# CVEs published 2022-06-29

49 CVEs were published on June 29, 2022: 1 critical, 6 high. Days are UTC.

- [CVE-2022-34835](https://cve.now/CVE-2022-34835.md): In Das U-Boot through 2022.07-rc5, an integer signedness error and resultant stack-based buffer overflow in the "i2c md" command enables the (no CVSS)
- [CVE-2021-40597](https://cve.now/CVE-2021-40597.md): The firmware of EDIMAX IC-3140W Version 3.11 is hardcoded with Administrator username and password. (no CVSS)
- [CVE-2022-30467](https://cve.now/CVE-2022-30467.md): Joy ebike Wolf Manufacturing year 2022 is vulnerable to Denial of service, which allows remote attackers to jam the key fob request via RF. (no CVSS)
- [CVE-2022-2073](https://cve.now/CVE-2022-2073.md): Code Injection in getgrav/grav (CVSS 9.1, getgrav/grav)
- [CVE-2022-31110](https://cve.now/CVE-2022-31110.md): Denial of Service (DoS) vulnerability in RSSHub (CVSS 5.3, DIYgod RSSHub · rsshub)
- [CVE-2022-31058](https://cve.now/CVE-2022-31058.md): SQL injection via the field name of a tracker in Tuleap (CVSS 7.2, Enalean tuleap)
- [CVE-2022-31063](https://cve.now/CVE-2022-31063.md): Cross site scripting via the title of a document in Tuleap (CVSS 6.5, Enalean tuleap)
- [CVE-2022-31032](https://cve.now/CVE-2022-31032.md): Resources of private projects can be exposed in Tuleap (CVSS 4.3, Enalean tuleap)
- [CVE-2022-33060](https://cve.now/CVE-2022-33060.md): Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f (no CVSS)
- [CVE-2022-33061](https://cve.now/CVE-2022-33061.md): Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f (no CVSS)
- [CVE-2022-33638](https://cve.now/CVE-2022-33638.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 8.3, Microsoft Edge)
- [CVE-2022-30192](https://cve.now/CVE-2022-30192.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 8.3, Microsoft Edge)
- [CVE-2022-33059](https://cve.now/CVE-2022-33059.md): Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f (no CVSS)
- [CVE-2022-33058](https://cve.now/CVE-2022-33058.md): Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f (no CVSS)
- [CVE-2022-33057](https://cve.now/CVE-2022-33057.md): Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f (no CVSS)
- [CVE-2022-33042](https://cve.now/CVE-2022-33042.md): Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/inquiries/view (no CVSS)
- [CVE-2017-20120](https://cve.now/CVE-2017-20120.md): TrueConf Server cross-site request forgery (CVSS 4.3, TrueConf Server)
- [CVE-2017-20119](https://cve.now/CVE-2017-20119.md): TrueConf Server change-lang redirect (CVSS 3.5, TrueConf Server)
- [CVE-2017-20118](https://cve.now/CVE-2017-20118.md): TrueConf Server DOM cross site scripting (CVSS 3.5, TrueConf Server)
- [CVE-2017-20117](https://cve.now/CVE-2017-20117.md): TrueConf Server group DOM cross site scripting (CVSS 3.5, TrueConf Server)
- [CVE-2017-20116](https://cve.now/CVE-2017-20116.md): TrueConf Server Reflected cross site scripting (CVSS 3.5, TrueConf Server)
- [CVE-2017-20115](https://cve.now/CVE-2017-20115.md): TrueConf Server Reflected cross site scripting (CVSS 3.5, TrueConf Server)
- [CVE-2017-20114](https://cve.now/CVE-2017-20114.md): TrueConf Server Reflected cross site scripting (CVSS 3.5, TrueConf Server)
- [CVE-2017-20113](https://cve.now/CVE-2017-20113.md): TrueConf Server Stored cross site scripting (CVSS 3.5, TrueConf Server)
- [CVE-2021-39074](https://cve.now/CVE-2021-39074.md): IBM Security Guardium 11.4 is vulnerable to cross-site scripting. (CVSS 6.1, IBM Security Guardium)
- [CVE-2022-2252](https://cve.now/CVE-2022-2252.md): Open Redirect in microweber/microweber (CVSS 4.3, microweber/microweber)
- [CVE-2022-32969](https://cve.now/CVE-2022-32969.md): MetaMask before 10.11.3 might allow an attacker to access a user's secret recovery phrase because an input field is used for a BIP39 mnemoni (no CVSS)
- [CVE-2020-26877](https://cve.now/CVE-2020-26877.md): ApiFest OAuth 2.0 Server 0.3.1 does not validate the redirect URI in accordance with RFC 6749 and is susceptible to an open redirector attac (no CVSS)
- [CVE-2022-33037](https://cve.now/CVE-2022-33037.md): A binary hijack in Orwell-Dev-Cpp v5.11 allows attackers to execute arbitrary code via a crafted .exe file. (no CVSS)
- [CVE-2022-34043](https://cve.now/CVE-2022-34043.md): Incorrect permissions for the folder C:\\ProgramData\\NoMachine\\var\\uninstall of Nomachine v7.9.2 allows attackers to perform a DLL hijacking (no CVSS)
- [CVE-2022-33036](https://cve.now/CVE-2022-33036.md): A binary hijack in Embarcadero Dev-CPP v6.3 allows attackers to execute arbitrary code via a crafted .exe file. (no CVSS)
- [CVE-2022-33035](https://cve.now/CVE-2022-33035.md): XLPD v7.0.0094 and below contains an unquoted service path vulnerability which allows local users to launch processes with elevated privileg (no CVSS)
- [CVE-2022-33023](https://cve.now/CVE-2022-33023.md): CVA6 commit 909d85a gives incorrect permission to use special multiplication units when the format of instructions is wrong. (no CVSS)
- [CVE-2022-33021](https://cve.now/CVE-2022-33021.md): CVA6 commit 909d85a accesses invalid memory when reading the value of MHPMCOUNTER30. (no CVSS)
- [CVE-2022-33107](https://cve.now/CVE-2022-33107.md): ThinkPHP v6.0.12 was discovered to contain a deserialization vulnerability via the component vendor\\league\\flysystem-cached-adapter\\src\\Stor (no CVSS, topthink/framework)
- [CVE-2021-40642](https://cve.now/CVE-2021-40642.md): Textpattern CMS v4.8.7 and older vulnerability exists through Sensitive Cookie in HTTPS Session Without 'Secure' Attribute via textpattern/l (no CVSS)
- [CVE-2017-20112](https://cve.now/CVE-2017-20112.md): IVPN Client privileges management (CVSS 7.8, IVPN Client)
- [CVE-2017-20111](https://cve.now/CVE-2017-20111.md): Teleopti WFM Administration privileges management (CVSS 7.3, Teleopti WFM)
- [CVE-2017-20110](https://cve.now/CVE-2017-20110.md): Teleopti WFM Administration Credentials information disclosure (CVSS 4.3, Teleopti WFM)
- [CVE-2017-20109](https://cve.now/CVE-2017-20109.md): Teleopti WFM Administration GetOneTenant Credentials information disclosure (CVSS 4.3, Teleopti WFM)
- [CVE-2017-20108](https://cve.now/CVE-2017-20108.md): Easy Table Plugin options-general.php cross site scripting (CVSS 3.5, Easy Table Plugin)
- [CVE-2022-29272](https://cve.now/CVE-2022-29272.md): In Nagios XI through 5.8.5, an open redirect vulnerability exists in the login function that could lead to spoofing. (no CVSS)
- [CVE-2022-29271](https://cve.now/CVE-2022-29271.md): In Nagios XI through 5.8.5, a read-only Nagios user (due to an incorrect permission check) is able to schedule downtime for any host/service (no CVSS)
- [CVE-2022-29270](https://cve.now/CVE-2022-29270.md): In Nagios XI through 5.8.5, it is possible for a user without password verification to change his e-mail address. (no CVSS)
- [CVE-2022-29269](https://cve.now/CVE-2022-29269.md): In Nagios XI through 5.8.5, in the schedule report function, an authenticated attacker is able to inject HTML tags that lead to the reformat (no CVSS)
- [CVE-2022-28803](https://cve.now/CVE-2022-28803.md): In SilverStripe Framework through 2022-04-07, Stored XSS can occur in javascript link tags added via XMLHttpRequest (XHR). (no CVSS, silverstripe/framework)
- [CVE-2022-31266](https://cve.now/CVE-2022-31266.md): In ILIAS through 7.10, lack of verification when changing an email address (on the Profile Page) allows remote attackers to take over accoun (no CVSS)
- [CVE-2022-31897](https://cve.now/CVE-2022-31897.md): SourceCodester Zoo Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via public\_html/register\_visitor?msg=. (no CVSS)
- [CVE-2022-33639](https://cve.now/CVE-2022-33639.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 8.3, Microsoft Edge)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-06-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.