# CVEs published 2022-05-12

159 CVEs were published on May 12, 2022: 18 critical, 33 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2022-29218](https://cve.now/CVE-2022-29218.md): Unauthorized takeover for new versions of some platform-specific gems (CVSS 7.7, rubygems.org)
- [CVE-2022-27134](https://cve.now/CVE-2022-27134.md): EOSIO batdappboomx v327c04cf has an Access-control vulnerability in the \`transfer\` function of the smart contract which allows remote attack (no CVSS)
- [CVE-2021-27777](https://cve.now/CVE-2021-27777.md): HCL Unica Platform is vulnerable to XML External Entity (XXE) injection (CVSS 7.5, HCL Software HCL Unica)
- [CVE-2021-27773](https://cve.now/CVE-2021-27773.md): HCL Sametime is vulnerable to clickjacking (CVSS 4.2, HCL Software Sametime)
- [CVE-2021-27772](https://cve.now/CVE-2021-27772.md): HCL Sametime is vulnerable to an information disclosure (CVSS 7.1, HCL Software Sametime)
- [CVE-2021-27771](https://cve.now/CVE-2021-27771.md): HCL Sametime is susceptible a file transfer service vulnerability (CVSS 8.2, HCL Software Sametime)
- [CVE-2021-27770](https://cve.now/CVE-2021-27770.md): HCL Sametime is vulnerable to arbitrary HTTP requests (CVSS 6.8, HCL Software Sametime)
- [CVE-2021-27769](https://cve.now/CVE-2021-27769.md): HCL Sametime is vulnerable to an information disclosure (CVSS 5.3, HCL Software Sametime)
- [CVE-2021-27768](https://cve.now/CVE-2021-27768.md): An SSL certificate host verification vulnerability affects HCL Verse for Android (CVSS 6.3, HCL Software Verse for Android)
- [CVE-2020-22985](https://cve.now/CVE-2020-22985.md): Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbi (no CVSS)
- [CVE-2020-22986](https://cve.now/CVE-2020-22986.md): Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbi (no CVSS)
- [CVE-2020-22987](https://cve.now/CVE-2020-22987.md): Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbi (no CVSS)
- [CVE-2020-22984](https://cve.now/CVE-2020-22984.md): Cross-Site Scripting (XSS) vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbi (no CVSS)
- [CVE-2022-23166](https://cve.now/CVE-2022-23166.md): Sysaid – Sysaid Local File Inclusion (LFI) (CVSS 6.1, Sysaid)
- [CVE-2022-23165](https://cve.now/CVE-2022-23165.md): Sysaid – Sysaid 14.2.0 Reflected Cross-Site Scripting (XSS) (CVSS 5.5, Sysaid)
- [CVE-2022-22798](https://cve.now/CVE-2022-22798.md): Sysaid – Pro Plus Edition, SysAid Help Desk Broken Access Control (CVSS 6.8, Sysaid)
- [CVE-2022-22797](https://cve.now/CVE-2022-22797.md): Sysaid – sysaid Open Redirect (CVSS 4.6, Sysaid)
- [CVE-2022-22796](https://cve.now/CVE-2022-22796.md): Sysaid – Sysaid System Takeover (CVSS 7.0, Sysaid)
- [CVE-2022-22971](https://cve.now/CVE-2022-22971.md): In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vu (no CVSS, Spring Framework · org.springframework:spring-messaging)
- [CVE-2022-22970](https://cve.now/CVE-2022-22970.md): In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable t (no CVSS, Spring Framework · org.springframework:spring-beans)
- [CVE-2022-23139](https://cve.now/CVE-2022-23139.md): ZTE's ZXMP M721 product has a permission and access control vulnerability. (no CVSS, ZXMP M721)
- [CVE-2022-23742](https://cve.now/CVE-2022-23742.md): Check Point Endpoint Security Client for Windows versions earlier than E86.40 copy files for forensics reports from a directory with low pri (CVSS 7.8, Check Point Endpoint Security Client for Windows)
- [CVE-2021-27500](https://cve.now/CVE-2021-27500.md): EIPStackGroup OpENer Ethernet/IP Reachable Assertion (CVSS 7.5, EIPStackGroup OpENer EtherNet/IP)
- [CVE-2021-27498](https://cve.now/CVE-2021-27498.md): EIPStackGroup OpENer Ethernet/IP Reachable Assertion (CVSS 7.5, EIPStackGroup OpENer EtherNet/IP)
- [CVE-2021-27482](https://cve.now/CVE-2021-27482.md): EIPStackGroup OpENer Ethernet/IP Out-of-bounds Read (CVSS 7.5, EIPStackGroup OpENer EtherNet/IP)
- [CVE-2021-27478](https://cve.now/CVE-2021-27478.md): EIPStackGroup OpENer Ethernet/IP Incorrect Conversion between Numeric Types (CVSS 8.2, EIPStackGroup OpENer EtherNet/IP)
- [CVE-2022-28818](https://cve.now/CVE-2022-28818.md): ColdFusion Reflected Cross-Site Scripting could lead to Arbitrary Code Execution (CVSS 6.1, Adobe ColdFusion)
- [CVE-2022-28819](https://cve.now/CVE-2022-28819.md): Adobe Character Animator SVG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Character Animator)
- [CVE-2021-22531](https://cve.now/CVE-2021-22531.md): A bug exist in the input parameter of Access Manager that allows supply of invalid character to trigger cross-site scripting vulnerability. (no CVSS, NetIQ Access Manager)
- [CVE-2022-29368](https://cve.now/CVE-2022-29368.md): Moddable commit before 135aa9a4a6a9b49b60aa730ebc3bcc6247d75c45 was discovered to contain an out-of-bounds read via the function fxUint8Gett (no CVSS)
- [CVE-2022-29369](https://cve.now/CVE-2022-29369.md): Nginx NJS v0.7.2 was discovered to contain a segmentation violation via njs\_lvlhsh\_bucket\_find at njs\_lvlhsh.c. (no CVSS)
- [CVE-2021-26363](https://cve.now/CVE-2021-26363.md): A malicious or compromised UApp or ABL could potentially change the value that the ASP uses for its reserved DRAM, to one outside of the fen (no CVSS, AMD Ryzen™ Series · AMD Athlon™ Series)
- [CVE-2021-26386](https://cve.now/CVE-2021-26386.md): A malicious or compromised UApp or ABL may be used by an attacker to issue a malformed system call to the Stage 2 Bootloader potentially lea (no CVSS, AMD Ryzen™ Series · AMD Athlon™ Series)
- [CVE-2021-26317](https://cve.now/CVE-2021-26317.md): Failure to verify the protocol in SMM may allow an attacker to control the protocol and modify SPI flash resulting in a potential arbitrary (no CVSS, AMD Ryzen™ Series · AMD Athlon™ Series)
- [CVE-2021-26368](https://cve.now/CVE-2021-26368.md): Insufficient check of the process type in Trusted OS (TOS) may allow an attacker with privileges to enable a lesser privileged process to un (no CVSS, AMD Ryzen™ Series · AMD Athlon™ Series)
- [CVE-2021-26361](https://cve.now/CVE-2021-26361.md): A malicious or compromised User Application (UApp) or AGESA Boot Loader (ABL) could be used by an attacker to exfiltrate arbitrary memory fr (no CVSS, AMD Ryzen™ Series · AMD Athlon™ Series)
- [CVE-2021-26362](https://cve.now/CVE-2021-26362.md): A malicious or compromised UApp or ABL may be used by an attacker to issue a malformed system call which results in mapping sensitive System (no CVSS, AMD Ryzen™ Series · AMD Athlon™ Series)
- [CVE-2021-26351](https://cve.now/CVE-2021-26351.md): Insufficient DRAM address validation in System Management Unit (SMU) may result in a DMA (Direct Memory Access) read/write from/to invalid D (no CVSS, AMD Ryzen™ Series · AMD Athlon™ Series)
- [CVE-2022-29363](https://cve.now/CVE-2022-29363.md): Phpok v6.1 was discovered to contain a deserialization vulnerability via the update\_f() function in login\_control.php. (no CVSS)
- [CVE-2021-26366](https://cve.now/CVE-2021-26366.md): An attacker, who gained elevated privileges via some other vulnerability, may be able to read data from Boot ROM resulting in a loss of syst (no CVSS, AMD Ryzen™ Series · AMD Athlon™ Series)
- [CVE-2021-26369](https://cve.now/CVE-2021-26369.md): A malicious or compromised UApp or ABL may be used by an attacker to send a malformed system call to the bootloader, resulting in out-of-bou (no CVSS, AMD Ryzen™ Series · AMD Athlon™ Series)
- [CVE-2022-27172](https://cve.now/CVE-2022-27172.md): A hard-coded password vulnerability exists in the console infactory functionality of InHand Networks InRouter302 V3.5.37. (CVSS 4.3, InHand Networks InRouter302)
- [CVE-2022-26782](https://cve.now/CVE-2022-26782.md): Multiple improper input validation vulnerabilities exists in the libnvram.so nvram\_import functionality of InHand Networks InRouter302 V3.5. (CVSS 9.9, InHand Networks InRouter302)
- [CVE-2022-26781](https://cve.now/CVE-2022-26781.md): Multiple improper input validation vulnerabilities exists in the libnvram.so nvram\_import functionality of InHand Networks InRouter302 V3.5. (CVSS 9.9, InHand Networks InRouter302)
- [CVE-2022-26780](https://cve.now/CVE-2022-26780.md): Multiple improper input validation vulnerabilities exists in the libnvram.so nvram\_import functionality of InHand Networks InRouter302 V3.5. (CVSS 9.9, InHand Networks InRouter302)
- [CVE-2022-26518](https://cve.now/CVE-2022-26518.md): An OS command injection vulnerability exists in the console infactory\_net functionality of InHand Networks InRouter302 V3.5.37. (CVSS 9.9, InHand Networks InRouter302)
- [CVE-2022-26510](https://cve.now/CVE-2022-26510.md): A firmware update vulnerability exists in the iburn firmware checks functionality of InHand Networks InRouter302 V3.5.37. (CVSS 9.9, InHand Networks InRouter302)
- [CVE-2022-26420](https://cve.now/CVE-2022-26420.md): An OS command injection vulnerability exists in the console infactory\_port functionality of InHand Networks InRouter302 V3.5.37. (CVSS 9.9, InHand Networks InRouter302)
- [CVE-2022-26085](https://cve.now/CVE-2022-26085.md): An OS command injection vulnerability exists in the httpd wlscan\_ASP functionality of InHand Networks InRouter302 V3.5.4. (CVSS 9.9, InHand Networks InRouter302)
- [CVE-2022-26075](https://cve.now/CVE-2022-26075.md): An OS command injection vulnerability exists in the console infactory\_wlan functionality of InHand Networks InRouter302 V3.5.37. (CVSS 9.9, InHand Networks InRouter302)
- [CVE-2022-26042](https://cve.now/CVE-2022-26042.md): An OS command injection vulnerability exists in the daretools binary functionality of InHand Networks InRouter302 V3.5.4. (CVSS 9.9, InHand Networks InRouter302)
- [CVE-2022-26020](https://cve.now/CVE-2022-26020.md): An information disclosure vulnerability exists in the router configuration export functionality of InHand Networks InRouter302 V3.5.4. (CVSS 6.3, InHand Networks InRouter302)
- [CVE-2022-26007](https://cve.now/CVE-2022-26007.md): An OS command injection vulnerability exists in the console factory functionality of InHand Networks InRouter302 V3.5.4. (CVSS 9.1, InHand Networks InRouter302)
- [CVE-2022-26002](https://cve.now/CVE-2022-26002.md): A stack-based buffer overflow vulnerability exists in the console factory functionality of InHand Networks InRouter302 V3.5.4. (CVSS 9.1, InHand Networks InRouter302)
- [CVE-2022-25995](https://cve.now/CVE-2022-25995.md): A command execution vulnerability exists in the console inhand functionality of InHand Networks InRouter302 V3.5.4. (CVSS 9.9, InHand Networks InRouter302)
- [CVE-2022-25172](https://cve.now/CVE-2022-25172.md): An information disclosure vulnerability exists in the web interface session cookie functionality of InHand Networks InRouter302 V3.5.4. (CVSS 7.5, InHand Networks InRouter302)
- [CVE-2022-24910](https://cve.now/CVE-2022-24910.md): A buffer overflow vulnerability exists in the httpd parse\_ping\_result API functionality of InHand Networks InRouter302 V3.5.4. (CVSS 8.2, InHand Networks InRouter302)
- [CVE-2022-21809](https://cve.now/CVE-2022-21809.md): A file write vulnerability exists in the httpd upload.cgi functionality of InHand Networks InRouter302 V3.5.4. (CVSS 9.9, InHand Networks InRouter302)
- [CVE-2022-21238](https://cve.now/CVE-2022-21238.md): A cross-site scripting (xss) vulnerability exists in the info.jsp functionality of InHand Networks InRouter302 V3.5.4. (CVSS 5.4, InHand Networks InRouter302)
- [CVE-2022-21182](https://cve.now/CVE-2022-21182.md): A privilege escalation vulnerability exists in the router configuration import functionality of InHand Networks InRouter302 V3.5.4. (CVSS 7.4, InHand Networks InRouter302)
- [CVE-2022-21147](https://cve.now/CVE-2022-21147.md): An out of bounds read vulnerability exists in the malware scan functionality of ESTsoft Alyac 2.5.7.7. (CVSS 5.0, ESTsoft Alyac)
- [CVE-2021-40399](https://cve.now/CVE-2021-40399.md): An exploitable use-after-free vulnerability exists in WPS Spreadsheets ( ET ) as part of WPS Office, version 11.2.0.10351. (CVSS 8.8, WPS Office)
- [CVE-2021-0155](https://cve.now/CVE-2021-0155.md): Unchecked return value in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable information discl (CVSS 5.5, Intel(R) Processors)
- [CVE-2021-0188](https://cve.now/CVE-2021-0188.md): Return of pointer value outside of expected range in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potential (CVSS 7.8, Intel(R) Processors)
- [CVE-2021-0159](https://cve.now/CVE-2021-0159.md): Improper input validation in the BIOS authenticated code module for some Intel(R) Processors may allow a privileged user to potentially enab (CVSS 7.8, Intel(R) Processors)
- [CVE-2021-33103](https://cve.now/CVE-2021-33103.md): Unintended intermediary in the BIOS authenticated code module for some Intel(R) Processors may allow a privileged user to potentially enable (CVSS 6.7, Intel(R) Processors)
- [CVE-2021-0189](https://cve.now/CVE-2021-0189.md): Use of out-of-range pointer offset in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable aesca (CVSS 7.8, Intel(R) Processors)
- [CVE-2021-33124](https://cve.now/CVE-2021-33124.md): Out-of-bounds write in the BIOS authenticated code module for some Intel(R) Processors may allow a privileged user to potentially enable aes (CVSS 6.7, Intel(R) Processors)
- [CVE-2021-33122](https://cve.now/CVE-2021-33122.md): Insufficient control flow management in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable aes (CVSS 7.8, Intel(R) Processors)
- [CVE-2021-0190](https://cve.now/CVE-2021-0190.md): Uncaught exception in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of privil (CVSS 7.8, Intel(R) Processors)
- [CVE-2021-33123](https://cve.now/CVE-2021-33123.md): Improper access control in the BIOS authenticated code module for some Intel(R) Processors may allow a privileged user to potentially enable (CVSS 7.8, Intel(R) Processors)
- [CVE-2021-0153](https://cve.now/CVE-2021-0153.md): Out-of-bounds write in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of privi (CVSS 7.8, Intel(R) Processors)
- [CVE-2021-0154](https://cve.now/CVE-2021-0154.md): Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable aescalation of (CVSS 7.8, Intel(R) Processors)
- [CVE-2022-21151](https://cve.now/CVE-2022-21151.md): Processor optimization removal or modification of security-critical code for some Intel(R) Processors may allow an authenticated user to pot (CVSS 5.5, Intel(R) Processors)
- [CVE-2021-33149](https://cve.now/CVE-2021-33149.md): Observable behavioral discrepancy in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via (CVSS 5.5, Intel(R) Processors)
- [CVE-2022-0005](https://cve.now/CVE-2022-0005.md): Sensitive information accessible by physical probing of JTAG interface for some Intel(R) Processors with SGX may allow an unprivileged user (CVSS 2.4, Intel(R) Processors with SGX)
- [CVE-2021-33117](https://cve.now/CVE-2021-33117.md): Improper access control for some 3rd Generation Intel(R) Xeon(R) Scalable Processors before BIOS version MR7, may allow a local attacker to (CVSS 5.5, Intel(R) Xeon(R) Scalable Processors)
- [CVE-2022-0004](https://cve.now/CVE-2022-0004.md): Hardware debug modes and processor INIT setting that allow override of locks for some Intel(R) Processors in Intel(R) Boot Guard and Intel(R (CVSS 6.8, Intel(R) Processors in Intel(R) Boot Guard and Intel(R) TXT)
- [CVE-2021-33082](https://cve.now/CVE-2021-33082.md): Sensitive information in resource not removed before reuse in firmware for some Intel(R) SSD and Intel(R) Optane(TM) SSD Products may allow (CVSS 4.6, Intel(R) SSD and Intel(R) Optane(TM) SSD Products)
- [CVE-2021-33083](https://cve.now/CVE-2021-33083.md): Improper authentication in firmware for some Intel(R) SSD, Intel(R) Optane(TM) SSD, Intel(R) Optane(TM) SSD DC and Intel(R) SSD DC Products (no CVSS, Intel(R) SSD, Intel(R) Optane(TM) SSD, Intel(R) Optane(TM)…)
- [CVE-2021-33069](https://cve.now/CVE-2021-33069.md): Improper resource shutdown or release in firmware for some Intel(R) SSD, Intel(R) SSD DC, Intel(R) Optane(TM) SSD and Intel(R) Optane(TM) SS (no CVSS, Intel(R) SSD, Intel(R) SSD DC, Intel(R) Optane(TM) SSD and…)
- [CVE-2021-33075](https://cve.now/CVE-2021-33075.md): Race condition in firmware for some Intel(R) Optane(TM) SSD, Intel(R) Optane(TM) SSD DC and Intel(R) SSD DC Products may allow a privileged (CVSS 4.7, Intel(R) Optane(TM) SSD, Intel(R) Optane(TM) SSD DC and Int…)
- [CVE-2021-33074](https://cve.now/CVE-2021-33074.md): Protection mechanism failure in firmware for some Intel(R) SSD, Intel(R) SSD DC and Intel(R) Optane(TM) SSD Products may allow an unauthenti (CVSS 4.6, Intel(R) SSD, Intel(R) SSD DC and Intel(R) Optane(TM) SSD P…)
- [CVE-2021-33080](https://cve.now/CVE-2021-33080.md): Exposure of sensitive system information due to uncleared debug information in firmware for some Intel(R) SSD DC, Intel(R) Optane(TM) SSD an (CVSS 6.8, Intel(R) SSD DC, Intel(R) Optane(TM) SSD and Intel(R) Optan…)
- [CVE-2021-33077](https://cve.now/CVE-2021-33077.md): Insufficient control flow management in firmware for some Intel(R) SSD, Intel(R) Optane(TM) SSD and Intel(R) SSD DC Products may allow an un (CVSS 6.8, Intel(R) SSD, Intel(R) Optane(TM) SSD and Intel(R) SSD DC P…)
- [CVE-2021-33078](https://cve.now/CVE-2021-33078.md): Race condition within a thread in firmware for some Intel(R) Optane(TM) SSD and Intel(R) SSD DC Products may allow a privileged user to pote (CVSS 4.7, Intel(R) Optane(TM) SSD and Intel(R) SSD DC Products)
- [CVE-2021-0126](https://cve.now/CVE-2021-0126.md): Improper input validation for the Intel(R) Manageability Commander before version 2.2 may allow an authenticated user to potentially enable (CVSS 8.0, Intel(R) Manageability Commander)
- [CVE-2022-21237](https://cve.now/CVE-2022-21237.md): Improper buffer access in firmware for some Intel(R) NUCs may allow a privileged user to potentially enable escalation of privilege via loca (CVSS 6.7, Intel(R) NUCs)
- [CVE-2022-24297](https://cve.now/CVE-2022-24297.md): Improper buffer restrictions in firmware for some Intel(R) NUCs may allow a privileged user to potentially enable escalation of privilege vi (CVSS 6.7, Intel(R) NUCs)
- [CVE-2021-26258](https://cve.now/CVE-2021-26258.md): Improper access control for the Intel(R) Killer(TM) Control Center software before version 2.4.3337.0 may allow an authorized user to potent (CVSS 7.8, Intel(R) Killer(TM) Control Center software)
- [CVE-2022-24382](https://cve.now/CVE-2022-24382.md): Improper input validation in firmware for some Intel(R) NUCs may allow a privileged user to potentially enable escalation of privilege via l (CVSS 6.7, Intel(R) NUCs)
- [CVE-2022-22139](https://cve.now/CVE-2022-22139.md): Uncontrolled search path in the Intel(R) XTU software before version 7.3.0.33 may allow an authenticated user to potentially enable escalati (CVSS 7.3, Intel(R) XTU software)
- [CVE-2022-21128](https://cve.now/CVE-2022-21128.md): Insufficient control flow management in the Intel(R) Advisor software before version 7.6.0.37 may allow an authenticated user to potentially (CVSS 7.8, Intel(R) Advisor software)
- [CVE-2021-0194](https://cve.now/CVE-2021-0194.md): Improper access control in the Intel(R) In-Band Manageability software before version 2.13.0 may allow a privileged user to potentially enab (CVSS 7.2, Intel(R) In-Band Manageability software)
- [CVE-2021-0193](https://cve.now/CVE-2021-0193.md): Improper authentication in the Intel(R) In-Band Manageability software before version 2.13.0 may allow a privileged user to potentially enab (CVSS 7.2, Intel(R) In-Band Manageability software)
- [CVE-2021-33108](https://cve.now/CVE-2021-33108.md): Improper input validation in the Intel(R) In-Band Manageability software before version 2.13.0 may allow a privileged user to potentially en (CVSS 6.7, Intel(R) In-Band Manageability software)
- [CVE-2021-33135](https://cve.now/CVE-2021-33135.md): Uncontrolled resource consumption in the Linux kernel drivers for Intel(R) SGX may allow an authenticated user to potentially enable denial (CVSS 5.5, Intel(R) SGX)
- [CVE-2022-21136](https://cve.now/CVE-2022-21136.md): Improper input validation for some Intel(R) Xeon(R) Processors may allow a privileged user to potentially enable denial of service via local (CVSS 5.5, Intel(R) Xeon(R) Processors)
- [CVE-2022-21131](https://cve.now/CVE-2022-21131.md): Improper access control for some Intel(R) Xeon(R) Processors may allow an authenticated user to potentially enable information disclosure vi (CVSS 5.5, Intel(R) Xeon(R) Processors)
- [CVE-2021-33130](https://cve.now/CVE-2021-33130.md): Insecure default variable initialization of Intel(R) RealSense(TM) ID Solution F450 before version 2.6.0.74 may allow an unauthenticated use (CVSS 4.6, Intel(R) RealSense(TM) ID Solution F450)
- [CVE-2022-28920](https://cve.now/CVE-2022-28920.md): Tieba-Cloud-Sign v4.9 was discovered to contain a cross-site scripting (XSS) vulnerability via the function strip\_tags. (no CVSS)
- [CVE-2022-28919](https://cve.now/CVE-2022-28919.md): HTMLCreator release\_stable\_2020-07-29 was discovered to contain a cross-site scripting (XSS) vulnerability via the function \_generateFilenam (no CVSS)
- [CVE-2022-29738](https://cve.now/CVE-2022-29738.md): Money Transfer Management System 1.0 is vulnerable to SQL Injection via /mtms/admin/?page=transaction/send&id=, id. (no CVSS)
- [CVE-2022-29739](https://cve.now/CVE-2022-29739.md): Money Transfer Management System 1.0 is vulnerable to SQL Injection via /mtms/admin/?page=user/manage\_user&id=. (no CVSS)
- [CVE-2022-29306](https://cve.now/CVE-2022-29306.md): IonizeCMS v1.0.8.1 was discovered to contain a SQL injection vulnerability via the id\_page parameter in application/models/article\_model.php (no CVSS)
- [CVE-2022-29307](https://cve.now/CVE-2022-29307.md): IonizeCMS v1.0.8.1 was discovered to contain a command injection vulnerability via the function copy\_lang\_content in application/models/lang (no CVSS)
- [CVE-2022-29741](https://cve.now/CVE-2022-29741.md): Money Transfer Management System 1.0 is vulnerable to SQL Injection via \\mtms\\classes\\Master.php?f=delete\_fee. (no CVSS)
- [CVE-2022-22413](https://cve.now/CVE-2022-22413.md): IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to SQL injection. (CVSS 4.2, IBM Robotic Process Automation)
- [CVE-2022-29745](https://cve.now/CVE-2022-29745.md): Money Transfer Management System 1.0 is vulnerable to SQL Injection via \\mtms\\classes\\Master.php?f=delete\_transaction. (no CVSS)
- [CVE-2022-29746](https://cve.now/CVE-2022-29746.md): Money Transfer Management System 1.0 is vulnerable to SQL Injection via /mtms/classes/Users.php?f=delete. (no CVSS)
- [CVE-2022-1698](https://cve.now/CVE-2022-1698.md): Allowing long password leads to denial of service in causefx/organizr (CVSS 9.9, causefx/organizr)
- [CVE-2022-1699](https://cve.now/CVE-2022-1699.md): Uncontrolled Resource Consumption in causefx/organizr (CVSS 9.9, causefx/organizr)
- [CVE-2022-29998](https://cve.now/CVE-2022-29998.md): Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/clientStatus.php?client\_id=. (no CVSS)
- [CVE-2022-29999](https://cve.now/CVE-2022-29999.md): Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/editClient.php?client\_id=. (no CVSS)
- [CVE-2022-29303](https://cve.now/CVE-2022-29303.md): SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via conf\_mail.php. (CVSS 9.8, KEV)
- [CVE-2022-29302](https://cve.now/CVE-2022-29302.md): SolarView Compact ver.6.00 was discovered to contain a local file disclosure via /html/Solar\_Ftp.php. (no CVSS)
- [CVE-2022-29298](https://cve.now/CVE-2022-29298.md): SolarView Compact ver.6.00 allows attackers to access sensitive files via directory traversal. (no CVSS)
- [CVE-2022-30000](https://cve.now/CVE-2022-30000.md): Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/editPayment.php?recipt\_no=. (no CVSS)
- [CVE-2022-30001](https://cve.now/CVE-2022-30001.md): Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/editAgent.php?agent\_id=. (no CVSS)
- [CVE-2022-30002](https://cve.now/CVE-2022-30002.md): Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/editNominee.php?nominee\_id=. (no CVSS)
- [CVE-2022-29985](https://cve.now/CVE-2022-29985.md): Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via \\scbs\\classes\\Master.php?f=delete\_category. (no CVSS)
- [CVE-2022-29986](https://cve.now/CVE-2022-29986.md): Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via \\scbs\\classes\\Master.php?f=delete\_facility. (no CVSS)
- [CVE-2022-29987](https://cve.now/CVE-2022-29987.md): Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/admin/?page=user/manage\_user&id=. (no CVSS)
- [CVE-2022-29988](https://cve.now/CVE-2022-29988.md): Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via \\scbs\\classes\\Master.php?f=delete. (no CVSS)
- [CVE-2022-29989](https://cve.now/CVE-2022-29989.md): Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via \\scbs\\classes\\Master.php?f=delete\_booking. (no CVSS)
- [CVE-2022-29990](https://cve.now/CVE-2022-29990.md): Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/admin/categories/view\_category.php?id=. (no CVSS)
- [CVE-2022-29992](https://cve.now/CVE-2022-29992.md): Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/admin/categories/manage\_category.php?id=. (no CVSS)
- [CVE-2022-30279](https://cve.now/CVE-2022-30279.md): An issue was discovered in Stormshield Network Security (SNS) 4.3.x before 4.3.8. (no CVSS)
- [CVE-2022-29993](https://cve.now/CVE-2022-29993.md): Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/admin/bookings/view\_booking.php?id=. (no CVSS)
- [CVE-2022-29994](https://cve.now/CVE-2022-29994.md): Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/admin/?page=facilities/manage\_facility&id=. (no CVSS)
- [CVE-2022-29995](https://cve.now/CVE-2022-29995.md): Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/admin/?page=clients/manage\_client&id=. (no CVSS)
- [CVE-2022-29747](https://cve.now/CVE-2022-29747.md): Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/admin/?page=invoice/manage\_invoice&id= // Leak place ---\> id. (no CVSS)
- [CVE-2022-29748](https://cve.now/CVE-2022-29748.md): Simple Client Management System 1.0 is vulnerable to SQL Injection via \\cms\\admin?page=client/manage\_client&id=. (no CVSS)
- [CVE-2022-29749](https://cve.now/CVE-2022-29749.md): Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/classes/Master.php?f=delete\_invoice. (no CVSS)
- [CVE-2022-29750](https://cve.now/CVE-2022-29750.md): Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/classes/Master.php?f=delete\_service. (no CVSS)
- [CVE-2022-29751](https://cve.now/CVE-2022-29751.md): Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/classes/Master.php?f=delete\_client. (no CVSS)
- [CVE-2022-29981](https://cve.now/CVE-2022-29981.md): Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/classes/Users.php?f=delete. (no CVSS)
- [CVE-2022-29538](https://cve.now/CVE-2022-29538.md): RESI Gemini-Net Web 4.2 is affected by Improper Access Control in authorization logic. (no CVSS)
- [CVE-2022-29979](https://cve.now/CVE-2022-29979.md): Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/classes/Master.php?f=delete\_designation. (no CVSS)
- [CVE-2022-29539](https://cve.now/CVE-2022-29539.md): resi-calltrace in RESI Gemini-Net 4.2 is affected by OS Command Injection. (no CVSS)
- [CVE-2022-29980](https://cve.now/CVE-2022-29980.md): Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/admin/?page=user/manage\_user&id=. (no CVSS)
- [CVE-2022-29982](https://cve.now/CVE-2022-29982.md): Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/admin/maintenance/manage\_service.php?id=. (no CVSS)
- [CVE-2022-29983](https://cve.now/CVE-2022-29983.md): Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/admin/?page=invoice/view\_invoice&id=. (no CVSS)
- [CVE-2022-29984](https://cve.now/CVE-2022-29984.md): Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/admin/?page=client/view\_client&id=. (no CVSS)
- [CVE-2022-30525](https://cve.now/CVE-2022-30525.md): A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 f (CVSS 9.8, KEV, Zyxel USG FLEX 100(W) firmware · Zyxel USG FLEX 200 firm… +6)
- [CVE-2021-42863](https://cve.now/CVE-2021-42863.md): A buffer overflow in ecma\_builtin\_typedarray\_prototype\_filter() in JerryScript version fe3a5c0 allows an attacker to construct a fake object (no CVSS)
- [CVE-2022-28873](https://cve.now/CVE-2022-28873.md): Multiple Address Bar Spoofing Vulnerability in F-Secure SAFE Browser for Android (CVSS 4.3, F-Secure Mobile Security)
- [CVE-2022-28872](https://cve.now/CVE-2022-28872.md): Address Bar Spoofing Vulnerability in F-Secure SAFE Browser for Android (CVSS 4.3, F-Secure Mobile Security)
- [CVE-2022-29930](https://cve.now/CVE-2022-29930.md): SHA1 implementation in JetBrains Ktor Native 2.0.0 was returning the same value. (CVSS 8.7, JetBrains Ktor)
- [CVE-2022-29929](https://cve.now/CVE-2022-29929.md): In JetBrains TeamCity before 2022.04 potential XSS via Referrer header was possible (CVSS 3.7, JetBrains TeamCity)
- [CVE-2022-29928](https://cve.now/CVE-2022-29928.md): In JetBrains TeamCity before 2022.04 leak of secrets in TeamCity agent logs was possible (CVSS 4.4, JetBrains TeamCity)
- [CVE-2022-29927](https://cve.now/CVE-2022-29927.md): In JetBrains TeamCity before 2022.04 reflected XSS on the Build Chain Status page was possible (CVSS 4.6, JetBrains TeamCity)
- [CVE-2022-1682](https://cve.now/CVE-2022-1682.md): Reflected Xss using url based payload in neorazorx/facturascripts (CVSS 9.4, neorazorx/facturascripts · facturascripts/facturascripts)
- [CVE-2022-1044](https://cve.now/CVE-2022-1044.md): Sensitive Data Exposure Due To Insecure Storage Of Profile Image in polonel/trudesk (CVSS 8.2, polonel/trudesk)
- [CVE-2022-1681](https://cve.now/CVE-2022-1681.md): Authentication Bypass Using an Alternate Path or Channel in requarks/wiki (CVSS 7.2, requarks/wiki)
- [CVE-2022-1650](https://cve.now/CVE-2022-1650.md): Improper Removal of Sensitive Information Before Storage or Transfer in eventsource/eventsource (CVSS 8.1, eventsource/eventsource · eventsource)
- [CVE-2022-1674](https://cve.now/CVE-2022-1674.md): NULL Pointer Dereference in function vim\_regexec\_string at regexp.c:2733 in vim/vim (CVSS 6.6, vim/vim)
- [CVE-2022-29885](https://cve.now/CVE-2022-29885.md): EncryptInterceptor does not provide complete protection on insecure networks (no CVSS, Apache Software Foundation Apache Tomcat · tomcat +1)
- [CVE-2022-30594](https://cve.now/CVE-2022-30594.md): The Linux kernel before 5.17.2 mishandles seccomp permissions. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-05-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.