# CVEs published 2022-05-17

111 CVEs were published on May 17, 2022: 2 critical, 23 high. Days are UTC.

- [CVE-2022-29174](https://cve.now/CVE-2022-29174.md): Predictable password reset token may lead to account takeover in countly-server (CVSS 8.1, countly-server)
- [CVE-2022-1362](https://cve.now/CVE-2022-1362.md): Cambium Networks cnMaestro OS Command Injection (CVSS 5.0, Cambium Networks cnMaestro)
- [CVE-2022-1361](https://cve.now/CVE-2022-1361.md): Cambium Networks cnMaestro SQL Injection (CVSS 7.4, Cambium Networks cnMaestro)
- [CVE-2022-1360](https://cve.now/CVE-2022-1360.md): Cambium Networks cnMaestro OS Command Injection (CVSS 8.2, Cambium Networks cnMaestro)
- [CVE-2022-1359](https://cve.now/CVE-2022-1359.md): Cambium Networks cnMaestro Path Traversal (CVSS 5.7, Cambium Networks cnMaestro)
- [CVE-2022-1358](https://cve.now/CVE-2022-1358.md): Cambium Networks cnMaestro SQL Injection (CVSS 5.9, Cambium Networks cnMaestro)
- [CVE-2022-1356](https://cve.now/CVE-2022-1356.md): Cambium Networks cnMaestro use of Potentially Dangerous Function (CVSS 7.1, Cambium Networks cnMaestro)
- [CVE-2022-1357](https://cve.now/CVE-2022-1357.md): Cambium Networks cnMaestro OS Command Injection (CVSS 9.8, Cambium Networks cnMaestro)
- [CVE-2022-28616](https://cve.now/CVE-2022-28616.md): A remote server-side request forgery (ssrf) vulnerability was discovered in HPE OneView version(s): Prior to 7.0. (no CVSS, HPE OneView)
- [CVE-2022-23706](https://cve.now/CVE-2022-23706.md): A remote cross-site scripting (xss) vulnerability was discovered in HPE OneView version(s): Prior to 7.0. (no CVSS, HPE OneView)
- [CVE-2022-28617](https://cve.now/CVE-2022-28617.md): A remote bypass security restrictions vulnerability was discovered in HPE OneView version(s): Prior to 7.0. (no CVSS, HPE OneView)
- [CVE-2022-29435](https://cve.now/CVE-2022-29435.md): WordPress Code Snippets Extended plugin \<= 1.4.7 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Alexander Stokmann Code Snippets Extended)
- [CVE-2022-29436](https://cve.now/CVE-2022-29436.md): WordPress Code Snippets Extended plugin \<= 1.4.7 - Cross-Site Request Forgery (CSRF) vulnerability leading to Persistent Cross-Site… (CVSS 4.7, Alexander Stokmann Code Snippets Extended)
- [CVE-2022-1118](https://cve.now/CVE-2022-1118.md): Rockwell Automation ISaGRAF Deserialization of Untrusted Data (CVSS 8.6, Rockwell Automation Connected Component Workbench · Rock… +1)
- [CVE-2021-35249](https://cve.now/CVE-2021-35249.md): Domain Admin Broken Access Control (CVSS 4.3, SolarWinds Serv-U)
- [CVE-2022-30054](https://cve.now/CVE-2022-30054.md): In Covid 19 Travel Pass Management 1.0, the code parameter is vulnerable to SQL injection attacks. (no CVSS)
- [CVE-2022-30053](https://cve.now/CVE-2022-30053.md): In Toll Tax Management System 1.0, the id parameter appears to be vulnerable to SQL injection attacks. (no CVSS)
- [CVE-2022-30052](https://cve.now/CVE-2022-30052.md): In Home Clean Service System 1.0, the password parameter is vulnerable to SQL injection attacks. (no CVSS)
- [CVE-2022-0486](https://cve.now/CVE-2022-0486.md): Privileged Command Injection Vulnerability in Fidelis Network and Deception (CVSS 4.4, Fidelis Cybersecurity Fidelis Network · Fidelis Cybersecuri…)
- [CVE-2022-0997](https://cve.now/CVE-2022-0997.md): Local Privilege Escalation Vulnerability in Fidelis Network and Deception (CVSS 3.9, Fidelis Cybersecurity Fidelis Network · Fidelis Cybersecuri…)
- [CVE-2022-24388](https://cve.now/CVE-2022-24388.md): Authenticated Privileged Command Injection Vulnerability in Fidelis Network and Deception (CVSS 8.8, Fidelis Cybersecurity Fidelis Network · Fidelis Cybersecuri…)
- [CVE-2022-24389](https://cve.now/CVE-2022-24389.md): Authenticated Privileged Command Injection Vulnerability in Fidelis Network and Deception (CVSS 8.8, Fidelis Cybersecurity Fidelis Network · Fidelis Cybersecuri…)
- [CVE-2022-24390](https://cve.now/CVE-2022-24390.md): Authenticated Command Injection Vulnerability in Fidelis Network and Deception (CVSS 8.8, Fidelis Cybersecurity Fidelis Network · Fidelis Cybersecuri…)
- [CVE-2022-24391](https://cve.now/CVE-2022-24391.md): Authenticated SQL Injection Vulnerability in Fidelis Network and Deception (CVSS 8.8, Fidelis Cybersecurity Fidelis Network · Fidelis Cybersecuri…)
- [CVE-2022-24392](https://cve.now/CVE-2022-24392.md): Authenticated Command Injection Vulnerability in Fidelis Network and Deception (CVSS 8.8, Fidelis Cybersecurity Fidelis Network · Fidelis Cybersecuri…)
- [CVE-2022-30045](https://cve.now/CVE-2022-30045.md): An issue was discovered in libezxml.a in ezXML 0.8.6. (no CVSS)
- [CVE-2022-24393](https://cve.now/CVE-2022-24393.md): Authenticated Command Injection Vulnerability in Fidelis Network and Deception (CVSS 8.8, Fidelis Cybersecurity Fidelis Network · Fidelis Cybersecuri…)
- [CVE-2022-24394](https://cve.now/CVE-2022-24394.md): Authenticated Command Injection Vulnerability in Fidelis Network and Deception (CVSS 8.8, Fidelis Cybersecurity Fidelis Network · Fidelis Cybersecuri…)
- [CVE-2022-28192](https://cve.now/CVE-2022-28192.md): NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko), where it may lead to a use-after-free, which in turn… (CVSS 4.1, NVIDIA Virtual GPU Software and NVIDIA Cloud Gaming)
- [CVE-2022-28191](https://cve.now/CVE-2022-28191.md): NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko), where uncontrolled resource consumption can be… (CVSS 5.5, NVIDIA Virtual GPU Software and NVIDIA Cloud Gaming)
- [CVE-2022-28190](https://cve.now/CVE-2022-28190.md): NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where… (CVSS 5.5, NVIDIA GPU Display Driver)
- [CVE-2022-28189](https://cve.now/CVE-2022-28189.md): NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where a… (CVSS 5.5, NVIDIA GPU Display Driver)
- [CVE-2022-28188](https://cve.now/CVE-2022-28188.md): NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where… (CVSS 5.5, NVIDIA GPU Display Driver)
- [CVE-2022-28187](https://cve.now/CVE-2022-28187.md): NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where the memory management… (CVSS 5.5, NVIDIA GPU Display Driver)
- [CVE-2022-28186](https://cve.now/CVE-2022-28186.md): NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where… (CVSS 6.1, NVIDIA GPU Display Driver)
- [CVE-2022-28182](https://cve.now/CVE-2022-28182.md): NVIDIA GPU Display Driver for Windows contains a vulnerability in the DirectX11 user mode driver (nvwgf2um/x.dll), where an unauthorized… (CVSS 8.5, NVIDIA GPU Display Driver)
- [CVE-2022-24890](https://cve.now/CVE-2022-24890.md): Exposure of Private Personal Information to an Unauthorized Actor in Nextcloud Talk (CVSS 2.4, nextcloud security-advisories)
- [CVE-2022-30688](https://cve.now/CVE-2022-30688.md): needrestart 0.8 through 3.5 before 3.6 is prone to local privilege escalation. (no CVSS)
- [CVE-2022-29429](https://cve.now/CVE-2022-29429.md): WordPress Code Snippets Extended plugin \<= 1.4.7 - Cross-Site Request Forgery (CSRF) leading to Remote Code Execution (RCE) vulnerability (CVSS 8.8, Alexander Stokmann Code Snippets Extended)
- [CVE-2022-23674](https://cve.now/CVE-2022-23674.md): A remote authenticated stored cross-site scripting (xss) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4… (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2022-23675](https://cve.now/CVE-2022-23675.md): A remote authenticated stored cross-site scripting (xss) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4… (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2022-23673](https://cve.now/CVE-2022-23673.md): A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below… (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2022-23671](https://cve.now/CVE-2022-23671.md): A remote authenticated information disclosure vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below… (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2022-23672](https://cve.now/CVE-2022-23672.md): A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below… (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2022-23669](https://cve.now/CVE-2022-23669.md): A remote authorization bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and… (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2022-22775](https://cve.now/CVE-2022-22775.md): TIBCO ActiveMatrix BPM Reflected Cross Site Scripting (XSS) vulnerability (CVSS 8.1, TIBCO Software TIBCO BPM Enterprise)
- [CVE-2022-22773](https://cve.now/CVE-2022-22773.md): TIBCO JasperReports Server Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.7, TIBCO Software TIBCO JasperReports Server)
- [CVE-2022-24611](https://cve.now/CVE-2022-24611.md): Denial of Service (DoS) in the Z-Wave S0 NonceGet protocol specification in Silicon Labs Z-Wave 500 series allows local attackers to block… (no CVSS)
- [CVE-2022-30689](https://cve.now/CVE-2022-30689.md): HashiCorp Vault and Vault Enterprise from 1.10.0 to 1.10.2 did not correctly configure and enforce MFA on login after server restarts. (no CVSS, github.com/hashicorp/vault)
- [CVE-2022-29581](https://cve.now/CVE-2022-29581.md): Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege escalation to root. (CVSS 7.8, Linux Kernel)
- [CVE-2022-1116](https://cve.now/CVE-2022-1116.md): Integer Overflow or Wraparound vulnerability in io\_uring of Linux Kernel allows local attacker to cause memory corruption and escalate… (CVSS 7.8, Linux Kernel)
- [CVE-2022-22482](https://cve.now/CVE-2022-22482.md): IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5 and 6.1.0.0 through 6.1.1.0 could allow an authenticated user to… (CVSS 6.5, IBM Sterling B2B Integrator)
- [CVE-2022-22475](https://cve.now/CVE-2022-22475.md): IBM WebSphere Application Server Liberty and Open Liberty 17.0.0.3 through 22.0.0.5 are vulnerable to identity spoofing by an… (CVSS 5.0, IBM WebSphere Application Server Liberty)
- [CVE-2021-38872](https://cve.now/CVE-2021-38872.md): IBM DataPower Gateway 10.0.2.0, 10.0.3.0, 10.0.1.0 through 10.0.1.4, and 2018.4.1.0 through 2018.4.1.17 could allow a remote user to cause… (CVSS 5.3, IBM DataPower Gateway)
- [CVE-2021-29726](https://cve.now/CVE-2021-29726.md): IBM Sterling Secure Proxy 6.0.3 and IBM Secure External Authentication Server 6.0.3 does not properly ensure that a certificate is… (CVSS 5.3, IBM Secure External Authentication Server · IBM Sterling Se…)
- [CVE-2020-4994](https://cve.now/CVE-2020-4994.md): IBM DataPower Gateway 10.0.1.0 through 10.0.1.4 and 2018.4.1.0 through 2018.4.1.17 could allow a remote user to cause a temporary denial… (CVSS 5.3, IBM DataPower Gateway)
- [CVE-2022-30072](https://cve.now/CVE-2022-30072.md): WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via \\admin\\pages\\sections\_save.php namesection2 parameters. (no CVSS)
- [CVE-2022-30073](https://cve.now/CVE-2022-30073.md): WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via /admin/users/save.php. (no CVSS)
- [CVE-2022-22484](https://cve.now/CVE-2022-22484.md): IBM Spectrum Protect Operations Center 8.1.12 and 8.1.13 could allow a local attacker to obtain sensitive information, caused by plain… (CVSS 5.1, IBM Spectrum Protect Operations Center)
- [CVE-2020-4957](https://cve.now/CVE-2020-4957.md): IBM Security Identity Governance and Intelligence 5.2.6 could disclose sensitive information in URL parameters that could aid in future… (CVSS 5.3, IBM Security Identity Governance and Intelligence)
- [CVE-2022-24108](https://cve.now/CVE-2022-24108.md): The Skyoftech So Listing Tabs module 2.2.0 for OpenCart allows a remote attacker to inject a serialized PHP object via the setting… (no CVSS)
- [CVE-2022-24856](https://cve.now/CVE-2022-24856.md): Server-Side Request Forgery in FlyteConsole (CVSS 9.1, flyteorg flyteconsole)
- [CVE-2022-30972](https://cve.now/CVE-2022-30972.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Storable Configs Plugin 1.0 and earlier allows attackers to have Jenkins… (no CVSS, Jenkins project Jenkins Storable Configs Plugin · org.jvnet…)
- [CVE-2022-30971](https://cve.now/CVE-2022-30971.md): Jenkins Storable Configs Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (no CVSS, Jenkins project Jenkins Storable Configs Plugin · org.jvnet…)
- [CVE-2022-30970](https://cve.now/CVE-2022-30970.md): Jenkins Autocomplete Parameter Plugin 1.1 and earlier references Dropdown Autocomplete parameter and Auto Complete String parameter names… (no CVSS, Jenkins project Jenkins Autocomplete Parameter Plugin · org…)
- [CVE-2022-30969](https://cve.now/CVE-2022-30969.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Autocomplete Parameter Plugin 1.1 and earlier allows attackers to execute… (no CVSS, Jenkins project Jenkins Autocomplete Parameter Plugin · org…)
- [CVE-2022-30968](https://cve.now/CVE-2022-30968.md): Jenkins vboxwrapper Plugin 1.3 and earlier does not escape the name and description of VBox node parameters on views displaying… (no CVSS, Jenkins project Jenkins vboxwrapper Plugin · org.jenkins-ci…)
- [CVE-2022-30967](https://cve.now/CVE-2022-30967.md): Jenkins Selection tasks Plugin 1.0 and earlier does not escape the name and description of Script Selection task variable parameters on… (no CVSS, Jenkins project Jenkins Selection tasks Plugin · org.jvnet.…)
- [CVE-2022-30966](https://cve.now/CVE-2022-30966.md): Jenkins Random String Parameter Plugin 1.0 and earlier does not escape the name and description of Random String parameters on views… (no CVSS, Jenkins project Jenkins Random String Parameter Plugin · or…)
- [CVE-2022-30965](https://cve.now/CVE-2022-30965.md): Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name and description of Promotion Level parameters on views… (no CVSS, Jenkins project Jenkins Promoted Builds (Simple) Plugin · o…)
- [CVE-2022-30964](https://cve.now/CVE-2022-30964.md): Jenkins Multiselect parameter Plugin 1.3 and earlier does not escape the name and description of Multiselect parameters on views… (no CVSS, Jenkins project Jenkins Multiselect parameter Plugin · io.j…)
- [CVE-2022-30963](https://cve.now/CVE-2022-30963.md): Jenkins JDK Parameter Plugin 1.0 and earlier does not escape the name and description of JDK parameters on views displaying parameters… (no CVSS, Jenkins project Jenkins JDK Parameter Plugin · org.jenkins-…)
- [CVE-2022-30962](https://cve.now/CVE-2022-30962.md): Jenkins Global Variable String Parameter Plugin 1.2 and earlier does not escape the name and description of Global Variable String… (no CVSS, Jenkins project Jenkins Global Variable String Parameter Pl…)
- [CVE-2022-30961](https://cve.now/CVE-2022-30961.md): Jenkins Autocomplete Parameter Plugin 1.1 and earlier does not escape the name of Dropdown Autocomplete and Auto Complete String… (no CVSS, Jenkins project Jenkins Autocomplete Parameter Plugin · org…)
- [CVE-2022-30960](https://cve.now/CVE-2022-30960.md): Jenkins Application Detector Plugin 1.0.8 and earlier does not escape the name of Chois Application Version parameters on views displaying… (no CVSS, Jenkins project Jenkins Application Detector Plugin · org.j…)
- [CVE-2022-30959](https://cve.now/CVE-2022-30959.md): A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to connect to an… (no CVSS, Jenkins project Jenkins SSH Plugin · org.jenkins-ci.plugins…)
- [CVE-2022-30958](https://cve.now/CVE-2022-30958.md): A cross-site request forgery (CSRF) vulnerability in Jenkins SSH Plugin 2.6.1 and earlier allows attackers to connect to an… (no CVSS, Jenkins project Jenkins SSH Plugin · org.jenkins-ci.plugins…)
- [CVE-2022-30957](https://cve.now/CVE-2022-30957.md): A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to enumerate credentials… (no CVSS, Jenkins project Jenkins SSH Plugin · org.jenkins-ci.plugins…)
- [CVE-2022-30956](https://cve.now/CVE-2022-30956.md): Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a stored cross-site… (no CVSS, Jenkins project Jenkins Rundeck Plugin · org.jenkins-ci.plu…)
- [CVE-2022-30955](https://cve.now/CVE-2022-30955.md): Jenkins GitLab Plugin 1.5.31 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read… (no CVSS, Jenkins project Jenkins GitLab Plugin · org.jenkins-ci.plug…)
- [CVE-2022-30954](https://cve.now/CVE-2022-30954.md): Jenkins Blue Ocean Plugin 1.25.3 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with… (no CVSS, Jenkins project Jenkins Blue Ocean Plugin · io.jenkins.blue…)
- [CVE-2022-30953](https://cve.now/CVE-2022-30953.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an… (no CVSS, Jenkins project Jenkins Blue Ocean Plugin · io.jenkins.blue…)
- [CVE-2022-30951](https://cve.now/CVE-2022-30951.md): Jenkins WMI Windows Agents Plugin 1.8 and earlier includes the Windows Remote Command library does not implement access control… (no CVSS, Jenkins project Jenkins WMI Windows Agents Plugin · org.jen…)
- [CVE-2022-30950](https://cve.now/CVE-2022-30950.md): Jenkins WMI Windows Agents Plugin 1.8 and earlier includes the Windows Remote Command library which has a buffer overflow vulnerability… (no CVSS, Jenkins project Jenkins WMI Windows Agents Plugin · org.jen…)
- [CVE-2022-30949](https://cve.now/CVE-2022-30949.md): Jenkins REPO Plugin 1.14.0 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the… (no CVSS, Jenkins project Jenkins REPO Plugin · org.jenkins-ci.plu… +2)
- [CVE-2022-30948](https://cve.now/CVE-2022-30948.md): Jenkins Mercurial Plugin 2.16 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the… (no CVSS, Jenkins project Jenkins Mercurial Plugin · org.jenkins-ci.p…)
- [CVE-2022-30947](https://cve.now/CVE-2022-30947.md): Jenkins Git Plugin 4.11.1 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the… (no CVSS, Jenkins project Jenkins Git Plugin · org.jenkins-ci.plug… +2)
- [CVE-2022-30946](https://cve.now/CVE-2022-30946.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Script Security Plugin 1158.v7c1b\_73a\_69a\_08 and earlier allows attackers to… (no CVSS, Jenkins project Jenkins Script Security Plugin · org.jenkin…)
- [CVE-2022-30945](https://cve.now/CVE-2022-30945.md): Jenkins Pipeline: Groovy Plugin 2689.v434009a\_31b\_f1 and earlier allows loading any Groovy source files on the classpath of Jenkins and… (no CVSS, Jenkins project Jenkins Pipeline: Groovy Plugin · org.jenki…)
- [CVE-2022-29332](https://cve.now/CVE-2022-29332.md): D-LINK DIR-825 AC1200 R2 is vulnerable to Directory Traversal. (no CVSS)
- [CVE-2022-30110](https://cve.now/CVE-2022-30110.md): The file preview functionality in Jirafeau \< 4.4.0, which is enabled by default, could be exploited for cross site scripting. (no CVSS, mojo42/jirafeau)
- [CVE-2022-1711](https://cve.now/CVE-2022-1711.md): Server-Side Request Forgery (SSRF) in jgraph/drawio (CVSS 7.5, jgraph/drawio)
- [CVE-2021-42644](https://cve.now/CVE-2021-42644.md): cmseasy V7.7.5\_20211012 is affected by an arbitrary file read vulnerability. (no CVSS)
- [CVE-2021-42643](https://cve.now/CVE-2021-42643.md): cmseasy V7.7.5\_20211012 is affected by an arbitrary file write vulnerability. (no CVSS)
- [CVE-2021-42943](https://cve.now/CVE-2021-42943.md): Stored cross-site scripting (XSS) in admin/usermanager.php over IPPlan v4.92b allows remote attackers to inject arbitrary web script or… (no CVSS)
- [CVE-2022-1723](https://cve.now/CVE-2022-1723.md): Server-Side Request Forgery (SSRF) in jgraph/drawio (CVSS 7.5, jgraph/drawio)
- [CVE-2022-26650](https://cve.now/CVE-2022-26650.md): Apache ShenYu (incubating) Regular expression denial of service (no CVSS, Apache Software Foundation Apache ShenYu · org.apache.sh… +1)
- [CVE-2013-10001](https://cve.now/CVE-2013-10001.md): HTC One/Sense Mail Client certificate validation (CVSS 4.8, HTC One · HTC Sense)
- [CVE-2022-1753](https://cve.now/CVE-2022-1753.md): WoWonder Group requests.php access control (CVSS 5.4, WoWonder)
- [CVE-2022-1706](https://cve.now/CVE-2022-1706.md): A vulnerability was found in Ignition where ignition configs are accessible from unprivileged containers in VMs running on VMware products. (no CVSS, coreos/ignition · github.com/coreos/ignition +1)
- [CVE-2022-1733](https://cve.now/CVE-2022-1733.md): Heap-based Buffer Overflow in vim/vim (CVSS 6.6, vim/vim)
- [CVE-2022-1735](https://cve.now/CVE-2022-1735.md): Classic Buffer Overflow in vim/vim (CVSS 6.6, vim/vim)
- [CVE-2022-1769](https://cve.now/CVE-2022-1769.md): Buffer Over-read in vim/vim (CVSS 6.6, vim/vim)
- [CVE-2022-28181](https://cve.now/CVE-2022-28181.md): NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user on… (CVSS 8.5, NVIDIA GPU Display Driver)
- [CVE-2022-28183](https://cve.now/CVE-2022-28183.md): NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user can… (CVSS 7.7, NVIDIA GPU Display Driver)
- [CVE-2022-28184](https://cve.now/CVE-2022-28184.md): NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for… (CVSS 7.1, NVIDIA GPU Display Driver)
- [CVE-2022-28185](https://cve.now/CVE-2022-28185.md): NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the ECC layer, where an unprivileged regular user can cause an… (CVSS 6.8, NVIDIA GPU Display Driver)
- [CVE-2022-29162](https://cve.now/CVE-2022-29162.md): Incorrect Default Permissions in runc (CVSS 5.9, opencontainers runc · github.com/opencontainers/runc)
- [CVE-2022-30007](https://cve.now/CVE-2022-30007.md): GXCMS V1.5 has a file upload vulnerability in the background. (no CVSS)
- [CVE-2022-30067](https://cve.now/CVE-2022-30067.md): GIMP 2.10.30 and 2.99.10 are vulnerable to Buffer Overflow. (no CVSS)
- [CVE-2022-30952](https://cve.now/CVE-2022-30952.md): Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials… (no CVSS, Jenkins project Jenkins Pipeline SCM API for Blue Ocean Plu…)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2022-05-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.