSS, WordPress Security – Firewall, Malware Scanner, Secure Logi…)
- [CVE-2022-1010](https://cve.now/CVE-2022-1010.md): Login using WordPress Users \< 1.13.4 - Admin+ Stored Cross-Site Scripting (no CVSS, Login using WordPress Users)
- [CVE-2022-0875](https://cve.now/CVE-2022-0875.md): miniOrange Google Authenticator \< 1.0.5 - CSRF to Stored Cross-Site Scripting (no CVSS, Google Authenticator)
- [CVE-2022-0444](https://cve.now/CVE-2022-0444.md): XCloner \< 4.3.6 - Plugin Settings Reset (no CVSS, Backup, Restore and Migrate WordPress Sites With the XClone…)
- [CVE-2022-2214](https://cve.now/CVE-2022-2214.md): SourceCodester Library Management System bookdetails.php sql injection (CVSS 6.3, SourceCodester Library Management System)
- [CVE-2022-2213](https://cve.now/CVE-2022-2213.md): SourceCodester Library Management System cross site scripting (CVSS 3.5, SourceCodester Library Management System)
- [CVE-2022-2212](https://cve.now/CVE-2022-2212.md): SourceCodester Library Management System /card/index.php unrestricted upload (CVSS 6.3, SourceCodester Library Management System)
- [CVE-2020-9754](https://cve.now/CVE-2020-9754.md): NAVER Whale browser mobile app before 1.10.6.2 allows the attacker to bypass its browser unlock function via incognito mode. (no CVSS, NAVER Whale browser)
- [CVE-2022-33202](https://cve.now/CVE-2022-33202.md): Authentication bypass vulnerability in the setup screen of L2Blocker(on-premise) Ver4.8.5 and earlier and L2Blocker(Cloud) Ver4.8.5 and earl (no CVSS, SOFTCREATE L2Blocker)
- [CVE-2022-33146](https://cve.now/CVE-2022-33146.md): Open redirect vulnerability in web2py versions prior to 2.22.5 allows a remote attacker to redirect a user to an arbitrary web site and cond (no CVSS, web2py)
- [CVE-2022-2207](https://cve.now/CVE-2022-2207.md): Heap-based Buffer Overflow in vim/vim (CVSS 7.8, vim/vim)
- [CVE-2022-2208](https://cve.now/CVE-2022-2208.md): NULL Pointer Dereference in vim/vim (CVSS 7.8, vim/vim)
- [CVE-2022-2210](https://cve.now/CVE-2022-2210.md): Out-of-bounds Write in vim/vim (CVSS 7.8, vim/vim)
- [CVE-2022-31081](https://cve.now/CVE-2022-31081.md): Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in HTTP::Daemon (CVSS 7.3, libwww-perl HTTP-Daemon)
- [CVE-2022-31090](https://cve.now/CVE-2022-31090.md): CURLOPT\_HTTPAUTH option not cleared on change of origin in Guzzle (CVSS 7.7, guzzle · guzzlehttp/guzzle)
- [CVE-2022-31091](https://cve.now/CVE-2022-31091.md): Change in port should be considered a change in origin in Guzzle (CVSS 7.7, guzzle · guzzlehttp/guzzle)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-06-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.