# CVEs published 2022-06-02

87 CVEs were published on June 2, 2022: 3 critical, 13 high. Days are UTC.

- [CVE-2022-30238](https://cve.now/CVE-2022-30238.md): A CWE-287: Improper Authentication vulnerability exists that could allow an attacker to take over the admin account when an attacker hijacks (CVSS 8.3, Schneider Electric Wiser Smart)
- [CVE-2022-30237](https://cve.now/CVE-2022-30237.md): A CWE-311: Missing Encryption of Sensitive Data vulnerability exists that could allow authentication credentials to be recovered when an att (CVSS 8.2, Schneider Electric Wiser Smart)
- [CVE-2022-30236](https://cve.now/CVE-2022-30236.md): A CWE-669: Incorrect Resource Transfer Between Spheres vulnerability exists that could allow unauthorized access when an attacker uses cross (CVSS 8.2, Schneider Electric Wiser Smart)
- [CVE-2022-30235](https://cve.now/CVE-2022-30235.md): A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow unauthorized access when an attac (CVSS 8.6, Schneider Electric Wiser Smart)
- [CVE-2022-30234](https://cve.now/CVE-2022-30234.md): A CWE-798: Use of Hard-coded Credentials vulnerability exists that could allow arbitrary code to be executed when root level access is obtai (CVSS 9.4, Schneider Electric Wiser Smart)
- [CVE-2022-30233](https://cve.now/CVE-2022-30233.md): A CWE-20: Improper Input Validation vulnerability exists that could allow the product to be maliciously manipulated when the user is tricked (CVSS 6.5, Schneider Electric Wiser Smart)
- [CVE-2022-30232](https://cve.now/CVE-2022-30232.md): A CWE-20: Improper Input Validation vulnerability exists that could cause potential remote code execution when an attacker is able to interc (CVSS 8.0, Schneider Electric Power Logic ION Setup)
- [CVE-2022-29594](https://cve.now/CVE-2022-29594.md): eG Agent before 7.2 has weak file permissions that enable escalation of privileges to SYSTEM. (no CVSS)
- [CVE-2022-31459](https://cve.now/CVE-2022-31459.md): Owl Labs Meeting Owl 5.2.0.15 allows attackers to retrieve the passcode hash via a certain c 10 value over Bluetooth. (CVSS 7.4)
- [CVE-2022-31461](https://cve.now/CVE-2022-31461.md): Owl Labs Meeting Owl 5.2.0.15 allows attackers to deactivate the passcode protection mechanism via a certain c 11 message. (CVSS 7.4)
- [CVE-2022-31462](https://cve.now/CVE-2022-31462.md): Owl Labs Meeting Owl 5.2.0.15 allows attackers to control the device via a backdoor password (derived from the serial number) that can be fo (CVSS 9.3)
- [CVE-2022-31463](https://cve.now/CVE-2022-31463.md): Owl Labs Meeting Owl 5.2.0.15 does not require a password for Bluetooth commands, because only client-side authentication is used. (CVSS 8.2)
- [CVE-2022-31460](https://cve.now/CVE-2022-31460.md): Owl Labs Meeting Owl 5.2.0.15 allows attackers to activate Tethering Mode with hard-coded hoothoot credentials via a certain c 150 value. (CVSS 7.4)
- [CVE-2022-29085](https://cve.now/CVE-2022-29085.md): Dell Unity, Dell UnityVSA, and Dell Unity XT versions prior to 5.2.0.0.5.173 contain a plain-text password storage vulnerability when certai (CVSS 6.4, Dell Unity)
- [CVE-2022-29084](https://cve.now/CVE-2022-29084.md): Dell Unity, Dell UnityVSA, and Dell Unity XT versions before 5.2.0.0.5.173 do not restrict excessive authentication attempts in Unisphere GU (CVSS 8.1, Dell Unity)
- [CVE-2022-26869](https://cve.now/CVE-2022-26869.md): Dell PowerStore versions 2.0.0.x, 2.0.1.x and 2.1.0.x contains an open port vulnerability. (CVSS 9.8, Dell PowerStore)
- [CVE-2022-26868](https://cve.now/CVE-2022-26868.md): Dell EMC PowerStore versions 2.0.0.x, 2.0.1.x, and 2.1.0.x are vulnerable to a command injection flaw. (CVSS 6.4, Dell PowerStore)
- [CVE-2022-26867](https://cve.now/CVE-2022-26867.md): PowerStore SW v2.1.1.0 supports the option to export data to either a CSV or an XLSX file. (CVSS 5.9, Dell PowerStore)
- [CVE-2022-26866](https://cve.now/CVE-2022-26866.md): Dell PowerStore Versions before v2.1.1.0. (CVSS 5.5, Dell PowerStore)
- [CVE-2022-22557](https://cve.now/CVE-2022-22557.md): PowerStore contains Plain-Text Password Storage Vulnerability in PowerStore X & T environments running versions 2.0.0.x and 2.0.1.x A locall (CVSS 7.5, Dell PowerStore)
- [CVE-2022-22556](https://cve.now/CVE-2022-22556.md): Dell PowerStore contains an Uncontrolled Resource Consumption Vulnerability in PowerStore User Interface. (CVSS 3.7, Dell PowerStore)
- [CVE-2022-32250](https://cve.now/CVE-2022-32250.md): net/netfilter/nf\_tables\_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privil (no CVSS)
- [CVE-2021-33473](https://cve.now/CVE-2021-33473.md): An argument injection vulnerability in Dragonfly Ruby Gem v1.3.0 allows attackers to read and write arbitrary files when the verify\_url opti (no CVSS, dragonfly)
- [CVE-2021-42877](https://cve.now/CVE-2021-42877.md): TOTOLINK EX1200T V4.1.2cu.5215 contains a denial of service vulnerability in function RebootSystem of the file lib/cste\_modules/system which (no CVSS)
- [CVE-2021-42875](https://cve.now/CVE-2021-42875.md): TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in the function setDiagnosisCfg of the file lib/cste\_module (no CVSS)
- [CVE-2022-31024](https://cve.now/CVE-2022-31024.md): Federated editing allows iframing remote servers by default in richdocuments (CVSS 6.5, nextcloud security-advisories)
- [CVE-2022-31023](https://cve.now/CVE-2022-31023.md): Dev error stack trace leaking into prod in Play Framework (CVSS 5.9, playframework · com.typesafe.play:play\_2.12 +1)
- [CVE-2021-45983](https://cve.now/CVE-2021-45983.md): NetScout nGeniusONE 6.3.2 allows Java RMI Code Execution. (no CVSS)
- [CVE-2021-45982](https://cve.now/CVE-2021-45982.md): NetScout nGeniusONE 6.3.2 allows Arbitrary File Upload by a privileged user. (no CVSS)
- [CVE-2021-45981](https://cve.now/CVE-2021-45981.md): NetScout nGeniusONE 6.3.2 allows an XML External Entity (XXE) attack. (no CVSS)
- [CVE-2022-26944](https://cve.now/CVE-2022-26944.md): Percona XtraBackup 2.4.20 unintentionally writes the command line to any resulting backup file output. (no CVSS)
- [CVE-2021-38221](https://cve.now/CVE-2021-38221.md): bbs-go \<= 3.3.0 including Custom Edition is vulnerable to stored XSS. (no CVSS)
- [CVE-2022-1980](https://cve.now/CVE-2022-1980.md): SourceCodester Product Show Room Site cross site scripting (CVSS 2.4, SourceCodester Product Show Room Site)
- [CVE-2022-1979](https://cve.now/CVE-2022-1979.md): SourceCodester Product Show Room Site p=contact cross site scripting (CVSS 3.5, SourceCodester Product Show Room Site)
- [CVE-2022-30429](https://cve.now/CVE-2022-30429.md): Multiple cross-site scripting (XSS) vulnerabilities in Neos CMS allow attackers with the editor role or higher to inject arbitrary script or (no CVSS, neos/neos)
- [CVE-2022-29597](https://cve.now/CVE-2022-29597.md): Solutions Atlantic Regulatory Reporting System (RRS) v500 is vulnerable to Local File Inclusion (LFI). (no CVSS)
- [CVE-2022-1716](https://cve.now/CVE-2022-1716.md): Keep My Notes v1.80.147 allows an attacker with physical access to the victim's device to bypass the application's password/pin lock to acce (no CVSS, Keep My Notes)
- [CVE-2022-1982](https://cve.now/CVE-2022-1982.md): A crafted SVG attachment can crash a Mattermost server (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-server)
- [CVE-2022-25163](https://cve.now/CVE-2022-25163.md): Improper Input Validation vulnerability in Mitsubishi Electric MELSEC-Q Series QJ71E71-100 first 5 digits of serial number "24061" or prior, (no CVSS, Mitsubishi Electric MELSEC-Q Series QJ71E71-100; Mitsubishi…)
- [CVE-2022-31018](https://cve.now/CVE-2022-31018.md): Denial of service binding form from JSON in Play Framework (CVSS 7.5, playframework · com.typesafe.play:play\_2.13 +1)
- [CVE-2022-29704](https://cve.now/CVE-2022-29704.md): BrowsBox CMS v4.0 was discovered to contain a SQL injection vulnerability. (no CVSS)
- [CVE-2022-32019](https://cve.now/CVE-2022-32019.md): Car Rental Management System v1.0 is vulnerable to Arbitrary code execution via car-rental-management-system/admin/ajax.php?action=save\_car. (no CVSS)
- [CVE-2022-32020](https://cve.now/CVE-2022-32020.md): Car Rental Management System v1.0 is vulnerable to Arbitrary code execution via ip/car-rental-management-system/admin/ajax.php?action=save\_s (no CVSS)
- [CVE-2022-32021](https://cve.now/CVE-2022-32021.md): Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/manage\_movement.php?id=. (no CVSS)
- [CVE-2022-32022](https://cve.now/CVE-2022-32022.md): Car Rental Management System v1.0 is vulnerable to SQL Injection via /ip/car-rental-management-system/admin/ajax.php?action=login. (no CVSS)
- [CVE-2022-32024](https://cve.now/CVE-2022-32024.md): Car Rental Management System v1.0 is vulnerable to SQL Injection via car-rental-management-system/booking.php?car\_id=. (no CVSS)
- [CVE-2022-32025](https://cve.now/CVE-2022-32025.md): Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/view\_car.php?id=. (no CVSS)
- [CVE-2022-32026](https://cve.now/CVE-2022-32026.md): Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/manage\_booking.php?id=. (no CVSS)
- [CVE-2022-32027](https://cve.now/CVE-2022-32027.md): Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/index.php?page=manage\_car&id=. (no CVSS)
- [CVE-2022-32028](https://cve.now/CVE-2022-32028.md): Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/manage\_user.php?id=. (no CVSS)
- [CVE-2022-32007](https://cve.now/CVE-2022-32007.md): Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/admin/company/index.php?view=edit&id=. (no CVSS)
- [CVE-2022-32008](https://cve.now/CVE-2022-32008.md): Complete Online Job Search System v1.0 is vulnerable to SQL Injection via eris/admin/vacancy/index.php?view=edit&id=. (no CVSS)
- [CVE-2022-32010](https://cve.now/CVE-2022-32010.md): Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/admin/user/index.php?view=edit&id=. (no CVSS)
- [CVE-2022-32011](https://cve.now/CVE-2022-32011.md): Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/admin/applicants/index.php?view=view&id=. (no CVSS)
- [CVE-2022-32012](https://cve.now/CVE-2022-32012.md): Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/admin/employee/index.php?view=edit&id=. (no CVSS)
- [CVE-2022-32013](https://cve.now/CVE-2022-32013.md): Complete Online Job Search System v1.0 is vulnerable to SQL Injection via eris/admin/category/index.php?view=edit&id=. (no CVSS)
- [CVE-2022-32014](https://cve.now/CVE-2022-32014.md): Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/index.php?q=result&searchfor=byfunction. (no CVSS)
- [CVE-2022-32015](https://cve.now/CVE-2022-32015.md): Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/index.php?q=category&search=. (no CVSS)
- [CVE-2022-32016](https://cve.now/CVE-2022-32016.md): Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/index.php?q=result&searchfor=bycompany. (no CVSS)
- [CVE-2022-32017](https://cve.now/CVE-2022-32017.md): Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/index.php?q=result&searchfor=bytitle. (no CVSS)
- [CVE-2022-32018](https://cve.now/CVE-2022-32018.md): Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/index.php?q=hiring&search=. (no CVSS)
- [CVE-2022-31985](https://cve.now/CVE-2022-31985.md): Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/?page=reports/daily\_sales\_report&date=. (no CVSS)
- [CVE-2022-31986](https://cve.now/CVE-2022-31986.md): Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/?page=reports/daily\_court\_rental\_report&date=. (no CVSS)
- [CVE-2022-31988](https://cve.now/CVE-2022-31988.md): Badminton Center Management System v1.0 is vulnerable to SQL Injection via bcms/admin/?page=reports/daily\_services\_report&date=. (no CVSS)
- [CVE-2022-31989](https://cve.now/CVE-2022-31989.md): Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/?page=user/manage\_user&id=. (no CVSS)
- [CVE-2022-31990](https://cve.now/CVE-2022-31990.md): Badminton Center Management System v1.0 is vulnerable to SQL Injection via bcms/classes/Master.php?f=delete\_product. (no CVSS)
- [CVE-2022-31991](https://cve.now/CVE-2022-31991.md): Badminton Center Management System v1.0 is vulnerable to SQL Injection via bcms/classes/Master.php?f=delete\_court. (no CVSS)
- [CVE-2022-31992](https://cve.now/CVE-2022-31992.md): Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/?page=court\_rentals/view\_court\_rental&id=. (no CVSS)
- [CVE-2022-31993](https://cve.now/CVE-2022-31993.md): Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/classes/Master.php?f=delete\_service. (no CVSS)
- [CVE-2022-31994](https://cve.now/CVE-2022-31994.md): Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/?page=sales/view\_details&id. (no CVSS)
- [CVE-2022-31996](https://cve.now/CVE-2022-31996.md): Badminton Center Management System v1.0 is vulnerable to SQL Injection via bcms/admin/?page=sales/manage\_sale&id=. (no CVSS)
- [CVE-2022-31998](https://cve.now/CVE-2022-31998.md): Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/?page=service\_transactions/view\_details&id=. (no CVSS)
- [CVE-2022-32000](https://cve.now/CVE-2022-32000.md): Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/?page=service\_transactions/manage\_service\_transaction (no CVSS)
- [CVE-2022-32001](https://cve.now/CVE-2022-32001.md): Badminton Center Management System v1.0 is vulnerable to SQL Injection via bcms/admin/products/view\_product.php?id=. (no CVSS)
- [CVE-2022-32002](https://cve.now/CVE-2022-32002.md): Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/courts/manage\_court.php?id=. (no CVSS)
- [CVE-2022-32003](https://cve.now/CVE-2022-32003.md): Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/courts/view\_court.php?id=. (no CVSS)
- [CVE-2022-32004](https://cve.now/CVE-2022-32004.md): Badminton Center Management System v1.0 is vulnerable to SQL Injection via bcms/admin/products/manage\_product.php?id=. (no CVSS)
- [CVE-2022-32005](https://cve.now/CVE-2022-32005.md): Badminton Center Management System v1.0 is vulnerable to SQL Injection via bcms/admin/services/manage\_service.php?id=. (no CVSS)
- [CVE-2022-32006](https://cve.now/CVE-2022-32006.md): Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/services/view\_service.php?id=. (no CVSS)
- [CVE-2022-29788](https://cve.now/CVE-2022-29788.md): libmobi before v0.10 contains a NULL pointer dereference via the component mobi\_buffer\_getpointer. (no CVSS)
- [CVE-2019-12350](https://cve.now/CVE-2019-12350.md): An issue was discovered in zzcms 2019. (no CVSS)
- [CVE-2019-12349](https://cve.now/CVE-2019-12349.md): An issue was discovered in zzcms 2019. (no CVSS)
- [CVE-2021-33615](https://cve.now/CVE-2021-33615.md): RSA Archer 6.8.00500.1003 P5 allows Unrestricted Upload of a File with a Dangerous Type. (no CVSS)
- [CVE-2019-12351](https://cve.now/CVE-2019-12351.md): An issue was discovered in zzcms 2019. (no CVSS)
- [CVE-2022-1968](https://cve.now/CVE-2022-1968.md): Use After Free in vim/vim (CVSS 7.8, vim/vim)
- [CVE-2022-26497](https://cve.now/CVE-2022-26497.md): BigBlueButton Greenlight 2.11.1 allows XSS. (no CVSS)
- [CVE-2022-29718](https://cve.now/CVE-2022-29718.md): Caddy v2.4 was discovered to contain an open redirect vulnerability. (no CVSS, github.com/caddyserver/caddy · github.com/caddyserver/caddy…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-06-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.