CVEs published May 13, 2022
88 CVEs were published on May 13, 2022: 1 critical, 17 high.
- Published
- 88
- Critical
- 1
- High
- 17
- Medium
- 5
- Low
- 1
- Unrated
- 64
- Now in CISA KEV
- 0
- Fix available
- 11
Most affected products
- Huawei HarmonyOS · Huawei EMUI
- 11
- Adobe FrameMaker
- 10
- mySCADA myPRO
- 4
- SonicWall SMA1000
- 3
- HarmonyOS;EMUI;Magic UI
- 2
- Apache Software Foundation Apache Tomcat · tomcat +1
- 1
- B&R Automation Automation Runtime webserver
- 1
- convict
- 1
- EMUI;Magic UI
- 1
- Huawei EMUI · Huawei Magic UI
- 1
Critical 1
High 17
- CVE-2022-21190Prototype Pollutionconvict
- CVE-2022-25865Command Injectionworkspace-tools
- CVE-2021-33013mySCADA myPRO Improper Access ControlmySCADA myPRO
- CVE-2021-33009mySCADA myPRO Unrestricted Upload of File with Dangerous TypemySCADA myPRO
- CVE-2021-33005mySCADA myPRO Path TraversalmySCADA myPRO
- CVE-2021-27505mySCADA myPRO Exposure of Information Through Directory ListingmySCADA myPRO
- CVE-2022-28829Adobe FrameMaker Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe FrameMaker
- CVE-2022-28828Adobe FrameMaker PDF File Parsing Out-Of-Bounds Write Code Execution VulnerabilityAdobe FrameMaker
- CVE-2022-28827Adobe FrameMaker SVG File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe FrameMaker
- CVE-2022-28826Adobe FrameMaker Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe FrameMaker
- CVE-2022-28825Adobe FrameMaker Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe FrameMaker
- CVE-2022-28824Adobe FrameMaker Font Parsing Use-After-Free Remote Code Execution VulnerabilityAdobe FrameMaker
- CVE-2022-28823Adobe FrameMaker Font Parsing Use-After-Free Remote Code Execution VulnerabilityAdobe FrameMaker
- CVE-2022-28822Adobe FrameMaker Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe FrameMaker
- CVE-2022-28821Adobe FrameMaker Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe FrameMaker
- CVE-2021-22275Denial of service vulnerability on Automation Runtime webserverB&R Automation Automation Runtime webserver
- CVE-2022-1714Out-of-bounds Read in radareorg/radare2radareorg/radare2
Medium, low and unrated 70
- CVE-2022-24830Path Traversal in OpenClinicaOpenClinica
- CVE-2022-25862Prototype Pollutionsds
- CVE-2022-22282SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions incorrectly restricts access to a resource using HTTP connectionSonicWall SMA1000
- CVE-2022-22281A buffer overflow vulnerability in the SonicWall SSL-VPN NetExtender Windows Client (32 and 64 bit) in 10.2.322 and earlier versions, allowsSonicWall NetExtender Windows (32 and 64 bit) Client
- CVE-2022-1702SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions accept a user-controlled input that specifies a link to an exterSonicWall SMA1000
- CVE-2022-1701SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions uses a shared and hard-coded encryption key to store data.SonicWall SMA1000
- CVE-2022-22393IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.5 , with the adminCenter-1.0 feature configured, could allow an authenticatIBM WebSphere Application Server Liberty
- CVE-2022-22325IBM MQ (IBM MQ for HPE NonStop 8.1.0) can inadvertently disclose sensitive information under certain circumstances to a local user from a stIBM MQ for HPE NonStop
- CVE-2022-29433https://patchstack.com/database/vulnerability/nd-donations/wordpress-donations-plugin-1-8-authenticated-stored-cross-site-scripting-xss-vulnerabilityNicdark Donations
- CVE-2022-22252The DFX module has a UAF vulnerability.Successful exploitation of this vulnerability may affect system stability.HarmonyOS;EMUI;Magic UI
- CVE-2022-30411Covid-19 Travel Pass Management System v1.0 is vulnerable to SQL Injection via /ctpms/admin/?page=individuals/view_individual&id=.
- CVE-2022-29796The HiAIserver has a vulnerability in verifying the validity of the weight used in the model.Successful exploitation of this vulnerability wHuawei HarmonyOS · Huawei EMUI
- CVE-2022-29795The frame scheduling module has a null pointer dereference vulnerability.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-29794The frame scheduling module has a Use After Free (UAF) vulnerability.Successful exploitation of this vulnerability will affect data integritHuawei HarmonyOS · Huawei EMUI
- CVE-2022-29793There is a configuration defect in the activation lock of mobile phones.Successful exploitation of this vulnerability may affect applicationHarmonyOS;EMUI;Magic UI
- CVE-2022-29792The chip component has a vulnerability of disclosing CPU SNs.Successful exploitation of this vulnerability may affect data confidentiality.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-30412Covid-19 Travel Pass Management System v1.0 is vulnerable to SQL Injection via /ctpms/admin/individuals/update_status.php?id=.
- CVE-2022-29791The HiAIserver has a vulnerability in verifying the validity of the weight used in the model.Successful exploitation of this vulnerability wHuawei HarmonyOS · Huawei EMUI
- CVE-2022-29790The graphics acceleration service has a vulnerability in multi-thread access to the database.Successful exploitation of this vulnerability mHuawei HarmonyOS · Huawei EMUI
- CVE-2022-29789The HiAIserver has a vulnerability in verifying the validity of the properties used in the model.Successful exploitation of this vulnerabiliHuawei HarmonyOS · Huawei EMUI
- CVE-2022-22261The HiAIserver has a vulnerability in verifying the validity of the weight used in the model.Successful exploitation of this vulnerability wHuawei HarmonyOS · Huawei EMUI
- CVE-2022-22260The kernel module has a UAF vulnerability.Successful exploitation of this vulnerability will affect data integrity and availability.Huawei HarmonyOS · Huawei EMUI
- CVE-2021-46789Configuration defects in the secure OS module.EMUI;Magic UI
- CVE-2022-30413Covid-19 Travel Pass Management System v1.0 is vulnerable to SQL Injection via /ctpms/classes/Master.php?f=delete_application.
- CVE-2021-46788Third-party pop-up window coverage vulnerability in the iConnect module.Successful exploitation of this vulnerability may cause system pop-uHuawei EMUI · Huawei Magic UI
- CVE-2021-46787The AMS module has a vulnerability of improper permission control.Successful exploitation of this vulnerability may cause non-system applicaHuawei HarmonyOS · Huawei EMUI +1
- CVE-2021-46786The audio module has a vulnerability in verifying the parameters passed by the application space.Successful exploitation of this vulnerabiliHuawei HarmonyOS · Huawei EMUI
- CVE-2021-46785The Property module has a vulnerability in permission control.This vulnerability can be exploited to obtain the unique device identifier.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-30414Covid-19 Travel Pass Management System v1.0 is vulnerable to SQL Injection via /ctpms/admin/?page=applications/view_application&id=.
- CVE-2022-30415Covid-19 Travel Pass Management System v1.0 is vulnerable to SQL Injection via /ctpms/admin/applications/update_status.php?id=.
- CVE-2022-30417Covid-19 Travel Pass Management System v1.0 is vulnerable to SQL Injection via ctpms/admin/?page=user/manage_user&id=.
- CVE-2022-30408Covid-19 Travel Pass Management System v1.0 is vulnerable to file deletion via /ctpms/classes/Master.php?f=delete_img.
- CVE-2022-30407Pharmacy Sales And Inventory System v1.0 is vulnerable to SQL Injection via /pharmacy-sales-and-inventory-system/manage_user.php?id=.
- CVE-2022-30404College Management System v1.0 is vulnerable to SQL Injection via /College_Management_System/admin/display-teacher.php?teacher_id=.
- CVE-2022-30381Merchandise Online Store v1.0 is vulnerable to file deletion via /vloggers_merch/classes/Master.php?f=delete_img.
- CVE-2022-30384Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_inventory.
- CVE-2022-30385Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_order.
- CVE-2022-28830Adobe FrameMaker Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe FrameMaker
- CVE-2022-25591BlogEngine.NET v3.3.8.0 was discovered to contain an arbitrary file deletion vulnerability which allows attackers to delete files within the
- CVE-2022-30386Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_featured.
- CVE-2022-30387Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=pay_order.
- CVE-2022-27247onlinetolls in cdSoft Onlinetools-Smart Winhotel.MX 2021 allows an attacker to download sensitive information about any customer (e.g., data
- CVE-2022-30391Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_category.
- CVE-2022-30392Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_sub_category.
- CVE-2022-30393Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/admin/?page=product/manage_product&id=.
- CVE-2022-30395Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_cart.
- CVE-2022-30396Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/admin/?page=inventory/manage_inventory&id=.
- CVE-2022-30398Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/admin/?page=orders/view_order&id=.
- CVE-2022-30399Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/admin/?page=maintenance/manage_category&id=.
- CVE-2022-30400Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/admin/orders/view_order.php?view=user&id=.
- CVE-2022-30401Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/?p=view_product&id=.
- CVE-2022-30402Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/admin/?page=maintenance/manage_sub_category&id=.
- CVE-2022-30403Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/?p=products&c=.
- CVE-2022-30375Sourcecodester Simple Social Networking Site v1.0 is vulnerable to file deletion via /sns/classes/Master.php?f=delete_img.
- CVE-2022-30376Sourcecodester Simple Social Networking Site v1.0 is vulnerable to SQL Injection via /sns/admin/members/view_member.php?id=.
- CVE-2022-30378Sourcecodester Simple Social Networking Site v1.0 is vulnerable to SQL Injection via /sns/admin/?page=posts/view_post&id=.
- CVE-2022-30379Sourcecodester Simple Social Networking Site v1.0 is vulnerable to SQL Injection via /sns/admin/?page=user/manage_user&id=.
- CVE-2022-30367Air Cargo Management System v1.0 is vulnerable to file deletion via /acms/classes/Master.php?f=delete_img.
- CVE-2022-29854A vulnerability in Mitel 6900 Series IP (MiNet) phones excluding 6970, versions 1.8 (1.8.0.12) and earlier, could allow a unauthenticated at
- CVE-2022-30489WAVLINK WN535 G3 was discovered to contain a cross-site scripting (XSS) vulnerability via the hostname parameter at /cgi-bin/login.cgi.
- CVE-2022-29383NETGEAR ProSafe SSL VPN firmware FVS336Gv2 and FVS336Gv3 was discovered to contain a SQL injection vulnerability via USERDBDomains.Domainnam
- CVE-2022-30370Air Cargo Management System 1.0 is vulnerable to SQL Injection via /acms/classes/Master.php?f=delete_cargo_type.
- CVE-2022-30371Air Cargo Management System 1.0 is vulnerable to SQL Injection via /acms/admin/cargo_types/view_cargo_type.php?id=.
- CVE-2022-30372Air Cargo Management System 1.0 is vulnerable to SQL Injection via /acms/classes/Master.php?f=delete_cargo.
- CVE-2022-30373Air Cargo Management System 1.0 is vulnerable to SQL Injection via /acms/admin/cargo_types/manage_cargo_type.php?id=.
- CVE-2022-30374Air Cargo Management System 1.0 is vulnerable to SQL Injection via /acms/admin/?page=transactions/manage_transaction&id=.
- CVE-2020-22983A Server-Side Request Forgery (SSRF) vulnerability exists in MicroStrategy Web SDK 11.1 and earlier, allows remote unauthenticated attackers
- CVE-2021-42969Certain Anaconda3 2021.05 are affected by OS command injection.
- CVE-2021-42967Unrestricted file upload in /novel-admin/src/main/java/com/java2nb/common/controller/FileController.java in novel-plus all versions allows a
- CVE-2022-25762Response mix-up with WebSocket concurrent send and closeApache Software Foundation Apache Tomcat · tomcat +1