# CVEs published 2022-05-13

88 CVEs were published on May 13, 2022: 1 critical, 17 high. Days are UTC.

- [CVE-2022-24830](https://cve.now/CVE-2022-24830.md): Path Traversal in OpenClinica (CVSS 6.5, OpenClinica)
- [CVE-2022-25862](https://cve.now/CVE-2022-25862.md): Prototype Pollution (CVSS 4.0, sds)
- [CVE-2022-21190](https://cve.now/CVE-2022-21190.md): Prototype Pollution (CVSS 7.5, convict)
- [CVE-2022-25865](https://cve.now/CVE-2022-25865.md): Command Injection (CVSS 8.1, workspace-tools)
- [CVE-2022-22282](https://cve.now/CVE-2022-22282.md): SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions incorrectly restricts access to a resource using HTTP connection (no CVSS, SonicWall SMA1000)
- [CVE-2022-22281](https://cve.now/CVE-2022-22281.md): A buffer overflow vulnerability in the SonicWall SSL-VPN NetExtender Windows Client (32 and 64 bit) in 10.2.322 and earlier versions, allows (no CVSS, SonicWall NetExtender Windows (32 and 64 bit) Client)
- [CVE-2022-1702](https://cve.now/CVE-2022-1702.md): SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions accept a user-controlled input that specifies a link to an exter (no CVSS, SonicWall SMA1000)
- [CVE-2022-1701](https://cve.now/CVE-2022-1701.md): SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions uses a shared and hard-coded encryption key to store data. (no CVSS, SonicWall SMA1000)
- [CVE-2022-1715](https://cve.now/CVE-2022-1715.md): Account Takeover in neorazorx/facturascripts (CVSS 9.8, neorazorx/facturascripts · facturascripts/facturascripts)
- [CVE-2022-22393](https://cve.now/CVE-2022-22393.md): IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.5 , with the adminCenter-1.0 feature configured, could allow an authenticat (CVSS 3.1, IBM WebSphere Application Server Liberty)
- [CVE-2022-22325](https://cve.now/CVE-2022-22325.md): IBM MQ (IBM MQ for HPE NonStop 8.1.0) can inadvertently disclose sensitive information under certain circumstances to a local user from a st (CVSS 5.1, IBM MQ for HPE NonStop)
- [CVE-2022-29433](https://cve.now/CVE-2022-29433.md): https://patchstack.com/database/vulnerability/nd-donations/wordpress-donations-plugin-1-8-authenticated-stored-cross-site-scripting-xss-vulnerability (CVSS 4.1, Nicdark Donations)
- [CVE-2021-33013](https://cve.now/CVE-2021-33013.md): mySCADA myPRO Improper Access Control (CVSS 8.2, mySCADA myPRO)
- [CVE-2021-33009](https://cve.now/CVE-2021-33009.md): mySCADA myPRO Unrestricted Upload of File with Dangerous Type (CVSS 7.5, mySCADA myPRO)
- [CVE-2021-33005](https://cve.now/CVE-2021-33005.md): mySCADA myPRO Path Traversal (CVSS 7.5, mySCADA myPRO)
- [CVE-2021-27505](https://cve.now/CVE-2021-27505.md): mySCADA myPRO Exposure of Information Through Directory Listing (CVSS 7.5, mySCADA myPRO)
- [CVE-2022-22252](https://cve.now/CVE-2022-22252.md): The DFX module has a UAF vulnerability.Successful exploitation of this vulnerability may affect system stability. (no CVSS, HarmonyOS;EMUI;Magic UI)
- [CVE-2022-30411](https://cve.now/CVE-2022-30411.md): Covid-19 Travel Pass Management System v1.0 is vulnerable to SQL Injection via /ctpms/admin/?page=individuals/view\_individual&id=. (no CVSS)
- [CVE-2022-29796](https://cve.now/CVE-2022-29796.md): The HiAIserver has a vulnerability in verifying the validity of the weight used in the model.Successful exploitation of this vulnerability w (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-29795](https://cve.now/CVE-2022-29795.md): The frame scheduling module has a null pointer dereference vulnerability. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-29794](https://cve.now/CVE-2022-29794.md): The frame scheduling module has a Use After Free (UAF) vulnerability.Successful exploitation of this vulnerability will affect data integrit (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-29793](https://cve.now/CVE-2022-29793.md): There is a configuration defect in the activation lock of mobile phones.Successful exploitation of this vulnerability may affect application (no CVSS, HarmonyOS;EMUI;Magic UI)
- [CVE-2022-29792](https://cve.now/CVE-2022-29792.md): The chip component has a vulnerability of disclosing CPU SNs.Successful exploitation of this vulnerability may affect data confidentiality. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-30412](https://cve.now/CVE-2022-30412.md): Covid-19 Travel Pass Management System v1.0 is vulnerable to SQL Injection via /ctpms/admin/individuals/update\_status.php?id=. (no CVSS)
- [CVE-2022-29791](https://cve.now/CVE-2022-29791.md): The HiAIserver has a vulnerability in verifying the validity of the weight used in the model.Successful exploitation of this vulnerability w (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-29790](https://cve.now/CVE-2022-29790.md): The graphics acceleration service has a vulnerability in multi-thread access to the database.Successful exploitation of this vulnerability m (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-29789](https://cve.now/CVE-2022-29789.md): The HiAIserver has a vulnerability in verifying the validity of the properties used in the model.Successful exploitation of this vulnerabili (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-22261](https://cve.now/CVE-2022-22261.md): The HiAIserver has a vulnerability in verifying the validity of the weight used in the model.Successful exploitation of this vulnerability w (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-22260](https://cve.now/CVE-2022-22260.md): The kernel module has a UAF vulnerability.Successful exploitation of this vulnerability will affect data integrity and availability. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2021-46789](https://cve.now/CVE-2021-46789.md): Configuration defects in the secure OS module. (no CVSS, EMUI;Magic UI)
- [CVE-2022-30413](https://cve.now/CVE-2022-30413.md): Covid-19 Travel Pass Management System v1.0 is vulnerable to SQL Injection via /ctpms/classes/Master.php?f=delete\_application. (no CVSS)
- [CVE-2021-46788](https://cve.now/CVE-2021-46788.md): Third-party pop-up window coverage vulnerability in the iConnect module.Successful exploitation of this vulnerability may cause system pop-u (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-46787](https://cve.now/CVE-2021-46787.md): The AMS module has a vulnerability of improper permission control.Successful exploitation of this vulnerability may cause non-system applica (no CVSS, Huawei HarmonyOS · Huawei EMUI +1)
- [CVE-2021-46786](https://cve.now/CVE-2021-46786.md): The audio module has a vulnerability in verifying the parameters passed by the application space.Successful exploitation of this vulnerabili (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2021-46785](https://cve.now/CVE-2021-46785.md): The Property module has a vulnerability in permission control.This vulnerability can be exploited to obtain the unique device identifier. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-30414](https://cve.now/CVE-2022-30414.md): Covid-19 Travel Pass Management System v1.0 is vulnerable to SQL Injection via /ctpms/admin/?page=applications/view\_application&id=. (no CVSS)
- [CVE-2022-30415](https://cve.now/CVE-2022-30415.md): Covid-19 Travel Pass Management System v1.0 is vulnerable to SQL Injection via /ctpms/admin/applications/update\_status.php?id=. (no CVSS)
- [CVE-2022-30417](https://cve.now/CVE-2022-30417.md): Covid-19 Travel Pass Management System v1.0 is vulnerable to SQL Injection via ctpms/admin/?page=user/manage\_user&id=. (no CVSS)
- [CVE-2022-30408](https://cve.now/CVE-2022-30408.md): Covid-19 Travel Pass Management System v1.0 is vulnerable to file deletion via /ctpms/classes/Master.php?f=delete\_img. (no CVSS)
- [CVE-2022-30407](https://cve.now/CVE-2022-30407.md): Pharmacy Sales And Inventory System v1.0 is vulnerable to SQL Injection via /pharmacy-sales-and-inventory-system/manage\_user.php?id=. (no CVSS)
- [CVE-2022-30404](https://cve.now/CVE-2022-30404.md): College Management System v1.0 is vulnerable to SQL Injection via /College\_Management\_System/admin/display-teacher.php?teacher\_id=. (no CVSS)
- [CVE-2022-30381](https://cve.now/CVE-2022-30381.md): Merchandise Online Store v1.0 is vulnerable to file deletion via /vloggers\_merch/classes/Master.php?f=delete\_img. (no CVSS)
- [CVE-2022-30384](https://cve.now/CVE-2022-30384.md): Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers\_merch/classes/Master.php?f=delete\_inventory. (no CVSS)
- [CVE-2022-30385](https://cve.now/CVE-2022-30385.md): Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers\_merch/classes/Master.php?f=delete\_order. (no CVSS)
- [CVE-2022-28830](https://cve.now/CVE-2022-28830.md): Adobe FrameMaker Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe FrameMaker)
- [CVE-2022-28829](https://cve.now/CVE-2022-28829.md): Adobe FrameMaker Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe FrameMaker)
- [CVE-2022-25591](https://cve.now/CVE-2022-25591.md): BlogEngine.NET v3.3.8.0 was discovered to contain an arbitrary file deletion vulnerability which allows attackers to delete files within the (no CVSS)
- [CVE-2022-28828](https://cve.now/CVE-2022-28828.md): Adobe FrameMaker PDF File Parsing Out-Of-Bounds Write Code Execution Vulnerability (CVSS 7.8, Adobe FrameMaker)
- [CVE-2022-28827](https://cve.now/CVE-2022-28827.md): Adobe FrameMaker SVG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe FrameMaker)
- [CVE-2022-28826](https://cve.now/CVE-2022-28826.md): Adobe FrameMaker Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe FrameMaker)
- [CVE-2022-28825](https://cve.now/CVE-2022-28825.md): Adobe FrameMaker Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe FrameMaker)
- [CVE-2022-28824](https://cve.now/CVE-2022-28824.md): Adobe FrameMaker Font Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe FrameMaker)
- [CVE-2022-30386](https://cve.now/CVE-2022-30386.md): Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers\_merch/classes/Master.php?f=delete\_featured. (no CVSS)
- [CVE-2022-28823](https://cve.now/CVE-2022-28823.md): Adobe FrameMaker Font Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe FrameMaker)
- [CVE-2022-28822](https://cve.now/CVE-2022-28822.md): Adobe FrameMaker Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe FrameMaker)
- [CVE-2022-28821](https://cve.now/CVE-2022-28821.md): Adobe FrameMaker Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe FrameMaker)
- [CVE-2022-30387](https://cve.now/CVE-2022-30387.md): Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers\_merch/classes/Master.php?f=pay\_order. (no CVSS)
- [CVE-2022-27247](https://cve.now/CVE-2022-27247.md): onlinetolls in cdSoft Onlinetools-Smart Winhotel.MX 2021 allows an attacker to download sensitive information about any customer (e.g., data (no CVSS)
- [CVE-2021-22275](https://cve.now/CVE-2021-22275.md): Denial of service vulnerability on Automation Runtime webserver (CVSS 8.6, B&R Automation Automation Runtime webserver)
- [CVE-2022-30391](https://cve.now/CVE-2022-30391.md): Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers\_merch/classes/Master.php?f=delete\_category. (no CVSS)
- [CVE-2022-30392](https://cve.now/CVE-2022-30392.md): Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers\_merch/classes/Master.php?f=delete\_sub\_category. (no CVSS)
- [CVE-2022-30393](https://cve.now/CVE-2022-30393.md): Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers\_merch/admin/?page=product/manage\_product&id=. (no CVSS)
- [CVE-2022-30395](https://cve.now/CVE-2022-30395.md): Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers\_merch/classes/Master.php?f=delete\_cart. (no CVSS)
- [CVE-2022-30396](https://cve.now/CVE-2022-30396.md): Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers\_merch/admin/?page=inventory/manage\_inventory&id=. (no CVSS)
- [CVE-2022-30398](https://cve.now/CVE-2022-30398.md): Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers\_merch/admin/?page=orders/view\_order&id=. (no CVSS)
- [CVE-2022-30399](https://cve.now/CVE-2022-30399.md): Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers\_merch/admin/?page=maintenance/manage\_category&id=. (no CVSS)
- [CVE-2022-30400](https://cve.now/CVE-2022-30400.md): Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers\_merch/admin/orders/view\_order.php?view=user&id=. (no CVSS)
- [CVE-2022-30401](https://cve.now/CVE-2022-30401.md): Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers\_merch/?p=view\_product&id=. (no CVSS)
- [CVE-2022-30402](https://cve.now/CVE-2022-30402.md): Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers\_merch/admin/?page=maintenance/manage\_sub\_category&id=. (no CVSS)
- [CVE-2022-30403](https://cve.now/CVE-2022-30403.md): Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers\_merch/?p=products&c=. (no CVSS)
- [CVE-2022-30375](https://cve.now/CVE-2022-30375.md): Sourcecodester Simple Social Networking Site v1.0 is vulnerable to file deletion via /sns/classes/Master.php?f=delete\_img. (no CVSS)
- [CVE-2022-30376](https://cve.now/CVE-2022-30376.md): Sourcecodester Simple Social Networking Site v1.0 is vulnerable to SQL Injection via /sns/admin/members/view\_member.php?id=. (no CVSS)
- [CVE-2022-30378](https://cve.now/CVE-2022-30378.md): Sourcecodester Simple Social Networking Site v1.0 is vulnerable to SQL Injection via /sns/admin/?page=posts/view\_post&id=. (no CVSS)
- [CVE-2022-30379](https://cve.now/CVE-2022-30379.md): Sourcecodester Simple Social Networking Site v1.0 is vulnerable to SQL Injection via /sns/admin/?page=user/manage\_user&id=. (no CVSS)
- [CVE-2022-30367](https://cve.now/CVE-2022-30367.md): Air Cargo Management System v1.0 is vulnerable to file deletion via /acms/classes/Master.php?f=delete\_img. (no CVSS)
- [CVE-2022-29854](https://cve.now/CVE-2022-29854.md): A vulnerability in Mitel 6900 Series IP (MiNet) phones excluding 6970, versions 1.8 (1.8.0.12) and earlier, could allow a unauthenticated at (no CVSS)
- [CVE-2022-30489](https://cve.now/CVE-2022-30489.md): WAVLINK WN535 G3 was discovered to contain a cross-site scripting (XSS) vulnerability via the hostname parameter at /cgi-bin/login.cgi. (no CVSS)
- [CVE-2022-29383](https://cve.now/CVE-2022-29383.md): NETGEAR ProSafe SSL VPN firmware FVS336Gv2 and FVS336Gv3 was discovered to contain a SQL injection vulnerability via USERDBDomains.Domainnam (no CVSS)
- [CVE-2022-30370](https://cve.now/CVE-2022-30370.md): Air Cargo Management System 1.0 is vulnerable to SQL Injection via /acms/classes/Master.php?f=delete\_cargo\_type. (no CVSS)
- [CVE-2022-30371](https://cve.now/CVE-2022-30371.md): Air Cargo Management System 1.0 is vulnerable to SQL Injection via /acms/admin/cargo\_types/view\_cargo\_type.php?id=. (no CVSS)
- [CVE-2022-30372](https://cve.now/CVE-2022-30372.md): Air Cargo Management System 1.0 is vulnerable to SQL Injection via /acms/classes/Master.php?f=delete\_cargo. (no CVSS)
- [CVE-2022-30373](https://cve.now/CVE-2022-30373.md): Air Cargo Management System 1.0 is vulnerable to SQL Injection via /acms/admin/cargo\_types/manage\_cargo\_type.php?id=. (no CVSS)
- [CVE-2022-30374](https://cve.now/CVE-2022-30374.md): Air Cargo Management System 1.0 is vulnerable to SQL Injection via /acms/admin/?page=transactions/manage\_transaction&id=. (no CVSS)
- [CVE-2020-22983](https://cve.now/CVE-2020-22983.md): A Server-Side Request Forgery (SSRF) vulnerability exists in MicroStrategy Web SDK 11.1 and earlier, allows remote unauthenticated attackers (no CVSS)
- [CVE-2021-42969](https://cve.now/CVE-2021-42969.md): Certain Anaconda3 2021.05 are affected by OS command injection. (no CVSS)
- [CVE-2021-42967](https://cve.now/CVE-2021-42967.md): Unrestricted file upload in /novel-admin/src/main/java/com/java2nb/common/controller/FileController.java in novel-plus all versions allows a (no CVSS)
- [CVE-2022-25762](https://cve.now/CVE-2022-25762.md): Response mix-up with WebSocket concurrent send and close (no CVSS, Apache Software Foundation Apache Tomcat · tomcat +1)
- [CVE-2022-1714](https://cve.now/CVE-2022-1714.md): Out-of-bounds Read in radareorg/radare2 (CVSS 7.9, radareorg/radare2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-05-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.