CVEs published May 25, 2022
56 CVEs were published on May 25, 2022: 5 critical, 12 high.
- Published
- 56
- Critical
- 5
- High
- 12
- Medium
- 11
- Low
- 2
- Unrated
- 26
- Now in CISA KEV
- 0
- Fix available
- 16
Most affected products
- Open Automation Software OAS Platform
- 8
- github.com/hashicorp/go-getter · github.com/hashicorp/go… +2
- 4
- github.com/gphper/ginadmin
- 2
- All F-Secure & WithSecure endpoint protection products for…
- 1
- Apache Software Foundation Apache Archiva · org.apache.arch…
- 1
- Bentley Nevada, a Baker Hughes subsidiary 3500 System 1… +2
- 1
- camptocamp/terraboard
- 1
- CVEProject cve-services
- 1
- FriendsOfFlarum upload · fof/upload
- 1
- guzzle · guzzlehttp/guzzle +1
- 1
Critical 5
- CVE-2022-26833An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V16.00.0121.Open Automation Software OAS Platform
- CVE-2022-26082A file write vulnerability exists in the OAS Engine SecureTransferFiles functionality of Open Automation Software OAS Platform V16.00.0112.Open Automation Software OAS Platform
- CVE-2021-27779A Security Misconfiguration vulnerability affects HCL VersionVault ExpressHCL Software HCL VersionVault Express
- CVE-2021-32989LCDS LAquis SCADA - Cross-site ScriptingLCDS—Leão Consultoria e Desenvolvimento de Sistemas Ltda ME…
- CVE-2022-1883SQL Injection in camptocamp/terraboardcamptocamp/terraboard
High 12
- CVE-2022-31004Potential secrets being logged to disk in CVE ServicesCVEProject cve-services
- CVE-2022-30999Possible cross-site scripting attack via unsanitized SVG files in FoF UploadFriendsOfFlarum upload · fof/upload
- CVE-2022-29251Cross-site Scripting in the Flamingo theme managerxwiki-platform · org.xwiki.platform:xwiki-platform-flamingo…
- CVE-2022-29252Cross-site Scripting in XWiki Platform Wiki UI Main Wikixwiki-platform · org.xwiki.platform:xwiki-platform-wiki-ui-…
- CVE-2022-27169An information disclosure vulnerability exists in the OAS Engine SecureBrowseFile functionality of Open Automation Software OAS Platform V16Open Automation Software OAS Platform
- CVE-2022-26303An external config control vulnerability exists in the OAS Engine SecureAddUser functionality of Open Automation Software OAS Platform V16.0Open Automation Software OAS Platform
- CVE-2022-26077A cleartext transmission of sensitive information vulnerability exists in the OAS Engine configuration communications functionality of Open Open Automation Software OAS Platform
- CVE-2022-26043An external config control vulnerability exists in the OAS Engine SecureAddSecurity functionality of Open Automation Software OAS Platform VOpen Automation Software OAS Platform
- CVE-2022-26026A denial of service vulnerability exists in the OAS Engine SecureConfigValues functionality of Open Automation Software OAS Platform V16.00.Open Automation Software OAS Platform
- CVE-2021-32997Baker Hughes Bently Nevada 3500 - Use of Password Hash with Insufficient Computational EffortBentley Nevada, a Baker Hughes subsidiary 3500 System 1… +2
- CVE-2022-1851Out-of-bounds Read in vim/vimvim/vim
- CVE-2022-29248Cross-domain cookie leakage in Guzzleguzzle · guzzlehttp/guzzle +1
Medium, low and unrated 39
- CVE-2022-29256Possible vulnerability at 'npm install' time in sharp if an attacker has control over build environmentlovell sharp · sharp
- CVE-2022-29253Path Traversal in XWiki Platformxwiki-platform · org.xwiki.platform:xwiki-platform-oldcore
- CVE-2022-31624MariaDB Server before 10.7 is vulnerable to Denial of Service.
- CVE-2022-26067An information disclosure vulnerability exists in the OAS Engine SecureTransferFiles functionality of Open Automation Software OAS Platform Open Automation Software OAS Platform
- CVE-2022-31620In libjpeg before 1.64, BitStream<false>::Get in bitstream.hpp has an assertion failure that may cause denial of service.
- CVE-2022-29402TP-Link TL-WR840N EU v6.20 was discovered to contain insecure protections for its UART console.
- CVE-2022-29408WordPress Advanced Contact form 7 DB plugin <= 1.8.7 - Unauthenticated Persistent Cross-Site Scripting (XSS) vulnerabilityVsourz Digital Advanced Contact form 7 DB
- CVE-2022-23775TrueStack Direct Connect 1.4.7 has Incorrect Access Control.
- CVE-2022-27305Gibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to session fixation.
- CVE-2021-44719Docker Desktop 4.3.0 has Incorrect Access Control.
- CVE-2022-30427In ginadmin through 05-10-2022 the incoming path value is not filtered, resulting in directory traversal.github.com/gphper/ginadmin
- CVE-2022-30428In ginadmin through 05-10-2022, the incoming path value is not filtered, resulting in arbitrary file reading.github.com/gphper/ginadmin
- CVE-2021-27783HCL BigFix Mobile / Modern Client Management is vulnerable to sensitive information exposureHCL Software HCL BigFix Mobile / Modern Client Management
- CVE-2022-1348A vulnerability was found in logrotate in how the state file is created.logrotate
- CVE-2022-28875Denial-of-Service (DoS) VulnerabilityAll F-Secure & WithSecure endpoint protection products for…
- CVE-2022-1678An issue was discovered in the Linux Kernel from 4.18 to 4.19, an improper update of sock reference in TCP pacing can lead to memory/netns lkernel
- CVE-2022-22127Tableau is aware of a broken access control vulnerability present in Tableau Server affecting Tableau Server customers using Local Identity Tableau Server
- CVE-2021-35487Nokia Broadcast Message Center through 11.1.0 allows an authenticated user to perform a Boolean Blind SQL Injection attack on the endpoint /
- CVE-2021-32966Philips Interoperability Solution XDS - Clear Text Transmission of Sensitive InformationPhilips Interoperability Solution XDS
- CVE-2022-29380Academy-LMS v4.3 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the SEO panel.
- CVE-2022-29379Nginx NJS v0.7.3 was discovered to contain a stack overflow in the function njs_default_module_loader at /src/njs/src/njs_module.c.
- CVE-2022-29650Online Food Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the Search parameter at /online-food-order/food
- CVE-2022-29651An arbitrary file upload vulnerability in the Select Image function of Online Food Ordering System v1.0 allows attackers to execute arbitrar
- CVE-2021-44974radareorg radare2 version 5.5.2 is vulnerable to NULL Pointer Dereference via libr/bin/p/bin_symbols.c binary symbol parser.
- CVE-2022-30595libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files.pillow
- CVE-2022-26945go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response hegithub.com/hashicorp/go-getter · github.com/hashicorp/go… +2
- CVE-2022-30321go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection flawsgithub.com/hashicorp/go-getter · github.com/hashicorp/go… +2
- CVE-2022-30322go-getter up to 1.5.11 and 2.0.2 allowed asymmetric resource exhaustion when go-getter processed malicious HTTP responses.github.com/hashicorp/go-getter · github.com/hashicorp/go… +2
- CVE-2022-30323go-getter up to 1.5.11 and 2.0.2 panicked when processing password-protected ZIP files.github.com/hashicorp/go-getter · github.com/hashicorp/go… +2
- CVE-2022-28862In Archibus Web Central before 26.2, multiple SQL Injection vulnerabilities occur in dwr/call/plaincall/workflow.runWorkflowRule.dwr.
- CVE-2022-21951Rancher: Weave CNI password is not set if RKE template is used with CNI value overriddenSUSE Rancher · github.com/rancher/rancher
- CVE-2022-1815Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawiojgraph/drawio
- CVE-2022-29405Apache Archiva Arbitrary user password reset vulnerabilityApache Software Foundation Apache Archiva · org.apache.arch…
- CVE-2022-29362A cross-site scripting (XSS) vulnerability in /navigation/create?ParentID=%23 of ZKEACMS v3.5.2 allows attackers to execute arbitrary web scZKEACMS.Publisher
- CVE-2022-31621MariaDB Server before 10.7 is vulnerable to Denial of Service.
- CVE-2022-31622MariaDB Server before 10.7 is vulnerable to Denial of Service.
- CVE-2022-31623MariaDB Server before 10.7 is vulnerable to Denial of Service.
- CVE-2022-31650In SoX 14.4.2, there is a floating-point exception in lsx_aiffstartwrite in aiff.c in libsox.a.
- CVE-2022-31651In SoX 14.4.2, there is an assertion failure in rate_init in rate.c in libsox.a.