# CVEs published 2022-06-28

60 CVEs were published on June 28, 2022: 3 critical, 6 high. Days are UTC.

- [CVE-2022-32532](https://cve.now/CVE-2022-32532.md): Authentication Bypass Vulnerability (no CVSS, Apache Software Foundation Apache Shiro · org.apache.shiro:…)
- [CVE-2022-25238](https://cve.now/CVE-2022-25238.md): Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that can can be added to website content via XHR by an (no CVSS, silverstripe/framework)
- [CVE-2022-29858](https://cve.now/CVE-2022-29858.md): Silverstripe silverstripe/assets through 1.10 is vulnerable to improper access control that allows protected images to be published by chang (no CVSS, silverstripe/assets)
- [CVE-2022-24444](https://cve.now/CVE-2022-24444.md): Silverstripe silverstripe/framework through 4.10 allows Session Fixation. (no CVSS, silverstripe/hybridsessions)
- [CVE-2021-41559](https://cve.now/CVE-2021-41559.md): Silverstripe silverstripe/framework 4.8.1 has a quadratic blowup in Convert::xml2array() that enables a remote attack via a crafted XML docu (no CVSS, silverstripe/framework)
- [CVE-2020-19897](https://cve.now/CVE-2020-19897.md): A reflected Cross Site Scripting (XSS) in wuzhicms v4.1.0 allows remote attackers to execute arbitrary web script or HTML via the imgurl par (no CVSS)
- [CVE-2020-19896](https://cve.now/CVE-2020-19896.md): File inclusion vulnerability in Minicms v1.9 allows remote attackers to execute arbitary PHP code via post-edit.php. (no CVSS)
- [CVE-2022-31887](https://cve.now/CVE-2022-31887.md): Marval MSM v14.19.0.12476 has a 0-Click Account Takeover vulnerability which allows an attacker to change any user's password in the organiz (no CVSS)
- [CVE-2022-31884](https://cve.now/CVE-2022-31884.md): Marval MSM v14.19.0.12476 has an Improper Access Control vulnerability which allows a low privilege user to delete other users API Keys incl (no CVSS)
- [CVE-2022-31883](https://cve.now/CVE-2022-31883.md): Marval MSM v14.19.0.12476 is has an Insecure Direct Object Reference (IDOR) vulnerability. (no CVSS)
- [CVE-2022-31886](https://cve.now/CVE-2022-31886.md): Marval MSM v14.19.0.12476 is vulnerable to Cross Site Request Forgery (CSRF). (no CVSS)
- [CVE-2022-31885](https://cve.now/CVE-2022-31885.md): Marval MSM v14.19.0.12476 is vulnerable to OS Command Injection due to the insecure handling of VBScripts. (no CVSS)
- [CVE-2021-3435](https://cve.now/CVE-2021-3435.md): L2CAP: Information leakage in le\_ecred\_conn\_req() (CVSS 4.0, zephyrproject-rtos zephyr)
- [CVE-2021-3434](https://cve.now/CVE-2021-3434.md): L2CAP: Stack based buffer overflow in le\_ecred\_conn\_req() (CVSS 4.9, zephyrproject-rtos zephyr)
- [CVE-2021-3433](https://cve.now/CVE-2021-3433.md): BT: Invalid channel map in CONNECT\_IND results to Deadlock (CVSS 4.0, zephyrproject-rtos zephyr)
- [CVE-2021-3432](https://cve.now/CVE-2021-3432.md): BT: Invalid interval in CONNECT\_IND leads to Division by Zero (CVSS 4.3, zephyrproject-rtos zephyr)
- [CVE-2021-3431](https://cve.now/CVE-2021-3431.md): BT: Assertion failure on repeated LL\_FEATURE\_REQ (CVSS 4.3, zephyrproject-rtos zephyr)
- [CVE-2021-3430](https://cve.now/CVE-2021-3430.md): BT: Assertion failure on repeated LL\_CONNECTION\_PARAM\_REQ (CVSS 6.5, zephyrproject-rtos zephyr)
- [CVE-2022-31230](https://cve.now/CVE-2022-31230.md): Dell PowerScale OneFS, versions 8.2.x-9.2.x, contain broken or risky cryptographic algorithm. (CVSS 8.1, Dell PowerScale OneFS)
- [CVE-2022-31229](https://cve.now/CVE-2022-31229.md): Dell PowerScale OneFS, 8.2.x through 9.3.0.x, contain an error message with sensitive information. (CVSS 9.6, Dell PowerScale OneFS)
- [CVE-2022-31108](https://cve.now/CVE-2022-31108.md): Arbitrary \`CSS\` injection into the generated graph affecting the container HTML in mermaid.js (CVSS 4.1, mermaid-js mermaid · mermaid)
- [CVE-2022-31061](https://cve.now/CVE-2022-31061.md): SQL injection on login page in GLPI (CVSS 9.8, glpi-project glpi)
- [CVE-2022-31068](https://cve.now/CVE-2022-31068.md): Sensitive Data Exposure on Refused Inventory Files in GLPI (CVSS 5.3, glpi-project glpi)
- [CVE-2022-28621](https://cve.now/CVE-2022-28621.md): A remote disclosure of sensitive information vulnerability was discovered in HPE NonStop DSM/SCM version: T6031H03^ADP. (no CVSS, HPE NonStop DSM/SCM T6031)
- [CVE-2022-2145](https://cve.now/CVE-2022-2145.md): Cloudlfare WARP Arbitrary File Overwrite (CVSS 5.8, Cloudflare WARP)
- [CVE-2022-31106](https://cve.now/CVE-2022-31106.md): Prototype Pollution in underscore.deep (CVSS 8.3, Clever underscore.deep)
- [CVE-2022-31052](https://cve.now/CVE-2022-31052.md): URL previews can crash Synapse media repositories or Synapse monoliths (CVSS 6.5, matrix-org synapse · matrix-synapse)
- [CVE-2022-33108](https://cve.now/CVE-2022-33108.md): XPDF v4.04 was discovered to contain a stack overflow vulnerability via the Object::Copy class of object.cc files. (no CVSS)
- [CVE-2021-3779](https://cve.now/CVE-2021-3779.md): Ruby-MySQL Gem Client File Read (no CVSS, Tomita Masahiro ruby-mysql · ruby-mysql)
- [CVE-2021-40553](https://cve.now/CVE-2021-40553.md): piwigo 11.5.0 is affected by a remote code execution (RCE) vulnerability in the LocalFiles Editor. (no CVSS)
- [CVE-2022-0987](https://cve.now/CVE-2022-0987.md): A flaw was found in PackageKit in the way some of the methods exposed by the Transaction interface examines files. (no CVSS, PackageKit)
- [CVE-2022-0085](https://cve.now/CVE-2022-0085.md): Server-Side Request Forgery (SSRF) in dompdf/dompdf (CVSS 3.7, dompdf/dompdf)
- [CVE-2022-23763](https://cve.now/CVE-2022-23763.md): DOUZONE BIZON NeoRS file download and execute vulnerability (CVSS 7.8, DOUZONE BIZON Co. NeoRS)
- [CVE-2022-30563](https://cve.now/CVE-2022-30563.md): When an attacker uses a man-in-the-middle attack to sniff the request packets with success logging in through ONVIF, he can log in to the de (no CVSS, IPCHDBW2XXX\[IPCHFW2XXX\[ASI7XXXX)
- [CVE-2022-30562](https://cve.now/CVE-2022-30562.md): If the user enables the https function on the device, an attacker can modify the user’s request data packet through a man-in-the-middle atta (no CVSS, IPCHDBW2XXX IPCHFW2XXX ASI7XXXX)
- [CVE-2022-30561](https://cve.now/CVE-2022-30561.md): When an attacker uses a man-in-the-middle attack to sniff the request packets with success logging in, the attacker could log in to the devi (no CVSS, IPCHDBW2XXX IPCHFW2XXX ASI7XXXX)
- [CVE-2022-30560](https://cve.now/CVE-2022-30560.md): When an attacker obtaining the administrative account and password, or through a man-in-the-middle attack, the attacker could send a specifi (no CVSS, IPCHDBW2XXX IPCHFW2XXX ASI7XXXX)
- [CVE-2021-41460](https://cve.now/CVE-2021-41460.md): ECShop 4.1.0 has SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information. (no CVSS)
- [CVE-2022-34750](https://cve.now/CVE-2022-34750.md): An issue was discovered in MediaWiki through 1.38.1. (no CVSS)
- [CVE-2022-23896](https://cve.now/CVE-2022-23896.md): Admidio 4.1.2 version is affected by stored cross-site scripting (XSS). (no CVSS, admidio/admidio)
- [CVE-2021-40607](https://cve.now/CVE-2021-40607.md): The schm\_box\_size function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box command. (no CVSS)
- [CVE-2022-30997](https://cve.now/CVE-2022-30997.md): Use of hard-coded credentials vulnerability exists in STARDOM FCN Controller and FCJ Controller R4.10 to R4.31, which may allow an attacker (CVSS 6.3, Yokogawa Electric STARDOM Controller)
- [CVE-2022-30707](https://cve.now/CVE-2022-30707.md): Violation of secure design principles exists in the communication of CAMS for HIS. (no CVSS, Yokogawa Electric CAMS for HIS)
- [CVE-2022-29519](https://cve.now/CVE-2022-29519.md): Cleartext transmission of sensitive information vulnerability exists in STARDOM FCN Controller and FCJ Controller R1.01 to R4.31, which may (no CVSS, Yokogawa Electric STARDOM Controller)
- [CVE-2021-40943](https://cve.now/CVE-2021-40943.md): In Bento4 1.6.0-638, there is a null pointer reference in the function AP4\_DescriptorListInspector::Action function in Ap4Descriptor.h:124 , (no CVSS)
- [CVE-2021-41687](https://cve.now/CVE-2021-41687.md): DCMTK through 3.6.6 does not handle memory free properly. (no CVSS)
- [CVE-2021-41688](https://cve.now/CVE-2021-41688.md): DCMTK through 3.6.6 does not handle memory free properly. (no CVSS)
- [CVE-2021-41690](https://cve.now/CVE-2021-41690.md): DCMTK through 3.6.6 does not handle memory free properly. (no CVSS)
- [CVE-2021-41689](https://cve.now/CVE-2021-41689.md): DCMTK through 3.6.6 does not handle string copy properly. (CVSS 7.5)
- [CVE-2022-0624](https://cve.now/CVE-2022-0624.md): Authorization Bypass Through User-Controlled Key in ionicabizau/parse-path (CVSS 6.5, ionicabizau/parse-path · parse-path)
- [CVE-2017-20107](https://cve.now/CVE-2017-20107.md): ShadeYouVPN.com Client privileges management (CVSS 5.3, ShadeYouVPN.com Client)
- [CVE-2017-20106](https://cve.now/CVE-2017-20106.md): Lithium Forum Compose Message server-side request forgery (CVSS 5.3, Lithium Forum)
- [CVE-2017-20105](https://cve.now/CVE-2017-20105.md): Simplessus path traversal (CVSS 5.4, Simplessus)
- [CVE-2017-20104](https://cve.now/CVE-2017-20104.md): Simplessus Cookie Time sql injection (CVSS 7.3, Simplessus)
- [CVE-2021-40606](https://cve.now/CVE-2021-40606.md): The gf\_bs\_write\_data function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box command. (no CVSS)
- [CVE-2021-40608](https://cve.now/CVE-2021-40608.md): The gf\_hinter\_track\_finalize function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box command. (no CVSS)
- [CVE-2021-40609](https://cve.now/CVE-2021-40609.md): The GetHintFormat function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box command. (no CVSS)
- [CVE-2021-40944](https://cve.now/CVE-2021-40944.md): In GPAC MP4Box 1.1.0, there is a Null pointer reference in the function gf\_filter\_pid\_get\_packet function in src/filter\_core/filter\_pid.c:53 (no CVSS)
- [CVE-2022-2231](https://cve.now/CVE-2022-2231.md): NULL Pointer Dereference in vim/vim (CVSS 7.8, vim/vim)
- [CVE-2022-31056](https://cve.now/CVE-2022-31056.md): SQL injection with \_actor parameter in GLPI (CVSS 9.8, glpi-project glpi)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-06-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.