CVEs published May 26, 2022
157 CVEs were published on May 26, 2022: 6 critical, 17 high. 3 are now in CISA KEV.
- Published
- 157
- Critical
- 6
- High
- 17
- Medium
- 18
- Low
- 3
- Unrated
- 113
- Now in CISA KEV
- 3
- Fix available
- 91
Most affected products
- Apple macOS
- 28
- Apple Security Update - Catalina · Apple macOS
- 17
- Apple watchOS
- 12
- Apple tvOS
- 7
- Apple iOS and iPadOS
- 3
- Apple iOS and iPadOS · Apple macOS
- 2
- Apple iTunes for Windows
- 2
- Arista Networks Arista EOS · Arista Networks Arista TerminA…
- 2
- Dell CPG BIOS
- 2
- KUKA KR C4 · KSS
- 2
Critical 6
- CVE-2022-26776This issue was addressed with improved checks.Apple macOS
- CVE-2022-26775An integer overflow was addressed with improved input validation.Apple Security Update - Catalina · Apple macOS
- CVE-2022-30584Archer Platform 6.3 before 6.11 (6.11.0.0) contains an Improper Access Control Vulnerability within SSO ADFS functionality that could potent
- CVE-2021-33016KUKA KR C4 - Use of Hard-Coded CredentialsKUKA KR C4 · KSS
- CVE-2022-26857Dell OpenManage Enterprise Versions 3.8.3 and prior contain an improper authorization vulnerability.Dell OpenManage Enterprise
- CVE-2022-24422Dell iDRAC9 versions 5.00.00.00 and later but prior to 5.10.10.00, contain an improper authentication vulnerability.Integrated Dell Remote Access Controller
High 17
- CVE-2022-26774A logic issue was addressed with improved state management.Apple iTunes for Windows
- CVE-2022-26773A logic issue was addressed with improved state management.Apple iTunes for Windows
- CVE-2022-26772A memory corruption issue was addressed with improved state management.Apple macOS
- CVE-2022-26771A memory corruption issue was addressed with improved state management.Apple watchOS
- CVE-2022-26770An out-of-bounds read issue was addressed with improved input validation.Apple Security Update - Catalina · Apple macOS
- CVE-2022-26769A memory corruption issue was addressed with improved input validation.Apple Security Update - Catalina · Apple macOS
- CVE-2022-26768A memory corruption issue was addressed with improved state management.Apple watchOS
- CVE-2022-26763An out-of-bounds access issue was addressed with improved bounds checking.Apple watchOS
- CVE-2022-26761A memory corruption issue was addressed with improved memory handling.Apple Security Update - Catalina · Apple macOS
- CVE-2022-22675An out-of-bounds write issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS +1
- CVE-2021-33014KUKA KR C4 - Use of Hard-Coded CredentialsKUKA KR C4 · KSS
- CVE-2022-1899Out-of-bounds Read in radareorg/radare2radareorg/radare2
- CVE-2022-24418Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2022-24417Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2022-24414Dell EMC CloudLink 7.1.3 and all earlier versions, Auth Token is exposed in GET requests.Dell CloudLink
- CVE-2022-1886Heap-based Buffer Overflow in vim/vimvim/vim
- CVE-2022-22576An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connectihttps://github.com/curl/curl
Medium, low and unrated 134
- CVE-2022-30701An uncontrolled search path element vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to craft a Trend Micro Apex One
- CVE-2022-30700An incorrect permission assignment vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to load a DLTrend Micro Apex One
- CVE-2022-30687Trend Micro Maximum Security 2022 is vulnerable to a link following vulnerability that could allow a low privileged local user to manipulateTrend Micro Maximum Security
- CVE-2022-28394EOL Product CVE - Installer of Trend Micro Password Manager (Consumer) versions 3.7.0.1223 and below provided by Trend Micro Incorporated coTrend Micro Password Manager
- CVE-2022-29637An arbitrary file upload vulnerability in Mindoc v2.1-beta.5 allows attackers to execute arbitrary commands via a crafted Zip file.github.com/mindoc-org/mindoc
- CVE-2022-29633An access control issue in Linglong v1.0 allows attackers to access the background of the application via a crafted cookie.
- CVE-2022-29632An arbitrary file upload vulnerability in the component /course/api/upload/pic of Roncoo Education v9.0.0 allows attackers to execute arbitr
- CVE-2021-28509TerminAttr streams MACsec sensitive data in clear text to other authorized users in CVPArista Networks Arista EOS · Arista Networks Arista TerminA…
- CVE-2021-28508TerminAttr streams IPsec sensitive data in clear text to other authorized users in CVPArista Networks Arista EOS · Arista Networks Arista TerminA…
- CVE-2022-26767The issue was addressed with additional permissions checks.Apple macOS
- CVE-2022-26766A certificate parsing issue was addressed with improved checks.Apple watchOS
- CVE-2022-26765A race condition was addressed with improved state handling.Apple watchOS
- CVE-2022-26764A memory corruption issue was addressed with improved validation.Apple watchOS
- CVE-2022-30585The REST API in Archer Platform 6.x before 6.11 (6.11.0.0) contains an Authorization Bypass Vulnerability.
- CVE-2022-26757A use after free issue was addressed with improved memory management.Apple watchOS
- CVE-2022-26756An out-of-bounds write issue was addressed with improved input validation.Apple Security Update - Catalina · Apple macOS
- CVE-2022-26755This issue was addressed with improved environment sanitization.Apple Security Update - Catalina · Apple macOS
- CVE-2022-26754A buffer overflow issue was addressed with improved memory handling.Apple macOS
- CVE-2022-26753A buffer overflow issue was addressed with improved memory handling.Apple macOS
- CVE-2022-26752A buffer overflow issue was addressed with improved memory handling.Apple macOS
- CVE-2022-26751A memory corruption issue was addressed with improved input validation.Apple Security Update - Catalina · Apple macOS
- CVE-2022-26750A buffer overflow issue was addressed with improved memory handling.Apple macOS
- CVE-2022-26749A buffer overflow issue was addressed with improved memory handling.Apple macOS
- CVE-2022-26748An out-of-bounds write issue was addressed with improved input validation.Apple Security Update - Catalina · Apple macOS
- CVE-2022-26747This issue was addressed with improved checks.Apple Xcode
- CVE-2022-26746This issue was addressed by removing the vulnerable code.Apple Security Update - Catalina · Apple macOS
- CVE-2022-31648Talend Administration Center is vulnerable to a reflected Cross-Site Scripting (XSS) issue in the SSO login endpoint.
- CVE-2022-26745A memory corruption issue was addressed with improved validation.Apple macOS
- CVE-2022-26743An out-of-bounds write issue was addressed with improved bounds checking.Apple macOS
- CVE-2022-26742A buffer overflow issue was addressed with improved memory handling.Apple macOS
- CVE-2022-26741A buffer overflow issue was addressed with improved memory handling.Apple macOS
- CVE-2022-26740An out-of-bounds write issue was addressed with improved bounds checking.Apple tvOS
- CVE-2022-26739An out-of-bounds write issue was addressed with improved bounds checking.Apple tvOS
- CVE-2022-26738An out-of-bounds write issue was addressed with improved bounds checking.Apple tvOS
- CVE-2022-26737An out-of-bounds write issue was addressed with improved bounds checking.Apple tvOS
- CVE-2022-26736An out-of-bounds write issue was addressed with improved bounds checking.Apple tvOS
- CVE-2022-26731A logic issue was addressed with improved state management.Apple macOS
- CVE-2022-26728This issue was addressed with improved entitlements.Apple Security Update - Catalina · Apple macOS
- CVE-2022-26727This issue was addressed with improved entitlements.Apple Security Update - Catalina · Apple macOS
- CVE-2022-26726This issue was addressed with improved checks.Apple watchOS
- CVE-2022-26725A logic issue was addressed with improved state management.Apple macOS
- CVE-2022-26724An authentication issue was addressed with improved state management.Apple tvOS
- CVE-2022-26723A memory corruption issue was addressed with improved input validation.Apple macOS
- CVE-2022-26722A memory initialization issue was addressed.Apple Security Update - Catalina · Apple macOS
- CVE-2022-26721A memory initialization issue was addressed.Apple Security Update - Catalina · Apple macOS
- CVE-2022-26720An out-of-bounds write issue was addressed with improved bounds checking.Apple Security Update - Catalina · Apple macOS
- CVE-2022-26718An out-of-bounds read issue was addressed with improved input validation.Apple macOS
- CVE-2022-26715An out-of-bounds write issue was addressed with improved bounds checking.Apple Security Update - Catalina · Apple macOS
- CVE-2022-26714A memory corruption issue was addressed with improved validation.Apple watchOS
- CVE-2022-26712This issue was addressed by removing the vulnerable code.Apple macOS
- CVE-2022-26711An integer overflow issue was addressed with improved input validation.Apple watchOS
- CVE-2022-26708This issue was addressed with improved checks.Apple macOS
- CVE-2022-26706An access issue was addressed with additional sandbox restrictions on third-party applications.Apple watchOS
- CVE-2022-26704A validation issue existed in the handling of symlinks and was addressed with improved validation of symlinks.Apple macOS
- CVE-2022-26703An authorization issue was addressed with improved state management.Apple iOS and iPadOS
- CVE-2022-26701A race condition was addressed with improved locking.Apple tvOS
- CVE-2022-26698An out-of-bounds read issue was addressed with improved bounds checking.Apple Security Update - Catalina · Apple macOS
- CVE-2022-26697An out-of-bounds read issue was addressed with improved input validation.Apple Security Update - Catalina · Apple macOS
- CVE-2022-26694This issue was addressed with improved checks.Apple macOS
- CVE-2022-26693This issue was addressed with improved checks.Apple macOS
- CVE-2022-26691A logic issue was addressed with improved state management.Apple macOS
- CVE-2022-26690Description: A race condition was addressed with additional validation.Apple macOS
- CVE-2022-26688An issue in the handling of symlinks was addressed with improved validation.Apple macOS
- CVE-2022-22676An event handler validation issue in the XPC Services API was addressed by removing the service.Apple macOS
- CVE-2022-22674An out-of-bounds read issue existed that led to the disclosure of kernel memory.Apple macOS
- CVE-2022-22673This issue was addressed with improved checks.Apple iOS and iPadOS
- CVE-2022-22672A memory corruption issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS
- CVE-2022-22663This issue was addressed with improved checks to prevent unauthorized actions.Apple iOS and iPadOS · Apple macOS
- CVE-2022-22662A cookie management issue was addressed with improved state management.Apple macOS
- CVE-2022-22616This issue was addressed with improved checks.Apple macOS
- CVE-2022-30508DedeCMS v5.7.93 was discovered to contain arbitrary file deletion vulnerability in upload.php via the delete parameter.
- CVE-2022-31265The replay feature in the client in Wargaming World of Warships 0.11.4 allows remote attackers to execute code when a user launches a replay
- CVE-2021-4232Zoo Management System manage-ticket.php cross site scriptingZoo Management System
- CVE-2022-21827An improper privilege vulnerability has been discovered in Citrix Gateway Plug-in for Windows (Citrix Secure Access for Windows) <21.9.1.2 wCitrix Gateway Windows Plugin
- CVE-2022-1261Matrikon OPC Server Improper Access ControlMatrikon, a subsidiary of Honeywell Matrikon OPC Server
- CVE-2022-30495In oretnom23 Automotive Shop Management System v1.0, the name id parameter is vulnerable to IDOR - Broken Access Control allowing attackers
- CVE-2022-30493In oretnom23 Automotive Shop Management System v1.0, the product id parameter suffers from a blind SQL Injection Vulnerability allowing remo
- CVE-2022-30494In oretnom23 Automotive Shop Management System v1.0, the first and last name user fields suffer from a stored XSS Injection Vulnerability al
- CVE-2022-30516In Hospital-Management-System v1.0, the editid parameter in the doctor.php page is vulnerable to SQL injection attacks.
- CVE-2022-30500Jfinal cms 5.1.0 is vulnerable to SQL Injection.com.jflyfox:jflyfox_jfinal
- CVE-2022-30477Tenda AC Series Router AC18_V15.03.05.19(6318) was discovered to contain a stack-based buffer overflow in the httpd module when handling /go
- CVE-2022-30476Tenda AC Series Router AC18_V15.03.05.19(6318) was discovered to contain a stack-based buffer overflow in the httpd module when handling /go
- CVE-2022-30475Tenda AC Series Router AC18_V15.03.05.19(6318) was discovered to contain a stack-based buffer overflow in the httpd module when handling /go
- CVE-2022-30474Tenda AC Series Router AC18_V15.03.05.19(6318) was discovered to contain a heap overflow in the httpd module when handling /goform/saveParen
- CVE-2022-30472Tenda AC Seris Router AC18_V15.03.05.19(6318) has a stack-based buffer overflow vulnerability in function fromAddressNat
- CVE-2022-29091Dell Unity, Dell UnityVSA, and Dell UnityXT versions prior to 5.2.0.0.5.173 contain a Reflected Cross-Site Scripting Vulnerability in UnisphDell Unity
- CVE-2022-29082Dell EMC NetWorker versions 19.1.x, 19.1.0.x, 19.1.1.x, 19.2.x, 19.2.0.x, 19.2.1.x 19.3.x, 19.3.0.x, 19.4.x, 19.4.0.x, 19.5.x,19.5.0.x, 19.6Dell NetWorker
- CVE-2022-26865Dell Support Assist OS Recovery versions before 5.5.2 contain an Authentication Bypass vulnerability.Dell OS Recovery Tool
- CVE-2022-30473Tenda AC Series Router AC18_V15.03.05.19(6318) has a stack-based buffer overflow vulnerability in function form_fast_setting_wifi_set
- CVE-2022-20821Cisco IOS XR Software Health Check Open Port VulnerabilityCisco IOS XR Software
- CVE-2022-20809Cisco Expressway Series and Cisco TelePresence Video Communication Server VulnerabilitiesCisco TelePresence Video Communication Server (VCS) Express…
- CVE-2022-29689CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/singer/admin
- CVE-2022-29688CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/singer/admin
- CVE-2022-29687CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/user/level_d
- CVE-2022-29686CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/singer/admin
- CVE-2022-29685CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/User/level_s
- CVE-2022-29684CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/Label/js_del
- CVE-2022-29682CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/vod/admin/to
- CVE-2022-29683CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/Label/page_d
- CVE-2022-29680CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/user/zu_del.
- CVE-2022-29681CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/Links/del.
- CVE-2022-29676CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/lists/zh
- CVE-2022-29670CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/type/del
- CVE-2022-29669CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/news/admin/lists/z
- CVE-2022-29667CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via /admin.php/pic/admin/pic/hy.
- CVE-2022-29666CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/lists/zh
- CVE-2022-29665CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/news/admin/topic/s
- CVE-2022-29664CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/type/pl_
- CVE-2022-29663CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/type/hy.
- CVE-2022-29662CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/news/admin/news/sa
- CVE-2022-29661CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/pic/admin/ty
- CVE-2022-29660CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/pic/del.
- CVE-2022-2972174cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/jobfairol/resumelist.
- CVE-2022-2972074cmsSE v3.5.1 was discovered to contain an arbitrary file read vulnerability via the component \index\controller\Download.php.
- CVE-2021-40317Piwigo 11.5.0 is affected by a SQL injection vulnerability via admin.php and the id parameter.
- CVE-2021-42860A stack buffer overflow exists in Mini-XML v3.2.
- CVE-2021-42859A memory leak issue was discovered in Mini-XML v3.2 that could cause a denial of service.
- CVE-2021-42692There is a stack-overflow vulnerability in tinytoml v0.4 that can cause a crash or DoS.
- CVE-2022-1664directory traversal for in-place extracts with untrusted v2 and v3 source packages with debian.tarDebian dpkg
- CVE-2021-34360CSRF Bypass in Proxy ServerQNAP Systems Proxy Server
- CVE-2021-4231Angular Comment cross site scriptingAngular · @angular/core
- CVE-2022-1882A use-after-free flaw was found in the Linux kernel’s pipes functionality in how a user performs manipulations with the pipe post_one_notifikernel
- CVE-2022-21831A code injection vulnerability exists in the Active Storage >= v5.2.0 that could allow an attacker to execute code via image_processing arguhttps://github.com/rails/rails · activestorage
- CVE-2022-22577An XSS Vulnerability in Action Pack >= 5.2.0 and < 5.2.0 that could allow an attacker to bypass CSP for non HTML like responses.https://github.com/rails/rails · actionpack
- CVE-2022-26702A use after free issue was addressed with improved memory management.Apple watchOS
- CVE-2022-26744A memory corruption issue was addressed with improved state management.Apple iOS and iPadOS
- CVE-2022-27777A XSS Vulnerability in Action View tag helpers >= 5.2.0 and < 5.2.0 which would allow an attacker to inject content if able to control inputhttps://github.com/rails/rails · actionview
- CVE-2022-30783An invalid return code in fuse_kern_mount enables intercepting of libfuse-lite protocol traffic between NTFS-3G and the kernel in NTFS-3G th
- CVE-2022-30784A crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value in NTFS-3G through 2021.8.22.
- CVE-2022-30785A file handle created in fuse_lib_opendir, and later used in fuse_lib_readdir, enables arbitrary memory read and write operations in NTFS-3G
- CVE-2022-30786A crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate in NTFS-3G through 2021.8.22.
- CVE-2022-30787An integer underflow in fuse_lib_readdir enables arbitrary memory read operations in NTFS-3G through 2021.8.22 when using libfuse-lite.
- CVE-2022-30788A crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc in NTFS-3G through 2021.8.22.
- CVE-2022-30789A crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array in NTFS-3G through 2021.8.22.