# CVEs published 2022-05-17

111 CVEs were published on May 17, 2022: 2 critical, 23 high. Days are UTC.

- [CVE-2022-29174](https://cve.now/CVE-2022-29174.md): Predictable password reset token may lead to account takeover in countly-server (CVSS 8.1, countly-server)
- [CVE-2022-1362](https://cve.now/CVE-2022-1362.md): Cambium Networks cnMaestro OS Command Injection (CVSS 5.0, Cambium Networks cnMaestro)
- [CVE-2022-1361](https://cve.now/CVE-2022-1361.md): Cambium Networks cnMaestro SQL Injection (CVSS 7.4, Cambium Networks cnMaestro)
- [CVE-2022-1360](https://cve.now/CVE-2022-1360.md): Cambium Networks cnMaestro OS Command Injection (CVSS 8.2, Cambium Networks cnMaestro)
- [CVE-2022-1359](https://cve.now/CVE-2022-1359.md): Cambium Networks cnMaestro Path Traversal (CVSS 5.7, Cambium Networks cnMaestro)
- [CVE-2022-1358](https://cve.now/CVE-2022-1358.md): Cambium Networks cnMaestro SQL Injection (CVSS 5.9, Cambium Networks cnMaestro)
- [CVE-2022-1356](https://cve.now/CVE-2022-1356.md): Cambium Networks cnMaestro use of Potentially Dangerous Function (CVSS 7.1, Cambium Networks cnMaestro)
- [CVE-2022-1357](https://cve.now/CVE-2022-1357.md): Cambium Networks cnMaestro OS Command Injection (CVSS 9.8, Cambium Networks cnMaestro)
- [CVE-2022-28616](https://cve.now/CVE-2022-28616.md): A remote server-side request forgery (ssrf) vulnerability was discovered in HPE OneView version(s): Prior to 7.0. (no CVSS, HPE OneView)
- [CVE-2022-23706](https://cve.now/CVE-2022-23706.md): A remote cross-site scripting (xss) vulnerability was discovered in HPE OneView version(s): Prior to 7.0. (no CVSS, HPE OneView)
- [CVE-2022-28617](https://cve.now/CVE-2022-28617.md): A remote bypass security restrictions vulnerability was discovered in HPE OneView version(s): Prior to 7.0. (no CVSS, HPE OneView)
- [CVE-2022-29435](https://cve.now/CVE-2022-29435.md): WordPress Code Snippets Extended plugin \<= 1.4.7 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Alexander Stokmann Code Snippets Extended)
- [CVE-2022-29436](https://cve.now/CVE-2022-29436.md): WordPress Code Snippets Extended plugin \<= 1.4.7 - Cross-Site Request Forgery (CSRF) vulnerability leading to Persistent Cross-Site Scripting (XSS) (CVSS 4.7, Alexander Stokmann Code Snippets Extended)
- [CVE-2022-1118](https://cve.now/CVE-2022-1118.md): Rockwell Automation ISaGRAF Deserialization of Untrusted Data (CVSS 8.6, Rockwell Automation Connected Component Workbench · Rock… +1)
- [CVE-2021-35249](https://cve.now/CVE-2021-35249.md): Domain Admin Broken Access Control (CVSS 4.3, SolarWinds Serv-U)
- [CVE-2022-30054](https://cve.now/CVE-2022-30054.md): In Covid 19 Travel Pass Management 1.0, the code parameter is vulnerable to SQL injection attacks. (no CVSS)
- [CVE-2022-30053](https://cve.now/CVE-2022-30053.md): In Toll Tax Management System 1.0, the id parameter appears to be vulnerable to SQL injection attacks. (no CVSS)
- [CVE-2022-30052](https://cve.now/CVE-2022-30052.md): In Home Clean Service System 1.0, the password parameter is vulnerable to SQL injection attacks. (no CVSS)
- [CVE-2022-0486](https://cve.now/CVE-2022-0486.md): Privileged Command Injection Vulnerability in Fidelis Network and Deception (CVSS 4.4, Fidelis Cybersecurity Fidelis Network · Fidelis Cybersecuri…)
- [CVE-2022-0997](https://cve.now/CVE-2022-0997.md): Local Privilege Escalation Vulnerability in Fidelis Network and Deception (CVSS 3.9, Fidelis Cybersecurity Fidelis Network · Fidelis Cybersecuri…)
- [CVE-2022-24388](https://cve.now/CVE-2022-24388.md): Authenticated Privileged Command Injection Vulnerability in Fidelis Network and Deception (CVSS 8.8, Fidelis Cybersecurity Fidelis Network · Fidelis Cybersecuri…)
- [CVE-2022-24389](https://cve.now/CVE-2022-24389.md): Authenticated Privileged Command Injection Vulnerability in Fidelis Network and Deception (CVSS 8.8, Fidelis Cybersecurity Fidelis Network · Fidelis Cybersecuri…)
- [CVE-2022-24390](https://cve.now/CVE-2022-24390.md): Authenticated Command Injection Vulnerability in Fidelis Network and Deception (CVSS 8.8, Fidelis Cybersecurity Fidelis Network · Fidelis Cybersecuri…)
- [CVE-2022-24391](https://cve.now/CVE-2022-24391.md): Authenticated SQL Injection Vulnerability in Fidelis Network and Deception (CVSS 8.8, Fidelis Cybersecurity Fidelis Network · Fidelis Cybersecuri…)
- [CVE-2022-24392](https://cve.now/CVE-2022-24392.md): Authenticated Command Injection Vulnerability in Fidelis Network and Deception (CVSS 8.8, Fidelis Cybersecurity Fidelis Network · Fidelis Cybersecuri…)
- [CVE-2022-30045](https://cve.now/CVE-2022-30045.md): An issue was discovered in libezxml.a in ezXML 0.8.6. (no CVSS)
- [CVE-2022-24393](https://cve.now/CVE-2022-24393.md): Authenticated Command Injection Vulnerability in Fidelis Network and Deception (CVSS 8.8, Fidelis Cybersecurity Fidelis Network · Fidelis Cybersecuri…)
- [CVE-2022-24394](https://cve.now/CVE-2022-24394.md): Authenticated Command Injection Vulnerability in Fidelis Network and Deception (CVSS 8.8, Fidelis Cybersecurity Fidelis Network · Fidelis Cybersecuri…)
- [CVE-2022-28192](https://cve.now/CVE-2022-28192.md): NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko), where it may lead to a use-after-free, which in turn m (CVSS 4.1, NVIDIA Virtual GPU Software and NVIDIA Cloud Gaming)
- [CVE-2022-28191](https://cve.now/CVE-2022-28191.md): NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko), where uncontrolled resource consumption can be trigger (CVSS 5.5, NVIDIA Virtual GPU Software and NVIDIA Cloud Gaming)
- [CVE-2022-28190](https://cve.now/CVE-2022-28190.md): NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where impr (CVSS 5.5, NVIDIA GPU Display Driver)
- [CVE-2022-28189](https://cve.now/CVE-2022-28189.md): NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where a NU (CVSS 5.5, NVIDIA GPU Display Driver)
- [CVE-2022-28188](https://cve.now/CVE-2022-28188.md): NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where the (CVSS 5.5, NVIDIA GPU Display Driver)
- [CVE-2022-28187](https://cve.now/CVE-2022-28187.md): NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where the memory management software (CVSS 5.5, NVIDIA GPU Display Driver)
- [CVE-2022-28186](https://cve.now/CVE-2022-28186.md): NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where the (CVSS 6.1, NVIDIA GPU Display Driver)
- [CVE-2022-28182](https://cve.now/CVE-2022-28182.md): NVIDIA GPU Display Driver for Windows contains a vulnerability in the DirectX11 user mode driver (nvwgf2um/x.dll), where an unauthorized att (CVSS 8.5, NVIDIA GPU Display Driver)
- [CVE-2022-24890](https://cve.now/CVE-2022-24890.md): Exposure of Private Personal Information to an Unauthorized Actor in Nextcloud Talk (CVSS 2.4, nextcloud security-advisories)
- [CVE-2022-30688](https://cve.now/CVE-2022-30688.md): needrestart 0.8 through 3.5 before 3.6 is prone to local privilege escalation. (no CVSS)
- [CVE-2022-29429](https://cve.now/CVE-2022-29429.md): WordPress Code Snippets Extended plugin \<= 1.4.7 - Cross-Site Request Forgery (CSRF) leading to Remote Code Execution (RCE) vulnerability (CVSS 8.8, Alexander Stokmann Code Snippets Extended)
- [CVE-2022-23674](https://cve.now/CVE-2022-23674.md): A remote authenticated stored cross-site scripting (xss) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 a (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2022-23675](https://cve.now/CVE-2022-23675.md): A remote authenticated stored cross-site scripting (xss) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 a (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2022-23673](https://cve.now/CVE-2022-23673.md): A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2022-23671](https://cve.now/CVE-2022-23671.md): A remote authenticated information disclosure vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6 (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2022-23672](https://cve.now/CVE-2022-23672.md): A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2022-23669](https://cve.now/CVE-2022-23669.md): A remote authorization bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2022-22775](https://cve.now/CVE-2022-22775.md): TIBCO ActiveMatrix BPM Reflected Cross Site Scripting (XSS) vulnerability (CVSS 8.1, TIBCO Software TIBCO BPM Enterprise)
- [CVE-2022-22773](https://cve.now/CVE-2022-22773.md): TIBCO JasperReports Server Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.7, TIBCO Software TIBCO JasperReports Server)
- [CVE-2022-24611](https://cve.now/CVE-2022-24611.md): Denial of Service (DoS) in the Z-Wave S0 NonceGet protocol specification in Silicon Labs Z-Wave 500 series allows local attackers to block S (no CVSS)
- [CVE-2022-30689](https://cve.now/CVE-2022-30689.md): HashiCorp Vault and Vault Enterprise from 1.10.0 to 1.10.2 did not correctly configure and enforce MFA on login after server restarts. (no CVSS, github.com/hashicorp/vault)
- [CVE-2022-29581](https://cve.now/CVE-2022-29581.md): Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege escalation to root. (CVSS 7.8, Linux Kernel)
- [CVE-2022-1116](https://cve.now/CVE-2022-1116.md): Integer Overflow or Wraparound vulnerability in io\_uring of Linux Kernel allows local attacker to cause memory corruption and escalate privi (CVSS 7.8, Linux Kernel)
- [CVE-2022-22482](https://cve.now/CVE-2022-22482.md): IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5 and 6.1.0.0 through 6.1.1.0 could allow an authenticated user to upload (CVSS 6.5, IBM Sterling B2B Integrator)
- [CVE-2022-22475](https://cve.now/CVE-2022-22475.md): IBM WebSphere Application Server Liberty and Open Liberty 17.0.0.3 through 22.0.0.5 are vulnerable to identity spoofing by an authenticated (CVSS 5.0, IBM WebSphere Application Server Liberty)
- [CVE-2021-38872](https://cve.now/CVE-2021-38872.md): IBM DataPower Gateway 10.0.2.0, 10.0.3.0, 10.0.1.0 through 10.0.1.4, and 2018.4.1.0 through 2018.4.1.17 could allow a remote user to cause a (CVSS 5.3, IBM DataPower Gateway)
- [CVE-2021-29726](https://cve.now/CVE-2021-29726.md): IBM Sterling Secure Proxy 6.0.3 and IBM Secure External Authentication Server 6.0.3 does not properly ensure that a certificate is actually (CVSS 5.3, IBM Secure External Authentication Server · IBM Sterling Se…)
- [CVE-2020-4994](https://cve.now/CVE-2020-4994.md): IBM DataPower Gateway 10.0.1.0 through 10.0.1.4 and 2018.4.1.0 through 2018.4.1.17 could allow a remote user to cause a temporary denial of (CVSS 5.3, IBM DataPower Gateway)
- [CVE-2022-30072](https://cve.now/CVE-2022-30072.md): WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via \\admin\\pages\\sections\_save.php namesection2 parameters. (no CVSS)
- [CVE-2022-30073](https://cve.now/CVE-2022-30073.md): WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via /admin/users/save.php. (no CVSS)
- [CVE-2022-22484](https://cve.now/CVE-2022-22484.md): IBM Spectrum Protect Operations Center 8.1.12 and 8.1.13 could allow a local attacker to obtain sensitive information, caused by plain text (CVSS 5.1, IBM Spectrum Protect Operations Center)
- [CVE-2020-4957](https://cve.now/CVE-2020-4957.md): IBM Security Identity Governance and Intelligence 5.2.6 could disclose sensitive information in URL parameters that could aid in future atta (CVSS 5.3, IBM Security Identity Governance and Intelligence)
- [CVE-2022-24108](https://cve.now/CVE-2022-24108.md): The Skyoftech So Listing Tabs module 2.2.0 for OpenCart allows a remote attacker to inject a serialized PHP object via the setting parameter (no CVSS)
- [CVE-2022-24856](https://cve.now/CVE-2022-24856.md): Server-Side Request Forgery in FlyteConsole (CVSS 9.1, flyteorg flyteconsole)
- [CVE-2022-30972](https://cve.now/CVE-2022-30972.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Storable Configs Plugin 1.0 and earlier allows attackers to have Jenkins parse (no CVSS, Jenkins project Jenkins Storable Configs Plugin · org.jvnet…)
- [CVE-2022-30971](https://cve.now/CVE-2022-30971.md): Jenkins Storable Configs Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (no CVSS, Jenkins project Jenkins Storable Configs Plugin · org.jvnet…)
- [CVE-2022-30970](https://cve.now/CVE-2022-30970.md): Jenkins Autocomplete Parameter Plugin 1.1 and earlier references Dropdown Autocomplete parameter and Auto Complete String parameter names in (no CVSS, Jenkins project Jenkins Autocomplete Parameter Plugin · org…)
- [CVE-2022-30969](https://cve.now/CVE-2022-30969.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Autocomplete Parameter Plugin 1.1 and earlier allows attackers to execute arbit (no CVSS, Jenkins project Jenkins Autocomplete Parameter Plugin · org…)
- [CVE-2022-30968](https://cve.now/CVE-2022-30968.md): Jenkins vboxwrapper Plugin 1.3 and earlier does not escape the name and description of VBox node parameters on views displaying parameters, (no CVSS, Jenkins project Jenkins vboxwrapper Plugin · org.jenkins-ci…)
- [CVE-2022-30967](https://cve.now/CVE-2022-30967.md): Jenkins Selection tasks Plugin 1.0 and earlier does not escape the name and description of Script Selection task variable parameters on view (no CVSS, Jenkins project Jenkins Selection tasks Plugin · org.jvnet.…)
- [CVE-2022-30966](https://cve.now/CVE-2022-30966.md): Jenkins Random String Parameter Plugin 1.0 and earlier does not escape the name and description of Random String parameters on views display (no CVSS, Jenkins project Jenkins Random String Parameter Plugin · or…)
- [CVE-2022-30965](https://cve.now/CVE-2022-30965.md): Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name and description of Promotion Level parameters on views disp (no CVSS, Jenkins project Jenkins Promoted Builds (Simple) Plugin · o…)
- [CVE-2022-30964](https://cve.now/CVE-2022-30964.md): Jenkins Multiselect parameter Plugin 1.3 and earlier does not escape the name and description of Multiselect parameters on views displaying (no CVSS, Jenkins project Jenkins Multiselect parameter Plugin · io.j…)
- [CVE-2022-30963](https://cve.now/CVE-2022-30963.md): Jenkins JDK Parameter Plugin 1.0 and earlier does not escape the name and description of JDK parameters on views displaying parameters, resu (no CVSS, Jenkins project Jenkins JDK Parameter Plugin · org.jenkins-…)
- [CVE-2022-30962](https://cve.now/CVE-2022-30962.md): Jenkins Global Variable String Parameter Plugin 1.2 and earlier does not escape the name and description of Global Variable String parameter (no CVSS, Jenkins project Jenkins Global Variable String Parameter Pl…)
- [CVE-2022-30961](https://cve.now/CVE-2022-30961.md): Jenkins Autocomplete Parameter Plugin 1.1 and earlier does not escape the name of Dropdown Autocomplete and Auto Complete String parameters (no CVSS, Jenkins project Jenkins Autocomplete Parameter Plugin · org…)
- [CVE-2022-30960](https://cve.now/CVE-2022-30960.md): Jenkins Application Detector Plugin 1.0.8 and earlier does not escape the name of Chois Application Version parameters on views displaying p (no CVSS, Jenkins project Jenkins Application Detector Plugin · org.j…)
- [CVE-2022-30959](https://cve.now/CVE-2022-30959.md): A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-s (no CVSS, Jenkins project Jenkins SSH Plugin · org.jenkins-ci.plugins…)
- [CVE-2022-30958](https://cve.now/CVE-2022-30958.md): A cross-site request forgery (CSRF) vulnerability in Jenkins SSH Plugin 2.6.1 and earlier allows attackers to connect to an attacker-specifi (no CVSS, Jenkins project Jenkins SSH Plugin · org.jenkins-ci.plugins…)
- [CVE-2022-30957](https://cve.now/CVE-2022-30957.md): A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to enumerate credentials ID (no CVSS, Jenkins project Jenkins SSH Plugin · org.jenkins-ci.plugins…)
- [CVE-2022-30956](https://cve.now/CVE-2022-30956.md): Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a stored cross-site scr (no CVSS, Jenkins project Jenkins Rundeck Plugin · org.jenkins-ci.plu…)
- [CVE-2022-30955](https://cve.now/CVE-2022-30955.md): Jenkins GitLab Plugin 1.5.31 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permi (no CVSS, Jenkins project Jenkins GitLab Plugin · org.jenkins-ci.plug…)
- [CVE-2022-30954](https://cve.now/CVE-2022-30954.md): Jenkins Blue Ocean Plugin 1.25.3 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/ (no CVSS, Jenkins project Jenkins Blue Ocean Plugin · io.jenkins.blue…)
- [CVE-2022-30953](https://cve.now/CVE-2022-30953.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker (no CVSS, Jenkins project Jenkins Blue Ocean Plugin · io.jenkins.blue…)
- [CVE-2022-30951](https://cve.now/CVE-2022-30951.md): Jenkins WMI Windows Agents Plugin 1.8 and earlier includes the Windows Remote Command library does not implement access control, potentially (no CVSS, Jenkins project Jenkins WMI Windows Agents Plugin · org.jen…)
- [CVE-2022-30950](https://cve.now/CVE-2022-30950.md): Jenkins WMI Windows Agents Plugin 1.8 and earlier includes the Windows Remote Command library which has a buffer overflow vulnerability that (no CVSS, Jenkins project Jenkins WMI Windows Agents Plugin · org.jen…)
- [CVE-2022-30949](https://cve.now/CVE-2022-30949.md): Jenkins REPO Plugin 1.14.0 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins (no CVSS, Jenkins project Jenkins REPO Plugin · org.jenkins-ci.plu… +2)
- [CVE-2022-30948](https://cve.now/CVE-2022-30948.md): Jenkins Mercurial Plugin 2.16 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenk (no CVSS, Jenkins project Jenkins Mercurial Plugin · org.jenkins-ci.p…)
- [CVE-2022-30947](https://cve.now/CVE-2022-30947.md): Jenkins Git Plugin 4.11.1 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins (no CVSS, Jenkins project Jenkins Git Plugin · org.jenkins-ci.plug… +2)
- [CVE-2022-30946](https://cve.now/CVE-2022-30946.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Script Security Plugin 1158.v7c1b\_73a\_69a\_08 and earlier allows attackers to ha (no CVSS, Jenkins project Jenkins Script Security Plugin · org.jenkin…)
- [CVE-2022-30945](https://cve.now/CVE-2022-30945.md): Jenkins Pipeline: Groovy Plugin 2689.v434009a\_31b\_f1 and earlier allows loading any Groovy source files on the classpath of Jenkins and Jenk (no CVSS, Jenkins project Jenkins Pipeline: Groovy Plugin · org.jenki…)
- [CVE-2022-29332](https://cve.now/CVE-2022-29332.md): D-LINK DIR-825 AC1200 R2 is vulnerable to Directory Traversal. (no CVSS)
- [CVE-2022-30110](https://cve.now/CVE-2022-30110.md): The file preview functionality in Jirafeau \< 4.4.0, which is enabled by default, could be exploited for cross site scripting. (no CVSS, mojo42/jirafeau)
- [CVE-2022-1711](https://cve.now/CVE-2022-1711.md): Server-Side Request Forgery (SSRF) in jgraph/drawio (CVSS 7.5, jgraph/drawio)
- [CVE-2021-42644](https://cve.now/CVE-2021-42644.md): cmseasy V7.7.5\_20211012 is affected by an arbitrary file read vulnerability. (no CVSS)
- [CVE-2021-42643](https://cve.now/CVE-2021-42643.md): cmseasy V7.7.5\_20211012 is affected by an arbitrary file write vulnerability. (no CVSS)
- [CVE-2021-42943](https://cve.now/CVE-2021-42943.md): Stored cross-site scripting (XSS) in admin/usermanager.php over IPPlan v4.92b allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2022-1723](https://cve.now/CVE-2022-1723.md): Server-Side Request Forgery (SSRF) in jgraph/drawio (CVSS 7.5, jgraph/drawio)
- [CVE-2022-26650](https://cve.now/CVE-2022-26650.md): Apache ShenYu (incubating) Regular expression denial of service (no CVSS, Apache Software Foundation Apache ShenYu · org.apache.sh… +1)
- [CVE-2013-10001](https://cve.now/CVE-2013-10001.md): HTC One/Sense Mail Client certificate validation (CVSS 4.8, HTC One · HTC Sense)
- [CVE-2022-1753](https://cve.now/CVE-2022-1753.md): WoWonder Group requests.php access control (CVSS 5.4, WoWonder)
- [CVE-2022-1706](https://cve.now/CVE-2022-1706.md): A vulnerability was found in Ignition where ignition configs are accessible from unprivileged containers in VMs running on VMware products. (no CVSS, coreos/ignition · github.com/coreos/ignition +1)
- [CVE-2022-1733](https://cve.now/CVE-2022-1733.md): Heap-based Buffer Overflow in vim/vim (CVSS 6.6, vim/vim)
- [CVE-2022-1735](https://cve.now/CVE-2022-1735.md): Classic Buffer Overflow in vim/vim (CVSS 6.6, vim/vim)
- [CVE-2022-1769](https://cve.now/CVE-2022-1769.md): Buffer Over-read in vim/vim (CVSS 6.6, vim/vim)
- [CVE-2022-28181](https://cve.now/CVE-2022-28181.md): NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user on the (CVSS 8.5, NVIDIA GPU Display Driver)
- [CVE-2022-28183](https://cve.now/CVE-2022-28183.md): NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user can ca (CVSS 7.7, NVIDIA GPU Display Driver)
- [CVE-2022-28184](https://cve.now/CVE-2022-28184.md): NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, (CVSS 7.1, NVIDIA GPU Display Driver)
- [CVE-2022-28185](https://cve.now/CVE-2022-28185.md): NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the ECC layer, where an unprivileged regular user can cause an o (CVSS 6.8, NVIDIA GPU Display Driver)
- [CVE-2022-29162](https://cve.now/CVE-2022-29162.md): Incorrect Default Permissions in runc (CVSS 5.9, opencontainers runc · github.com/opencontainers/runc)
- [CVE-2022-30007](https://cve.now/CVE-2022-30007.md): GXCMS V1.5 has a file upload vulnerability in the background. (no CVSS)
- [CVE-2022-30067](https://cve.now/CVE-2022-30067.md): GIMP 2.10.30 and 2.99.10 are vulnerable to Buffer Overflow. (no CVSS)
- [CVE-2022-30952](https://cve.now/CVE-2022-30952.md): Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials with (no CVSS, Jenkins project Jenkins Pipeline SCM API for Blue Ocean Plu…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-05-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.