CVEs published May 18, 2022
77 CVEs were published on May 18, 2022: 1 critical, 19 high.
- Published
- 77
- Critical
- 1
- High
- 19
- Medium
- 15
- Low
- 2
- Unrated
- 40
- Now in CISA KEV
- 0
- Fix available
- 33
Most affected products
- Lenovo Personal Cloud Storage A1 · Lenovo Personal Cloud… +3
- 5
- moodle · moodle/moodle
- 5
- Acronis Cyber Protect
- 4
- Inkscape
- 3
- jgraph/drawio
- 3
- TIBCO Software TIBCO BusinessConnect Trading Community Mana…
- 3
- Zoom Video Communications Zoom Client for Meetings for A… +3
- 3
- Lenovo IMController
- 2
- MEIKYO ELECTRIC CO. Rebooter, PoE Rebooter, Scheduler, and…
- 2
- Mitsubishi Electric MELSEC iQ-F series FX5U-xMy/z(x=32,64,8…
- 2
Critical 1
High 19
- CVE-2022-30138Windows Print Spooler Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-1774Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawiojgraph/drawio
- CVE-2022-22778TIBCO BusinessConnect Trading Community Management Cross-Site Request Forgery VulnerabilityTIBCO Software TIBCO BusinessConnect Trading Community Mana…
- CVE-2022-22776TIBCO BusinessConnect Trading Community Management Stored Cross Site Scripting VulnerabilityTIBCO Software TIBCO BusinessConnect Trading Community Mana…
- CVE-2022-0883Windows Unquoted/Trusted Service PathsSnow License Manager
- CVE-2021-42704Inkscape Out-of-bounds WriteInkscape
- CVE-2021-42852A command injection vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an authenticated user to execuLenovo Personal Cloud Storage A1 · Lenovo Personal Cloud… +3
- CVE-2021-42850A weak default administrator password for the web interface and serial port was reported in some Lenovo Personal Cloud Storage devices that Lenovo Personal Cloud Storage A1 · Lenovo Personal Cloud… +3
- CVE-2021-3969A Time of Check Time of Use (TOCTOU) vulnerability was reported in IMController, a software component of Lenovo System Interface Foundation,Lenovo IMController
- CVE-2021-3922A race condition vulnerability was reported in IMController, a software component of Lenovo System Interface Foundation, prior to version 1.Lenovo IMController
- CVE-2022-1767Server-Side Request Forgery (SSRF) in jgraph/drawiojgraph/drawio
- CVE-2022-22786Update package downgrade in Zoom Client for Meetings for WindowsZoom Video Communications Zoom Client for Meetings for Wind…
- CVE-2022-22784Improper XML Parsing in Zoom Client for MeetingsZoom Video Communications Zoom Client for Meetings for A… +3
- CVE-2022-23067ToolJet - Token Leakage via Referer HeaderToolJet
- CVE-2022-1727Improper Input Validation in jgraph/drawiojgraph/drawio
- CVE-2022-1432Cross-site Scripting (XSS) - Generic in octoprint/octoprintoctoprint/octoprint · octoprint
- CVE-2022-1430Cross-site Scripting (XSS) - DOM in octoprint/octoprintoctoprint/octoprint · octoprint
- CVE-2022-1795Use After Free in gpac/gpacgpac/gpac
- CVE-2022-30065A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern
Medium, low and unrated 57
- CVE-2022-29229Missing Cryptographic Step in cassprojectcassproject CASS · cassproject
- CVE-2022-29230Potential cross-site scripting (XSS) vulnerability in HydrogenShopify hydrogen · @shopify/hydrogen
- CVE-2022-30991HTML injection via report nameAcronis Cyber Protect
- CVE-2022-30992Open redirect via user-controlled query parameterAcronis Cyber Protect
- CVE-2022-30993Cleartext transmission of sensitive informationAcronis Cyber Protect
- CVE-2022-30994Cleartext transmission of sensitive informationAcronis Cyber Protect
- CVE-2022-30990Sensitive information disclosure due to insecure folder permissionsAcronis Cyber Protect · Acronis Agent
- CVE-2021-38944IBM DataPower Gateway 10.0.2.0 through 1.0.3.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 is vulnerable to HTTP header iIBM DataPower Gateway
- CVE-2022-30033Tenda TX9 Pro V22.03.02.10 is vulnerable to Buffer Overflow via the functtion setIPv6Status() in httpd module.
- CVE-2022-25617WordPress Code Snippets plugin <= 2.14.3 - Reflected Cross-Site Scripting (XSS) vulnerabilityCode Snippets Pro Code Snippets
- CVE-2022-30600A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed.moodle · moodle/moodle
- CVE-2022-30111Due to the use of an insecure algorithm for rolling codes in MCK Smartlock 1.0, allows attackers to unlock the mechanism via replay attacks.
- CVE-2022-28921A Cross-Site Request Forgery (CSRF) vulnerability discovered in BlogEngine.Net v3.3.8.0 allows unauthenticated attackers to read arbitrary f
- CVE-2022-30599A flaw was found in moodle where an SQL injection risk was identified in Badges code relating to configuring criteria.moodle · moodle/moodle
- CVE-2022-30598A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise hamoodle · moodle/moodle
- CVE-2022-30597A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field.moodle · moodle/moodle
- CVE-2022-22777TIBCO BusinessConnect Trading Community Management Reflected Cross Site Scripting VulnerabilityTIBCO Software TIBCO BusinessConnect Trading Community Mana…
- CVE-2022-30596A flaw was found in moodle where ID numbers displayed when bulk allocating markers to assignments required additional sanitizing to prevent moodle · moodle/moodle
- CVE-2022-29445WordPress Popup Box plugin <= 2.1.2 - Authenticated Local File Inclusion (LFI) vulnerabilityWow-Company Popup Box
- CVE-2022-25162Improper Input Validation vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U-xMy/z(x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serialMitsubishi Electric MELSEC iQ-F series FX5U-xMy/z(x=32,64,8…
- CVE-2022-28924An information disclosure vulnerability in UniverSIS-Students before v1.5.0 allows attackers to obtain sensitive information via a crafted G
- CVE-2022-25161Improper Input Validation vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U-xMy/z(x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serialMitsubishi Electric MELSEC iQ-F series FX5U-xMy/z(x=32,64,8…
- CVE-2022-1734A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use after free both read or write whekernel
- CVE-2021-42702Inkscape Access of Uninitialized PointerInkscape
- CVE-2021-42700Inkscape Out-of-bounds ReadInkscape
- CVE-2022-1110A buffer overflow vulnerability in Lenovo Smart Standby Driver prior to version 4.1.50.0 could allow a local attacker to cause denial of serLenovo Smart Standby Driver
- CVE-2021-42851A vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to create a standard useLenovo Personal Cloud Storage A1 · Lenovo Personal Cloud… +3
- CVE-2021-42849A weak default password for the serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device Lenovo Personal Cloud Storage A1 · Lenovo Personal Cloud… +3
- CVE-2021-42848An information disclosure vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user Lenovo Personal Cloud Storage A1 · Lenovo Personal Cloud… +3
- CVE-2021-3956A read-only authentication bypass vulnerability was reported in the Third Quarter 2021 release of Lenovo XClarity Controller (XCC) firmware Lenovo XClarity Controller
- CVE-2022-22787Insufficient hostname validation during Clusterswitch message in Zoom Client for MeetingsZoom Video Communications Zoom Client for Meetings for A… +3
- CVE-2022-30105In Belkin N300 Firmware 1.00.08, the script located at /setting_hidden.asp, which is accessible before and after configuring the device, exh
- CVE-2022-22785Improperly constrained session cookies in Zoom Client for MeetingsZoom Video Communications Zoom Client for Meetings for A… +3
- CVE-2022-28917Tenda AX12 v22.03.01.21_cn was discovered to contain a stack overflow via the lanIp parameter in /goform/AdvSetLanIp.
- CVE-2021-27548There is a Null Pointer Dereference vulnerability in the XFAScanner::scanNode() function in XFAScanner.cc in xpdf 4.03.
- CVE-2022-29646An access control issue in TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 allows attackers to obtain sensitive informat
- CVE-2022-29645TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a hard coded password for root stored in the
- CVE-2022-29644TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a hard coded password for the telnet service
- CVE-2022-29643TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the macAddress parameter
- CVE-2022-29642TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the url parameter in the
- CVE-2022-29641TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the startTime and endTim
- CVE-2022-29640TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the comment parameter in
- CVE-2022-29638TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the comment parameter in
- CVE-2022-29639TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a command injection vulnerability via the mag
- CVE-2022-28956An issue in the getcfg.php component of D-Link DIR816L_FW206b01 allows attackers to access the device via a crafted payload.
- CVE-2022-28955An access control issue in D-Link DIR816L_FW206b01 allows unauthenticated attackers to access folders folder_view.php and category_view.php.
- CVE-2022-23068ToolJet - HTML Injection in Invite New UserToolJet
- CVE-2021-41946In FiberHome VDSL2 Modem HG150-Ub_V3.0, a stored cross-site scripting (XSS) vulnerability in Parental Control --> Access Time Restriction --
- CVE-2022-29518Screen Creator Advance2, HMI GC-A2 series, and Real time remote monitoring and control tool Screen Creator Advance2 versions prior to Ver.0.KOYO ELECTRONICS INDUSTRIES CO. Screen Creator Advance2, HM…
- CVE-2022-29516The web console of FUJITSU Network IPCOM series (IPCOM EX2 IN(3200, 3500), IPCOM EX2 LB(1100, 3200, 3500), IPCOM EX2 SC(1100, 3200, 3500), IFUJITSU LIMITED IPCOM EX2 series, IPCOM EX series, IPCOM VE…
- CVE-2022-28717Cross-site scripting vulnerability in Rebooter(WATCH BOOT nino RPC-M2C [End of Sale] all firmware versions, WATCH BOOT light RPC-M5C [End ofMEIKYO ELECTRIC CO. Rebooter, PoE Rebooter, Scheduler, and…
- CVE-2022-27632Cross-site request forgery (CSRF) vulnerability in Rebooter(WATCH BOOT nino RPC-M2C [End of Sale] all firmware versions, WATCH BOOT light RPMEIKYO ELECTRIC CO. Rebooter, PoE Rebooter, Scheduler, and…
- CVE-2019-25061The random_password_generator (aka RandomPasswordGenerator) gem through 1.0.0 for Ruby uses Kernel#rand to generate passwords, which, due torandom_password_generator
- CVE-2022-30976GPAC 2.0.0 misuses a certain Unicode utf8_wcslen (renamed gf_utf8_wcslen) function in utils/utf.c, resulting in a heap-based buffer over-rea
- CVE-2022-1771Uncontrolled Recursion in vim/vimvim/vim
- CVE-2022-30974compile in regexp.c in Artifex MuJS through 1.2.0 results in stack consumption because of unlimited recursion, a different issue than CVE-20
- CVE-2022-30975In Artifex MuJS through 1.2.0, jsP_dumpsyntax in jsdump.c has a NULL pointer dereference, as demonstrated by mujs-pp.