CVEs published May 4, 2022
77 CVEs were published on May 4, 2022: 6 critical, 9 high.
- Published
- 77
- Critical
- 6
- High
- 9
- Medium
- 20
- Low
- 0
- Unrated
- 42
- Now in CISA KEV
- 0
- Fix available
- 19
Most affected products
- Secomea GateManager
- 8
- Cisco AMP for Endpoints
- 4
- Cisco Enterprise NFV Infrastructure Software
- 3
- Cisco Small Business RV Series Router Firmware
- 3
- Cisco RoomOS Software
- 2
- microweber/microweber
- 2
- Secomea SiteManager
- 2
- Cisco SD-WAN vManage
- 1
- com.github.pagehelper:pagehelper
- 1
- Fortinet FortiIsolator
- 1
Critical 6
- CVE-2022-30284In the python-libnmap package through 0.7.2 for Python, remote command execution can occur (if used in a client application that does not vapython-libnmap
- CVE-2022-20780Cisco Enterprise NFV Infrastructure Software VulnerabilitiesCisco Enterprise NFV Infrastructure Software
- CVE-2022-20779Cisco Enterprise NFV Infrastructure Software VulnerabilitiesCisco Enterprise NFV Infrastructure Software
- CVE-2022-20777Cisco Enterprise NFV Infrastructure Software VulnerabilitiesCisco Enterprise NFV Infrastructure Software
- CVE-2022-25784User controllable HTML element attribute (potential XSS)Secomea SiteManager
- CVE-2022-1571Cross-site scripting - Reflected in Create Subaccount in neorazorx/facturascriptsneorazorx/facturascripts · facturascripts/facturascripts
High 9
- CVE-2022-30288Agoo before 2.14.3 does not reject GraphQL fragment spreads that form cycles, leading to an application crash.
- CVE-2022-20785ClamAV HTML Scanning Memory Leak Vulnerability Affecting Cisco Products: April 2022Cisco AMP for Endpoints
- CVE-2022-20771ClamAV TIFF File Parsing Denial of Service Vulnerability Affecting Cisco Products: April 2022Cisco AMP for Endpoints
- CVE-2022-20770ClamAV CHM File Parsing Denial of Service Vulnerability Affecting Cisco Products: April 2022Cisco AMP for Endpoints
- CVE-2022-23443An improper access control in Fortinet FortiSOAR before 7.2.0 allows unauthenticated attackers to access gateway API data via crafted HTTP GFortinet FortiSOAR
- CVE-2021-41020An improper access control vulnerability [CWE-284] in FortiIsolator versions 2.3.2 and below may allow an authenticated, non privileged attaFortinet FortiIsolator
- CVE-2022-25787GTA URLs issued by LMM WEB API may leak informationSecomea GateManager
- CVE-2022-1555DOM XSS in microweber ver 1.2.15 in microweber/microwebermicroweber/microweber
- CVE-2022-24901Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter parse-community parse-server · parse-server
Medium, low and unrated 62
- CVE-2022-30292Heap-based buffer overflow in sqbaselib.cpp in SQUIRREL 3.2 due to lack of a certain sq_reservestack call.
- CVE-2022-29155In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, viopenldap
- CVE-2022-30241The jquery.json-viewer library through 1.4.0 for Node.js does not properly escape characters such as < in a JSON object, as demonstrated by jquery.json-viewer
- CVE-2022-29943Talend Administration Center has a vulnerability that allows an authenticated user to use XML External Entity (XXE) processing to achieve re
- CVE-2022-29942Talend Administration Center has a vulnerability that allows an authenticated user to use the Service Registry 'Add' functionality to perfor
- CVE-2022-25786GateManager debug interface is included in production buildsSecomea GateManager
- CVE-2022-20799Cisco Small Business RV Series Routers Command Injection VulnerabilitiesCisco Small Business RV Series Router Firmware
- CVE-2022-20801Cisco Small Business RV Series Routers Command Injection VulnerabilitiesCisco Small Business RV Series Router Firmware
- CVE-2022-20796ClamAV Truncated File Denial of Service Vulnerability Affecting Cisco Products: April 2022Cisco AMP for Endpoints
- CVE-2022-20794Cisco TelePresence Collaboration Endpoint and RoomOS Software VulnerabilitiesCisco RoomOS Software
- CVE-2022-20764Cisco TelePresence Collaboration Endpoint and RoomOS Software VulnerabilitiesCisco RoomOS Software
- CVE-2022-20753Cisco Small Business RV Series Routers Remote Code Execution VulnerabilityCisco Small Business RV Series Router Firmware
- CVE-2022-20734Cisco SD-WAN vManage Software Information Disclosure VulnerabilityCisco SD-WAN vManage
- CVE-2022-1584Reflected XSS in microweber/microwebermicroweber/microweber
- CVE-2021-42235SQL injection in osTicket before 1.14.8 and 1.15.4 login and password reset process allows attackers to access the osTicket administration p
- CVE-2022-23724PingID Integration for Windows Login MFA BypassPing Identity PingID Integration for Windows Login
- CVE-2022-28940In H3C MagicR100 <=V100R005, the / Ajax / ajaxget interface can be accessed without authorization.
- CVE-2021-43206A server-generated error message containing sensitive information in Fortinet FortiOS 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.x, 6.0.xFortinet FortiOS, FortiProxy
- CVE-2021-41032An improper access control vulnerability [CWE-284] in FortiOS versions 6.4.8 and prior and 7.0.3 and prior may allow an authenticated attackFortinet FortiOS
- CVE-2021-20051SonicWall Global VPN Client 4.10.7.1117 installer (32-bit and 64-bit) and earlier versions have a DLL Search Order Hijacking vulnerability iSonicWall Global VPN Client
- CVE-2022-28557There is a command injection vulnerability at the /goform/setsambacfg interface of Tenda AC15 US_AC15V1.0BR_V15.03.05.20_multi_TDE01.bin dev
- CVE-2022-28556Tenda AC15 US_AC15V1.0BR_V15.03.05.20_multi_TDE01.bin is vulnerable to Buffer Overflow.
- CVE-2022-28552Cscms 4.1 is vulnerable to SQL Injection.
- CVE-2022-28568Sourcecodester Doctor's Appointment System 1.0 is vulnerable to File Upload to RCE via Image upload from the administrator panel.
- CVE-2022-29347An arbitrary file upload vulnerability in Web@rchiv 1.0 allows attackers to execute arbitrary commands via a crafted PHP file.
- CVE-2022-28512A SQL injection vulnerability exists in Sourcecodester Fantastic Blog CMS 1.0 .
- CVE-2022-29950Experian Hunter 1.16 allows remote authenticated users to modify assumed-immutable elements via the (1) rule name parameter to the Rules pag
- CVE-2022-28488The function wav_format_write in libwav.c in libwav through 2017-04-20 has an Use of Uninitialized Variable vulnerability.
- CVE-2022-28806An issue was discovered on certain Fujitsu LIEFBOOK devices (A3510, U9310, U7511/U7411/U7311, U9311, E5510/E5410, U7510/U7410/U7310, E459/E4
- CVE-2022-27461In nopCommerce 4.50.1, an open redirect vulnerability can be triggered by luring a user to authenticate to a nopCommerce page by clicking on
- CVE-2022-25785Buffer overrunSecomea SiteManager
- CVE-2022-25783Hacking attempts from logged-in users are not properly logged by GMSecomea GateManager
- CVE-2022-25782Insufficient privilege checks on object access and updates.Secomea GateManager
- CVE-2022-25781Reflected XSS issues in GateManagerSecomea GateManager
- CVE-2022-25780Information leak via device availability query functionSecomea GateManager
- CVE-2022-25779Insufficient scope checks allows adding unrelated audit log entriesSecomea GateManager
- CVE-2022-28508An XSS issue was discovered in browser_search_plugin.php in MantisBT before 2.25.2.mantisbt/mantisbt
- CVE-2022-25778Unload handlers may unintentionally defeat CSRF guardsSecomea GateManager
- CVE-2021-32010Clients may connect to a GateManager with TLS 1.0Secomea SiteManager · Secomea LinkManager +1
- CVE-2022-28067An incorrect access control issue in Sandboxie Classic v5.55.13 allows attackers to cause a Denial of Service (DoS) in the Sandbox via a cra
- CVE-2022-28099Poultry Farm Management System v1.0 was discovered to contain a SQL injection vulnerability via the Item parameter at /farm/store.php.
- CVE-2022-28076Seacms v11.6 was discovered to contain a remote command execution (RCE) vulnerability via the Mail Server Settings.
- CVE-2022-27903An OS Command Injection vulnerability in the configuration parser of Eve-NG Professional through 4.0.1-65 and Eve-NG Community through 2.0.3
- CVE-2022-28081A reflected cross-site scripting (XSS) vulnerability in the component Query.php of arPHP v3.6.0 allows attackers to execute arbitrary web sc
- CVE-2022-28082Tenda AX12 v22.03.01.21_CN was discovered to contain a stack overflow via the list parameter at /goform/SetNetControlList.
- CVE-2022-28090Jspxcms v10.2.0 allows attackers to execute a Server-Side Request Forgery (SSRF) via /cmscp/ext/collect/fetch_url.do?url=.
- CVE-2022-28096Skycaiji v2.4 was discovered to contain a remote code execution (RCE) vulnerability via /SkycaijiApp/admin/controller/Develop.php.
- CVE-2021-42185wdja v2.1 is affected by a SQL injection vulnerability in the foreground search function.
- CVE-2022-1502Permissions were not properly verified in the API on projects using version control in Git.Octopus Deploy Octopus Server
- CVE-2022-28055Fusionpbx v4.4 and below contains a command injection vulnerability via the download email logs function.
- CVE-2022-27470SDL_ttf v2.0.18 and below was discovered to contain an arbitrary memory write via the function TTF_RenderText_Solid().
- CVE-2022-27431Wuzhicms v4.1.0 was discovered to contain a SQL injection vulnerability via the groupid parameter at /coreframe/app/member/admin/group.php.
- CVE-2022-27420Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the patient_contact parameter in patientsearch.p
- CVE-2021-43159A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55
- CVE-2021-43162A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55
- CVE-2021-43160A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55
- CVE-2021-43161A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55
- CVE-2021-43163A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55
- CVE-2021-43164A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55
- CVE-2021-42192Konga v0.14.9 is affected by an incorrect access control vulnerability where a specially crafted request can lead to privilege escalation.
- CVE-2022-28111MyBatis PageHelper v1.x.x-v3.7.0 v4.0.0-v5.0.0,v5.1.0-v5.3.0 was discovered to contain a time-blind SQL injection vulnerability via the ordecom.github.pagehelper:pagehelper
- CVE-2022-28487Tcpreplay version 4.4.1 contains a memory leakage flaw in fix_ipv6_checksums() function.