CVEs published May 2, 2022
76 CVEs were published on May 2, 2022: 12 critical, 10 high.
- Published
- 76
- Critical
- 12
- High
- 10
- Medium
- 6
- Low
- 3
- Unrated
- 45
- Now in CISA KEV
- 0
- Fix available
- 41
Most affected products
- Delta Electronics DIAEnergie
- 11
- Adobe XMP Toolkit
- 5
- SUSE Rancher · github.com/rancher/rancher
- 3
- AdRotate – Ad manager & AdSense Ads
- 2
- Micro Focus NetIQ Access Manager
- 2
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- 2
- Ad Invalid Click Protector
- 1
- Advanced Page Visit Counter – Advanced WordPress Visit Coun…
- 1
- All In One WP Security & Firewall
- 1
- Cloudways Breeze
- 1
Critical 12
- CVE-2022-1378Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_pgHandler.ashx.Delta Electronics DIAEnergie
- CVE-2022-1377Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_rltHandler.ashx.Delta Electronics DIAEnergie
- CVE-2022-1376Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_privgrpHandler.ashx.Delta Electronics DIAEnergie
- CVE-2022-1375Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_slogHandler.ashx.Delta Electronics DIAEnergie
- CVE-2022-1374Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_unHandler.ashx.Delta Electronics DIAEnergie
- CVE-2022-1372Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in dlSlog.aspx.Delta Electronics DIAEnergie
- CVE-2022-1371Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in ReadRegf.Delta Electronics DIAEnergie
- CVE-2022-1370Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in ReadREGbyID.Delta Electronics DIAEnergie
- CVE-2022-1369Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in ReadRegIND.Delta Electronics DIAEnergie
- CVE-2022-1367Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in Handler_TCV.ashx.Delta Electronics DIAEnergie
- CVE-2022-1366Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerChart.ashx.Delta Electronics DIAEnergie
- CVE-2022-1300Missing authentication in TRUMPF products may result in corruption of dataTRUMPF TruTops Boost · TRUMPF TruTops Fab
High 10
- CVE-2021-42529XMP-Toolkit SDK Stack-based Buffer Overflow Could Lead To Arbitrary Code ExecutionAdobe XMP Toolkit
- CVE-2021-42531XMP-Toolkit SDK Stack-based Buffer Overflow Could Lead To Arbitrary Code ExecutionAdobe XMP Toolkit
- CVE-2021-42530XMP-Toolkit SDK Stack-based Buffer Overflow Could Lead To Arbitrary Code ExecutionAdobe XMP Toolkit
- CVE-2021-42532XMP-Toolkit SDK Stack-based Buffer Overflow Could Lead To Arbitrary Code ExecutionAdobe XMP Toolkit
- CVE-2022-23723PingFederate PingOneMFA Integration Kit MFA BypassPing Identity PingFederate PingOne MFA Integration Kit
- CVE-2022-24897Arbitrary filesystem write access from Velocityxwiki-commons · org.xwiki.commons:xwiki-commons-velocity
- CVE-2022-28613Specially Crafted Modbus TCP Packet Vulnerability in RTU500 seriesHitachi Energy RTU500 series CMU Firmware
- CVE-2022-23064Snipe-IT - Host Header Injectionsnipe-it · snipe/snipe-it
- CVE-2021-36784Privilege escalation for users with create/update permissions in Global RolesSUSE Rancher · github.com/rancher/rancher
- CVE-2021-36778Exposure of repository credentials to external third-party sourcesSUSE Rancher · github.com/rancher/rancher
Medium, low and unrated 54
- CVE-2020-23621The Java Remote Management Interface of all versions of SVI MS Management System was discovered to contain a vulnerability due to insecure d
- CVE-2020-23620The Java Remote Management Interface of all versions of Orlansoft ERP was discovered to contain a vulnerability due to insecure deserializat
- CVE-2020-23618A reflected cross site scripting (XSS) vulnerability in Xtend Voice Logger 1.0 allows attackers to execute arbitrary web scripts or HTML, vi
- CVE-2020-23617A cross site scripting (XSS) vulnerability in the error page of Totolink N200RE and N100RE Routers 2.0 allows attackers to execute arbitrary
- CVE-2021-42528XMP-Toolkit Null Pointer Dereference Application denial-of-serviceAdobe XMP Toolkit
- CVE-2022-24974Links may not be rewritten according to policy in some specially formatted emails.
- CVE-2021-4138Improved Host header checks to reject requests not sent to a well-known local hostname or IP, or the server-specified hostname.Mozilla geckodriver
- CVE-2022-23722PingFederate Password Reset via Authentication API MishandlingPing Identity PingFederate
- CVE-2021-36844WordPress WP Subscribe plugin <= 1.2.12 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityMyThemeShop WP Subscribe
- CVE-2021-41810Script injection in M-Files AdminM-Files Server
- CVE-2022-29444WordPress Breeze plugin <= 2.0.2 - Plugin Settings Change leading to Cross-Site Scripting (XSS) vulnerabilityCloudways Breeze
- CVE-2022-1515A memory leak was discovered in matio 1.5.21 and earlier in Mat_VarReadNextInfo5() in mat5.c via a crafted file.matio
- CVE-2021-3750A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU.QEMU
- CVE-2021-3643A flaw was found in sox 14.4.1.sox
- CVE-2022-26326Potential open redirection vulnerability in NetIQ Access Manager versions prior to version 5.0.2Micro Focus NetIQ Access Manager
- CVE-2022-26325Cross Site Scripting vulnerability in NetIQ Access Manager versions prior to version 5.0.2Micro Focus NetIQ Access Manager
- CVE-2021-29859IBM ICP4A - User Management System Component (IBM Cloud Pak for Business Automation V21.0.3 through V21.0.3-IF008, V21.0.2 through V21.0.2-IIBM Cloud Pak for Business Automation
- CVE-2022-1282Photo Gallery < 1.6.3 - Reflected Cross-Site ScriptingPhoto Gallery by 10Web – Mobile-Friendly Image Gallery
- CVE-2022-1281Photo Gallery < 1.6.3 - Unauthenticated SQL InjectionPhoto Gallery by 10Web – Mobile-Friendly Image Gallery
- CVE-2022-1273Import WP < 2.4.6 - Admin+ Arbitrary File Upload to RCEImport WP – Import and Export WordPress data to XML or CSV…
- CVE-2022-1269Fast Flow < 1.2.12 - Reflected Cross-Site ScriptingFast Flow
- CVE-2022-1255Import and export users and customers < 1.19.2.1 - Admin+ Stored Cross-Site ScriptingImport and export users and customers
- CVE-2022-1250LifterLMS PayPal < 1.4.0 - Reflected Cross-Site ScriptingLifterLMS Paypal
- CVE-2022-1239HubSpot < 8.8.15 - Contributor+ Blind SSRFHubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics
- CVE-2022-1046Visual Form Builder < 3.0.7 - Admin+ Stored Cross-Site ScriptingVisual Form Builder
- CVE-2022-0952Sitemap by click5 < 1.0.36 - Unauthenticated Arbitrary Options UpdateSitemap by click5
- CVE-2022-0783Multiple Shipping Address Woocommerce < 2.0 - Unauthenticated SQLiMultiple Shipping Address Woocommerce
- CVE-2022-0773Documentor <= 1.5.3 - Unauthenticated SQLiDocumentor – Create Product Documentation
- CVE-2022-0771SiteSuperCharger < 5.2.0 - Unauthenticated SQLiSiteSuperCharger
- CVE-2022-0662Adrotate < 5.8.23 - Admin+ XSS via Advert NameAdRotate – Ad manager & AdSense Ads
- CVE-2022-0649Adrotate < 5.8.23 - Admin+ XSS via Group NameAdRotate – Ad manager & AdSense Ads
- CVE-2022-0428Content Egg < 5.3.0 - Reflected Cross-Site ScriptingContent Egg
- CVE-2022-0418Event List < 0.8.8 - Admin+ Stored Cross-Site ScriptingEvent List
- CVE-2022-0191Ad Invalid Click Protector (AICP) < 1.2.7 - Arbitrary Ban Deletion via CSRFAd Invalid Click Protector
- CVE-2021-25102All In One WP Security < 4.4.11 - Authenticated Reflected Cross-Site ScriptingAll In One WP Security & Firewall
- CVE-2021-25086Advanced Page Visit Counter < 6.1.2 - Unauthenticated Stored Cross-Site ScriptingAdvanced Page Visit Counter – Advanced WordPress Visit Coun…
- CVE-2021-25002Tipsacarrier < 1.5.0.5 - Unauthenticated Orders DisclosureTipsacarrier
- CVE-2022-28056ShopXO v2.2.5 and below was discovered to contain a system re-install vulnerability via the Add function in app/install/controller/Index.phpshopxo/shopxo
- CVE-2022-28054Improper sanitization of trigger action scripts in VanDyke Software VShell for Windows v4.6.2 allows attackers to execute arbitrary code via
- CVE-2022-27983RG-NBR-E Enterprise Gateway RG-NBR2100G-E was discovered to contain an arbitrary file read vulnerability via the url parameter in check.php.
- CVE-2022-27982RG-NBR-E Enterprise Gateway RG-NBR2100G-E was discovered to contain a remote code execution (RCE) vulnerability via the fileName parameter a
- CVE-2022-27466MCMS v5.2.27 was discovered to contain a SQL injection vulnerability in the orderBy parameter at /dict/list.do.
- CVE-2022-28573D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetNTPserverSeting.
- CVE-2022-28572Tenda AX1806 v1.0.0.1 was discovered to contain a command injection vulnerability in `SetIPv6Status` function
- CVE-2022-28571D-link 882 DIR882A1_FW130B06 was discovered to contain a command injection vulnerability in`/usr/bin/cli.
- CVE-2022-23065Vendure - XSS via SVG File Uploadvendure-ecommerce vendure
- CVE-2022-23904Rainworx Auctionworx < 3.1R2 is vulnerable to a Cross-Site Request Forgery (CSRF) attack that allows an authenticated user to upgrade his ac
- CVE-2021-4200Write access to the Catalog for any user when restricted-admin role is enabledSUSE Rancher · github.com/rancher/rancher
- CVE-2021-46790ntfsck in NTFS-3G through 2021.8.22 has a heap-based buffer overflow involving buffer+512*3-2.
- CVE-2022-29973relan exFAT 1.3.0 allows local users to obtain sensitive information (data from deleted files in the filesystem) in certain situations invol
- CVE-2022-29969The RSS extension before 2022-04-29 for MediaWiki allows XSS via an rss element (if the feed is in $wgRSSUrlWhitelist and $wgRSSAllowLinkTag
- CVE-2022-29968An issue was discovered in the Linux kernel through 5.17.5.
- CVE-2022-1475An integer overflow vulnerability was found in FFmpeg versions before 4.4.2 and before 5.0.1 in g729_parse() in llibavcodec/g729_parser.c whFFmpeg
- CVE-2022-29970Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.sinatra