# CVEs published 2022-06-08

61 CVEs were published on June 8, 2022: 4 critical, 7 high. Days are UTC.

- [CVE-2022-31496](https://cve.now/CVE-2022-31496.md): LibreHealth EHR Base 2.0.0 allows incorrect interface/super/manage\_site\_files.php access. (no CVSS)
- [CVE-2022-29014](https://cve.now/CVE-2022-29014.md): A local file inclusion vulnerability in Razer Sila Gaming Router v2.0.441\_api-2.0.418 allows attackers to read arbitrary files. (no CVSS)
- [CVE-2022-29013](https://cve.now/CVE-2022-29013.md): A command injection in the command parameter of Razer Sila Gaming Router v2.0.441\_api-2.0.418 allows attackers to execute arbitrary commands (no CVSS)
- [CVE-2022-31313](https://cve.now/CVE-2022-31313.md): api-res-py package in PyPI 0.1 is vulnerable to a code execution backdoor in the request package. (no CVSS, api-res-py)
- [CVE-2022-30882](https://cve.now/CVE-2022-30882.md): pyanxdns package in PyPI version 0.2 is vulnerable to code execution backdoor. (no CVSS)
- [CVE-2021-40589](https://cve.now/CVE-2021-40589.md): ZAngband zangband-data 2.7.5 is affected by an integer underflow vulnerability in src/tk/plat.c through the variable fileheader.bfOffBits. (no CVSS)
- [CVE-2022-31038](https://cve.now/CVE-2022-31038.md): XSS vulnerability in repository issue list in Gogs (CVSS 5.4, gogs · gogs.io/gogs)
- [CVE-2022-30877](https://cve.now/CVE-2022-30877.md): The keep for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party. (no CVSS, keep)
- [CVE-2022-30875](https://cve.now/CVE-2022-30875.md): Dolibarr 12.0.5 is vulnerable to Cross Site Scripting (XSS) via Sql Error Page. (no CVSS, dolibarr/dolibarr)
- [CVE-2022-31325](https://cve.now/CVE-2022-31325.md): There is a SQL Injection vulnerability in ChurchCRM 4.4.5 via the 'PersonID' field in /churchcrm/WhyCameEditor.php. (no CVSS)
- [CVE-2022-30899](https://cve.now/CVE-2022-30899.md): A Cross Site Scripting vulnerabilty exists in PartKeepr 1.4.0 via the 'name' field in /api/part\_categories. (no CVSS)
- [CVE-2022-28385](https://cve.now/CVE-2022-28385.md): An issue was discovered in certain Verbatim drives through 2022-03-31. (no CVSS)
- [CVE-2022-28387](https://cve.now/CVE-2022-28387.md): An issue was discovered in certain Verbatim drives through 2022-03-31. (no CVSS)
- [CVE-2022-32273](https://cve.now/CVE-2022-32273.md): As a result of an observable discrepancy in returned messages, OPSWAT MetaDefender Core (MDCore) before 5.1.2 could allow an authenticated u (no CVSS)
- [CVE-2021-36710](https://cve.now/CVE-2021-36710.md): ToaruOS 1.99.2 is affected by incorrect access control via the kernel. (no CVSS)
- [CVE-2020-14125](https://cve.now/CVE-2020-14125.md): A denial of service vulnerability exists in some Xiaomi models of phones. (no CVSS, Redmi Note 11 ,Redmi Note)
- [CVE-2022-24296](https://cve.now/CVE-2022-24296.md): Use of a Broken or Risky Cryptographic Algorithm vulnerability in Air Conditioning System G-150AD Ver. (no CVSS, Air Conditioning System G-150AD; Air Conditioning System AG…)
- [CVE-2022-1993](https://cve.now/CVE-2022-1993.md): Path Traversal in gogs/gogs (CVSS 8.1, gogs/gogs · gogs.io/gogs)
- [CVE-2022-1992](https://cve.now/CVE-2022-1992.md): Path Traversal in gogs/gogs (CVSS 10.0, gogs/gogs · gogs.io/gogs)
- [CVE-2022-30926](https://cve.now/CVE-2022-30926.md): H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the EditMacList parameter at /goform/aspForm. (no CVSS)
- [CVE-2022-30925](https://cve.now/CVE-2022-30925.md): H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the AddMacList parameter at /goform/aspForm. (no CVSS)
- [CVE-2022-30924](https://cve.now/CVE-2022-30924.md): H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the SetAPWifiorLedInfoById parameter at /goform/asp (no CVSS)
- [CVE-2022-30922](https://cve.now/CVE-2022-30922.md): H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the EditWlanMacList parameter at /goform/aspForm. (no CVSS)
- [CVE-2022-30923](https://cve.now/CVE-2022-30923.md): H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Asp\_SetTimingtimeWifiAndLed parameter at /gofor (no CVSS)
- [CVE-2022-30921](https://cve.now/CVE-2022-30921.md): H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the SetMobileAPInfoById parameter at /goform/aspFor (no CVSS)
- [CVE-2022-30920](https://cve.now/CVE-2022-30920.md): H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Edit\_BasicSSID parameter at /goform/aspForm. (no CVSS)
- [CVE-2022-30918](https://cve.now/CVE-2022-30918.md): H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Asp\_SetTelnet parameter at /goform/aspForm. (no CVSS)
- [CVE-2022-30919](https://cve.now/CVE-2022-30919.md): H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Edit\_BasicSSID\_5G parameter at /goform/aspForm. (no CVSS)
- [CVE-2022-30917](https://cve.now/CVE-2022-30917.md): H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the AddWlanMacList parameter at /goform/aspForm. (no CVSS)
- [CVE-2022-30916](https://cve.now/CVE-2022-30916.md): H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Asp\_SetTelnetDebug parameter at /goform/aspForm (no CVSS)
- [CVE-2022-30914](https://cve.now/CVE-2022-30914.md): H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the UpdateMacClone parameter at /goform/aspForm. (no CVSS)
- [CVE-2022-30915](https://cve.now/CVE-2022-30915.md): H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the UpdateSnat parameter at /goform/aspForm. (no CVSS)
- [CVE-2022-30913](https://cve.now/CVE-2022-30913.md): H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the ipqos\_set\_bandwidth parameter at /goform/aspFor (no CVSS)
- [CVE-2022-30912](https://cve.now/CVE-2022-30912.md): H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the UpdateWanParams parameter at /goform/aspForm. (no CVSS)
- [CVE-2022-30910](https://cve.now/CVE-2022-30910.md): H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the GO parameter at /goform/aspForm. (no CVSS)
- [CVE-2022-30909](https://cve.now/CVE-2022-30909.md): H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the CMD parameter at /goform/aspForm. (no CVSS)
- [CVE-2022-30552](https://cve.now/CVE-2022-30552.md): Das U-Boot 2022.01 has a Buffer Overflow. (no CVSS)
- [CVE-2022-30790](https://cve.now/CVE-2022-30790.md): Das U-Boot 2022.01 has a Buffer Overflow, a different issue than CVE-2022-30552. (no CVSS)
- [CVE-2022-31497](https://cve.now/CVE-2022-31497.md): LibreHealth EHR Base 2.0.0 allows interface/main/finder/finder\_navigation.php patient XSS. (no CVSS)
- [CVE-2022-31813](https://cve.now/CVE-2022-31813.md): mod\_proxy X-Forwarded-For dropped by hop-by-hop mechanism (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2022-30556](https://cve.now/CVE-2022-30556.md): Information Disclosure in mod\_lua with websockets (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2022-30522](https://cve.now/CVE-2022-30522.md): mod\_sed denial of service (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2022-29404](https://cve.now/CVE-2022-29404.md): Denial of service in mod\_lua r:parsebody (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2022-28615](https://cve.now/CVE-2022-28615.md): Read beyond bounds in ap\_strcmp\_match() (CVSS 9.1, Apache Software Foundation Apache HTTP Server)
- [CVE-2022-28614](https://cve.now/CVE-2022-28614.md): read beyond bounds via ap\_rwrite() (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2022-28330](https://cve.now/CVE-2022-28330.md): read beyond bounds in mod\_isapi (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2022-26377](https://cve.now/CVE-2022-26377.md): mod\_proxy\_ajp: Possible request smuggling (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2022-2026](https://cve.now/CVE-2022-2026.md): Cross-site Scripting (XSS) - Stored in kromitgmbh/titra (CVSS 8.2, kromitgmbh/titra)
- [CVE-2022-2027](https://cve.now/CVE-2022-2027.md): Improper Neutralization of Formula Elements in a CSV File in kromitgmbh/titra (CVSS 8.0, kromitgmbh/titra)
- [CVE-2022-2028](https://cve.now/CVE-2022-2028.md): Cross-site Scripting (XSS) - Generic in kromitgmbh/titra (CVSS 8.2, kromitgmbh/titra)
- [CVE-2022-2029](https://cve.now/CVE-2022-2029.md): Cross-site Scripting (XSS) - DOM in kromitgmbh/titra (CVSS 8.2, kromitgmbh/titra)
- [CVE-2022-2015](https://cve.now/CVE-2022-2015.md): Cross-site Scripting (XSS) - Stored in jgraph/drawio (CVSS 6.1, jgraph/drawio)
- [CVE-2022-2014](https://cve.now/CVE-2022-2014.md): Code Injection in jgraph/drawio (CVSS 9.6, jgraph/drawio)
- [CVE-2021-40592](https://cve.now/CVE-2021-40592.md): GPAC version before commit 71460d72ec07df766dab0a4d52687529f3efcf0a (version v1.0.1 onwards) contains loop with unreachable exit condition ( (no CVSS)
- [CVE-2022-25151](https://cve.now/CVE-2022-25151.md): ITarian - Session cookie not protected by HttpOnly flag (CVSS 7.5, ITarian SaaS platform / on-premise)
- [CVE-2022-25152](https://cve.now/CVE-2022-25152.md): ITarian - Any user with a valid session token can create and execute agent procedures and bypass mandatory approvals (CVSS 9.9, ITarian platform)
- [CVE-2022-25153](https://cve.now/CVE-2022-25153.md): ITarian - Local privilege escalation in Endpoint Manager agent on Windows (CVSS 7.8, ITarian Endpoint Manager Communication Client for Windows)
- [CVE-2022-28382](https://cve.now/CVE-2022-28382.md): An issue was discovered in certain Verbatim drives through 2022-03-31. (no CVSS)
- [CVE-2022-28383](https://cve.now/CVE-2022-28383.md): An issue was discovered in certain Verbatim drives through 2022-03-31. (no CVSS)
- [CVE-2022-28384](https://cve.now/CVE-2022-28384.md): An issue was discovered in certain Verbatim drives through 2022-03-31. (no CVSS)
- [CVE-2022-28386](https://cve.now/CVE-2022-28386.md): An issue was discovered in certain Verbatim drives through 2022-03-31. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-06-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.