# CVEs published 2022-06-03

51 CVEs were published on June 3, 2022: 3 critical, 6 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2022-26134](https://cve.now/CVE-2022-26134.md): In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attack (CVSS 9.8, KEV, Atlassian Confluence Data Center · Atlassian Confluence Ser…)
- [CVE-2022-1703](https://cve.now/CVE-2022-1703.md): Improper neutralization of special elements in the SonicWall SSL-VPN SMA100 series management interface allows a remote authenticated attack (no CVSS, SonicWall SMA100)
- [CVE-2022-29784](https://cve.now/CVE-2022-29784.md): PublicCMS V4.0.202204.a and below contains an information leak via the component /views/directive/sys/SysConfigDataDirective.java. (no CVSS)
- [CVE-2022-29778](https://cve.now/CVE-2022-29778.md): D-Link DIR-890L 1.20b01 allows attackers to execute arbitrary code due to the hardcoded option Wake-On-Lan for the parameter 'descriptor' at (CVSS 8.8)
- [CVE-2022-29773](https://cve.now/CVE-2022-29773.md): An access control issue in aleksis/core/util/auth\_helpers.py: ClientProtectedResourceMixin of AlekSIS-Core v2.8.1 and below allows attackers (no CVSS, aleksis-core)
- [CVE-2022-21122](https://cve.now/CVE-2022-21122.md): Arbitrary Code Execution (CVSS 9.0, metacalc)
- [CVE-2022-29770](https://cve.now/CVE-2022-29770.md): XXL-Job v2.3.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via /xxl-job-admin/jobinfo. (no CVSS, com.xuxueli:xxl-job)
- [CVE-2022-24065](https://cve.now/CVE-2022-24065.md): Command Injection (CVSS 8.1, cookiecutter)
- [CVE-2021-43271](https://cve.now/CVE-2021-43271.md): Riverbed AppResponse 11.8.0, 11.8.5, 11.8.5a, 11.9.0, 11.9.0a, 11.10.0, 11.11.0, 11.11.0a, 11.11.1, 11.11.1a, 11.11.5, and 11.11.5a (when co (no CVSS)
- [CVE-2020-36542](https://cve.now/CVE-2020-36542.md): Demokratian install3.php privileges management (CVSS 7.3, Demokratian)
- [CVE-2020-36541](https://cve.now/CVE-2020-36541.md): Demokratian genera\_select.php sql injection (CVSS 7.3, Demokratian)
- [CVE-2020-36540](https://cve.now/CVE-2020-36540.md): Neetai Tech product.php sql injection (CVSS 6.3, Neetai Tech)
- [CVE-2020-36539](https://cve.now/CVE-2020-36539.md): Lógico y Creativo sql injection (CVSS 6.3, Lógico y Creativo)
- [CVE-2020-36538](https://cve.now/CVE-2020-36538.md): Eatan CMS sql injection (CVSS 6.3, Eatan CMS)
- [CVE-2020-36537](https://cve.now/CVE-2020-36537.md): Everywhere CMS sql injection (CVSS 6.3, Everywhere CMS)
- [CVE-2020-36536](https://cve.now/CVE-2020-36536.md): Brandbugle main.php sql injection (CVSS 6.3, Brandbugle)
- [CVE-2020-36535](https://cve.now/CVE-2020-36535.md): MINMAX newsDia.php sql injection (CVSS 6.3, MINMAX)
- [CVE-2020-36534](https://cve.now/CVE-2020-36534.md): easyii CMS out cross-site request forgery (CVSS 4.3, easyii CMS · noumo/easyii)
- [CVE-2020-36533](https://cve.now/CVE-2020-36533.md): Klapp App JSON Web Token improper authentication (CVSS 3.7, Klapp App)
- [CVE-2020-36532](https://cve.now/CVE-2020-36532.md): Klapp App Authorization Credentials information disclosure (CVSS 4.3, Klapp App)
- [CVE-2020-36531](https://cve.now/CVE-2020-36531.md): SevOne Network Management System Device Manager Page injection (CVSS 6.3, SevOne Network Management System)
- [CVE-2020-36530](https://cve.now/CVE-2020-36530.md): SevOne Network Management System Alert Summary sql injection (CVSS 6.3, SevOne Network Management System)
- [CVE-2020-36529](https://cve.now/CVE-2020-36529.md): SevOne Network Management System Traceroute traceroute.php command injection (CVSS 8.8, SevOne Network Management System)
- [CVE-2021-42893](https://cve.now/CVE-2021-42893.md): In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can obtain sensitive information (wifikey, etc.) without authorization through getSysStatusCf (no CVSS)
- [CVE-2021-42892](https://cve.now/CVE-2021-42892.md): In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can start telnet without authorization because the default username and password exists in th (no CVSS)
- [CVE-2022-26493](https://cve.now/CVE-2022-26493.md): miniOrange SAML Authentication Bypass (CVSS 9.8, Xecuify Drupal 8 miniOrange SAML SP · Xecuify Drupal 9 m… +1)
- [CVE-2021-42891](https://cve.now/CVE-2021-42891.md): In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can obtain sensitive information (wifikey, etc.) without authorization. (no CVSS)
- [CVE-2021-42890](https://cve.now/CVE-2021-42890.md): TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function NTPSyncWithHost of the file system.so which can (no CVSS)
- [CVE-2020-36528](https://cve.now/CVE-2020-36528.md): Platinum Mobile MobileHandler.ashx access control (CVSS 5.5, Platinum Mobile)
- [CVE-2020-36527](https://cve.now/CVE-2020-36527.md): Server Status HTTP Status/SMTP Status cross site scripting (CVSS 3.5, Server Status)
- [CVE-2020-36526](https://cve.now/CVE-2020-36526.md): Countdown Timer Macro cross site scripting (CVSS 3.5, Countdown Timer)
- [CVE-2020-36525](https://cve.now/CVE-2020-36525.md): Linking New Windows Macro cross site scripting (CVSS 3.5, Linking)
- [CVE-2020-36524](https://cve.now/CVE-2020-36524.md): Refined Toolkit UI-Image/UI-Button cross site scripting (CVSS 3.5, Refined Toolkit)
- [CVE-2020-36523](https://cve.now/CVE-2020-36523.md): PlantUML Database Information Macro cross site scripting (CVSS 3.5, PlantUML)
- [CVE-2022-31028](https://cve.now/CVE-2022-31028.md): Possible DDOS by establishing keep-alive connections with anonymous HTTP clients in MinIO (CVSS 7.5, minio)
- [CVE-2022-31025](https://cve.now/CVE-2022-31025.md): Invite bypasses user approval in Discourse (CVSS 2.6, discourse)
- [CVE-2022-1991](https://cve.now/CVE-2022-1991.md): Fast Food Ordering System Master List Master.php cross site scripting (CVSS 3.5, Fast Food Ordering System)
- [CVE-2021-42889](https://cve.now/CVE-2021-42889.md): In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can obtain sensitive information (wifikey, wifiname, etc.) without authorization. (no CVSS)
- [CVE-2021-42888](https://cve.now/CVE-2021-42888.md): TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function setLanguageCfg of the file global.so which can (no CVSS)
- [CVE-2021-42887](https://cve.now/CVE-2021-42887.md): In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm. (no CVSS)
- [CVE-2021-42886](https://cve.now/CVE-2021-42886.md): TOTOLINK EX1200T V4.1.2cu.5215 contains an information disclosure vulnerability where an attacker can get the apmib configuration file witho (no CVSS)
- [CVE-2021-42885](https://cve.now/CVE-2021-42885.md): TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function setDeviceMac of the file global.so which can co (no CVSS)
- [CVE-2021-42884](https://cve.now/CVE-2021-42884.md): TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function setDeviceName of the file global.so which can c (no CVSS)
- [CVE-2022-1988](https://cve.now/CVE-2022-1988.md): Cross-site Scripting (XSS) - Generic in neorazorx/facturascripts (CVSS 6.5, neorazorx/facturascripts · facturascripts/facturascripts)
- [CVE-2022-1987](https://cve.now/CVE-2022-1987.md): Buffer Over-read in bfabiszewski/libmobi (CVSS 2.5, bfabiszewski/libmobi)
- [CVE-2022-32270](https://cve.now/CVE-2022-32270.md): In Real Player 20.0.7.309 and 20.0.8.310, external::Import() allows download of arbitrary file types and Directory Traversal, leading to Rem (no CVSS)
- [CVE-2022-32271](https://cve.now/CVE-2022-32271.md): In Real Player 20.0.8.310, there is a DCP:// URI Remote Arbitrary Code Execution Vulnerability. (no CVSS)
- [CVE-2022-32269](https://cve.now/CVE-2022-32269.md): In Real Player 20.0.8.310, the G2 Control allows injection of unsafe javascript: URIs in local HTTP error pages (displayed by Internet Explo (no CVSS)
- [CVE-2022-32268](https://cve.now/CVE-2022-32268.md): StarWind SAN and NAS v0.2 build 1914 allow remote code execution. (no CVSS)
- [CVE-2022-32265](https://cve.now/CVE-2022-32265.md): qDecoder before 12.1.0 does not ensure that the percent character is followed by two hex digits for URL decoding. (no CVSS)
- [CVE-2022-29767](https://cve.now/CVE-2022-29767.md): adbyby v2.7 allows external users to make connections via port 8118. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-06-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.