# CVEs published 2022-05-25

56 CVEs were published on May 25, 2022: 5 critical, 12 high. Days are UTC.

- [CVE-2022-31004](https://cve.now/CVE-2022-31004.md): Potential secrets being logged to disk in CVE Services (CVSS 7.5, CVEProject cve-services)
- [CVE-2022-30999](https://cve.now/CVE-2022-30999.md): Possible cross-site scripting attack via unsanitized SVG files in FoF Upload (CVSS 8.7, FriendsOfFlarum upload · fof/upload)
- [CVE-2022-29256](https://cve.now/CVE-2022-29256.md): Possible vulnerability at 'npm install' time in sharp if an attacker has control over build environment (CVSS 6.5, lovell sharp · sharp)
- [CVE-2022-29251](https://cve.now/CVE-2022-29251.md): Cross-site Scripting in the Flamingo theme manager (CVSS 7.4, xwiki-platform · org.xwiki.platform:xwiki-platform-flamingo…)
- [CVE-2022-29252](https://cve.now/CVE-2022-29252.md): Cross-site Scripting in XWiki Platform Wiki UI Main Wiki (CVSS 7.4, xwiki-platform · org.xwiki.platform:xwiki-platform-wiki-ui-…)
- [CVE-2022-29253](https://cve.now/CVE-2022-29253.md): Path Traversal in XWiki Platform (CVSS 2.7, xwiki-platform · org.xwiki.platform:xwiki-platform-oldcore)
- [CVE-2022-31624](https://cve.now/CVE-2022-31624.md): MariaDB Server before 10.7 is vulnerable to Denial of Service. (no CVSS)
- [CVE-2022-27169](https://cve.now/CVE-2022-27169.md): An information disclosure vulnerability exists in the OAS Engine SecureBrowseFile functionality of Open Automation Software OAS Platform V16 (CVSS 7.5, Open Automation Software OAS Platform)
- [CVE-2022-26833](https://cve.now/CVE-2022-26833.md): An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V16.00.0121. (CVSS 9.4, Open Automation Software OAS Platform)
- [CVE-2022-26303](https://cve.now/CVE-2022-26303.md): An external config control vulnerability exists in the OAS Engine SecureAddUser functionality of Open Automation Software OAS Platform V16.0 (CVSS 7.5, Open Automation Software OAS Platform)
- [CVE-2022-26082](https://cve.now/CVE-2022-26082.md): A file write vulnerability exists in the OAS Engine SecureTransferFiles functionality of Open Automation Software OAS Platform V16.00.0112. (CVSS 9.1, Open Automation Software OAS Platform)
- [CVE-2022-26077](https://cve.now/CVE-2022-26077.md): A cleartext transmission of sensitive information vulnerability exists in the OAS Engine configuration communications functionality of Open (CVSS 7.5, Open Automation Software OAS Platform)
- [CVE-2022-26067](https://cve.now/CVE-2022-26067.md): An information disclosure vulnerability exists in the OAS Engine SecureTransferFiles functionality of Open Automation Software OAS Platform (CVSS 4.9, Open Automation Software OAS Platform)
- [CVE-2022-26043](https://cve.now/CVE-2022-26043.md): An external config control vulnerability exists in the OAS Engine SecureAddSecurity functionality of Open Automation Software OAS Platform V (CVSS 7.5, Open Automation Software OAS Platform)
- [CVE-2022-26026](https://cve.now/CVE-2022-26026.md): A denial of service vulnerability exists in the OAS Engine SecureConfigValues functionality of Open Automation Software OAS Platform V16.00. (CVSS 7.5, Open Automation Software OAS Platform)
- [CVE-2022-31620](https://cve.now/CVE-2022-31620.md): In libjpeg before 1.64, BitStream\<false\>::Get in bitstream.hpp has an assertion failure that may cause denial of service. (no CVSS)
- [CVE-2022-29402](https://cve.now/CVE-2022-29402.md): TP-Link TL-WR840N EU v6.20 was discovered to contain insecure protections for its UART console. (CVSS 6.8)
- [CVE-2022-29408](https://cve.now/CVE-2022-29408.md): WordPress Advanced Contact form 7 DB plugin \<= 1.8.7 - Unauthenticated Persistent Cross-Site Scripting (XSS) vulnerability (CVSS 4.7, Vsourz Digital Advanced Contact form 7 DB)
- [CVE-2022-23775](https://cve.now/CVE-2022-23775.md): TrueStack Direct Connect 1.4.7 has Incorrect Access Control. (no CVSS)
- [CVE-2022-27305](https://cve.now/CVE-2022-27305.md): Gibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to session fixation. (no CVSS)
- [CVE-2021-44719](https://cve.now/CVE-2021-44719.md): Docker Desktop 4.3.0 has Incorrect Access Control. (no CVSS)
- [CVE-2022-30427](https://cve.now/CVE-2022-30427.md): In ginadmin through 05-10-2022 the incoming path value is not filtered, resulting in directory traversal. (no CVSS, github.com/gphper/ginadmin)
- [CVE-2022-30428](https://cve.now/CVE-2022-30428.md): In ginadmin through 05-10-2022, the incoming path value is not filtered, resulting in arbitrary file reading. (no CVSS, github.com/gphper/ginadmin)
- [CVE-2021-27783](https://cve.now/CVE-2021-27783.md): HCL BigFix Mobile / Modern Client Management is vulnerable to sensitive information exposure (CVSS 6.8, HCL Software HCL BigFix Mobile / Modern Client Management)
- [CVE-2021-27779](https://cve.now/CVE-2021-27779.md): A Security Misconfiguration vulnerability affects HCL VersionVault Express (CVSS 9.1, HCL Software HCL VersionVault Express)
- [CVE-2022-1348](https://cve.now/CVE-2022-1348.md): A vulnerability was found in logrotate in how the state file is created. (CVSS 6.5, logrotate)
- [CVE-2022-28875](https://cve.now/CVE-2022-28875.md): Denial-of-Service (DoS) Vulnerability (CVSS 4.3, All F-Secure & WithSecure endpoint protection products for…)
- [CVE-2022-1678](https://cve.now/CVE-2022-1678.md): An issue was discovered in the Linux Kernel from 4.18 to 4.19, an improper update of sock reference in TCP pacing can lead to memory/netns l (CVSS 5.9, kernel)
- [CVE-2022-22127](https://cve.now/CVE-2022-22127.md): Tableau is aware of a broken access control vulnerability present in Tableau Server affecting Tableau Server customers using Local Identity (no CVSS, Tableau Server)
- [CVE-2021-35487](https://cve.now/CVE-2021-35487.md): Nokia Broadcast Message Center through 11.1.0 allows an authenticated user to perform a Boolean Blind SQL Injection attack on the endpoint / (no CVSS)
- [CVE-2021-32997](https://cve.now/CVE-2021-32997.md): Baker Hughes Bently Nevada 3500 - Use of Password Hash with Insufficient Computational Effort (CVSS 8.2, Bentley Nevada, a Baker Hughes subsidiary 3500 System 1… +2)
- [CVE-2021-32989](https://cve.now/CVE-2021-32989.md): LCDS LAquis SCADA - Cross-site Scripting (CVSS 9.3, LCDS—Leão Consultoria e Desenvolvimento de Sistemas Ltda ME…)
- [CVE-2021-32966](https://cve.now/CVE-2021-32966.md): Philips Interoperability Solution XDS - Clear Text Transmission of Sensitive Information (CVSS 3.7, Philips Interoperability Solution XDS)
- [CVE-2022-29380](https://cve.now/CVE-2022-29380.md): Academy-LMS v4.3 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the SEO panel. (no CVSS)
- [CVE-2022-29379](https://cve.now/CVE-2022-29379.md): Nginx NJS v0.7.3 was discovered to contain a stack overflow in the function njs\_default\_module\_loader at /src/njs/src/njs\_module.c. (no CVSS)
- [CVE-2022-29650](https://cve.now/CVE-2022-29650.md): Online Food Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the Search parameter at /online-food-order/food (no CVSS)
- [CVE-2022-29651](https://cve.now/CVE-2022-29651.md): An arbitrary file upload vulnerability in the Select Image function of Online Food Ordering System v1.0 allows attackers to execute arbitrar (no CVSS)
- [CVE-2021-44974](https://cve.now/CVE-2021-44974.md): radareorg radare2 version 5.5.2 is vulnerable to NULL Pointer Dereference via libr/bin/p/bin\_symbols.c binary symbol parser. (no CVSS)
- [CVE-2022-30595](https://cve.now/CVE-2022-30595.md): libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files. (no CVSS, pillow)
- [CVE-2022-26945](https://cve.now/CVE-2022-26945.md): go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response he (no CVSS, github.com/hashicorp/go-getter · github.com/hashicorp/go… +2)
- [CVE-2022-30321](https://cve.now/CVE-2022-30321.md): go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection flaws (no CVSS, github.com/hashicorp/go-getter · github.com/hashicorp/go… +2)
- [CVE-2022-30322](https://cve.now/CVE-2022-30322.md): go-getter up to 1.5.11 and 2.0.2 allowed asymmetric resource exhaustion when go-getter processed malicious HTTP responses. (no CVSS, github.com/hashicorp/go-getter · github.com/hashicorp/go… +2)
- [CVE-2022-30323](https://cve.now/CVE-2022-30323.md): go-getter up to 1.5.11 and 2.0.2 panicked when processing password-protected ZIP files. (no CVSS, github.com/hashicorp/go-getter · github.com/hashicorp/go… +2)
- [CVE-2022-28862](https://cve.now/CVE-2022-28862.md): In Archibus Web Central before 26.2, multiple SQL Injection vulnerabilities occur in dwr/call/plaincall/workflow.runWorkflowRule.dwr. (no CVSS)
- [CVE-2022-1883](https://cve.now/CVE-2022-1883.md): SQL Injection in camptocamp/terraboard (CVSS 9.6, camptocamp/terraboard)
- [CVE-2022-21951](https://cve.now/CVE-2022-21951.md): Rancher: Weave CNI password is not set if RKE template is used with CNI value overridden (CVSS 6.8, SUSE Rancher · github.com/rancher/rancher)
- [CVE-2022-1815](https://cve.now/CVE-2022-1815.md): Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawio (CVSS 5.3, jgraph/drawio)
- [CVE-2022-29405](https://cve.now/CVE-2022-29405.md): Apache Archiva Arbitrary user password reset vulnerability (no CVSS, Apache Software Foundation Apache Archiva · org.apache.arch…)
- [CVE-2022-29362](https://cve.now/CVE-2022-29362.md): A cross-site scripting (XSS) vulnerability in /navigation/create?ParentID=%23 of ZKEACMS v3.5.2 allows attackers to execute arbitrary web sc (no CVSS, ZKEACMS.Publisher)
- [CVE-2022-1851](https://cve.now/CVE-2022-1851.md): Out-of-bounds Read in vim/vim (CVSS 7.8, vim/vim)
- [CVE-2022-29248](https://cve.now/CVE-2022-29248.md): Cross-domain cookie leakage in Guzzle (CVSS 8.0, guzzle · guzzlehttp/guzzle +1)
- [CVE-2022-31621](https://cve.now/CVE-2022-31621.md): MariaDB Server before 10.7 is vulnerable to Denial of Service. (CVSS 5.3)
- [CVE-2022-31622](https://cve.now/CVE-2022-31622.md): MariaDB Server before 10.7 is vulnerable to Denial of Service. (no CVSS)
- [CVE-2022-31623](https://cve.now/CVE-2022-31623.md): MariaDB Server before 10.7 is vulnerable to Denial of Service. (no CVSS)
- [CVE-2022-31650](https://cve.now/CVE-2022-31650.md): In SoX 14.4.2, there is a floating-point exception in lsx\_aiffstartwrite in aiff.c in libsox.a. (no CVSS)
- [CVE-2022-31651](https://cve.now/CVE-2022-31651.md): In SoX 14.4.2, there is an assertion failure in rate\_init in rate.c in libsox.a. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-05-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.