CVEs published May 9, 2022
45 CVEs were published on May 9, 2022: 2 critical, 1 high. 1 is now in CISA KEV.
- Published
- 45
- Critical
- 2
- High
- 1
- Medium
- 3
- Low
- 1
- Unrated
- 38
- Now in CISA KEV
- 1
- Fix available
- 15
Most affected products
- Brocade SANNav
- 2
- Admin Menu Editor
- 1
- BadgeOS
- 1
- craftcms/cms
- 1
- Easily Generate Rest API Url
- 1
- HPE Integrated Lights-Out
- 1
- HPE Nimble Storage Hybrid Flash Arrays; Nimble Storage All…
- 1
- IBM Cloud Pak System
- 1
- IBM i
- 1
- IBM Robotic Process Automation as a Service · IBM Robotic P…
- 1
Critical 2
High 1
Medium, low and unrated 42
- CVE-2021-43712Stored XSS in Add New Employee Form in Sourcecodester Employee Daily Task Management System 1.0 Allows Remote Attacker to Inject/Store Arbit
- CVE-2022-23705A security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays, HPE Nimble Storage All Flash Arrays, and HPE Nimble HPE Nimble Storage Hybrid Flash Arrays; Nimble Storage All…
- CVE-2022-23704A potential security vulnerability has been identified in Integrated Lights-Out 4 (iLO 4).HPE Integrated Lights-Out
- CVE-2022-30335Bonanza Wealth Management System (BWM) 7.3.2 allows SQL injection via the login form.
- CVE-2022-298681Password for Mac 7.2.4 through 7.9.x before 7.9.3 is vulnerable to a process validation bypass.
- CVE-2022-30524There is an invalid memory access in the TextLine class in TextOutputDev.cc in Xpdf 4.0.4 because the text extractor mishandles characters a
- CVE-2022-29933Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password ancraftcms/cms
- CVE-2022-27412Explore CMS v1.0 was discovered to contain a SQL injection vulnerability via a /page.php?id= request.
- CVE-2022-27308A stored cross-site scripting (XSS) vulnerability in PHProjekt PhpSimplyGest v1.3.0 allows attackers to execute arbitrary web scripts or HTM
- CVE-2022-30240An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Redshift JDBC Driver 1.2.40
- CVE-2022-30239An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Athena JDBC Driver 2.0.25 th
- CVE-2022-29972An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Redshift ODBC Driver (1.4.14
- CVE-2022-29971An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Athena ODBC Driver 1.1.1 thr
- CVE-2022-27114There is a vulnerability in htmldoc 1.9.16.
- CVE-2022-1338Easily Generate Rest API Url <= 1.0.0 - Admin+ Stored Cross-Site ScriptingEasily Generate Rest API Url
- CVE-2022-1303Slide Anything < 2.3.44 - Editor+ Stored Cross-Site ScriptingSlide Anything – Responsive Content / HTML Slider and Carou…
- CVE-2022-1171Vertical scroll recent post < 14.0 - Reflected Cross-Site ScriptingVertical scroll recent post
- CVE-2022-1104Popup Maker < 1.16.5 - Admin+ Stored Cross-Site ScriptingPopup Maker – Popup for opt-ins, lead gen, & more
- CVE-2022-1047Themify - Post Type Builder Search Addon < 1.4.0 - Reflected Cross-Site Scriptingthemify-ptb-search
- CVE-2022-1013Personal Dictionary < 1.3.4 - Unauthenticated SQLiPersonal Dictionary
- CVE-2022-0948Order Listener for WooCommerce < 3.2.2 - Unauthenticated SQLiOrder Listener for WooCommerce – Play Sounds Instantly on N…
- CVE-2022-0898IgniteUp <= 3.4.1 - Admin+ Stored Cross-Site ScriptingIgniteUp – Coming Soon and Maintenance Mode
- CVE-2022-0874WP Social Buttons <= 2.1 - Admin+ Stored Cross-Site ScriptingWP Social Buttons
- CVE-2022-0836SEMA API < 4.02 - Unauthenticated SQLiSEMA API
- CVE-2022-0826WP Video Gallery <= 1.7.1 - Unauthenticated SQLiWP Video Gallery
- CVE-2022-0817BadgeOS <= 3.7.0 - Unauthenticated SQLiBadgeOS
- CVE-2022-0814Ubigeo de Peru < 3.6.4 - Unauthenticated SQLiUbigeo de Perú para Woocommerce y WordPress
- CVE-2022-0625Admin Menu Editor <= 1.0.4 - Reflected Cross-Site ScriptingAdmin Menu Editor
- CVE-2022-0592MapSVG < 6.2.20 - Unauthenticated SQLiMapSVG
- CVE-2022-0424Popup by Supsystic < 1.10.9 - Unauthenticated Subscriber Email Addresses DisclosurePopup by Supsystic
- CVE-2019-25060WP-GraphQL < 0.3.5 - Improper Access ControlWPGraphQL · wp-graphql/wp-graphql
- CVE-2022-22481IBM Navigator for i 7.2, 7.3, and 7.4 (heritage version) could allow a remote attacker to obtain access to the web interface without valid cIBM i
- CVE-2022-22319IBM Robotic Process Automation 21.0.1 could allow a register user on the system to physically delete a queue that could cause disruption forIBM Robotic Process Automation as a Service · IBM Robotic P…
- CVE-2021-20479IBM Cloud Pak System 2.3.0 through 2.3.3.3 Interim Fix 1 uses weaker than expected cryptographic algorithms that could allow an attacker to IBM Cloud Pak System
- CVE-2022-28161An information exposure through log file vulnerability in Brocade SANNav versions before Brocade SANnav 2.2.0 could allow an authenticated, Brocade SANNav
- CVE-2022-28162Brocade SANnav before version SANnav 2.2.0 logs the REST API Authentication token in plain text.Brocade SANNav
- CVE-2022-27224An issue was discovered in Galleon NTS-6002-GPS 4.14.103-Galleon-NTS-6002.V12 4.
- CVE-2022-1631Users Account Pre-Takeover or Users Account Takeover. in microweber/microwebermicroweber/microweber
- CVE-2022-23332Command injection vulnerability in Manual Ping Form (Web UI) in Shenzhen Ejoin Information Technology Co., Ltd.
- CVE-2022-30286pyscriptjs (aka PyScript Demonstrator) in PyScript through 2022-05-04 allows a remote user to read Python source code.
- CVE-2022-28738A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2.
- CVE-2022-28739There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2.