# CVEs published 2022-05-23

47 CVEs were published on May 23, 2022: 3 critical, 5 high. Days are UTC.

- [CVE-2022-29002](https://cve.now/CVE-2022-29002.md): A Cross-Site Request Forgery (CSRF) in XXL-Job v2.3.0 allows attackers to arbitrarily create administrator accounts via the component /gaia- (no CVSS, com.xuxueli:xxl-job)
- [CVE-2022-30015](https://cve.now/CVE-2022-30015.md): In Simple Food Website 1.0, a moderation can put the Cross Site Scripting Payload in any of the fields on http://127.0.0.1:1234/food/admin/a (no CVSS)
- [CVE-2022-29376](https://cve.now/CVE-2022-29376.md): Xampp for Windows v8.1.4 and below was discovered to contain insecure permissions for its install directory, allowing attackers to execute a (no CVSS)
- [CVE-2022-28999](https://cve.now/CVE-2022-28999.md): Insecure permissions in the install directories and binaries of Dev-CPP v4.9.9.2 allows attackers to execute arbitrary code via overwriting (no CVSS)
- [CVE-2022-31487](https://cve.now/CVE-2022-31487.md): Inout Blockchain AltExchanger 1.2.1 and Inout Blockchain FiatExchanger 2.2.1 allow Chart/TradingView/chart\_content/master.php symbol SQL inj (no CVSS)
- [CVE-2022-31488](https://cve.now/CVE-2022-31488.md): Inout Blockchain AltExchanger 1.2.1 allows index.php/coins/update\_marketboxslider marketcurrency SQL injection. (no CVSS)
- [CVE-2022-31489](https://cve.now/CVE-2022-31489.md): Inout Blockchain AltExchanger 1.2.1 allows index.php/home/about inoutio\_language cookie SQL injection. (no CVSS)
- [CVE-2021-32958](https://cve.now/CVE-2021-32958.md): Claroty Secure Remote Access Site - Authentication Bypass Using an Alternate Path or Channel (CVSS 5.5, Claroty Secure Remote Access (SRA) Site)
- [CVE-2022-1467](https://cve.now/CVE-2022-1467.md): AVEVA InTouch Access Anywhere Exposure of Resource to Wrong Sphere (CVSS 7.4, AVEVA InTouch Access Anywhere · AVEVA Plant SCADA Access An…)
- [CVE-2021-32941](https://cve.now/CVE-2021-32941.md): Annke Network Video Recorder - Stack-based Buffer Overflow (CVSS 9.4, Annke N48PBB)
- [CVE-2021-32935](https://cve.now/CVE-2021-32935.md): Cognex In-Sight OPC Server - Deserialization of Untrusted Data (CVSS 8.8, Cognex In-Sight OPC Server)
- [CVE-2022-31466](https://cve.now/CVE-2022-31466.md): TOCTOU Vulnerability in Quick Heal Total Security (CVSS 7.9)
- [CVE-2022-31467](https://cve.now/CVE-2022-31467.md): DLL Hijacking Vulnerability in Quick Heal Total Security (CVSS 7.9)
- [CVE-2021-42233](https://cve.now/CVE-2021-42233.md): The Simple Blog plugin in Wondercms 3.4.1 is vulnerable to stored cross-site scripting (XSS) vulnerability. (no CVSS)
- [CVE-2022-28944](https://cve.now/CVE-2022-28944.md): Certain EMCO Software products are affected by: CWE-494: Download of Code Without Integrity Check. (no CVSS)
- [CVE-2022-30016](https://cve.now/CVE-2022-30016.md): Rescue Dispatch Management System 1.0 is vulnerable to Incorrect Access Control via http://localhost/rdms/admin/?page=system\_info. (no CVSS)
- [CVE-2022-30017](https://cve.now/CVE-2022-30017.md): Rescue Dispatch Management System 1.0 suffers from Stored XSS, leading to admin account takeover via cookie stealing. (no CVSS)
- [CVE-2022-28932](https://cve.now/CVE-2022-28932.md): D-Link DSL-G2452DG HW:T1\\\\tFW:ME\_2.00 was discovered to contain insecure permissions. (no CVSS)
- [CVE-2022-30014](https://cve.now/CVE-2022-30014.md): Lumidek Associates Simple Food Website 1.0 is vulnerable to Cross Site Request Forgery (CSRF) which allows anyone to takeover admin/moderate (no CVSS)
- [CVE-2022-29004](https://cve.now/CVE-2022-29004.md): Diary Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name parameter in search-result.ph (no CVSS)
- [CVE-2021-41714](https://cve.now/CVE-2021-41714.md): In Tipask \< 3.5.9, path parameters entered by the user are not validated when downloading attachments, a registered user can download arbitr (CVSS 7.7)
- [CVE-2022-29005](https://cve.now/CVE-2022-29005.md): Multiple cross-site scripting (XSS) vulnerabilities in the component /obcs/user/profile.php of Online Birth Certificate System v1.2 allows a (no CVSS)
- [CVE-2022-28998](https://cve.now/CVE-2022-28998.md): Xlight FTP v3.9.3.2 was discovered to contain a stack-based buffer overflow which allows attackers to leak sensitive information via crafted (no CVSS)
- [CVE-2022-28997](https://cve.now/CVE-2022-28997.md): CSZCMS v1.3.0 allows attackers to execute a Server-Side Request Forgery (SSRF) which can be leveraged to leak sensitive data via a local fil (no CVSS)
- [CVE-2022-1811](https://cve.now/CVE-2022-1811.md): Unrestricted Upload of File with Dangerous Type in publify/publify (CVSS 9.1, publify/publify · publify\_core)
- [CVE-2022-0900](https://cve.now/CVE-2022-0900.md): Cross-Site Scripting Vulnerability in DivvyDrive (CVSS 5.4, NetDataSoft DivvyDrive)
- [CVE-2022-1817](https://cve.now/CVE-2022-1817.md): Badminton Center Management System Userlist Module cross site scripting (CVSS 3.5, Badminton Center Management System)
- [CVE-2022-1816](https://cve.now/CVE-2022-1816.md): Zoo Management System Content Module cross site scripting (CVSS 3.5, Zoo Management System)
- [CVE-2022-1825](https://cve.now/CVE-2022-1825.md): Cross-site Scripting (XSS) - Reflected in collectiveaccess/providence (CVSS 5.5, collectiveaccess/providence)
- [CVE-2021-42586](https://cve.now/CVE-2021-42586.md): A heap buffer overflow was discovered in copy\_bytes in decode\_r2007.c in dwgread before 0.12.4 via a crafted dwg file. (no CVSS)
- [CVE-2021-42585](https://cve.now/CVE-2021-42585.md): A heap buffer overflow was discovered in copy\_compressed\_bytes in decode\_r2007.c in dwgread before 0.12.4 via a crafted dwg file. (no CVSS)
- [CVE-2022-28874](https://cve.now/CVE-2022-28874.md): Multiple Denial-of-Service (DoS) Vulnerabilities (CVSS 4.3, F-Secure endpoint protection products for Windows and Mac.…)
- [CVE-2022-29599](https://cve.now/CVE-2022-29599.md): Commandline class shell injection vulnerabilities (no CVSS, Apache Software Foundation Apache Maven · org.apache.maven.…)
- [CVE-2022-1558](https://cve.now/CVE-2022-1558.md): Curtain \<= 1.0.2 - Admin+ Stored Cross-Site Scripting (no CVSS, Curtain)
- [CVE-2022-1547](https://cve.now/CVE-2022-1547.md): Check & Log email \< 1.0.6 - Reflected Cross-Site Scripting (no CVSS, Check & Log Email)
- [CVE-2022-1320](https://cve.now/CVE-2022-1320.md): Sliderby10Web \< 1.2.52 - Admin+ Stored Cross-Site Scripting (no CVSS, Sliderby10Web)
- [CVE-2022-1298](https://cve.now/CVE-2022-1298.md): Tabs Responsive \< 2.2.8 - Editor+ Stored Cross-Site Scripting (no CVSS, Tabs)
- [CVE-2022-1268](https://cve.now/CVE-2022-1268.md): Donate Extra \<= 2.02 - Reflected Cross-Site Scripting (no CVSS, Donate Extra)
- [CVE-2022-1221](https://cve.now/CVE-2022-1221.md): Gwyn's Imagemap Selector \<= 0.3.3 - Reflected Cross-Site Scripting (no CVSS, Gwyn's Imagemap Selector)
- [CVE-2022-1218](https://cve.now/CVE-2022-1218.md): Domain Replace \<= 1.3.8 - Reflected Cross-Site Scripting (no CVSS, Domain Replace)
- [CVE-2022-1192](https://cve.now/CVE-2022-1192.md): Turn off all comments \<= 1.0 - Reflected Cross-Site Scripting (no CVSS, Turn off all comments)
- [CVE-2022-1093](https://cve.now/CVE-2022-1093.md): WP Meta SEO \< 4.4.7 - Admin+ Stored Cross-Site Scripting via breadcrumbs (no CVSS, WP Meta SEO)
- [CVE-2022-1014](https://cve.now/CVE-2022-1014.md): WP Contacts Manager \<= 2.2.4 - Unauthenticated SQLi (no CVSS, WP Contacts Manager)
- [CVE-2022-0781](https://cve.now/CVE-2022-0781.md): Nirweb support \< 2.8.2 - Unauthenticated SQLi (no CVSS, Nirweb support)
- [CVE-2022-0346](https://cve.now/CVE-2022-0346.md): Google XML Sitemap Generator \< 2.0.4 - Reflected Cross-Site Scripting (no CVSS, XML Sitemap Generator for Google)
- [CVE-2021-41834](https://cve.now/CVE-2021-41834.md): JFrog Artifactory prior to version 7.28.0 and 6.23.38, is vulnerable to Broken Access Control, the copy functionality can be used by a low-p (CVSS 5.3, JFrog Artifactory)
- [CVE-2022-1810](https://cve.now/CVE-2022-1810.md): Authorization Bypass Through User-Controlled Key in publify/publify (CVSS 9.9, publify/publify · publify\_core)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-05-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.