# CVEs published 2022-05-04

77 CVEs were published on May 4, 2022: 6 critical, 9 high. Days are UTC.

- [CVE-2022-30292](https://cve.now/CVE-2022-30292.md): Heap-based buffer overflow in sqbaselib.cpp in SQUIRREL 3.2 due to lack of a certain sq\_reservestack call. (no CVSS)
- [CVE-2022-30288](https://cve.now/CVE-2022-30288.md): Agoo before 2.14.3 does not reject GraphQL fragment spreads that form cycles, leading to an application crash. (CVSS 7.5)
- [CVE-2022-30284](https://cve.now/CVE-2022-30284.md): In the python-libnmap package through 0.7.2 for Python, remote command execution can occur (if used in a client application that does not va (CVSS 9.0, python-libnmap)
- [CVE-2022-29155](https://cve.now/CVE-2022-29155.md): In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, vi (no CVSS, openldap)
- [CVE-2022-30241](https://cve.now/CVE-2022-30241.md): The jquery.json-viewer library through 1.4.0 for Node.js does not properly escape characters such as \< in a JSON object, as demonstrated by (no CVSS, jquery.json-viewer)
- [CVE-2022-29943](https://cve.now/CVE-2022-29943.md): Talend Administration Center has a vulnerability that allows an authenticated user to use XML External Entity (XXE) processing to achieve re (no CVSS)
- [CVE-2022-29942](https://cve.now/CVE-2022-29942.md): Talend Administration Center has a vulnerability that allows an authenticated user to use the Service Registry 'Add' functionality to perfor (no CVSS)
- [CVE-2022-25786](https://cve.now/CVE-2022-25786.md): GateManager debug interface is included in production builds (CVSS 4.9, Secomea GateManager)
- [CVE-2022-20799](https://cve.now/CVE-2022-20799.md): Cisco Small Business RV Series Routers Command Injection Vulnerabilities (CVSS 4.7, Cisco Small Business RV Series Router Firmware)
- [CVE-2022-20801](https://cve.now/CVE-2022-20801.md): Cisco Small Business RV Series Routers Command Injection Vulnerabilities (CVSS 4.7, Cisco Small Business RV Series Router Firmware)
- [CVE-2022-20796](https://cve.now/CVE-2022-20796.md): ClamAV Truncated File Denial of Service Vulnerability Affecting Cisco Products: April 2022 (CVSS 6.5, Cisco AMP for Endpoints)
- [CVE-2022-20794](https://cve.now/CVE-2022-20794.md): Cisco TelePresence Collaboration Endpoint and RoomOS Software Vulnerabilities (CVSS 6.5, Cisco RoomOS Software)
- [CVE-2022-20785](https://cve.now/CVE-2022-20785.md): ClamAV HTML Scanning Memory Leak Vulnerability Affecting Cisco Products: April 2022 (CVSS 7.5, Cisco AMP for Endpoints)
- [CVE-2022-20780](https://cve.now/CVE-2022-20780.md): Cisco Enterprise NFV Infrastructure Software Vulnerabilities (CVSS 9.9, Cisco Enterprise NFV Infrastructure Software)
- [CVE-2022-20779](https://cve.now/CVE-2022-20779.md): Cisco Enterprise NFV Infrastructure Software Vulnerabilities (CVSS 9.9, Cisco Enterprise NFV Infrastructure Software)
- [CVE-2022-20777](https://cve.now/CVE-2022-20777.md): Cisco Enterprise NFV Infrastructure Software Vulnerabilities (CVSS 9.9, Cisco Enterprise NFV Infrastructure Software)
- [CVE-2022-20771](https://cve.now/CVE-2022-20771.md): ClamAV TIFF File Parsing Denial of Service Vulnerability Affecting Cisco Products: April 2022 (CVSS 7.5, Cisco AMP for Endpoints)
- [CVE-2022-20770](https://cve.now/CVE-2022-20770.md): ClamAV CHM File Parsing Denial of Service Vulnerability Affecting Cisco Products: April 2022 (CVSS 8.6, Cisco AMP for Endpoints)
- [CVE-2022-20764](https://cve.now/CVE-2022-20764.md): Cisco TelePresence Collaboration Endpoint and RoomOS Software Vulnerabilities (CVSS 6.5, Cisco RoomOS Software)
- [CVE-2022-20753](https://cve.now/CVE-2022-20753.md): Cisco Small Business RV Series Routers Remote Code Execution Vulnerability (CVSS 4.7, Cisco Small Business RV Series Router Firmware)
- [CVE-2022-20734](https://cve.now/CVE-2022-20734.md): Cisco SD-WAN vManage Software Information Disclosure Vulnerability (CVSS 4.4, Cisco SD-WAN vManage)
- [CVE-2022-1584](https://cve.now/CVE-2022-1584.md): Reflected XSS in microweber/microweber (CVSS 6.3, microweber/microweber)
- [CVE-2021-42235](https://cve.now/CVE-2021-42235.md): SQL injection in osTicket before 1.14.8 and 1.15.4 login and password reset process allows attackers to access the osTicket administration p (no CVSS)
- [CVE-2022-23724](https://cve.now/CVE-2022-23724.md): PingID Integration for Windows Login MFA Bypass (CVSS 6.4, Ping Identity PingID Integration for Windows Login)
- [CVE-2022-28940](https://cve.now/CVE-2022-28940.md): In H3C MagicR100 \<=V100R005, the / Ajax / ajaxget interface can be accessed without authorization. (no CVSS)
- [CVE-2021-43206](https://cve.now/CVE-2021-43206.md): A server-generated error message containing sensitive information in Fortinet FortiOS 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.x, 6.0.x (CVSS 4.3, Fortinet FortiOS, FortiProxy)
- [CVE-2022-23443](https://cve.now/CVE-2022-23443.md): An improper access control in Fortinet FortiSOAR before 7.2.0 allows unauthenticated attackers to access gateway API data via crafted HTTP G (CVSS 7.5, Fortinet FortiSOAR)
- [CVE-2021-41032](https://cve.now/CVE-2021-41032.md): An improper access control vulnerability \[CWE-284\] in FortiOS versions 6.4.8 and prior and 7.0.3 and prior may allow an authenticated attack (CVSS 6.3, Fortinet FortiOS)
- [CVE-2021-41020](https://cve.now/CVE-2021-41020.md): An improper access control vulnerability \[CWE-284\] in FortiIsolator versions 2.3.2 and below may allow an authenticated, non privileged atta (CVSS 8.8, Fortinet FortiIsolator)
- [CVE-2021-20051](https://cve.now/CVE-2021-20051.md): SonicWall Global VPN Client 4.10.7.1117 installer (32-bit and 64-bit) and earlier versions have a DLL Search Order Hijacking vulnerability i (no CVSS, SonicWall Global VPN Client)
- [CVE-2022-28557](https://cve.now/CVE-2022-28557.md): There is a command injection vulnerability at the /goform/setsambacfg interface of Tenda AC15 US\_AC15V1.0BR\_V15.03.05.20\_multi\_TDE01.bin dev (no CVSS)
- [CVE-2022-28556](https://cve.now/CVE-2022-28556.md): Tenda AC15 US\_AC15V1.0BR\_V15.03.05.20\_multi\_TDE01.bin is vulnerable to Buffer Overflow. (no CVSS)
- [CVE-2022-28552](https://cve.now/CVE-2022-28552.md): Cscms 4.1 is vulnerable to SQL Injection. (no CVSS)
- [CVE-2022-28568](https://cve.now/CVE-2022-28568.md): Sourcecodester Doctor's Appointment System 1.0 is vulnerable to File Upload to RCE via Image upload from the administrator panel. (no CVSS)
- [CVE-2022-29347](https://cve.now/CVE-2022-29347.md): An arbitrary file upload vulnerability in Web@rchiv 1.0 allows attackers to execute arbitrary commands via a crafted PHP file. (no CVSS)
- [CVE-2022-28512](https://cve.now/CVE-2022-28512.md): A SQL injection vulnerability exists in Sourcecodester Fantastic Blog CMS 1.0 . (no CVSS)
- [CVE-2022-29950](https://cve.now/CVE-2022-29950.md): Experian Hunter 1.16 allows remote authenticated users to modify assumed-immutable elements via the (1) rule name parameter to the Rules pag (no CVSS)
- [CVE-2022-28488](https://cve.now/CVE-2022-28488.md): The function wav\_format\_write in libwav.c in libwav through 2017-04-20 has an Use of Uninitialized Variable vulnerability. (no CVSS)
- [CVE-2022-28806](https://cve.now/CVE-2022-28806.md): An issue was discovered on certain Fujitsu LIEFBOOK devices (A3510, U9310, U7511/U7411/U7311, U9311, E5510/E5410, U7510/U7410/U7310, E459/E4 (no CVSS)
- [CVE-2022-27461](https://cve.now/CVE-2022-27461.md): In nopCommerce 4.50.1, an open redirect vulnerability can be triggered by luring a user to authenticate to a nopCommerce page by clicking on (no CVSS)
- [CVE-2022-25787](https://cve.now/CVE-2022-25787.md): GTA URLs issued by LMM WEB API may leak information (CVSS 7.5, Secomea GateManager)
- [CVE-2022-25785](https://cve.now/CVE-2022-25785.md): Buffer overrun (CVSS 6.6, Secomea SiteManager)
- [CVE-2022-25784](https://cve.now/CVE-2022-25784.md): User controllable HTML element attribute (potential XSS) (CVSS 9.1, Secomea SiteManager)
- [CVE-2022-25783](https://cve.now/CVE-2022-25783.md): Hacking attempts from logged-in users are not properly logged by GM (CVSS 4.3, Secomea GateManager)
- [CVE-2022-25782](https://cve.now/CVE-2022-25782.md): Insufficient privilege checks on object access and updates. (CVSS 5.4, Secomea GateManager)
- [CVE-2022-25781](https://cve.now/CVE-2022-25781.md): Reflected XSS issues in GateManager (CVSS 4.2, Secomea GateManager)
- [CVE-2022-25780](https://cve.now/CVE-2022-25780.md): Information leak via device availability query function (CVSS 4.3, Secomea GateManager)
- [CVE-2022-25779](https://cve.now/CVE-2022-25779.md): Insufficient scope checks allows adding unrelated audit log entries (CVSS 4.3, Secomea GateManager)
- [CVE-2022-28508](https://cve.now/CVE-2022-28508.md): An XSS issue was discovered in browser\_search\_plugin.php in MantisBT before 2.25.2. (no CVSS, mantisbt/mantisbt)
- [CVE-2022-25778](https://cve.now/CVE-2022-25778.md): Unload handlers may unintentionally defeat CSRF guards (CVSS 4.2, Secomea GateManager)
- [CVE-2021-32010](https://cve.now/CVE-2021-32010.md): Clients may connect to a GateManager with TLS 1.0 (CVSS 5.6, Secomea SiteManager · Secomea LinkManager +1)
- [CVE-2022-28067](https://cve.now/CVE-2022-28067.md): An incorrect access control issue in Sandboxie Classic v5.55.13 allows attackers to cause a Denial of Service (DoS) in the Sandbox via a cra (no CVSS)
- [CVE-2022-28099](https://cve.now/CVE-2022-28099.md): Poultry Farm Management System v1.0 was discovered to contain a SQL injection vulnerability via the Item parameter at /farm/store.php. (no CVSS)
- [CVE-2022-28076](https://cve.now/CVE-2022-28076.md): Seacms v11.6 was discovered to contain a remote command execution (RCE) vulnerability via the Mail Server Settings. (no CVSS)
- [CVE-2022-27903](https://cve.now/CVE-2022-27903.md): An OS Command Injection vulnerability in the configuration parser of Eve-NG Professional through 4.0.1-65 and Eve-NG Community through 2.0.3 (no CVSS)
- [CVE-2022-28081](https://cve.now/CVE-2022-28081.md): A reflected cross-site scripting (XSS) vulnerability in the component Query.php of arPHP v3.6.0 allows attackers to execute arbitrary web sc (no CVSS)
- [CVE-2022-28082](https://cve.now/CVE-2022-28082.md): Tenda AX12 v22.03.01.21\_CN was discovered to contain a stack overflow via the list parameter at /goform/SetNetControlList. (no CVSS)
- [CVE-2022-28090](https://cve.now/CVE-2022-28090.md): Jspxcms v10.2.0 allows attackers to execute a Server-Side Request Forgery (SSRF) via /cmscp/ext/collect/fetch\_url.do?url=. (no CVSS)
- [CVE-2022-28096](https://cve.now/CVE-2022-28096.md): Skycaiji v2.4 was discovered to contain a remote code execution (RCE) vulnerability via /SkycaijiApp/admin/controller/Develop.php. (no CVSS)
- [CVE-2021-42185](https://cve.now/CVE-2021-42185.md): wdja v2.1 is affected by a SQL injection vulnerability in the foreground search function. (no CVSS)
- [CVE-2022-1571](https://cve.now/CVE-2022-1571.md): Cross-site scripting - Reflected in Create Subaccount in neorazorx/facturascripts (CVSS 9.9, neorazorx/facturascripts · facturascripts/facturascripts)
- [CVE-2022-1555](https://cve.now/CVE-2022-1555.md): DOM XSS in microweber ver 1.2.15 in microweber/microweber (CVSS 8.8, microweber/microweber)
- [CVE-2022-1502](https://cve.now/CVE-2022-1502.md): Permissions were not properly verified in the API on projects using version control in Git. (no CVSS, Octopus Deploy Octopus Server)
- [CVE-2022-28055](https://cve.now/CVE-2022-28055.md): Fusionpbx v4.4 and below contains a command injection vulnerability via the download email logs function. (no CVSS)
- [CVE-2022-27470](https://cve.now/CVE-2022-27470.md): SDL\_ttf v2.0.18 and below was discovered to contain an arbitrary memory write via the function TTF\_RenderText\_Solid(). (no CVSS)
- [CVE-2022-27431](https://cve.now/CVE-2022-27431.md): Wuzhicms v4.1.0 was discovered to contain a SQL injection vulnerability via the groupid parameter at /coreframe/app/member/admin/group.php. (no CVSS)
- [CVE-2022-27420](https://cve.now/CVE-2022-27420.md): Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the patient\_contact parameter in patientsearch.p (no CVSS)
- [CVE-2022-24901](https://cve.now/CVE-2022-24901.md): Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter (CVSS 7.5, parse-community parse-server · parse-server)
- [CVE-2021-43159](https://cve.now/CVE-2021-43159.md): A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW\_3.0(1)B11P55 (no CVSS)
- [CVE-2021-43162](https://cve.now/CVE-2021-43162.md): A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW\_3.0(1)B11P55 (no CVSS)
- [CVE-2021-43160](https://cve.now/CVE-2021-43160.md): A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW\_3.0(1)B11P55 (no CVSS)
- [CVE-2021-43161](https://cve.now/CVE-2021-43161.md): A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW\_3.0(1)B11P55 (no CVSS)
- [CVE-2021-43163](https://cve.now/CVE-2021-43163.md): A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW\_3.0(1)B11P55 (no CVSS)
- [CVE-2021-43164](https://cve.now/CVE-2021-43164.md): A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW\_3.0(1)B11P55 (no CVSS)
- [CVE-2021-42192](https://cve.now/CVE-2021-42192.md): Konga v0.14.9 is affected by an incorrect access control vulnerability where a specially crafted request can lead to privilege escalation. (no CVSS)
- [CVE-2022-28111](https://cve.now/CVE-2022-28111.md): MyBatis PageHelper v1.x.x-v3.7.0 v4.0.0-v5.0.0,v5.1.0-v5.3.0 was discovered to contain a time-blind SQL injection vulnerability via the orde (no CVSS, com.github.pagehelper:pagehelper)
- [CVE-2022-28487](https://cve.now/CVE-2022-28487.md): Tcpreplay version 4.4.1 contains a memory leakage flaw in fix\_ipv6\_checksums() function. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-05-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.