# CVEs published 2022-05-18

77 CVEs were published on May 18, 2022: 1 critical, 19 high. Days are UTC.

- [CVE-2022-30138](https://cve.now/CVE-2022-30138.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2022-29229](https://cve.now/CVE-2022-29229.md): Missing Cryptographic Step in cassproject (CVSS 6.3, cassproject CASS · cassproject)
- [CVE-2022-1774](https://cve.now/CVE-2022-1774.md): Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawio (CVSS 8.2, jgraph/drawio)
- [CVE-2022-29230](https://cve.now/CVE-2022-29230.md): Potential cross-site scripting (XSS) vulnerability in Hydrogen (CVSS 6.3, Shopify hydrogen · @shopify/hydrogen)
- [CVE-2022-30991](https://cve.now/CVE-2022-30991.md): HTML injection via report name (no CVSS, Acronis Cyber Protect)
- [CVE-2022-30992](https://cve.now/CVE-2022-30992.md): Open redirect via user-controlled query parameter (no CVSS, Acronis Cyber Protect)
- [CVE-2022-30993](https://cve.now/CVE-2022-30993.md): Cleartext transmission of sensitive information (no CVSS, Acronis Cyber Protect)
- [CVE-2022-30994](https://cve.now/CVE-2022-30994.md): Cleartext transmission of sensitive information (no CVSS, Acronis Cyber Protect)
- [CVE-2022-30990](https://cve.now/CVE-2022-30990.md): Sensitive information disclosure due to insecure folder permissions (no CVSS, Acronis Cyber Protect · Acronis Agent)
- [CVE-2021-38944](https://cve.now/CVE-2021-38944.md): IBM DataPower Gateway 10.0.2.0 through 1.0.3.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 is vulnerable to HTTP header i (CVSS 4.8, IBM DataPower Gateway)
- [CVE-2022-30033](https://cve.now/CVE-2022-30033.md): Tenda TX9 Pro V22.03.02.10 is vulnerable to Buffer Overflow via the functtion setIPv6Status() in httpd module. (no CVSS)
- [CVE-2022-25617](https://cve.now/CVE-2022-25617.md): WordPress Code Snippets plugin \<= 2.14.3 - Reflected Cross-Site Scripting (XSS) vulnerability (CVSS 4.7, Code Snippets Pro Code Snippets)
- [CVE-2022-30600](https://cve.now/CVE-2022-30600.md): A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed. (no CVSS, moodle · moodle/moodle)
- [CVE-2022-30111](https://cve.now/CVE-2022-30111.md): Due to the use of an insecure algorithm for rolling codes in MCK Smartlock 1.0, allows attackers to unlock the mechanism via replay attacks. (no CVSS)
- [CVE-2022-28921](https://cve.now/CVE-2022-28921.md): A Cross-Site Request Forgery (CSRF) vulnerability discovered in BlogEngine.Net v3.3.8.0 allows unauthenticated attackers to read arbitrary f (no CVSS)
- [CVE-2022-30599](https://cve.now/CVE-2022-30599.md): A flaw was found in moodle where an SQL injection risk was identified in Badges code relating to configuring criteria. (no CVSS, moodle · moodle/moodle)
- [CVE-2022-30598](https://cve.now/CVE-2022-30598.md): A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise ha (no CVSS, moodle · moodle/moodle)
- [CVE-2022-30597](https://cve.now/CVE-2022-30597.md): A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field. (no CVSS, moodle · moodle/moodle)
- [CVE-2022-22778](https://cve.now/CVE-2022-22778.md): TIBCO BusinessConnect Trading Community Management Cross-Site Request Forgery Vulnerability (CVSS 8.8, TIBCO Software TIBCO BusinessConnect Trading Community Mana…)
- [CVE-2022-22777](https://cve.now/CVE-2022-22777.md): TIBCO BusinessConnect Trading Community Management Reflected Cross Site Scripting Vulnerability (CVSS 6.1, TIBCO Software TIBCO BusinessConnect Trading Community Mana…)
- [CVE-2022-22776](https://cve.now/CVE-2022-22776.md): TIBCO BusinessConnect Trading Community Management Stored Cross Site Scripting Vulnerability (CVSS 8.0, TIBCO Software TIBCO BusinessConnect Trading Community Mana…)
- [CVE-2022-30596](https://cve.now/CVE-2022-30596.md): A flaw was found in moodle where ID numbers displayed when bulk allocating markers to assignments required additional sanitizing to prevent (no CVSS, moodle · moodle/moodle)
- [CVE-2022-29445](https://cve.now/CVE-2022-29445.md): WordPress Popup Box plugin \<= 2.1.2 - Authenticated Local File Inclusion (LFI) vulnerability (CVSS 6.8, Wow-Company Popup Box)
- [CVE-2022-0883](https://cve.now/CVE-2022-0883.md): Windows Unquoted/Trusted Service Paths (CVSS 7.3, Snow License Manager)
- [CVE-2022-25162](https://cve.now/CVE-2022-25162.md): Improper Input Validation vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U-xMy/z(x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serial (no CVSS, Mitsubishi Electric MELSEC iQ-F series FX5U-xMy/z(x=32,64,8…)
- [CVE-2022-28924](https://cve.now/CVE-2022-28924.md): An information disclosure vulnerability in UniverSIS-Students before v1.5.0 allows attackers to obtain sensitive information via a crafted G (no CVSS)
- [CVE-2022-25161](https://cve.now/CVE-2022-25161.md): Improper Input Validation vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U-xMy/z(x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serial (no CVSS, Mitsubishi Electric MELSEC iQ-F series FX5U-xMy/z(x=32,64,8…)
- [CVE-2022-1734](https://cve.now/CVE-2022-1734.md): A flaw in Linux Kernel found in nfcmrvl\_nci\_unregister\_dev() in drivers/nfc/nfcmrvl/main.c can lead to use after free both read or write whe (no CVSS, kernel)
- [CVE-2021-42704](https://cve.now/CVE-2021-42704.md): Inkscape Out-of-bounds Write (CVSS 7.8, Inkscape)
- [CVE-2021-42702](https://cve.now/CVE-2021-42702.md): Inkscape Access of Uninitialized Pointer (CVSS 3.3, Inkscape)
- [CVE-2021-42700](https://cve.now/CVE-2021-42700.md): Inkscape Out-of-bounds Read (CVSS 3.3, Inkscape)
- [CVE-2022-1110](https://cve.now/CVE-2022-1110.md): A buffer overflow vulnerability in Lenovo Smart Standby Driver prior to version 4.1.50.0 could allow a local attacker to cause denial of ser (CVSS 5.5, Lenovo Smart Standby Driver)
- [CVE-2021-42852](https://cve.now/CVE-2021-42852.md): A command injection vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an authenticated user to execu (CVSS 8.0, Lenovo Personal Cloud Storage A1 · Lenovo Personal Cloud… +3)
- [CVE-2021-42851](https://cve.now/CVE-2021-42851.md): A vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to create a standard use (CVSS 6.3, Lenovo Personal Cloud Storage A1 · Lenovo Personal Cloud… +3)
- [CVE-2021-42850](https://cve.now/CVE-2021-42850.md): A weak default administrator password for the web interface and serial port was reported in some Lenovo Personal Cloud Storage devices that (CVSS 8.8, Lenovo Personal Cloud Storage A1 · Lenovo Personal Cloud… +3)
- [CVE-2021-42849](https://cve.now/CVE-2021-42849.md): A weak default password for the serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device (CVSS 6.8, Lenovo Personal Cloud Storage A1 · Lenovo Personal Cloud… +3)
- [CVE-2021-42848](https://cve.now/CVE-2021-42848.md): An information disclosure vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user (CVSS 4.3, Lenovo Personal Cloud Storage A1 · Lenovo Personal Cloud… +3)
- [CVE-2021-3969](https://cve.now/CVE-2021-3969.md): A Time of Check Time of Use (TOCTOU) vulnerability was reported in IMController, a software component of Lenovo System Interface Foundation, (CVSS 7.8, Lenovo IMController)
- [CVE-2021-3956](https://cve.now/CVE-2021-3956.md): A read-only authentication bypass vulnerability was reported in the Third Quarter 2021 release of Lenovo XClarity Controller (XCC) firmware (CVSS 4.3, Lenovo XClarity Controller)
- [CVE-2021-3922](https://cve.now/CVE-2021-3922.md): A race condition vulnerability was reported in IMController, a software component of Lenovo System Interface Foundation, prior to version 1. (CVSS 7.8, Lenovo IMController)
- [CVE-2022-22787](https://cve.now/CVE-2022-22787.md): Insufficient hostname validation during Clusterswitch message in Zoom Client for Meetings (CVSS 5.9, Zoom Video Communications Zoom Client for Meetings for A… +3)
- [CVE-2022-30105](https://cve.now/CVE-2022-30105.md): In Belkin N300 Firmware 1.00.08, the script located at /setting\_hidden.asp, which is accessible before and after configuring the device, exh (no CVSS)
- [CVE-2022-1767](https://cve.now/CVE-2022-1767.md): Server-Side Request Forgery (SSRF) in jgraph/drawio (CVSS 7.5, jgraph/drawio)
- [CVE-2022-22786](https://cve.now/CVE-2022-22786.md): Update package downgrade in Zoom Client for Meetings for Windows (CVSS 7.5, Zoom Video Communications Zoom Client for Meetings for Wind…)
- [CVE-2022-22785](https://cve.now/CVE-2022-22785.md): Improperly constrained session cookies in Zoom Client for Meetings (CVSS 5.9, Zoom Video Communications Zoom Client for Meetings for A… +3)
- [CVE-2022-22784](https://cve.now/CVE-2022-22784.md): Improper XML Parsing in Zoom Client for Meetings (CVSS 8.1, Zoom Video Communications Zoom Client for Meetings for A… +3)
- [CVE-2022-28917](https://cve.now/CVE-2022-28917.md): Tenda AX12 v22.03.01.21\_cn was discovered to contain a stack overflow via the lanIp parameter in /goform/AdvSetLanIp. (no CVSS)
- [CVE-2021-27548](https://cve.now/CVE-2021-27548.md): There is a Null Pointer Dereference vulnerability in the XFAScanner::scanNode() function in XFAScanner.cc in xpdf 4.03. (no CVSS)
- [CVE-2022-29646](https://cve.now/CVE-2022-29646.md): An access control issue in TOTOLINK A3100R V4.1.2cu.5050\_B20200504 and V4.1.2cu.5247\_B20211129 allows attackers to obtain sensitive informat (no CVSS)
- [CVE-2022-29645](https://cve.now/CVE-2022-29645.md): TOTOLINK A3100R V4.1.2cu.5050\_B20200504 and V4.1.2cu.5247\_B20211129 were discovered to contain a hard coded password for root stored in the (no CVSS)
- [CVE-2022-29644](https://cve.now/CVE-2022-29644.md): TOTOLINK A3100R V4.1.2cu.5050\_B20200504 and V4.1.2cu.5247\_B20211129 were discovered to contain a hard coded password for the telnet service (no CVSS)
- [CVE-2022-29643](https://cve.now/CVE-2022-29643.md): TOTOLINK A3100R V4.1.2cu.5050\_B20200504 and V4.1.2cu.5247\_B20211129 were discovered to contain a stack overflow via the macAddress parameter (no CVSS)
- [CVE-2022-29642](https://cve.now/CVE-2022-29642.md): TOTOLINK A3100R V4.1.2cu.5050\_B20200504 and V4.1.2cu.5247\_B20211129 were discovered to contain a stack overflow via the url parameter in the (no CVSS)
- [CVE-2022-29641](https://cve.now/CVE-2022-29641.md): TOTOLINK A3100R V4.1.2cu.5050\_B20200504 and V4.1.2cu.5247\_B20211129 were discovered to contain a stack overflow via the startTime and endTim (no CVSS)
- [CVE-2022-29640](https://cve.now/CVE-2022-29640.md): TOTOLINK A3100R V4.1.2cu.5050\_B20200504 and V4.1.2cu.5247\_B20211129 were discovered to contain a stack overflow via the comment parameter in (no CVSS)
- [CVE-2022-29638](https://cve.now/CVE-2022-29638.md): TOTOLINK A3100R V4.1.2cu.5050\_B20200504 and V4.1.2cu.5247\_B20211129 were discovered to contain a stack overflow via the comment parameter in (no CVSS)
- [CVE-2022-29639](https://cve.now/CVE-2022-29639.md): TOTOLINK A3100R V4.1.2cu.5050\_B20200504 and V4.1.2cu.5247\_B20211129 were discovered to contain a command injection vulnerability via the mag (no CVSS)
- [CVE-2022-28956](https://cve.now/CVE-2022-28956.md): An issue in the getcfg.php component of D-Link DIR816L\_FW206b01 allows attackers to access the device via a crafted payload. (no CVSS)
- [CVE-2022-28955](https://cve.now/CVE-2022-28955.md): An access control issue in D-Link DIR816L\_FW206b01 allows unauthenticated attackers to access folders folder\_view.php and category\_view.php. (no CVSS)
- [CVE-2022-23068](https://cve.now/CVE-2022-23068.md): ToolJet - HTML Injection in Invite New User (CVSS 5.4, ToolJet)
- [CVE-2022-23067](https://cve.now/CVE-2022-23067.md): ToolJet - Token Leakage via Referer Header (CVSS 8.8, ToolJet)
- [CVE-2022-1727](https://cve.now/CVE-2022-1727.md): Improper Input Validation in jgraph/drawio (CVSS 8.3, jgraph/drawio)
- [CVE-2022-1432](https://cve.now/CVE-2022-1432.md): Cross-site Scripting (XSS) - Generic in octoprint/octoprint (CVSS 7.5, octoprint/octoprint · octoprint)
- [CVE-2021-41946](https://cve.now/CVE-2021-41946.md): In FiberHome VDSL2 Modem HG150-Ub\_V3.0, a stored cross-site scripting (XSS) vulnerability in Parental Control --\> Access Time Restriction -- (no CVSS)
- [CVE-2022-1430](https://cve.now/CVE-2022-1430.md): Cross-site Scripting (XSS) - DOM in octoprint/octoprint (CVSS 7.5, octoprint/octoprint · octoprint)
- [CVE-2022-29518](https://cve.now/CVE-2022-29518.md): Screen Creator Advance2, HMI GC-A2 series, and Real time remote monitoring and control tool Screen Creator Advance2 versions prior to Ver.0. (no CVSS, KOYO ELECTRONICS INDUSTRIES CO. Screen Creator Advance2, HM…)
- [CVE-2022-29516](https://cve.now/CVE-2022-29516.md): The web console of FUJITSU Network IPCOM series (IPCOM EX2 IN(3200, 3500), IPCOM EX2 LB(1100, 3200, 3500), IPCOM EX2 SC(1100, 3200, 3500), I (no CVSS, FUJITSU LIMITED IPCOM EX2 series, IPCOM EX series, IPCOM VE…)
- [CVE-2022-28717](https://cve.now/CVE-2022-28717.md): Cross-site scripting vulnerability in Rebooter(WATCH BOOT nino RPC-M2C \[End of Sale\] all firmware versions, WATCH BOOT light RPC-M5C \[End of (no CVSS, MEIKYO ELECTRIC CO. Rebooter, PoE Rebooter, Scheduler, and…)
- [CVE-2022-27632](https://cve.now/CVE-2022-27632.md): Cross-site request forgery (CSRF) vulnerability in Rebooter(WATCH BOOT nino RPC-M2C \[End of Sale\] all firmware versions, WATCH BOOT light RP (no CVSS, MEIKYO ELECTRIC CO. Rebooter, PoE Rebooter, Scheduler, and…)
- [CVE-2022-1782](https://cve.now/CVE-2022-1782.md): Cross-site Scripting (XSS) - Generic in erudika/para (CVSS 9.4, erudika/para · com.erudika:para-core)
- [CVE-2019-25061](https://cve.now/CVE-2019-25061.md): The random\_password\_generator (aka RandomPasswordGenerator) gem through 1.0.0 for Ruby uses Kernel#rand to generate passwords, which, due to (no CVSS, random\_password\_generator)
- [CVE-2022-30976](https://cve.now/CVE-2022-30976.md): GPAC 2.0.0 misuses a certain Unicode utf8\_wcslen (renamed gf\_utf8\_wcslen) function in utils/utf.c, resulting in a heap-based buffer over-rea (no CVSS)
- [CVE-2022-1771](https://cve.now/CVE-2022-1771.md): Uncontrolled Recursion in vim/vim (CVSS 5.5, vim/vim)
- [CVE-2022-1795](https://cve.now/CVE-2022-1795.md): Use After Free in gpac/gpac (CVSS 7.3, gpac/gpac)
- [CVE-2022-30065](https://cve.now/CVE-2022-30065.md): A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern (CVSS 7.8)
- [CVE-2022-30974](https://cve.now/CVE-2022-30974.md): compile in regexp.c in Artifex MuJS through 1.2.0 results in stack consumption because of unlimited recursion, a different issue than CVE-20 (no CVSS)
- [CVE-2022-30975](https://cve.now/CVE-2022-30975.md): In Artifex MuJS through 1.2.0, jsP\_dumpsyntax in jsdump.c has a NULL pointer dereference, as demonstrated by mujs-pp. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-05-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.