CVEs published May 24, 2022
80 CVEs were published on May 24, 2022: 2 critical, 12 high.
- Published
- 80
- Critical
- 2
- High
- 12
- Medium
- 21
- Low
- 3
- Unrated
- 42
- Now in CISA KEV
- 0
- Fix available
- 19
Most affected products
- Home Clean Services Management System
- 4
- Telecommunication Software SAMwin Contact Center Suite
- 3
- AGG Software Web Server
- 2
- azure-rtos usbx
- 2
- Delta Electronics DIAScreen
- 2
- filegator/filegator
- 2
- SSCMS
- 2
- undertow · io.undertow:undertow-core
- 2
- Zyxel USG/ZyWALL series firmware · Zyxel USG FLEX series… +2
- 2
- Zyxel USG/ZyWALL series firmware · Zyxel USG FLEX series… +8
- 2
Critical 2
High 12
- CVE-2022-22497IBM Aspera Faspex 4.4.1 and 5.0.0 could allow unauthorized access due to an incorrectly computed security token.IBM Aspera Faspex
- CVE-2022-22977VMware Tools for Windows(12.0.0, 11.x.y and 10.x.y) contains an XML External Entity (XXE) vulnerability.VMware Tools for Windows
- CVE-2021-32969Delta Electronics DIAScreen - Type Confusion, Out-of-bounds WriteDelta Electronics DIAScreen
- CVE-2021-32965Delta Electronics DIAScreen - Type Confusion, Out-of-bounds WriteDelta Electronics DIAScreen
- CVE-2021-32962Claroty Secure Remote Access Site - Authentication Bypass Using an Alternate Path or ChannelAGG Software Web Server
- CVE-2014-125001Cardo Systems Scala Rider Q3 Cardo-Updater api privileges managementCardo Systems Scala Rider Q3
- CVE-2022-29249Reversible One-Way Hash and Use of a Broken or Risky Cryptographic Algorithm in io.github.javaezlib.JavaEZJavaEZLib JavaEZ · io.github.javaezlib:JavaEZ
- CVE-2022-29223Buffer overflow on HUB descriptor in Azure RTOS USBXazure-rtos usbx
- CVE-2022-29219Integer Overflow in LodestarChainSafe lodestar · @chainsafe/lodestar
- CVE-2022-29217Key confusion through non-blocklisted public key formats in PyJWTjpadilla pyjwt · pyjwt
- CVE-2022-26532A argument injection vulnerability in the 'packet-trace' CLI command of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEZyxel USG/ZyWALL series firmware · Zyxel USG FLEX series… +8
- CVE-2022-29221PHP Code Injection by malicious block or filename in Smartysmarty-php smarty · smarty/smarty
Medium, low and unrated 66
- CVE-2022-29361Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTwerkzeug
- CVE-2022-29710A cross-site scripting (XSS) vulnerability in uploadConfirm.php of LimeSurvey v5.3.9 and below allows attackers to execute arbitrary web scr
- CVE-2022-29359A stored cross-site scripting (XSS) vulnerability in /scas/?page=clubs/application_form&id=7 of School Club Application System v0.1 allows a
- CVE-2022-29358epub2txt2 v2.04 was discovered to contain an integer overflow via the function bug in _parse_special_tag at sxmlc.c.
- CVE-2022-29349kkFileView v4.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /controller/OnlinePreviewCon
- CVE-2022-29337C-DATA FD702XW-X-R430 v2.1.13_X001 was discovered to contain a command injection vulnerability via the va_cmd parameter in formlanipv6.
- CVE-2022-29334An issue in H v1.0 allows attackers to bypass authentication via a session replay attack.
- CVE-2022-29333A vulnerability in CyberLink Power Director v14 allows attackers to escalate privileges via a crafted .exe file.
- CVE-2021-42614A use after free in info_width_internal in bk_info.c in Halibut 1.2 allows an attacker to cause a segmentation fault or possibly have unspec
- CVE-2021-3597A flaw was found in undertow.undertow · io.undertow:undertow-core
- CVE-2021-3629A flaw was found in Undertow.undertow · io.undertow:undertow-core
- CVE-2021-3717A flaw was found in Wildfly.wildfly · org.wildfly.core:wildfly-core-parent
- CVE-2021-42613A double free in cleanup_index in index.c in Halibut 1.2 allows an attacker to cause a denial of service or possibly have other unspecified
- CVE-2021-42612A use after free in cleanup_index in index.c in Halibut 1.2 allows an attacker to cause a segmentation fault or possibly have other unspecif
- CVE-2022-23050ManageEngine AppManager15 (Build No:15510) allows an authenticated admin user to upload a DLL file to perform a DLL hijack attack inside theManageEngine AppManager15
- CVE-2021-32964Claroty Secure Remote Access Site - Authentication Bypass Using an Alternate Path or ChannelAGG Software Web Server
- CVE-2022-1669Circutor COMPACT DC-S BASICCIRCUTOR COMPACT DC-S BASIC
- CVE-2022-22495IBM i 7.3, 7.4, and 7.5 is vulnerable to SQL injection.IBM i
- CVE-2022-22309The POWER systems FSP is vulnerable to unauthenticated logins through the serial port/TTY interface.IBM Power System S922 Server
- CVE-2020-4926A vulnerability in the Spectrum Scale 5.1 core component and IBM Elastic Storage System 6.1 could allow unauthorized access to user data or IBM Spectrum Scale · IBM Elastic Storage System
- CVE-2021-4230Airfield Online MySQL Backup improper authenticationAirfield Online
- CVE-2021-4229ua-parser-js Crypto Mining backdoorua-parser-js
- CVE-2013-10004Telecommunication Software SAMwin Contact Center Suite Password SAMwinLIBVB.dll passwordScramble improper authenticationTelecommunication Software SAMwin Contact Center Suite
- CVE-2013-10003Telecommunication Software SAMwin Contact Center Suite Database SAMwinLIBVB.dll getCurrentDBVersion sql injectionTelecommunication Software SAMwin Contact Center Suite
- CVE-2013-10002Telecommunication Software SAMwin Contact Center Suite Credential SAMwinLIBVB.dll getCurrentDBVersion hard-coded credentialsTelecommunication Software SAMwin Contact Center Suite
- CVE-2022-29242Buffer Overflow on creating key transport blob in GOST Enginegost-engine engine
- CVE-2022-31261An XXE issue was discovered in Morpheus through 5.2.16 and 5.4.x through 5.4.4.
- CVE-2022-29237Limited Authentication Bypass for Media Files in Opencastopencast · org.opencastproject:opencast-ingest-service-impl
- CVE-2021-44975radareorg radare2 5.5.2 is vulnerable to Buffer Overflow via /libr/core/anal_objc.c mach-o parser.
- CVE-2022-22306An improper certificate validation vulnerability [CWE-295] in FortiOS 6.0.0 through 6.0.14, 6.2.0 through 6.2.10, 6.4.0 through 6.4.8, 7.0.0Fortinet FortiOS
- CVE-2021-45914In LuxSoft LuxCal Web Calendar before 5.2.0, an unauthenticated attacker can manipulate a POST request.
- CVE-2021-45915In LuxSoft LuxCal Web Calendar before 5.2.0, an unauthenticated attacker can manipulate a cookie value.
- CVE-2022-29567Possible information disclosure inside TreeGrid component with default data providervaadin · vaadin-grid-flow +2
- CVE-2022-30839Room-rent-portal-site v1.0 is vulnerable to Cross Site Scripting (XSS) via /rrps/classes/Master.php?f=save_category, vehicle_name.
- CVE-2022-30843Room-rent-portal-site v1.0 is vulnerable to SQL Injection via /rrps/classes/Master.php?f=delete_category, id.
- CVE-2022-30838Covid-19 Travel Pass Management System v1.0 is vulnerable to SQL Injection via /ctpms/classes/Master.php?f=update_application_status
- CVE-2022-30842Covid-19 Travel Pass Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via /ctpms/classes/Users.php?f=save, firstname.
- CVE-2022-30837Toll-tax-management-system v1.0 is vulnerable to Cross Site Scripting (XSS) via /ttms/classes/Master.php?f=save_recipient, vehicle_name.
- CVE-2022-30461Water-billing-management-system v1.0 is vulnerable to SQL Injection via /wbms/classes/Master.php?f=delete_client, id
- CVE-2022-30462Water-billing-management-system v1.0 is affected by: Cross Site Scripting (XSS) via /wbms/classes/Users.php?f=save, firstname.
- CVE-2022-30459ChatBot App with Suggestion in PHP/OOP v1.0 is vulnerable to SQL Injection via /simple_chat_bot/classes/Master.php?f=delete_response, id.
- CVE-2022-30464ChatBot App with Suggestion in PHP/OOP v1.0 is vulnerable to Cross Site Scripting (XSS) via /simple_chat_bot/classes/Master.php?f=save_respo
- CVE-2022-30463Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/classes/Master.php?f=delete_product.
- CVE-2022-30458Automotive Shop Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via /asms/classes/Master.php?f=save_product, name.
- CVE-2022-30460Simple Social Networking Site v1.0 is vulnerable to Cross Site Scripting (XSS) via /sns/classes/Users.php?f=save, firstname.
- CVE-2021-42656SiteServer CMS V6.15.51 is affected by a Cross Site Scripting (XSS) vulnerability.SSCMS
- CVE-2022-30455Badminton Center Management System 1.0 is vulnerable to SQL Injection via /bcms/classes/Master.php?f=delete_court_rental, id.
- CVE-2022-30456Badminton Center Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via /bcms/classes/Master.php?f=save_court_rental.
- CVE-2021-42655SiteServer CMS V6.15.51 is affected by a SQL injection vulnerability.SSCMS
- CVE-2022-30454Merchandise Online Store 1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_product.
- CVE-2021-42654SiteServer CMS < V5.1 is affected by an unrestricted upload of a file with dangerous type (getshell), which could be used to execute arbitra
- CVE-2022-1850Path Traversal in filegator/filegatorfilegator/filegator
- CVE-2022-1849Session Fixation in filegator/filegatorfilegator/filegator
- CVE-2021-42659There is a buffer overflow vulnerability in the Web server httpd of the router in Tenda router devices such as Tenda AC9 V1.0 V15.03.02.19(6
- CVE-2022-1840Home Clean Services Management System cross site scriptingHome Clean Services Management System
- CVE-2022-1839Home Clean Services Management System login.php sql injectionHome Clean Services Management System
- CVE-2022-1838Home Clean Services Management System login.php sql injectionHome Clean Services Management System
- CVE-2022-1837Home Clean Services Management System unrestricted uploadHome Clean Services Management System
- CVE-2022-1819Student Information System Student Roll Module cross site scriptingStudent Information System
- CVE-2022-31263app/models/user.rb in Mastodon before 3.5.0 allows a bypass of e-mail restrictions.
- CVE-2022-0910A downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI program of Zyxel USG/ZyWALL series firmwareZyxel USG/ZyWALL series firmware · Zyxel USG FLEX series… +2
- CVE-2022-29309mysiteforme v2.2.1 was discovered to contain a Server-Side Request Forgery.
- CVE-2022-0734A cross-site scripting vulnerability was identified in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.35 through 4.70, USG FZyxel USG/ZyWALL series firmware · Zyxel USG FLEX series… +2
- CVE-2022-29305imgurl v2.31 was discovered to contain a Blind SQL injection vulnerability via /upload/localhost.helloxz/imgurl
- CVE-2022-29377Totolink A3600R V4.1.2cu.5182_B20201102 was discovered to contain a stacker overflow in the fread function at infostat.cgi.
- CVE-2022-26531Multiple improper input validation flaws were identified in some CLI commands of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71Zyxel USG/ZyWALL series firmware · Zyxel USG FLEX series… +8