# CVEs published 2022-05-05

128 CVEs were published on May 5, 2022: 7 critical, 36 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2022-24884](https://cve.now/CVE-2022-24884.md): Trivial signature forgery in ecdsautils (CVSS 10.0, freifunk-gluon ecdsautils)
- [CVE-2022-24899](https://cve.now/CVE-2022-24899.md): Cross site scripting via canonical tag (CVSS 7.2, contao · contao/core-bundle +1)
- [CVE-2022-29161](https://cve.now/CVE-2022-29161.md): Crypto script service uses hashing algorithm SHA1 with RSA for certificate signature in xwiki-platform (CVSS 5.4, xwiki-platform · org.xwiki.platform:xwiki-platform-crypto)
- [CVE-2022-24902](https://cve.now/CVE-2022-24902.md): Memory issue in playing videos (CVSS 2.9, PaulleDemon tkVideoPlayer · tkvideoplayer)
- [CVE-2022-29171](https://cve.now/CVE-2022-29171.md): Remote Code Execution in sourcegraph (CVSS 6.6, sourcegraph)
- [CVE-2022-29164](https://cve.now/CVE-2022-29164.md): Privilege Escalation in argo-workflows (CVSS 7.1, argoproj argo-workflows · github.com/argoproj/argo-workflow…)
- [CVE-2022-29166](https://cve.now/CVE-2022-29166.md): Improper handling of multiline messages in matrix-appservice-irc (CVSS 8.0, matrix-org matrix-appservice-irc · matrix-appservice-irc)
- [CVE-2022-29167](https://cve.now/CVE-2022-29167.md): ReDoS vulnerability in header parsing in hawk (CVSS 7.4, mozilla hawk · hawk)
- [CVE-2022-29172](https://cve.now/CVE-2022-29172.md): HTML injection with additional signup fields (CVSS 6.1, auth0 lock · auth0-lock)
- [CVE-2022-29173](https://cve.now/CVE-2022-29173.md): No protection against rollback attacks in go-tuf (CVSS 8.0, theupdateframework go-tuf · github.com/theupdateframework/g…)
- [CVE-2022-29535](https://cve.now/CVE-2022-29535.md): Zoho ManageEngine OPManager through 125588 allows SQL Injection via a few default reports. (no CVSS)
- [CVE-2022-29176](https://cve.now/CVE-2022-29176.md): Unauthorized gem takeover for some gems on rubygems.org (CVSS 9.9, rubygems.org)
- [CVE-2022-27337](https://cve.now/CVE-2022-27337.md): A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file. (no CVSS)
- [CVE-2022-27359](https://cve.now/CVE-2022-27359.md): Foxit PDF Reader before 12.0.1 and PDF Editor before 12.0.1 allow a this.maildoc NULL pointer dereference. (no CVSS)
- [CVE-2022-27360](https://cve.now/CVE-2022-27360.md): SpringBlade v3.2.0 and below was discovered to contain a SQL injection vulnerability via the component customSqlSegment. (no CVSS)
- [CVE-2022-27411](https://cve.now/CVE-2022-27411.md): TOTOLINK N600R v5.3c.5507\_B20171031 was discovered to contain a command injection vulnerability via the QUERY\_STRING parameter in the "Main" (no CVSS)
- [CVE-2021-25268](https://cve.now/CVE-2021-25268.md): Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from MySophos admin to SFOS admin in Sophos Firewall older than vers (CVSS 8.4, Sophos Firewall)
- [CVE-2021-25267](https://cve.now/CVE-2021-25267.md): Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 19.0 (CVSS 6.8, Sophos Firewall)
- [CVE-2022-28583](https://cve.now/CVE-2022-28583.md): It is found that there is a command injection vulnerability in the setWiFiWpsCfg interface in TOTOlink A7100RU (v7.4cu.2313\_b20191024) route (no CVSS)
- [CVE-2022-28582](https://cve.now/CVE-2022-28582.md): It is found that there is a command injection vulnerability in the setWiFiSignalCfg interface in TOTOlink A7100RU (v7.4cu.2313\_b20191024) ro (no CVSS)
- [CVE-2022-28581](https://cve.now/CVE-2022-28581.md): It is found that there is a command injection vulnerability in the setWiFiAdvancedCfg interface in TOTOlink A7100RU (v7.4cu.2313\_b20191024) (no CVSS)
- [CVE-2022-28580](https://cve.now/CVE-2022-28580.md): It is found that there is a command injection vulnerability in the setL2tpServerCfg interface in TOTOlink A7100RU (v7.4cu.2313\_b20191024) ro (no CVSS)
- [CVE-2022-28579](https://cve.now/CVE-2022-28579.md): It is found that there is a command injection vulnerability in the setParentalRules interface in TOTOlink A7100RU (v7.4cu.2313\_b20191024) ro (no CVSS)
- [CVE-2022-28578](https://cve.now/CVE-2022-28578.md): It is found that there is a command injection vulnerability in the setOpenVpnCfg interface in TOTOlink A7100RU (v7.4cu.2313\_b20191024) route (no CVSS)
- [CVE-2022-26073](https://cve.now/CVE-2022-26073.md): A denial of service vulnerability exists in the libxm\_av.so DemuxCmdInBuffer functionality of Anker Eufy Homebase 2 2.1.8.5h. (CVSS 7.4, Anker Eufy Homebase)
- [CVE-2022-25989](https://cve.now/CVE-2022-25989.md): An authentication bypass vulnerability exists in the libxm\_av.so getpeermac() functionality of Anker Eufy Homebase 2 2.1.8.5h. (CVSS 7.1, Anker Eufy Homebase)
- [CVE-2022-28577](https://cve.now/CVE-2022-28577.md): It is found that there is a command injection vulnerability in the delParentalRules interface in TOTOlink A7100RU (v7.4cu.2313\_b20191024) ro (no CVSS)
- [CVE-2022-28575](https://cve.now/CVE-2022-28575.md): It is found that there is a command injection vulnerability in the setopenvpnclientcfg interface in TOTOlink A7100RU (v7.4cu.2313\_b20191024) (no CVSS)
- [CVE-2022-28584](https://cve.now/CVE-2022-28584.md): It is found that there is a command injection vulnerability in the setWiFiWpsStart interface in TOTOlink A7100RU (v7.4cu.2313\_b20191024) rou (no CVSS)
- [CVE-2022-27588](https://cve.now/CVE-2022-27588.md): Vulnerability in QVR (CVSS 9.8, QNAP Systems QVR)
- [CVE-2021-44057](https://cve.now/CVE-2021-44057.md): Improper authentication in Photo Station (CVSS 7.1, QNAP Systems Photo Station)
- [CVE-2021-44056](https://cve.now/CVE-2021-44056.md): Improper authentication in Video Station (CVSS 7.1, QNAP Systems Video Station)
- [CVE-2021-44055](https://cve.now/CVE-2021-44055.md): Information leakage in Video Station (CVSS 5.3, QNAP Systems Video Station)
- [CVE-2021-44054](https://cve.now/CVE-2021-44054.md): Open redirect (CVSS 4.3, QNAP Systems QuTScloud · QNAP Systems QuTS hero +1)
- [CVE-2021-44053](https://cve.now/CVE-2021-44053.md): Reflected XSS (CVSS 5.7, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2021-44052](https://cve.now/CVE-2021-44052.md): Arbitrary file read (CVSS 6.5, QNAP Systems QuTScloud · QNAP Systems QuTS hero +1)
- [CVE-2021-44051](https://cve.now/CVE-2021-44051.md): Command injection (CVSS 8.8, QNAP Systems QuTScloud · QNAP Systems QuTS hero +1)
- [CVE-2021-38693](https://cve.now/CVE-2021-38693.md): Path Traversal in thttpd (CVSS 5.3, QNAP Systems QuTScloud · QNAP Systems QuTS hero +1)
- [CVE-2022-29491](https://cve.now/CVE-2022-29491.md): On F5 BIG-IP LTM, Advanced WAF, ASM, or APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14. (CVSS 7.5, F5 BIG-IP LTM, Advanced WAF, ASM, and APM)
- [CVE-2022-29480](https://cve.now/CVE-2022-29480.md): On F5 BIG-IP 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, when multiple route domains are configured, undisclosed (CVSS 5.3, F5 BIG-IP)
- [CVE-2022-29479](https://cve.now/CVE-2022-29479.md): On F5 BIG-IP 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1 (CVSS 5.3, F5 BIG-IP · F5 BIG-IQ Centralized Management)
- [CVE-2022-29474](https://cve.now/CVE-2022-29474.md): On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior (CVSS 4.3, F5 BIG-IP)
- [CVE-2022-29473](https://cve.now/CVE-2022-29473.md): On F5 BIG-IP 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when an IPSec ALG pr (CVSS 5.9, F5 BIG-IP)
- [CVE-2022-29263](https://cve.now/CVE-2022-29263.md): On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions pr (CVSS 7.8, F5 BIG-IP APM)
- [CVE-2022-28530](https://cve.now/CVE-2022-28530.md): Sourcecodester Covid-19 Directory on Vaccination System 1.0 is vulnerable to SQL Injection via cmdcategory. (no CVSS)
- [CVE-2022-28859](https://cve.now/CVE-2022-28859.md): On F5 BIG-IP 15.1.x versions prior to 15.1.5.1 and 14.1.x versions prior to 14.1.4.6, when installing Net HSM, the scripts (nethsm-safenet-i (CVSS 6.5, F5 BIG-IP)
- [CVE-2022-28716](https://cve.now/CVE-2022-28716.md): On 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, (CVSS 7.5, F5 BIG-IP)
- [CVE-2022-28714](https://cve.now/CVE-2022-28714.md): On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions pr (CVSS 7.3, F5 BIG-IP APM)
- [CVE-2022-28708](https://cve.now/CVE-2022-28708.md): On F5 BIG-IP 16.1.x versions prior to 16.1.2.2 and 15.1.x versions prior to 15.1.5.1, when a BIG-IP DNS resolver-enabled, HTTP-Explicit or S (CVSS 5.9, F5 BIG-IP)
- [CVE-2022-28707](https://cve.now/CVE-2022-28707.md): On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, a stored cross-sit (CVSS 8.0, F5 BIG-IP)
- [CVE-2022-28706](https://cve.now/CVE-2022-28706.md): On F5 BIG-IP 16.1.x versions prior to 16.1.2 and 15.1.x versions prior to 15.1.5.1, when the DNS resolver configuration is used, undisclosed (CVSS 5.9, F5 BIG-IP)
- [CVE-2022-28705](https://cve.now/CVE-2022-28705.md): On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions pr (CVSS 7.5, F5 BIG-IP)
- [CVE-2022-28701](https://cve.now/CVE-2022-28701.md): On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, when the stream profile is configured on a virtual server, undisclosed requests can cause an (CVSS 7.5, F5 BIG-IP)
- [CVE-2022-28695](https://cve.now/CVE-2022-28695.md): On F5 BIG-IP AFM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x version (CVSS 7.2, F5 BIG-IP AFM)
- [CVE-2022-28691](https://cve.now/CVE-2022-28691.md): On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prio (CVSS 7.5, F5 BIG-IP)
- [CVE-2022-27880](https://cve.now/CVE-2022-27880.md): On F5 Traffix SDC 5.2.x versions prior to 5.2.2 and 5.1.x versions prior to 5.1.35, a stored Cross-Site Scripting (XSS) vulnerability exists (CVSS 4.8, F5 Traffix SDC)
- [CVE-2022-27878](https://cve.now/CVE-2022-27878.md): On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP, and F5 BIG-IP Guided Configuration (GC) all versions pri (CVSS 6.8, F5 BIG-IP)
- [CVE-2022-27875](https://cve.now/CVE-2022-27875.md): On F5 Access for Android 3.x versions prior to 3.0.8, a Task Hijacking vulnerability exists in the F5 Access for Android application, which (CVSS 5.5, F5 Access for Android)
- [CVE-2022-27806](https://cve.now/CVE-2022-27806.md): On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP Guided Configur (CVSS 8.7, F5 BIG-IP)
- [CVE-2022-27662](https://cve.now/CVE-2022-27662.md): On F5 Traffix SDC 5.2.x versions prior to 5.2.2 and 5.1.x versions prior to 5.1.35, a stored Cross-Site Template Injection vulnerability exi (CVSS 4.8, F5 Traffix SDC)
- [CVE-2022-26517](https://cve.now/CVE-2022-26517.md): On F5 BIG-IP 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when the BIG-IP CGNA (CVSS 5.9, F5 BIG-IP)
- [CVE-2022-26415](https://cve.now/CVE-2022-26415.md): On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior (CVSS 7.7, F5 BIG-IP)
- [CVE-2022-26372](https://cve.now/CVE-2022-26372.md): On F5 BIG-IP 15.1.x versions prior to 15.1.0.2, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1 (CVSS 7.5, F5 BIG-IP)
- [CVE-2022-26370](https://cve.now/CVE-2022-26370.md): On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, and 14.1.x versions prior to 14.1.4.6, when a Session Initi (CVSS 5.9, F5 BIG-IP)
- [CVE-2022-26340](https://cve.now/CVE-2022-26340.md): On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior (CVSS 4.9, F5 BIG-IP · F5 BIG-IQ Centralized Management)
- [CVE-2022-26130](https://cve.now/CVE-2022-26130.md): On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions pr (CVSS 5.3, F5 BIG-IP)
- [CVE-2022-28533](https://cve.now/CVE-2022-28533.md): Sourcecodester Medical Hub Directory Site 1.0 is vulnerable to SQL Injection via /mhds/clinic/view\_details.php. (no CVSS)
- [CVE-2022-26071](https://cve.now/CVE-2022-26071.md): On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior (CVSS 7.4, F5 BIG-IP)
- [CVE-2022-25990](https://cve.now/CVE-2022-25990.md): On 1.0.x versions prior to 1.0.1, systems running F5OS-A software may expose certain registry ports externally. (CVSS 5.3, F5OS-A)
- [CVE-2022-25946](https://cve.now/CVE-2022-25946.md): On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP Guided Configur (CVSS 8.7, F5 BIG-IP)
- [CVE-2022-1468](https://cve.now/CVE-2022-1468.md): On all versions of 17.0.x, 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x on F5 BIG-IP, an authenticated iControl REST user with at leas (CVSS 4.3, F5 BIG-IP)
- [CVE-2022-1389](https://cve.now/CVE-2022-1389.md): On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP (fixed in 17.0.0), a cross-site request forgery (CSRF) vu (CVSS 3.1, F5 BIG-IP)
- [CVE-2022-1388](https://cve.now/CVE-2022-1388.md): On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior (CVSS 9.8, KEV, F5 BIG-IP)
- [CVE-2022-27659](https://cve.now/CVE-2022-27659.md): On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, an authenticated a (CVSS 4.3, F5 BIG-IP)
- [CVE-2022-29500](https://cve.now/CVE-2022-29500.md): SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Information Disclosure. (no CVSS)
- [CVE-2022-29501](https://cve.now/CVE-2022-29501.md): SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Escalation of Privileges and code execution. (no CVSS)
- [CVE-2022-29502](https://cve.now/CVE-2022-29502.md): SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Escalation of Privileges. (no CVSS)
- [CVE-2022-27636](https://cve.now/CVE-2022-27636.md): On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions pr (CVSS 5.5, F5 BIG-IP APM)
- [CVE-2022-27634](https://cve.now/CVE-2022-27634.md): On 16.1.x versions prior to 16.1.2.2 and 15.1.x versions prior to 15.1.5.1, BIG-IP APM does not properly validate configurations, allowing a (CVSS 6.5, F5 BIG-IP APM)
- [CVE-2022-27495](https://cve.now/CVE-2022-27495.md): On all versions 1.3.x (fixed in 1.4.0) NGINX Service Mesh control plane endpoints are exposed to the cluster overlay network. (CVSS 6.5, F5 NGINX Service Mesh)
- [CVE-2022-27230](https://cve.now/CVE-2022-27230.md): On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP APM, and F5 BIG-IP Guided Configuration (GC) all versions (CVSS 7.5, F5 BIG-IP APM · F5 BIG-IP Guided Configuration)
- [CVE-2022-27189](https://cve.now/CVE-2022-27189.md): On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior (CVSS 7.5, F5 BIG-IP)
- [CVE-2022-27182](https://cve.now/CVE-2022-27182.md): On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, when BIG-IP packet (CVSS 5.3, F5 BIG-IP)
- [CVE-2022-27181](https://cve.now/CVE-2022-27181.md): On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions pr (CVSS 5.3, F5 BIG-IP APM)
- [CVE-2022-28080](https://cve.now/CVE-2022-28080.md): Royal Event Management System v1.0 was discovered to contain a SQL injection vulnerability via the todate parameter. (no CVSS)
- [CVE-2022-26890](https://cve.now/CVE-2022-26890.md): On F5 BIG-IP Advanced WAF, ASM, and APM 16.1.x versions prior to 16.1.2.1, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4. (CVSS 7.5, F5 BIG-IP Advanced WAF, ASM, and APM)
- [CVE-2022-26835](https://cve.now/CVE-2022-26835.md): On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior (CVSS 4.9, F5 BIG-IP)
- [CVE-2022-28120](https://cve.now/CVE-2022-28120.md): Beijing Runnier Network Technology Co., Ltd Open virtual simulation experiment teaching management platform software 2.0 has a file upload v (no CVSS)
- [CVE-2022-22434](https://cve.now/CVE-2022-22434.md): IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a user with physical access to create an API request modified to creat (CVSS 4.2, IBM Robotic Process Automation)
- [CVE-2022-22433](https://cve.now/CVE-2022-22433.md): IBM Robotic Process Automation 21.0.1 and 21.0.2 is vulnerable to External Service Interaction attack, caused by improper validation of user (CVSS 2.7, IBM Robotic Process Automation)
- [CVE-2022-28606](https://cve.now/CVE-2022-28606.md): An arbitrary file upload vulnerability exists in Wenzhou Huoyin Information Technology Co., Ltd. (no CVSS)
- [CVE-2022-22415](https://cve.now/CVE-2022-22415.md): A vulnerability exists where an IBM Robotic Process Automation 21.0.1 regular user is able to obtain view-only access to some admin pages in (CVSS 4.3, IBM Robotic Process Automation)
- [CVE-2021-39020](https://cve.now/CVE-2021-39020.md): IBM Guardium Data Encryption (GDE) 4.0.0.7 and lower stores sensitive information in URL parameters. (CVSS 2.0, IBM Guardium Data Encryption)
- [CVE-2022-29592](https://cve.now/CVE-2022-29592.md): Tenda TX9 Pro 22.03.02.10 devices allow OS command injection via set\_route (called by doSystemCmd\_route). (no CVSS)
- [CVE-2022-28079](https://cve.now/CVE-2022-28079.md): College Management System v1.0 was discovered to contain a SQL injection vulnerability via the course\_code parameter. (no CVSS)
- [CVE-2021-38435](https://cve.now/CVE-2021-38435.md): RTI Connext DDS Professional and Connext DDS Secure Incorrect Calculation of Buffer Size (CVSS 6.6, RTI Connext DDS Professional · RTI Connext DDS Secure)
- [CVE-2021-38433](https://cve.now/CVE-2021-38433.md): RTI Connext DDS Professional and Connext DDS Secure Stack-based Buffer Overflow (CVSS 6.6, RTI Connext DDS Professional · RTI Connext DDS Secure)
- [CVE-2021-38429](https://cve.now/CVE-2021-38429.md): OCI OpenDDS Secure Network Amplification (CVSS 6.6, OCI OpenDDS)
- [CVE-2021-38427](https://cve.now/CVE-2021-38427.md): RTI Connext DDS Professional and Connext DDS Secure Stack-based Buffer Overflow (CVSS 6.6, RTI Connext DDS Professional · RTI Connext DDS Secure)
- [CVE-2021-38425](https://cve.now/CVE-2021-38425.md): eProsima Fast DDS Network Amplification (CVSS 7.5, eProsima Fast DDS)
- [CVE-2021-38423](https://cve.now/CVE-2021-38423.md): GurumDDS Heap-based Incorrect Calculation of Buffer Size (CVSS 6.6, GurumNetworks GurumDDS)
- [CVE-2021-43547](https://cve.now/CVE-2021-43547.md): TwinOaks Computing CoreDX DDS Secure Network Amplification (CVSS 7.5, TwinOaks Computing CoreDX DDS)
- [CVE-2021-38487](https://cve.now/CVE-2021-38487.md): Potential Network Amplification and Information Exposure in RTI Connext Professional and Connext Micro (CVSS 8.8, RTI Connext Professional · RTI Connext Micro)
- [CVE-2021-38447](https://cve.now/CVE-2021-38447.md): OCI OpenDDS Secure Amplification (CVSS 8.6, OCI OpenDDS)
- [CVE-2021-38445](https://cve.now/CVE-2021-38445.md): OCI OpenDDS Secure Improper Handling of Length Parameter Inconsistency (CVSS 7.0, OCI OpenDDS)
- [CVE-2021-38443](https://cve.now/CVE-2021-38443.md): Eclipse CycloneDDS Improper Handling of Syntactically Invalid Structure (CVSS 6.6, Eclipse CycloneDDS)
- [CVE-2021-38441](https://cve.now/CVE-2021-38441.md): Eclipse CycloneDDS Write-what-where Condition (CVSS 6.6, Eclipse CycloneDDS)
- [CVE-2021-38439](https://cve.now/CVE-2021-38439.md): GurumDDS Heap-based Buffer Overflow (CVSS 8.6, GurumNetworks GurumDDS)
- [CVE-2022-1516](https://cve.now/CVE-2022-1516.md): A NULL pointer dereference flaw was found in the Linux kernel’s X.25 set of standardized network protocols functionality in the way a user t (no CVSS, Kernel)
- [CVE-2022-1464](https://cve.now/CVE-2022-1464.md): Stored xss bug in gogs/gogs (CVSS 7.3, gogs/gogs · gogs.io/gogs)
- [CVE-2021-42183](https://cve.now/CVE-2021-42183.md): MasaCMS 7.2.1 is affected by a path traversal vulnerability in /index.cfm/\_api/asset/image/. (no CVSS)
- [CVE-2022-29340](https://cve.now/CVE-2022-29340.md): GPAC 2.1-DEV-rev87-g053aae8-master. (no CVSS)
- [CVE-2022-29339](https://cve.now/CVE-2022-29339.md): In GPAC 2.1-DEV-rev87-g053aae8-master, function BS\_ReadByte() in utils/bitstream.c has a failed assertion, which causes a Denial of Service. (no CVSS)
- [CVE-2022-28471](https://cve.now/CVE-2022-28471.md): In ffjpeg (commit hash: caade60), the function bmp\_load() in bmp.c contains an integer overflow vulnerability, which eventually results in t (no CVSS)
- [CVE-2022-28462](https://cve.now/CVE-2022-28462.md): novel-plus 3.6.0 suffers from an Arbitrary file reading vulnerability. (no CVSS)
- [CVE-2022-28461](https://cve.now/CVE-2022-28461.md): mingyuefusu Library Management System all versions as of 03-27-2022 is vulnerable to SQL Injection. (no CVSS)
- [CVE-2021-42242](https://cve.now/CVE-2021-42242.md): A command execution vulnerability exists in jfinal\_cms 5.0.1 via com.jflyfox.component.controller.Ueditor. (no CVSS)
- [CVE-2022-1575](https://cve.now/CVE-2022-1575.md): Arbitrary Code Execution through Sanitizer Bypass in jgraph/drawio (CVSS 9.6, jgraph/drawio)
- [CVE-2022-29938](https://cve.now/CVE-2022-29938.md): In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameter payment\_id in interface\\billing\\new\_payment.php via interface\\billing\\pa (no CVSS)
- [CVE-2022-29939](https://cve.now/CVE-2022-29939.md): In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters debug and InsId in interface\\billing\\sl\_eob\_process.php leads to multip (no CVSS)
- [CVE-2022-29940](https://cve.now/CVE-2022-29940.md): In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters formseq and formid in interface\\orders\\find\_order\_popup.php leads to mu (no CVSS)
- [CVE-2021-41739](https://cve.now/CVE-2021-41739.md): A OS Command Injection vulnerability was discovered in Artica Proxy 4.30.000000. (no CVSS)
- [CVE-2022-1411](https://cve.now/CVE-2022-1411.md): Unrestructed file upload in yetiforcecompany/yetiforcecrm (CVSS 9.1, yetiforcecompany/yetiforcecrm · yetiforce/yetiforce-crm)
- [CVE-2021-45783](https://cve.now/CVE-2021-45783.md): Bookeen Notea Firmware BK\_R\_1.0.5\_20210608 is affected by a directory traversal vulnerability that allows an attacker to obtain sensitive in (no CVSS)
- [CVE-2022-1592](https://cve.now/CVE-2022-1592.md): Server-Side Request Forgery in scout in clinical-genomics/scout (CVSS 9.4, clinical-genomics/scout · scout-browser)
- [CVE-2022-1590](https://cve.now/CVE-2022-1590.md): Bludit New Content Module new-content cross site scripting (CVSS 3.5, Bludit)
- [CVE-2022-28890](https://cve.now/CVE-2022-28890.md): Processing external DTDs (no CVSS, Apache Software Foundation Apache Jena · org.apache.jena:je…)
- [CVE-2022-24903](https://cve.now/CVE-2022-24903.md): Buffer overflow in TCP syslog server (receiver) components in rsyslog (CVSS 8.1, rsyslog)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-05-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.