# CVEs published 2022-05-19

40 CVEs were published on May 19, 2022: 2 critical, 9 high. Days are UTC.

- [CVE-2022-21500](https://cve.now/CVE-2022-21500.md): Vulnerability in Oracle E-Business Suite (component: Manage Proxies). (CVSS 7.5, Oracle User Management)
- [CVE-2020-4107](https://cve.now/CVE-2020-4107.md): HCL Domino is affected by an Insufficient Access Control vulnerability (CVSS 8.8, HCL Software HCL Domino)
- [CVE-2022-29652](https://cve.now/CVE-2022-29652.md): Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/classes/Users.php?f=save\_client. (no CVSS)
- [CVE-2022-29304](https://cve.now/CVE-2022-29304.md): Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /classes/master.php?f=delete\_ Facility. (no CVSS)
- [CVE-2022-28962](https://cve.now/CVE-2022-28962.md): Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/classes/Users.php?f=delete\_client. (no CVSS)
- [CVE-2022-28961](https://cve.now/CVE-2022-28961.md): Spip Web Framework v3.1.13 and below was discovered to contain multiple SQL injection vulnerabilities at /ecrire via the lier\_trad and where (no CVSS)
- [CVE-2022-28960](https://cve.now/CVE-2022-28960.md): A PHP injection vulnerability in Spip before v3.2.8 allows attackers to execute arbitrary PHP code via the \_oups parameter at /ecrire. (no CVSS)
- [CVE-2022-28959](https://cve.now/CVE-2022-28959.md): Multiple cross-site scripting (XSS) vulnerabilities in the component /spip.php of Spip Web Framework v3.1.13 and below allows attackers to e (no CVSS)
- [CVE-2022-28948](https://cve.now/CVE-2022-28948.md): An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input. (no CVSS, gopkg.in/yaml.v3)
- [CVE-2022-28946](https://cve.now/CVE-2022-28946.md): An issue in the component ast/parser.go of Open Policy Agent v0.39.0 causes the application to incorrectly interpret every expression, causi (no CVSS, github.com/open-policy-agent/opa)
- [CVE-2020-14496](https://cve.now/CVE-2020-14496.md): Mitsubishi Electric Multiple Factory Automation Engineering Software Products (Update A) - Permission Issues (CVSS 8.3, Mitsubishi Electric CPU Module Logging Configuration To… +30)
- [CVE-2020-16235](https://cve.now/CVE-2020-16235.md): Emerson OpenEnterprise - Inadequate Encryption Strength (CVSS 3.8, Emerson Open Enterprise)
- [CVE-2020-16231](https://cve.now/CVE-2020-16231.md): All Bachmann M1 System Processor Modules - Use of Password Hash with Insufficient Computational Effort (CVSS 7.2, Bachmann Electronic M1 Hardware Controller MX207 · Bach… +18)
- [CVE-2021-32934](https://cve.now/CVE-2021-32934.md): ThroughTek P2P SDK - Cleartext Transmission of Sensitive Information (CVSS 9.1, ThroughTek P2P SDK)
- [CVE-2020-16209](https://cve.now/CVE-2020-16209.md): Fieldcomm Group HART-IP and hipserver - Stack-based Buffer Overflow (CVSS 9.8, Fieldcomm Group HART-IP Developer Kit · Fieldcomm Group hip…)
- [CVE-2022-1423](https://cve.now/CVE-2022-1423.md): Improper access control in the CI/CD cache mechanism in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions (CVSS 7.1, GitLab)
- [CVE-2022-1413](https://cve.now/CVE-2022-1413.md): Missing input masking in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and (CVSS 5.4, GitLab)
- [CVE-2022-1416](https://cve.now/CVE-2022-1416.md): Missing sanitization of data in Pipeline error messages in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versio (CVSS 4.3, GitLab)
- [CVE-2022-30618](https://cve.now/CVE-2022-30618.md): An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, fo (no CVSS, Strapi · @strapi/strapi)
- [CVE-2022-30617](https://cve.now/CVE-2022-30617.md): An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, fo (no CVSS, Strapi · @strapi/strapi)
- [CVE-2020-4970](https://cve.now/CVE-2020-4970.md): IBM Security Identity Governance and Intelligence 5.2.4, 5.2.5, and 5.2.6 could allow a remote attacker to obtain sensitive information, cau (CVSS 5.3, IBM Security Identity Governance and Intelligence)
- [CVE-2022-28927](https://cve.now/CVE-2022-28927.md): A remote code execution (RCE) vulnerability in Subconverter v0.7.2 allows attackers to execute arbitrary code via crafted config and url par (no CVSS)
- [CVE-2022-29449](https://cve.now/CVE-2022-29449.md): WordPress Opal Hotel Room Booking plugin \<= 1.2.7 - Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.1, wpopal Opal Hotel Room Booking)
- [CVE-2022-29446](https://cve.now/CVE-2022-29446.md): WordPress Counter Box plugin \<= 1.1.1 - Authenticated Local File Inclusion (LFI) vulnerability (CVSS 6.8, Wow-Company Counter Box)
- [CVE-2021-37413](https://cve.now/CVE-2021-37413.md): GRANDCOM DynWEB before 4.2 contains a SQL Injection vulnerability in the admin login interface. (no CVSS)
- [CVE-2021-26631](https://cve.now/CVE-2021-26631.md): Mangboard parameter modulation vulnerability (CVSS 8.0, Hometory Co. Mangboard commerce package)
- [CVE-2021-26630](https://cve.now/CVE-2021-26630.md): HANDY Groupware file download and execute vulnerability (CVSS 7.8, Handysoft Co. HANDY Groupware)
- [CVE-2022-22976](https://cve.now/CVE-2022-22976.md): Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerabil (no CVSS, Spring Security · org.springframework.security:spring-secur…)
- [CVE-2021-45730](https://cve.now/CVE-2021-45730.md): JFrog Artifactory prior to 7.31.10, is vulnerable to Broken Access Control where a Project Admin is able to create, edit and delete Reposito (CVSS 6.0, JFrog Artifactory)
- [CVE-2021-41938](https://cve.now/CVE-2021-41938.md): An issue was discovered in ShopXO CMS 2.2.0. (no CVSS, shopxo/shopxo)
- [CVE-2022-1730](https://cve.now/CVE-2022-1730.md): Cross-site Scripting (XSS) - Stored in jgraph/drawio (CVSS 6.3, jgraph/drawio)
- [CVE-2022-30018](https://cve.now/CVE-2022-30018.md): Mobotix Control Center (MxCC) through 2.5.4.5 has Insufficiently Protected Credentials, Storing Passwords in a Recoverable Format via the Mx (no CVSS)
- [CVE-2022-1183](https://cve.now/CVE-2022-1183.md): Destroying a TLS session early causes assertion failure (CVSS 7.5, ISC BIND9)
- [CVE-2022-1670](https://cve.now/CVE-2022-1670.md): When generating a user invitation code in Octopus Server, the validity of this code can be set for a specific number of users. (no CVSS, Octopus Deploy Octopus Server)
- [CVE-2022-28349](https://cve.now/CVE-2022-28349.md): Arm Mali GPU Kernel Driver has a use-after-free: Midgard r28p0 through r29p0 before r30p0, Bifrost r17p0 through r23p0 before r24p0, and Val (no CVSS)
- [CVE-2022-28350](https://cve.now/CVE-2022-28350.md): Arm Mali GPU Kernel Driver allows improper GPU operations in Valhall r29p0 through r36p0 before r37p0 to reach a use-after-free situation. (no CVSS)
- [CVE-2022-28348](https://cve.now/CVE-2022-28348.md): Arm Mali GPU Kernel Driver (Midgard r4p0 through r31p0, Bifrost r0p0 through r36p0 before r37p0, and Valhall r19p0 through r36p0 before r37p (no CVSS)
- [CVE-2022-1785](https://cve.now/CVE-2022-1785.md): Out-of-bounds Write in vim/vim (CVSS 7.3, vim/vim)
- [CVE-2022-1796](https://cve.now/CVE-2022-1796.md): Use After Free in vim/vim (CVSS 6.6, vim/vim)
- [CVE-2022-22978](https://cve.now/CVE-2022-22978.md): In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigure (no CVSS, Spring Security · org.springframework.security:spring-se… +1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-05-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.