CVEs published May 19, 2022
40 CVEs were published on May 19, 2022: 2 critical, 9 high.
- Published
- 40
- Critical
- 2
- High
- 9
- Medium
- 8
- Low
- 1
- Unrated
- 20
- Now in CISA KEV
- 0
- Fix available
- 14
Most affected products
- GitLab
- 3
- Strapi · @strapi/strapi
- 2
- vim/vim
- 2
- Bachmann Electronic M1 Hardware Controller MX207 · Bach… +18
- 1
- Emerson Open Enterprise
- 1
- Fieldcomm Group HART-IP Developer Kit · Fieldcomm Group hip…
- 1
- github.com/open-policy-agent/opa
- 1
- gopkg.in/yaml.v3
- 1
- Handysoft Co. HANDY Groupware
- 1
- HCL Software HCL Domino
- 1
Critical 2
High 9
- CVE-2022-21500Vulnerability in Oracle E-Business Suite (component: Manage Proxies).Oracle User Management
- CVE-2020-4107HCL Domino is affected by an Insufficient Access Control vulnerabilityHCL Software HCL Domino
- CVE-2020-14496Mitsubishi Electric Multiple Factory Automation Engineering Software Products (Update A) - Permission IssuesMitsubishi Electric CPU Module Logging Configuration To… +30
- CVE-2020-16231All Bachmann M1 System Processor Modules - Use of Password Hash with Insufficient Computational EffortBachmann Electronic M1 Hardware Controller MX207 · Bach… +18
- CVE-2022-1423Improper access control in the CI/CD cache mechanism in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions GitLab
- CVE-2021-26631Mangboard parameter modulation vulnerabilityHometory Co. Mangboard commerce package
- CVE-2021-26630HANDY Groupware file download and execute vulnerabilityHandysoft Co. HANDY Groupware
- CVE-2022-1183Destroying a TLS session early causes assertion failureISC BIND9
- CVE-2022-1785Out-of-bounds Write in vim/vimvim/vim
Medium, low and unrated 29
- CVE-2022-29652Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/classes/Users.php?f=save_client.
- CVE-2022-29304Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /classes/master.php?f=delete_ Facility.
- CVE-2022-28962Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/classes/Users.php?f=delete_client.
- CVE-2022-28961Spip Web Framework v3.1.13 and below was discovered to contain multiple SQL injection vulnerabilities at /ecrire via the lier_trad and where
- CVE-2022-28960A PHP injection vulnerability in Spip before v3.2.8 allows attackers to execute arbitrary PHP code via the _oups parameter at /ecrire.
- CVE-2022-28959Multiple cross-site scripting (XSS) vulnerabilities in the component /spip.php of Spip Web Framework v3.1.13 and below allows attackers to e
- CVE-2022-28948An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input.gopkg.in/yaml.v3
- CVE-2022-28946An issue in the component ast/parser.go of Open Policy Agent v0.39.0 causes the application to incorrectly interpret every expression, causigithub.com/open-policy-agent/opa
- CVE-2020-16235Emerson OpenEnterprise - Inadequate Encryption StrengthEmerson Open Enterprise
- CVE-2022-1413Missing input masking in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and GitLab
- CVE-2022-1416Missing sanitization of data in Pipeline error messages in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versioGitLab
- CVE-2022-30618An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, foStrapi · @strapi/strapi
- CVE-2022-30617An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, foStrapi · @strapi/strapi
- CVE-2020-4970IBM Security Identity Governance and Intelligence 5.2.4, 5.2.5, and 5.2.6 could allow a remote attacker to obtain sensitive information, cauIBM Security Identity Governance and Intelligence
- CVE-2022-28927A remote code execution (RCE) vulnerability in Subconverter v0.7.2 allows attackers to execute arbitrary code via crafted config and url par
- CVE-2022-29449WordPress Opal Hotel Room Booking plugin <= 1.2.7 - Stored Cross-Site Scripting (XSS) vulnerabilitywpopal Opal Hotel Room Booking
- CVE-2022-29446WordPress Counter Box plugin <= 1.1.1 - Authenticated Local File Inclusion (LFI) vulnerabilityWow-Company Counter Box
- CVE-2021-37413GRANDCOM DynWEB before 4.2 contains a SQL Injection vulnerability in the admin login interface.
- CVE-2022-22976Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerabilSpring Security · org.springframework.security:spring-secur…
- CVE-2021-45730JFrog Artifactory prior to 7.31.10, is vulnerable to Broken Access Control where a Project Admin is able to create, edit and delete RepositoJFrog Artifactory
- CVE-2021-41938An issue was discovered in ShopXO CMS 2.2.0.shopxo/shopxo
- CVE-2022-1730Cross-site Scripting (XSS) - Stored in jgraph/drawiojgraph/drawio
- CVE-2022-30018Mobotix Control Center (MxCC) through 2.5.4.5 has Insufficiently Protected Credentials, Storing Passwords in a Recoverable Format via the Mx
- CVE-2022-1670When generating a user invitation code in Octopus Server, the validity of this code can be set for a specific number of users.Octopus Deploy Octopus Server
- CVE-2022-28349Arm Mali GPU Kernel Driver has a use-after-free: Midgard r28p0 through r29p0 before r30p0, Bifrost r17p0 through r23p0 before r24p0, and Val
- CVE-2022-28350Arm Mali GPU Kernel Driver allows improper GPU operations in Valhall r29p0 through r36p0 before r37p0 to reach a use-after-free situation.
- CVE-2022-28348Arm Mali GPU Kernel Driver (Midgard r4p0 through r31p0, Bifrost r0p0 through r36p0 before r37p0, and Valhall r19p0 through r36p0 before r37p
- CVE-2022-1796Use After Free in vim/vimvim/vim
- CVE-2022-22978In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigureSpring Security · org.springframework.security:spring-se… +1