CVEs published May 17, 2022
111 CVEs were published on May 17, 2022: 2 critical, 23 high.
- Published
- 111
- Critical
- 2
- High
- 23
- Medium
- 28
- Low
- 2
- Unrated
- 56
- Now in CISA KEV
- 0
- Fix available
- 46
Most affected products
- NVIDIA GPU Display Driver
- 10
- Fidelis Cybersecurity Fidelis Network · Fidelis Cybersecuri…
- 9
- Cambium Networks cnMaestro
- 7
- Aruba ClearPass Policy Manager
- 6
- Alexander Stokmann Code Snippets Extended
- 3
- HPE OneView
- 3
- Jenkins project Jenkins Autocomplete Parameter Plugin · org…
- 3
- Jenkins project Jenkins SSH Plugin · org.jenkins-ci.plugins…
- 3
- vim/vim
- 3
- IBM DataPower Gateway
- 2
Critical 2
High 23
- CVE-2022-29174Predictable password reset token may lead to account takeover in countly-servercountly-server
- CVE-2022-1361Cambium Networks cnMaestro SQL InjectionCambium Networks cnMaestro
- CVE-2022-1360Cambium Networks cnMaestro OS Command InjectionCambium Networks cnMaestro
- CVE-2022-1356Cambium Networks cnMaestro use of Potentially Dangerous FunctionCambium Networks cnMaestro
- CVE-2022-1118Rockwell Automation ISaGRAF Deserialization of Untrusted DataRockwell Automation Connected Component Workbench · Rock… +1
- CVE-2022-24388Authenticated Privileged Command Injection Vulnerability in Fidelis Network and DeceptionFidelis Cybersecurity Fidelis Network · Fidelis Cybersecuri…
- CVE-2022-24389Authenticated Privileged Command Injection Vulnerability in Fidelis Network and DeceptionFidelis Cybersecurity Fidelis Network · Fidelis Cybersecuri…
- CVE-2022-24390Authenticated Command Injection Vulnerability in Fidelis Network and DeceptionFidelis Cybersecurity Fidelis Network · Fidelis Cybersecuri…
- CVE-2022-24391Authenticated SQL Injection Vulnerability in Fidelis Network and DeceptionFidelis Cybersecurity Fidelis Network · Fidelis Cybersecuri…
- CVE-2022-24392Authenticated Command Injection Vulnerability in Fidelis Network and DeceptionFidelis Cybersecurity Fidelis Network · Fidelis Cybersecuri…
- CVE-2022-24393Authenticated Command Injection Vulnerability in Fidelis Network and DeceptionFidelis Cybersecurity Fidelis Network · Fidelis Cybersecuri…
- CVE-2022-24394Authenticated Command Injection Vulnerability in Fidelis Network and DeceptionFidelis Cybersecurity Fidelis Network · Fidelis Cybersecuri…
- CVE-2022-28182NVIDIA GPU Display Driver for Windows contains a vulnerability in the DirectX11 user mode driver (nvwgf2um/x.dll), where an unauthorized attNVIDIA GPU Display Driver
- CVE-2022-29429WordPress Code Snippets Extended plugin <= 1.4.7 - Cross-Site Request Forgery (CSRF) leading to Remote Code Execution (RCE) vulnerabilityAlexander Stokmann Code Snippets Extended
- CVE-2022-22775TIBCO ActiveMatrix BPM Reflected Cross Site Scripting (XSS) vulnerabilityTIBCO Software TIBCO BPM Enterprise
- CVE-2022-22773TIBCO JasperReports Server Reflected Cross Site Scripting (XSS) vulnerabilityTIBCO Software TIBCO JasperReports Server
- CVE-2022-29581Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege escalation to root.Linux Kernel
- CVE-2022-1116Integer Overflow or Wraparound vulnerability in io_uring of Linux Kernel allows local attacker to cause memory corruption and escalate priviLinux Kernel
- CVE-2022-1711Server-Side Request Forgery (SSRF) in jgraph/drawiojgraph/drawio
- CVE-2022-1723Server-Side Request Forgery (SSRF) in jgraph/drawiojgraph/drawio
- CVE-2022-28181NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user on theNVIDIA GPU Display Driver
- CVE-2022-28183NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user can caNVIDIA GPU Display Driver
- CVE-2022-28184NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, NVIDIA GPU Display Driver
Medium, low and unrated 86
- CVE-2022-1362Cambium Networks cnMaestro OS Command InjectionCambium Networks cnMaestro
- CVE-2022-1359Cambium Networks cnMaestro Path TraversalCambium Networks cnMaestro
- CVE-2022-1358Cambium Networks cnMaestro SQL InjectionCambium Networks cnMaestro
- CVE-2022-28616A remote server-side request forgery (ssrf) vulnerability was discovered in HPE OneView version(s): Prior to 7.0.HPE OneView
- CVE-2022-23706A remote cross-site scripting (xss) vulnerability was discovered in HPE OneView version(s): Prior to 7.0.HPE OneView
- CVE-2022-28617A remote bypass security restrictions vulnerability was discovered in HPE OneView version(s): Prior to 7.0.HPE OneView
- CVE-2022-29435WordPress Code Snippets Extended plugin <= 1.4.7 - Cross-Site Request Forgery (CSRF) vulnerabilityAlexander Stokmann Code Snippets Extended
- CVE-2022-29436WordPress Code Snippets Extended plugin <= 1.4.7 - Cross-Site Request Forgery (CSRF) vulnerability leading to Persistent Cross-Site Scripting (XSS)Alexander Stokmann Code Snippets Extended
- CVE-2021-35249Domain Admin Broken Access ControlSolarWinds Serv-U
- CVE-2022-30054In Covid 19 Travel Pass Management 1.0, the code parameter is vulnerable to SQL injection attacks.
- CVE-2022-30053In Toll Tax Management System 1.0, the id parameter appears to be vulnerable to SQL injection attacks.
- CVE-2022-30052In Home Clean Service System 1.0, the password parameter is vulnerable to SQL injection attacks.
- CVE-2022-0486Privileged Command Injection Vulnerability in Fidelis Network and DeceptionFidelis Cybersecurity Fidelis Network · Fidelis Cybersecuri…
- CVE-2022-0997Local Privilege Escalation Vulnerability in Fidelis Network and DeceptionFidelis Cybersecurity Fidelis Network · Fidelis Cybersecuri…
- CVE-2022-30045An issue was discovered in libezxml.a in ezXML 0.8.6.
- CVE-2022-28192NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko), where it may lead to a use-after-free, which in turn mNVIDIA Virtual GPU Software and NVIDIA Cloud Gaming
- CVE-2022-28191NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko), where uncontrolled resource consumption can be triggerNVIDIA Virtual GPU Software and NVIDIA Cloud Gaming
- CVE-2022-28190NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where imprNVIDIA GPU Display Driver
- CVE-2022-28189NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where a NUNVIDIA GPU Display Driver
- CVE-2022-28188NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where the NVIDIA GPU Display Driver
- CVE-2022-28187NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where the memory management softwareNVIDIA GPU Display Driver
- CVE-2022-28186NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where the NVIDIA GPU Display Driver
- CVE-2022-24890Exposure of Private Personal Information to an Unauthorized Actor in Nextcloud Talknextcloud security-advisories
- CVE-2022-30688needrestart 0.8 through 3.5 before 3.6 is prone to local privilege escalation.
- CVE-2022-23674A remote authenticated stored cross-site scripting (xss) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 aAruba ClearPass Policy Manager
- CVE-2022-23675A remote authenticated stored cross-site scripting (xss) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 aAruba ClearPass Policy Manager
- CVE-2022-23673A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 Aruba ClearPass Policy Manager
- CVE-2022-23671A remote authenticated information disclosure vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6Aruba ClearPass Policy Manager
- CVE-2022-23672A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 Aruba ClearPass Policy Manager
- CVE-2022-23669A remote authorization bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, Aruba ClearPass Policy Manager
- CVE-2022-24611Denial of Service (DoS) in the Z-Wave S0 NonceGet protocol specification in Silicon Labs Z-Wave 500 series allows local attackers to block S
- CVE-2022-30689HashiCorp Vault and Vault Enterprise from 1.10.0 to 1.10.2 did not correctly configure and enforce MFA on login after server restarts.github.com/hashicorp/vault
- CVE-2022-22482IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5 and 6.1.0.0 through 6.1.1.0 could allow an authenticated user to uploadIBM Sterling B2B Integrator
- CVE-2022-22475IBM WebSphere Application Server Liberty and Open Liberty 17.0.0.3 through 22.0.0.5 are vulnerable to identity spoofing by an authenticated IBM WebSphere Application Server Liberty
- CVE-2021-38872IBM DataPower Gateway 10.0.2.0, 10.0.3.0, 10.0.1.0 through 10.0.1.4, and 2018.4.1.0 through 2018.4.1.17 could allow a remote user to cause aIBM DataPower Gateway
- CVE-2021-29726IBM Sterling Secure Proxy 6.0.3 and IBM Secure External Authentication Server 6.0.3 does not properly ensure that a certificate is actually IBM Secure External Authentication Server · IBM Sterling Se…
- CVE-2020-4994IBM DataPower Gateway 10.0.1.0 through 10.0.1.4 and 2018.4.1.0 through 2018.4.1.17 could allow a remote user to cause a temporary denial of IBM DataPower Gateway
- CVE-2022-30072WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via \admin\pages\sections_save.php namesection2 parameters.
- CVE-2022-30073WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via /admin/users/save.php.
- CVE-2022-22484IBM Spectrum Protect Operations Center 8.1.12 and 8.1.13 could allow a local attacker to obtain sensitive information, caused by plain text IBM Spectrum Protect Operations Center
- CVE-2020-4957IBM Security Identity Governance and Intelligence 5.2.6 could disclose sensitive information in URL parameters that could aid in future attaIBM Security Identity Governance and Intelligence
- CVE-2022-24108The Skyoftech So Listing Tabs module 2.2.0 for OpenCart allows a remote attacker to inject a serialized PHP object via the setting parameter
- CVE-2022-30972A cross-site request forgery (CSRF) vulnerability in Jenkins Storable Configs Plugin 1.0 and earlier allows attackers to have Jenkins parse Jenkins project Jenkins Storable Configs Plugin · org.jvnet…
- CVE-2022-30971Jenkins Storable Configs Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins project Jenkins Storable Configs Plugin · org.jvnet…
- CVE-2022-30970Jenkins Autocomplete Parameter Plugin 1.1 and earlier references Dropdown Autocomplete parameter and Auto Complete String parameter names inJenkins project Jenkins Autocomplete Parameter Plugin · org…
- CVE-2022-30969A cross-site request forgery (CSRF) vulnerability in Jenkins Autocomplete Parameter Plugin 1.1 and earlier allows attackers to execute arbitJenkins project Jenkins Autocomplete Parameter Plugin · org…
- CVE-2022-30968Jenkins vboxwrapper Plugin 1.3 and earlier does not escape the name and description of VBox node parameters on views displaying parameters, Jenkins project Jenkins vboxwrapper Plugin · org.jenkins-ci…
- CVE-2022-30967Jenkins Selection tasks Plugin 1.0 and earlier does not escape the name and description of Script Selection task variable parameters on viewJenkins project Jenkins Selection tasks Plugin · org.jvnet.…
- CVE-2022-30966Jenkins Random String Parameter Plugin 1.0 and earlier does not escape the name and description of Random String parameters on views displayJenkins project Jenkins Random String Parameter Plugin · or…
- CVE-2022-30965Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name and description of Promotion Level parameters on views dispJenkins project Jenkins Promoted Builds (Simple) Plugin · o…
- CVE-2022-30964Jenkins Multiselect parameter Plugin 1.3 and earlier does not escape the name and description of Multiselect parameters on views displaying Jenkins project Jenkins Multiselect parameter Plugin · io.j…
- CVE-2022-30963Jenkins JDK Parameter Plugin 1.0 and earlier does not escape the name and description of JDK parameters on views displaying parameters, resuJenkins project Jenkins JDK Parameter Plugin · org.jenkins-…
- CVE-2022-30962Jenkins Global Variable String Parameter Plugin 1.2 and earlier does not escape the name and description of Global Variable String parameterJenkins project Jenkins Global Variable String Parameter Pl…
- CVE-2022-30961Jenkins Autocomplete Parameter Plugin 1.1 and earlier does not escape the name of Dropdown Autocomplete and Auto Complete String parameters Jenkins project Jenkins Autocomplete Parameter Plugin · org…
- CVE-2022-30960Jenkins Application Detector Plugin 1.0.8 and earlier does not escape the name of Chois Application Version parameters on views displaying pJenkins project Jenkins Application Detector Plugin · org.j…
- CVE-2022-30959A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-sJenkins project Jenkins SSH Plugin · org.jenkins-ci.plugins…
- CVE-2022-30958A cross-site request forgery (CSRF) vulnerability in Jenkins SSH Plugin 2.6.1 and earlier allows attackers to connect to an attacker-specifiJenkins project Jenkins SSH Plugin · org.jenkins-ci.plugins…
- CVE-2022-30957A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDJenkins project Jenkins SSH Plugin · org.jenkins-ci.plugins…
- CVE-2022-30956Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a stored cross-site scrJenkins project Jenkins Rundeck Plugin · org.jenkins-ci.plu…
- CVE-2022-30955Jenkins GitLab Plugin 1.5.31 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permiJenkins project Jenkins GitLab Plugin · org.jenkins-ci.plug…
- CVE-2022-30954Jenkins Blue Ocean Plugin 1.25.3 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Jenkins project Jenkins Blue Ocean Plugin · io.jenkins.blue…
- CVE-2022-30953A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attackerJenkins project Jenkins Blue Ocean Plugin · io.jenkins.blue…
- CVE-2022-30951Jenkins WMI Windows Agents Plugin 1.8 and earlier includes the Windows Remote Command library does not implement access control, potentiallyJenkins project Jenkins WMI Windows Agents Plugin · org.jen…
- CVE-2022-30950Jenkins WMI Windows Agents Plugin 1.8 and earlier includes the Windows Remote Command library which has a buffer overflow vulnerability thatJenkins project Jenkins WMI Windows Agents Plugin · org.jen…
- CVE-2022-30949Jenkins REPO Plugin 1.14.0 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the JenkinsJenkins project Jenkins REPO Plugin · org.jenkins-ci.plu… +2
- CVE-2022-30948Jenkins Mercurial Plugin 2.16 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the JenkJenkins project Jenkins Mercurial Plugin · org.jenkins-ci.p…
- CVE-2022-30947Jenkins Git Plugin 4.11.1 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins Jenkins project Jenkins Git Plugin · org.jenkins-ci.plug… +2
- CVE-2022-30946A cross-site request forgery (CSRF) vulnerability in Jenkins Script Security Plugin 1158.v7c1b_73a_69a_08 and earlier allows attackers to haJenkins project Jenkins Script Security Plugin · org.jenkin…
- CVE-2022-30945Jenkins Pipeline: Groovy Plugin 2689.v434009a_31b_f1 and earlier allows loading any Groovy source files on the classpath of Jenkins and JenkJenkins project Jenkins Pipeline: Groovy Plugin · org.jenki…
- CVE-2022-29332D-LINK DIR-825 AC1200 R2 is vulnerable to Directory Traversal.
- CVE-2022-30110The file preview functionality in Jirafeau < 4.4.0, which is enabled by default, could be exploited for cross site scripting.mojo42/jirafeau
- CVE-2021-42644cmseasy V7.7.5_20211012 is affected by an arbitrary file read vulnerability.
- CVE-2021-42643cmseasy V7.7.5_20211012 is affected by an arbitrary file write vulnerability.
- CVE-2021-42943Stored cross-site scripting (XSS) in admin/usermanager.php over IPPlan v4.92b allows remote attackers to inject arbitrary web script or HTML
- CVE-2022-26650Apache ShenYu (incubating) Regular expression denial of serviceApache Software Foundation Apache ShenYu · org.apache.sh… +1
- CVE-2013-10001HTC One/Sense Mail Client certificate validationHTC One · HTC Sense
- CVE-2022-1753WoWonder Group requests.php access controlWoWonder
- CVE-2022-1706A vulnerability was found in Ignition where ignition configs are accessible from unprivileged containers in VMs running on VMware products.coreos/ignition · github.com/coreos/ignition +1
- CVE-2022-1733Heap-based Buffer Overflow in vim/vimvim/vim
- CVE-2022-1735Classic Buffer Overflow in vim/vimvim/vim
- CVE-2022-1769Buffer Over-read in vim/vimvim/vim
- CVE-2022-28185NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the ECC layer, where an unprivileged regular user can cause an oNVIDIA GPU Display Driver
- CVE-2022-29162Incorrect Default Permissions in runcopencontainers runc · github.com/opencontainers/runc
- CVE-2022-30007GXCMS V1.5 has a file upload vulnerability in the background.
- CVE-2022-30067GIMP 2.10.30 and 2.99.10 are vulnerable to Buffer Overflow.
- CVE-2022-30952Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials with Jenkins project Jenkins Pipeline SCM API for Blue Ocean Plu…