# CVEs published 2022-05-09

45 CVEs were published on May 9, 2022: 2 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-43712](https://cve.now/CVE-2021-43712.md): Stored XSS in Add New Employee Form in Sourcecodester Employee Daily Task Management System 1.0 Allows Remote Attacker to Inject/Store Arbit (no CVSS)
- [CVE-2022-23705](https://cve.now/CVE-2022-23705.md): A security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays, HPE Nimble Storage All Flash Arrays, and HPE Nimble (no CVSS, HPE Nimble Storage Hybrid Flash Arrays; Nimble Storage All…)
- [CVE-2022-23704](https://cve.now/CVE-2022-23704.md): A potential security vulnerability has been identified in Integrated Lights-Out 4 (iLO 4). (no CVSS, HPE Integrated Lights-Out)
- [CVE-2022-30335](https://cve.now/CVE-2022-30335.md): Bonanza Wealth Management System (BWM) 7.3.2 allows SQL injection via the login form. (no CVSS)
- [CVE-2022-29868](https://cve.now/CVE-2022-29868.md): 1Password for Mac 7.2.4 through 7.9.x before 7.9.3 is vulnerable to a process validation bypass. (no CVSS)
- [CVE-2022-30524](https://cve.now/CVE-2022-30524.md): There is an invalid memory access in the TextLine class in TextOutputDev.cc in Xpdf 4.0.4 because the text extractor mishandles characters a (no CVSS)
- [CVE-2022-29933](https://cve.now/CVE-2022-29933.md): Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password an (no CVSS, craftcms/cms)
- [CVE-2022-27412](https://cve.now/CVE-2022-27412.md): Explore CMS v1.0 was discovered to contain a SQL injection vulnerability via a /page.php?id= request. (no CVSS)
- [CVE-2022-27308](https://cve.now/CVE-2022-27308.md): A stored cross-site scripting (XSS) vulnerability in PHProjekt PhpSimplyGest v1.3.0 allows attackers to execute arbitrary web scripts or HTM (no CVSS)
- [CVE-2022-30240](https://cve.now/CVE-2022-30240.md): An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Redshift JDBC Driver 1.2.40 (no CVSS)
- [CVE-2022-30239](https://cve.now/CVE-2022-30239.md): An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Athena JDBC Driver 2.0.25 th (no CVSS)
- [CVE-2022-29972](https://cve.now/CVE-2022-29972.md): An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Redshift ODBC Driver (1.4.14 (no CVSS)
- [CVE-2022-29971](https://cve.now/CVE-2022-29971.md): An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Athena ODBC Driver 1.1.1 thr (no CVSS)
- [CVE-2022-27114](https://cve.now/CVE-2022-27114.md): There is a vulnerability in htmldoc 1.9.16. (no CVSS)
- [CVE-2022-1338](https://cve.now/CVE-2022-1338.md): Easily Generate Rest API Url \<= 1.0.0 - Admin+ Stored Cross-Site Scripting (no CVSS, Easily Generate Rest API Url)
- [CVE-2022-1303](https://cve.now/CVE-2022-1303.md): Slide Anything \< 2.3.44 - Editor+ Stored Cross-Site Scripting (no CVSS, Slide Anything – Responsive Content / HTML Slider and Carou…)
- [CVE-2022-1171](https://cve.now/CVE-2022-1171.md): Vertical scroll recent post \< 14.0 - Reflected Cross-Site Scripting (no CVSS, Vertical scroll recent post)
- [CVE-2022-1104](https://cve.now/CVE-2022-1104.md): Popup Maker \< 1.16.5 - Admin+ Stored Cross-Site Scripting (no CVSS, Popup Maker – Popup for opt-ins, lead gen, & more)
- [CVE-2022-1047](https://cve.now/CVE-2022-1047.md): Themify - Post Type Builder Search Addon \< 1.4.0 - Reflected Cross-Site Scripting (no CVSS, themify-ptb-search)
- [CVE-2022-1013](https://cve.now/CVE-2022-1013.md): Personal Dictionary \< 1.3.4 - Unauthenticated SQLi (no CVSS, Personal Dictionary)
- [CVE-2022-0948](https://cve.now/CVE-2022-0948.md): Order Listener for WooCommerce \< 3.2.2 - Unauthenticated SQLi (no CVSS, Order Listener for WooCommerce – Play Sounds Instantly on N…)
- [CVE-2022-0898](https://cve.now/CVE-2022-0898.md): IgniteUp \<= 3.4.1 - Admin+ Stored Cross-Site Scripting (no CVSS, IgniteUp – Coming Soon and Maintenance Mode)
- [CVE-2022-0874](https://cve.now/CVE-2022-0874.md): WP Social Buttons \<= 2.1 - Admin+ Stored Cross-Site Scripting (no CVSS, WP Social Buttons)
- [CVE-2022-0836](https://cve.now/CVE-2022-0836.md): SEMA API \< 4.02 - Unauthenticated SQLi (no CVSS, SEMA API)
- [CVE-2022-0826](https://cve.now/CVE-2022-0826.md): WP Video Gallery \<= 1.7.1 - Unauthenticated SQLi (no CVSS, WP Video Gallery)
- [CVE-2022-0817](https://cve.now/CVE-2022-0817.md): BadgeOS \<= 3.7.0 - Unauthenticated SQLi (no CVSS, BadgeOS)
- [CVE-2022-0814](https://cve.now/CVE-2022-0814.md): Ubigeo de Peru \< 3.6.4 - Unauthenticated SQLi (no CVSS, Ubigeo de Perú para Woocommerce y WordPress)
- [CVE-2022-0625](https://cve.now/CVE-2022-0625.md): Admin Menu Editor \<= 1.0.4 - Reflected Cross-Site Scripting (no CVSS, Admin Menu Editor)
- [CVE-2022-0592](https://cve.now/CVE-2022-0592.md): MapSVG \< 6.2.20 - Unauthenticated SQLi (no CVSS, MapSVG)
- [CVE-2022-0424](https://cve.now/CVE-2022-0424.md): Popup by Supsystic \< 1.10.9 - Unauthenticated Subscriber Email Addresses Disclosure (no CVSS, Popup by Supsystic)
- [CVE-2019-25060](https://cve.now/CVE-2019-25060.md): WP-GraphQL \< 0.3.5 - Improper Access Control (no CVSS, WPGraphQL · wp-graphql/wp-graphql)
- [CVE-2022-22481](https://cve.now/CVE-2022-22481.md): IBM Navigator for i 7.2, 7.3, and 7.4 (heritage version) could allow a remote attacker to obtain access to the web interface without valid c (CVSS 3.7, IBM i)
- [CVE-2022-22319](https://cve.now/CVE-2022-22319.md): IBM Robotic Process Automation 21.0.1 could allow a register user on the system to physically delete a queue that could cause disruption for (CVSS 4.6, IBM Robotic Process Automation as a Service · IBM Robotic P…)
- [CVE-2021-20479](https://cve.now/CVE-2021-20479.md): IBM Cloud Pak System 2.3.0 through 2.3.3.3 Interim Fix 1 uses weaker than expected cryptographic algorithms that could allow an attacker to (CVSS 5.9, IBM Cloud Pak System)
- [CVE-2022-28161](https://cve.now/CVE-2022-28161.md): An information exposure through log file vulnerability in Brocade SANNav versions before Brocade SANnav 2.2.0 could allow an authenticated, (no CVSS, Brocade SANNav)
- [CVE-2022-28162](https://cve.now/CVE-2022-28162.md): Brocade SANnav before version SANnav 2.2.0 logs the REST API Authentication token in plain text. (no CVSS, Brocade SANNav)
- [CVE-2022-27224](https://cve.now/CVE-2022-27224.md): An issue was discovered in Galleon NTS-6002-GPS 4.14.103-Galleon-NTS-6002.V12 4. (no CVSS)
- [CVE-2022-1631](https://cve.now/CVE-2022-1631.md): Users Account Pre-Takeover or Users Account Takeover. in microweber/microweber (CVSS 6.8, microweber/microweber)
- [CVE-2022-23332](https://cve.now/CVE-2022-23332.md): Command injection vulnerability in Manual Ping Form (Web UI) in Shenzhen Ejoin Information Technology Co., Ltd. (no CVSS)
- [CVE-2022-30286](https://cve.now/CVE-2022-30286.md): pyscriptjs (aka PyScript Demonstrator) in PyScript through 2022-05-04 allows a remote user to read Python source code. (no CVSS)
- [CVE-2022-23066](https://cve.now/CVE-2022-23066.md): Solana rBPF - Incorrect Calculation in sdiv instruction (CVSS 9.1, solana-labs rbpf · solana\_rbpf)
- [CVE-2022-1621](https://cve.now/CVE-2022-1621.md): Heap buffer overflow in vim\_strncpy find\_word in vim/vim (CVSS 7.3, vim/vim)
- [CVE-2022-28738](https://cve.now/CVE-2022-28738.md): A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. (no CVSS)
- [CVE-2022-28739](https://cve.now/CVE-2022-28739.md): There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. (no CVSS)
- [CVE-2022-30333](https://cve.now/CVE-2022-30333.md): RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonst (CVSS 9.8, KEV)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-05-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.