CVEs published May 3, 2022
109 CVEs were published on May 3, 2022: 2 critical, 26 high.
- Published
- 109
- Critical
- 2
- High
- 26
- Medium
- 31
- Low
- 1
- Unrated
- 49
- Now in CISA KEV
- 0
- Fix available
- 29
Most affected products
- Samsung Mobile Devices
- 10
- MediaTek MT6580, MT6739, MT6761, MT6762, MT6765, MT6768, MT…
- 8
- Cisco Firepower Threat Defense Software
- 7
- Cisco Adaptive Security Appliance (ASA) Software
- 6
- Cisco Firepower Management Center
- 6
- MediaTek MT6580, MT6731, MT6739, MT6761, MT6762, MT6765, MT…
- 4
- MediaTek MT6580, MT6735, MT6737, MT6739, MT6750, MT6750S, M…
- 4
- MediaTek MT9011, MT9215, MT9216, MT9220, MT9221, MT9255, MT…
- 4
- OpenSSL · openssl-src
- 3
- Accusoft ImageGear
- 2
Critical 2
High 26
- CVE-2021-27433ARM mbed-ualloc memory library Integer Overflow or WraparoundARM mbed-ualloc memory library
- CVE-2021-27439TencentOS-tiny Integer Overflow or WraparoundTencentOS-tiny
- CVE-2021-22680NXP MQX Integer Overflow or WraparoundNXP MQX
- CVE-2021-27421NXP MCUXpresso SDK Integer Overflow or WraparoundNXP MCUXpresso SDK
- CVE-2021-27431ARM CMSIS RTOS2 Integer Overflow or WraparoundARM CMSIS RTOS2
- CVE-2021-27435ARM mbed Integer Overflow or WraparoundARM mbed
- CVE-2021-27425Cesanta Software Mongoose-OS Integer Overflow or WraparoundCesanta Software Mongoose-OS
- CVE-2021-27419uClibc-ng Integer Overflow or WraparounduClibc-ng
- CVE-2021-27427RIOT OS Integer Overflow or WraparoundRIOT OS
- CVE-2022-28781Improper input validation in Settings prior to SMR-May-2022 Release 1 allows attackers to launch arbitrary activity with system privilege.Samsung Mobile Devices
- CVE-2022-23400A stack-based buffer overflow vulnerability exists in the IGXMPXMLParser::parseDelimiter functionality of Accusoft ImageGear 19.10.Accusoft ImageGear
- CVE-2021-22573Incorrect signature verification on Google-oauth-java-clientGoogle-oauth-java-client · com.google.oauth-client:google-o…
- CVE-2022-1473Resource leakage when decoding certificates and keysOpenSSL · openssl-src
- CVE-2022-0916Broken authentication on Logitech Options due to misvalidation of Oauth state parameterLogitech Options
- CVE-2022-23063Shopizer - Insufficient Session Expirationshopizer-ecommerce Shopizer
- CVE-2022-21949Multiple XXE vulnerabilities in OBSSUSE Open Build Service
- CVE-2022-20715Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Remote Access SSL VPN Denial of Service VulnerabilityCisco Adaptive Security Appliance (ASA) Software
- CVE-2022-20737Cisco Adaptive Security Appliance Software Clientless SSL VPN Heap Overflow VulnerabilityCisco Adaptive Security Appliance (ASA) Software
- CVE-2022-20742Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software IPsec IKEv2 VPN Information Disclosure VulnerabilityCisco Adaptive Security Appliance (ASA) Software
- CVE-2022-20767Cisco Firepower Threat Defense Software DNS Enforcement Denial of Service VulnerabilityCisco Firepower Threat Defense Software
- CVE-2022-20759Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Privilege Escalation VulnerabilityCisco Adaptive Security Appliance (ASA) Software
- CVE-2022-20760Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software DNS Inspection Denial of Service VulnerabilityCisco Adaptive Security Appliance (ASA) Software
- CVE-2022-20757Cisco Firepower Threat Defense Software Denial of Service VulnerabilityCisco Firepower Threat Defense Software
- CVE-2022-20751Cisco Firepower Threat Defense Software Snort Out of Memory Denial of Service VulnerabilityCisco Firepower Threat Defense Software
- CVE-2022-20746Cisco Firepower Threat Defense Software TCP Proxy Denial of Service VulnerabilityCisco Firepower Threat Defense Software
- CVE-2022-20745Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Denial of Service VulnerabilityCisco Adaptive Security Appliance (ASA) Software
Medium, low and unrated 81
- CVE-2022-27413Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the adminname parameter in admin.php.
- CVE-2021-27411Micrium OS Integer Overflow or WraparoundMicrium OS
- CVE-2021-27417eCosCentric eCosPro RTOS Integer Overflow or WraparoundeCosCentric eCosPro RTOS
- CVE-2022-1548Playbook members are allowed to escalate their membership privileges and perform actions restricted to playbook admins.Mattermost Playbooks
- CVE-2022-21743In ion, there is a possible use after free due to an integer overflow.MediaTek MT6580, MT6735, MT6737, MT6739, MT6750, MT6750S, M…
- CVE-2022-20111In ion, there is a possible use after free due to incorrect error handling.MediaTek MT6580, MT6735, MT6737, MT6739, MT6750, MT6750S, M…
- CVE-2022-20108In voice service, there is a possible out of bounds write due to a stack-based buffer overflow.MediaTek MT9011, MT9215, MT9216, MT9220, MT9221, MT9255, MT…
- CVE-2022-20107In subtitle service, there is a possible application crash due to an integer overflow.MediaTek MT9011, MT9215, MT9216, MT9220, MT9221, MT9255, MT…
- CVE-2022-20106In MM service, there is a possible out of bounds write due to a heap-based buffer overflow.MediaTek MT9011, MT9215, MT9216, MT9220, MT9221, MT9255, MT…
- CVE-2022-20105In MM service, there is a possible out of bounds write due to a stack-based buffer overflow.MediaTek MT9011, MT9215, MT9216, MT9220, MT9221, MT9255, MT…
- CVE-2022-20104In aee daemon, there is a possible information disclosure due to improper access control.MediaTek MT6580, MT6739, MT6761, MT6762, MT6765, MT6768, MT…
- CVE-2022-20103In aee daemon, there is a possible information disclosure due to symbolic link following.MediaTek MT6580, MT6739, MT6761, MT6762, MT6765, MT6768, MT…
- CVE-2022-20102In aee daemon, there is a possible information disclosure due to a missing permission check.MediaTek MT6580, MT6739, MT6761, MT6762, MT6765, MT6768, MT…
- CVE-2022-20101In aee daemon, there is a possible information disclosure due to a path traversal.MediaTek MT6580, MT6739, MT6761, MT6762, MT6765, MT6768, MT…
- CVE-2022-27330A cross-site scripting (XSS) vulnerability in /public/admin/index.php?add_product of E-Commerce Website v1.0 allows attackers to execute arb
- CVE-2022-20100In aee daemon, there is a possible information disclosure due to a missing permission check.MediaTek MT6580, MT6739, MT6761, MT6762, MT6765, MT6768, MT…
- CVE-2022-20099In aee daemon, there is a possible out of bounds write due to improper input validation.MediaTek MT6580, MT6739, MT6761, MT6762, MT6765, MT6768, MT…
- CVE-2022-20098In aee daemon, there is a possible information disclosure due to a missing permission check.MediaTek MT6580, MT6739, MT6761, MT6762, MT6765, MT6768, MT…
- CVE-2022-20097In aee daemon, there is a possible information disclosure due to a race condition.MediaTek MT6580, MT6739, MT6761, MT6762, MT6765, MT6768, MT…
- CVE-2022-20096In camera, there is a possible information disclosure due to uninitialized data.MediaTek MT6765, MT6768, MT6769, MT8183, MT8185, MT8385, MT…
- CVE-2022-20095In imgsensor, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6771, MT6779, MT6781, MT6785, MT6833, MT6853, MT…
- CVE-2022-20094In imgsensor, there is a possible out of bounds write due to an incorrect bounds check.MediaTek MT6771, MT6779, MT6781, MT6785, MT6833, MT6853, MT…
- CVE-2022-20093In telephony, there is a possible way to disable receiving SMS messages due to a missing permission check.MediaTek MT6731, MT6732, MT6735, MT6737, MT6739, MT6750, MT…
- CVE-2022-20092In alac decoder, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6761, MT6768, MT6779, MT6785, MT6833, MT6853, MT…
- CVE-2022-20091In aee driver, there is a possible use after free due to a race condition.MediaTek MT6580, MT6731, MT6739, MT6761, MT6762, MT6765, MT…
- CVE-2022-20090In aee driver, there is a possible use after free due to a race condition.MediaTek MT6580, MT6731, MT6739, MT6761, MT6762, MT6765, MT…
- CVE-2022-20089In aee driver, there is a possible memory corruption due to active debug code.MediaTek MT6580, MT6731, MT6739, MT6761, MT6762, MT6765, MT…
- CVE-2022-20088In aee driver, there is a possible reference count mistake due to incorrect error handling.MediaTek MT6580, MT6731, MT6739, MT6761, MT6762, MT6765, MT…
- CVE-2022-20087In ccu, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6833, MT6853, MT6873, MT6877, MT6885, MT6893
- CVE-2022-27313An arbitrary file deletion vulnerability in Gitea v1.16.3 allows attackers to cause a Denial of Service (DoS) via deleting the configurationcode.gitea.io/gitea
- CVE-2022-20085In netdiag, there is a possible symbolic link following due to an improper link resolution.MediaTek MT6580, MT6731, MT6735, MT6750S, MT6753, MT6755S,…
- CVE-2022-20110In ion, there is a possible use after free due to a race condition.MediaTek MT6580, MT6735, MT6737, MT6739, MT6750, MT6750S, M…
- CVE-2022-20109In ion, there is a possible use after free due to improper update of reference count.MediaTek MT6580, MT6735, MT6737, MT6739, MT6750, MT6750S, M…
- CVE-2022-20084In telephony, there is a possible way to disable receiving emergency broadcasts due to a missing permission check.MediaTek MT6731, MT6732, MT6735, MT6737, MT6739, MT6750, MT…
- CVE-2022-28793Given the TEE is compromised and controlled by the attacker, improper state maintenance in StrongBox allows attackers to change Android ROT Samsung Mobile Devices
- CVE-2022-28792DLL hijacking vulnerability in Gear IconX PC Manager prior to version 2.1.220405.51 allows attacker to execute arbitrary code.Samsung Mobile Gear IconX PC Manager
- CVE-2022-28791Improper input validation vulnerability in InstallAgent in Galaxy Store prior to version 4.5.41.8 allows attacker to overwrite files stored Samsung Mobile Galaxy Store
- CVE-2022-28790Improper authentication in Link to Windows Service prior to version 2.3.04.1 allows attacker to lock the device.Samsung Mobile Link to Windows Service
- CVE-2022-28789Unprotected activities in Voice Note prior to version 21.3.51.11 allows attackers to record voice without user interaction.Samsung Mobile Voice Note
- CVE-2022-28788Improper buffer size check logic in aviextractor library prior to SMR May-2022 Release 1 allows out of bounds read leading to possible tempoSamsung Mobile Devices
- CVE-2022-28787Improper buffer size check logic in wmfextractor library prior to SMR May-2022 Release 1 allows out of bounds read leading to possible tempoSamsung Mobile Devices
- CVE-2022-28786Improper buffer size check logic in aviextractor library prior to SMR May-2022 Release 1 allows out of bounds read leading to possible tempoSamsung Mobile Devices
- CVE-2022-28785Improper buffer size check logic in aviextractor library prior to SMR May-2022 Release 1 allows out of bounds read leading to possible tempoSamsung Mobile Devices
- CVE-2022-28784Path traversal vulnerability in Galaxy Themes prior to SMR May-2022 Release 1 allows attackers to list file names in arbitrary directory as Samsung Mobile Devices
- CVE-2022-28783Improper validation of removing package name in Galaxy Themes prior to SMR May-2022 Release 1 allows attackers to uninstall arbitrary packagSamsung Mobile Devices
- CVE-2022-28782Improper access control vulnerability in Contents To Window prior to SMR May-2022 Release 1 allows physical attacker to install package befoSamsung Mobile Devices
- CVE-2022-28780Improper access control vulnerability in Weather prior to SMR May-2022 Release 1 allows that attackers can access location information that Samsung Mobile Devices
- CVE-2022-1331Delta Electronics DMARS Improper Restriction of XML External Entity ReferenceDelta Electronics DMARS
- CVE-2022-22368IBM Spectrum Scale 5.1.0 through 5.1.3.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sIBM Spectrum Scale
- CVE-2021-29854IBM Maximo Asset Management 7.6.1.1 and 7.6.1.2 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST hIBM Maximo Asset Management
- CVE-2022-28599A stored cross-site scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 that allows an authenticated user to upload a malicious .pdf file
- CVE-2022-29001In SpringBootMovie <=1.2, the uploaded file suffix parameter is not filtered, resulting in arbitrary file upload vulnerability
- CVE-2022-28588In SpringBootMovie <=1.2 when adding movie names, malicious code can be stored because there are no filtering parameters, resulting in store
- CVE-2021-46440Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi before 3.6.9 and 4.x before 4.1.5 allows an attackstrapi · @strapi/strapi
- CVE-2022-28585EmpireCMS 7.5 has a SQL injection vulnerability in AdClass.php
- CVE-2022-27962Bluecms 1.6 has a SQL injection vulnerability at cooike.
- CVE-2022-28505Jfinal_cms 5.1.0 is vulnerable to SQL Injection via com.jflyfox.system.log.LogController.java.
- CVE-2022-0882Illegal access to Kernel log in Fuchsia Google Fuchsia Kernel
- CVE-2021-22556Integer Overflow in Fuchsia KernelGoogle Fuchsia Kernel
- CVE-2022-28561There is a stack overflow vulnerability in the /goform/setMacFilterCfg function in the httpd service of Tenda ax12 22.03.01.21_cn router.
- CVE-2022-28560There is a stack overflow vulnerability in the goform/fast_setting_wifi_set function in the httpd service of Tenda ac9 15.03.2.21_cn router.
- CVE-2022-1434Incorrect MAC key used in the RC4-MD5 ciphersuiteOpenSSL · openssl-src
- CVE-2022-1343OCSP_basic_verify may incorrectly verify the response signing certificateOpenSSL · openssl-src
- CVE-2022-28589A stored cross-site scripting (XSS) vulnerability in Pixelimity 1.0 allows attackers to execute arbitrary web scripts or HTML via the Title
- CVE-2022-28590A Remote Code Execution (RCE) vulnerability exists in Pixelimity 1.0 via admin/admin-ajax.php?action=install_theme.
- CVE-2021-39390Stored XSS in PartKeepr 1.4.0 Edit section in multiple api endpoints via name parameter.
- CVE-2021-42165MitraStar GPT-2541GNAC-N1 (HGU) 100VNZ0b33 devices allow remote authenticated users to obtain root access by executing command "deviceinfo s
- CVE-2021-41959JerryScript Git version 14ff5bf does not sufficiently track and release allocated memory via jerry-core/ecma/operations/ecma-regexp-object.c
- CVE-2021-42218OMPL v1.5.2 contains a memory leak in VFRRT.cpp
- CVE-2022-1554Path Traversal due to `send_file` call in clinical-genomics/scoutclinical-genomics/scout · scout-browser
- CVE-2022-20744Cisco Firepower Management Center Software Information Disclosure VulnerabilityCisco Firepower Management Center
- CVE-2022-20627Cisco Firepower Management Center Software Cross-Site Scripting VulnerabilitiesCisco Firepower Management Center
- CVE-2022-20628Cisco Firepower Management Center Software Cross-Site Scripting VulnerabilitiesCisco Firepower Management Center
- CVE-2022-20629Cisco Firepower Management Center Software Cross-Site Scripting VulnerabilitiesCisco Firepower Management Center
- CVE-2022-20729Cisco Firepower Threat Defense Software XML Injection VulnerabilityCisco Firepower Threat Defense Software
- CVE-2022-20730Cisco Firepower Threat Defense Software Security Intelligence DNS Feed Bypass VulnerabilityCisco Firepower Threat Defense Software
- CVE-2022-20740Cisco Firepower Management Center Software Cross-Site Scripting VulnerabilityCisco Firepower Management Center
- CVE-2022-20743Cisco Firepower Management Center File Upload Security Bypass VulnerabilityCisco Firepower Management Center
- CVE-2022-20748Cisco Firepower Threat Defense Software Local Malware Analysis Denial of Service VulnerabilityCisco Firepower Threat Defense Software
- CVE-2022-28118SiteServer CMS v7.x allows attackers to execute arbitrary code via a crafted plug-in.siteserver
- CVE-2022-29824In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows.