# CVEs published 2022-05-18

77 CVEs were published on May 18, 2022: 1 critical, 19 high. Days are UTC.

- [CVE-2022-30138](https://cve.now/CVE-2022-30138.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-29229](https://cve.now/CVE-2022-29229.md): Missing Cryptographic Step in cassproject (CVSS 6.3, cassproject CASS · cassproject)
- [CVE-2022-1774](https://cve.now/CVE-2022-1774.md): Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawio (CVSS 8.2, jgraph/drawio)
- [CVE-2022-29230](https://cve.now/CVE-2022-29230.md): Potential cross-site scripting (XSS) vulnerability in Hydrogen (CVSS 6.3, Shopify hydrogen · @shopify/hydrogen)
- [CVE-2022-30991](https://cve.now/CVE-2022-30991.md): HTML injection via report name (no CVSS, Acronis Cyber Protect)
- [CVE-2022-30992](https://cve.now/CVE-2022-30992.md): Open redirect via user-controlled query parameter (no CVSS, Acronis Cyber Protect)
- [CVE-2022-30993](https://cve.now/CVE-2022-30993.md): Cleartext transmission of sensitive information (no CVSS, Acronis Cyber Protect)
- [CVE-2022-30994](https://cve.now/CVE-2022-30994.md): Cleartext transmission of sensitive information (no CVSS, Acronis Cyber Protect)
- [CVE-2022-30990](https://cve.now/CVE-2022-30990.md): Sensitive information disclosure due to insecure folder permissions (no CVSS, Acronis Cyber Protect · Acronis Agent)
- [CVE-2021-38944](https://cve.now/CVE-2021-38944.md): IBM DataPower Gateway 10.0.2.0 through 1.0.3.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 is vulnerable to HTTP header… (CVSS 4.8, IBM DataPower Gateway)
- [CVE-2022-30033](https://cve.now/CVE-2022-30033.md): Tenda TX9 Pro V22.03.02.10 is vulnerable to Buffer Overflow via the functtion setIPv6Status() in httpd module. (no CVSS)
- [CVE-2022-25617](https://cve.now/CVE-2022-25617.md): WordPress Code Snippets plugin \<= 2.14.3 - Reflected Cross-Site Scripting (XSS) vulnerability (CVSS 4.7, Code Snippets Pro Code Snippets)
- [CVE-2022-30600](https://cve.now/CVE-2022-30600.md): A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed. (no CVSS, moodle · moodle/moodle)
- [CVE-2022-30111](https://cve.now/CVE-2022-30111.md): Due to the use of an insecure algorithm for rolling codes in MCK Smartlock 1.0, allows attackers to unlock the mechanism via replay attacks. (no CVSS)
- [CVE-2022-28921](https://cve.now/CVE-2022-28921.md): A Cross-Site Request Forgery (CSRF) vulnerability discovered in BlogEngine.Net v3.3.8.0 allows unauthenticated attackers to read arbitrary… (no CVSS)
- [CVE-2022-30599](https://cve.now/CVE-2022-30599.md): A flaw was found in moodle where an SQL injection risk was identified in Badges code relating to configuring criteria. (no CVSS, moodle · moodle/moodle)
- [CVE-2022-30598](https://cve.now/CVE-2022-30598.md): A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise… (no CVSS, moodle · moodle/moodle)
- [CVE-2022-30597](https://cve.now/CVE-2022-30597.md): A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field. (no CVSS, moodle · moodle/moodle)
- [CVE-2022-22778](https://cve.now/CVE-2022-22778.md): TIBCO BusinessConnect Trading Community Management Cross-Site Request Forgery Vulnerability (CVSS 8.8, TIBCO Software TIBCO BusinessConnect Trading Community Mana…)
- [CVE-2022-22777](https://cve.now/CVE-2022-22777.md): TIBCO BusinessConnect Trading Community Management Reflected Cross Site Scripting Vulnerability (CVSS 6.1, TIBCO Software TIBCO BusinessConnect Trading Community Mana…)
- [CVE-2022-22776](https://cve.now/CVE-2022-22776.md): TIBCO BusinessConnect Trading Community Management Stored Cross Site Scripting Vulnerability (CVSS 8.0, TIBCO Software TIBCO BusinessConnect Trading Community Mana…)
- [CVE-2022-30596](https://cve.now/CVE-2022-30596.md): A flaw was found in moodle where ID numbers displayed when bulk allocating markers to assignments required additional sanitizing to… (no CVSS, moodle · moodle/moodle)
- [CVE-2022-29445](https://cve.now/CVE-2022-29445.md): WordPress Popup Box plugin \<= 2.1.2 - Authenticated Local File Inclusion (LFI) vulnerability (CVSS 6.8, Wow-Company Popup Box)
- [CVE-2022-0883](https://cve.now/CVE-2022-0883.md): Windows Unquoted/Trusted Service Paths (CVSS 7.3, Snow License Manager)
- [CVE-2022-25162](https://cve.now/CVE-2022-25162.md): Improper Input Validation vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U-xMy/z(x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with… (no CVSS, Mitsubishi Electric MELSEC iQ-F series FX5U-xMy/z(x=32,64,8…)
- [CVE-2022-28924](https://cve.now/CVE-2022-28924.md): An information disclosure vulnerability in UniverSIS-Students before v1.5.0 allows attackers to obtain sensitive information via a crafted… (no CVSS)
- [CVE-2022-25161](https://cve.now/CVE-2022-25161.md): Improper Input Validation vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U-xMy/z(x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with… (no CVSS, Mitsubishi Electric MELSEC iQ-F series FX5U-xMy/z(x=32,64,8…)
- [CVE-2022-1734](https://cve.now/CVE-2022-1734.md): A flaw in Linux Kernel found in nfcmrvl\_nci\_unregister\_dev() in drivers/nfc/nfcmrvl/main.c can lead to use after free both read or write… (no CVSS, kernel)
- [CVE-2021-42704](https://cve.now/CVE-2021-42704.md): Inkscape Out-of-bounds Write (CVSS 7.8, Inkscape)
- [CVE-2021-42702](https://cve.now/CVE-2021-42702.md): Inkscape Access of Uninitialized Pointer (CVSS 3.3, Inkscape)
- [CVE-2021-42700](https://cve.now/CVE-2021-42700.md): Inkscape Out-of-bounds Read (CVSS 3.3, Inkscape)
- [CVE-2022-1110](https://cve.now/CVE-2022-1110.md): A buffer overflow vulnerability in Lenovo Smart Standby Driver prior to version 4.1.50.0 could allow a local attacker to cause denial of… (CVSS 5.5, Lenovo Smart Standby Driver)
- [CVE-2021-42852](https://cve.now/CVE-2021-42852.md): A command injection vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an authenticated user to… (CVSS 8.0, Lenovo Personal Cloud Storage A1 · Lenovo Personal Cloud… +3)
- [CVE-2021-42851](https://cve.now/CVE-2021-42851.md): A vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to create a standard… (CVSS 6.3, Lenovo Personal Cloud Storage A1 · Lenovo Personal Cloud… +3)
- [CVE-2021-42850](https://cve.now/CVE-2021-42850.md): A weak default administrator password for the web interface and serial port was reported in some Lenovo Personal Cloud Storage devices… (CVSS 8.8, Lenovo Personal Cloud Storage A1 · Lenovo Personal Cloud… +3)
- [CVE-2021-42849](https://cve.now/CVE-2021-42849.md): A weak default password for the serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized… (CVSS 6.8, Lenovo Personal Cloud Storage A1 · Lenovo Personal Cloud… +3)
- [CVE-2021-42848](https://cve.now/CVE-2021-42848.md): An information disclosure vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated… (CVSS 4.3, Lenovo Personal Cloud Storage A1 · Lenovo Personal Cloud… +3)
- [CVE-2021-3969](https://cve.now/CVE-2021-3969.md): A Time of Check Time of Use (TOCTOU) vulnerability was reported in IMController, a software component of Lenovo System Interface… (CVSS 7.8, Lenovo IMController)
- [CVE-2021-3956](https://cve.now/CVE-2021-3956.md): A read-only authentication bypass vulnerability was reported in the Third Quarter 2021 release of Lenovo XClarity Controller (XCC)… (CVSS 4.3, Lenovo XClarity Controller)
- [CVE-2021-3922](https://cve.now/CVE-2021-3922.md): A race condition vulnerability was reported in IMController, a software component of Lenovo System Interface Foundation, prior to version… (CVSS 7.8, Lenovo IMController)
- [CVE-2022-22787](https://cve.now/CVE-2022-22787.md): Insufficient hostname validation during Clusterswitch message in Zoom Client for Meetings (CVSS 5.9, Zoom Video Communications Zoom Client for Meetings for A… +3)
- [CVE-2022-30105](https://cve.now/CVE-2022-30105.md): In Belkin N300 Firmware 1.00.08, the script located at /setting\_hidden.asp, which is accessible before and after configuring the device… (no CVSS)
- [CVE-2022-1767](https://cve.now/CVE-2022-1767.md): Server-Side Request Forgery (SSRF) in jgraph/drawio (CVSS 7.5, jgraph/drawio)
- [CVE-2022-22786](https://cve.now/CVE-2022-22786.md): Update package downgrade in Zoom Client for Meetings for Windows (CVSS 7.5, Zoom Video Communications Zoom Client for Meetings for Wind…)
- [CVE-2022-22785](https://cve.now/CVE-2022-22785.md): Improperly constrained session cookies in Zoom Client for Meetings (CVSS 5.9, Zoom Video Communications Zoom Client for Meetings for A… +3)
- [CVE-2022-22784](https://cve.now/CVE-2022-22784.md): Improper XML Parsing in Zoom Client for Meetings (CVSS 8.1, Zoom Video Communications Zoom Client for Meetings for A… +3)
- [CVE-2022-28917](https://cve.now/CVE-2022-28917.md): Tenda AX12 v22.03.01.21\_cn was discovered to contain a stack overflow via the lanIp parameter in /goform/AdvSetLanIp. (no CVSS)
- [CVE-2021-27548](https://cve.now/CVE-2021-27548.md): There is a Null Pointer Dereference vulnerability in the XFAScanner::scanNode() function in XFAScanner.cc in xpdf 4.03. (no CVSS)
- [CVE-2022-29646](https://cve.now/CVE-2022-29646.md): An access control issue in TOTOLINK A3100R V4.1.2cu.5050\_B20200504 and V4.1.2cu.5247\_B20211129 allows attackers to obtain sensitive… (no CVSS)
- [CVE-2022-29645](https://cve.now/CVE-2022-29645.md): TOTOLINK A3100R V4.1.2cu.5050\_B20200504 and V4.1.2cu.5247\_B20211129 were discovered to contain a hard coded password for root stored in… (no CVSS)
- [CVE-2022-29644](https://cve.now/CVE-2022-29644.md): TOTOLINK A3100R V4.1.2cu.5050\_B20200504 and V4.1.2cu.5247\_B20211129 were discovered to contain a hard coded password for the telnet… (no CVSS)
- [CVE-2022-29643](https://cve.now/CVE-2022-29643.md): TOTOLINK A3100R V4.1.2cu.5050\_B20200504 and V4.1.2cu.5247\_B20211129 were discovered to contain a stack overflow via the macAddress… (no CVSS)
- [CVE-2022-29642](https://cve.now/CVE-2022-29642.md): TOTOLINK A3100R V4.1.2cu.5050\_B20200504 and V4.1.2cu.5247\_B20211129 were discovered to contain a stack overflow via the url parameter in… (no CVSS)
- [CVE-2022-29641](https://cve.now/CVE-2022-29641.md): TOTOLINK A3100R V4.1.2cu.5050\_B20200504 and V4.1.2cu.5247\_B20211129 were discovered to contain a stack overflow via the startTime and… (no CVSS)
- [CVE-2022-29640](https://cve.now/CVE-2022-29640.md): TOTOLINK A3100R V4.1.2cu.5050\_B20200504 and V4.1.2cu.5247\_B20211129 were discovered to contain a stack overflow via the comment parameter… (no CVSS)
- [CVE-2022-29638](https://cve.now/CVE-2022-29638.md): TOTOLINK A3100R V4.1.2cu.5050\_B20200504 and V4.1.2cu.5247\_B20211129 were discovered to contain a stack overflow via the comment parameter… (no CVSS)
- [CVE-2022-29639](https://cve.now/CVE-2022-29639.md): TOTOLINK A3100R V4.1.2cu.5050\_B20200504 and V4.1.2cu.5247\_B20211129 were discovered to contain a command injection vulnerability via the… (no CVSS)
- [CVE-2022-28956](https://cve.now/CVE-2022-28956.md): An issue in the getcfg.php component of D-Link DIR816L\_FW206b01 allows attackers to access the device via a crafted payload. (no CVSS)
- [CVE-2022-28955](https://cve.now/CVE-2022-28955.md): An access control issue in D-Link DIR816L\_FW206b01 allows unauthenticated attackers to access folders folder\_view.php and category\_view.php. (no CVSS)
- [CVE-2022-23068](https://cve.now/CVE-2022-23068.md): ToolJet - HTML Injection in Invite New User (CVSS 5.4, ToolJet)
- [CVE-2022-23067](https://cve.now/CVE-2022-23067.md): ToolJet - Token Leakage via Referer Header (CVSS 8.8, ToolJet)
- [CVE-2022-1727](https://cve.now/CVE-2022-1727.md): Improper Input Validation in jgraph/drawio (CVSS 8.3, jgraph/drawio)
- [CVE-2022-1432](https://cve.now/CVE-2022-1432.md): Cross-site Scripting (XSS) - Generic in octoprint/octoprint (CVSS 7.5, octoprint/octoprint · octoprint)
- [CVE-2021-41946](https://cve.now/CVE-2021-41946.md): In FiberHome VDSL2 Modem HG150-Ub\_V3.0, a stored cross-site scripting (XSS) vulnerability in Parental Control --\> Access Time Restriction… (no CVSS)
- [CVE-2022-1430](https://cve.now/CVE-2022-1430.md): Cross-site Scripting (XSS) - DOM in octoprint/octoprint (CVSS 7.5, octoprint/octoprint · octoprint)
- [CVE-2022-29518](https://cve.now/CVE-2022-29518.md): Screen Creator Advance2, HMI GC-A2 series, and Real time remote monitoring and control tool Screen Creator Advance2 versions prior to… (no CVSS, KOYO ELECTRONICS INDUSTRIES CO. Screen Creator Advance2, HM…)
- [CVE-2022-29516](https://cve.now/CVE-2022-29516.md): The web console of FUJITSU Network IPCOM series (IPCOM EX2 IN(3200, 3500), IPCOM EX2 LB(1100, 3200, 3500), IPCOM EX2 SC(1100, 3200, 3500)… (no CVSS, FUJITSU LIMITED IPCOM EX2 series, IPCOM EX series, IPCOM VE…)
- [CVE-2022-28717](https://cve.now/CVE-2022-28717.md): Cross-site scripting vulnerability in Rebooter(WATCH BOOT nino RPC-M2C \[End of Sale\] all firmware versions, WATCH BOOT light RPC-M5C \[End… (no CVSS, MEIKYO ELECTRIC CO. Rebooter, PoE Rebooter, Scheduler, and…)
- [CVE-2022-27632](https://cve.now/CVE-2022-27632.md): Cross-site request forgery (CSRF) vulnerability in Rebooter(WATCH BOOT nino RPC-M2C \[End of Sale\] all firmware versions, WATCH BOOT light… (no CVSS, MEIKYO ELECTRIC CO. Rebooter, PoE Rebooter, Scheduler, and…)
- [CVE-2022-1782](https://cve.now/CVE-2022-1782.md): Cross-site Scripting (XSS) - Generic in erudika/para (CVSS 9.4, erudika/para · com.erudika:para-core)
- [CVE-2019-25061](https://cve.now/CVE-2019-25061.md): The random\_password\_generator (aka RandomPasswordGenerator) gem through 1.0.0 for Ruby uses Kernel#rand to generate passwords, which, due… (no CVSS, random\_password\_generator)
- [CVE-2022-30976](https://cve.now/CVE-2022-30976.md): GPAC 2.0.0 misuses a certain Unicode utf8\_wcslen (renamed gf\_utf8\_wcslen) function in utils/utf.c, resulting in a heap-based buffer… (no CVSS)
- [CVE-2022-1771](https://cve.now/CVE-2022-1771.md): Uncontrolled Recursion in vim/vim (CVSS 5.5, vim/vim)
- [CVE-2022-1795](https://cve.now/CVE-2022-1795.md): Use After Free in gpac/gpac (CVSS 7.3, gpac/gpac)
- [CVE-2022-30065](https://cve.now/CVE-2022-30065.md): A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk… (CVSS 7.8)
- [CVE-2022-30974](https://cve.now/CVE-2022-30974.md): compile in regexp.c in Artifex MuJS through 1.2.0 results in stack consumption because of unlimited recursion, a different issue than… (no CVSS)
- [CVE-2022-30975](https://cve.now/CVE-2022-30975.md): In Artifex MuJS through 1.2.0, jsP\_dumpsyntax in jsdump.c has a NULL pointer dereference, as demonstrated by mujs-pp. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2022-05-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.