# CVEs published 2022-05-11

174 CVEs were published on May 11, 2022: 2 critical, 42 high. Days are UTC.

- [CVE-2022-30592](https://cve.now/CVE-2022-30592.md): liblsquic/lsquic\_qenc\_hdl.c in LiteSpeed QUIC (aka LSQUIC) before 3.1.0 mishandles MAX\_TABLE\_CAPACITY. (no CVSS)
- [CVE-2022-30557](https://cve.now/CVE-2022-30557.md): Foxit PDF Reader and PDF Editor before 11.2.2 have a Type Confusion issue that causes a crash because of Unsigned32 mishandling during JavaS (no CVSS)
- [CVE-2022-29855](https://cve.now/CVE-2022-29855.md): Mitel 6800 and 6900 Series SIP phone devices through 2022-04-27 have "undocumented functionality." A vulnerability in Mitel 6800 Series and (no CVSS)
- [CVE-2022-29596](https://cve.now/CVE-2022-29596.md): MicroStrategy Enterprise Manager 2022 allows authentication bypass by triggering a login failure and then entering the Uid=/../../../../../. (no CVSS)
- [CVE-2022-30449](https://cve.now/CVE-2022-30449.md): Hospital Management System in PHP with Source Code (HMS) 1.0 was discovered to contain a SQL injection vulnerability via the editid paramete (no CVSS)
- [CVE-2022-30450](https://cve.now/CVE-2022-30450.md): A Remote Code Execution (RCE) vulnerability exists in waimairen 9.1 via wx.php (no CVSS)
- [CVE-2022-30451](https://cve.now/CVE-2022-30451.md): An authenticated user could execute code via a SQLi vulnerability in waimairenCMS before version 9.1. (no CVSS)
- [CVE-2022-30448](https://cve.now/CVE-2022-30448.md): Hospital Management System in PHP with Source Code (HMS) 1.0 was discovered to contain a File upload vulnerability in treatmentrecord.php. (no CVSS)
- [CVE-2022-30063](https://cve.now/CVE-2022-30063.md): ftcms \<=2.1 was discovered to be vulnerable to code execution attacks . (no CVSS)
- [CVE-2022-30062](https://cve.now/CVE-2022-30062.md): ftcms \<=2.1 was discovered to be vulnerable to Arbitrary File Read via tp.php (no CVSS)
- [CVE-2022-28838](https://cve.now/CVE-2022-28838.md): Adobe Acrobat Pro DC Doc flattenPages Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-30060](https://cve.now/CVE-2022-30060.md): ftcms \<=2.1 was discovered to be vulnerable to Arbitrary File Write via admin/controllers/tp.php (no CVSS)
- [CVE-2022-28837](https://cve.now/CVE-2022-28837.md): Adobe Acrobat Pro DC Doc buttonSetIcon Use-After-Free Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2022-28269](https://cve.now/CVE-2022-28269.md): Adobe Acrobat Reader DC Annotation Use-After-Free Information Disclosure Vulnerability (CVSS 3.3, Adobe Acrobat Reader)
- [CVE-2022-30061](https://cve.now/CVE-2022-30061.md): ftcms \<=2.1 was discovered to be vulnerable to directory traversal attacks via the parameter tp. (no CVSS)
- [CVE-2022-28268](https://cve.now/CVE-2022-28268.md): Adobe Acrobat Reader DC Annotation Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe Acrobat Reader)
- [CVE-2022-28267](https://cve.now/CVE-2022-28267.md): Adobe Acrobat Reader DC Annotation Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2022-28266](https://cve.now/CVE-2022-28266.md): Adobe Acrobat Reader DC Annotation Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2022-28265](https://cve.now/CVE-2022-28265.md): Adobe Acrobat Reader DC Annotation Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2022-29848](https://cve.now/CVE-2022-29848.md): In Progress Ipswitch WhatsUp Gold 17.0.0 through 21.1.1, and 22.0.0, it is possible for an authenticated user to invoke an API transaction t (no CVSS)
- [CVE-2022-29847](https://cve.now/CVE-2022-29847.md): In Progress Ipswitch WhatsUp Gold 21.0.0 through 21.1.1, and 22.0.0, it is possible for an unauthenticated attacker to invoke an API transac (no CVSS)
- [CVE-2022-29846](https://cve.now/CVE-2022-29846.md): In Progress Ipswitch WhatsUp Gold 16.1 through 21.1.1, and 22.0.0, it is possible for an unauthenticated attacker to obtain the WhatsUp Gold (no CVSS)
- [CVE-2022-29845](https://cve.now/CVE-2022-29845.md): In Progress Ipswitch WhatsUp Gold 21.1.0 through 21.1.1, and 22.0.0, it is possible for an authenticated user to invoke an API transaction t (no CVSS)
- [CVE-2022-28264](https://cve.now/CVE-2022-28264.md): Adobe Acrobat Reader DC Annotation Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2022-30453](https://cve.now/CVE-2022-30453.md): ShopWind \<= 3.4.2 has a RCE vulnerability in Database.php (no CVSS)
- [CVE-2022-28263](https://cve.now/CVE-2022-28263.md): Adobe Acrobat Reader DC Annotation Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2022-28262](https://cve.now/CVE-2022-28262.md): Adobe Acrobat Reader DC Annotation Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2022-30452](https://cve.now/CVE-2022-30452.md): ShopWind \<= v3.4.2 has a Sql injection vulnerability in Database.php (no CVSS)
- [CVE-2022-28261](https://cve.now/CVE-2022-28261.md): Adobe Acrobat Reader DC Annotation Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2022-28260](https://cve.now/CVE-2022-28260.md): Adobe Acrobat Reader DC Annotation Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2022-30057](https://cve.now/CVE-2022-30057.md): Shopwind \<=v3.4.2 was discovered to contain a stored cross-site scripting (XSS) vulnerability. (no CVSS)
- [CVE-2022-28259](https://cve.now/CVE-2022-28259.md): Adobe Acrobat Reader DC Annotation Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2022-28258](https://cve.now/CVE-2022-28258.md): Adobe Acrobat Reader DC Annotation Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2022-28257](https://cve.now/CVE-2022-28257.md): Adobe Acrobat Reader DC Annotation Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2022-24584](https://cve.now/CVE-2022-24584.md): Incorrect access control in Yubico OTP functionality of the YubiKey hardware tokens along with the Yubico OTP validation server. (no CVSS)
- [CVE-2022-30059](https://cve.now/CVE-2022-30059.md): Shopwind \<=v3.4.2 was discovered to contain a Arbitrary File Delete vulnerability via the neirong parameter at \\backend\\controllers\\DbContro (no CVSS)
- [CVE-2022-28256](https://cve.now/CVE-2022-28256.md): Adobe Acrobat Reader DC Annotation Use-After-Free Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2022-30058](https://cve.now/CVE-2022-30058.md): Shopwind \<=v3.4.2 was discovered to contain a Arbitrary File Download vulnerability via the neirong parameter at \\backend\\controllers\\DbCont (no CVSS)
- [CVE-2022-28255](https://cve.now/CVE-2022-28255.md): Adobe Acrobat Reader DC Annotation Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2022-28254](https://cve.now/CVE-2022-28254.md): Adobe Acrobat Reader DC Annotation Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2022-28253](https://cve.now/CVE-2022-28253.md): Adobe Acrobat Reader DC Annotation Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2022-28252](https://cve.now/CVE-2022-28252.md): Adobe Acrobat Reader DC Annotation Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe Acrobat Reader)
- [CVE-2022-28251](https://cve.now/CVE-2022-28251.md): Adobe Acrobat Reader DC Annotation Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2022-28250](https://cve.now/CVE-2022-28250.md): Adobe Acrobat Reader DC Annotation Use-After-Free Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2022-28249](https://cve.now/CVE-2022-28249.md): Adobe Acrobat Reader DC Annotation Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2022-28248](https://cve.now/CVE-2022-28248.md): Adobe Acrobat Reader DC Annotation Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2022-28247](https://cve.now/CVE-2022-28247.md): Adobe Acrobat Uninstaller Hard Link Leads To Remote Code Execution (CVSS 6.7, Adobe Acrobat Reader)
- [CVE-2022-28246](https://cve.now/CVE-2022-28246.md): Adobe Acrobat Reader DC Doc Object Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2022-28245](https://cve.now/CVE-2022-28245.md): Adobe Acrobat Reader DC Doc Object Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2022-28244](https://cve.now/CVE-2022-28244.md): Adobe Acrobat Reader DC CSP Bypass Leads To Privilege Escalation (CVSS 6.3, Adobe Acrobat Reader)
- [CVE-2022-28243](https://cve.now/CVE-2022-28243.md): Adobe Acrobat Reader DC Doc Object Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-30048](https://cve.now/CVE-2022-30048.md): Mingsoft MCMS 5.2.7 was discovered to contain a SQL injection vulnerability in /mdiy/dict/list URI via orderBy parameter. (no CVSS)
- [CVE-2022-28242](https://cve.now/CVE-2022-28242.md): Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-30047](https://cve.now/CVE-2022-30047.md): Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability in /mdiy/dict/listExcludeApp URI via orderBy parameter. (no CVSS)
- [CVE-2022-28241](https://cve.now/CVE-2022-28241.md): Adobe Acrobat Reader DC Doc Object Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-28240](https://cve.now/CVE-2022-28240.md): Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-42648](https://cve.now/CVE-2021-42648.md): Cross-site scripting (XSS) vulnerability exists in Coder Code-Server before 3.12.0, allows attackers to execute arbitrary code via crafted U (no CVSS, code-server)
- [CVE-2021-28290](https://cve.now/CVE-2021-28290.md): A cross-site scripting (XSS) vulnerability in Skoruba IdentityServer4.Admin before 2.0.0 via unencoded value passed to the data-secret-value (no CVSS)
- [CVE-2021-36613](https://cve.now/CVE-2021-36613.md): Mikrotik RouterOs before stable 6.48.2 suffers from a memory corruption vulnerability in the ptp process. (no CVSS)
- [CVE-2021-34085](https://cve.now/CVE-2021-34085.md): Read access violation in the III\_dequantize\_sample function in mpglibDBL/layer3.c in mp3gain through 1.5.2-r2 allows remote attackers to cau (no CVSS)
- [CVE-2022-28239](https://cve.now/CVE-2022-28239.md): Adobe Acrobat Reader DC Annotation Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-31330](https://cve.now/CVE-2021-31330.md): A Cross-Site Scripting (XSS) vulnerability exists within Review Board versions 3.0.20 and 4.0 RC1 and earlier. (no CVSS)
- [CVE-2021-36614](https://cve.now/CVE-2021-36614.md): Mikrotik RouterOs before stable 6.48.2 suffers from a memory corruption vulnerability in the tr069-client process. (no CVSS)
- [CVE-2021-33317](https://cve.now/CVE-2021-33317.md): The TRENDnet TI-PG1284i switch(hw v2.0R) prior to version 2.0.2.S0 suffers from a null pointer dereference vulnerability. (no CVSS)
- [CVE-2021-33315](https://cve.now/CVE-2021-33315.md): The TRENDnet TI-PG1284i switch(hw v2.0R) prior to version 2.0.2.S0 suffers from an integer underflow vulnerability. (no CVSS)
- [CVE-2021-33316](https://cve.now/CVE-2021-33316.md): The TRENDnet TI-PG1284i switch(hw v2.0R) prior to version 2.0.2.S0 suffers from an integer underflow vulnerability. (no CVSS)
- [CVE-2022-28238](https://cve.now/CVE-2022-28238.md): Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-28237](https://cve.now/CVE-2022-28237.md): Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-28236](https://cve.now/CVE-2022-28236.md): Adobe Acrobat Reader DC Annotation Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-28235](https://cve.now/CVE-2022-28235.md): Adobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-28234](https://cve.now/CVE-2022-28234.md): Adobe Acrobat Reader DC Heap Overflow Could Lead to RCE (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-28233](https://cve.now/CVE-2022-28233.md): Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-30040](https://cve.now/CVE-2022-30040.md): Tenda AX1803 v1.0.0.1\_2890 is vulnerable to Buffer Overflow. (no CVSS)
- [CVE-2022-28232](https://cve.now/CVE-2022-28232.md): Adobe Acrobat Reader DC Collab Object Use-After-Free Information Disclosure Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-28231](https://cve.now/CVE-2022-28231.md): Adobe Acrobat Reader DC Doc Object Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-28230](https://cve.now/CVE-2022-28230.md): Adobe Acrobat Reader DC AcroForm calculateNow Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-27802](https://cve.now/CVE-2022-27802.md): Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-27801](https://cve.now/CVE-2022-27801.md): Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-27800](https://cve.now/CVE-2022-27800.md): Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-27799](https://cve.now/CVE-2022-27799.md): Adobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-27798](https://cve.now/CVE-2022-27798.md): Adobe Acrobat Reader DC zoomType Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-27797](https://cve.now/CVE-2022-27797.md): Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-27796](https://cve.now/CVE-2022-27796.md): Adobe Acrobat Reader DC AcroForm isBoxChecked Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-27795](https://cve.now/CVE-2022-27795.md): Adobe Acrobat Reader DC AcroForm isDefaultChecked Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-27794](https://cve.now/CVE-2022-27794.md): Adobe Acrobat Reader DC Font Parsing Uninitialized Variable Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-27793](https://cve.now/CVE-2022-27793.md): Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-27792](https://cve.now/CVE-2022-27792.md): Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-27791](https://cve.now/CVE-2022-27791.md): Adobe Acrobat Reader DC Font Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-27790](https://cve.now/CVE-2022-27790.md): Adobe Acrobat Reader DC Font Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-27789](https://cve.now/CVE-2022-27789.md): Adobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-27788](https://cve.now/CVE-2022-27788.md): Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-27787](https://cve.now/CVE-2022-27787.md): Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-27786](https://cve.now/CVE-2022-27786.md): Adobe Acrobat Reader DC Font Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-27785](https://cve.now/CVE-2022-27785.md): Adobe Acrobat Reader DC Font Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-24104](https://cve.now/CVE-2022-24104.md): Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-24103](https://cve.now/CVE-2022-24103.md): Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-24102](https://cve.now/CVE-2022-24102.md): Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2022-24101](https://cve.now/CVE-2022-24101.md): Adobe Acrobat Reader DC Annotation Use-After-Free Information Disclosure Vulnerability (CVSS 3.3, Adobe Acrobat Reader)
- [CVE-2021-30361](https://cve.now/CVE-2021-30361.md): The Check Point Gaia Portal's GUI Clients allowed authenticated administrators with permission for the GUI Clients settings to inject a comm (no CVSS, Check Point Gaia Portal)
- [CVE-2021-46744](https://cve.now/CVE-2021-46744.md): An attacker with access to a malicious hypervisor may be able to infer data values used in a SEV guest on AMD CPUs by monitoring ciphertext (no CVSS, AMD Processors)
- [CVE-2021-26400](https://cve.now/CVE-2021-26400.md): AMD processors may speculatively re-order load instructions which can result in stale data being observed when multiple processors are opera (no CVSS, AMD Processors)
- [CVE-2022-0027](https://cve.now/CVE-2022-0027.md): Cortex XSOAR: Incorrect Authorization Vulnerability When Generating Reports (CVSS 4.3, Palo Alto Networks Cortex XSOAR)
- [CVE-2022-0026](https://cve.now/CVE-2022-0026.md): Cortex XDR Agent: Unintended Program Execution Leads to Local Privilege Escalation (PE) Vulnerability (CVSS 6.7, Palo Alto Networks Cortex XDR Agent)
- [CVE-2022-0025](https://cve.now/CVE-2022-0025.md): Cortex XDR Agent: An Uncontrolled Search Path Element Leads to Local Privilege Escalation (PE) Vulnerability (CVSS 6.7, Palo Alto Networks Cortex XDR Agent)
- [CVE-2022-0024](https://cve.now/CVE-2022-0024.md): PAN-OS: Improper Neutralization Vulnerability Leads to Unintended Program Execution During Configuration Commit (CVSS 7.2, Palo Alto Networks PAN-OS)
- [CVE-2021-26388](https://cve.now/CVE-2021-26388.md): Improper validation of the BIOS directory may allow for searches to read beyond the directory table copy in RAM, exposing out of bounds memo (no CVSS, AMD EPYC™ Processors · AMD Ryzen™ Series +1)
- [CVE-2021-26376](https://cve.now/CVE-2021-26376.md): Insufficient checks in System Management Unit (SMU) FeatureConfig may result in reenabling features potentially resulting in denial of resou (no CVSS, AMD EPYC™ Processors · AMD Ryzen™ Series +1)
- [CVE-2021-26373](https://cve.now/CVE-2021-26373.md): Insufficient bound checks in the System Management Unit (SMU) may result in a system voltage malfunction that could result in denial of reso (no CVSS, AMD EPYC™ Processors · AMD Ryzen™ Series +1)
- [CVE-2021-26348](https://cve.now/CVE-2021-26348.md): Failure to flush the Translation Lookaside Buffer (TLB) of the I/O memory management unit (IOMMU) may lead an IO device to write to memory i (no CVSS, AMD EPYC™ Processors)
- [CVE-2021-26364](https://cve.now/CVE-2021-26364.md): Insufficient bounds checking in an SMU mailbox register could allow an attacker to potentially read outside of the SRAM address range which (no CVSS, AMD EPYC™ Processors)
- [CVE-2021-26349](https://cve.now/CVE-2021-26349.md): Failure to assign a new report ID to an imported guest may potentially result in an SEV-SNP guest VM being tricked into trusting a dishonest (no CVSS, AMD EPYC™ Processors)
- [CVE-2021-26378](https://cve.now/CVE-2021-26378.md): Insufficient bound checks in the System Management Unit (SMU) may result in access to an invalid address space that could result in denial o (no CVSS, AMD EPYC™ Processors · AMD Ryzen™ Series +1)
- [CVE-2021-26347](https://cve.now/CVE-2021-26347.md): Failure to validate the integer operand in ASP (AMD Secure Processor) bootloader may allow an attacker to introduce an integer overflow in t (no CVSS, AMD Ryzen 5000 Series)
- [CVE-2021-26342](https://cve.now/CVE-2021-26342.md): In SEV guest VMs, the CPU may fail to flush the Translation Lookaside Buffer (TLB) following a particular sequence of operations that includ (no CVSS, AMD EPYC™ Processors)
- [CVE-2021-26375](https://cve.now/CVE-2021-26375.md): Insufficient General Purpose IO (GPIO) bounds check in System Management Unit (SMU) may result in access/updates from/to invalid address spa (no CVSS, AMD EPYC™ Processors · AMD Ryzen™ Series +1)
- [CVE-2021-26372](https://cve.now/CVE-2021-26372.md): Insufficient bound checks related to PCIE in the System Management Unit (SMU) may result in access to an invalid address space that could re (no CVSS, AMD EPYC™ Processors · AMD Ryzen™ Series +1)
- [CVE-2021-26339](https://cve.now/CVE-2021-26339.md): A bug in AMD CPU’s core logic may allow for an attacker, using specific code from an unprivileged VM, to trigger a CPU core hang resulting i (no CVSS, AMD EPYC™ Processors · AMD Ryzen™ Series +1)
- [CVE-2021-26350](https://cve.now/CVE-2021-26350.md): A TOCTOU race condition in SMU may allow for the caller to obtain and manipulate the address of a message port register which may result in (no CVSS, AMD EPYC™ Processors)
- [CVE-2022-22320](https://cve.now/CVE-2022-22320.md): IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. (CVSS 4.8, IBM QRadar SIEM)
- [CVE-2021-39059](https://cve.now/CVE-2021-39059.md): IBM Jazz Foundation (IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2) is vulnerable to cross-site scripting. (CVSS 5.4, IBM Jazz Team Server)
- [CVE-2021-38969](https://cve.now/CVE-2021-38969.md): IBM Spectrum Virtualize 8.2, 8.3, and 8.4 could allow an attacker to allow unauthorized access due to the reuse of support generated credent (CVSS 5.6, IBM Spectrum Virtualize)
- [CVE-2021-43066](https://cve.now/CVE-2021-43066.md): A external control of file name or path in Fortinet FortiClientWindows version 7.0.2 and below, version 6.4.6 and below, version 6.2.9 and b (CVSS 8.4, Fortinet FortiClientWindows)
- [CVE-2021-3611](https://cve.now/CVE-2021-3611.md): A stack overflow vulnerability was found in the Intel HD Audio device (intel-hda) of QEMU. (no CVSS, QEMU)
- [CVE-2022-22975](https://cve.now/CVE-2022-22975.md): An issue was discovered in the Pinniped Supervisor with either LADPIdentityProvider or ActiveDirectoryIdentityProvider resources. (no CVSS, Pinniped)
- [CVE-2022-23137](https://cve.now/CVE-2022-23137.md): ZTE's ZXCDN product has a reflective XSS vulnerability. (no CVSS, ZXCDN)
- [CVE-2022-29616](https://cve.now/CVE-2022-29616.md): SAP Host Agent, SAP NetWeaver and ABAP Platform allow an attacker to leverage logical errors in memory management to cause a memory corrupti (no CVSS, SAP SE SAP NetWeaver and ABAP Platform · SAP SE SAP Host Ag…)
- [CVE-2022-29613](https://cve.now/CVE-2022-29613.md): Due to insufficient input validation, SAP Employee Self Service allows an authenticated attacker with user privileges to alter employee numb (no CVSS, SAP SE SAP Employee Self Service)
- [CVE-2022-29611](https://cve.now/CVE-2022-29611.md): SAP NetWeaver Application Server for ABAP and ABAP Platform do not perform necessary authorization checks for an authenticated user, resulti (no CVSS, SAP SE SAP NetWeaver Application Server for ABAP and ABAP P…)
- [CVE-2022-29610](https://cve.now/CVE-2022-29610.md): SAP NetWeaver Application Server ABAP allows an authenticated attacker to upload malicious files and delete (theme) data, which could result (no CVSS, SAP SE SAP NetWeaver Application Server ABAP)
- [CVE-2022-28774](https://cve.now/CVE-2022-28774.md): Under certain conditions, the SAP Host Agent logfile shows information which would otherwise be restricted. (no CVSS, SAP SE SAP Host Agent)
- [CVE-2022-28214](https://cve.now/CVE-2022-28214.md): During an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, 430, authentication credentials are bein (no CVSS, SAP SE SAP BusinessObjects Enterprise)
- [CVE-2022-27656](https://cve.now/CVE-2022-27656.md): The Web administration UI of SAP Web Dispatcher and the Internet Communication Manager (ICM) does not sufficiently encode user-controlled in (no CVSS, SAP SE SAP NetWeaver AS for ABAP and Java · SAP SE SAP Web…)
- [CVE-2022-1124](https://cve.now/CVE-2022-1124.md): An improper authorization issue has been discovered in GitLab CE/EE affecting all versions prior to 14.8.6, all versions from 14.9.0 prior t (CVSS 4.3, GitLab)
- [CVE-2022-1510](https://cve.now/CVE-2022-1510.md): An issue has been discovered in GitLab affecting all versions starting from 13.9 before 14.8.6, all versions starting from 14.9 before 14.9. (CVSS 6.5, GitLab)
- [CVE-2022-1460](https://cve.now/CVE-2022-1460.md): An issue has been discovered in GitLab affecting all versions starting from 9.2 before 14.8.6, all versions starting from 14.9 before 14.9.4 (CVSS 6.1, GitLab)
- [CVE-2022-1406](https://cve.now/CVE-2022-1406.md): Improper input validation in GitLab CE/EE affecting all versions from 8.12 prior to 14.8.6, all versions from 14.9.0 prior to 14.9.4, and 14 (CVSS 6.5, GitLab)
- [CVE-2022-1428](https://cve.now/CVE-2022-1428.md): An issue has been discovered in GitLab affecting all versions before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions sta (CVSS 4.3, GitLab)
- [CVE-2022-1426](https://cve.now/CVE-2022-1426.md): An issue has been discovered in GitLab affecting all versions starting from 12.6 before 14.8.6, all versions starting from 14.9 before 14.9. (CVSS 2.0, GitLab)
- [CVE-2021-43081](https://cve.now/CVE-2021-43081.md): An improper neutralization of input during web page generation vulnerability \[CWE-79\] in FortiOS version 7.0.3 and below, 6.4.8 and below, 6 (CVSS 6.1, Fortinet FortiProxy)
- [CVE-2022-1352](https://cve.now/CVE-2022-1352.md): Due to an insecure direct object reference vulnerability in Gitlab EE/CE affecting all versions from 11.0 prior to 14.8.6, 14.9 prior to 14. (CVSS 5.3, GitLab)
- [CVE-2022-1433](https://cve.now/CVE-2022-1433.md): An issue has been discovered in GitLab affecting all versions starting from 14.4 before 14.8.6, all versions starting from 14.9 before 14.9. (CVSS 2.6, GitLab)
- [CVE-2022-29898](https://cve.now/CVE-2022-29898.md): Remote Code Execution in all versions of various RAD-ISM-900-EN-\* devices by PHOENIX CONTACT (CVSS 9.1, PHOENIX CONTACT RAD-ISM-900-EN-BD/B · PHOENIX CONTACT RA… +1)
- [CVE-2022-29897](https://cve.now/CVE-2022-29897.md): Remote Code Execution in all versions of various RAD-ISM-900-EN-\* devices by PHOENIX CONTACT (CVSS 9.1, PHOENIX CONTACT RAD-ISM-900-EN-BD/B · PHOENIX CONTACT RA… +1)
- [CVE-2021-34606](https://cve.now/CVE-2021-34606.md): XINJE XD/E Series PLC Program Tool DLL Hijacking (CVSS 7.3, XINJE XD/E Series PLC Program Tool)
- [CVE-2021-34605](https://cve.now/CVE-2021-34605.md): Xinje XD/E Series PLC Program Tool Zip Slip (CVSS 7.3, XINJE XD/E Series PLC Program Tool)
- [CVE-2022-1545](https://cve.now/CVE-2022-1545.md): It was possible to disclose details of confidential notes created via the API in Gitlab CE/EE affecting all versions from 13.2 prior to 14.8 (CVSS 4.3, GitLab)
- [CVE-2021-44167](https://cve.now/CVE-2021-44167.md): An incorrect permission assignment for critical resource vulnerability \[CWE-732\] in FortiClient for Linux version 6.0.8 and below, 6.2.9 and (CVSS 6.8, Fortinet FortiClientLinux)
- [CVE-2021-42651](https://cve.now/CVE-2021-42651.md): A Server Side Template Injection (SSTI) vulnerability in Pentest-Collaboration-Framework v1.0.8 allows an authenticated remote attacker to e (no CVSS)
- [CVE-2021-37851](https://cve.now/CVE-2021-37851.md): Local Privilege Escalation in ESET product for Windows (CVSS 7.3, ESET, spol. s r.o. ESET NOD32 Antivirus · ESET, spol. s… +8)
- [CVE-2022-28078](https://cve.now/CVE-2022-28078.md): Home Owners Collection Management v1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the Admin panel via t (no CVSS)
- [CVE-2022-28077](https://cve.now/CVE-2022-28077.md): Home Owners Collection Management v1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the Admin panel via t (no CVSS)
- [CVE-2022-29932](https://cve.now/CVE-2022-29932.md): The HTTP Server in PRIMEUR SPAZIO 2.5.1.954 (File Transfer) allows an unauthenticated attacker to obtain sensitive data (related to the cont (no CVSS)
- [CVE-2022-29978](https://cve.now/CVE-2022-29978.md): There is a floating point exception error in sixel\_encoder\_do\_resize, encoder.c:633 in libsixel img2sixel 1.8.6. (no CVSS)
- [CVE-2022-29977](https://cve.now/CVE-2022-29977.md): There is an assertion failure error in stbi\_\_jpeg\_huff\_decode, stb\_image.h:1894 in libsixel img2sixel 1.8.6. (no CVSS)
- [CVE-2022-29009](https://cve.now/CVE-2022-29009.md): Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Cyber Cafe Management System Project v (no CVSS)
- [CVE-2022-29008](https://cve.now/CVE-2022-29008.md): An insecure direct object reference (IDOR) vulnerability in the viewid parameter of Bus Pass Management System v1.0 allows attackers to acce (no CVSS)
- [CVE-2022-29007](https://cve.now/CVE-2022-29007.md): Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Dairy Farm Shop Management System v1.0 (no CVSS)
- [CVE-2022-29006](https://cve.now/CVE-2022-29006.md): Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Directory Management System v1.0 allow (no CVSS)
- [CVE-2022-29728](https://cve.now/CVE-2022-29728.md): Survey Sparrow Enterprise Survey Software 2022 has a Reflected cross-site scripting (XSS) vulnerability in the test parameter. (no CVSS)
- [CVE-2022-29656](https://cve.now/CVE-2022-29656.md): Wedding Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /Wedding-Management/package\_d (no CVSS)
- [CVE-2022-29655](https://cve.now/CVE-2022-29655.md): An arbitrary file upload vulnerability in the Upload Photos module of Wedding Management System v1.0 allows attackers to execute arbitrary c (no CVSS)
- [CVE-2022-29318](https://cve.now/CVE-2022-29318.md): An arbitrary file upload vulnerability in the New Entry module of Car Rental Management System v1.0 allows attackers to execute arbitrary co (no CVSS)
- [CVE-2022-29316](https://cve.now/CVE-2022-29316.md): Complete Online Job Search System v1.0 was discovered to contain a SQL injection vulnerability via /eris/index.php?q=result&searchfor=advanc (no CVSS)
- [CVE-2022-29317](https://cve.now/CVE-2022-29317.md): Simple Bus Ticket Booking System v1.0 was discovered to contain multiple SQL injection vulnerbilities via the username and password paramete (no CVSS)
- [CVE-2022-29727](https://cve.now/CVE-2022-29727.md): Survey Sparrow Enterprise Survey Software 2022 has a Stored cross-site scripting (XSS) vulnerability in the Signup parameter. (no CVSS)
- [CVE-2022-29976](https://cve.now/CVE-2022-29976.md): An Authenticated Reflected Cross-site scripting at BCC Parameter was discovered in MDaemon before 22.0.0 . (no CVSS)
- [CVE-2022-29975](https://cve.now/CVE-2022-29975.md): An Authenticated Reflected Cross-site scripting at CC Parameter was discovered in MDaemon before 22.0.0 . (no CVSS)
- [CVE-2020-19228](https://cve.now/CVE-2020-19228.md): An issue was found in bludit v3.13.0, unsafe implementation of the backup plugin allows attackers to upload arbitrary files. (no CVSS)
- [CVE-2021-3254](https://cve.now/CVE-2021-3254.md): Asus DSL-N14U-B1 1.1.2.3\_805 allows remote attackers to cause a Denial of Service (DoS) via a TCP SYN scan using nmap. (no CVSS)
- [CVE-2022-26116](https://cve.now/CVE-2022-26116.md): Multiple improper neutralization of special elements used in SQL commands ('SQL Injection') vulnerability \[CWE-89\] in FortiNAC version 8.3.7 (CVSS 7.2, Fortinet FortiNAC)
- [CVE-2021-42646](https://cve.now/CVE-2021-42646.md): XML External Entity (XXE) vulnerability in the file based service provider creation feature of the Management Console in WSO2 API Manager 2. (no CVSS)
- [CVE-2022-1622](https://cve.now/CVE-2022-1622.md): LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif\_lzw.c:619, allowing attackers to cause a denial-of-service via a (CVSS 5.5, libtiff)
- [CVE-2022-1623](https://cve.now/CVE-2022-1623.md): LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif\_lzw.c:624, allowing attackers to cause a denial-of-service via a (CVSS 5.5, libtiff)
- [CVE-2022-23743](https://cve.now/CVE-2022-23743.md): Check Point ZoneAlarm before version 15.8.200.19118 allows a local actor to escalate privileges during the upgrade process. (no CVSS, ZoneAlarm.)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-05-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.