# CVEs published 2022-06-07

64 CVEs were published on June 7, 2022: 2 critical, 7 high. Days are UTC.

- [CVE-2021-35530](https://cve.now/CVE-2021-35530.md): User authentication bypass in TXpert Hub CoreTec 4 (CVSS 6.0, Hitachi Energy TXpert Hub CoreTec 4 version)
- [CVE-2022-30466](https://cve.now/CVE-2022-30466.md): joyebike Joy ebike Wolf Manufacturing year 2022 is vulnerable to Authentication Bypass by Capture-replay. (no CVSS)
- [CVE-2022-29620](https://cve.now/CVE-2022-29620.md): FileZilla v3.59.0 allows attackers to obtain cleartext passwords of connected SSH or FTP servers via a memory dump.- NOTE: the vendor does n (no CVSS)
- [CVE-2021-35531](https://cve.now/CVE-2021-35531.md): Remote Code Execution in TXpert Hub CoreTec 4 (no CVSS, Hitachi Energy TXpert Hub CoreTec 4 version)
- [CVE-2021-35532](https://cve.now/CVE-2021-35532.md): Firmware upload verification bypass in TXpert Hub CoreTec 4 (no CVSS, Hitachi Energy TXpert Hub CoreTec 4 version)
- [CVE-2022-30749](https://cve.now/CVE-2022-30749.md): Improper access control vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to add arbitrary smart devices by bypassing (CVSS 3.3, Samsung Mobile Smart Things)
- [CVE-2022-30748](https://cve.now/CVE-2022-30748.md): Unprotected dynamic receiver in Samsung Members prior to version 4.2.005 allows attacker to launch arbitrary activity. (CVSS 4.0, Samsung Mobile Samsung Members)
- [CVE-2022-30747](https://cve.now/CVE-2022-30747.md): PendingIntent hijacking vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to access files without permission via impli (CVSS 5.5, Samsung Mobile Smart Things)
- [CVE-2022-30746](https://cve.now/CVE-2022-30746.md): Missing caller check in Smart Things prior to version 1.7.85.12 allows attacker to access senstive information remotely using javascript int (CVSS 7.5, Samsung Mobile Smart Things)
- [CVE-2022-30745](https://cve.now/CVE-2022-30745.md): Improper access control vulnerability in Quick Share prior to version 13.1.2.4 allows attacker to access internal files in Quick Share. (CVSS 4.0, Samsung Mobile Quick Share)
- [CVE-2022-30744](https://cve.now/CVE-2022-30744.md): DLL hijacking vulnerability in KiesWrapper in Samsung Kies prior to version 2.6.4.22043\_1 allows attacker to execute arbitrary code. (CVSS 6.2, Samsung Mobile Samsung Kies)
- [CVE-2022-30743](https://cve.now/CVE-2022-30743.md): Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the data of contact and gallery wi (CVSS 5.3, Samsung Mobile Samsung Account)
- [CVE-2022-30742](https://cve.now/CVE-2022-30742.md): Sensitive information exposure vulnerability in FmmExtraOperation of Find My Mobile prior to 7.2.24.12 allows local attackers with log acces (CVSS 3.3, Samsung Mobile Find My Mobile)
- [CVE-2022-30741](https://cve.now/CVE-2022-30741.md): Sensitive information exposure vulnerability in SimChangeAlertManger of Find My Mobile prior to 7.2.24.12 allows local attackers with log ac (CVSS 3.3, Samsung Mobile Find My Mobile)
- [CVE-2022-30740](https://cve.now/CVE-2022-30740.md): Improper auto-fill algorithm in Samsung Internet prior to version 17.0.1.69 allows physical attackers to guess stored credit card numbers. (CVSS 4.1, Samsung Mobile Samsung Internet)
- [CVE-2022-30739](https://cve.now/CVE-2022-30739.md): Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get an user email or phone number with (CVSS 4.0, Samsung Mobile Samsung Account)
- [CVE-2022-30738](https://cve.now/CVE-2022-30738.md): Improper check in Loader in Samsung Internet prior to 17.0.1.69 allows attackers to spoof address bar via executing script. (CVSS 4.3, Samsung Mobile Samsung Internet)
- [CVE-2022-30737](https://cve.now/CVE-2022-30737.md): Implicit Intent hijacking vulnerability in Samsung Account prior to version 13.2.00.6 allows attackers to get email ID. (CVSS 4.0, Samsung Mobile Samsung Account)
- [CVE-2022-30736](https://cve.now/CVE-2022-30736.md): Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the data of contact and gallery wi (CVSS 5.3, Samsung Mobile Samsung Account)
- [CVE-2022-30735](https://cve.now/CVE-2022-30735.md): Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the access\_token without permissio (CVSS 5.9, Samsung Mobile Samsung Account)
- [CVE-2022-30734](https://cve.now/CVE-2022-30734.md): Sensitive information exposure in Sign-out log in Samsung Account prior to version 13.2.00.6 allows attackers to get an user email or phone (CVSS 4.0, Samsung Mobile Samsung Account)
- [CVE-2022-30733](https://cve.now/CVE-2022-30733.md): Sensitive information exposure in Sign-in log in Samsung Account prior to version 13.2.00.6 allows attackers to get an user email or phone n (CVSS 4.0, Samsung Mobile Samsung Account)
- [CVE-2022-30732](https://cve.now/CVE-2022-30732.md): Exposure of Sensitive Information vulnerability in Samsung Account prior to version 13.2.00.6 allows attacker to access sensitive informatio (CVSS 5.5, Samsung Mobile Samsung Account)
- [CVE-2022-30731](https://cve.now/CVE-2022-30731.md): Improper access control vulnerability in My Files prior to version 13.1.00.193 allows attackers to access arbitrary private files in My File (CVSS 5.1, Samsung Mobile My Files)
- [CVE-2022-30730](https://cve.now/CVE-2022-30730.md): Improper authorization in Samsung Pass prior to 1.0.00.33 allows physical attackers to acess account list without authentication. (CVSS 4.6, Samsung Mobile Samsung Pass)
- [CVE-2022-30728](https://cve.now/CVE-2022-30728.md): Information exposure vulnerability in ScanPool prior to SMR Jun-2022 Release 1 allows local attackers to get MAC address information. (CVSS 1.9, Samsung Mobile Devices)
- [CVE-2022-30727](https://cve.now/CVE-2022-30727.md): Improper handling of insufficient permissions vulnerability in addAppPackageNameToAllowList in PersonaManagerService prior to SMR Jun-2022 R (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2022-30726](https://cve.now/CVE-2022-30726.md): Unprotected component vulnerability in DeviceSearchTrampoline in SecSettingsIntelligence prior to SMR Jun-2022 Release 1 allows local attack (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2022-30725](https://cve.now/CVE-2022-30725.md): Broadcasting Intent including the BluetoothDevice object without proper restriction of receivers in sendIntentSessionError function of Bluet (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2022-30724](https://cve.now/CVE-2022-30724.md): Broadcasting Intent including the BluetoothDevice object without proper restriction of receivers in sendIntentSessionCompleted function of B (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2022-30723](https://cve.now/CVE-2022-30723.md): Broadcasting Intent including the BluetoothDevice object without proper restriction of receivers in activateVoiceRecognitionWithDevice funct (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2022-30722](https://cve.now/CVE-2022-30722.md): Implicit Intent hijacking vulnerability in Samsung Account prior to SMR Jun-2022 Release 1 allows attackers to bypass user confirmation of S (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2022-30729](https://cve.now/CVE-2022-30729.md): Implicit Intent hijacking vulnerability in Settings prior to SMR Jun-2022 Release 1 allows attackers to get Wi-Fi SSID and password via a ma (CVSS 3.3, Samsung Mobile Devices)
- [CVE-2022-30721](https://cve.now/CVE-2022-30721.md): Improper input validation check logic vulnerability in libsmkvextractor prior to SMR Jun-2022 Release 1 allows attackers to trigger crash. (CVSS 2.5, Samsung Mobile Devices)
- [CVE-2022-30720](https://cve.now/CVE-2022-30720.md): Improper input validation check logic vulnerability in libsmkvextractor prior to SMR Jun-2022 Release 1 allows attackers to trigger crash. (CVSS 2.5, Samsung Mobile Devices)
- [CVE-2022-30719](https://cve.now/CVE-2022-30719.md): Improper input validation check logic vulnerability in libsmkvextractor prior to SMR Jun-2022 Release 1 allows attackers to trigger crash. (CVSS 2.5, Samsung Mobile Devices)
- [CVE-2019-9972](https://cve.now/CVE-2019-9972.md): PhoneSystem Terminal in 3CX Phone System (Debian based installation) 16.0.0.1570 allows an authenticated attacker to run arbitrary commands (no CVSS)
- [CVE-2019-9971](https://cve.now/CVE-2019-9971.md): PhoneSystem Terminal in 3CX Phone System (Debian based installation) 16.0.0.1570 allows an attacker to gain root privileges by using sudo wi (no CVSS)
- [CVE-2022-30717](https://cve.now/CVE-2022-30717.md): Improper caller check in AR Emoji prior to SMR Jun-2022 Release 1 allows untrusted applications to use some camera functions via deeplink. (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2022-30716](https://cve.now/CVE-2022-30716.md): Unprotected broadcast in sendIntentForToastDumpLog in DisplayToast prior to SMR Jun-2022 Release 1 allows untrusted applications to access t (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2022-30715](https://cve.now/CVE-2022-30715.md): Improper access control vulnerability in DofViewer prior to SMR Jun-2022 Release 1 allows attackers to control floating system alert window. (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2022-30714](https://cve.now/CVE-2022-30714.md): Information exposure vulnerability in SemIWCMonitor prior to SMR Jun-2022 Release 1 allows local attackers to get MAC address information. (CVSS 1.9, Samsung Mobile Devices)
- [CVE-2022-30713](https://cve.now/CVE-2022-30713.md): Improper validation vulnerability in LSOItemData prior to SMR Jun-2022 Release 1 allows attackers to launch certain activities. (CVSS 8.5, Samsung Mobile Devices)
- [CVE-2022-30712](https://cve.now/CVE-2022-30712.md): Improper validation vulnerability in KfaOptions prior to SMR Jun-2022 Release 1 allows attackers to launch certain activities. (CVSS 8.5, Samsung Mobile Devices)
- [CVE-2022-30711](https://cve.now/CVE-2022-30711.md): Improper validation vulnerability in FeedsInfo prior to SMR Jun-2022 Release 1 allows attackers to launch certain activities. (CVSS 8.5, Samsung Mobile Devices)
- [CVE-2022-30710](https://cve.now/CVE-2022-30710.md): Improper validation vulnerability in RemoteViews prior to SMR Jun-2022 Release 1 allows attackers to launch certain activities. (CVSS 8.5, Samsung Mobile Devices)
- [CVE-2022-30709](https://cve.now/CVE-2022-30709.md): Improper input validation check logic vulnerability in SECRIL prior to SMR Jun-2022 Release 1 allows attackers to trigger crash. (CVSS 2.5, Samsung Mobile Devices)
- [CVE-2022-28794](https://cve.now/CVE-2022-28794.md): Sensitive information exposure in low-battery dumpstate log prior to SMR Jun-2022 Release 1 allows local attackers to get SIM card informati (CVSS 2.2, Samsung Mobile Devices)
- [CVE-2021-27786](https://cve.now/CVE-2021-27786.md): HCL OneTest Server is vulnerable to Cross Origin Resource Sharing: Arbitrary Origin Trusted (CVSS 4.6, HCL Software HCL OneTest Server)
- [CVE-2022-2022](https://cve.now/CVE-2022-2022.md): Cross-site Scripting (XSS) - Stored in nocodb/nocodb (CVSS 9.0, nocodb/nocodb)
- [CVE-2022-1708](https://cve.now/CVE-2022-1708.md): A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. (no CVSS, CRI-O · github.com/cri-o/cri-o)
- [CVE-2022-31495](https://cve.now/CVE-2022-31495.md): LibreHealth EHR Base 2.0.0 allows gacl/admin/acl\_admin.php return\_page XSS. (no CVSS)
- [CVE-2021-37589](https://cve.now/CVE-2021-37589.md): Virtua Cobranca before 12R allows SQL Injection on the login page. (no CVSS)
- [CVE-2022-25361](https://cve.now/CVE-2022-25361.md): WatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to delete arbitrary files from a limited set of directories o (no CVSS)
- [CVE-2022-29564](https://cve.now/CVE-2022-29564.md): Jamf Private Access before 2022-05-16 has Incorrect Access Control, in which an unauthorized user can reach a system in the internal infrast (no CVSS)
- [CVE-2022-2020](https://cve.now/CVE-2022-2020.md): SourceCodester Prison Management System System Name cross site scripting (CVSS 2.4, SourceCodester Prison Management System)
- [CVE-2022-2019](https://cve.now/CVE-2022-2019.md): SourceCodester Prison Management System New User Creation improper authorization (CVSS 7.3, SourceCodester Prison Management System)
- [CVE-2022-2018](https://cve.now/CVE-2022-2018.md): SourceCodester Prison Management System Inmate sql injection (CVSS 4.7, SourceCodester Prison Management System)
- [CVE-2022-2017](https://cve.now/CVE-2022-2017.md): SourceCodester Prison Management System Visit view\_visit.php sql injection (CVSS 4.7, SourceCodester Prison Management System)
- [CVE-2022-2016](https://cve.now/CVE-2022-2016.md): Cross-site Scripting (XSS) - Reflected in neorazorx/facturascripts (CVSS 6.8, neorazorx/facturascripts · facturascripts/facturascripts)
- [CVE-2022-0823](https://cve.now/CVE-2022-0823.md): An improper control of interaction frequency vulnerability in Zyxel GS1200 series switches could allow a local attacker to guess the passwor (CVSS 6.2, Zyxel GS1200 series firmware)
- [CVE-2022-2000](https://cve.now/CVE-2022-2000.md): Out-of-bounds Write in vim/vim (CVSS 7.8, vim/vim)
- [CVE-2022-31031](https://cve.now/CVE-2022-31031.md): Potential stack buffer overflow when parsing message as a STUN client (CVSS 9.8, pjsip pjproject)
- [CVE-2022-31470](https://cve.now/CVE-2022-31470.md): An XSS vulnerability in the index\_mobile\_changepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12 and 10.3.x before 1 (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-06-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.