CVEs published May 6, 2022
72 CVEs were published on May 6, 2022: 3 critical, 28 high.
- Published
- 72
- Critical
- 3
- High
- 28
- Medium
- 15
- Low
- 5
- Unrated
- 21
- Now in CISA KEV
- 0
- Fix available
- 11
Most affected products
- Adobe Photoshop
- 14
- Splunk Enterprise
- 7
- HCL Software BigFix Platform
- 5
- Adam Skaat Countdown & Clock
- 4
- Brocade SANNav
- 3
- Adobe After Effects
- 2
- fluxcd flux2 · github.com/fluxcd/flux2 +1
- 2
- HCL Software HCL BigFix Inventory
- 2
- IBM Guardium Data Encryption
- 2
- Andrea Pernici News Sitemap for Google
- 1
Critical 3
- CVE-2019-12254TECSON/GOK: Improper Authentication and Access Control on multiple devicesTECSON e-litro net · TECSON LX-Net +2
- CVE-2022-24877Improper path handling in kustomization files allows path traversalfluxcd flux2 · github.com/fluxcd/flux2 +1
- CVE-2022-24817Improper kubeconfig validation allows arbitrary code executionfluxcd flux2 · github.com/fluxcd/flux2 +2
High 28
- CVE-2021-23592Deserialization of Untrusted Datatopthink/framework
- CVE-2021-23792XML External Entity (XXE) Injectioncom.twelvemonkeys.imageio:imageio-metadata
- CVE-2022-25324Denial of Service (DoS)bignum
- CVE-2021-27764HCL BigFix WebUI Cookie missing attributesHCL Software HCL BigFix WebUI
- CVE-2022-27784Adobe After Effects Stack Buffer Overflow Could Lead To RCEAdobe After Effects
- CVE-2022-27783Adobe After Effects Stack Buffer Overflow Could Lead To RCEAdobe After Effects
- CVE-2022-28279Adobe Photoshop Font Parsing Use-After-Free Remote Code Execution VulnerabilityAdobe Photoshop
- CVE-2022-28278Adobe Photoshop Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Photoshop
- CVE-2022-28277Adobe Photoshop PDF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Photoshop
- CVE-2022-28276Adobe Photoshop Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Photoshop
- CVE-2022-28275Adobe Photoshop Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Photoshop
- CVE-2022-28274Adobe Photoshop Font Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Photoshop
- CVE-2022-28273Adobe Photoshop Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Photoshop
- CVE-2022-28272Adobe Photoshop Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Photoshop
- CVE-2022-28271Adobe Photoshop PDF File Parsing Use-After-Free Remote Code Execution VulnerabilityAdobe Photoshop
- CVE-2022-28270Adobe Photoshop SVG File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Photoshop
- CVE-2022-24105Adobe Photoshop U3D File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Photoshop
- CVE-2022-24098Adobe Photoshop PCX File Parsing Memory Corruption Remote Code Execution VulnerabilityAdobe Photoshop
- CVE-2022-23205Adobe Photoshop Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Photoshop
- CVE-2022-27183Reflected XSS in a query parameter of the Monitoring ConsoleSplunk Enterprise
- CVE-2022-26889Path Traversal in search parameter results in external content injectionSplunk Enterprise
- CVE-2021-42743Local privilege escalation via a default path in Splunk Enterprise WindowsSplunk Enterprise
- CVE-2021-31559S2S TcpToken authentication bypassSplunk Enterprise
- CVE-2021-26253Bypass of Splunk Enterprise's implementation of DUO MFASplunk Enterprise
- CVE-2022-21934Metasys Unverified Password ChangeJohnson Controls Metasys ADS/ADX/OAS server
- CVE-2022-24878Improper path handling in Kustomization files allows for denial of servicefluxcd flux2 · github.com/fluxcd/flux2 +1
- CVE-2021-25746Ingress-nginx directive injection via annotationsKubernetes ingress-nginx
- CVE-2021-25745Ingress-nginx path can be pointed to service account token fileKubernetes ingress-nginx · k8s.io/ingress-nginx
Medium, low and unrated 41
- CVE-2021-27767HCL BigFix Platform Console is affected by a Privilege Escalation VulnerabilityHCL Software BigFix Platform
- CVE-2021-27766HCL BigFix Platform Client is affected by a Privilege Escalation VulnerabilityHCL Software BigFix Platform
- CVE-2021-27765HCL BigFix Platform Server API is affected by Privilege Escalation VulnerabilityHCL Software BigFix Platform
- CVE-2021-27762HCL BigFix Platform is affected by misconfigured security-related HTTP headersHCL Software BigFix Platform
- CVE-2021-27761HCL BigFix Platform is affected by weak web transport securityHCL Software BigFix Platform
- CVE-2021-27760HCL Notes 11.0 - 11.0.1 FP4 Sametime Embedded chat clients are vulnerable to group chats loading script on restartHCL Software HCL Notes
- CVE-2021-27759This vulnerability arises because the application allows the user to perform some sensitive action without verifying that the request was seHCL Software HCL BigFix Inventory
- CVE-2021-27758There is a security vulnerability in login form related to Cross-site Request Forgery which prevents user to login after attacker spam to loHCL Software HCL BigFix Inventory
- CVE-2021-27751HCL Commerce is affected by an Insufficient Session Expiration vulnerability.HCL Software HCL Commerce
- CVE-2022-27909Extension - Incorrect Access Control within jdownloads extensionjDownloads
- CVE-2022-23802Extension - Insecure Permissions within Joomla Guru extensionsijoomla.com Guru
- CVE-2022-29423WordPress Countdown & Clock plugin <= 2.3.2 - Pro Features Lock Bypass vulnerabilityAdam Skaat Countdown & Clock
- CVE-2022-29422WordPress Countdown & Clock plugin <= 2.3.2 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilitiesAdam Skaat Countdown & Clock
- CVE-2022-24099Adobe Photoshop Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Photoshop
- CVE-2022-29421WordPress Countdown & Clock plugin <= 2.3.2 - Reflected Cross-Site Scripting (XSS) vulnerabilityAdam Skaat Countdown & Clock
- CVE-2022-29420WordPress Countdown & Clock plugin <= 2.3.2 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityAdam Skaat Countdown & Clock
- CVE-2021-36912Andrea Pernici News Sitemap for Google plugin <= 1.0.16 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityAndrea Pernici News Sitemap for Google
- CVE-2022-1053Keylime does not enforce that the agent registrar data is the same when the tenant uses it for validation of the EK and identity quote and tkeylime
- CVE-2022-28507Dragon Path Technologies Bharti Airtel Routers Hardware BDT-121 version 1.0 is vulnerable to Cross Site Scripting (XSS) via Dragon path rout
- CVE-2022-26070Error message discloses internal pathSplunk Enterprise
- CVE-2021-33845Username enumeration through lockout message in REST APISplunk Enterprise
- CVE-2022-28545FUDforum 3.1.1 is vulnerable to Stored XSS.
- CVE-2022-28165A vulnerability in the role-based access control (RBAC) functionality of the Brocade SANNav before 2.2.0 could allow an authenticated, remotBrocade SANNav
- CVE-2022-28163In Brocade SANnav before Brocade SANnav 2.2.0, multiple endpoints associated with Zone management are susceptible to SQL injection, allowingBrocade SANNav
- CVE-2022-28164Brocade SANnav before SANnav 2.2.0 application uses the Blowfish symmetric encryption algorithm for the storage of passwords.Brocade SANNav
- CVE-2021-39027IBM Guardium Data Encryption (GDE) 4.0.0 and 5.0.0 prepares a structured message for communication with another component, but encoding or eIBM Guardium Data Encryption
- CVE-2021-39023IBM Guardium Data Encryption (GDE) 4.0.0 and 5.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical eIBM Guardium Data Encryption
- CVE-2020-19217SQL Injection vulnerability in admin/batch_manager.php in piwigo v2.9.5, via the filter_category parameter to admin.php?page=batch_manager.
- CVE-2020-19216SQL Injection vulnerability in admin/user_perm.php in piwigo v2.9.5, via the cat_false parameter to admin.php?page=group_perm.
- CVE-2020-19215SQL Injection vulnerability in admin/user_perm.php in piwigo v2.9.5, via the cat_false parameter to admin.php?page=user_perm.
- CVE-2020-19213SQL Injection vulnerability in cat_move.php in piwigo v2.9.5, via the selection parameter to move_categories.
- CVE-2020-19212SQL Injection vulnerability in admin/group_list.php in piwigo v2.9.5, via the group parameter to delete.
- CVE-2022-28973Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the wanMTU parameter in the function fromAdvSetMacMtuWan.
- CVE-2022-28972Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the timeZone parameter in the function form_fast_setting_wifi_set.
- CVE-2022-28971Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the list parameter in the function fromSetIpMacBind.
- CVE-2022-28970Tenda AX1806 v1.0.0.1 was discovered to contain a heap overflow via the mac parameter in the function GetParentControlInfo.
- CVE-2022-28969Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the shareSpeed parameter in the function fromSetWifiGusetBasic.
- CVE-2022-24823Local Information Disclosure Vulnerability in io.netty:netty-codec-httpnetty · io.netty:netty-codec-http
- CVE-2022-30295uClibc-ng through 1.0.40 and uClibc through 0.9.33.2 use predictable DNS transaction IDs that may lead to DNS cache poisoning.
- CVE-2022-30293In WebKitGTK through 2.36.0 (and WPE WebKit), there is a heap-based buffer overflow in WebCore::TextureMapperLayer::setContentsLayer in WebC
- CVE-2022-28005An issue was discovered in the 3CX Phone System Management Console prior to version 18 Update 3 FINAL.