# CVEs published 2022-06-09

62 CVEs were published on June 9, 2022: 4 critical, 10 high. Days are UTC.

- [CVE-2017-20028](https://cve.now/CVE-2017-20028.md): HumHub privileges management (CVSS 5.6, HumHub)
- [CVE-2017-20027](https://cve.now/CVE-2017-20027.md): HumHub DOM cross site scriting (CVSS 4.3, HumHub)
- [CVE-2017-20026](https://cve.now/CVE-2017-20026.md): HumHub Reflected cross site scriting (CVSS 4.3, HumHub)
- [CVE-2017-20025](https://cve.now/CVE-2017-20025.md): Solare Solar-Log Flash Memory privileges management (CVSS 7.3, Solare Solar-Log)
- [CVE-2017-20024](https://cve.now/CVE-2017-20024.md): Solare Solar-Log denial of service (CVSS 5.3, Solare Solar-Log)
- [CVE-2017-20023](https://cve.now/CVE-2017-20023.md): Solare Solar-Log Network Config privileges management (CVSS 6.3, Solare Solar-Log)
- [CVE-2017-20022](https://cve.now/CVE-2017-20022.md): Solare Solar-Log information disclosure (CVSS 7.5, Solare Solar-Log)
- [CVE-2017-20021](https://cve.now/CVE-2017-20021.md): Solare Solar-Log File Upload privileges management (CVSS 6.5, Solare Solar-Log)
- [CVE-2017-20020](https://cve.now/CVE-2017-20020.md): Solare Solar-Log cross-site request forgery (CVSS 5.3, Solare Solar-Log)
- [CVE-2017-20019](https://cve.now/CVE-2017-20019.md): Solare Solar-Log Config information disclosure (CVSS 4.3, Solare Solar-Log)
- [CVE-2017-20018](https://cve.now/CVE-2017-20018.md): XAMPP Installer uncontrolled search path (CVSS 6.3, XAMPP)
- [CVE-2022-31045](https://cve.now/CVE-2022-31045.md): Ill-formed headers may lead to unexpected behavior in Istio (CVSS 7.0, istio · istio.io/istio)
- [CVE-2022-21499](https://cve.now/CVE-2022-21499.md): KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown. (CVSS 6.7, Oracle Linux · Oracle VM)
- [CVE-2022-30703](https://cve.now/CVE-2022-30703.md): Trend Micro Security 2021 and 2022 (Consumer) is vulnerable to an exposed dangerous method vulnerability that could allow an attacker to obt (no CVSS, Trend Micro Security)
- [CVE-2022-30702](https://cve.now/CVE-2022-30702.md): Trend Micro Security 2022 and 2021 (Consumer) is vulnerable to an Out-Of-Bounds Read Information Disclosure vulnerability that could allow a (no CVSS, Trend Micro Security)
- [CVE-2022-31051](https://cve.now/CVE-2022-31051.md): Exposure of Sensitive Information to an Unauthorized Actor in semantic-release (CVSS 4.4, semantic-release)
- [CVE-2022-31033](https://cve.now/CVE-2022-31033.md): Authorization header leak in rubygem Mechanize (CVSS 5.9, sparklemotion mechanize · mechanize)
- [CVE-2022-29250](https://cve.now/CVE-2022-29250.md): SQL injection in GLPI (CVSS 8.1, glpi-project glpi)
- [CVE-2022-29227](https://cve.now/CVE-2022-29227.md): Use after free in Envoy (CVSS 7.5, envoyproxy envoy)
- [CVE-2022-29226](https://cve.now/CVE-2022-29226.md): Trivial authentication bypass in Envoy (CVSS 10.0, envoyproxy envoy)
- [CVE-2022-29228](https://cve.now/CVE-2022-29228.md): Reachable assertion in Envoy (CVSS 7.5, envoyproxy envoy)
- [CVE-2022-29225](https://cve.now/CVE-2022-29225.md): Zip bomb vulnerability in Envoy (CVSS 7.5, envoyproxy envoy)
- [CVE-2022-29224](https://cve.now/CVE-2022-29224.md): Segmentation fault leading to crash in Envoy (CVSS 5.9, envoyproxy envoy)
- [CVE-2022-30898](https://cve.now/CVE-2022-30898.md): A Cross-site request forgery (CSRF) vulnerability in Cscms music portal system v4.2 allows remote attackers to change the administrator's us (no CVSS)
- [CVE-2022-24876](https://cve.now/CVE-2022-24876.md): Stored cross site scrpting in GLPI's Kanban (CVSS 5.4, glpi-project glpi)
- [CVE-2022-30760](https://cve.now/CVE-2022-30760.md): An Insecure Direct Object Reference (IDOR) issue in fn2Web in ihb eG FlexNow before 2.04.09.016 allows remote authenticated attackers to obt (no CVSS)
- [CVE-2022-1998](https://cve.now/CVE-2022-1998.md): A use after free in the Linux kernel File System notify functionality was found in the way user triggers copy\_info\_records\_to\_user() call to (no CVSS, Kernel)
- [CVE-2022-23138](https://cve.now/CVE-2022-23138.md): ZTE's MF297D product has cryptographic issues vulnerability. (no CVSS, MF297D)
- [CVE-2022-2035](https://cve.now/CVE-2022-2035.md): A reflected cross-site scripting (XSS) vulnerability exists in the playerConfUrl parameter in the /defaultui/player/modern.html file for SCO (no CVSS, Rustici Software SCORM Engine)
- [CVE-2022-31827](https://cve.now/CVE-2022-31827.md): MonstaFTP v2.10.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the function performFetchRequest at HTTPFetcher.php. (no CVSS)
- [CVE-2022-31830](https://cve.now/CVE-2022-31830.md): Kity Minder v1.3.5 was discovered to contain a Server-Side Request Forgery (SSRF) via the init function at ImageCapture.class.php. (no CVSS, kityminder)
- [CVE-2022-31393](https://cve.now/CVE-2022-31393.md): Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Index function in app/admin/c/PluginsCo (no CVSS)
- [CVE-2022-31390](https://cve.now/CVE-2022-31390.md): Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Update function in app/admin/c/Template (no CVSS)
- [CVE-2022-31386](https://cve.now/CVE-2022-31386.md): A Server-Side Request Forgery (SSRF) in the getFileBinary function of nbnbk cms 3 allows attackers to force the application to make arbitrar (no CVSS)
- [CVE-2019-25070](https://cve.now/CVE-2019-25070.md): WolfCMS User Add cross site scripting (CVSS 3.5, WolfCMS)
- [CVE-2019-25069](https://cve.now/CVE-2019-25069.md): Axios Italia Axios RE Error Message ASP.NET information disclosure (CVSS 5.3, Axios Italia Axios RE)
- [CVE-2019-25068](https://cve.now/CVE-2019-25068.md): Axios Italia Axios RE Connection REDefault.aspx privileges management (CVSS 6.3, Axios Italia Axios RE)
- [CVE-2019-25067](https://cve.now/CVE-2019-25067.md): Podman/Varlink API Privilege Escalation (CVSS 6.3, Podman · Varlink)
- [CVE-2019-25066](https://cve.now/CVE-2019-25066.md): ajenti API privileges management (CVSS 6.3, ajenti)
- [CVE-2019-25065](https://cve.now/CVE-2019-25065.md): OpenNetAdmin os command injection (CVSS 6.3, OpenNetAdmin)
- [CVE-2019-25064](https://cve.now/CVE-2019-25064.md): CoreHR Core Portal cross-site request forgery (CVSS 4.3, CoreHR Core Portal)
- [CVE-2021-40668](https://cve.now/CVE-2021-40668.md): The Android application HTTP File Server (Version 1.4.1) by 'slowscript' is affected by a path traversal vulnerability that permits arbitrar (no CVSS)
- [CVE-2022-26362](https://cve.now/CVE-2022-26362.md): x86 pv: Race condition in typeref acquisition Xen maintains a type reference count for pages, in addition to a regular reference count. (no CVSS, xen)
- [CVE-2022-26364](https://cve.now/CVE-2022-26364.md): x86 pv: Insufficient care with non-coherent mappings T\[his CNA information record relates to multiple CVEs; the text explains which aspects/ (no CVSS, xen)
- [CVE-2022-26363](https://cve.now/CVE-2022-26363.md): x86 pv: Insufficient care with non-coherent mappings T\[his CNA information record relates to multiple CVEs; the text explains which aspects/ (no CVSS, xen)
- [CVE-2021-40610](https://cve.now/CVE-2021-40610.md): Emlog Pro v 1.0.4 cross-site scripting (XSS) in Emlog Pro background management. (no CVSS)
- [CVE-2022-2037](https://cve.now/CVE-2022-2037.md): Excessive Attack Surface in tooljet/tooljet (CVSS 9.8, tooljet/tooljet)
- [CVE-2016-15002](https://cve.now/CVE-2016-15002.md): MONyog Ultimate Cookie privileges management (CVSS 7.3, MONyog Ultimate)
- [CVE-2022-2036](https://cve.now/CVE-2022-2036.md): Cross-site Scripting (XSS) - Stored in francoisjacquet/rosariosis (CVSS 9.0, francoisjacquet/rosariosis)
- [CVE-2022-1986](https://cve.now/CVE-2022-1986.md): OS Command Injection in gogs/gogs (CVSS 10.0, gogs/gogs · gogs.io/gogs)
- [CVE-2022-30075](https://cve.now/CVE-2022-30075.md): In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to remote code execution due (no CVSS)
- [CVE-2022-31649](https://cve.now/CVE-2022-31649.md): ownCloud owncloud/core before 10.10.0 Improperly Removes Sensitive Information Before Storage or Transfer. (no CVSS)
- [CVE-2022-25804](https://cve.now/CVE-2022-25804.md): An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. (no CVSS)
- [CVE-2022-25805](https://cve.now/CVE-2022-25805.md): An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. (no CVSS)
- [CVE-2022-25806](https://cve.now/CVE-2022-25806.md): An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. (no CVSS)
- [CVE-2022-25807](https://cve.now/CVE-2022-25807.md): An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. (no CVSS)
- [CVE-2022-32195](https://cve.now/CVE-2022-32195.md): Open edX platform before 2022-06-06 allows XSS via the "next" parameter in the logout URL. (no CVSS)
- [CVE-2021-40961](https://cve.now/CVE-2021-40961.md): CMS Made Simple \<=2.2.15 is affected by SQL injection in modules/News/function.admin\_articlestab.php. (no CVSS)
- [CVE-2022-31042](https://cve.now/CVE-2022-31042.md): Failure to strip the Cookie header on change in host or HTTP downgrade in Guzzle (CVSS 7.5, guzzle · guzzlehttp/guzzle +1)
- [CVE-2022-31043](https://cve.now/CVE-2022-31043.md): Fix failure to strip Authorization header on HTTP downgrade in Guzzle (CVSS 7.5, guzzle · guzzlehttp/guzzle +1)
- [CVE-2022-31214](https://cve.now/CVE-2022-31214.md): A Privilege Context Switching issue was discovered in join.c in Firejail 0.9.68. (no CVSS)
- [CVE-2022-32272](https://cve.now/CVE-2022-32272.md): OPSWAT MetaDefender Core before 5.1.2, MetaDefender ICAP before 4.12.1, and MetaDefender Email Gateway Security before 5.6.1 have incorrect (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-06-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.