# CVEs published 2022-05-31

115 CVEs were published on May 31, 2022: 6 critical, 12 high. Days are UTC.

- [CVE-2021-27778](https://cve.now/CVE-2021-27778.md): HCL Traveler is susceptible to a cross-site scripting vulnerability which could allow an attacker to execute a malicious script to access sensitive information. (CVSS 4.9, HCL Software HCL Traveler)
- [CVE-2021-44095](https://cve.now/CVE-2021-44095.md): A SQL injection vulnerability exists in ProjectWorlds Hospital Management System in php 1.0 on login page that allows a remote attacker to c (no CVSS)
- [CVE-2021-44096](https://cve.now/CVE-2021-44096.md): EGavilan Media User-Registration-and-Login-System-With-Admin-Panel 1.0 is vulnerable to SQL Injection via profile\_action - update\_user. (no CVSS)
- [CVE-2021-44097](https://cve.now/CVE-2021-44097.md): EGavilan Media Contact-Form-With-Messages-Entry-Management 1.0 is vulnerable to SQL Injection via Addmessage.php. (no CVSS)
- [CVE-2021-44098](https://cve.now/CVE-2021-44098.md): EGavilan Media Expense-Management-System 1.0 is vulnerable to SQL Injection via /expense\_action.php. (no CVSS)
- [CVE-2021-43512](https://cve.now/CVE-2021-43512.md): An issue was discovered in FlightRadar24 v8.9.0, v8.10.0, v8.10.2, v8.10.3, v8.10.4 for Android, allows attackers to cause unspecified conse (no CVSS)
- [CVE-2022-28945](https://cve.now/CVE-2022-28945.md): An issue in Webbank WeCube v3.2.2 allows attackers to execute a directory traversal via a crafted ZIP file. (no CVSS)
- [CVE-2021-42872](https://cve.now/CVE-2021-42872.md): TOTOLINK EX1200T V4.1.2cu.5215 is affected by a command injection vulnerability that can remotely execute arbitrary code. (no CVSS)
- [CVE-2022-31015](https://cve.now/CVE-2022-31015.md): Uncaught Exception (due to a data race) leads to process termination in Waitress (CVSS 6.5, Pylons waitress · waitress)
- [CVE-2021-42204](https://cve.now/CVE-2021-42204.md): An issue was discovered in swftools through 20201222. (no CVSS)
- [CVE-2022-31013](https://cve.now/CVE-2022-31013.md): Authentication bypass in Vartalap chat-server (CVSS 9.1, ramank775 chat-server)
- [CVE-2022-1947](https://cve.now/CVE-2022-1947.md): Use of Incorrect Operator in polonel/trudesk (CVSS 9.1, polonel/trudesk)
- [CVE-2022-1808](https://cve.now/CVE-2022-1808.md): Execution with Unnecessary Privileges in polonel/trudesk (CVSS 8.8, polonel/trudesk)
- [CVE-2022-1893](https://cve.now/CVE-2022-1893.md): Improper Removal of Sensitive Information Before Storage or Transfer in polonel/trudesk (CVSS 4.6, polonel/trudesk)
- [CVE-2022-29653](https://cve.now/CVE-2022-29653.md): OFCMS v1.1.4 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/comn/service/update.json. (no CVSS)
- [CVE-2022-29648](https://cve.now/CVE-2022-29648.md): A cross-site scripting (XSS) vulnerability in Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted X-Fo (no CVSS, com.jflyfox:jflyfox\_jfinal)
- [CVE-2022-29647](https://cve.now/CVE-2022-29647.md): An issue was discovered in MCMS 5.2.7. (no CVSS, net.mingsoft:ms-mcms)
- [CVE-2021-32546](https://cve.now/CVE-2021-32546.md): Missing input validation in internal/db/repo\_editor.go in Gogs before 0.12.8 allows an attacker to execute code remotely. (no CVSS, gogs.io/gogs)
- [CVE-2022-29624](https://cve.now/CVE-2022-29624.md): An arbitrary file upload vulnerability in the Add File function of TPCMS v3.2 allows attackers to execute arbitrary code via a crafted PHP f (no CVSS)
- [CVE-2022-30478](https://cve.now/CVE-2022-30478.md): Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in \\search\_product.php via the keyword parameters. (no CVSS)
- [CVE-2022-30482](https://cve.now/CVE-2022-30482.md): Ecommerce-project-with-php-and-mysqli-Fruits-Bazar- 1.0 is vulnerable to Cross Site Scripting (XSS) in \\admin\\add\_cata.php via the ctg\_name (no CVSS)
- [CVE-2022-30481](https://cve.now/CVE-2022-30481.md): Food-order-and-table-reservation-system- 1.0 is vulnerable to SQL Injection in categorywise-menu.php via the catid parameters. (no CVSS)
- [CVE-2022-29540](https://cve.now/CVE-2022-29540.md): resi-calltrace in RESI Gemini-Net 4.2 is affected by Multiple XSS issues. (no CVSS)
- [CVE-2021-33504](https://cve.now/CVE-2021-33504.md): Couchbase Server before 7.1.0 has Incorrect Access Control. (no CVSS)
- [CVE-2022-28605](https://cve.now/CVE-2022-28605.md): Hardcoded admin token in SoundBar apps in Linkplay SDK 1.00 allows remote attackers to gain admin privilege access in linkplay antifactory (no CVSS)
- [CVE-2022-24701](https://cve.now/CVE-2022-24701.md): An issue was discovered in WinAPRS 2.9.0. (no CVSS)
- [CVE-2022-24700](https://cve.now/CVE-2022-24700.md): An issue was discovered in WinAPRS 2.9.0. (no CVSS)
- [CVE-2022-24702](https://cve.now/CVE-2022-24702.md): An issue was discovered in WinAPRS 2.9.0. (no CVSS)
- [CVE-2022-1661](https://cve.now/CVE-2022-1661.md): Keysight N6854A Geolocation server and N6841A RF Sensor software (CVSS 7.5, Keysight N6854A Geolocation server and N6841A RF Sensor sof…)
- [CVE-2022-31005](https://cve.now/CVE-2022-31005.md): Integer Overflow in Vapor's HTTP Range Request (CVSS 7.5, vapor)
- [CVE-2022-1660](https://cve.now/CVE-2022-1660.md): Keysight N6854A Geolocation server and N6841A RF Sensor software (CVSS 9.8, Keysight N6854A Geolocation server and N6841A RF Sensor sof…)
- [CVE-2021-36890](https://cve.now/CVE-2021-36890.md): WordPress Social Share Buttons by Supsystic plugin \<= 2.2.2 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 4.3, supsystic.com Social Share Buttons by Supsystic)
- [CVE-2022-31011](https://cve.now/CVE-2022-31011.md): TiDB authentication bypass vulnerability (CVSS 7.8, pingcap tidb · github.com/pingcap/tidb)
- [CVE-2022-31007](https://cve.now/CVE-2022-31007.md): Privilege escalation from administrator in eLabFTW (CVSS 4.9, elabftw)
- [CVE-2021-36866](https://cve.now/CVE-2021-36866.md): WordPress Easy Pricing Tables plugin \<= 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, Fatcat Apps Easy Pricing Tables)
- [CVE-2022-1797](https://cve.now/CVE-2022-1797.md): Rockwell Automation Logix Controllers Uncontrolled Resource Consumption (CVSS 6.8, Rockwell Automation CompactLogix 5380 controllers · Rock… +7)
- [CVE-2021-42203](https://cve.now/CVE-2021-42203.md): An issue was discovered in swftools through 20201222. (no CVSS)
- [CVE-2022-1789](https://cve.now/CVE-2022-1789.md): With shadow paging enabled, the INVPCID instruction results in a call to kvm\_mmu\_invpcid\_gva. (no CVSS, kernel)
- [CVE-2022-1786](https://cve.now/CVE-2022-1786.md): A use-after-free flaw was found in the Linux kernel’s io\_uring subsystem in the way a user sets up a ring with IORING\_SETUP\_IOPOLL with more (no CVSS, kernel)
- [CVE-2021-42202](https://cve.now/CVE-2021-42202.md): An issue was discovered in swftools through 20201222. (no CVSS)
- [CVE-2021-42201](https://cve.now/CVE-2021-42201.md): An issue was discovered in swftools through 20201222. (no CVSS)
- [CVE-2021-40186](https://cve.now/CVE-2021-40186.md): DNN CMS Server-Side Request Forgery (SSRF) (CVSS 6.5, DNNSoftware DNN Platform)
- [CVE-2022-1652](https://cve.now/CVE-2022-1652.md): Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency use-after-free flaw in the bad\_fl (no CVSS, kernel)
- [CVE-2022-1419](https://cve.now/CVE-2022-1419.md): The root cause of this vulnerability is that the ioctl$DRM\_IOCTL\_MODE\_DESTROY\_DUMB can decrease refcount of \*drm\_vgem\_gem\_object \*(created i (no CVSS, kernel)
- [CVE-2022-29483](https://cve.now/CVE-2022-29483.md): e-Design - Multiple vulnerabilities (CVSS 7.8, ABB e-Design)
- [CVE-2022-28702](https://cve.now/CVE-2022-28702.md): e-Design - Multiple vulnerabilities (CVSS 6.1, ABB e-Design)
- [CVE-2022-30819](https://cve.now/CVE-2022-30819.md): In Wedding Management System v1.0, there is an arbitrary file upload vulnerability in the picture upload point of "photos\_edit.php" file. (no CVSS)
- [CVE-2022-30820](https://cve.now/CVE-2022-30820.md): In Wedding Management v1.0, there is an arbitrary file upload vulnerability in the picture upload point of "users\_edit.php" file. (no CVSS)
- [CVE-2022-30821](https://cve.now/CVE-2022-30821.md): In Wedding Management System v1.0, the editing function of the "Services" module in the background management system has an arbitrary file u (no CVSS)
- [CVE-2021-42200](https://cve.now/CVE-2021-42200.md): An issue was discovered in swftools through 20201222. (no CVSS)
- [CVE-2022-30822](https://cve.now/CVE-2022-30822.md): In Wedding Management System v1.0, there is an arbitrary file upload vulnerability in the picture upload point of "users\_profile.php" file. (no CVSS)
- [CVE-2022-30823](https://cve.now/CVE-2022-30823.md): Wedding Management System v1.0 is vulnerable to SQL Injection via \\admin\\blog\_events\_edit.php. (no CVSS)
- [CVE-2022-30825](https://cve.now/CVE-2022-30825.md): Wedding Management System v1.0 is vulnerable to SQL Injection via \\admin\\client\_edit.php. (no CVSS)
- [CVE-2022-30826](https://cve.now/CVE-2022-30826.md): Wedding Management System v1.0 is vulnerable to SQL Injection via admin\\client\_assign.php. (no CVSS)
- [CVE-2022-30827](https://cve.now/CVE-2022-30827.md): Wedding Management System v1.0 is vulnerable to SQL Injection via \\admin\\package\_edit.php. (no CVSS)
- [CVE-2022-30828](https://cve.now/CVE-2022-30828.md): Wedding Management System v1.0 is vulnerable to SQL Injection via \\admin\\photos\_edit.php. (no CVSS)
- [CVE-2021-42199](https://cve.now/CVE-2021-42199.md): An issue was discovered in swftools through 20201222. (no CVSS)
- [CVE-2022-30829](https://cve.now/CVE-2022-30829.md): Wedding Management System v1.0 is vulnerable to SQL Injection via \\admin\\users\_edit.php. (no CVSS)
- [CVE-2022-30830](https://cve.now/CVE-2022-30830.md): Wedding Management System v1.0 is vulnerable to SQL Injection via \\admin\\feature\_edit.php. (no CVSS)
- [CVE-2022-30831](https://cve.now/CVE-2022-30831.md): Wedding Management System v1.0 is vulnerable to SQL Injection via Wedding-Management/wedding\_details.php. (no CVSS)
- [CVE-2022-30832](https://cve.now/CVE-2022-30832.md): Wedding Management System v1.0 is vulnerable to SQL Injection via /Wedding-Management/admin/client\_assign.php?booking=31&user\_id=. (no CVSS)
- [CVE-2021-42198](https://cve.now/CVE-2021-42198.md): An issue was discovered in swftools through 20201222. (no CVSS)
- [CVE-2022-30833](https://cve.now/CVE-2022-30833.md): Wedding Management System v1.0 is vulnerable to SQL Injection via /Wedding-Management/admin/client\_edit.php?booking=31&user\_id=. (no CVSS)
- [CVE-2022-30818](https://cve.now/CVE-2022-30818.md): Wedding Management System v1.0 is vulnerable to SQL injection via /Wedding-Management/admin/blog\_events\_edit.php?id=31. (no CVSS)
- [CVE-2022-30834](https://cve.now/CVE-2022-30834.md): Wedding Management System v1.0 is vulnerable to SQL Injection via /Wedding-Management/admin/client\_manage\_account\_details.php?booking\_id=31& (no CVSS)
- [CVE-2022-30835](https://cve.now/CVE-2022-30835.md): Wedding Management System v1.0 is vulnerable to SQL Injection. (no CVSS)
- [CVE-2022-30836](https://cve.now/CVE-2022-30836.md): Wedding Management System v1.0 is vulnerable to SQL Injection. (no CVSS)
- [CVE-2021-42197](https://cve.now/CVE-2021-42197.md): An issue was discovered in swftools through 20201222 through a memory leak in the swftools when swfdump is used. (no CVSS)
- [CVE-2022-29258](https://cve.now/CVE-2022-29258.md): Cross-site Scripting in Filter Stream Converter Application in XWiki Platform (CVSS 7.4, xwiki-platform · org.xwiki.platform:xwiki-platform-filter-ui)
- [CVE-2021-42196](https://cve.now/CVE-2021-42196.md): An issue was discovered in swftools through 20201222. (no CVSS)
- [CVE-2022-29245](https://cve.now/CVE-2022-29245.md): Weak private key generation in SSH.NET (CVSS 6.5, sshnet SSH.NET · SSH.NET)
- [CVE-2022-30817](https://cve.now/CVE-2022-30817.md): Simple Bus Ticket Booking System 1.0 is vulnerable to SQL Injection via /SimpleBusTicket/index.php. (no CVSS)
- [CVE-2021-42195](https://cve.now/CVE-2021-42195.md): An issue was discovered in swftools through 20201222. (no CVSS)
- [CVE-2022-30804](https://cve.now/CVE-2022-30804.md): elitecms v1.01 is vulnerable to Delete any file via /admin/delete\_image.php?file=. (no CVSS)
- [CVE-2022-30808](https://cve.now/CVE-2022-30808.md): elitecms 1.0.1 is vulnerable to Arbitrary code execution via admin/manage\_uploads.php. (no CVSS)
- [CVE-2022-30809](https://cve.now/CVE-2022-30809.md): elitecms 1.01 is vulnerable to SQL Injection via /admin/edit\_page.php?page=. (no CVSS)
- [CVE-2022-30810](https://cve.now/CVE-2022-30810.md): elitecms v1.01 is vulnerable to SQL Injection via admin/edit\_post.php. (no CVSS)
- [CVE-2022-30813](https://cve.now/CVE-2022-30813.md): elitecms 1.01 is vulnerable to SQL Injection via /admin/add\_post.php. (no CVSS)
- [CVE-2022-30814](https://cve.now/CVE-2022-30814.md): elitecms v1.01 is vulnerable to SQL Injection via /admin/add\_sidebar.php. (no CVSS)
- [CVE-2022-29243](https://cve.now/CVE-2022-29243.md): Improper input-size validation on the user new session name in Nextcloud Server (CVSS 4.3, nextcloud security-advisories)
- [CVE-2022-29220](https://cve.now/CVE-2022-29220.md): No verification of commits origin in github-action-merge-dependabot (CVSS 6.5, fastify github-action-merge-dependabot)
- [CVE-2022-30815](https://cve.now/CVE-2022-30815.md): elitecms 1.01 is vulnerable to SQL Injection via admin/edit\_sidebar.php?page=2&sidebar= (no CVSS)
- [CVE-2022-30816](https://cve.now/CVE-2022-30816.md): elitecms 1.01 is vulnerable to SQL Injection via /admin/edit\_sidebar.php. (no CVSS)
- [CVE-2022-22361](https://cve.now/CVE-2022-22361.md): IBM Business Automation Workflow traditional 21.0.1 through 21.0.3, 20.0.0.1 through 20.0.0.2, 19.0.0.1 through 19.0.0.3, 18.0.0.0 through 1 (CVSS 4.3, IBM Business Process Manager · IBM Business Automation Work…)
- [CVE-2022-31329](https://cve.now/CVE-2022-31329.md): Online Ordering System By janobe 2.3.2 is vulnerable to SQL Injection via /ordering/admin/orders/loaddata.php. (no CVSS)
- [CVE-2022-31328](https://cve.now/CVE-2022-31328.md): Online Ordering System By janobe 2.3.2 has SQL Injection via /ordering/admin/products/index.php?view=edit&id=. (no CVSS)
- [CVE-2022-31327](https://cve.now/CVE-2022-31327.md): Online Ordering System By janobe 2.3.2 is vulneranle to SQL Injection via /ordering/index.php?q=products&id=. (no CVSS)
- [CVE-2022-30799](https://cve.now/CVE-2022-30799.md): Online Ordering System v1.0 by oretnom23 has SQL injection via store/orderpage.php. (no CVSS)
- [CVE-2022-30798](https://cve.now/CVE-2022-30798.md): Online Ordering System v1.0 by oretnom23 is vulnerable to SQL Injection via admin/viewreport.php. (no CVSS)
- [CVE-2022-30797](https://cve.now/CVE-2022-30797.md): Online Ordering System 1.0 by oretnom23 is vulnerable to SQL Injection via admin/vieworders.php. (no CVSS)
- [CVE-2022-30795](https://cve.now/CVE-2022-30795.md): Online Ordering System v1.0 by oretnom23 is vulnerable to SQL Injection via admin/editproductimage.php. (no CVSS)
- [CVE-2022-30794](https://cve.now/CVE-2022-30794.md): Online Ordering System v1.0 by oretnom23 is vulnerable to SQL Injection via admin/editproductetails.php. (no CVSS)
- [CVE-2022-31335](https://cve.now/CVE-2022-31335.md): Online Ordering System 2.3.2 is vulnerable to SQL Injection via /ordering/admin/stockin/index.php?view=edit&id=. (no CVSS)
- [CVE-2022-31336](https://cve.now/CVE-2022-31336.md): Online Ordering System 2.3.2 is vulnerable to SQL Injection via /ordering/admin/stockin/loaddata.php. (no CVSS)
- [CVE-2022-31337](https://cve.now/CVE-2022-31337.md): Online Ordering System 2.3.2 is vulnerable to SQL Injection via /ordering/admin/category/index.php?view=edit&id=. (no CVSS)
- [CVE-2022-31338](https://cve.now/CVE-2022-31338.md): Online Ordering System 2.3.2 is vulnerable to SQL Injection via /ordering/admin/user/index.php?view=edit&id=. (no CVSS)
- [CVE-2022-23082](https://cve.now/CVE-2022-23082.md): CureKit - Path Traversal in isFileOutsideDir (CVSS 7.5, WhiteSource CureKit · io.whitesource:curekit)
- [CVE-2022-29725](https://cve.now/CVE-2022-29725.md): An arbitrary file upload in the image upload component of wityCMS v0.6.2 allows attackers to execute arbitrary code via a crafted PHP file. (no CVSS)
- [CVE-2022-30973](https://cve.now/CVE-2022-30973.md): Missing fix for CVE-2022-30126 in 1.28.2 (no CVSS, Apache Software Foundation Apache Tika · org.apache.tika:ti…)
- [CVE-2022-29712](https://cve.now/CVE-2022-29712.md): LibreNMS v22.3.0 was discovered to contain multiple command injection vulnerabilities via the service\_ip, hostname, and service\_param parame (no CVSS, librenms/librenms)
- [CVE-2022-29711](https://cve.now/CVE-2022-29711.md): LibreNMS v22.3.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /Table/GraylogController.php. (no CVSS, librenms/librenms)
- [CVE-2022-30034](https://cve.now/CVE-2022-30034.md): Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. (no CVSS, flower)
- [CVE-2022-31500](https://cve.now/CVE-2022-31500.md): In KNIME Analytics Platform below 4.6.0, the Windows installer sets improper filesystem permissions. (no CVSS)
- [CVE-2021-3555](https://cve.now/CVE-2021-3555.md): A Buffer Overflow vulnerability in the RSTP server component of Eufy Indoor 2K Indoor Camera allows a local attacker to achieve remote code (CVSS 7.6, Eufy Indoor 2K Indoor Camera)
- [CVE-2022-1926](https://cve.now/CVE-2022-1926.md): Integer Overflow or Wraparound in polonel/trudesk (CVSS 7.6, polonel/trudesk)
- [CVE-2022-26491](https://cve.now/CVE-2022-26491.md): An issue was discovered in Pidgin before 2.14.9. (no CVSS)
- [CVE-2022-1934](https://cve.now/CVE-2022-1934.md): Use After Free in mruby/mruby (CVSS 5.1, mruby/mruby)
- [CVE-2022-1931](https://cve.now/CVE-2022-1931.md): Incorrect Synchronization in polonel/trudesk (CVSS 9.1, polonel/trudesk)
- [CVE-2020-28246](https://cve.now/CVE-2020-28246.md): A Server-Side Template Injection (SSTI) was discovered in Form.io 2.0.0. (CVSS 9.8, formio)
- [CVE-2022-1215](https://cve.now/CVE-2022-1215.md): A format string vulnerability was found in libinput (no CVSS, libinput)
- [CVE-2022-1462](https://cve.now/CVE-2022-1462.md): An out-of-bounds read flaw was found in the Linux kernel’s TeleTYpe subsystem. (no CVSS, kernel)
- [CVE-2022-1942](https://cve.now/CVE-2022-1942.md): Heap-based Buffer Overflow in vim/vim (CVSS 7.8, vim/vim)
- [CVE-2022-31001](https://cve.now/CVE-2022-31001.md): Out-of-bounds Read in Sofia-SIP (CVSS 7.5, freeswitch sofia-sip)
- [CVE-2022-31002](https://cve.now/CVE-2022-31002.md): Out-of-bounds Read in Sofia-SIP (CVSS 7.5, freeswitch sofia-sip)
- [CVE-2022-31003](https://cve.now/CVE-2022-31003.md): Heap-based Buffer Overflow and Out-of-bounds Write in Sofia-SIP (CVSS 9.1, freeswitch sofia-sip)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-05-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.