CVEs published May 20, 2022
107 CVEs were published on May 20, 2022: 3 critical, 13 high.
- Published
- 107
- Critical
- 3
- High
- 13
- Medium
- 49
- Low
- 4
- Unrated
- 38
- Now in CISA KEV
- 0
- Fix available
- 50
Most affected products
- tensorflow · tensorflow-cpu +1
- 20
- nextcloud security-advisories
- 4
- polonel/trudesk
- 4
- tensorflow · tensorflow-gpu +1
- 4
- gocd
- 3
- argoproj argo-cd · github.com/argoproj/argo-cd +1
- 2
- cilium · github.com/cilium/cilium
- 2
- 2J Slideshow Team Slideshow, Image Slider by
- 1
- Aftab Muni Disable Right Click For WP
- 1
- argoproj argo-cd · github.com/argoproj/argo-cd/v2 +1
- 1
Critical 3
- CVE-2022-29186Use of Hard-coded Cryptographic Key in rundeck/rundeck, rundeckpro/enterpriserundeck
- CVE-2022-1770Improper Privilege Management in polonel/trudeskpolonel/trudesk
- CVE-2022-29165Argo CD will blindly trust JWT claims if anonymous access is enabledargoproj argo-cd · github.com/argoproj/argo-cd/v2 +1
High 13
- CVE-2022-29190Header reconstruction method can be thrown into an infinite loop in Pion DTLSpion dtls · github.com/pion/dtls/v2 +1
- CVE-2022-29216Code injection in `saved_model_cli` in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2022-1775Weak Password Requirements in polonel/trudeskpolonel/trudesk
- CVE-2022-29208Segfault and Out-of-bounds Write write due to incomplete validation in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2022-31258In Checkmk before 1.6.0p29, 2.x before 2.0.0p25, and 2.1.x before 2.1.0b10, a site user can escalate to root by editing an OMD hook symlink.
- CVE-2022-1803Improper Restriction of Rendered UI Layers or Frames in polonel/trudeskpolonel/trudesk
- CVE-2022-24434Denial of Service (DoS)dicer · org.webjars.npm:dicer
- CVE-2022-29184Command Injection/Argument Injection in GoCDgocd
- CVE-2022-29179Improper Privilege Management in Ciliumcilium · github.com/cilium/cilium
- CVE-2022-29178Incorrect Default Permissions in Ciliumcilium · github.com/cilium/cilium
- CVE-2022-1784Server-Side Request Forgery (SSRF) in jgraph/drawiojgraph/drawio
- CVE-2022-1754Integer Overflow or Wraparound in polonel/trudeskpolonel/trudesk
- CVE-2022-29181Improper Handling of Unexpected Data Type in Nokogirisparklemotion nokogiri · nokogiri
Medium, low and unrated 91
- CVE-2022-29189Buffer for inbound DTLS fragments has no limitpion dtls · github.com/pion/dtls +1
- CVE-2022-29188Smokescreen SSRF via deny list bypass (square brackets) in Smokescreenstripe smokescreen · github.com/stripe/smokescreen
- CVE-2022-29214URL Redirection to Untrusted Site ('Open Redirect') in next-authnextauthjs next-auth · next-auth
- CVE-2022-29213Incomplete validation in signal ops leads to crashes in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2022-29210Heap buffer overflow due to incorrect hash function in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2022-29209Type confusion leading to `CHECK`-failure based denial of service in TensorFlowtensorflow · tensorflow-gpu +1
- CVE-2022-29211Segfault in TensorFlow if `tf.histogram_fixed_width` is called with NaN valuestensorflow · tensorflow-cpu +1
- CVE-2022-29212Core dump when loading TFLite models with quantization in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2022-29201Missing validation in `QuantizedConv2D` results in undefined behavior in TensorFlowtensorflow · tensorflow-gpu +1
- CVE-2022-29202Denial of service in TensorFlow due to lack of validation in `tf.ragged.constant`tensorflow · tensorflow-cpu +1
- CVE-2022-29203Integer overflow in `SpaceToBatchND` in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2022-29204Missing validation causes denial of service in TensorFlow via `Conv3DBackpropFilterV2`tensorflow · tensorflow-cpu +1
- CVE-2022-29205Segfault due to missing support for quantized types in TensorFlowtensorflow · tensorflow-gpu +1
- CVE-2022-29206Missing validation results in undefined behavior in `SparseTensorDenseAdd` in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2022-29207Undefined behavior when users supply invalid resource handles in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2022-29195Missing validation causes denial of service in TensorFlow via `StagePeek`tensorflow · tensorflow-cpu +1
- CVE-2022-29197Missing validation causes denial of service in TensorFlow via `UnsortedSegmentJoin`tensorflow · tensorflow-gpu +1
- CVE-2022-29196Missing validation causes denial of service in TensorFlow via `Conv3DBackpropFilterV2`tensorflow · tensorflow-cpu +1
- CVE-2022-29198Missing validation causes denial of service in TensorFlow via `SparseTensorToCSRSparseMatrix`tensorflow · tensorflow-cpu +1
- CVE-2022-29199Missing validation causes denial of service in TensorFlow via `LoadAndRemapMatrix`tensorflow · tensorflow-cpu +1
- CVE-2022-29200Missing validation causes denial of service in TensorFlow via `LSTMBlockCell`tensorflow · tensorflow-cpu +1
- CVE-2022-29193Missing validation causes `TensorSummaryV2` in TensorFlow to crashtensorflow · tensorflow-cpu +1
- CVE-2022-29194Missing validation causes denial of service via `DeleteSessionTensor` in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2022-28618A command injection security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays, HPE Nimble Storage All Flash ArrayHPE Nimble Storage Hybrid Flash Arrays; Nimble Storage All…
- CVE-2022-29191Missing validation causes denial of service via `GetSessionTensor` in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2022-29432WordPress wpDataTables plugin <= 2.1.27 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilitiesTMS-Plugins wpDataTables – Tables & Table Charts
- CVE-2022-29431Remove CPT base <= 5.8 - CSRF leads to CPT base deletionKubiQ Remove CPT base
- CVE-2022-29430WordPress PNG to JPG plugin <= 4.0 - Cross-Site Request Forgery (CSRF) leading to Persistent Cross-Site Scripting (XSS) vulnerabilityKubiQ PNG to JPG
- CVE-2022-29428WordPress WP Slider Plugin <= 1.4.5 - Cross-Site Scripting (XSS) vulnerabilityMuneeb WP Slider Plugin
- CVE-2022-29192Missing validation crashes `QuantizeAndDequantizeV4Grad` in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2022-29434WordPress Spiffy Calendar plugin <= 4.9.0 - Edit/Delete event via IDOR vulnerabilitySpiffy Plugins Spiffy Calendar
- CVE-2022-22972VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain VMware Workspace ONE Access, Identity Manager and vRealize…
- CVE-2022-22973VMware Workspace ONE Access and Identity Manager contain a privilege escalation vulnerability.VMware Workspace ONE Access and Identity Manager.
- CVE-2022-29447WordPress Hover Effects plugin <= 2.1 - Authenticated Local File Inclusion (LFI) vulnerabilityWow-Company Hover Effects – easily create any hover effect
- CVE-2022-29427WordPress Disable Right Click For WP plugin <= 1.1.6 - Cross-Site Request Forgery (CSRF) vulnerabilityAftab Muni Disable Right Click For WP
- CVE-2022-29426WordPress Slideshow, Image Slider by 2J plugin <= 1.3.54 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability2J Slideshow Team Slideshow, Image Slider by
- CVE-2022-21195Regular Expression Denial of Service (ReDoS)url-regex
- CVE-2022-29448WordPress Herd Effects plugin <= 5.2 - Local File Inclusion (LFI) vulnerabilityWow-Company Herd Effects
- CVE-2022-29425WordPress Checkout Files Upload for WooCommerce plugin <= 2.1.2 - Cross-Site Scripting (XSS) vulnerabilityWP Wham Checkout Files Upload for WooCommerce
- CVE-2022-29424WordPress Image Hover Effects Ultimate plugin <= 9.7.1 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilityBiplob Adhikari Image Hover Effects Ultimate
- CVE-2021-36833WordPress MC4WP plugin <= 4.8.6 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityibericode MC4WP: Mailchimp for WordPress
- CVE-2022-29185Observable Timing Discrepancy in totp-rsconstantoine totp-rs · totp-rs
- CVE-2022-29183Reflected XSS in GoCDgocd
- CVE-2022-29182DOM-based XSS in GoCDgocd
- CVE-2022-28995Rengine v1.0.2 was discovered to contain a remote code execution (RCE) vulnerability via the yaml configuration function.
- CVE-2022-28531Sourcecodester Covid-19 Directory on Vaccination System1.0 is vulnerable to SQL Injection via the admin/login.php txtusername (aka Username)
- CVE-2022-28990WASM3 v0.5.0 was discovered to contain a heap overflow via the component /wabt/bin/poc.wasm.pywasm3
- CVE-2022-22365IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0, with the Ajax Proxy Web Application (AjaxProxy.war) deployed, is vulnerable to spooIBM WebSphere Application Server
- CVE-2021-39043IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to stored cross-site scripting.IBM Jazz Team Server
- CVE-2022-29177DoS via malicious p2p message in Go-Ethereumgo-ethereum · github.com/ethereum/go-ethereum
- CVE-2022-29170Grafana Enterprise datasource network restrictions bypass via HTTP redirectsgrafana
- CVE-2022-29163Bypass of password requirements when sharing a folder via the Circles app in Nextcloud Servernextcloud security-advisories
- CVE-2022-29160Sensitive files/data exist after deletion of user account in Nextcloud Androidnextcloud security-advisories
- CVE-2022-24906Error in deleting deck cards attachment reveals the full application path in Nextcloud Decknextcloud security-advisories
- CVE-2022-29159Possibility for anyone to add a stack with existing tasks on anyone's board in Nextcloud Decknextcloud security-advisories
- CVE-2021-30028SOOTEWAY Wi-Fi Range Extender v1.5 was discovered to use default credentials (the admin password for the admin account) to access the TELNET
- CVE-2021-43728Pix-Link MiNi Router 28K.MiniRouter.20190211 was discovered to contain a stored cross-site scripting (XSS) vulnerability due to an unsanitiz
- CVE-2021-43729Pix-Link MiNi Router 28K.MiniRouter.20190211 was discovered to contain a stored cross-site scripting (XSS) vulnerability due to an unsanitiz
- CVE-2022-28660The querier component in Grafana Enterprise Logs 1.1.x through 1.3.x before 1.4.0 does not require authentication when X-Scope-OrgID is used
- CVE-2022-31245mailcow before 2022-05d allows a remote authenticated user to inject OS commands and escalate privileges to domain admin via the --debug opt
- CVE-2022-24905Argo CD login screen allows message spoofing if SSO is enabledargoproj argo-cd · github.com/argoproj/argo-cd +1
- CVE-2022-24904Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-serverargoproj argo-cd · github.com/argoproj/argo-cd +1
- CVE-2022-30886School Dormitory Management System v1.0 was discovered to contain a SQL injection vulnerability via the month parameter at /dms/admin/report
- CVE-2022-30887Pharmacy Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /php_action/editProd
- CVE-2022-30518ChatBot Application with a Suggestion Feature 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /simple_ch
- CVE-2022-29320MiniTool Partition Wizard v12.0 contains an unquoted service path which allows attackers to escalate privileges to the system level.
- CVE-2022-28993Multi Store Inventory Management System v1.0 allows attackers to perform an account takeover via a crafted POST request.
- CVE-2022-28992A Cross-Site Request Forgery (CSRF) in Online Banquet Booking System v1.0 allows attackers to change admin credentials via a crafted POST re
- CVE-2022-28991Multi Store Inventory Management System v1.0 was discovered to contain an information disclosure vulnerability which allows attackers to acc
- CVE-2022-28106Online Sports Complex Booking System v1.0 was discovered to allow attackers to take over user accounts via a crafted POST request.
- CVE-2022-28105Online Sports Complex Booking System v1.0 was discovered to contain a blind SQL injection vulnerability via the id parameter in /scbs/view_f
- CVE-2022-27095BattlEye v0.9 contains an unquoted service path which allows attackers to escalate privileges to the system level.
- CVE-2022-28104Foxit PDF Editor v11.3.1 was discovered to contain an arbitrary file upload vulnerability.
- CVE-2022-27094Sony PlayMemories Home v6.0 contains an unquoted service path which allows attackers to escalate privileges to the system level.
- CVE-2022-26633Simple Student Quarterly Result/Grade System v1.0 was discovered to contain a SQL injection vulnerability via /sqgs/Actions.php.
- CVE-2022-26634HMA VPN v5.3.5913.0 contains an unquoted service path which allows attackers to escalate privileges to the system level.
- CVE-2022-26632Multi-Vendor Online Groceries Management System v1.0 was discovered to contain a blind SQL injection vulnerability via the id parameter in /
- CVE-2022-29022A buffer overflow vulnerability exists in the razeraccessory driver of OpenRazer up to version v3.3.0 allows attackers to cause a Denial of
- CVE-2022-29023A buffer overflow vulnerability exists in the razermouse driver of OpenRazer up to version v3.3.0 allows attackers to cause a Denial of Serv
- CVE-2022-29021A buffer overflow vulnerability exists in the razerkbd driver of OpenRazer up to version v3.3.0 allows attackers to cause a Denial of Servic
- CVE-2022-31215In certain Goverlan products, the Windows Firewall is temporarily turned off upon a Goverlan agent update operation.
- CVE-2022-30551OPC UA Legacy Java Stack 2022-04-01 allows a remote attacker to cause a server to stop processing messages by sending crafted messages that
- CVE-2022-25224Proton v0.2.0 allows an attacker to create a malicious link inside a markdown file.Proton
- CVE-2022-25227Thinfinity VNC v4.0.0.1 contains a Cross-Origin Resource Sharing (CORS) vulnerability which can allow an unprivileged remote attacker, if thThinfinity VNC
- CVE-2022-25229Popcorn Time 0.4.7 has a Stored XSS in the 'Movies API Server(s)' field via the 'settings' page.Popcorn Time
- CVE-2022-1806Cross-site Scripting (XSS) - Reflected in rtxteam/rtxrtxteam/rtx
- CVE-2021-34111Thecus 4800Eco was discovered to contain a command injection vulnerability via the username parameter in /adm/setmain.php.
- CVE-2022-28987Zoho ManageEngine ADSelfService Plus before 6202 allows attackers to perform username enumeration via a crafted POST request to /ServletAPI/
- CVE-2022-28985A stored cross-site scripting (XSS) vulnerability in the addNewPost component of OrangeHRM v4.10.1 allows attackers to execute arbitrary web
- CVE-2022-28965Multiple DLL hijacking vulnerabilities via the components instup.exe and wsc_proxy.exe in Avast Premium Security before v21.11.2500 allows a
- CVE-2022-28964An arbitrary file write vulnerability in Avast Premium Security before v21.11.2500 (build 21.11.6809.528) allows attackers to cause a Denial