# CVEs published 2022-05-27

60 CVEs were published on May 27, 2022: 1 critical, 3 high. Days are UTC.

- [CVE-2022-31782](https://cve.now/CVE-2022-31782.md): ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow. (no CVSS)
- [CVE-2022-29627](https://cve.now/CVE-2022-29627.md): An insecure direct object reference (IDOR) in Online Market Place Site v1.0 allows attackers to modify products that are owned by other sell (no CVSS)
- [CVE-2022-29628](https://cve.now/CVE-2022-29628.md): A cross-site scripting (XSS) vulnerability in /omps/seller of Online Market Place Site v1.0 allows attackers to execute arbitrary web cripts (no CVSS)
- [CVE-2022-25878](https://cve.now/CVE-2022-25878.md): Prototype Pollution (CVSS 8.2, protobufjs)
- [CVE-2022-29694](https://cve.now/CVE-2022-29694.md): Unicorn Engine v2.0.0-rc7 and below was discovered to contain a NULL pointer dereference via qemu\_ram\_free. (no CVSS)
- [CVE-2022-29695](https://cve.now/CVE-2022-29695.md): Unicorn Engine v2.0.0-rc7 contains memory leaks caused by an incomplete unicorn engine initialization. (no CVSS)
- [CVE-2022-29693](https://cve.now/CVE-2022-29693.md): Unicorn Engine v2.0.0-rc7 and below was discovered to contain a memory leak via the function uc\_close at /my/unicorn/uc.c. (no CVSS)
- [CVE-2022-29692](https://cve.now/CVE-2022-29692.md): Unicorn Engine v1.0.3 was discovered to contain a use-after-free vulnerability via the hook function. (no CVSS)
- [CVE-2022-24581](https://cve.now/CVE-2022-24581.md): ACEweb Online Portal 3.5.065 allows unauthenticated SMB hash capture via UNC. (no CVSS)
- [CVE-2022-24241](https://cve.now/CVE-2022-24241.md): ACEweb Online Portal 3.5.065 was discovered to contain an External Controlled File Path and Name vulnerability via the txtFilePath parameter (no CVSS)
- [CVE-2022-24240](https://cve.now/CVE-2022-24240.md): ACEweb Online Portal 3.5.065 was discovered to contain a SQL injection vulnerability via the criteria parameter in showschedule.awp. (no CVSS)
- [CVE-2022-24239](https://cve.now/CVE-2022-24239.md): ACEweb Online Portal 3.5.065 was discovered to contain an unrestricted file upload vulnerability via attachments.awp. (no CVSS)
- [CVE-2022-24238](https://cve.now/CVE-2022-24238.md): ACEweb Online Portal 3.5.065 was discovered to contain a cross-site scripting (XSS) vulnerability via the txtNmName1 parameter in person.awp (no CVSS)
- [CVE-2022-30496](https://cve.now/CVE-2022-30496.md): SQL injection in Logon Page of IDCE MV's application, version 1.0, allows an attacker to inject SQL payloads in the user field, connecting t (no CVSS)
- [CVE-2022-30349](https://cve.now/CVE-2022-30349.md): siteserver SSCMS 6.15.51 is vulnerable to Cross Site Scripting (XSS). (no CVSS, SSCMS)
- [CVE-2022-29598](https://cve.now/CVE-2022-29598.md): Solutions Atlantic Regulatory Reporting System (RRS) v500 is vulnerable to an reflected Cross-Site Scripting (XSS) vulnerability via RRSWeb/ (no CVSS)
- [CVE-2022-25237](https://cve.now/CVE-2022-25237.md): Bonita Web 2021.2 is affected by a authentication/authorization bypass vulnerability due to an overly broad exclude pattern used in the Rest (no CVSS)
- [CVE-2022-30513](https://cve.now/CVE-2022-30513.md): School Dormitory Management System v1.0 is vulnerable to reflected cross-site scripting (XSS) via admin/inc/navigation.php:125 (no CVSS)
- [CVE-2021-27781](https://cve.now/CVE-2021-27781.md): HCL BigFix Mobile / Modern Client Management is vulnerable to stored cross-site scripting (CVSS 6.6, HCL Software HCL BigFix Mobile / Modern Client Management)
- [CVE-2021-27780](https://cve.now/CVE-2021-27780.md): HCL BigFix Mobile / Modern Client Management is vulnerable to unauthenticated XML interaction (CVSS 5.3, HCL Software HCL BigFix Mobile / Modern Client Management)
- [CVE-2022-30511](https://cve.now/CVE-2022-30511.md): School Dormitory Management System 1.0 is vulnerable to SQL Injection via accounts/view\_details.php:4. (no CVSS)
- [CVE-2022-30514](https://cve.now/CVE-2022-30514.md): School Dormitory Management System v1.0 is vulnerable to reflected cross-site scripting (XSS) via admin/inc/navigation.php:126. (no CVSS)
- [CVE-2022-30324](https://cve.now/CVE-2022-30324.md): HashiCorp Nomad and Nomad Enterprise version 0.2.0 up to 1.3.0 were impacted by go-getter vulnerabilities enabling privilege escalation thro (no CVSS, github.com/hashicorp/nomad)
- [CVE-2022-20807](https://cve.now/CVE-2022-20807.md): Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities (CVSS 4.3, Cisco TelePresence Video Communication Server (VCS) Express…)
- [CVE-2022-20806](https://cve.now/CVE-2022-20806.md): Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities (CVSS 4.3, Cisco TelePresence Video Communication Server (VCS) Express…)
- [CVE-2022-20802](https://cve.now/CVE-2022-20802.md): Cisco Enterprise Chat and Email Stored Cross-Site Scripting Vulnerability (CVSS 5.4, Cisco Enterprise Chat and Email)
- [CVE-2022-20797](https://cve.now/CVE-2022-20797.md): Cisco Secure Network Analytics Remote Code Execution Vulnerability (CVSS 5.5, Cisco Stealthwatch Enterprise)
- [CVE-2022-20765](https://cve.now/CVE-2022-20765.md): Cisco UCS Director JavaScript Cross-Site Scripting Vulnerability (CVSS 4.8, Cisco UCS Director)
- [CVE-2022-20674](https://cve.now/CVE-2022-20674.md): Cisco Common Services Platform Collector Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Common Services Platform Collector Software)
- [CVE-2022-20673](https://cve.now/CVE-2022-20673.md): Cisco Common Services Platform Collector Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Common Services Platform Collector Software)
- [CVE-2022-20672](https://cve.now/CVE-2022-20672.md): Cisco Common Services Platform Collector Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Common Services Platform Collector Software)
- [CVE-2022-20671](https://cve.now/CVE-2022-20671.md): Cisco Common Services Platform Collector Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Common Services Platform Collector Software)
- [CVE-2022-20670](https://cve.now/CVE-2022-20670.md): Cisco Common Services Platform Collector Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Common Services Platform Collector Software)
- [CVE-2022-20669](https://cve.now/CVE-2022-20669.md): Cisco Common Services Platform Collector Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Common Services Platform Collector Software)
- [CVE-2022-20668](https://cve.now/CVE-2022-20668.md): Cisco Common Services Platform Collector Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Common Services Platform Collector Software)
- [CVE-2022-20667](https://cve.now/CVE-2022-20667.md): Cisco Common Services Platform Collector Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Common Services Platform Collector Software)
- [CVE-2022-20666](https://cve.now/CVE-2022-20666.md): Cisco Common Services Platform Collector Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Common Services Platform Collector Software)
- [CVE-2022-30512](https://cve.now/CVE-2022-30512.md): School Dormitory Management System 1.0 is vulnerable to SQL Injection via accounts/payment\_history.php:31. (no CVSS)
- [CVE-2022-30352](https://cve.now/CVE-2022-30352.md): phpABook 0.9i is vulnerable to SQL Injection due to insufficient sanitization of user-supplied data in the "auth\_user" parameter in index.ph (no CVSS)
- [CVE-2022-30423](https://cve.now/CVE-2022-30423.md): Merchandise Online Store v1.0 by oretnom23 has an arbitrary code execution (RCE) vulnerability in the user profile upload point in the syste (no CVSS)
- [CVE-2022-30506](https://cve.now/CVE-2022-30506.md): An arbitrary file upload vulnerability was discovered in MCMS 5.2.7, allowing an attacker to execute arbitrary code through a crafted ZIP fi (no CVSS, net.mingsoft:ms-mcms)
- [CVE-2022-30503](https://cve.now/CVE-2022-30503.md): Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs\_set\_number at src/njs\_value.h. (no CVSS)
- [CVE-2022-29780](https://cve.now/CVE-2022-29780.md): Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs\_array\_prototype\_sort at src/njs\_array.c. (no CVSS)
- [CVE-2022-29779](https://cve.now/CVE-2022-29779.md): Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs\_value\_own\_enumerate at src/njs\_value.c. (no CVSS)
- [CVE-2022-30425](https://cve.now/CVE-2022-30425.md): Tenda Technology Co.,Ltd HG6 3.3.0-210926 was discovered to contain a command injection vulnerability via the pingAddr and traceAddr paramet (no CVSS)
- [CVE-2022-29735](https://cve.now/CVE-2022-29735.md): Delta Controls enteliTOUCH 3.40.3935, 3.40.3706, and 3.33.4005 allows attackers to execute arbitrary commands via a crafted HTTP request. (no CVSS)
- [CVE-2022-29734](https://cve.now/CVE-2022-29734.md): A cross-site scripting (XSS) vulnerability in ICT Protege GX/WX v2.08 allows authenticated attackers to execute arbitrary web scripts or HTM (no CVSS)
- [CVE-2022-29733](https://cve.now/CVE-2022-29733.md): Delta Controls enteliTOUCH 3.40.3935, 3.40.3706, and 3.33.4005 was discovered to transmit and store sensitive information in cleartext. (no CVSS)
- [CVE-2022-29732](https://cve.now/CVE-2022-29732.md): Delta Controls enteliTOUCH 3.40.3935, 3.40.3706, and 3.33.4005 was discovered to contain a cross-site scripting (XSS) vulnerability via the (no CVSS)
- [CVE-2022-29731](https://cve.now/CVE-2022-29731.md): An access control issue in ICT Protege GX/WX 2.08 allows attackers to leak SHA1 password hashes of other users. (no CVSS)
- [CVE-2022-29729](https://cve.now/CVE-2022-29729.md): Verizon 4G LTE Network Extender GA4.38 - V0.4.038.2131 utilizes a weak default admin password generation algorithm which generates passwords (no CVSS)
- [CVE-2022-29730](https://cve.now/CVE-2022-29730.md): USR IOT 4G LTE Industrial Cellular VPN Router v1.0.36 was discovered to contain hard-coded credentials for its highest privileged account. (no CVSS)
- [CVE-2022-30510](https://cve.now/CVE-2022-30510.md): School Dormitory Management System 1.0 is vulnerable to SQL Injection via reports/daily\_collection\_report.php:59. (no CVSS)
- [CVE-2022-1908](https://cve.now/CVE-2022-1908.md): Buffer Over-read in bfabiszewski/libmobi (CVSS 3.6, bfabiszewski/libmobi)
- [CVE-2022-1909](https://cve.now/CVE-2022-1909.md): Cross-site Scripting (XSS) - Stored in causefx/organizr (CVSS 9.0, causefx/organizr)
- [CVE-2022-1907](https://cve.now/CVE-2022-1907.md): Buffer Over-read in bfabiszewski/libmobi (CVSS 3.6, bfabiszewski/libmobi)
- [CVE-2022-1897](https://cve.now/CVE-2022-1897.md): Out-of-bounds Write in vim/vim (CVSS 7.8, vim/vim)
- [CVE-2022-1898](https://cve.now/CVE-2022-1898.md): Use After Free in vim/vim (CVSS 7.8, vim/vim)
- [CVE-2022-30521](https://cve.now/CVE-2022-30521.md): The LAN-side Web-Configuration Interface has Stack-based Buffer Overflow vulnerability in the D-Link Wi-Fi router firmware DIR-890L DIR890LA (no CVSS)
- [CVE-2022-31783](https://cve.now/CVE-2022-31783.md): Liblouis 3.21.0 has an out-of-bounds write in compileRule in compileTranslationTable.c, as demonstrated by lou\_trace. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-05-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.