# CVEs published 2022-05-16

101 CVEs were published on May 16, 2022: 3 critical, 8 high. Days are UTC.

- [CVE-2022-23670](https://cve.now/CVE-2022-23670.md): A remote authenticated information disclosure vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6 (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2022-23667](https://cve.now/CVE-2022-23667.md): A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2022-23668](https://cve.now/CVE-2022-23668.md): A remote authenticated server-side request forgery (ssrf) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2022-23666](https://cve.now/CVE-2022-23666.md): A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2022-23665](https://cve.now/CVE-2022-23665.md): A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2022-23664](https://cve.now/CVE-2022-23664.md): A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2022-23661](https://cve.now/CVE-2022-23661.md): A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2022-23662](https://cve.now/CVE-2022-23662.md): A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2022-23663](https://cve.now/CVE-2022-23663.md): A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2022-23660](https://cve.now/CVE-2022-23660.md): A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2022-23659](https://cve.now/CVE-2022-23659.md): A remote reflected cross site scripting (xss) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6 (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2022-23658](https://cve.now/CVE-2022-23658.md): A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2022-23657](https://cve.now/CVE-2022-23657.md): A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2022-1731](https://cve.now/CVE-2022-1731.md): Metasonic Doc WebClient 7.0.14.0 / 7.0.12.0 / 7.0.3.0 is vulnerable to a SQL injection attack in the username field. (no CVSS, Metasonic Doc WebClient)
- [CVE-2021-33025](https://cve.now/CVE-2021-33025.md): xArrow SCADA Path Traversal (CVSS 5.6, xArrow SCADA)
- [CVE-2021-33021](https://cve.now/CVE-2021-33021.md): xArrow SCADA Cross-site Scripting (CVSS 6.1, xArrow SCADA)
- [CVE-2021-33001](https://cve.now/CVE-2021-33001.md): xArrow SCADA Cross-site Scripting (CVSS 6.1, xArrow SCADA)
- [CVE-2022-30697](https://cve.now/CVE-2022-30697.md): Local privilege escalation due to insecure folder permissions (no CVSS, Acronis Snap Deploy)
- [CVE-2022-30696](https://cve.now/CVE-2022-30696.md): Local privilege escalation due to a DLL hijacking vulnerability (no CVSS, Acronis Snap Deploy)
- [CVE-2022-30695](https://cve.now/CVE-2022-30695.md): Local privilege escalation due to excessive permissions assigned to child processes (no CVSS, Acronis Snap Deploy)
- [CVE-2021-27446](https://cve.now/CVE-2021-27446.md): Weintek EasyWeb cMT Code Injection (CVSS 10.0, Weintek cMT-SVR-1xx/2xx · Weintek cMT-G01/G02 +5)
- [CVE-2021-27444](https://cve.now/CVE-2021-27444.md): Weintek EasyWeb cMT Improper Access Control (CVSS 9.8, Weintek cMT-SVR-1xx/2xx · Weintek cMT-G01/G02 +5)
- [CVE-2021-27442](https://cve.now/CVE-2021-27442.md): Weintek EasyWeb cMT Cross-site Scripting (CVSS 9.4, Weintek cMT-SVR-1xx/2xx · Weintek cMT-G01/G02 +5)
- [CVE-2021-23267](https://cve.now/CVE-2021-23267.md): Improper Control of Dynamically-Managed Code Resources in Crafter Studio (CVSS 7.6, Crafter Software Crafter CMS · org.craftercms:crafter-studio)
- [CVE-2021-23266](https://cve.now/CVE-2021-23266.md): Improper Output Neutralization for Logs in Crafter Studio (CVSS 4.3, Crafter Software Crafter CMS · org.craftercms:craftercms)
- [CVE-2021-23265](https://cve.now/CVE-2021-23265.md): Improper Privilege Management in Crafter Studio (CVSS 3.5, Crafter Software Crafter CMS · org.craftercms:craftercms)
- [CVE-2022-30126](https://cve.now/CVE-2022-30126.md): Apache Tika Regular Expression Denial of Service in Standards Extractor (no CVSS, Apache Software Foundation Apache Tika · org.apache.tika:ti…)
- [CVE-2022-25169](https://cve.now/CVE-2022-25169.md): Apache Tika BPGParser Memory Usage DoS (no CVSS, Apache Software Foundation Apache Tika · org.apache.tika:ti…)
- [CVE-2022-30055](https://cve.now/CVE-2022-30055.md): Prime95 30.7 build 9 suffers from a Buffer Overflow vulnerability that could lead to Remote Code Execution. (no CVSS)
- [CVE-2022-30050](https://cve.now/CVE-2022-30050.md): Gnuboard 5.55 and 5.56 is vulnerable to Cross Site Scripting (XSS) via bbs/member\_confirm.php. (no CVSS)
- [CVE-2021-33318](https://cve.now/CVE-2021-33318.md): An Input Validation Vulnerability exists in Joel Christner .NET C# packages WatsonWebserver, IpMatcher 1.0.4.1 and below (IpMatcher) and 4.1 (no CVSS, IpMatcher)
- [CVE-2022-1726](https://cve.now/CVE-2022-1726.md): Bootstrap Tables XSS vulnerability with Table Export plug-in when exportOptions: htmlContent is true in wenzhixin/bootstrap-table (CVSS 6.8, wenzhixin/bootstrap-table · bootstrap-table)
- [CVE-2022-1728](https://cve.now/CVE-2022-1728.md): Allowing long password leads to denial of service in polonel/trudesk in polonel/trudesk (CVSS 7.6, polonel/trudesk)
- [CVE-2022-30523](https://cve.now/CVE-2022-30523.md): Trend Micro Password Manager (Consumer) version 5.0.0.1266 and below is vulnerable to a Link Following Privilege Escalation Vulnerability th (no CVSS, Trend Micro Password Manager)
- [CVE-2022-1718](https://cve.now/CVE-2022-1718.md): The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request in polonel/trudesk (CVSS 7.2, polonel/trudesk)
- [CVE-2022-1719](https://cve.now/CVE-2022-1719.md): Reflected XSS on ticket filter function in polonel/trudesk (CVSS 5.5, polonel/trudesk)
- [CVE-2022-0573](https://cve.now/CVE-2022-0573.md): JFrog Artifactory before 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of untrusted data which can lead to DoS, Privilege Es (CVSS 8.8, JFrog Artifactory)
- [CVE-2022-1553](https://cve.now/CVE-2022-1553.md): Leaking password protected articles content due to improper access control in publify/publify (CVSS 8.8, publify/publify · publify\_core)
- [CVE-2022-1713](https://cve.now/CVE-2022-1713.md): SSRF on /proxy in jgraph/drawio (CVSS 7.5, jgraph/drawio)
- [CVE-2022-0578](https://cve.now/CVE-2022-0578.md): Code Injection in publify/publify (CVSS 5.3, publify/publify · publify\_core)
- [CVE-2022-0574](https://cve.now/CVE-2022-0574.md): Improper Access Control in publify/publify (CVSS 5.3, publify/publify · publify\_core)
- [CVE-2022-1721](https://cve.now/CVE-2022-1721.md): Path Traversal in WellKnownServlet in jgraph/drawio (CVSS 7.5, jgraph/drawio)
- [CVE-2022-1722](https://cve.now/CVE-2022-1722.md): SSRF in editor's proxy via IPv6 link-local address in jgraph/drawio (CVSS 7.5, jgraph/drawio)
- [CVE-2022-1560](https://cve.now/CVE-2022-1560.md): Amministrazione Aperta \< 3.8 - Admin+ LFI (no CVSS, Amministrazione Aperta)
- [CVE-2022-1559](https://cve.now/CVE-2022-1559.md): Clipr \<= 1.2.3 - Admin+ Stored Cross-Site Scripting (no CVSS, Clipr)
- [CVE-2022-1557](https://cve.now/CVE-2022-1557.md): ULeak Security & Monitoring \<= 1.2.3 - Subscriber+ Stored Cross-Site Scripting (no CVSS, ULeak Security & Monitoring Plugin)
- [CVE-2022-1512](https://cve.now/CVE-2022-1512.md): ScrollReveal.js Effects \<= 1.2 - Admin+ Stored Cross-Site Scripting (no CVSS, ScrollReveal.js Effects)
- [CVE-2022-1465](https://cve.now/CVE-2022-1465.md): WPC Smart Wishlist for WooCommerce \< 2.9.9 - Reflected Cross-Site Scripting (no CVSS, WPC Smart Wishlist for WooCommerce)
- [CVE-2022-1455](https://cve.now/CVE-2022-1455.md): Call Now Button \< 1.1.2 - Reflected Cross-Site Scripting (no CVSS, Call Now Button)
- [CVE-2022-1436](https://cve.now/CVE-2022-1436.md): WPCargo Track & Trace \< 6.9.5 - Reflected Cross Site Scripting (no CVSS, WPCargo Track & Trace)
- [CVE-2022-1435](https://cve.now/CVE-2022-1435.md): WPCargo Track & Trace \< 6.9.5 - Admin+ Stored Cross Site Scripting (no CVSS, WPCargo Track & Trace)
- [CVE-2022-1425](https://cve.now/CVE-2022-1425.md): WPQA \< 5.2 - Subscriber+ Private Message Disclosure via IDOR (no CVSS, WPQA Builder Plugin)
- [CVE-2022-1418](https://cve.now/CVE-2022-1418.md): Social Stickers \<= 2.2.9 - Stored Cross-Site Scripting via CSRF (no CVSS, Social Stickers)
- [CVE-2022-1409](https://cve.now/CVE-2022-1409.md): VikBooking Hotel Booking Engine & PMS \< 1.5.8 - Admin+ PHP File Upload (no CVSS, VikBooking Hotel Booking Engine & PMS)
- [CVE-2022-1408](https://cve.now/CVE-2022-1408.md): VikBooking Hotel Booking Engine & PMS \< 1.5.8 - Admin+ Stored Cross-Site Scripting (no CVSS, VikBooking Hotel Booking Engine & PMS)
- [CVE-2022-1407](https://cve.now/CVE-2022-1407.md): VikBooking Hotel Booking Engine & PMS \< 1.5.7 - Stored Cross-Site Scripting via CSRF (no CVSS, VikBooking Hotel Booking Engine & PMS)
- [CVE-2022-1398](https://cve.now/CVE-2022-1398.md): External Media without Import \<= 1.1.2 - Subscriber+ Blind SSRF (no CVSS, External Media without Import)
- [CVE-2022-1393](https://cve.now/CVE-2022-1393.md): WP Subtitle \< 3.4.1 - Contributor+ Stored Cross-Site Scripting (no CVSS, WP Subtitle)
- [CVE-2022-1386](https://cve.now/CVE-2022-1386.md): Fusion Builder \< 3.6.2 - Unauthenticated SSRF (no CVSS, Fusion Builder)
- [CVE-2022-1349](https://cve.now/CVE-2022-1349.md): WPQA \< 5.2 - Subscriber+ Arbitrary Profile Picture Deletion via IDOR (no CVSS, WPQA Builder Plugin)
- [CVE-2022-1334](https://cve.now/CVE-2022-1334.md): WP YouTube Live \< 1.8.3 - Admin+ Stored Cross Site Scripting (no CVSS, WP YouTube Live)
- [CVE-2022-1267](https://cve.now/CVE-2022-1267.md): BMI BMR Calculator \<= 1.3 - Reflected Cross-Site Scripting (no CVSS, BMI BMR Calculator)
- [CVE-2022-1265](https://cve.now/CVE-2022-1265.md): BulletProof Security \< 6.1 - Admin+ Stored Cross-Site Scripting (no CVSS, BulletProof Security)
- [CVE-2022-1217](https://cve.now/CVE-2022-1217.md): Custom TinyMCE Shortcode Button \<= 1.1 - Reflected Cross-Site Scripting (no CVSS, Custom TinyMCE Shortcode Button)
- [CVE-2022-1216](https://cve.now/CVE-2022-1216.md): Advanced Image Sitemap \<= 1.2 - Reflected Cross-Site Scripting (no CVSS, Advanced Image Sitemap)
- [CVE-2022-1182](https://cve.now/CVE-2022-1182.md): Visual Slide Box Builder \<= 3.2.9 - Subscriber+ SQLi (no CVSS, Visual Slide Box Builder)
- [CVE-2022-1103](https://cve.now/CVE-2022-1103.md): Advanced Uploader \<= 4.2 - Subscriber+ Arbitrary File Upload (no CVSS, Advanced uploader)
- [CVE-2022-1089](https://cve.now/CVE-2022-1089.md): Bulk Edit and Create User Profiles \< 1.5.14 - Admin+ Stored Cross-Site Scripting (no CVSS, Bulk Edit and Create User Profiles – WP Sheet Editor)
- [CVE-2022-1062](https://cve.now/CVE-2022-1062.md): th23 Social \<= 1.2.0 - Admin+ Stored Cross-Site Scripting (no CVSS, th23 Social)
- [CVE-2022-1051](https://cve.now/CVE-2022-1051.md): WPQA \< 5.2 - Subscriber+ Stored Cross-Site Scripting via Profile fields (no CVSS, WPQA Builder Plugin)
- [CVE-2022-0873](https://cve.now/CVE-2022-0873.md): Gmedia Photo Gallery \< 1.20.0 - Admin+ Stored Cross-Site Scripting (no CVSS, Gmedia Photo Gallery)
- [CVE-2022-0867](https://cve.now/CVE-2022-0867.md): ARPrice Lite \< 3.6.1 - Unauthenticated SQLi (no CVSS, Pricing Table Plugin)
- [CVE-2021-25119](https://cve.now/CVE-2021-25119.md): AGIL \<= 1.0 - Admin+ Arbitrary File Upload (no CVSS, AGIL)
- [CVE-2021-42870](https://cve.now/CVE-2021-42870.md): ACCEL-PPP 1.12.0 has an out-of-bounds read in post\_msg when processing a call\_clear\_request. (no CVSS)
- [CVE-2022-30777](https://cve.now/CVE-2022-30777.md): Parallels H-Sphere 3.6.1713 allows XSS via the index\_en.php from parameter. (no CVSS)
- [CVE-2022-30776](https://cve.now/CVE-2022-30776.md): atmail 6.5.0 allows XSS via the index.php/admin/index/ error parameter. (no CVSS)
- [CVE-2021-42897](https://cve.now/CVE-2021-42897.md): A remote command execution (RCE) vulnerability was found in FeMiner wms V1.0 in /wms/src/system/datarec.php. (no CVSS)
- [CVE-2022-30013](https://cve.now/CVE-2022-30013.md): A stored cross-site scripting (XSS) vulnerability in the upload function of totaljs CMS 3.4.5 allows attackers to execute arbitrary web scri (no CVSS)
- [CVE-2022-29351](https://cve.now/CVE-2022-29351.md): An arbitrary file upload vulnerability in the file upload module of Tiddlywiki5 v5.2.2 allows attackers to execute arbitrary code via a craf (no CVSS)
- [CVE-2022-29353](https://cve.now/CVE-2022-29353.md): An arbitrary file upload vulnerability in the file upload module of Graphql-upload v13.0.0 allows attackers to execute arbitrary code via a (no CVSS)
- [CVE-2022-29354](https://cve.now/CVE-2022-29354.md): An arbitrary file upload vulnerability in the file upload module of Keystone v4.2.1 allows attackers to execute arbitrary code via a crafted (no CVSS)
- [CVE-2022-29623](https://cve.now/CVE-2022-29623.md): An arbitrary file upload vulnerability in the file upload module of Express Connect-Multiparty 2.2.0 allows attackers to execute arbitrary c (no CVSS, connect-multiparty)
- [CVE-2022-29017](https://cve.now/CVE-2022-29017.md): Bento4 v1.6.0.0 was discovered to contain a segmentation fault via the component /x86\_64/multiarch/strlen-avx2.S. (no CVSS)
- [CVE-2022-30012](https://cve.now/CVE-2022-30012.md): In the POST request of the appointment.php page of HMS v.0, there are SQL injection vulnerabilities in multiple parameters, and database inf (no CVSS)
- [CVE-2022-30011](https://cve.now/CVE-2022-30011.md): In HMS 1.0 when requesting appointment.php through POST, multiple parameters can lead to a SQL injection vulnerability. (no CVSS)
- [CVE-2022-29586](https://cve.now/CVE-2022-29586.md): Konica Minolta bizhub MFP devices before 2022-04-14 allow a Sandbox Escape. (no CVSS)
- [CVE-2022-29587](https://cve.now/CVE-2022-29587.md): Konica Minolta bizhub MFP devices before 2022-04-14 have an internal Chromium browser that executes with root (aka superuser) access privile (no CVSS)
- [CVE-2022-29588](https://cve.now/CVE-2022-29588.md): Konica Minolta bizhub MFP devices before 2022-04-14 use cleartext password storage for the /var/log/nginx/html/ADMINPASS and /etc/shadow fil (no CVSS)
- [CVE-2022-30782](https://cve.now/CVE-2022-30782.md): Openmoney API through 2020-06-29 uses the JavaScript Math.random function, which does not provide cryptographically secure random numbers. (no CVSS)
- [CVE-2022-30775](https://cve.now/CVE-2022-30775.md): xpdf 4.04 allocates excessive memory when presented with crafted input. (no CVSS)
- [CVE-2022-30767](https://cve.now/CVE-2022-30767.md): nfs\_lookup\_reply in net/nfs.c in Das U-Boot through 2022.04 (and through 2022.07-rc2) has an unbounded memcpy with a failed length check, le (no CVSS)
- [CVE-2022-30763](https://cve.now/CVE-2022-30763.md): Janet before 1.22.0 mishandles arrays. (no CVSS)
- [CVE-2022-30765](https://cve.now/CVE-2022-30765.md): Calibre-Web before 0.6.18 allows user table SQL Injection. (no CVSS, calibreweb)
- [CVE-2022-1586](https://cve.now/CVE-2022-1586.md): An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile\_xclass\_matchingpath() function of the pcre2\_jit\_compi (no CVSS, pcre2)
- [CVE-2022-1587](https://cve.now/CVE-2022-1587.md): An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get\_recurse\_data\_length() function of the pcre2\_jit\_compile.c (no CVSS, pcre2)
- [CVE-2022-1679](https://cve.now/CVE-2022-1679.md): A use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter driver in the way a user forces the ath9k\_htc\_wait\_for\_target (no CVSS, Kernel)
- [CVE-2022-1720](https://cve.now/CVE-2022-1720.md): Buffer Over-read in function grab\_file\_name in vim/vim (CVSS 6.6, vim/vim)
- [CVE-2022-1725](https://cve.now/CVE-2022-1725.md): NULL Pointer Dereference in vim/vim (CVSS 6.6, vim/vim)
- [CVE-2022-29622](https://cve.now/CVE-2022-29622.md): An arbitrary file upload vulnerability in formidable v3.1.4 allows attackers to execute arbitrary code via a crafted filename. (no CVSS)
- [CVE-2022-30770](https://cve.now/CVE-2022-30770.md): Terminalfour versions 8.3.7, 8.3.x versions prior to version 8.3.8 and r 8.2.x versions prior to version 8.2.18.5 or 8.2.18.2.1 are vulnerab (no CVSS)
- [CVE-2022-30781](https://cve.now/CVE-2022-30781.md): Gitea before 1.16.7 does not escape git fetch remote. (no CVSS, code.gitea.io/gitea)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-05-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.