CVEs published May 5, 2022
128 CVEs were published on May 5, 2022: 7 critical, 36 high. 1 is now in CISA KEV.
- Published
- 128
- Critical
- 7
- High
- 36
- Medium
- 42
- Low
- 5
- Unrated
- 38
- Now in CISA KEV
- 1
- Fix available
- 75
Most affected products
- F5 BIG-IP
- 27
- F5 BIG-IP APM
- 5
- QNAP Systems QuTScloud · QNAP Systems QuTS hero +1
- 4
- IBM Robotic Process Automation
- 3
- OCI OpenDDS
- 3
- RTI Connext DDS Professional · RTI Connext DDS Secure
- 3
- Anker Eufy Homebase
- 2
- Eclipse CycloneDDS
- 2
- F5 BIG-IP · F5 BIG-IQ Centralized Management
- 2
- F5 Traffix SDC
- 2
Critical 7
- CVE-2022-24884Trivial signature forgery in ecdsautilsfreifunk-gluon ecdsautils
- CVE-2022-29176Unauthorized gem takeover for some gems on rubygems.orgrubygems.org
- CVE-2022-27588Vulnerability in QVRQNAP Systems QVR
- CVE-2022-1388On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior F5 BIG-IP
- CVE-2022-1575Arbitrary Code Execution through Sanitizer Bypass in jgraph/drawiojgraph/drawio
- CVE-2022-1411Unrestructed file upload in yetiforcecompany/yetiforcecrmyetiforcecompany/yetiforcecrm · yetiforce/yetiforce-crm
- CVE-2022-1592Server-Side Request Forgery in scout in clinical-genomics/scoutclinical-genomics/scout · scout-browser
High 36
- CVE-2022-24899Cross site scripting via canonical tagcontao · contao/core-bundle +1
- CVE-2022-29164Privilege Escalation in argo-workflowsargoproj argo-workflows · github.com/argoproj/argo-workflow…
- CVE-2022-29166Improper handling of multiline messages in matrix-appservice-ircmatrix-org matrix-appservice-irc · matrix-appservice-irc
- CVE-2022-29167ReDoS vulnerability in header parsing in hawkmozilla hawk · hawk
- CVE-2022-29173No protection against rollback attacks in go-tuftheupdateframework go-tuf · github.com/theupdateframework/g…
- CVE-2021-25268Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from MySophos admin to SFOS admin in Sophos Firewall older than versSophos Firewall
- CVE-2022-26073A denial of service vulnerability exists in the libxm_av.so DemuxCmdInBuffer functionality of Anker Eufy Homebase 2 2.1.8.5h.Anker Eufy Homebase
- CVE-2022-25989An authentication bypass vulnerability exists in the libxm_av.so getpeermac() functionality of Anker Eufy Homebase 2 2.1.8.5h.Anker Eufy Homebase
- CVE-2021-44057Improper authentication in Photo StationQNAP Systems Photo Station
- CVE-2021-44056Improper authentication in Video StationQNAP Systems Video Station
- CVE-2021-44051Command injectionQNAP Systems QuTScloud · QNAP Systems QuTS hero +1
- CVE-2022-29491On F5 BIG-IP LTM, Advanced WAF, ASM, or APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.F5 BIG-IP LTM, Advanced WAF, ASM, and APM
- CVE-2022-29263On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prF5 BIG-IP APM
- CVE-2022-28716On 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5,F5 BIG-IP
- CVE-2022-28714On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prF5 BIG-IP APM
- CVE-2022-28707On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, a stored cross-sitF5 BIG-IP
- CVE-2022-28705On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prF5 BIG-IP
- CVE-2022-28701On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, when the stream profile is configured on a virtual server, undisclosed requests can cause anF5 BIG-IP
- CVE-2022-28695On F5 BIG-IP AFM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versionF5 BIG-IP AFM
- CVE-2022-28691On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prioF5 BIG-IP
- CVE-2022-27806On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP Guided ConfigurF5 BIG-IP
- CVE-2022-26415On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior F5 BIG-IP
- CVE-2022-26372On F5 BIG-IP 15.1.x versions prior to 15.1.0.2, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1F5 BIG-IP
- CVE-2022-26071On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior F5 BIG-IP
- CVE-2022-25946On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP Guided ConfigurF5 BIG-IP
- CVE-2022-27230On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP APM, and F5 BIG-IP Guided Configuration (GC) all versionsF5 BIG-IP APM · F5 BIG-IP Guided Configuration
- CVE-2022-27189On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior F5 BIG-IP
- CVE-2022-26890On F5 BIG-IP Advanced WAF, ASM, and APM 16.1.x versions prior to 16.1.2.1, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.F5 BIG-IP Advanced WAF, ASM, and APM
- CVE-2021-38425eProsima Fast DDS Network AmplificationeProsima Fast DDS
- CVE-2021-43547TwinOaks Computing CoreDX DDS Secure Network AmplificationTwinOaks Computing CoreDX DDS
- CVE-2021-38487Potential Network Amplification and Information Exposure in RTI Connext Professional and Connext MicroRTI Connext Professional · RTI Connext Micro
- CVE-2021-38447OCI OpenDDS Secure AmplificationOCI OpenDDS
- CVE-2021-38445OCI OpenDDS Secure Improper Handling of Length Parameter InconsistencyOCI OpenDDS
- CVE-2021-38439GurumDDS Heap-based Buffer OverflowGurumNetworks GurumDDS
- CVE-2022-1464Stored xss bug in gogs/gogsgogs/gogs · gogs.io/gogs
- CVE-2022-24903Buffer overflow in TCP syslog server (receiver) components in rsyslogrsyslog
Medium, low and unrated 85
- CVE-2022-29161Crypto script service uses hashing algorithm SHA1 with RSA for certificate signature in xwiki-platformxwiki-platform · org.xwiki.platform:xwiki-platform-crypto
- CVE-2022-24902Memory issue in playing videosPaulleDemon tkVideoPlayer · tkvideoplayer
- CVE-2022-29171Remote Code Execution in sourcegraphsourcegraph
- CVE-2022-29172HTML injection with additional signup fieldsauth0 lock · auth0-lock
- CVE-2022-29535Zoho ManageEngine OPManager through 125588 allows SQL Injection via a few default reports.
- CVE-2022-27337A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.
- CVE-2022-27359Foxit PDF Reader before 12.0.1 and PDF Editor before 12.0.1 allow a this.maildoc NULL pointer dereference.
- CVE-2022-27360SpringBlade v3.2.0 and below was discovered to contain a SQL injection vulnerability via the component customSqlSegment.
- CVE-2022-27411TOTOLINK N600R v5.3c.5507_B20171031 was discovered to contain a command injection vulnerability via the QUERY_STRING parameter in the "Main"
- CVE-2021-25267Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 19.0Sophos Firewall
- CVE-2022-28583It is found that there is a command injection vulnerability in the setWiFiWpsCfg interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) route
- CVE-2022-28582It is found that there is a command injection vulnerability in the setWiFiSignalCfg interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) ro
- CVE-2022-28581It is found that there is a command injection vulnerability in the setWiFiAdvancedCfg interface in TOTOlink A7100RU (v7.4cu.2313_b20191024)
- CVE-2022-28580It is found that there is a command injection vulnerability in the setL2tpServerCfg interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) ro
- CVE-2022-28579It is found that there is a command injection vulnerability in the setParentalRules interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) ro
- CVE-2022-28578It is found that there is a command injection vulnerability in the setOpenVpnCfg interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) route
- CVE-2022-28577It is found that there is a command injection vulnerability in the delParentalRules interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) ro
- CVE-2022-28575It is found that there is a command injection vulnerability in the setopenvpnclientcfg interface in TOTOlink A7100RU (v7.4cu.2313_b20191024)
- CVE-2022-28584It is found that there is a command injection vulnerability in the setWiFiWpsStart interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) rou
- CVE-2021-44055Information leakage in Video StationQNAP Systems Video Station
- CVE-2021-44054Open redirectQNAP Systems QuTScloud · QNAP Systems QuTS hero +1
- CVE-2021-44053Reflected XSSQNAP Systems QTS · QNAP Systems QuTS hero +1
- CVE-2021-44052Arbitrary file readQNAP Systems QuTScloud · QNAP Systems QuTS hero +1
- CVE-2021-38693Path Traversal in thttpdQNAP Systems QuTScloud · QNAP Systems QuTS hero +1
- CVE-2022-29480On F5 BIG-IP 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, when multiple route domains are configured, undisclosedF5 BIG-IP
- CVE-2022-29479On F5 BIG-IP 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1F5 BIG-IP · F5 BIG-IQ Centralized Management
- CVE-2022-29474On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior F5 BIG-IP
- CVE-2022-29473On F5 BIG-IP 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when an IPSec ALG prF5 BIG-IP
- CVE-2022-28530Sourcecodester Covid-19 Directory on Vaccination System 1.0 is vulnerable to SQL Injection via cmdcategory.
- CVE-2022-28859On F5 BIG-IP 15.1.x versions prior to 15.1.5.1 and 14.1.x versions prior to 14.1.4.6, when installing Net HSM, the scripts (nethsm-safenet-iF5 BIG-IP
- CVE-2022-28708On F5 BIG-IP 16.1.x versions prior to 16.1.2.2 and 15.1.x versions prior to 15.1.5.1, when a BIG-IP DNS resolver-enabled, HTTP-Explicit or SF5 BIG-IP
- CVE-2022-28706On F5 BIG-IP 16.1.x versions prior to 16.1.2 and 15.1.x versions prior to 15.1.5.1, when the DNS resolver configuration is used, undisclosedF5 BIG-IP
- CVE-2022-27880On F5 Traffix SDC 5.2.x versions prior to 5.2.2 and 5.1.x versions prior to 5.1.35, a stored Cross-Site Scripting (XSS) vulnerability existsF5 Traffix SDC
- CVE-2022-27878On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP, and F5 BIG-IP Guided Configuration (GC) all versions priF5 BIG-IP
- CVE-2022-27875On F5 Access for Android 3.x versions prior to 3.0.8, a Task Hijacking vulnerability exists in the F5 Access for Android application, which F5 Access for Android
- CVE-2022-27662On F5 Traffix SDC 5.2.x versions prior to 5.2.2 and 5.1.x versions prior to 5.1.35, a stored Cross-Site Template Injection vulnerability exiF5 Traffix SDC
- CVE-2022-26517On F5 BIG-IP 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when the BIG-IP CGNAF5 BIG-IP
- CVE-2022-26370On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, and 14.1.x versions prior to 14.1.4.6, when a Session InitiF5 BIG-IP
- CVE-2022-26340On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior F5 BIG-IP · F5 BIG-IQ Centralized Management
- CVE-2022-26130On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prF5 BIG-IP
- CVE-2022-28533Sourcecodester Medical Hub Directory Site 1.0 is vulnerable to SQL Injection via /mhds/clinic/view_details.php.
- CVE-2022-25990On 1.0.x versions prior to 1.0.1, systems running F5OS-A software may expose certain registry ports externally.F5OS-A
- CVE-2022-1468On all versions of 17.0.x, 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x on F5 BIG-IP, an authenticated iControl REST user with at leasF5 BIG-IP
- CVE-2022-1389On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP (fixed in 17.0.0), a cross-site request forgery (CSRF) vuF5 BIG-IP
- CVE-2022-27659On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, an authenticated aF5 BIG-IP
- CVE-2022-29500SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Information Disclosure.
- CVE-2022-29501SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Escalation of Privileges and code execution.
- CVE-2022-29502SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Escalation of Privileges.
- CVE-2022-27636On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prF5 BIG-IP APM
- CVE-2022-27634On 16.1.x versions prior to 16.1.2.2 and 15.1.x versions prior to 15.1.5.1, BIG-IP APM does not properly validate configurations, allowing aF5 BIG-IP APM
- CVE-2022-27495On all versions 1.3.x (fixed in 1.4.0) NGINX Service Mesh control plane endpoints are exposed to the cluster overlay network.F5 NGINX Service Mesh
- CVE-2022-27182On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, when BIG-IP packetF5 BIG-IP
- CVE-2022-27181On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prF5 BIG-IP APM
- CVE-2022-28080Royal Event Management System v1.0 was discovered to contain a SQL injection vulnerability via the todate parameter.
- CVE-2022-26835On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior F5 BIG-IP
- CVE-2022-28120Beijing Runnier Network Technology Co., Ltd Open virtual simulation experiment teaching management platform software 2.0 has a file upload v
- CVE-2022-22434IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a user with physical access to create an API request modified to creatIBM Robotic Process Automation
- CVE-2022-22433IBM Robotic Process Automation 21.0.1 and 21.0.2 is vulnerable to External Service Interaction attack, caused by improper validation of userIBM Robotic Process Automation
- CVE-2022-28606An arbitrary file upload vulnerability exists in Wenzhou Huoyin Information Technology Co., Ltd.
- CVE-2022-22415A vulnerability exists where an IBM Robotic Process Automation 21.0.1 regular user is able to obtain view-only access to some admin pages inIBM Robotic Process Automation
- CVE-2021-39020IBM Guardium Data Encryption (GDE) 4.0.0.7 and lower stores sensitive information in URL parameters.IBM Guardium Data Encryption
- CVE-2022-29592Tenda TX9 Pro 22.03.02.10 devices allow OS command injection via set_route (called by doSystemCmd_route).
- CVE-2022-28079College Management System v1.0 was discovered to contain a SQL injection vulnerability via the course_code parameter.
- CVE-2021-38435RTI Connext DDS Professional and Connext DDS Secure Incorrect Calculation of Buffer SizeRTI Connext DDS Professional · RTI Connext DDS Secure
- CVE-2021-38433RTI Connext DDS Professional and Connext DDS Secure Stack-based Buffer OverflowRTI Connext DDS Professional · RTI Connext DDS Secure
- CVE-2021-38429OCI OpenDDS Secure Network AmplificationOCI OpenDDS
- CVE-2021-38427RTI Connext DDS Professional and Connext DDS Secure Stack-based Buffer OverflowRTI Connext DDS Professional · RTI Connext DDS Secure
- CVE-2021-38423GurumDDS Heap-based Incorrect Calculation of Buffer SizeGurumNetworks GurumDDS
- CVE-2021-38443Eclipse CycloneDDS Improper Handling of Syntactically Invalid StructureEclipse CycloneDDS
- CVE-2021-38441Eclipse CycloneDDS Write-what-where ConditionEclipse CycloneDDS
- CVE-2022-1516A NULL pointer dereference flaw was found in the Linux kernel’s X.25 set of standardized network protocols functionality in the way a user tKernel
- CVE-2021-42183MasaCMS 7.2.1 is affected by a path traversal vulnerability in /index.cfm/_api/asset/image/.
- CVE-2022-29340GPAC 2.1-DEV-rev87-g053aae8-master.
- CVE-2022-29339In GPAC 2.1-DEV-rev87-g053aae8-master, function BS_ReadByte() in utils/bitstream.c has a failed assertion, which causes a Denial of Service.
- CVE-2022-28471In ffjpeg (commit hash: caade60), the function bmp_load() in bmp.c contains an integer overflow vulnerability, which eventually results in t
- CVE-2022-28462novel-plus 3.6.0 suffers from an Arbitrary file reading vulnerability.
- CVE-2022-28461mingyuefusu Library Management System all versions as of 03-27-2022 is vulnerable to SQL Injection.
- CVE-2021-42242A command execution vulnerability exists in jfinal_cms 5.0.1 via com.jflyfox.component.controller.Ueditor.
- CVE-2022-29938In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameter payment_id in interface\billing\new_payment.php via interface\billing\pa
- CVE-2022-29939In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters debug and InsId in interface\billing\sl_eob_process.php leads to multip
- CVE-2022-29940In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters formseq and formid in interface\orders\find_order_popup.php leads to mu
- CVE-2021-41739A OS Command Injection vulnerability was discovered in Artica Proxy 4.30.000000.
- CVE-2021-45783Bookeen Notea Firmware BK_R_1.0.5_20210608 is affected by a directory traversal vulnerability that allows an attacker to obtain sensitive in
- CVE-2022-1590Bludit New Content Module new-content cross site scriptingBludit
- CVE-2022-28890Processing external DTDsApache Software Foundation Apache Jena · org.apache.jena:je…