CVEs published May 16, 2022
101 CVEs were published on May 16, 2022: 3 critical, 8 high.
- Published
- 101
- Critical
- 3
- High
- 8
- Medium
- 10
- Low
- 1
- Unrated
- 79
- Now in CISA KEV
- 0
- Fix available
- 45
Most affected products
- Aruba ClearPass Policy Manager
- 13
- Acronis Snap Deploy
- 3
- jgraph/drawio
- 3
- polonel/trudesk
- 3
- publify/publify · publify_core
- 3
- VikBooking Hotel Booking Engine & PMS
- 3
- Weintek cMT-SVR-1xx/2xx · Weintek cMT-G01/G02 +5
- 3
- WPQA Builder Plugin
- 3
- xArrow SCADA
- 3
- Apache Software Foundation Apache Tika · org.apache.tika:ti…
- 2
Critical 3
- CVE-2021-27446Weintek EasyWeb cMT Code InjectionWeintek cMT-SVR-1xx/2xx · Weintek cMT-G01/G02 +5
- CVE-2021-27444Weintek EasyWeb cMT Improper Access ControlWeintek cMT-SVR-1xx/2xx · Weintek cMT-G01/G02 +5
- CVE-2021-27442Weintek EasyWeb cMT Cross-site ScriptingWeintek cMT-SVR-1xx/2xx · Weintek cMT-G01/G02 +5
High 8
- CVE-2021-23267Improper Control of Dynamically-Managed Code Resources in Crafter StudioCrafter Software Crafter CMS · org.craftercms:crafter-studio
- CVE-2022-1728Allowing long password leads to denial of service in polonel/trudesk in polonel/trudeskpolonel/trudesk
- CVE-2022-1718The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request in polonel/trudeskpolonel/trudesk
- CVE-2022-0573JFrog Artifactory before 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of untrusted data which can lead to DoS, Privilege EsJFrog Artifactory
- CVE-2022-1553Leaking password protected articles content due to improper access control in publify/publifypublify/publify · publify_core
- CVE-2022-1713SSRF on /proxy in jgraph/drawiojgraph/drawio
- CVE-2022-1721Path Traversal in WellKnownServlet in jgraph/drawiojgraph/drawio
- CVE-2022-1722SSRF in editor's proxy via IPv6 link-local address in jgraph/drawiojgraph/drawio
Medium, low and unrated 90
- CVE-2022-23670A remote authenticated information disclosure vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6Aruba ClearPass Policy Manager
- CVE-2022-23667A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 Aruba ClearPass Policy Manager
- CVE-2022-23668A remote authenticated server-side request forgery (ssrf) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 Aruba ClearPass Policy Manager
- CVE-2022-23666A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 Aruba ClearPass Policy Manager
- CVE-2022-23665A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 Aruba ClearPass Policy Manager
- CVE-2022-23664A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 Aruba ClearPass Policy Manager
- CVE-2022-23661A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 Aruba ClearPass Policy Manager
- CVE-2022-23662A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 Aruba ClearPass Policy Manager
- CVE-2022-23663A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 Aruba ClearPass Policy Manager
- CVE-2022-23660A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below,Aruba ClearPass Policy Manager
- CVE-2022-23659A remote reflected cross site scripting (xss) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6Aruba ClearPass Policy Manager
- CVE-2022-23658A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below,Aruba ClearPass Policy Manager
- CVE-2022-23657A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below,Aruba ClearPass Policy Manager
- CVE-2022-1731Metasonic Doc WebClient 7.0.14.0 / 7.0.12.0 / 7.0.3.0 is vulnerable to a SQL injection attack in the username field.Metasonic Doc WebClient
- CVE-2021-33025xArrow SCADA Path TraversalxArrow SCADA
- CVE-2021-33021xArrow SCADA Cross-site ScriptingxArrow SCADA
- CVE-2021-33001xArrow SCADA Cross-site ScriptingxArrow SCADA
- CVE-2022-30697Local privilege escalation due to insecure folder permissionsAcronis Snap Deploy
- CVE-2022-30696Local privilege escalation due to a DLL hijacking vulnerabilityAcronis Snap Deploy
- CVE-2022-30695Local privilege escalation due to excessive permissions assigned to child processesAcronis Snap Deploy
- CVE-2021-23266Improper Output Neutralization for Logs in Crafter StudioCrafter Software Crafter CMS · org.craftercms:craftercms
- CVE-2021-23265Improper Privilege Management in Crafter StudioCrafter Software Crafter CMS · org.craftercms:craftercms
- CVE-2022-30126Apache Tika Regular Expression Denial of Service in Standards ExtractorApache Software Foundation Apache Tika · org.apache.tika:ti…
- CVE-2022-25169Apache Tika BPGParser Memory Usage DoSApache Software Foundation Apache Tika · org.apache.tika:ti…
- CVE-2022-30055Prime95 30.7 build 9 suffers from a Buffer Overflow vulnerability that could lead to Remote Code Execution.
- CVE-2022-30050Gnuboard 5.55 and 5.56 is vulnerable to Cross Site Scripting (XSS) via bbs/member_confirm.php.
- CVE-2021-33318An Input Validation Vulnerability exists in Joel Christner .NET C# packages WatsonWebserver, IpMatcher 1.0.4.1 and below (IpMatcher) and 4.1IpMatcher
- CVE-2022-1726Bootstrap Tables XSS vulnerability with Table Export plug-in when exportOptions: htmlContent is true in wenzhixin/bootstrap-tablewenzhixin/bootstrap-table · bootstrap-table
- CVE-2022-30523Trend Micro Password Manager (Consumer) version 5.0.0.1266 and below is vulnerable to a Link Following Privilege Escalation Vulnerability thTrend Micro Password Manager
- CVE-2022-1719Reflected XSS on ticket filter function in polonel/trudeskpolonel/trudesk
- CVE-2022-0578Code Injection in publify/publifypublify/publify · publify_core
- CVE-2022-0574Improper Access Control in publify/publifypublify/publify · publify_core
- CVE-2022-1560Amministrazione Aperta < 3.8 - Admin+ LFIAmministrazione Aperta
- CVE-2022-1559Clipr <= 1.2.3 - Admin+ Stored Cross-Site ScriptingClipr
- CVE-2022-1557ULeak Security & Monitoring <= 1.2.3 - Subscriber+ Stored Cross-Site ScriptingULeak Security & Monitoring Plugin
- CVE-2022-1512ScrollReveal.js Effects <= 1.2 - Admin+ Stored Cross-Site ScriptingScrollReveal.js Effects
- CVE-2022-1465WPC Smart Wishlist for WooCommerce < 2.9.9 - Reflected Cross-Site ScriptingWPC Smart Wishlist for WooCommerce
- CVE-2022-1455Call Now Button < 1.1.2 - Reflected Cross-Site ScriptingCall Now Button
- CVE-2022-1436WPCargo Track & Trace < 6.9.5 - Reflected Cross Site ScriptingWPCargo Track & Trace
- CVE-2022-1435WPCargo Track & Trace < 6.9.5 - Admin+ Stored Cross Site ScriptingWPCargo Track & Trace
- CVE-2022-1425WPQA < 5.2 - Subscriber+ Private Message Disclosure via IDORWPQA Builder Plugin
- CVE-2022-1418Social Stickers <= 2.2.9 - Stored Cross-Site Scripting via CSRFSocial Stickers
- CVE-2022-1409VikBooking Hotel Booking Engine & PMS < 1.5.8 - Admin+ PHP File UploadVikBooking Hotel Booking Engine & PMS
- CVE-2022-1408VikBooking Hotel Booking Engine & PMS < 1.5.8 - Admin+ Stored Cross-Site ScriptingVikBooking Hotel Booking Engine & PMS
- CVE-2022-1407VikBooking Hotel Booking Engine & PMS < 1.5.7 - Stored Cross-Site Scripting via CSRFVikBooking Hotel Booking Engine & PMS
- CVE-2022-1398External Media without Import <= 1.1.2 - Subscriber+ Blind SSRFExternal Media without Import
- CVE-2022-1393WP Subtitle < 3.4.1 - Contributor+ Stored Cross-Site ScriptingWP Subtitle
- CVE-2022-1386Fusion Builder < 3.6.2 - Unauthenticated SSRFFusion Builder
- CVE-2022-1349WPQA < 5.2 - Subscriber+ Arbitrary Profile Picture Deletion via IDORWPQA Builder Plugin
- CVE-2022-1334WP YouTube Live < 1.8.3 - Admin+ Stored Cross Site ScriptingWP YouTube Live
- CVE-2022-1267BMI BMR Calculator <= 1.3 - Reflected Cross-Site ScriptingBMI BMR Calculator
- CVE-2022-1265BulletProof Security < 6.1 - Admin+ Stored Cross-Site ScriptingBulletProof Security
- CVE-2022-1217Custom TinyMCE Shortcode Button <= 1.1 - Reflected Cross-Site ScriptingCustom TinyMCE Shortcode Button
- CVE-2022-1216Advanced Image Sitemap <= 1.2 - Reflected Cross-Site ScriptingAdvanced Image Sitemap
- CVE-2022-1182Visual Slide Box Builder <= 3.2.9 - Subscriber+ SQLiVisual Slide Box Builder
- CVE-2022-1103Advanced Uploader <= 4.2 - Subscriber+ Arbitrary File UploadAdvanced uploader
- CVE-2022-1089Bulk Edit and Create User Profiles < 1.5.14 - Admin+ Stored Cross-Site ScriptingBulk Edit and Create User Profiles – WP Sheet Editor
- CVE-2022-1062th23 Social <= 1.2.0 - Admin+ Stored Cross-Site Scriptingth23 Social
- CVE-2022-1051WPQA < 5.2 - Subscriber+ Stored Cross-Site Scripting via Profile fieldsWPQA Builder Plugin
- CVE-2022-0873Gmedia Photo Gallery < 1.20.0 - Admin+ Stored Cross-Site ScriptingGmedia Photo Gallery
- CVE-2022-0867ARPrice Lite < 3.6.1 - Unauthenticated SQLiPricing Table Plugin
- CVE-2021-25119AGIL <= 1.0 - Admin+ Arbitrary File UploadAGIL
- CVE-2021-42870ACCEL-PPP 1.12.0 has an out-of-bounds read in post_msg when processing a call_clear_request.
- CVE-2022-30777Parallels H-Sphere 3.6.1713 allows XSS via the index_en.php from parameter.
- CVE-2022-30776atmail 6.5.0 allows XSS via the index.php/admin/index/ error parameter.
- CVE-2021-42897A remote command execution (RCE) vulnerability was found in FeMiner wms V1.0 in /wms/src/system/datarec.php.
- CVE-2022-30013A stored cross-site scripting (XSS) vulnerability in the upload function of totaljs CMS 3.4.5 allows attackers to execute arbitrary web scri
- CVE-2022-29351An arbitrary file upload vulnerability in the file upload module of Tiddlywiki5 v5.2.2 allows attackers to execute arbitrary code via a craf
- CVE-2022-29353An arbitrary file upload vulnerability in the file upload module of Graphql-upload v13.0.0 allows attackers to execute arbitrary code via a
- CVE-2022-29354An arbitrary file upload vulnerability in the file upload module of Keystone v4.2.1 allows attackers to execute arbitrary code via a crafted
- CVE-2022-29623An arbitrary file upload vulnerability in the file upload module of Express Connect-Multiparty 2.2.0 allows attackers to execute arbitrary cconnect-multiparty
- CVE-2022-29017Bento4 v1.6.0.0 was discovered to contain a segmentation fault via the component /x86_64/multiarch/strlen-avx2.S.
- CVE-2022-30012In the POST request of the appointment.php page of HMS v.0, there are SQL injection vulnerabilities in multiple parameters, and database inf
- CVE-2022-30011In HMS 1.0 when requesting appointment.php through POST, multiple parameters can lead to a SQL injection vulnerability.
- CVE-2022-29586Konica Minolta bizhub MFP devices before 2022-04-14 allow a Sandbox Escape.
- CVE-2022-29587Konica Minolta bizhub MFP devices before 2022-04-14 have an internal Chromium browser that executes with root (aka superuser) access privile
- CVE-2022-29588Konica Minolta bizhub MFP devices before 2022-04-14 use cleartext password storage for the /var/log/nginx/html/ADMINPASS and /etc/shadow fil
- CVE-2022-30782Openmoney API through 2020-06-29 uses the JavaScript Math.random function, which does not provide cryptographically secure random numbers.
- CVE-2022-30775xpdf 4.04 allocates excessive memory when presented with crafted input.
- CVE-2022-30767nfs_lookup_reply in net/nfs.c in Das U-Boot through 2022.04 (and through 2022.07-rc2) has an unbounded memcpy with a failed length check, le
- CVE-2022-30763Janet before 1.22.0 mishandles arrays.
- CVE-2022-30765Calibre-Web before 0.6.18 allows user table SQL Injection.calibreweb
- CVE-2022-1586An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compipcre2
- CVE-2022-1587An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.cpcre2
- CVE-2022-1679A use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_targetKernel
- CVE-2022-1720Buffer Over-read in function grab_file_name in vim/vimvim/vim
- CVE-2022-1725NULL Pointer Dereference in vim/vimvim/vim
- CVE-2022-29622An arbitrary file upload vulnerability in formidable v3.1.4 allows attackers to execute arbitrary code via a crafted filename.
- CVE-2022-30770Terminalfour versions 8.3.7, 8.3.x versions prior to version 8.3.8 and r 8.2.x versions prior to version 8.2.18.5 or 8.2.18.2.1 are vulnerab
- CVE-2022-30781Gitea before 1.16.7 does not escape git fetch remote.code.gitea.io/gitea