# CVEs published 2022-06-14

198 CVEs were published on June 14, 2022: 11 critical, 53 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2022-32243](https://cve.now/CVE-2022-32243.md): When a user opens manipulated Scalable Vector Graphics (.svg, svg.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Vie (no CVSS, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2022-32242](https://cve.now/CVE-2022-32242.md): When a user opens manipulated Radiance Picture (.hdr, hdr.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the (no CVSS, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2022-32241](https://cve.now/CVE-2022-32241.md): When a user opens manipulated Portable Document Format (.pdf, PDFView.x3d) files received from untrusted sources in SAP 3D Visual Enterprise (no CVSS, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2022-32240](https://cve.now/CVE-2022-32240.md): When a user opens manipulated Jupiter Tesselation (.jt, JTReader.x3d) files received from untrusted sources in SAP 3D Visual Enterprise View (no CVSS, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2022-31066](https://cve.now/CVE-2022-31066.md): Configuration API in EdgeXFoundry exposes message bus credentials to local unauthenticated users (CVSS 5.9, edgexfoundry edgex-go · github.com/edgexfoundry/app-func… +3)
- [CVE-2022-32230](https://cve.now/CVE-2022-32230.md): SMBv3 FileNormalizedNameInformation NULL Pointer Dereference (CVSS 7.5, Microsoft Windows)
- [CVE-2022-31050](https://cve.now/CVE-2022-31050.md): Insufficient Session Expiration in TYPO3 Admin Tool (CVSS 6.0, typo3 · typo3/cms-core +1)
- [CVE-2022-31048](https://cve.now/CVE-2022-31048.md): Cross-Site Scripting in Form Framework (CVSS 5.4, typo3 · typo3/cms-core +1)
- [CVE-2022-31049](https://cve.now/CVE-2022-31049.md): Cross-Site Scripting in Frontend Login Mailer (CVSS 5.4, typo3 · typo3/cms-core +1)
- [CVE-2022-31046](https://cve.now/CVE-2022-31046.md): Information Disclosure via Export Module in TYPO3 CMS (CVSS 4.3, typo3 · typo3/cms-core +1)
- [CVE-2022-29241](https://cve.now/CVE-2022-29241.md): Known or guessable hidden files may be accessed in Jupyter Server (CVSS 7.1, jupyter-server jupyter\_server · jupyter-server)
- [CVE-2022-31047](https://cve.now/CVE-2022-31047.md): Insertion of Sensitive Information into Log File in typo3/cms-core (CVSS 5.3, typo3 · typo3/cms-core +1)
- [CVE-2022-32353](https://cve.now/CVE-2022-32353.md): Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/categories/manage\_field\_order.php?id=. (no CVSS)
- [CVE-2022-32354](https://cve.now/CVE-2022-32354.md): Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/?page=user/manage\_user&id=. (no CVSS)
- [CVE-2022-32355](https://cve.now/CVE-2022-32355.md): Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/?page=products/view\_product&id=. (no CVSS)
- [CVE-2022-32358](https://cve.now/CVE-2022-32358.md): Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/classes/Master.php?f=delete\_inquiry. (no CVSS)
- [CVE-2022-32359](https://cve.now/CVE-2022-32359.md): Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/classes/Master.php?f=delete\_category. (no CVSS)
- [CVE-2022-31060](https://cve.now/CVE-2022-31060.md): Banner topic data is exposed on login-required Discourse sites (CVSS 5.3, discourse)
- [CVE-2022-32362](https://cve.now/CVE-2022-32362.md): Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/categories/manage\_category.php?id=. (no CVSS)
- [CVE-2022-32363](https://cve.now/CVE-2022-32363.md): Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/categories/view\_category.php?id=. (no CVSS)
- [CVE-2022-31059](https://cve.now/CVE-2022-31059.md): Discourse Calendar Event names susceptible to Cross-site Scripting (CVSS 6.5, discourse-calendar)
- [CVE-2022-32239](https://cve.now/CVE-2022-32239.md): When a user opens manipulated JPEG 2000 (.jp2, jp2k.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the appli (no CVSS, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2022-32238](https://cve.now/CVE-2022-32238.md): When a user opens manipulated Encapsulated Post Script (.eps, ai.x3d) files received from untrusted sources in SAP 3D Visual Enterprise View (no CVSS, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2022-32237](https://cve.now/CVE-2022-32237.md): When a user opens manipulated Computer Graphics Metafile (.cgm, CgmCore.dll) files received from untrusted sources in SAP 3D Visual Enterpri (no CVSS, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2022-32236](https://cve.now/CVE-2022-32236.md): When a user opens manipulated Windows Bitmap (.bmp, 2d.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the ap (no CVSS, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2022-32235](https://cve.now/CVE-2022-32235.md): When a user opens manipulated AutoCAD (.dwg, TeighaTranslator.exe) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, (no CVSS, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2022-31595](https://cve.now/CVE-2022-31595.md): SAP Financial Consolidation - version 1010,�does not perform necessary authorization checks for an authenticated user, resulting in escalati (no CVSS, SAP SE SAP Financial Consolidation)
- [CVE-2022-31594](https://cve.now/CVE-2022-31594.md): A highly privileged user can exploit SUID-root program to escalate his privileges to root on a local Unix system. (no CVSS, SAP SE SAP Adaptive Server Enterprise)
- [CVE-2022-31590](https://cve.now/CVE-2022-31590.md): SAP PowerDesigner Proxy - version 16.7, allows an attacker with low privileges and has local access, with the ability to work around system’ (no CVSS, SAP SE SAP PowerDesigner Proxy)
- [CVE-2022-31589](https://cve.now/CVE-2022-31589.md): Due to improper authorization check, business users who are using Israeli File from SHAAM program (/ATL/VQ23 transaction), are granted more (no CVSS, SAP SE SAP ERP, localization for CEE countries. · SAP SE… +1)
- [CVE-2022-29618](https://cve.now/CVE-2022-29618.md): Due to insufficient input validation, SAP NetWeaver Development Infrastructure (Design Time Repository) - versions 7.30, 7.31, 7.40, 7.50, a (no CVSS, SAP SE SAP NetWeaver Development Infrastructure)
- [CVE-2022-29615](https://cve.now/CVE-2022-29615.md): SAP NetWeaver Developer Studio (NWDS) - version 7.50, is based on Eclipse, which contains the logging framework log4j in version 1.x. (no CVSS, SAP SE SAP NetWeaver Developer Studio)
- [CVE-2022-29614](https://cve.now/CVE-2022-29614.md): SAP startservice - of SAP NetWeaver Application Server ABAP, Application Server Java, ABAP Platform and HANA Database - versions KERNEL 7.22 (no CVSS, SAP SE SAP NetWeaver AS ABAP, AS Java, ABAP Platform and HA…)
- [CVE-2022-29238](https://cve.now/CVE-2022-29238.md): Forced Browsing in Jupyter Notebook (CVSS 4.3, jupyter notebook · notebook)
- [CVE-2022-21504](https://cve.now/CVE-2022-21504.md): The code in UEK6 U3 was missing an appropiate file descriptor count to be missing. (CVSS 5.5, Oracle Linux)
- [CVE-2022-32364](https://cve.now/CVE-2022-32364.md): Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/?page=products/manage\_product&id=. (no CVSS)
- [CVE-2022-32365](https://cve.now/CVE-2022-32365.md): Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/fields/manage\_field.php?id=. (no CVSS)
- [CVE-2022-32366](https://cve.now/CVE-2022-32366.md): Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/fields/view\_field.php?id=. (no CVSS)
- [CVE-2022-32367](https://cve.now/CVE-2022-32367.md): Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/?page=inquiries/view\_inquiry&id=. (no CVSS)
- [CVE-2022-30903](https://cve.now/CVE-2022-30903.md): Nokia "G-2425G-A" Bharti Airtel Routers Hardware version "3FE48299DEAA" Software Version "3FE49362IJHK42" is vulnerable to Cross-Site Script (no CVSS)
- [CVE-2022-29612](https://cve.now/CVE-2022-29612.md): SAP NetWeaver, ABAP Platform and SAP Host Agent - versions KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, 7.88, 8.04, KRNL64NUC 7.22 (no CVSS, SAP SE SAP NetWeaver, ABAP Platform and SAP Host Agent)
- [CVE-2022-27668](https://cve.now/CVE-2022-27668.md): Depending on the configuration of the route permission table in file 'saprouttab', it is possible for an unauthenticated attacker to execute (no CVSS, SAP SE SAP NetWeaver and ABAP Platform)
- [CVE-2022-32559](https://cve.now/CVE-2022-32559.md): An issue was discovered in Couchbase Server before 7.0.4. (no CVSS)
- [CVE-2022-32557](https://cve.now/CVE-2022-32557.md): An issue was discovered in Couchbase Server before 7.0.4. (no CVSS)
- [CVE-2022-32561](https://cve.now/CVE-2022-32561.md): An issue was discovered in Couchbase Server before 6.6.5 and 7.x before 7.0.4. (no CVSS)
- [CVE-2021-42675](https://cve.now/CVE-2021-42675.md): Kreado Kreasfero 1.5 does not properly sanitize uploaded files to the media directory. (no CVSS)
- [CVE-2022-31403](https://cve.now/CVE-2022-31403.md): ITOP v3.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via /itop/pages/ajax.render.php. (no CVSS)
- [CVE-2022-30930](https://cve.now/CVE-2022-30930.md): Tourism Management System Version: V 3.2 is affected by: Cross Site Request Forgery (CSRF). (no CVSS)
- [CVE-2022-32337](https://cve.now/CVE-2022-32337.md): Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/patients/manage\_patient.php?id=. (no CVSS)
- [CVE-2022-32338](https://cve.now/CVE-2022-32338.md): Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/doctors/manage\_doctor.php?id=. (no CVSS)
- [CVE-2022-32339](https://cve.now/CVE-2022-32339.md): Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/doctors/view\_doctor.php?id=. (no CVSS)
- [CVE-2022-32340](https://cve.now/CVE-2022-32340.md): Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/?page=patients/view\_patient&id=. (no CVSS)
- [CVE-2022-32341](https://cve.now/CVE-2022-32341.md): Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/?page=user/manage\_user&id=. (no CVSS)
- [CVE-2022-32342](https://cve.now/CVE-2022-32342.md): Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/room\_types/view\_room\_type.php?id=. (no CVSS)
- [CVE-2022-32343](https://cve.now/CVE-2022-32343.md): Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via hprms/admin/room\_types/manage\_room\_type.php?id=. (no CVSS)
- [CVE-2022-32344](https://cve.now/CVE-2022-32344.md): Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/classes/Master.php?f=delete\_patient. (no CVSS)
- [CVE-2022-32345](https://cve.now/CVE-2022-32345.md): Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/rooms/manage\_room.php?id=. (no CVSS)
- [CVE-2022-32346](https://cve.now/CVE-2022-32346.md): Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/rooms/view\_room.php?id=. (no CVSS)
- [CVE-2022-30931](https://cve.now/CVE-2022-30931.md): Employee Leaves Management System (ELMS) V 2.1 is vulnerable to Cross Site Request Forgery (CSRF) via /myprofile.php. (no CVSS)
- [CVE-2022-32347](https://cve.now/CVE-2022-32347.md): Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/classes/Master.php?f=delete\_room. (no CVSS)
- [CVE-2022-32348](https://cve.now/CVE-2022-32348.md): Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/classes/Master.php?f=delete\_doctor. (no CVSS)
- [CVE-2022-32349](https://cve.now/CVE-2022-32349.md): Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/classes/Master.php?f=delete\_patient\_history. (no CVSS)
- [CVE-2022-32350](https://cve.now/CVE-2022-32350.md): Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/classes/Master.php?f=delete\_room\_type. (no CVSS)
- [CVE-2022-32351](https://cve.now/CVE-2022-32351.md): Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/classes/Master.php?f=delete\_message. (no CVSS)
- [CVE-2022-32352](https://cve.now/CVE-2022-32352.md): Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/classes/Master.php?f=delete\_patient\_admission. (no CVSS)
- [CVE-2022-32335](https://cve.now/CVE-2022-32335.md): Fast Food Ordering System v1.0 is vulnerable to SQL Injection via /ffos/admin/menus/manage\_menu.php?id=. (no CVSS)
- [CVE-2022-32334](https://cve.now/CVE-2022-32334.md): Fast Food Ordering System v1.0 is vulnerable to SQL Injection via /ffos/admin/categories/manage\_category.php?id=. (no CVSS)
- [CVE-2022-32333](https://cve.now/CVE-2022-32333.md): Fast Food Ordering System v1.0 is vulnerable to SQL Injection via /ffos/admin/sales/receipt.php?id=. (no CVSS)
- [CVE-2022-32332](https://cve.now/CVE-2022-32332.md): Fast Food Ordering System v1.0 is vulnerable to SQL Injection via /ffos/classes/Master.php?f=delete\_category. (no CVSS)
- [CVE-2022-32331](https://cve.now/CVE-2022-32331.md): Fast Food Ordering System v1.0 is vulnerable to SQL Injection via /ffos/admin/categories/view\_category.php?id=. (no CVSS)
- [CVE-2022-32330](https://cve.now/CVE-2022-32330.md): Fast Food Ordering System v1.0 is vulnerable to SQL Injection via /ffos/classes/Master.php?f=delete\_menu. (no CVSS)
- [CVE-2022-32328](https://cve.now/CVE-2022-32328.md): Fast Food Ordering System v1.0 is vulnerable to Delete any file. (no CVSS)
- [CVE-2022-27889](https://cve.now/CVE-2022-27889.md): The Foundry Multipass service contains code paths that could be abused to cause a denial of service for authentication and authorization operations. (CVSS 5.3, Palantir Foundry Multipass)
- [CVE-2021-40660](https://cve.now/CVE-2021-40660.md): An issue was discovered in Delight Nashorn Sandbox 0.2.0. (no CVSS, org.javadelight:delight-nashorn-sandbox)
- [CVE-2022-31847](https://cve.now/CVE-2022-31847.md): A vulnerability in /cgi-bin/ExportAllSettings.sh of WAVLINK WN579 X3 M79X3.V5030.180719 allows attackers to obtain sensitive router informat (no CVSS)
- [CVE-2022-31846](https://cve.now/CVE-2022-31846.md): A vulnerability in live\_mfg.shtml of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to obtain sensitive router information via execut (no CVSS)
- [CVE-2022-31845](https://cve.now/CVE-2022-31845.md): A vulnerability in live\_check.shtml of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to obtain sensitive router information via exec (no CVSS)
- [CVE-2022-31311](https://cve.now/CVE-2022-31311.md): An issue in adm.cgi of WAVLINK AERIAL X 1200M M79X3.V5030.180719 allows attackers to execute arbitrary commands via a crafted POST request. (no CVSS)
- [CVE-2022-31308](https://cve.now/CVE-2022-31308.md): A vulnerability in live\_mfg.shtml of WAVLINK AERIAL X 1200M M79X3.V5030.191012 allows attackers to obtain sensitive router information via e (no CVSS)
- [CVE-2022-31309](https://cve.now/CVE-2022-31309.md): A vulnerability in live\_check.shtml of WAVLINK AERIAL X 1200M M79X3.V5030.180719 allows attackers to obtain sensitive router information via (no CVSS)
- [CVE-2022-32336](https://cve.now/CVE-2022-32336.md): Fast Food Ordering System v1.0 is vulnerable to SQL Injection via /ffos/admin/menus/view\_menu.php?id=. (no CVSS)
- [CVE-2021-40678](https://cve.now/CVE-2021-40678.md): In Piwigo 11.5.0, there exists a persistent cross-site scripting in the single mode function through /admin.php?page=batch\_manager&mode=unit (no CVSS)
- [CVE-2022-31273](https://cve.now/CVE-2022-31273.md): An issue in TopIDP3000 Topsec Operating System tos\_3.3.005.665b.15\_smpidp allows attackers to perform a brute-force attack via a crafted ses (no CVSS)
- [CVE-2021-40658](https://cve.now/CVE-2021-40658.md): Textpattern 4.8.7 is affected by a HTML injection vulnerability through “Content\>Write\>Body”. (no CVSS)
- [CVE-2021-40633](https://cve.now/CVE-2021-40633.md): A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of memory exception or den (no CVSS)
- [CVE-2021-35130](https://cve.now/CVE-2021-35130.md): Memory corruption in graphics support layer due to use after free condition in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industri (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…)
- [CVE-2021-35129](https://cve.now/CVE-2021-35129.md): Memory corruption in BT controller due to improper length check while processing vendor specific commands in Snapdragon Compute, Snapdragon (CVSS 7.8, Qualcomm Snapdragon Compute, Snapdragon Connectivity, Snapd…)
- [CVE-2021-35126](https://cve.now/CVE-2021-35126.md): Memory corruption in DSP service due to improper validation of input parameters in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectiv (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-35123](https://cve.now/CVE-2021-35123.md): Buffer copy in GATT multi notification due to improper length check for the data coming over-the-air in Snapdragon Connectivity, Snapdragon (CVSS 8.8, Qualcomm Snapdragon Connectivity, Snapdragon Industrial IOT)
- [CVE-2021-35112](https://cve.now/CVE-2021-35112.md): A user with user level permission can access graphics protected region due to improper access control in register configuration in Snapdrago (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-35104](https://cve.now/CVE-2021-35104.md): Possible buffer overflow due to improper parsing of headers while playing the FLAC audio clip in Snapdragon Auto, Snapdragon Compute, Snapdr (CVSS 9.8, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-35100](https://cve.now/CVE-2021-35100.md): Possible buffer over read due to improper calculation of string length while parsing Id3 tag in Snapdragon Auto, Snapdragon Compute, Snapdra (CVSS 7.5, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-35095](https://cve.now/CVE-2021-35095.md): Improper serialization of message queue client registration can lead to race condition allowing multiple gunyah message clients to register (CVSS 8.4, Qualcomm Snapdragon Connectivity, Snapdragon Mobile)
- [CVE-2021-35091](https://cve.now/CVE-2021-35091.md): Possible out of bounds read due to improper typecasting while handling page fault for global memory in Snapdragon Connectivity, Snapdragon M (CVSS 8.4, Qualcomm Snapdragon Connectivity, Snapdragon Mobile)
- [CVE-2021-35081](https://cve.now/CVE-2021-35081.md): Possible buffer overflow due to improper validation of SSID length received from beacon or probe response during an IBSS session in Snapdrag (CVSS 9.8, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-35071](https://cve.now/CVE-2021-35071.md): Possible buffer over read due to lack of size validation while copying data from DBR buffer to RX buffer and can lead to Denial of Service i (CVSS 5.5, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-35070](https://cve.now/CVE-2021-35070.md): RPM secure Stream can access any secure resource due to improper SMMU configuration and can lead to information disclosure in Snapdragon Ind (CVSS 6.5, Qualcomm Snapdragon Industrial IOT, Snapdragon Mobile)
- [CVE-2021-30350](https://cve.now/CVE-2021-30350.md): Lack of MBN header size verification against input buffer can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon C (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-30349](https://cve.now/CVE-2021-30349.md): Improper access control sequence for AC database after memory allocation can lead to possible memory corruption in Snapdragon Auto, Snapdrag (CVSS 8.2, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-30347](https://cve.now/CVE-2021-30347.md): Improper integrity check can lead to race condition between tasks PDCP and RRC? right after a valid RRC Command packet has been received in (CVSS 9.1, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-30346](https://cve.now/CVE-2021-30346.md): RPM secure Stream can access any secure resource due to improper SMMU configuration in Snapdragon Industrial IOT, Snapdragon Mobile, Snapdra (CVSS 6.5, Qualcomm Snapdragon Industrial IOT, Snapdragon Mobile, Snap…)
- [CVE-2021-30345](https://cve.now/CVE-2021-30345.md): RPM secure Stream can access any secure resource due to improper SMMU configuration in Snapdragon Industrial IOT, Snapdragon Mobile, Snapdra (CVSS 6.5, Qualcomm Snapdragon Industrial IOT, Snapdragon Mobile, Snap…)
- [CVE-2021-30344](https://cve.now/CVE-2021-30344.md): Improper authorization of a replayed LTE security mode command can lead to a denial of service in Snapdragon Auto, Snapdragon Compute, Snapd (CVSS 7.5, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-30343](https://cve.now/CVE-2021-30343.md): Improper integrity check can lead to race condition between tasks PDCP and RRC? after a valid RRC Command packet has been received in Snapdr (CVSS 9.1, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-30342](https://cve.now/CVE-2021-30342.md): Improper integrity check can lead to race condition between tasks PDCP and RRC? after a valid RRC Command packet has been received in Snapdr (CVSS 9.1, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-30341](https://cve.now/CVE-2021-30341.md): Improper buffer size validation of DSM packet received can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Conn (CVSS 9.8, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-30340](https://cve.now/CVE-2021-30340.md): Reachable assertion due to improper validation of coreset in PDCCH configuration in SA mode in Snapdragon Auto, Snapdragon Compute, Snapdrag (CVSS 7.5, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-30339](https://cve.now/CVE-2021-30339.md): Reading PRNG output may lead to improper key generation due to lack of buffer validation in Snapdragon Connectivity, Snapdragon Industrial I (CVSS 9.0, Qualcomm Snapdragon Connectivity, Snapdragon Industrial IOT…)
- [CVE-2021-30338](https://cve.now/CVE-2021-30338.md): Improper input validation in TrustZone memory transfer interface can lead to information disclosure in Snapdragon Compute (CVSS 7.1, Qualcomm Snapdragon Compute)
- [CVE-2021-30334](https://cve.now/CVE-2021-30334.md): Possible use after free due to lack of null check of DRM file status after file structure is freed in Snapdragon Auto, Snapdragon Compute, S (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-30327](https://cve.now/CVE-2021-30327.md): Buffer overflow in sahara protocol while processing commands leads to overwrite of secure configuration data in Snapdragon Mobile, Snapdrago (CVSS 7.5, Qualcomm Snapdragon Mobile, Snapdragon Compute, Snapdragon…)
- [CVE-2021-30281](https://cve.now/CVE-2021-30281.md): Possible unauthorized access to secure space due to improper check of data allowed while flashing the no access control device configuration (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-40616](https://cve.now/CVE-2021-40616.md): thinkcmf v5.1.7 has an unauthorized vulnerability. (no CVSS, thinkcmf/thinkcmf)
- [CVE-2022-22072](https://cve.now/CVE-2022-22072.md): Buffer overflow can occur due to improper validation of NDP application information length in Snapdragon Auto, Snapdragon Compute, Snapdrago (CVSS 7.8, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2022-22071](https://cve.now/CVE-2022-22071.md): Possible use after free when process shell memory is freed using IOCTL munmap call and process initialization is in progress in Snapdragon A (CVSS 8.4, KEV, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2022-22068](https://cve.now/CVE-2022-22068.md): kernel event may contain unexpected content which is not generated by NPU software in asynchronous execution mode in Snapdragon Auto, Snapdr (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2022-22065](https://cve.now/CVE-2022-22065.md): Out of bound read in WLAN HOST due to improper length check can lead to DOS in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, (CVSS 7.5, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2022-22064](https://cve.now/CVE-2022-22064.md): Possible buffer over read due to lack of size validation while unpacking frame in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivi (CVSS 7.5, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-35116](https://cve.now/CVE-2021-35116.md): APK can load a crafted model into the CDSP which can lead to a compromise of CDSP and other APK\`s data executing there in Snapdragon Auto, S (CVSS 7.7, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-35098](https://cve.now/CVE-2021-35098.md): Improper validation of session id in PCM routing process can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Co (CVSS 6.7, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-35096](https://cve.now/CVE-2021-35096.md): Improper memory allocation during counter check DLM handling can lead to denial of service in Snapdragon Auto, Snapdragon Compute, Snapdrago (CVSS 7.5, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-35094](https://cve.now/CVE-2021-35094.md): Improper verification of timeout-based authentication in identity credential can lead to invalid authorization in HLOS in Snapdragon Auto, S (CVSS 7.8, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-35092](https://cve.now/CVE-2021-35092.md): Processing DCB/AVB algorithm with an invalid queue index from IOCTL request could lead to arbitrary address modification in Snapdragon Auto, (CVSS 6.7, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-35090](https://cve.now/CVE-2021-35090.md): Possible hypervisor memory corruption due to TOC TOU race condition when updating address mappings in Snapdragon Auto, Snapdragon Compute, S (CVSS 9.3, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-35087](https://cve.now/CVE-2021-35087.md): Possible null pointer access due to improper validation of system information message to be processed in Snapdragon Industrial IOT, Snapdrag (CVSS 7.5, Qualcomm Snapdragon Industrial IOT, Snapdragon Mobile)
- [CVE-2021-35086](https://cve.now/CVE-2021-35086.md): Possible buffer over read due to improper validation of SIB type when processing a NR system Information message in Snapdragon Auto, Snapdra (CVSS 7.5, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-35085](https://cve.now/CVE-2021-35085.md): Possible buffer overflow due to lack of buffer length check during management frame Rx handling in Snapdragon Auto, Snapdragon Compute, Snap (CVSS 5.5, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-35084](https://cve.now/CVE-2021-35084.md): Possible out of bound read due to lack of length check of data length for a DIAG event in Snapdragon Auto, Snapdragon Compute, Snapdragon Co (CVSS 5.5, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-35082](https://cve.now/CVE-2021-35082.md): Improper integrity check can lead to race condition between tasks PDCP and RRC? right after a valid RRC security mode command packet has bee (CVSS 9.1, Qualcomm Snapdragon Industrial IOT)
- [CVE-2021-35080](https://cve.now/CVE-2021-35080.md): Disabled SMMU from secure side while RPM is assigned a secure stream can lead to information disclosure in Snapdragon Industrial IOT, Snapdr (CVSS 6.5, Qualcomm Snapdragon Industrial IOT, Snapdragon Mobile, Snap…)
- [CVE-2021-35079](https://cve.now/CVE-2021-35079.md): Improper validation of permissions for third party application accessing Telephony service API can lead to information disclosure in Snapdra (CVSS 6.2, Qualcomm Snapdragon Compute, Snapdragon Connectivity, Snapd…)
- [CVE-2021-35078](https://cve.now/CVE-2021-35078.md): Possible memory leak due to improper validation of certificate chain length while parsing server certificate chain in Snapdragon Auto, Snapd (CVSS 7.5, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-35076](https://cve.now/CVE-2021-35076.md): Possible null pointer dereference due to improper validation of RRC connection reconfiguration message in Snapdragon Auto, Snapdragon Comput (CVSS 7.5, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-35073](https://cve.now/CVE-2021-35073.md): Possible assertion due to improper validation of rank restriction field in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Sna (CVSS 7.5, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-35072](https://cve.now/CVE-2021-35072.md): Possible buffer overflow due to improper validation of array index while processing external DIAG command in Snapdragon Auto, Snapdragon Con (CVSS 7.8, Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…)
- [CVE-2022-25651](https://cve.now/CVE-2022-25651.md): Memory corruption in bluetooth host due to integer overflow while processing BT HFP-UNIT profile in Snapdragon Auto, Snapdragon Consumer IOT (CVSS 9.8, Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…)
- [CVE-2022-22103](https://cve.now/CVE-2022-22103.md): Memory corruption in multimedia driver due to double free while processing data from user in Snapdragon Auto (CVSS 7.8, Qualcomm Snapdragon Auto)
- [CVE-2022-22090](https://cve.now/CVE-2022-22090.md): Memory corruption in audio due to use after free while managing buffers from internal cache in Snapdragon Compute, Snapdragon Connectivity, (CVSS 8.4, Qualcomm Snapdragon Compute, Snapdragon Connectivity, Snapd…)
- [CVE-2022-22087](https://cve.now/CVE-2022-22087.md): memory corruption in video due to buffer overflow while parsing mkv clip with no codechecker in Snapdragon Auto, Snapdragon Compute, Snapdra (CVSS 7.3, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2022-22086](https://cve.now/CVE-2022-22086.md): Memory corruption in video due to double free while parsing 3gp clip with invalid meta data atoms in Snapdragon Auto, Snapdragon Compute, Sn (CVSS 7.3, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2022-22085](https://cve.now/CVE-2022-22085.md): Memory corruption in video due to buffer overflow while reading the dts file in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2022-22084](https://cve.now/CVE-2022-22084.md): Memory corruption when extracting qcp audio file due to lack of check on data length in Snapdragon Auto, Snapdragon Compute, Snapdragon Conn (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2022-22083](https://cve.now/CVE-2022-22083.md): Denial of service due to memory corruption while extracting ape header from clips in Snapdragon Auto, Snapdragon Compute, Snapdragon Connect (CVSS 7.5, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2022-22082](https://cve.now/CVE-2022-22082.md): Memory corruption due to possible buffer overflow while parsing DSF header with corrupted channel count in Snapdragon Auto, Snapdragon Compu (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-35121](https://cve.now/CVE-2021-35121.md): An array index is improperly used to lock and unlock a mutex which can lead to a Use After Free condition In the Synx driver in Snapdragon C (CVSS 6.7, Qualcomm Snapdragon Compute, Snapdragon Connectivity, Snapd…)
- [CVE-2021-35120](https://cve.now/CVE-2021-35120.md): Improper handling between export and release functions on the same handle from client can lead to use after free in Snapdragon Compute, Snap (CVSS 6.7, Qualcomm Snapdragon Compute, Snapdragon Connectivity, Snapd…)
- [CVE-2021-35119](https://cve.now/CVE-2021-35119.md): Potential out of Bounds read in FIPS event processing due to improper validation of the length from the firmware in Snapdragon Auto, Snapdra (CVSS 5.5, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-35118](https://cve.now/CVE-2021-35118.md): An out-of-bounds write can occur due to an incorrect input check in the camera driver in Snapdragon Auto, Snapdragon Compute, Snapdragon Con (CVSS 6.7, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-35114](https://cve.now/CVE-2021-35114.md): Improper buffer initialization on the backend driver can lead to buffer overflow in Snapdragon Auto (CVSS 8.4, Qualcomm Snapdragon Auto)
- [CVE-2021-35111](https://cve.now/CVE-2021-35111.md): Improper validation of tag id while RRC sending tag id to MAC can lead to TOCTOU race condition in Snapdragon Connectivity, Snapdragon Mobil (CVSS 7.5, Qualcomm Snapdragon Connectivity, Snapdragon Mobile)
- [CVE-2021-35102](https://cve.now/CVE-2021-35102.md): Possible buffer overflow due to lack of validation for the length of NAI string read from EFS in Snapdragon Auto, Snapdragon Compute, Snapdr (CVSS 7.8, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-35101](https://cve.now/CVE-2021-35101.md): Improper handling of writes to virtual GICR control can lead to assertion failure in the hypervisor in Snapdragon Auto, Snapdragon Compute, (CVSS 7.1, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Mo…)
- [CVE-2021-35083](https://cve.now/CVE-2021-35083.md): Possible out of bound read due to improper validation of certificate chain in SSL or Internet key exchange in Snapdragon Auto, Snapdragon Co (CVSS 8.2, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-40650](https://cve.now/CVE-2021-40650.md): In Connx Version 6.2.0.1269 (20210623), a cookie can be issued by the application and not have the secure flag set. (no CVSS)
- [CVE-2021-40649](https://cve.now/CVE-2021-40649.md): In Connx Version 6.2.0.1269 (20210623), a cookie can be issued by the application and not have the HttpOnly flag set. (no CVSS)
- [CVE-2022-32286](https://cve.now/CVE-2022-32286.md): A vulnerability has been identified in Mendix SAML Module (Mendix 7 compatible) (All versions \< V1.16.6), Mendix SAML Module (Mendix 8 compa (no CVSS, Siemens Mendix SAML Module)
- [CVE-2022-32285](https://cve.now/CVE-2022-32285.md): A vulnerability has been identified in Mendix SAML Module (Mendix 7 compatible) (All versions \< V1.16.6), Mendix SAML Module (Mendix 8 compa (no CVSS, Siemens Mendix SAML Module)
- [CVE-2022-32262](https://cve.now/CVE-2022-32262.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.1). (CVSS 8.8, Siemens SINEMA Remote Connect Server)
- [CVE-2022-32261](https://cve.now/CVE-2022-32261.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.1). (CVSS 5.3, Siemens SINEMA Remote Connect Server)
- [CVE-2022-32260](https://cve.now/CVE-2022-32260.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.2 SP1). (CVSS 6.5, Siemens SINEMA Remote Connect Server)
- [CVE-2022-32259](https://cve.now/CVE-2022-32259.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.1). (CVSS 6.5, Siemens SINEMA Remote Connect Server)
- [CVE-2022-32258](https://cve.now/CVE-2022-32258.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.1). (CVSS 5.3, Siemens SINEMA Remote Connect Server)
- [CVE-2022-32256](https://cve.now/CVE-2022-32256.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.1). (CVSS 4.3, Siemens SINEMA Remote Connect Server)
- [CVE-2022-32255](https://cve.now/CVE-2022-32255.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.1). (CVSS 5.3, Siemens SINEMA Remote Connect Server)
- [CVE-2022-32254](https://cve.now/CVE-2022-32254.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.1). (CVSS 4.3, Siemens SINEMA Remote Connect Server)
- [CVE-2022-32253](https://cve.now/CVE-2022-32253.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.1). (CVSS 4.9, Siemens SINEMA Remote Connect Server)
- [CVE-2022-32252](https://cve.now/CVE-2022-32252.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.1). (CVSS 6.5, Siemens SINEMA Remote Connect Server)
- [CVE-2022-32251](https://cve.now/CVE-2022-32251.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.1). (CVSS 8.8, Siemens SINEMA Remote Connect Server)
- [CVE-2022-32145](https://cve.now/CVE-2022-32145.md): A vulnerability has been identified in Teamcenter Active Workspace V5.2 (All versions \< V5.2.9), Teamcenter Active Workspace V6.0 (All versi (no CVSS, Siemens Teamcenter Active Workspace)
- [CVE-2022-31619](https://cve.now/CVE-2022-31619.md): A vulnerability has been identified in Teamcenter V12.4 (All versions \< V12.4.0.13), Teamcenter V13.0 (All versions \< V13.0.0.9), Teamcenter (no CVSS, Siemens Teamcenter)
- [CVE-2022-31465](https://cve.now/CVE-2022-31465.md): A vulnerability has been identified in Xpedition Designer VX.2.10 (All versions \< VX.2.10 Update 13), Xpedition Designer VX.2.11 (All versio (CVSS 7.8, Siemens Xpedition Designer VX.2.10 · Siemens Xpedition D… +2)
- [CVE-2022-30937](https://cve.now/CVE-2022-30937.md): A vulnerability has been identified in EN100 Ethernet module DNP3 IP variant (All versions), EN100 Ethernet module IEC 104 variant (All vers (no CVSS, Siemens EN100 Ethernet module DNP3 IP variant · Siemens… +3)
- [CVE-2022-30231](https://cve.now/CVE-2022-30231.md): A vulnerability has been identified in SICAM GridEdge (Classic) (All versions \< V2.6.6). (CVSS 4.9, Siemens SICAM GridEdge)
- [CVE-2022-30230](https://cve.now/CVE-2022-30230.md): A vulnerability has been identified in SICAM GridEdge (Classic) (All versions \< V2.6.6). (CVSS 9.8, Siemens SICAM GridEdge)
- [CVE-2022-30229](https://cve.now/CVE-2022-30229.md): A vulnerability has been identified in SICAM GridEdge (Classic) (All versions \< V2.6.6). (CVSS 7.2, Siemens SICAM GridEdge)
- [CVE-2022-30228](https://cve.now/CVE-2022-30228.md): A vulnerability has been identified in SICAM GridEdge (Classic) (All versions \< V2.6.6). (CVSS 8.8, Siemens SICAM GridEdge)
- [CVE-2022-29034](https://cve.now/CVE-2022-29034.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.1). (CVSS 6.1, Siemens SINEMA Remote Connect Server)
- [CVE-2022-27221](https://cve.now/CVE-2022-27221.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.1). (CVSS 5.9, Siemens SINEMA Remote Connect Server)
- [CVE-2022-27220](https://cve.now/CVE-2022-27220.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.0 SP2). (no CVSS, Siemens SINEMA Remote Connect Server)
- [CVE-2022-27219](https://cve.now/CVE-2022-27219.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.0 SP2). (no CVSS, Siemens SINEMA Remote Connect Server)
- [CVE-2022-26476](https://cve.now/CVE-2022-26476.md): A vulnerability has been identified in Spectrum Power 4 (All versions using Shared HIS), Spectrum Power 7 (All versions using Shared HIS), S (no CVSS, Siemens Spectrum Power)
- [CVE-2021-37182](https://cve.now/CVE-2021-37182.md): A vulnerability has been identified in SCALANCE XM408-4C (All versions \< V6.5), SCALANCE XM408-4C (L3 int.) (All versions \< V6.5), SCALANCE (no CVSS, Siemens SCALANCE XM408-4C · Siemens SCALANCE XM408-8C +7)
- [CVE-2022-2079](https://cve.now/CVE-2022-2079.md): Cross-site Scripting (XSS) - Stored in nocodb/nocodb (CVSS 7.3, nocodb/nocodb · nocodb)
- [CVE-2022-25167](https://cve.now/CVE-2022-25167.md): Apache Flume vulnerable to a JNDI RCE in JMSSource (no CVSS, Apache Software Foundation Apache Flume · org.apache.flume.…)
- [CVE-2022-29925](https://cve.now/CVE-2022-29925.md): Access of uninitialized pointer vulnerability exists in the simulator module contained in the graphic editor 'V-SFT' versions prior to v6.1. (no CVSS, FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT)
- [CVE-2022-29524](https://cve.now/CVE-2022-29524.md): Out-of-bounds write vulnerability exists in V-Server v4.0.11.0 and earlier and V-Server Lite v4.0.13.0 and earlier, which may allow an attac (no CVSS, FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-Server an…)
- [CVE-2022-29522](https://cve.now/CVE-2022-29522.md): Use after free vulnerability exists in the simulator module contained in the graphic editor 'V-SFT' versions prior to v6.1.6.0, which may al (no CVSS, FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT)
- [CVE-2022-29509](https://cve.now/CVE-2022-29509.md): Directory traversal vulnerability in T&D Data Server (Japanese Edition) Ver.2.22 and earlier, T&D Data Server (English Edition) Ver.2.30 and (no CVSS, T&D Data Server and THERMO RECORDER DATA SERVER)
- [CVE-2022-29506](https://cve.now/CVE-2022-29506.md): Out-of-bounds read vulnerability exist in the simulator module contained in the graphic editor 'V-SFT' v6.1.3.0 and earlier, which may allow (no CVSS, FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT)
- [CVE-2022-29485](https://cve.now/CVE-2022-29485.md): Cross-site scripting vulnerability in SHIRASAGI v1.0.0 to v1.14.2, and v1.15.0 allows a remote attacker to inject an arbitrary script via un (no CVSS, SHIRASAGI Project SHIRASAGI)
- [CVE-2022-29482](https://cve.now/CVE-2022-29482.md): 'Mobaoku-Auction&Flea Market' App for iOS versions prior to 5.5.16 improperly verifies server certificates, which may allow an attacker to e (no CVSS, DeNA Co. Mobaoku-Auction & Flea Market App for iOS)
- [CVE-2022-27176](https://cve.now/CVE-2022-27176.md): Incomplete filtering of special elements vulnerability exists in RevoWorks SCVX using 'File Sanitization Library' 1.043 and prior versions, (no CVSS, J’s Communication Co. RevoWorks SCVX, RevoWorks Browser, an…)
- [CVE-2022-26302](https://cve.now/CVE-2022-26302.md): Heap-based buffer overflow exists in the simulator module contained in the graphic editor 'V-SFT' versions prior to v6.1.6.0, which may allo (no CVSS, FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT)
- [CVE-2022-31447](https://cve.now/CVE-2022-31447.md): An XML external entity (XXE) injection vulnerability in Magicpin v3.4 allows attackers to access sensitive database information via a crafte (no CVSS)
- [CVE-2022-31446](https://cve.now/CVE-2022-31446.md): Tenda AC18 router V15.03.05.19 and V15.03.05.05 was discovered to contain a remote code execution (RCE) vulnerability via the Mac parameter (no CVSS)
- [CVE-2022-31415](https://cve.now/CVE-2022-31415.md): Online Fire Reporting System v1.0 was discovered to contain a SQL injection vulnerability via the GET parameter in /report/list.php. (no CVSS)
- [CVE-2022-22057](https://cve.now/CVE-2022-22057.md): Use after free in graphics fence due to a race condition while closing fence file descriptor and destroy graphics timeline simultaneously in (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2022-32156](https://cve.now/CVE-2022-32156.md): Splunk Enterprise and Universal Forwarder CLI connections lacked TLS cert validation (CVSS 7.4, Splunk Enterprise · Splunk Universal Forwarder)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-06-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.