# CVEs published 2022-05-10

196 CVEs were published on May 10, 2022: 7 critical, 60 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2022-28601](https://cve.now/CVE-2022-28601.md): A Two-Factor Authentication (2FA) bypass vulnerability in "Simple 2FA Plugin for Moodle" by LMS Doctor allows remote attackers to overwrite (no CVSS)
- [CVE-2022-30130](https://cve.now/CVE-2022-30130.md): .NET Framework Denial of Service Vulnerability (CVSS 3.3, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 · Microsoft…)
- [CVE-2022-30129](https://cve.now/CVE-2022-30129.md): Visual Studio Code Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Visual Studio Code)
- [CVE-2022-29151](https://cve.now/CVE-2022-29151.md): Windows Cluster Shared Volume (CSV) Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows Server)
- [CVE-2022-29150](https://cve.now/CVE-2022-29150.md): Windows Cluster Shared Volume (CSV) Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows Server)
- [CVE-2022-29148](https://cve.now/CVE-2022-29148.md): Visual Studio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio)
- [CVE-2022-29145](https://cve.now/CVE-2022-29145.md): .NET and Visual Studio Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET · Microsoft Visual Studio +11)
- [CVE-2022-29142](https://cve.now/CVE-2022-29142.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2022-29141](https://cve.now/CVE-2022-29141.md): Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-29140](https://cve.now/CVE-2022-29140.md): Windows Print Spooler Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2022-29139](https://cve.now/CVE-2022-29139.md): Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-29138](https://cve.now/CVE-2022-29138.md): Windows Clustered Shared Volume Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows Server)
- [CVE-2022-29137](https://cve.now/CVE-2022-29137.md): Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-29135](https://cve.now/CVE-2022-29135.md): Windows Cluster Shared Volume (CSV) Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows Server)
- [CVE-2022-29134](https://cve.now/CVE-2022-29134.md): Windows Clustered Shared Volume Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows Server)
- [CVE-2022-29133](https://cve.now/CVE-2022-29133.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-29132](https://cve.now/CVE-2022-29132.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-29131](https://cve.now/CVE-2022-29131.md): Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-29130](https://cve.now/CVE-2022-29130.md): Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows)
- [CVE-2022-29129](https://cve.now/CVE-2022-29129.md): Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-29128](https://cve.now/CVE-2022-29128.md): Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-29127](https://cve.now/CVE-2022-29127.md): BitLocker Security Feature Bypass Vulnerability (CVSS 4.2, Microsoft Windows)
- [CVE-2022-29126](https://cve.now/CVE-2022-29126.md): Tablet Windows User Interface Application Core Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2022-29125](https://cve.now/CVE-2022-29125.md): Windows Push Notifications Apps Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2022-29123](https://cve.now/CVE-2022-29123.md): Windows Clustered Shared Volume Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows Server)
- [CVE-2022-29122](https://cve.now/CVE-2022-29122.md): Windows Clustered Shared Volume Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows Server)
- [CVE-2022-29121](https://cve.now/CVE-2022-29121.md): Windows WLAN AutoConfig Service Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2022-29120](https://cve.now/CVE-2022-29120.md): Windows Clustered Shared Volume Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows Server)
- [CVE-2022-29117](https://cve.now/CVE-2022-29117.md): .NET and Visual Studio Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET · Microsoft Visual Studio +14)
- [CVE-2022-29116](https://cve.now/CVE-2022-29116.md): Windows Kernel Information Disclosure Vulnerability (CVSS 4.7, Microsoft Windows)
- [CVE-2022-29115](https://cve.now/CVE-2022-29115.md): Windows Fax Service Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-29114](https://cve.now/CVE-2022-29114.md): Windows Print Spooler Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2022-29113](https://cve.now/CVE-2022-29113.md): Windows Digital Media Receiver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-29112](https://cve.now/CVE-2022-29112.md): Windows Graphics Component Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2022-29110](https://cve.now/CVE-2022-29110.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Excel · Microsoft Office Web Apps Server 2013 Ser…)
- [CVE-2022-29109](https://cve.now/CVE-2022-29109.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise)
- [CVE-2022-29108](https://cve.now/CVE-2022-29108.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2022-29107](https://cve.now/CVE-2022-29107.md): Microsoft Office Security Feature Bypass Vulnerability (CVSS 5.5, Microsoft Office LTSC · Microsoft Office +3)
- [CVE-2022-29106](https://cve.now/CVE-2022-29106.md): Windows Hyper-V Shared Virtual Disk Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows Server)
- [CVE-2022-29105](https://cve.now/CVE-2022-29105.md): Microsoft Windows Media Foundation Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-29104](https://cve.now/CVE-2022-29104.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-29103](https://cve.now/CVE-2022-29103.md): Windows Remote Access Connection Manager Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-29102](https://cve.now/CVE-2022-29102.md): Windows Failover Cluster Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows Server)
- [CVE-2022-26940](https://cve.now/CVE-2022-26940.md): Remote Desktop Protocol Client Information Disclosure Vulnerability (CVSS 6.5, Microsoft Remote Desktop client for Windows Desktop · Mi… +1)
- [CVE-2022-26939](https://cve.now/CVE-2022-26939.md): Storage Spaces Direct Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows Server)
- [CVE-2022-26938](https://cve.now/CVE-2022-26938.md): Storage Spaces Direct Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows Server)
- [CVE-2022-26937](https://cve.now/CVE-2022-26937.md): Windows Network File System Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows Server)
- [CVE-2022-26936](https://cve.now/CVE-2022-26936.md): Windows Server Service Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2022-26935](https://cve.now/CVE-2022-26935.md): Windows WLAN AutoConfig Service Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2022-26934](https://cve.now/CVE-2022-26934.md): Windows Graphics Component Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows · Microsoft Office 2019 for Mac +2)
- [CVE-2022-26933](https://cve.now/CVE-2022-26933.md): Windows NTFS Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2022-26932](https://cve.now/CVE-2022-26932.md): Storage Spaces Direct Elevation of Privilege Vulnerability (CVSS 8.2, Microsoft Windows Server)
- [CVE-2022-26931](https://cve.now/CVE-2022-26931.md): Windows Kerberos Elevation of Privilege Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2022-26930](https://cve.now/CVE-2022-26930.md): Windows Remote Access Connection Manager Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2022-26927](https://cve.now/CVE-2022-26927.md): Windows Graphics Component Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-26926](https://cve.now/CVE-2022-26926.md): Windows Address Book Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-26925](https://cve.now/CVE-2022-26925.md): Windows LSA Spoofing Vulnerability (CVSS 8.1, KEV, Microsoft Windows)
- [CVE-2022-26923](https://cve.now/CVE-2022-26923.md): Active Directory Domain Services Elevation of Privilege Vulnerability (CVSS 8.8, KEV, Microsoft Windows)
- [CVE-2022-26913](https://cve.now/CVE-2022-26913.md): Windows Authentication Information Disclosure Vulnerability (CVSS 7.4, Microsoft Windows)
- [CVE-2022-24466](https://cve.now/CVE-2022-24466.md): Windows Hyper-V Security Feature Bypass Vulnerability (CVSS 4.1, Microsoft Windows)
- [CVE-2022-23279](https://cve.now/CVE-2022-23279.md): Windows ALPC Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2022-23270](https://cve.now/CVE-2022-23270.md): Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2022-23267](https://cve.now/CVE-2022-23267.md): .NET and Visual Studio Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET Core · Microsoft .NET +14)
- [CVE-2022-22713](https://cve.now/CVE-2022-22713.md): Windows Hyper-V Denial of Service Vulnerability (CVSS 5.6, Microsoft Windows)
- [CVE-2022-22019](https://cve.now/CVE-2022-22019.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-22017](https://cve.now/CVE-2022-22017.md): Remote Desktop Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Remote Desktop client for Windows Desktop · Mi… +1)
- [CVE-2022-22016](https://cve.now/CVE-2022-22016.md): Windows PlayToManager Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2022-22015](https://cve.now/CVE-2022-22015.md): Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows · Microsoft Remote Desktop client for Win…)
- [CVE-2022-22014](https://cve.now/CVE-2022-22014.md): Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-22013](https://cve.now/CVE-2022-22013.md): Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2022-22012](https://cve.now/CVE-2022-22012.md): Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows)
- [CVE-2022-22011](https://cve.now/CVE-2022-22011.md): Windows Graphics Component Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2022-21978](https://cve.now/CVE-2022-21978.md): Microsoft Exchange Server Elevation of Privilege Vulnerability (CVSS 8.2, Microsoft Exchange Server 2016 Cumulative Update · Micro… +1)
- [CVE-2022-21972](https://cve.now/CVE-2022-21972.md): Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2022-1417](https://cve.now/CVE-2022-1417.md): Improper access control in GitLab CE/EE affecting all versions starting from 8.12 before 14.8.6, all versions starting from 14.9 before 14.9 (CVSS 4.3, GitLab)
- [CVE-2022-1431](https://cve.now/CVE-2022-1431.md): An issue has been discovered in GitLab affecting all versions starting from 12.10 before 14.8.6, all versions starting from 14.9 before 14.9 (CVSS 4.3, GitLab)
- [CVE-2022-0866](https://cve.now/CVE-2022-0866.md): This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configur (no CVSS, Wildfly)
- [CVE-2022-20121](https://cve.now/CVE-2022-20121.md): In getNodeValue of USCCDMPlugin.java, there is a possible disclosure of ICCID due to a missing permission check. (no CVSS, Android)
- [CVE-2022-20120](https://cve.now/CVE-2022-20120.md): Product: AndroidVersions: Android kernelAndroid ID: A-203213034References: N/A (no CVSS, Android)
- [CVE-2022-20119](https://cve.now/CVE-2022-20119.md): In private\_handle\_t of mali\_gralloc\_buffer.h, there is a possible information disclosure due to uninitialized data. (no CVSS, Android)
- [CVE-2022-20118](https://cve.now/CVE-2022-20118.md): In ion\_ioctl and related functions of ion.c, there is a possible use after free due to a race condition. (no CVSS, Android)
- [CVE-2022-20117](https://cve.now/CVE-2022-20117.md): In (TBD) of (TBD), there is a possible way to decrypt local data encrypted by the GSC due to improperly used crypto. (no CVSS, Android)
- [CVE-2021-39738](https://cve.now/CVE-2021-39738.md): In CarSetings, there is a possible to pair BT device bypassing user's consent due to a missing permission check. (no CVSS, Android)
- [CVE-2022-20116](https://cve.now/CVE-2022-20116.md): In onEntryUpdated of OngoingCallController.kt, it is possible to launch non-exported activities due to intent redirection. (no CVSS, Android)
- [CVE-2022-20115](https://cve.now/CVE-2022-20115.md): In broadcastServiceStateChanged of TelephonyRegistry.java, there is a possible way to learn base station information without location permis (no CVSS, Android)
- [CVE-2022-20114](https://cve.now/CVE-2022-20114.md): In placeCall of TelecomManager.java, there is a possible way for an application to keep itself running with foreground service importance du (no CVSS, Android)
- [CVE-2022-20113](https://cve.now/CVE-2022-20113.md): In mPreference of DefaultUsbConfigurationPreferenceController.java, there is a possible way to enable file transfer mode due to a logic erro (no CVSS, Android)
- [CVE-2022-20112](https://cve.now/CVE-2022-20112.md): In getAvailabilityStatus of PrivateDnsPreferenceController.java, there is a possible way for a guest user to change private DNS settings due (no CVSS, Android)
- [CVE-2022-20011](https://cve.now/CVE-2022-20011.md): In getArray of NotificationManagerService.java , there is a possible leak of one user notifications to another due to missing check. (no CVSS, Android)
- [CVE-2022-20010](https://cve.now/CVE-2022-20010.md): In l2cble\_process\_sig\_cmd of l2c\_ble.cc, there is a possible out of bounds read due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2022-20009](https://cve.now/CVE-2022-20009.md): In various functions of the USB gadget subsystem, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2022-20008](https://cve.now/CVE-2022-20008.md): In mmc\_blk\_read\_single of block.c, there is a possible way to read kernel heap memory due to uninitialized data. (no CVSS, Android)
- [CVE-2022-20007](https://cve.now/CVE-2022-20007.md): In startActivityForAttachedApplicationIfNeeded of RootWindowContainer.java, there is a possible way to overlay an app that believes it's sti (no CVSS, Android)
- [CVE-2022-20006](https://cve.now/CVE-2022-20006.md): In several functions of KeyguardServiceWrapper.java and related files,, there is a possible way to briefly view what's under the lockscreen (no CVSS, Android)
- [CVE-2022-20005](https://cve.now/CVE-2022-20005.md): In validateApkInstallLocked of PackageInstallerSession.java, there is a way to force a mismatch between running code and a parsed APK . (no CVSS, Android)
- [CVE-2022-20004](https://cve.now/CVE-2022-20004.md): In checkSlicePermission of SliceManagerService.java, it is possible to access any slice URI due to improper input validation. (no CVSS, Android)
- [CVE-2021-39700](https://cve.now/CVE-2021-39700.md): In the policies of adbd.te, there was a logic error which caused the CTS Listening Ports Test to report invalid results. (no CVSS, Android)
- [CVE-2021-39670](https://cve.now/CVE-2021-39670.md): In setStream of WallpaperManager.java, there is a possible way to cause a permanent DoS due to improper input validation. (no CVSS, Android)
- [CVE-2022-29398](https://cve.now/CVE-2022-29398.md): TOTOLINK N600R V4.3.0cu.7647\_B20210106 was discovered to contain a stack overflow via the File parameter in the function FUN\_0041309c. (no CVSS)
- [CVE-2022-29399](https://cve.now/CVE-2022-29399.md): TOTOLINK N600R V4.3.0cu.7647\_B20210106 was discovered to contain a stack overflow via the url parameter in the function FUN\_00415bf0. (no CVSS)
- [CVE-2022-29397](https://cve.now/CVE-2022-29397.md): TOTOLINK N600R V4.3.0cu.7647\_B20210106 was discovered to contain a stack overflow via the comment parameter in the function FUN\_004196c8. (no CVSS)
- [CVE-2022-29395](https://cve.now/CVE-2022-29395.md): TOTOLINK N600R V4.3.0cu.7647\_B20210106 was discovered to contain a stack overflow via the apcliKey parameter in the function FUN\_0041bac4. (no CVSS)
- [CVE-2022-29396](https://cve.now/CVE-2022-29396.md): TOTOLINK N600R V4.3.0cu.7647\_B20210106 was discovered to contain a stack overflow via the comment parameter in the function FUN\_00418f10. (no CVSS)
- [CVE-2022-29394](https://cve.now/CVE-2022-29394.md): TOTOLINK N600R V4.3.0cu.7647\_B20210106 was discovered to contain a stack overflow via the macAddress parameter in the function FUN\_0041b448. (no CVSS)
- [CVE-2022-29393](https://cve.now/CVE-2022-29393.md): TOTOLINK N600R V4.3.0cu.7647\_B20210106 was discovered to contain a stack overflow via the comment parameter in the function FUN\_004192cc. (no CVSS)
- [CVE-2022-29391](https://cve.now/CVE-2022-29391.md): TOTOLINK N600R V4.3.0cu.7647\_B20210106 was discovered to contain a stack overflow via the comment parameter in the function FUN\_004200c8. (no CVSS)
- [CVE-2022-29392](https://cve.now/CVE-2022-29392.md): TOTOLINK N600R V4.3.0cu.7647\_B20210106 was discovered to contain a stack overflow via the comment parameter in the function FUN\_00418c24. (no CVSS)
- [CVE-2022-30278](https://cve.now/CVE-2022-30278.md): A vulnerability in Black Duck Hub’s embedded MadCap Flare documentation files could allow an unauthenticated remote attacker to conduct a cr (no CVSS, Synopsys Black Duck Hub)
- [CVE-2022-27167](https://cve.now/CVE-2022-27167.md): Arbitrary File Deletion in ESET products for Windows (CVSS 7.1, ESET, spol. s r.o. ESET NOD32 Antivirus · ESET, spol. s… +8)
- [CVE-2022-1567](https://cve.now/CVE-2022-1567.md): WP JS \<= 2.0.6 - Reflected Cross-Site Scripting (CVSS 6.1, halmat WP JS)
- [CVE-2022-1463](https://cve.now/CVE-2022-1463.md): Booking Calendar \<= 9.1 - PHP Object Injection via Shortcode (CVSS 8.8, wpdevelop Booking Calendar)
- [CVE-2022-1505](https://cve.now/CVE-2022-1505.md): RSVPMaker \<= 9.2.6 - Unauthenticated SQL Injection (CVSS 9.8, davidfcarr RSVPMaker)
- [CVE-2022-1209](https://cve.now/CVE-2022-1209.md): Ultimate Member \<= 2.3.1 - Arbitrary Redirect (CVSS 4.3, ultimatemember Ultimate Member – User Profile, Registration…)
- [CVE-2022-1442](https://cve.now/CVE-2022-1442.md): Metform Elementor Contact Form Builder \<= 2.1.3 - Sensitive Information Disclosure (CVSS 7.5, roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…)
- [CVE-2022-1453](https://cve.now/CVE-2022-1453.md): RSVPMaker \<= 9.2.5 - Unauthenticated SQL Injection (CVSS 9.8, davidfcarr RSVPMaker)
- [CVE-2022-1476](https://cve.now/CVE-2022-1476.md): All-in-One WP Migration \<= 7.58 - Directory Traversal to File Deletion on Windows Hosts (CVSS 6.6, servmask All-in-One WP Migration and Backup)
- [CVE-2022-0947](https://cve.now/CVE-2022-0947.md): Arctic Wireless Gateway Firewall vulnerability (CVSS 9.0, ABB ARG600 Wireless Gateway series)
- [CVE-2022-28986](https://cve.now/CVE-2022-28986.md): LMS Doctor Simple 2 Factor Authentication Plugin For Moodle Affected: 2021072900 has an Insecure direct object references (IDOR) vulnerabili (no CVSS)
- [CVE-2021-26353](https://cve.now/CVE-2021-26353.md): Failure to validate inputs in SMM may allow an attacker to create a mishandled error leaving the DRTM UApp in a partially initialized state (no CVSS, AMD 3rd Gen EPYC)
- [CVE-2021-46771](https://cve.now/CVE-2021-46771.md): Insufficient validation of addresses in AMD Secure Processor (ASP) firmware system call may potentially lead to arbitrary code execution by (no CVSS, 3rd Gen AMD EPYC™)
- [CVE-2021-43010](https://cve.now/CVE-2021-43010.md): In Safedog Apache v4.0.30255, attackers can bypass this product for SQL injection. (no CVSS)
- [CVE-2021-26324](https://cve.now/CVE-2021-26324.md): A bug with the SEV-ES TMR may lead to a potential loss of memory integrity for SNP-active VMs. (no CVSS, 3rd Gen AMD EPYC™)
- [CVE-2021-26332](https://cve.now/CVE-2021-26332.md): Failure to verify SEV-ES TMR is not in MMIO space, SEV-ES FW could result in a potential loss of integrity or availability. (no CVSS, 3rd Gen AMD EPYC™)
- [CVE-2021-26352](https://cve.now/CVE-2021-26352.md): Insufficient bound checks in System Management Unit (SMU) PCIe Hot Plug table may result in access/updates from/to invalid address space tha (no CVSS, AMD Ryzen™ Series · AMD Athlon™ Series)
- [CVE-2021-26370](https://cve.now/CVE-2021-26370.md): Improper validation of destination address in SVC\_LOAD\_FW\_IMAGE\_BY\_INSTANCE and SVC\_LOAD\_BINARY\_BY\_ATTRIB in a malicious UApp or ABL may all (no CVSS, 2nd Gen AMD EPYC™ · 3rd Gen AMD EPYC™)
- [CVE-2021-26390](https://cve.now/CVE-2021-26390.md): A malicious or compromised UApp or ABL may coerce the bootloader into corrupting arbitrary memory potentially leading to loss of integrity o (no CVSS, AMD Ryzen™ Series · AMD Athlon™ Series)
- [CVE-2021-26408](https://cve.now/CVE-2021-26408.md): Insufficient validation of elliptic curve points in SEV-legacy firmware may compromise SEV-legacy guest migration potentially resulting in l (no CVSS, 1st Gen AMD EPYC™ · 2nd Gen AMD EPYC™)
- [CVE-2022-23677](https://cve.now/CVE-2022-23677.md): A remote execution of arbitrary code vulnerability was discovered in ArubaOS-Switch Devices version(s): ArubaOS-Switch 15.xx.xxxx: All versi (no CVSS, ArubaOS-Switch Devices)
- [CVE-2022-23676](https://cve.now/CVE-2022-23676.md): A remote execution of arbitrary code vulnerability was discovered in ArubaOS-Switch Devices version(s): ArubaOS-Switch 15.xx.xxxx: All versi (no CVSS, ArubaOS-Switch Devices)
- [CVE-2022-22774](https://cve.now/CVE-2022-22774.md): TIBCO Managed File Transfer Command Center XXE Vulnerability (CVSS 8.6, TIBCO Software TIBCO Managed File Transfer Command Center ·…)
- [CVE-2022-22454](https://cve.now/CVE-2022-22454.md): IBM InfoSphere Information Server 11.7 could allow a locally authenticated attacker to execute arbitrary commands on the system by sending a (CVSS 5.9, IBM InfoSphere Information Server)
- [CVE-2021-39024](https://cve.now/CVE-2021-39024.md): IBM Guardium Data Encryption (GDE) 4.0.0.0 and 5.0.0.0 is vulnerable to cross-site scripting. (CVSS 4.8, IBM Guardium Data Encryption)
- [CVE-2022-26988](https://cve.now/CVE-2022-26988.md): TP-Link TL-WDR7660 2.0.30, Mercury D196G 20200109\_2.0.4, and Fast FAC1900R 20190827\_2.0.2 routers have a stack overflow issue in \`MntAte\` fu (no CVSS)
- [CVE-2022-26987](https://cve.now/CVE-2022-26987.md): TP-Link TL-WDR7660 2.0.30, Mercury D196G 20200109\_2.0.4, and Fast FAC1900R 20190827\_2.0.2 routers have a stack overflow issue in \`MmtAtePras (no CVSS)
- [CVE-2022-28896](https://cve.now/CVE-2022-28896.md): A command injection vulnerability in the component /setnetworksettings/SubnetMask of D-Link DIR882 DIR882A1\_FW130B06 allows attackers to esc (no CVSS)
- [CVE-2022-28895](https://cve.now/CVE-2022-28895.md): A command injection vulnerability in the component /setnetworksettings/IPAddress of D-Link DIR882 DIR882A1\_FW130B06 allows attackers to esca (no CVSS)
- [CVE-2022-28901](https://cve.now/CVE-2022-28901.md): A command injection vulnerability in the component /SetTriggerLEDBlink/Blink of D-Link DIR882 DIR882A1\_FW130B06 allows attackers to escalate (no CVSS)
- [CVE-2022-28912](https://cve.now/CVE-2022-28912.md): TOTOLink N600R V5.3c.7159\_B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/setUp (no CVSS)
- [CVE-2022-28913](https://cve.now/CVE-2022-28913.md): TOTOLink N600R V5.3c.7159\_B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/setUp (no CVSS)
- [CVE-2022-28910](https://cve.now/CVE-2022-28910.md): TOTOLink N600R V5.3c.7159\_B20190425 was discovered to contain a command injection vulnerability via the devicename parameter in /setting/set (no CVSS)
- [CVE-2022-28911](https://cve.now/CVE-2022-28911.md): TOTOLink N600R V5.3c.7159\_B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/Cloud (no CVSS)
- [CVE-2022-28909](https://cve.now/CVE-2022-28909.md): TOTOLink N600R V5.3c.7159\_B20190425 was discovered to contain a command injection vulnerability via the webwlanidx parameter in /setting/set (no CVSS)
- [CVE-2022-28907](https://cve.now/CVE-2022-28907.md): TOTOLink N600R V5.3c.7159\_B20190425 was discovered to contain a command injection vulnerability via the hosttime function in /setting/NTPSyn (no CVSS)
- [CVE-2022-28908](https://cve.now/CVE-2022-28908.md): TOTOLink N600R V5.3c.7159\_B20190425 was discovered to contain a command injection vulnerability via the ipdoamin parameter in /setting/setDi (no CVSS)
- [CVE-2022-28905](https://cve.now/CVE-2022-28905.md): TOTOLink N600R V5.3c.7159\_B20190425 was discovered to contain a command injection vulnerability via the devicemac parameter in /setting/setD (no CVSS)
- [CVE-2022-28906](https://cve.now/CVE-2022-28906.md): TOTOLink N600R V5.3c.7159\_B20190425 was discovered to contain a command injection vulnerability via the langtype parameter in /setting/setLa (no CVSS)
- [CVE-2022-28915](https://cve.now/CVE-2022-28915.md): D-Link DIR-816 A2\_v1.10CNB04 was discovered to contain a command injection vulnerability via the admuser and admpass parameters in /goform/s (no CVSS)
- [CVE-2022-29327](https://cve.now/CVE-2022-29327.md): D-Link DIR-816 A2\_v1.10CNB04 was discovered to contain a stack overflow via the urladd parameter in /goform/websURLFilterAddDel. (no CVSS)
- [CVE-2022-29322](https://cve.now/CVE-2022-29322.md): D-Link DIR-816 A2\_v1.10CNB04 was discovered to contain a stack overflow via the IPADDR and nvmacaddr parameters in /goform/form2Dhcpip. (no CVSS)
- [CVE-2022-29321](https://cve.now/CVE-2022-29321.md): D-Link DIR-816 A2\_v1.10CNB04 was discovered to contain a stack overflow via the lanip parameter in /goform/setNetworkLan. (no CVSS)
- [CVE-2022-29323](https://cve.now/CVE-2022-29323.md): D-Link DIR-816 A2\_v1.10CNB04 was discovered to contain a stack overflow via the MAC parameter in /goform/editassignment. (no CVSS)
- [CVE-2022-29324](https://cve.now/CVE-2022-29324.md): D-Link DIR-816 A2\_v1.10CNB04 was discovered to contain a stack overflow via the proto parameter in /goform/form2IPQoSTcAdd. (no CVSS)
- [CVE-2022-29325](https://cve.now/CVE-2022-29325.md): D-Link DIR-816 A2\_v1.10CNB04 was discovered to contain a stack overflow via the addurlfilter parameter in /goform/websURLFilter. (no CVSS)
- [CVE-2022-29326](https://cve.now/CVE-2022-29326.md): D-Link DIR-816 A2\_v1.10CNB04 was discovered to contain a stack overflow via the addhostfilter parameter in /goform/websHostFilter. (no CVSS)
- [CVE-2022-29328](https://cve.now/CVE-2022-29328.md): D-Link DAP-1330\_OSS-firmware\_1.00b21 was discovered to contain a stack overflow via the function checkvalidupgrade. (no CVSS)
- [CVE-2022-29329](https://cve.now/CVE-2022-29329.md): D-Link DAP-1330\_OSS-firmware\_1.00b21 was discovered to contain a heap overflow via the devicename parameter in /goform/setDeviceSettings. (no CVSS)
- [CVE-2022-28110](https://cve.now/CVE-2022-28110.md): Hotel Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at the login page. (no CVSS)
- [CVE-2022-29591](https://cve.now/CVE-2022-29591.md): Tenda TX9 Pro 22.03.02.10 devices have a SetNetControlList buffer overflow. (no CVSS)
- [CVE-2021-43094](https://cve.now/CVE-2021-43094.md): An SQL Injection vulnerability exists in OpenMRS Reference Application Standalone Edition \<=2.11 and Platform Standalone Edition \<=2.4.0 via (no CVSS)
- [CVE-2021-42645](https://cve.now/CVE-2021-42645.md): CMSimple\_XH 1.7.4 is affected by a remote code execution (RCE) vulnerability. (no CVSS)
- [CVE-2021-42581](https://cve.now/CVE-2021-42581.md): Prototype poisoning in function mapObjIndexed in Ramda 0.27.0 and earlier allows attackers to compromise integrity or availability of applic (no CVSS)
- [CVE-2022-1397](https://cve.now/CVE-2022-1397.md): API Privilege Escalation in alextselegidis/easyappointments (CVSS 8.8, alextselegidis/easyappointments)
- [CVE-2022-1649](https://cve.now/CVE-2022-1649.md): Null pointer dereference in libr/bin/format/mach0/mach0.c in radareorg/radare2 in radareorg/radare2 (CVSS 7.6, radareorg/radare2)
- [CVE-2022-29883](https://cve.now/CVE-2022-29883.md): A vulnerability has been identified in SICAM T (All versions \< V3.0). (CVSS 5.3, Siemens SICAM T)
- [CVE-2022-29882](https://cve.now/CVE-2022-29882.md): A vulnerability has been identified in SICAM T (All versions \< V3.0). (CVSS 7.1, Siemens SICAM T)
- [CVE-2022-29881](https://cve.now/CVE-2022-29881.md): A vulnerability has been identified in SICAM T (All versions \< V3.0). (CVSS 5.3, Siemens SICAM T)
- [CVE-2022-29880](https://cve.now/CVE-2022-29880.md): A vulnerability has been identified in SICAM T (All versions \< V3.0). (CVSS 6.5, Siemens SICAM T)
- [CVE-2022-29879](https://cve.now/CVE-2022-29879.md): A vulnerability has been identified in SICAM T (All versions \< V3.0). (CVSS 4.3, Siemens SICAM T)
- [CVE-2022-29878](https://cve.now/CVE-2022-29878.md): A vulnerability has been identified in SICAM T (All versions \< V3.0). (CVSS 7.5, Siemens SICAM T)
- [CVE-2022-29877](https://cve.now/CVE-2022-29877.md): A vulnerability has been identified in SICAM P850 (All versions \< V3.00), SICAM P850 (All versions \< V3.00), SICAM P850 (All versions \< V3.0 (no CVSS, Siemens SICAM P850 · Siemens SICAM P855)
- [CVE-2022-29876](https://cve.now/CVE-2022-29876.md): A vulnerability has been identified in SICAM T (All versions \< V3.0). (CVSS 7.1, Siemens SICAM T)
- [CVE-2022-29874](https://cve.now/CVE-2022-29874.md): A vulnerability has been identified in SICAM T (All versions \< V3.0). (CVSS 8.8, Siemens SICAM T)
- [CVE-2022-29873](https://cve.now/CVE-2022-29873.md): A vulnerability has been identified in SICAM T (All versions \< V3.0). (CVSS 9.8, Siemens SICAM T)
- [CVE-2022-29872](https://cve.now/CVE-2022-29872.md): A vulnerability has been identified in SICAM T (All versions \< V3.0). (CVSS 8.8, Siemens SICAM T)
- [CVE-2022-29801](https://cve.now/CVE-2022-29801.md): A vulnerability has been identified in Teamcenter V12.4 (All versions \< V12.4.0.13), Teamcenter V13.0 (All versions \< V13.0.0.9). (no CVSS, Siemens Teamcenter)
- [CVE-2022-29033](https://cve.now/CVE-2022-29033.md): A vulnerability has been identified in JT2Go (All versions \< V13.3.0.3), Teamcenter Visualization V13.3 (All versions \< V13.3.0.3), Teamcent (no CVSS, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2022-29032](https://cve.now/CVE-2022-29032.md): A vulnerability has been identified in JT2Go (All versions \< V13.3.0.3), Teamcenter Visualization V13.3 (All versions \< V13.3.0.3), Teamcent (no CVSS, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2022-29031](https://cve.now/CVE-2022-29031.md): A vulnerability has been identified in JT2Go (All versions \< V13.3.0.3), Teamcenter Visualization V13.3 (All versions \< V13.3.0.3), Teamcent (no CVSS, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2022-29030](https://cve.now/CVE-2022-29030.md): A vulnerability has been identified in JT2Go (All versions \< V13.3.0.3), Teamcenter Visualization V13.3 (All versions \< V13.3.0.3), Teamcent (no CVSS, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2022-29029](https://cve.now/CVE-2022-29029.md): A vulnerability has been identified in JT2Go (All versions \< V13.3.0.3), Teamcenter Visualization V13.3 (All versions \< V13.3.0.3), Teamcent (no CVSS, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2022-29028](https://cve.now/CVE-2022-29028.md): A vulnerability has been identified in JT2Go (All versions \< V13.3.0.3), Teamcenter Visualization V13.3 (All versions \< V13.3.0.3), Teamcent (no CVSS, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2022-27653](https://cve.now/CVE-2022-27653.md): A vulnerability has been identified in Simcenter Femap (All versions \< V2022.2). (no CVSS, Siemens Simcenter Femap)
- [CVE-2022-27640](https://cve.now/CVE-2022-27640.md): A vulnerability has been identified in SIMATIC CP 442-1 RNA (All versions \< V1.5.18), SIMATIC CP 443-1 RNA (All versions \< V1.5.18). (no CVSS, Siemens SIMATIC CP 442-1 RNA · Siemens SIMATIC CP 443-1 RNA)
- [CVE-2022-27242](https://cve.now/CVE-2022-27242.md): A vulnerability has been identified in OpenV2G (V0.9.4). (no CVSS, Siemens OpenV2G)
- [CVE-2022-24290](https://cve.now/CVE-2022-24290.md): A vulnerability has been identified in Teamcenter V12.4 (All versions \< V12.4.0.13), Teamcenter V13.0 (All versions \< V13.0.0.9), Teamcenter (no CVSS, Siemens Teamcenter)
- [CVE-2022-24287](https://cve.now/CVE-2022-24287.md): A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions \< V9.0 SP3 UC06), SIMATIC PCS 7 V (CVSS 7.8, Siemens SIMATIC PCS 7 · Siemens SIMATIC WinCC Runtime Pr… +2)
- [CVE-2022-24045](https://cve.now/CVE-2022-24045.md): A vulnerability has been identified in Desigo DXR2 (All versions \< V01.21.142.5-22), Desigo PXC3 (All versions \< V01.21.142.4-18), Desigo PX (no CVSS, Siemens Desigo DXR2 · Siemens Desigo PXC3 +2)
- [CVE-2022-24044](https://cve.now/CVE-2022-24044.md): A vulnerability has been identified in Desigo DXR2 (All versions \< V01.21.142.5-22), Desigo PXC3 (All versions \< V01.21.142.4-18), Desigo PX (no CVSS, Siemens Desigo DXR2 · Siemens Desigo PXC3 +2)
- [CVE-2022-24043](https://cve.now/CVE-2022-24043.md): A vulnerability has been identified in Desigo DXR2 (All versions \< V01.21.142.5-22), Desigo PXC3 (All versions \< V01.21.142.4-18), Desigo PX (no CVSS, Siemens Desigo DXR2 · Siemens Desigo PXC3 +2)
- [CVE-2022-24042](https://cve.now/CVE-2022-24042.md): A vulnerability has been identified in Desigo DXR2 (All versions \< V01.21.142.5-22), Desigo PXC3 (All versions \< V01.21.142.4-18), Desigo PX (no CVSS, Siemens Desigo DXR2 · Siemens Desigo PXC3 +2)
- [CVE-2022-24041](https://cve.now/CVE-2022-24041.md): A vulnerability has been identified in Desigo DXR2 (All versions \< V01.21.142.5-22), Desigo PXC3 (All versions \< V01.21.142.4-18), Desigo PX (no CVSS, Siemens Desigo DXR2 · Siemens Desigo PXC3 +2)
- [CVE-2022-24040](https://cve.now/CVE-2022-24040.md): A vulnerability has been identified in Desigo DXR2 (All versions \< V01.21.142.5-22), Desigo PXC3 (All versions \< V01.21.142.4-18), Desigo PX (no CVSS, Siemens Desigo DXR2 · Siemens Desigo PXC3 +2)
- [CVE-2022-24039](https://cve.now/CVE-2022-24039.md): A vulnerability has been identified in Desigo PXC4 (All versions \< V02.20.142.10-10884), Desigo PXC5 (All versions \< V02.20.142.10-10884). (no CVSS, Siemens Desigo PXC4 · Siemens Desigo PXC5)
- [CVE-2021-41545](https://cve.now/CVE-2021-41545.md): A vulnerability has been identified in Desigo DXR2 (All versions \< V01.21.142.5-22), Desigo PXC3 (All versions \< V01.21.142.4-18), Desigo PX (no CVSS, Siemens Desigo DXR2 · Siemens Desigo PXC3 +2)
- [CVE-2022-1537](https://cve.now/CVE-2022-1537.md): file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in gruntjs/grunt (CVSS 7.8, gruntjs/grunt · grunt)
- [CVE-2022-1629](https://cve.now/CVE-2022-1629.md): Buffer Over-read in function find\_next\_quote in vim/vim (CVSS 6.6, vim/vim)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-05-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.