CVEs published May 27, 2022
60 CVEs were published on May 27, 2022: 1 critical, 3 high.
- Published
- 60
- Critical
- 1
- High
- 3
- Medium
- 16
- Low
- 2
- Unrated
- 38
- Now in CISA KEV
- 0
- Fix available
- 7
Most affected products
- Cisco Common Services Platform Collector Software
- 9
- bfabiszewski/libmobi
- 2
- Cisco TelePresence Video Communication Server (VCS) Express…
- 2
- HCL Software HCL BigFix Mobile / Modern Client Management
- 2
- vim/vim
- 2
- causefx/organizr
- 1
- Cisco Enterprise Chat and Email
- 1
- Cisco Stealthwatch Enterprise
- 1
- Cisco UCS Director
- 1
- github.com/hashicorp/nomad
- 1
Critical 1
High 3
Medium, low and unrated 56
- CVE-2022-31782ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow.
- CVE-2022-29627An insecure direct object reference (IDOR) in Online Market Place Site v1.0 allows attackers to modify products that are owned by other sell
- CVE-2022-29628A cross-site scripting (XSS) vulnerability in /omps/seller of Online Market Place Site v1.0 allows attackers to execute arbitrary web cripts
- CVE-2022-29694Unicorn Engine v2.0.0-rc7 and below was discovered to contain a NULL pointer dereference via qemu_ram_free.
- CVE-2022-29695Unicorn Engine v2.0.0-rc7 contains memory leaks caused by an incomplete unicorn engine initialization.
- CVE-2022-29693Unicorn Engine v2.0.0-rc7 and below was discovered to contain a memory leak via the function uc_close at /my/unicorn/uc.c.
- CVE-2022-29692Unicorn Engine v1.0.3 was discovered to contain a use-after-free vulnerability via the hook function.
- CVE-2022-24581ACEweb Online Portal 3.5.065 allows unauthenticated SMB hash capture via UNC.
- CVE-2022-24241ACEweb Online Portal 3.5.065 was discovered to contain an External Controlled File Path and Name vulnerability via the txtFilePath parameter
- CVE-2022-24240ACEweb Online Portal 3.5.065 was discovered to contain a SQL injection vulnerability via the criteria parameter in showschedule.awp.
- CVE-2022-24239ACEweb Online Portal 3.5.065 was discovered to contain an unrestricted file upload vulnerability via attachments.awp.
- CVE-2022-24238ACEweb Online Portal 3.5.065 was discovered to contain a cross-site scripting (XSS) vulnerability via the txtNmName1 parameter in person.awp
- CVE-2022-30496SQL injection in Logon Page of IDCE MV's application, version 1.0, allows an attacker to inject SQL payloads in the user field, connecting t
- CVE-2022-30349siteserver SSCMS 6.15.51 is vulnerable to Cross Site Scripting (XSS).SSCMS
- CVE-2022-29598Solutions Atlantic Regulatory Reporting System (RRS) v500 is vulnerable to an reflected Cross-Site Scripting (XSS) vulnerability via RRSWeb/
- CVE-2022-25237Bonita Web 2021.2 is affected by a authentication/authorization bypass vulnerability due to an overly broad exclude pattern used in the Rest
- CVE-2022-30513School Dormitory Management System v1.0 is vulnerable to reflected cross-site scripting (XSS) via admin/inc/navigation.php:125
- CVE-2021-27781HCL BigFix Mobile / Modern Client Management is vulnerable to stored cross-site scriptingHCL Software HCL BigFix Mobile / Modern Client Management
- CVE-2021-27780HCL BigFix Mobile / Modern Client Management is vulnerable to unauthenticated XML interactionHCL Software HCL BigFix Mobile / Modern Client Management
- CVE-2022-30511School Dormitory Management System 1.0 is vulnerable to SQL Injection via accounts/view_details.php:4.
- CVE-2022-30514School Dormitory Management System v1.0 is vulnerable to reflected cross-site scripting (XSS) via admin/inc/navigation.php:126.
- CVE-2022-30324HashiCorp Nomad and Nomad Enterprise version 0.2.0 up to 1.3.0 were impacted by go-getter vulnerabilities enabling privilege escalation throgithub.com/hashicorp/nomad
- CVE-2022-20807Cisco Expressway Series and Cisco TelePresence Video Communication Server VulnerabilitiesCisco TelePresence Video Communication Server (VCS) Express…
- CVE-2022-20806Cisco Expressway Series and Cisco TelePresence Video Communication Server VulnerabilitiesCisco TelePresence Video Communication Server (VCS) Express…
- CVE-2022-20802Cisco Enterprise Chat and Email Stored Cross-Site Scripting VulnerabilityCisco Enterprise Chat and Email
- CVE-2022-20797Cisco Secure Network Analytics Remote Code Execution VulnerabilityCisco Stealthwatch Enterprise
- CVE-2022-20765Cisco UCS Director JavaScript Cross-Site Scripting VulnerabilityCisco UCS Director
- CVE-2022-20674Cisco Common Services Platform Collector Cross-Site Scripting VulnerabilitiesCisco Common Services Platform Collector Software
- CVE-2022-20673Cisco Common Services Platform Collector Cross-Site Scripting VulnerabilitiesCisco Common Services Platform Collector Software
- CVE-2022-20672Cisco Common Services Platform Collector Cross-Site Scripting VulnerabilitiesCisco Common Services Platform Collector Software
- CVE-2022-20671Cisco Common Services Platform Collector Cross-Site Scripting VulnerabilitiesCisco Common Services Platform Collector Software
- CVE-2022-20670Cisco Common Services Platform Collector Cross-Site Scripting VulnerabilitiesCisco Common Services Platform Collector Software
- CVE-2022-20669Cisco Common Services Platform Collector Cross-Site Scripting VulnerabilitiesCisco Common Services Platform Collector Software
- CVE-2022-20668Cisco Common Services Platform Collector Cross-Site Scripting VulnerabilitiesCisco Common Services Platform Collector Software
- CVE-2022-20667Cisco Common Services Platform Collector Cross-Site Scripting VulnerabilitiesCisco Common Services Platform Collector Software
- CVE-2022-20666Cisco Common Services Platform Collector Cross-Site Scripting VulnerabilitiesCisco Common Services Platform Collector Software
- CVE-2022-30512School Dormitory Management System 1.0 is vulnerable to SQL Injection via accounts/payment_history.php:31.
- CVE-2022-30352phpABook 0.9i is vulnerable to SQL Injection due to insufficient sanitization of user-supplied data in the "auth_user" parameter in index.ph
- CVE-2022-30423Merchandise Online Store v1.0 by oretnom23 has an arbitrary code execution (RCE) vulnerability in the user profile upload point in the syste
- CVE-2022-30506An arbitrary file upload vulnerability was discovered in MCMS 5.2.7, allowing an attacker to execute arbitrary code through a crafted ZIP finet.mingsoft:ms-mcms
- CVE-2022-30503Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_set_number at src/njs_value.h.
- CVE-2022-29780Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_array_prototype_sort at src/njs_array.c.
- CVE-2022-29779Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_value_own_enumerate at src/njs_value.c.
- CVE-2022-30425Tenda Technology Co.,Ltd HG6 3.3.0-210926 was discovered to contain a command injection vulnerability via the pingAddr and traceAddr paramet
- CVE-2022-29735Delta Controls enteliTOUCH 3.40.3935, 3.40.3706, and 3.33.4005 allows attackers to execute arbitrary commands via a crafted HTTP request.
- CVE-2022-29734A cross-site scripting (XSS) vulnerability in ICT Protege GX/WX v2.08 allows authenticated attackers to execute arbitrary web scripts or HTM
- CVE-2022-29733Delta Controls enteliTOUCH 3.40.3935, 3.40.3706, and 3.33.4005 was discovered to transmit and store sensitive information in cleartext.
- CVE-2022-29732Delta Controls enteliTOUCH 3.40.3935, 3.40.3706, and 3.33.4005 was discovered to contain a cross-site scripting (XSS) vulnerability via the
- CVE-2022-29731An access control issue in ICT Protege GX/WX 2.08 allows attackers to leak SHA1 password hashes of other users.
- CVE-2022-29729Verizon 4G LTE Network Extender GA4.38 - V0.4.038.2131 utilizes a weak default admin password generation algorithm which generates passwords
- CVE-2022-29730USR IOT 4G LTE Industrial Cellular VPN Router v1.0.36 was discovered to contain hard-coded credentials for its highest privileged account.
- CVE-2022-30510School Dormitory Management System 1.0 is vulnerable to SQL Injection via reports/daily_collection_report.php:59.
- CVE-2022-1908Buffer Over-read in bfabiszewski/libmobibfabiszewski/libmobi
- CVE-2022-1907Buffer Over-read in bfabiszewski/libmobibfabiszewski/libmobi
- CVE-2022-30521The LAN-side Web-Configuration Interface has Stack-based Buffer Overflow vulnerability in the D-Link Wi-Fi router firmware DIR-890L DIR890LA
- CVE-2022-31783Liblouis 3.21.0 has an out-of-bounds write in compileRule in compileTranslationTable.c, as demonstrated by lou_trace.