CVEs published May 23, 2022
47 CVEs were published on May 23, 2022: 3 critical, 5 high.
- Published
- 47
- Critical
- 3
- High
- 5
- Medium
- 5
- Low
- 2
- Unrated
- 32
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- publify/publify · publify_core
- 2
- Annke N48PBB
- 1
- Apache Software Foundation Apache Maven · org.apache.maven.…
- 1
- AVEVA InTouch Access Anywhere · AVEVA Plant SCADA Access An…
- 1
- Badminton Center Management System
- 1
- Check & Log Email
- 1
- Claroty Secure Remote Access (SRA) Site
- 1
- Cognex In-Sight OPC Server
- 1
- collectiveaccess/providence
- 1
- com.xuxueli:xxl-job
- 1
Critical 3
- CVE-2021-32941Annke Network Video Recorder - Stack-based Buffer OverflowAnnke N48PBB
- CVE-2022-1811Unrestricted Upload of File with Dangerous Type in publify/publifypublify/publify · publify_core
- CVE-2022-1810Authorization Bypass Through User-Controlled Key in publify/publifypublify/publify · publify_core
High 5
- CVE-2022-1467AVEVA InTouch Access Anywhere Exposure of Resource to Wrong SphereAVEVA InTouch Access Anywhere · AVEVA Plant SCADA Access An…
- CVE-2021-32935Cognex In-Sight OPC Server - Deserialization of Untrusted DataCognex In-Sight OPC Server
- CVE-2022-31466TOCTOU Vulnerability in Quick Heal Total Security
- CVE-2022-31467DLL Hijacking Vulnerability in Quick Heal Total Security
- CVE-2021-41714In Tipask < 3.5.9, path parameters entered by the user are not validated when downloading attachments, a registered user can download arbitr
Medium, low and unrated 39
- CVE-2022-29002A Cross-Site Request Forgery (CSRF) in XXL-Job v2.3.0 allows attackers to arbitrarily create administrator accounts via the component /gaia-com.xuxueli:xxl-job
- CVE-2022-30015In Simple Food Website 1.0, a moderation can put the Cross Site Scripting Payload in any of the fields on http://127.0.0.1:1234/food/admin/a
- CVE-2022-29376Xampp for Windows v8.1.4 and below was discovered to contain insecure permissions for its install directory, allowing attackers to execute a
- CVE-2022-28999Insecure permissions in the install directories and binaries of Dev-CPP v4.9.9.2 allows attackers to execute arbitrary code via overwriting
- CVE-2022-31487Inout Blockchain AltExchanger 1.2.1 and Inout Blockchain FiatExchanger 2.2.1 allow Chart/TradingView/chart_content/master.php symbol SQL inj
- CVE-2022-31488Inout Blockchain AltExchanger 1.2.1 allows index.php/coins/update_marketboxslider marketcurrency SQL injection.
- CVE-2022-31489Inout Blockchain AltExchanger 1.2.1 allows index.php/home/about inoutio_language cookie SQL injection.
- CVE-2021-32958Claroty Secure Remote Access Site - Authentication Bypass Using an Alternate Path or ChannelClaroty Secure Remote Access (SRA) Site
- CVE-2021-42233The Simple Blog plugin in Wondercms 3.4.1 is vulnerable to stored cross-site scripting (XSS) vulnerability.
- CVE-2022-28944Certain EMCO Software products are affected by: CWE-494: Download of Code Without Integrity Check.
- CVE-2022-30016Rescue Dispatch Management System 1.0 is vulnerable to Incorrect Access Control via http://localhost/rdms/admin/?page=system_info.
- CVE-2022-30017Rescue Dispatch Management System 1.0 suffers from Stored XSS, leading to admin account takeover via cookie stealing.
- CVE-2022-28932D-Link DSL-G2452DG HW:T1\\tFW:ME_2.00 was discovered to contain insecure permissions.
- CVE-2022-30014Lumidek Associates Simple Food Website 1.0 is vulnerable to Cross Site Request Forgery (CSRF) which allows anyone to takeover admin/moderate
- CVE-2022-29004Diary Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name parameter in search-result.ph
- CVE-2022-29005Multiple cross-site scripting (XSS) vulnerabilities in the component /obcs/user/profile.php of Online Birth Certificate System v1.2 allows a
- CVE-2022-28998Xlight FTP v3.9.3.2 was discovered to contain a stack-based buffer overflow which allows attackers to leak sensitive information via crafted
- CVE-2022-28997CSZCMS v1.3.0 allows attackers to execute a Server-Side Request Forgery (SSRF) which can be leveraged to leak sensitive data via a local fil
- CVE-2022-0900Cross-Site Scripting Vulnerability in DivvyDriveNetDataSoft DivvyDrive
- CVE-2022-1817Badminton Center Management System Userlist Module cross site scriptingBadminton Center Management System
- CVE-2022-1816Zoo Management System Content Module cross site scriptingZoo Management System
- CVE-2022-1825Cross-site Scripting (XSS) - Reflected in collectiveaccess/providencecollectiveaccess/providence
- CVE-2021-42586A heap buffer overflow was discovered in copy_bytes in decode_r2007.c in dwgread before 0.12.4 via a crafted dwg file.
- CVE-2021-42585A heap buffer overflow was discovered in copy_compressed_bytes in decode_r2007.c in dwgread before 0.12.4 via a crafted dwg file.
- CVE-2022-28874Multiple Denial-of-Service (DoS) VulnerabilitiesF-Secure endpoint protection products for Windows and Mac.…
- CVE-2022-29599Commandline class shell injection vulnerabilitiesApache Software Foundation Apache Maven · org.apache.maven.…
- CVE-2022-1558Curtain <= 1.0.2 - Admin+ Stored Cross-Site ScriptingCurtain
- CVE-2022-1547Check & Log email < 1.0.6 - Reflected Cross-Site ScriptingCheck & Log Email
- CVE-2022-1320Sliderby10Web < 1.2.52 - Admin+ Stored Cross-Site ScriptingSliderby10Web
- CVE-2022-1298Tabs Responsive < 2.2.8 - Editor+ Stored Cross-Site ScriptingTabs
- CVE-2022-1268Donate Extra <= 2.02 - Reflected Cross-Site ScriptingDonate Extra
- CVE-2022-1221Gwyn's Imagemap Selector <= 0.3.3 - Reflected Cross-Site ScriptingGwyn's Imagemap Selector
- CVE-2022-1218Domain Replace <= 1.3.8 - Reflected Cross-Site ScriptingDomain Replace
- CVE-2022-1192Turn off all comments <= 1.0 - Reflected Cross-Site ScriptingTurn off all comments
- CVE-2022-1093WP Meta SEO < 4.4.7 - Admin+ Stored Cross-Site Scripting via breadcrumbsWP Meta SEO
- CVE-2022-1014WP Contacts Manager <= 2.2.4 - Unauthenticated SQLiWP Contacts Manager
- CVE-2022-0781Nirweb support < 2.8.2 - Unauthenticated SQLiNirweb support
- CVE-2022-0346Google XML Sitemap Generator < 2.0.4 - Reflected Cross-Site ScriptingXML Sitemap Generator for Google
- CVE-2021-41834JFrog Artifactory prior to version 7.28.0 and 6.23.38, is vulnerable to Broken Access Control, the copy functionality can be used by a low-pJFrog Artifactory