# CVEs published 2022-05-02

76 CVEs were published on May 2, 2022: 12 critical, 10 high. Days are UTC.

- [CVE-2020-23621](https://cve.now/CVE-2020-23621.md): The Java Remote Management Interface of all versions of SVI MS Management System was discovered to contain a vulnerability due to insecure d (no CVSS)
- [CVE-2020-23620](https://cve.now/CVE-2020-23620.md): The Java Remote Management Interface of all versions of Orlansoft ERP was discovered to contain a vulnerability due to insecure deserializat (no CVSS)
- [CVE-2020-23618](https://cve.now/CVE-2020-23618.md): A reflected cross site scripting (XSS) vulnerability in Xtend Voice Logger 1.0 allows attackers to execute arbitrary web scripts or HTML, vi (no CVSS)
- [CVE-2020-23617](https://cve.now/CVE-2020-23617.md): A cross site scripting (XSS) vulnerability in the error page of Totolink N200RE and N100RE Routers 2.0 allows attackers to execute arbitrary (no CVSS)
- [CVE-2021-42529](https://cve.now/CVE-2021-42529.md): XMP-Toolkit SDK Stack-based Buffer Overflow Could Lead To Arbitrary Code Execution (CVSS 7.8, Adobe XMP Toolkit)
- [CVE-2021-42531](https://cve.now/CVE-2021-42531.md): XMP-Toolkit SDK Stack-based Buffer Overflow Could Lead To Arbitrary Code Execution (CVSS 7.8, Adobe XMP Toolkit)
- [CVE-2021-42530](https://cve.now/CVE-2021-42530.md): XMP-Toolkit SDK Stack-based Buffer Overflow Could Lead To Arbitrary Code Execution (CVSS 7.8, Adobe XMP Toolkit)
- [CVE-2021-42532](https://cve.now/CVE-2021-42532.md): XMP-Toolkit SDK Stack-based Buffer Overflow Could Lead To Arbitrary Code Execution (CVSS 7.8, Adobe XMP Toolkit)
- [CVE-2021-42528](https://cve.now/CVE-2021-42528.md): XMP-Toolkit Null Pointer Dereference Application denial-of-service (CVSS 5.5, Adobe XMP Toolkit)
- [CVE-2022-24974](https://cve.now/CVE-2022-24974.md): Links may not be rewritten according to policy in some specially formatted emails. (no CVSS)
- [CVE-2021-4138](https://cve.now/CVE-2021-4138.md): Improved Host header checks to reject requests not sent to a well-known local hostname or IP, or the server-specified hostname. (no CVSS, Mozilla geckodriver)
- [CVE-2022-23723](https://cve.now/CVE-2022-23723.md): PingFederate PingOneMFA Integration Kit MFA Bypass (CVSS 7.7, Ping Identity PingFederate PingOne MFA Integration Kit)
- [CVE-2022-23722](https://cve.now/CVE-2022-23722.md): PingFederate Password Reset via Authentication API Mishandling (no CVSS, Ping Identity PingFederate)
- [CVE-2022-24897](https://cve.now/CVE-2022-24897.md): Arbitrary filesystem write access from Velocity (CVSS 7.5, xwiki-commons · org.xwiki.commons:xwiki-commons-velocity)
- [CVE-2021-36844](https://cve.now/CVE-2021-36844.md): WordPress WP Subscribe plugin \<= 1.2.12 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 3.4, MyThemeShop WP Subscribe)
- [CVE-2021-41810](https://cve.now/CVE-2021-41810.md): Script injection in M-Files Admin (CVSS 5.2, M-Files Server)
- [CVE-2022-29444](https://cve.now/CVE-2022-29444.md): WordPress Breeze plugin \<= 2.0.2 - Plugin Settings Change leading to Cross-Site Scripting (XSS) vulnerability (CVSS 6.5, Cloudways Breeze)
- [CVE-2022-28613](https://cve.now/CVE-2022-28613.md): Specially Crafted Modbus TCP Packet Vulnerability in RTU500 series (CVSS 7.5, Hitachi Energy RTU500 series CMU Firmware)
- [CVE-2022-1515](https://cve.now/CVE-2022-1515.md): A memory leak was discovered in matio 1.5.21 and earlier in Mat\_VarReadNextInfo5() in mat5.c via a crafted file. (no CVSS, matio)
- [CVE-2021-3750](https://cve.now/CVE-2021-3750.md): A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. (no CVSS, QEMU)
- [CVE-2021-3643](https://cve.now/CVE-2021-3643.md): A flaw was found in sox 14.4.1. (no CVSS, sox)
- [CVE-2022-26326](https://cve.now/CVE-2022-26326.md): Potential open redirection vulnerability in NetIQ Access Manager versions prior to version 5.0.2 (CVSS 4.0, Micro Focus NetIQ Access Manager)
- [CVE-2022-26325](https://cve.now/CVE-2022-26325.md): Cross Site Scripting vulnerability in NetIQ Access Manager versions prior to version 5.0.2 (CVSS 2.9, Micro Focus NetIQ Access Manager)
- [CVE-2022-1378](https://cve.now/CVE-2022-1378.md): Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE\_pgHandler.ashx. (CVSS 9.8, Delta Electronics DIAEnergie)
- [CVE-2022-1377](https://cve.now/CVE-2022-1377.md): Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE\_rltHandler.ashx. (CVSS 9.8, Delta Electronics DIAEnergie)
- [CVE-2022-1376](https://cve.now/CVE-2022-1376.md): Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE\_privgrpHandler.ashx. (CVSS 9.8, Delta Electronics DIAEnergie)
- [CVE-2022-1375](https://cve.now/CVE-2022-1375.md): Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE\_slogHandler.ashx. (CVSS 9.8, Delta Electronics DIAEnergie)
- [CVE-2022-1374](https://cve.now/CVE-2022-1374.md): Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE\_unHandler.ashx. (CVSS 9.8, Delta Electronics DIAEnergie)
- [CVE-2022-1372](https://cve.now/CVE-2022-1372.md): Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in dlSlog.aspx. (CVSS 9.8, Delta Electronics DIAEnergie)
- [CVE-2022-1371](https://cve.now/CVE-2022-1371.md): Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in ReadRegf. (CVSS 9.8, Delta Electronics DIAEnergie)
- [CVE-2022-1370](https://cve.now/CVE-2022-1370.md): Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in ReadREGbyID. (CVSS 9.8, Delta Electronics DIAEnergie)
- [CVE-2022-1369](https://cve.now/CVE-2022-1369.md): Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in ReadRegIND. (CVSS 9.8, Delta Electronics DIAEnergie)
- [CVE-2022-1367](https://cve.now/CVE-2022-1367.md): Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in Handler\_TCV.ashx. (CVSS 9.8, Delta Electronics DIAEnergie)
- [CVE-2022-1366](https://cve.now/CVE-2022-1366.md): Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerChart.ashx. (CVSS 9.8, Delta Electronics DIAEnergie)
- [CVE-2021-29859](https://cve.now/CVE-2021-29859.md): IBM ICP4A - User Management System Component (IBM Cloud Pak for Business Automation V21.0.3 through V21.0.3-IF008, V21.0.2 through V21.0.2-I (CVSS 3.5, IBM Cloud Pak for Business Automation)
- [CVE-2022-1282](https://cve.now/CVE-2022-1282.md): Photo Gallery \< 1.6.3 - Reflected Cross-Site Scripting (no CVSS, Photo Gallery by 10Web – Mobile-Friendly Image Gallery)
- [CVE-2022-1281](https://cve.now/CVE-2022-1281.md): Photo Gallery \< 1.6.3 - Unauthenticated SQL Injection (no CVSS, Photo Gallery by 10Web – Mobile-Friendly Image Gallery)
- [CVE-2022-1273](https://cve.now/CVE-2022-1273.md): Import WP \< 2.4.6 - Admin+ Arbitrary File Upload to RCE (no CVSS, Import WP – Import and Export WordPress data to XML or CSV…)
- [CVE-2022-1269](https://cve.now/CVE-2022-1269.md): Fast Flow \< 1.2.12 - Reflected Cross-Site Scripting (no CVSS, Fast Flow)
- [CVE-2022-1255](https://cve.now/CVE-2022-1255.md): Import and export users and customers \< 1.19.2.1 - Admin+ Stored Cross-Site Scripting (no CVSS, Import and export users and customers)
- [CVE-2022-1250](https://cve.now/CVE-2022-1250.md): LifterLMS PayPal \< 1.4.0 - Reflected Cross-Site Scripting (no CVSS, LifterLMS Paypal)
- [CVE-2022-1239](https://cve.now/CVE-2022-1239.md): HubSpot \< 8.8.15 - Contributor+ Blind SSRF (no CVSS, HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics)
- [CVE-2022-1046](https://cve.now/CVE-2022-1046.md): Visual Form Builder \< 3.0.7 - Admin+ Stored Cross-Site Scripting (no CVSS, Visual Form Builder)
- [CVE-2022-0952](https://cve.now/CVE-2022-0952.md): Sitemap by click5 \< 1.0.36 - Unauthenticated Arbitrary Options Update (no CVSS, Sitemap by click5)
- [CVE-2022-0783](https://cve.now/CVE-2022-0783.md): Multiple Shipping Address Woocommerce \< 2.0 - Unauthenticated SQLi (no CVSS, Multiple Shipping Address Woocommerce)
- [CVE-2022-0773](https://cve.now/CVE-2022-0773.md): Documentor \<= 1.5.3 - Unauthenticated SQLi (no CVSS, Documentor – Create Product Documentation)
- [CVE-2022-0771](https://cve.now/CVE-2022-0771.md): SiteSuperCharger \< 5.2.0 - Unauthenticated SQLi (no CVSS, SiteSuperCharger)
- [CVE-2022-0662](https://cve.now/CVE-2022-0662.md): Adrotate \< 5.8.23 - Admin+ XSS via Advert Name (no CVSS, AdRotate – Ad manager & AdSense Ads)
- [CVE-2022-0649](https://cve.now/CVE-2022-0649.md): Adrotate \< 5.8.23 - Admin+ XSS via Group Name (no CVSS, AdRotate – Ad manager & AdSense Ads)
- [CVE-2022-0428](https://cve.now/CVE-2022-0428.md): Content Egg \< 5.3.0 - Reflected Cross-Site Scripting (no CVSS, Content Egg)
- [CVE-2022-0418](https://cve.now/CVE-2022-0418.md): Event List \< 0.8.8 - Admin+ Stored Cross-Site Scripting (no CVSS, Event List)
- [CVE-2022-0191](https://cve.now/CVE-2022-0191.md): Ad Invalid Click Protector (AICP) \< 1.2.7 - Arbitrary Ban Deletion via CSRF (no CVSS, Ad Invalid Click Protector)
- [CVE-2021-25102](https://cve.now/CVE-2021-25102.md): All In One WP Security \< 4.4.11 - Authenticated Reflected Cross-Site Scripting (no CVSS, All In One WP Security & Firewall)
- [CVE-2021-25086](https://cve.now/CVE-2021-25086.md): Advanced Page Visit Counter \< 6.1.2 - Unauthenticated Stored Cross-Site Scripting (no CVSS, Advanced Page Visit Counter – Advanced WordPress Visit Coun…)
- [CVE-2021-25002](https://cve.now/CVE-2021-25002.md): Tipsacarrier \< 1.5.0.5 - Unauthenticated Orders Disclosure (no CVSS, Tipsacarrier)
- [CVE-2022-28056](https://cve.now/CVE-2022-28056.md): ShopXO v2.2.5 and below was discovered to contain a system re-install vulnerability via the Add function in app/install/controller/Index.php (no CVSS, shopxo/shopxo)
- [CVE-2022-28054](https://cve.now/CVE-2022-28054.md): Improper sanitization of trigger action scripts in VanDyke Software VShell for Windows v4.6.2 allows attackers to execute arbitrary code via (no CVSS)
- [CVE-2022-27983](https://cve.now/CVE-2022-27983.md): RG-NBR-E Enterprise Gateway RG-NBR2100G-E was discovered to contain an arbitrary file read vulnerability via the url parameter in check.php. (no CVSS)
- [CVE-2022-27982](https://cve.now/CVE-2022-27982.md): RG-NBR-E Enterprise Gateway RG-NBR2100G-E was discovered to contain a remote code execution (RCE) vulnerability via the fileName parameter a (no CVSS)
- [CVE-2022-27466](https://cve.now/CVE-2022-27466.md): MCMS v5.2.27 was discovered to contain a SQL injection vulnerability in the orderBy parameter at /dict/list.do. (no CVSS)
- [CVE-2022-28573](https://cve.now/CVE-2022-28573.md): D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetNTPserverSeting. (no CVSS)
- [CVE-2022-28572](https://cve.now/CVE-2022-28572.md): Tenda AX1806 v1.0.0.1 was discovered to contain a command injection vulnerability in \`SetIPv6Status\` function (no CVSS)
- [CVE-2022-28571](https://cve.now/CVE-2022-28571.md): D-link 882 DIR882A1\_FW130B06 was discovered to contain a command injection vulnerability in\`/usr/bin/cli. (no CVSS)
- [CVE-2022-23065](https://cve.now/CVE-2022-23065.md): Vendure - XSS via SVG File Upload (CVSS 5.4, vendure-ecommerce vendure)
- [CVE-2022-23064](https://cve.now/CVE-2022-23064.md): Snipe-IT - Host Header Injection (CVSS 8.8, snipe-it · snipe/snipe-it)
- [CVE-2022-23904](https://cve.now/CVE-2022-23904.md): Rainworx Auctionworx \< 3.1R2 is vulnerable to a Cross-Site Request Forgery (CSRF) attack that allows an authenticated user to upgrade his ac (no CVSS)
- [CVE-2022-1300](https://cve.now/CVE-2022-1300.md): Missing authentication in TRUMPF products may result in corruption of data (CVSS 9.8, TRUMPF TruTops Boost · TRUMPF TruTops Fab)
- [CVE-2021-4200](https://cve.now/CVE-2021-4200.md): Write access to the Catalog for any user when restricted-admin role is enabled (CVSS 5.4, SUSE Rancher · github.com/rancher/rancher)
- [CVE-2021-36784](https://cve.now/CVE-2021-36784.md): Privilege escalation for users with create/update permissions in Global Roles (CVSS 7.2, SUSE Rancher · github.com/rancher/rancher)
- [CVE-2021-36778](https://cve.now/CVE-2021-36778.md): Exposure of repository credentials to external third-party sources (CVSS 7.3, SUSE Rancher · github.com/rancher/rancher)
- [CVE-2021-46790](https://cve.now/CVE-2021-46790.md): ntfsck in NTFS-3G through 2021.8.22 has a heap-based buffer overflow involving buffer+512\*3-2. (no CVSS)
- [CVE-2022-29973](https://cve.now/CVE-2022-29973.md): relan exFAT 1.3.0 allows local users to obtain sensitive information (data from deleted files in the filesystem) in certain situations invol (no CVSS)
- [CVE-2022-29969](https://cve.now/CVE-2022-29969.md): The RSS extension before 2022-04-29 for MediaWiki allows XSS via an rss element (if the feed is in $wgRSSUrlWhitelist and $wgRSSAllowLinkTag (no CVSS)
- [CVE-2022-29968](https://cve.now/CVE-2022-29968.md): An issue was discovered in the Linux kernel through 5.17.5. (no CVSS)
- [CVE-2022-1475](https://cve.now/CVE-2022-1475.md): An integer overflow vulnerability was found in FFmpeg versions before 4.4.2 and before 5.0.1 in g729\_parse() in llibavcodec/g729\_parser.c wh (no CVSS, FFmpeg)
- [CVE-2022-29970](https://cve.now/CVE-2022-29970.md): Sinatra before 2.2.0 does not validate that the expanded path matches public\_dir when serving static files. (no CVSS, sinatra)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-05-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.