# CVEs published 2022-05-06

72 CVEs were published on May 6, 2022: 3 critical, 28 high. Days are UTC.

- [CVE-2021-23592](https://cve.now/CVE-2021-23592.md): Deserialization of Untrusted Data (CVSS 7.7, topthink/framework)
- [CVE-2021-23792](https://cve.now/CVE-2021-23792.md): XML External Entity (XXE) Injection (CVSS 7.3, com.twelvemonkeys.imageio:imageio-metadata)
- [CVE-2022-25324](https://cve.now/CVE-2022-25324.md): Denial of Service (DoS) (CVSS 7.5, bignum)
- [CVE-2021-27767](https://cve.now/CVE-2021-27767.md): HCL BigFix Platform Console is affected by a Privilege Escalation Vulnerability (CVSS 6.7, HCL Software BigFix Platform)
- [CVE-2021-27766](https://cve.now/CVE-2021-27766.md): HCL BigFix Platform Client is affected by a Privilege Escalation Vulnerability (CVSS 6.7, HCL Software BigFix Platform)
- [CVE-2021-27765](https://cve.now/CVE-2021-27765.md): HCL BigFix Platform Server API is affected by Privilege Escalation Vulnerability (CVSS 6.7, HCL Software BigFix Platform)
- [CVE-2021-27764](https://cve.now/CVE-2021-27764.md): HCL BigFix WebUI Cookie missing attributes (CVSS 7.4, HCL Software HCL BigFix WebUI)
- [CVE-2021-27762](https://cve.now/CVE-2021-27762.md): HCL BigFix Platform is affected by misconfigured security-related HTTP headers (CVSS 4.7, HCL Software BigFix Platform)
- [CVE-2021-27761](https://cve.now/CVE-2021-27761.md): HCL BigFix Platform is affected by weak web transport security (CVSS 4.8, HCL Software BigFix Platform)
- [CVE-2021-27760](https://cve.now/CVE-2021-27760.md): HCL Notes 11.0 - 11.0.1 FP4 Sametime Embedded chat clients are vulnerable to group chats loading script on restart (CVSS 4.6, HCL Software HCL Notes)
- [CVE-2021-27759](https://cve.now/CVE-2021-27759.md): This vulnerability arises because the application allows the user to perform some sensitive action without verifying that the request was se (CVSS 2.3, HCL Software HCL BigFix Inventory)
- [CVE-2021-27758](https://cve.now/CVE-2021-27758.md): There is a security vulnerability in login form related to Cross-site Request Forgery which prevents user to login after attacker spam to lo (CVSS 4.3, HCL Software HCL BigFix Inventory)
- [CVE-2021-27751](https://cve.now/CVE-2021-27751.md): HCL Commerce is affected by an Insufficient Session Expiration vulnerability. (CVSS 4.4, HCL Software HCL Commerce)
- [CVE-2022-27909](https://cve.now/CVE-2022-27909.md): Extension - Incorrect Access Control within jdownloads extension (no CVSS, jDownloads)
- [CVE-2022-23802](https://cve.now/CVE-2022-23802.md): Extension - Insecure Permissions within Joomla Guru extensions (no CVSS, ijoomla.com Guru)
- [CVE-2022-29423](https://cve.now/CVE-2022-29423.md): WordPress Countdown & Clock plugin \<= 2.3.2 - Pro Features Lock Bypass vulnerability (CVSS 3.8, Adam Skaat Countdown & Clock)
- [CVE-2022-29422](https://cve.now/CVE-2022-29422.md): WordPress Countdown & Clock plugin \<= 2.3.2 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities (CVSS 4.8, Adam Skaat Countdown & Clock)
- [CVE-2019-12254](https://cve.now/CVE-2019-12254.md): TECSON/GOK: Improper Authentication and Access Control on multiple devices (CVSS 9.8, TECSON e-litro net · TECSON LX-Net +2)
- [CVE-2022-27784](https://cve.now/CVE-2022-27784.md): Adobe After Effects Stack Buffer Overflow Could Lead To RCE (CVSS 7.8, Adobe After Effects)
- [CVE-2022-27783](https://cve.now/CVE-2022-27783.md): Adobe After Effects Stack Buffer Overflow Could Lead To RCE (CVSS 7.8, Adobe After Effects)
- [CVE-2022-28279](https://cve.now/CVE-2022-28279.md): Adobe Photoshop Font Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Photoshop)
- [CVE-2022-28278](https://cve.now/CVE-2022-28278.md): Adobe Photoshop Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Photoshop)
- [CVE-2022-28277](https://cve.now/CVE-2022-28277.md): Adobe Photoshop PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Photoshop)
- [CVE-2022-28276](https://cve.now/CVE-2022-28276.md): Adobe Photoshop Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Photoshop)
- [CVE-2022-28275](https://cve.now/CVE-2022-28275.md): Adobe Photoshop Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Photoshop)
- [CVE-2022-28274](https://cve.now/CVE-2022-28274.md): Adobe Photoshop Font Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Photoshop)
- [CVE-2022-28273](https://cve.now/CVE-2022-28273.md): Adobe Photoshop Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Photoshop)
- [CVE-2022-28272](https://cve.now/CVE-2022-28272.md): Adobe Photoshop Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Photoshop)
- [CVE-2022-28271](https://cve.now/CVE-2022-28271.md): Adobe Photoshop PDF File Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Photoshop)
- [CVE-2022-28270](https://cve.now/CVE-2022-28270.md): Adobe Photoshop SVG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Photoshop)
- [CVE-2022-24105](https://cve.now/CVE-2022-24105.md): Adobe Photoshop U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Photoshop)
- [CVE-2022-24099](https://cve.now/CVE-2022-24099.md): Adobe Photoshop Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe Photoshop)
- [CVE-2022-24098](https://cve.now/CVE-2022-24098.md): Adobe Photoshop PCX File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, Adobe Photoshop)
- [CVE-2022-23205](https://cve.now/CVE-2022-23205.md): Adobe Photoshop Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Photoshop)
- [CVE-2022-29421](https://cve.now/CVE-2022-29421.md): WordPress Countdown & Clock plugin \<= 2.3.2 - Reflected Cross-Site Scripting (XSS) vulnerability (CVSS 4.7, Adam Skaat Countdown & Clock)
- [CVE-2022-29420](https://cve.now/CVE-2022-29420.md): WordPress Countdown & Clock plugin \<= 2.3.2 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (CVSS 5.9, Adam Skaat Countdown & Clock)
- [CVE-2021-36912](https://cve.now/CVE-2021-36912.md): Andrea Pernici News Sitemap for Google plugin \<= 1.0.16 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 5.4, Andrea Pernici News Sitemap for Google)
- [CVE-2022-1053](https://cve.now/CVE-2022-1053.md): Keylime does not enforce that the agent registrar data is the same when the tenant uses it for validation of the EK and identity quote and t (no CVSS, keylime)
- [CVE-2022-28507](https://cve.now/CVE-2022-28507.md): Dragon Path Technologies Bharti Airtel Routers Hardware BDT-121 version 1.0 is vulnerable to Cross Site Scripting (XSS) via Dragon path rout (no CVSS)
- [CVE-2022-27183](https://cve.now/CVE-2022-27183.md): Reflected XSS in a query parameter of the Monitoring Console (CVSS 8.8, Splunk Enterprise)
- [CVE-2022-26889](https://cve.now/CVE-2022-26889.md): Path Traversal in search parameter results in external content injection (CVSS 8.8, Splunk Enterprise)
- [CVE-2022-26070](https://cve.now/CVE-2022-26070.md): Error message discloses internal path (CVSS 4.3, Splunk Enterprise)
- [CVE-2021-42743](https://cve.now/CVE-2021-42743.md): Local privilege escalation via a default path in Splunk Enterprise Windows (CVSS 8.8, Splunk Enterprise)
- [CVE-2021-33845](https://cve.now/CVE-2021-33845.md): Username enumeration through lockout message in REST API (CVSS 5.3, Splunk Enterprise)
- [CVE-2021-31559](https://cve.now/CVE-2021-31559.md): S2S TcpToken authentication bypass (CVSS 7.5, Splunk Enterprise)
- [CVE-2021-26253](https://cve.now/CVE-2021-26253.md): Bypass of Splunk Enterprise's implementation of DUO MFA (CVSS 8.1, Splunk Enterprise)
- [CVE-2022-28545](https://cve.now/CVE-2022-28545.md): FUDforum 3.1.1 is vulnerable to Stored XSS. (no CVSS)
- [CVE-2022-28165](https://cve.now/CVE-2022-28165.md): A vulnerability in the role-based access control (RBAC) functionality of the Brocade SANNav before 2.2.0 could allow an authenticated, remot (no CVSS, Brocade SANNav)
- [CVE-2022-28163](https://cve.now/CVE-2022-28163.md): In Brocade SANnav before Brocade SANnav 2.2.0, multiple endpoints associated with Zone management are susceptible to SQL injection, allowing (no CVSS, Brocade SANNav)
- [CVE-2022-28164](https://cve.now/CVE-2022-28164.md): Brocade SANnav before SANnav 2.2.0 application uses the Blowfish symmetric encryption algorithm for the storage of passwords. (no CVSS, Brocade SANNav)
- [CVE-2022-21934](https://cve.now/CVE-2022-21934.md): Metasys Unverified Password Change (CVSS 8.0, Johnson Controls Metasys ADS/ADX/OAS server)
- [CVE-2021-39027](https://cve.now/CVE-2021-39027.md): IBM Guardium Data Encryption (GDE) 4.0.0 and 5.0.0 prepares a structured message for communication with another component, but encoding or e (CVSS 3.0, IBM Guardium Data Encryption)
- [CVE-2021-39023](https://cve.now/CVE-2021-39023.md): IBM Guardium Data Encryption (GDE) 4.0.0 and 5.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical e (CVSS 2.7, IBM Guardium Data Encryption)
- [CVE-2020-19217](https://cve.now/CVE-2020-19217.md): SQL Injection vulnerability in admin/batch\_manager.php in piwigo v2.9.5, via the filter\_category parameter to admin.php?page=batch\_manager. (no CVSS)
- [CVE-2020-19216](https://cve.now/CVE-2020-19216.md): SQL Injection vulnerability in admin/user\_perm.php in piwigo v2.9.5, via the cat\_false parameter to admin.php?page=group\_perm. (no CVSS)
- [CVE-2020-19215](https://cve.now/CVE-2020-19215.md): SQL Injection vulnerability in admin/user\_perm.php in piwigo v2.9.5, via the cat\_false parameter to admin.php?page=user\_perm. (no CVSS)
- [CVE-2020-19213](https://cve.now/CVE-2020-19213.md): SQL Injection vulnerability in cat\_move.php in piwigo v2.9.5, via the selection parameter to move\_categories. (no CVSS)
- [CVE-2020-19212](https://cve.now/CVE-2020-19212.md): SQL Injection vulnerability in admin/group\_list.php in piwigo v2.9.5, via the group parameter to delete. (no CVSS)
- [CVE-2022-28973](https://cve.now/CVE-2022-28973.md): Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the wanMTU parameter in the function fromAdvSetMacMtuWan. (no CVSS)
- [CVE-2022-28972](https://cve.now/CVE-2022-28972.md): Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the timeZone parameter in the function form\_fast\_setting\_wifi\_set. (no CVSS)
- [CVE-2022-28971](https://cve.now/CVE-2022-28971.md): Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the list parameter in the function fromSetIpMacBind. (no CVSS)
- [CVE-2022-28970](https://cve.now/CVE-2022-28970.md): Tenda AX1806 v1.0.0.1 was discovered to contain a heap overflow via the mac parameter in the function GetParentControlInfo. (no CVSS)
- [CVE-2022-28969](https://cve.now/CVE-2022-28969.md): Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the shareSpeed parameter in the function fromSetWifiGusetBasic. (no CVSS)
- [CVE-2022-24823](https://cve.now/CVE-2022-24823.md): Local Information Disclosure Vulnerability in io.netty:netty-codec-http (CVSS 5.5, netty · io.netty:netty-codec-http)
- [CVE-2022-30295](https://cve.now/CVE-2022-30295.md): uClibc-ng through 1.0.40 and uClibc through 0.9.33.2 use predictable DNS transaction IDs that may lead to DNS cache poisoning. (no CVSS)
- [CVE-2022-30293](https://cve.now/CVE-2022-30293.md): In WebKitGTK through 2.36.0 (and WPE WebKit), there is a heap-based buffer overflow in WebCore::TextureMapperLayer::setContentsLayer in WebC (no CVSS)
- [CVE-2022-24878](https://cve.now/CVE-2022-24878.md): Improper path handling in Kustomization files allows for denial of service (CVSS 7.7, fluxcd flux2 · github.com/fluxcd/flux2 +1)
- [CVE-2022-24877](https://cve.now/CVE-2022-24877.md): Improper path handling in kustomization files allows path traversal (CVSS 9.9, fluxcd flux2 · github.com/fluxcd/flux2 +1)
- [CVE-2021-25746](https://cve.now/CVE-2021-25746.md): Ingress-nginx directive injection via annotations (CVSS 7.6, Kubernetes ingress-nginx)
- [CVE-2021-25745](https://cve.now/CVE-2021-25745.md): Ingress-nginx path can be pointed to service account token file (CVSS 7.6, Kubernetes ingress-nginx · k8s.io/ingress-nginx)
- [CVE-2022-24817](https://cve.now/CVE-2022-24817.md): Improper kubeconfig validation allows arbitrary code execution (CVSS 9.9, fluxcd flux2 · github.com/fluxcd/flux2 +2)
- [CVE-2022-28005](https://cve.now/CVE-2022-28005.md): An issue was discovered in the 3CX Phone System Management Console prior to version 18 Update 3 FINAL. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-05-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.