# CVEs published 2022-05-03

109 CVEs were published on May 3, 2022: 2 critical, 26 high. Days are UTC.

- [CVE-2021-27433](https://cve.now/CVE-2021-27433.md): ARM mbed-ualloc memory library Integer Overflow or Wraparound (CVSS 7.3, ARM mbed-ualloc memory library)
- [CVE-2021-27439](https://cve.now/CVE-2021-27439.md): TencentOS-tiny Integer Overflow or Wraparound (CVSS 7.3, TencentOS-tiny)
- [CVE-2021-22680](https://cve.now/CVE-2021-22680.md): NXP MQX Integer Overflow or Wraparound (CVSS 7.3, NXP MQX)
- [CVE-2021-27421](https://cve.now/CVE-2021-27421.md): NXP MCUXpresso SDK Integer Overflow or Wraparound (CVSS 7.3, NXP MCUXpresso SDK)
- [CVE-2022-27413](https://cve.now/CVE-2022-27413.md): Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the adminname parameter in admin.php. (no CVSS)
- [CVE-2021-27431](https://cve.now/CVE-2021-27431.md): ARM CMSIS RTOS2 Integer Overflow or Wraparound (CVSS 7.3, ARM CMSIS RTOS2)
- [CVE-2021-27435](https://cve.now/CVE-2021-27435.md): ARM mbed Integer Overflow or Wraparound (CVSS 7.3, ARM mbed)
- [CVE-2021-27425](https://cve.now/CVE-2021-27425.md): Cesanta Software Mongoose-OS Integer Overflow or Wraparound (CVSS 7.3, Cesanta Software Mongoose-OS)
- [CVE-2021-27419](https://cve.now/CVE-2021-27419.md): uClibc-ng Integer Overflow or Wraparound (CVSS 7.3, uClibc-ng)
- [CVE-2021-27411](https://cve.now/CVE-2021-27411.md): Micrium OS Integer Overflow or Wraparound (CVSS 6.5, Micrium OS)
- [CVE-2021-27417](https://cve.now/CVE-2021-27417.md): eCosCentric eCosPro RTOS Integer Overflow or Wraparound (CVSS 4.6, eCosCentric eCosPro RTOS)
- [CVE-2021-27427](https://cve.now/CVE-2021-27427.md): RIOT OS Integer Overflow or Wraparound (CVSS 7.3, RIOT OS)
- [CVE-2022-1548](https://cve.now/CVE-2022-1548.md): Playbook members are allowed to escalate their membership privileges and perform actions restricted to playbook admins. (CVSS 3.7, Mattermost Playbooks)
- [CVE-2022-21743](https://cve.now/CVE-2022-21743.md): In ion, there is a possible use after free due to an integer overflow. (no CVSS, MediaTek MT6580, MT6735, MT6737, MT6739, MT6750, MT6750S, M…)
- [CVE-2022-20111](https://cve.now/CVE-2022-20111.md): In ion, there is a possible use after free due to incorrect error handling. (no CVSS, MediaTek MT6580, MT6735, MT6737, MT6739, MT6750, MT6750S, M…)
- [CVE-2022-20108](https://cve.now/CVE-2022-20108.md): In voice service, there is a possible out of bounds write due to a stack-based buffer overflow. (no CVSS, MediaTek MT9011, MT9215, MT9216, MT9220, MT9221, MT9255, MT…)
- [CVE-2022-20107](https://cve.now/CVE-2022-20107.md): In subtitle service, there is a possible application crash due to an integer overflow. (no CVSS, MediaTek MT9011, MT9215, MT9216, MT9220, MT9221, MT9255, MT…)
- [CVE-2022-20106](https://cve.now/CVE-2022-20106.md): In MM service, there is a possible out of bounds write due to a heap-based buffer overflow. (no CVSS, MediaTek MT9011, MT9215, MT9216, MT9220, MT9221, MT9255, MT…)
- [CVE-2022-20105](https://cve.now/CVE-2022-20105.md): In MM service, there is a possible out of bounds write due to a stack-based buffer overflow. (no CVSS, MediaTek MT9011, MT9215, MT9216, MT9220, MT9221, MT9255, MT…)
- [CVE-2022-20104](https://cve.now/CVE-2022-20104.md): In aee daemon, there is a possible information disclosure due to improper access control. (no CVSS, MediaTek MT6580, MT6739, MT6761, MT6762, MT6765, MT6768, MT…)
- [CVE-2022-20103](https://cve.now/CVE-2022-20103.md): In aee daemon, there is a possible information disclosure due to symbolic link following. (no CVSS, MediaTek MT6580, MT6739, MT6761, MT6762, MT6765, MT6768, MT…)
- [CVE-2022-20102](https://cve.now/CVE-2022-20102.md): In aee daemon, there is a possible information disclosure due to a missing permission check. (no CVSS, MediaTek MT6580, MT6739, MT6761, MT6762, MT6765, MT6768, MT…)
- [CVE-2022-20101](https://cve.now/CVE-2022-20101.md): In aee daemon, there is a possible information disclosure due to a path traversal. (no CVSS, MediaTek MT6580, MT6739, MT6761, MT6762, MT6765, MT6768, MT…)
- [CVE-2022-27330](https://cve.now/CVE-2022-27330.md): A cross-site scripting (XSS) vulnerability in /public/admin/index.php?add\_product of E-Commerce Website v1.0 allows attackers to execute arb (no CVSS)
- [CVE-2022-20100](https://cve.now/CVE-2022-20100.md): In aee daemon, there is a possible information disclosure due to a missing permission check. (no CVSS, MediaTek MT6580, MT6739, MT6761, MT6762, MT6765, MT6768, MT…)
- [CVE-2022-20099](https://cve.now/CVE-2022-20099.md): In aee daemon, there is a possible out of bounds write due to improper input validation. (no CVSS, MediaTek MT6580, MT6739, MT6761, MT6762, MT6765, MT6768, MT…)
- [CVE-2022-20098](https://cve.now/CVE-2022-20098.md): In aee daemon, there is a possible information disclosure due to a missing permission check. (no CVSS, MediaTek MT6580, MT6739, MT6761, MT6762, MT6765, MT6768, MT…)
- [CVE-2022-20097](https://cve.now/CVE-2022-20097.md): In aee daemon, there is a possible information disclosure due to a race condition. (no CVSS, MediaTek MT6580, MT6739, MT6761, MT6762, MT6765, MT6768, MT…)
- [CVE-2022-20096](https://cve.now/CVE-2022-20096.md): In camera, there is a possible information disclosure due to uninitialized data. (no CVSS, MediaTek MT6765, MT6768, MT6769, MT8183, MT8185, MT8385, MT…)
- [CVE-2022-20095](https://cve.now/CVE-2022-20095.md): In imgsensor, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT6771, MT6779, MT6781, MT6785, MT6833, MT6853, MT…)
- [CVE-2022-20094](https://cve.now/CVE-2022-20094.md): In imgsensor, there is a possible out of bounds write due to an incorrect bounds check. (no CVSS, MediaTek MT6771, MT6779, MT6781, MT6785, MT6833, MT6853, MT…)
- [CVE-2022-20093](https://cve.now/CVE-2022-20093.md): In telephony, there is a possible way to disable receiving SMS messages due to a missing permission check. (no CVSS, MediaTek MT6731, MT6732, MT6735, MT6737, MT6739, MT6750, MT…)
- [CVE-2022-20092](https://cve.now/CVE-2022-20092.md): In alac decoder, there is a possible out of bounds read due to a missing bounds check. (no CVSS, MediaTek MT6761, MT6768, MT6779, MT6785, MT6833, MT6853, MT…)
- [CVE-2022-20091](https://cve.now/CVE-2022-20091.md): In aee driver, there is a possible use after free due to a race condition. (no CVSS, MediaTek MT6580, MT6731, MT6739, MT6761, MT6762, MT6765, MT…)
- [CVE-2022-20090](https://cve.now/CVE-2022-20090.md): In aee driver, there is a possible use after free due to a race condition. (no CVSS, MediaTek MT6580, MT6731, MT6739, MT6761, MT6762, MT6765, MT…)
- [CVE-2022-20089](https://cve.now/CVE-2022-20089.md): In aee driver, there is a possible memory corruption due to active debug code. (no CVSS, MediaTek MT6580, MT6731, MT6739, MT6761, MT6762, MT6765, MT…)
- [CVE-2022-20088](https://cve.now/CVE-2022-20088.md): In aee driver, there is a possible reference count mistake due to incorrect error handling. (no CVSS, MediaTek MT6580, MT6731, MT6739, MT6761, MT6762, MT6765, MT…)
- [CVE-2022-20087](https://cve.now/CVE-2022-20087.md): In ccu, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT6833, MT6853, MT6873, MT6877, MT6885, MT6893)
- [CVE-2022-27313](https://cve.now/CVE-2022-27313.md): An arbitrary file deletion vulnerability in Gitea v1.16.3 allows attackers to cause a Denial of Service (DoS) via deleting the configuration (no CVSS, code.gitea.io/gitea)
- [CVE-2022-20085](https://cve.now/CVE-2022-20085.md): In netdiag, there is a possible symbolic link following due to an improper link resolution. (no CVSS, MediaTek MT6580, MT6731, MT6735, MT6750S, MT6753, MT6755S,…)
- [CVE-2022-20110](https://cve.now/CVE-2022-20110.md): In ion, there is a possible use after free due to a race condition. (no CVSS, MediaTek MT6580, MT6735, MT6737, MT6739, MT6750, MT6750S, M…)
- [CVE-2022-20109](https://cve.now/CVE-2022-20109.md): In ion, there is a possible use after free due to improper update of reference count. (no CVSS, MediaTek MT6580, MT6735, MT6737, MT6739, MT6750, MT6750S, M…)
- [CVE-2022-20084](https://cve.now/CVE-2022-20084.md): In telephony, there is a possible way to disable receiving emergency broadcasts due to a missing permission check. (no CVSS, MediaTek MT6731, MT6732, MT6735, MT6737, MT6739, MT6750, MT…)
- [CVE-2022-28793](https://cve.now/CVE-2022-28793.md): Given the TEE is compromised and controlled by the attacker, improper state maintenance in StrongBox allows attackers to change Android ROT (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2022-28792](https://cve.now/CVE-2022-28792.md): DLL hijacking vulnerability in Gear IconX PC Manager prior to version 2.1.220405.51 allows attacker to execute arbitrary code. (CVSS 6.2, Samsung Mobile Gear IconX PC Manager)
- [CVE-2022-28791](https://cve.now/CVE-2022-28791.md): Improper input validation vulnerability in InstallAgent in Galaxy Store prior to version 4.5.41.8 allows attacker to overwrite files stored (CVSS 6.2, Samsung Mobile Galaxy Store)
- [CVE-2022-28790](https://cve.now/CVE-2022-28790.md): Improper authentication in Link to Windows Service prior to version 2.3.04.1 allows attacker to lock the device. (CVSS 4.0, Samsung Mobile Link to Windows Service)
- [CVE-2022-28789](https://cve.now/CVE-2022-28789.md): Unprotected activities in Voice Note prior to version 21.3.51.11 allows attackers to record voice without user interaction. (CVSS 6.2, Samsung Mobile Voice Note)
- [CVE-2022-28788](https://cve.now/CVE-2022-28788.md): Improper buffer size check logic in aviextractor library prior to SMR May-2022 Release 1 allows out of bounds read leading to possible tempo (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2022-28787](https://cve.now/CVE-2022-28787.md): Improper buffer size check logic in wmfextractor library prior to SMR May-2022 Release 1 allows out of bounds read leading to possible tempo (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2022-28786](https://cve.now/CVE-2022-28786.md): Improper buffer size check logic in aviextractor library prior to SMR May-2022 Release 1 allows out of bounds read leading to possible tempo (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2022-28785](https://cve.now/CVE-2022-28785.md): Improper buffer size check logic in aviextractor library prior to SMR May-2022 Release 1 allows out of bounds read leading to possible tempo (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2022-28784](https://cve.now/CVE-2022-28784.md): Path traversal vulnerability in Galaxy Themes prior to SMR May-2022 Release 1 allows attackers to list file names in arbitrary directory as (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2022-28783](https://cve.now/CVE-2022-28783.md): Improper validation of removing package name in Galaxy Themes prior to SMR May-2022 Release 1 allows attackers to uninstall arbitrary packag (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2022-28782](https://cve.now/CVE-2022-28782.md): Improper access control vulnerability in Contents To Window prior to SMR May-2022 Release 1 allows physical attacker to install package befo (CVSS 4.6, Samsung Mobile Devices)
- [CVE-2022-28781](https://cve.now/CVE-2022-28781.md): Improper input validation in Settings prior to SMR-May-2022 Release 1 allows attackers to launch arbitrary activity with system privilege. (CVSS 7.7, Samsung Mobile Devices)
- [CVE-2022-28780](https://cve.now/CVE-2022-28780.md): Improper access control vulnerability in Weather prior to SMR May-2022 Release 1 allows that attackers can access location information that (CVSS 5.0, Samsung Mobile Devices)
- [CVE-2022-1331](https://cve.now/CVE-2022-1331.md): Delta Electronics DMARS Improper Restriction of XML External Entity Reference (CVSS 5.5, Delta Electronics DMARS)
- [CVE-2022-22368](https://cve.now/CVE-2022-22368.md): IBM Spectrum Scale 5.1.0 through 5.1.3.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly s (CVSS 5.9, IBM Spectrum Scale)
- [CVE-2021-29854](https://cve.now/CVE-2021-29854.md): IBM Maximo Asset Management 7.6.1.1 and 7.6.1.2 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST h (CVSS 5.4, IBM Maximo Asset Management)
- [CVE-2022-28599](https://cve.now/CVE-2022-28599.md): A stored cross-site scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 that allows an authenticated user to upload a malicious .pdf file (no CVSS)
- [CVE-2022-29001](https://cve.now/CVE-2022-29001.md): In SpringBootMovie \<=1.2, the uploaded file suffix parameter is not filtered, resulting in arbitrary file upload vulnerability (no CVSS)
- [CVE-2022-28588](https://cve.now/CVE-2022-28588.md): In SpringBootMovie \<=1.2 when adding movie names, malicious code can be stored because there are no filtering parameters, resulting in store (no CVSS)
- [CVE-2021-46440](https://cve.now/CVE-2021-46440.md): Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi before 3.6.9 and 4.x before 4.1.5 allows an attack (no CVSS, strapi · @strapi/strapi)
- [CVE-2022-28585](https://cve.now/CVE-2022-28585.md): EmpireCMS 7.5 has a SQL injection vulnerability in AdClass.php (no CVSS)
- [CVE-2022-27962](https://cve.now/CVE-2022-27962.md): Bluecms 1.6 has a SQL injection vulnerability at cooike. (no CVSS)
- [CVE-2022-28505](https://cve.now/CVE-2022-28505.md): Jfinal\_cms 5.1.0 is vulnerable to SQL Injection via com.jflyfox.system.log.LogController.java. (no CVSS)
- [CVE-2022-23400](https://cve.now/CVE-2022-23400.md): A stack-based buffer overflow vulnerability exists in the IGXMPXMLParser::parseDelimiter functionality of Accusoft ImageGear 19.10. (CVSS 7.1, Accusoft ImageGear)
- [CVE-2022-22137](https://cve.now/CVE-2022-22137.md): A memory corruption vulnerability exists in the ioca\_mys\_rgb\_allocate functionality of Accusoft ImageGear 19.10. (CVSS 9.8, Accusoft ImageGear)
- [CVE-2022-0882](https://cve.now/CVE-2022-0882.md): Illegal access to Kernel log in Fuchsia (CVSS 5.3, Google Fuchsia Kernel)
- [CVE-2021-22556](https://cve.now/CVE-2021-22556.md): Integer Overflow in Fuchsia Kernel (CVSS 5.3, Google Fuchsia Kernel)
- [CVE-2021-22573](https://cve.now/CVE-2021-22573.md): Incorrect signature verification on Google-oauth-java-client (CVSS 8.7, Google-oauth-java-client · com.google.oauth-client:google-o…)
- [CVE-2022-28561](https://cve.now/CVE-2022-28561.md): There is a stack overflow vulnerability in the /goform/setMacFilterCfg function in the httpd service of Tenda ax12 22.03.01.21\_cn router. (no CVSS)
- [CVE-2022-28560](https://cve.now/CVE-2022-28560.md): There is a stack overflow vulnerability in the goform/fast\_setting\_wifi\_set function in the httpd service of Tenda ac9 15.03.2.21\_cn router. (no CVSS)
- [CVE-2022-1473](https://cve.now/CVE-2022-1473.md): Resource leakage when decoding certificates and keys (CVSS 7.5, OpenSSL · openssl-src)
- [CVE-2022-1434](https://cve.now/CVE-2022-1434.md): Incorrect MAC key used in the RC4-MD5 ciphersuite (no CVSS, OpenSSL · openssl-src)
- [CVE-2022-1343](https://cve.now/CVE-2022-1343.md): OCSP\_basic\_verify may incorrectly verify the response signing certificate (CVSS 5.3, OpenSSL · openssl-src)
- [CVE-2022-1292](https://cve.now/CVE-2022-1292.md): The c\_rehash script allows command injection (CVSS 9.8, OpenSSL)
- [CVE-2022-28589](https://cve.now/CVE-2022-28589.md): A stored cross-site scripting (XSS) vulnerability in Pixelimity 1.0 allows attackers to execute arbitrary web scripts or HTML via the Title (no CVSS)
- [CVE-2022-28590](https://cve.now/CVE-2022-28590.md): A Remote Code Execution (RCE) vulnerability exists in Pixelimity 1.0 via admin/admin-ajax.php?action=install\_theme. (no CVSS)
- [CVE-2022-0916](https://cve.now/CVE-2022-0916.md): Broken authentication on Logitech Options due to misvalidation of Oauth state parameter (CVSS 8.4, Logitech Options)
- [CVE-2021-39390](https://cve.now/CVE-2021-39390.md): Stored XSS in PartKeepr 1.4.0 Edit section in multiple api endpoints via name parameter. (no CVSS)
- [CVE-2021-42165](https://cve.now/CVE-2021-42165.md): MitraStar GPT-2541GNAC-N1 (HGU) 100VNZ0b33 devices allow remote authenticated users to obtain root access by executing command "deviceinfo s (no CVSS)
- [CVE-2021-41959](https://cve.now/CVE-2021-41959.md): JerryScript Git version 14ff5bf does not sufficiently track and release allocated memory via jerry-core/ecma/operations/ecma-regexp-object.c (no CVSS)
- [CVE-2021-42218](https://cve.now/CVE-2021-42218.md): OMPL v1.5.2 contains a memory leak in VFRRT.cpp (no CVSS)
- [CVE-2022-23063](https://cve.now/CVE-2022-23063.md): Shopizer - Insufficient Session Expiration (CVSS 8.8, shopizer-ecommerce Shopizer)
- [CVE-2022-1554](https://cve.now/CVE-2022-1554.md): Path Traversal due to \`send\_file\` call in clinical-genomics/scout (CVSS 6.8, clinical-genomics/scout · scout-browser)
- [CVE-2022-21949](https://cve.now/CVE-2022-21949.md): Multiple XXE vulnerabilities in OBS (CVSS 8.8, SUSE Open Build Service)
- [CVE-2022-20744](https://cve.now/CVE-2022-20744.md): Cisco Firepower Management Center Software Information Disclosure Vulnerability (CVSS 4.3, Cisco Firepower Management Center)
- [CVE-2022-20627](https://cve.now/CVE-2022-20627.md): Cisco Firepower Management Center Software Cross-Site Scripting Vulnerabilities (CVSS 5.4, Cisco Firepower Management Center)
- [CVE-2022-20628](https://cve.now/CVE-2022-20628.md): Cisco Firepower Management Center Software Cross-Site Scripting Vulnerabilities (CVSS 5.4, Cisco Firepower Management Center)
- [CVE-2022-20629](https://cve.now/CVE-2022-20629.md): Cisco Firepower Management Center Software Cross-Site Scripting Vulnerabilities (CVSS 5.4, Cisco Firepower Management Center)
- [CVE-2022-20715](https://cve.now/CVE-2022-20715.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2022-20729](https://cve.now/CVE-2022-20729.md): Cisco Firepower Threat Defense Software XML Injection Vulnerability (CVSS 4.4, Cisco Firepower Threat Defense Software)
- [CVE-2022-20730](https://cve.now/CVE-2022-20730.md): Cisco Firepower Threat Defense Software Security Intelligence DNS Feed Bypass Vulnerability (CVSS 4.0, Cisco Firepower Threat Defense Software)
- [CVE-2022-20737](https://cve.now/CVE-2022-20737.md): Cisco Adaptive Security Appliance Software Clientless SSL VPN Heap Overflow Vulnerability (CVSS 8.5, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2022-20740](https://cve.now/CVE-2022-20740.md): Cisco Firepower Management Center Software Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Firepower Management Center)
- [CVE-2022-20742](https://cve.now/CVE-2022-20742.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software IPsec IKEv2 VPN Information Disclosure Vulnerability (CVSS 7.4, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2022-20743](https://cve.now/CVE-2022-20743.md): Cisco Firepower Management Center File Upload Security Bypass Vulnerability (CVSS 6.5, Cisco Firepower Management Center)
- [CVE-2022-20767](https://cve.now/CVE-2022-20767.md): Cisco Firepower Threat Defense Software DNS Enforcement Denial of Service Vulnerability (CVSS 8.6, Cisco Firepower Threat Defense Software)
- [CVE-2022-20759](https://cve.now/CVE-2022-20759.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Privilege Escalation Vulnerability (CVSS 8.8, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2022-20760](https://cve.now/CVE-2022-20760.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software DNS Inspection Denial of Service Vulnerability (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2022-20757](https://cve.now/CVE-2022-20757.md): Cisco Firepower Threat Defense Software Denial of Service Vulnerability (CVSS 8.6, Cisco Firepower Threat Defense Software)
- [CVE-2022-20751](https://cve.now/CVE-2022-20751.md): Cisco Firepower Threat Defense Software Snort Out of Memory Denial of Service Vulnerability (CVSS 8.6, Cisco Firepower Threat Defense Software)
- [CVE-2022-20748](https://cve.now/CVE-2022-20748.md): Cisco Firepower Threat Defense Software Local Malware Analysis Denial of Service Vulnerability (CVSS 5.3, Cisco Firepower Threat Defense Software)
- [CVE-2022-20746](https://cve.now/CVE-2022-20746.md): Cisco Firepower Threat Defense Software TCP Proxy Denial of Service Vulnerability (CVSS 8.6, Cisco Firepower Threat Defense Software)
- [CVE-2022-20745](https://cve.now/CVE-2022-20745.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Denial of Service Vulnerability (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2022-28118](https://cve.now/CVE-2022-28118.md): SiteServer CMS v7.x allows attackers to execute arbitrary code via a crafted plug-in. (no CVSS, siteserver)
- [CVE-2022-29824](https://cve.now/CVE-2022-29824.md): In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf\*) and tree.c (xmlBuffer\*) don't check for integer overflows. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-05-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.