CVEs published May 31, 2022
115 CVEs were published on May 31, 2022: 6 critical, 12 high.
- Published
- 115
- Critical
- 6
- High
- 12
- Medium
- 14
- Low
- 0
- Unrated
- 83
- Now in CISA KEV
- 0
- Fix available
- 28
Most affected products
- kernel
- 5
- polonel/trudesk
- 5
- freeswitch sofia-sip
- 3
- ABB e-Design
- 2
- Keysight N6854A Geolocation server and N6841A RF Sensor sof…
- 2
- librenms/librenms
- 2
- Apache Software Foundation Apache Tika · org.apache.tika:ti…
- 1
- com.jflyfox:jflyfox_jfinal
- 1
- DNNSoftware DNN Platform
- 1
- elabftw
- 1
Critical 6
- CVE-2022-31013Authentication bypass in Vartalap chat-serverramank775 chat-server
- CVE-2022-1947Use of Incorrect Operator in polonel/trudeskpolonel/trudesk
- CVE-2022-1660Keysight N6854A Geolocation server and N6841A RF Sensor softwareKeysight N6854A Geolocation server and N6841A RF Sensor sof…
- CVE-2022-1931Incorrect Synchronization in polonel/trudeskpolonel/trudesk
- CVE-2020-28246A Server-Side Template Injection (SSTI) was discovered in Form.io 2.0.0.formio
- CVE-2022-31003Heap-based Buffer Overflow and Out-of-bounds Write in Sofia-SIPfreeswitch sofia-sip
High 12
- CVE-2022-1808Execution with Unnecessary Privileges in polonel/trudeskpolonel/trudesk
- CVE-2022-1661Keysight N6854A Geolocation server and N6841A RF Sensor softwareKeysight N6854A Geolocation server and N6841A RF Sensor sof…
- CVE-2022-31005Integer Overflow in Vapor's HTTP Range Requestvapor
- CVE-2022-31011TiDB authentication bypass vulnerabilitypingcap tidb · github.com/pingcap/tidb
- CVE-2022-29483e-Design - Multiple vulnerabilitiesABB e-Design
- CVE-2022-29258Cross-site Scripting in Filter Stream Converter Application in XWiki Platformxwiki-platform · org.xwiki.platform:xwiki-platform-filter-ui
- CVE-2022-23082CureKit - Path Traversal in isFileOutsideDirWhiteSource CureKit · io.whitesource:curekit
- CVE-2021-3555A Buffer Overflow vulnerability in the RSTP server component of Eufy Indoor 2K Indoor Camera allows a local attacker to achieve remote code Eufy Indoor 2K Indoor Camera
- CVE-2022-1926Integer Overflow or Wraparound in polonel/trudeskpolonel/trudesk
- CVE-2022-1942Heap-based Buffer Overflow in vim/vimvim/vim
- CVE-2022-31001Out-of-bounds Read in Sofia-SIPfreeswitch sofia-sip
- CVE-2022-31002Out-of-bounds Read in Sofia-SIPfreeswitch sofia-sip
Medium, low and unrated 97
- CVE-2021-27778HCL Traveler is susceptible to a cross-site scripting vulnerability which could allow an attacker to execute a malicious script to access sensitive information.HCL Software HCL Traveler
- CVE-2021-44095A SQL injection vulnerability exists in ProjectWorlds Hospital Management System in php 1.0 on login page that allows a remote attacker to c
- CVE-2021-44096EGavilan Media User-Registration-and-Login-System-With-Admin-Panel 1.0 is vulnerable to SQL Injection via profile_action - update_user.
- CVE-2021-44097EGavilan Media Contact-Form-With-Messages-Entry-Management 1.0 is vulnerable to SQL Injection via Addmessage.php.
- CVE-2021-44098EGavilan Media Expense-Management-System 1.0 is vulnerable to SQL Injection via /expense_action.php.
- CVE-2021-43512An issue was discovered in FlightRadar24 v8.9.0, v8.10.0, v8.10.2, v8.10.3, v8.10.4 for Android, allows attackers to cause unspecified conse
- CVE-2022-28945An issue in Webbank WeCube v3.2.2 allows attackers to execute a directory traversal via a crafted ZIP file.
- CVE-2021-42872TOTOLINK EX1200T V4.1.2cu.5215 is affected by a command injection vulnerability that can remotely execute arbitrary code.
- CVE-2022-31015Uncaught Exception (due to a data race) leads to process termination in WaitressPylons waitress · waitress
- CVE-2021-42204An issue was discovered in swftools through 20201222.
- CVE-2022-1893Improper Removal of Sensitive Information Before Storage or Transfer in polonel/trudeskpolonel/trudesk
- CVE-2022-29653OFCMS v1.1.4 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/comn/service/update.json.
- CVE-2022-29648A cross-site scripting (XSS) vulnerability in Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted X-Focom.jflyfox:jflyfox_jfinal
- CVE-2022-29647An issue was discovered in MCMS 5.2.7.net.mingsoft:ms-mcms
- CVE-2021-32546Missing input validation in internal/db/repo_editor.go in Gogs before 0.12.8 allows an attacker to execute code remotely.gogs.io/gogs
- CVE-2022-29624An arbitrary file upload vulnerability in the Add File function of TPCMS v3.2 allows attackers to execute arbitrary code via a crafted PHP f
- CVE-2022-30478Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in \search_product.php via the keyword parameters.
- CVE-2022-30482Ecommerce-project-with-php-and-mysqli-Fruits-Bazar- 1.0 is vulnerable to Cross Site Scripting (XSS) in \admin\add_cata.php via the ctg_name
- CVE-2022-30481Food-order-and-table-reservation-system- 1.0 is vulnerable to SQL Injection in categorywise-menu.php via the catid parameters.
- CVE-2022-29540resi-calltrace in RESI Gemini-Net 4.2 is affected by Multiple XSS issues.
- CVE-2021-33504Couchbase Server before 7.1.0 has Incorrect Access Control.
- CVE-2022-28605Hardcoded admin token in SoundBar apps in Linkplay SDK 1.00 allows remote attackers to gain admin privilege access in linkplay antifactory
- CVE-2022-24701An issue was discovered in WinAPRS 2.9.0.
- CVE-2022-24700An issue was discovered in WinAPRS 2.9.0.
- CVE-2022-24702An issue was discovered in WinAPRS 2.9.0.
- CVE-2021-36890WordPress Social Share Buttons by Supsystic plugin <= 2.2.2 - Cross-Site Request Forgery (CSRF) vulnerabilitysupsystic.com Social Share Buttons by Supsystic
- CVE-2022-31007Privilege escalation from administrator in eLabFTWelabftw
- CVE-2021-36866WordPress Easy Pricing Tables plugin <= 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityFatcat Apps Easy Pricing Tables
- CVE-2022-1797Rockwell Automation Logix Controllers Uncontrolled Resource ConsumptionRockwell Automation CompactLogix 5380 controllers · Rock… +7
- CVE-2021-42203An issue was discovered in swftools through 20201222.
- CVE-2022-1789With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva.kernel
- CVE-2022-1786A use-after-free flaw was found in the Linux kernel’s io_uring subsystem in the way a user sets up a ring with IORING_SETUP_IOPOLL with morekernel
- CVE-2021-42202An issue was discovered in swftools through 20201222.
- CVE-2021-42201An issue was discovered in swftools through 20201222.
- CVE-2021-40186DNN CMS Server-Side Request Forgery (SSRF)DNNSoftware DNN Platform
- CVE-2022-1652Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency use-after-free flaw in the bad_flkernel
- CVE-2022-1419The root cause of this vulnerability is that the ioctl$DRM_IOCTL_MODE_DESTROY_DUMB can decrease refcount of *drm_vgem_gem_object *(created ikernel
- CVE-2022-28702e-Design - Multiple vulnerabilitiesABB e-Design
- CVE-2022-30819In Wedding Management System v1.0, there is an arbitrary file upload vulnerability in the picture upload point of "photos_edit.php" file.
- CVE-2022-30820In Wedding Management v1.0, there is an arbitrary file upload vulnerability in the picture upload point of "users_edit.php" file.
- CVE-2022-30821In Wedding Management System v1.0, the editing function of the "Services" module in the background management system has an arbitrary file u
- CVE-2021-42200An issue was discovered in swftools through 20201222.
- CVE-2022-30822In Wedding Management System v1.0, there is an arbitrary file upload vulnerability in the picture upload point of "users_profile.php" file.
- CVE-2022-30823Wedding Management System v1.0 is vulnerable to SQL Injection via \admin\blog_events_edit.php.
- CVE-2022-30825Wedding Management System v1.0 is vulnerable to SQL Injection via \admin\client_edit.php.
- CVE-2022-30826Wedding Management System v1.0 is vulnerable to SQL Injection via admin\client_assign.php.
- CVE-2022-30827Wedding Management System v1.0 is vulnerable to SQL Injection via \admin\package_edit.php.
- CVE-2022-30828Wedding Management System v1.0 is vulnerable to SQL Injection via \admin\photos_edit.php.
- CVE-2021-42199An issue was discovered in swftools through 20201222.
- CVE-2022-30829Wedding Management System v1.0 is vulnerable to SQL Injection via \admin\users_edit.php.
- CVE-2022-30830Wedding Management System v1.0 is vulnerable to SQL Injection via \admin\feature_edit.php.
- CVE-2022-30831Wedding Management System v1.0 is vulnerable to SQL Injection via Wedding-Management/wedding_details.php.
- CVE-2022-30832Wedding Management System v1.0 is vulnerable to SQL Injection via /Wedding-Management/admin/client_assign.php?booking=31&user_id=.
- CVE-2021-42198An issue was discovered in swftools through 20201222.
- CVE-2022-30833Wedding Management System v1.0 is vulnerable to SQL Injection via /Wedding-Management/admin/client_edit.php?booking=31&user_id=.
- CVE-2022-30818Wedding Management System v1.0 is vulnerable to SQL injection via /Wedding-Management/admin/blog_events_edit.php?id=31.
- CVE-2022-30834Wedding Management System v1.0 is vulnerable to SQL Injection via /Wedding-Management/admin/client_manage_account_details.php?booking_id=31&
- CVE-2022-30835Wedding Management System v1.0 is vulnerable to SQL Injection.
- CVE-2022-30836Wedding Management System v1.0 is vulnerable to SQL Injection.
- CVE-2021-42197An issue was discovered in swftools through 20201222 through a memory leak in the swftools when swfdump is used.
- CVE-2021-42196An issue was discovered in swftools through 20201222.
- CVE-2022-29245Weak private key generation in SSH.NETsshnet SSH.NET · SSH.NET
- CVE-2022-30817Simple Bus Ticket Booking System 1.0 is vulnerable to SQL Injection via /SimpleBusTicket/index.php.
- CVE-2021-42195An issue was discovered in swftools through 20201222.
- CVE-2022-30804elitecms v1.01 is vulnerable to Delete any file via /admin/delete_image.php?file=.
- CVE-2022-30808elitecms 1.0.1 is vulnerable to Arbitrary code execution via admin/manage_uploads.php.
- CVE-2022-30809elitecms 1.01 is vulnerable to SQL Injection via /admin/edit_page.php?page=.
- CVE-2022-30810elitecms v1.01 is vulnerable to SQL Injection via admin/edit_post.php.
- CVE-2022-30813elitecms 1.01 is vulnerable to SQL Injection via /admin/add_post.php.
- CVE-2022-30814elitecms v1.01 is vulnerable to SQL Injection via /admin/add_sidebar.php.
- CVE-2022-29243Improper input-size validation on the user new session name in Nextcloud Servernextcloud security-advisories
- CVE-2022-29220No verification of commits origin in github-action-merge-dependabotfastify github-action-merge-dependabot
- CVE-2022-30815elitecms 1.01 is vulnerable to SQL Injection via admin/edit_sidebar.php?page=2&sidebar=
- CVE-2022-30816elitecms 1.01 is vulnerable to SQL Injection via /admin/edit_sidebar.php.
- CVE-2022-22361IBM Business Automation Workflow traditional 21.0.1 through 21.0.3, 20.0.0.1 through 20.0.0.2, 19.0.0.1 through 19.0.0.3, 18.0.0.0 through 1IBM Business Process Manager · IBM Business Automation Work…
- CVE-2022-31329Online Ordering System By janobe 2.3.2 is vulnerable to SQL Injection via /ordering/admin/orders/loaddata.php.
- CVE-2022-31328Online Ordering System By janobe 2.3.2 has SQL Injection via /ordering/admin/products/index.php?view=edit&id=.
- CVE-2022-31327Online Ordering System By janobe 2.3.2 is vulneranle to SQL Injection via /ordering/index.php?q=products&id=.
- CVE-2022-30799Online Ordering System v1.0 by oretnom23 has SQL injection via store/orderpage.php.
- CVE-2022-30798Online Ordering System v1.0 by oretnom23 is vulnerable to SQL Injection via admin/viewreport.php.
- CVE-2022-30797Online Ordering System 1.0 by oretnom23 is vulnerable to SQL Injection via admin/vieworders.php.
- CVE-2022-30795Online Ordering System v1.0 by oretnom23 is vulnerable to SQL Injection via admin/editproductimage.php.
- CVE-2022-30794Online Ordering System v1.0 by oretnom23 is vulnerable to SQL Injection via admin/editproductetails.php.
- CVE-2022-31335Online Ordering System 2.3.2 is vulnerable to SQL Injection via /ordering/admin/stockin/index.php?view=edit&id=.
- CVE-2022-31336Online Ordering System 2.3.2 is vulnerable to SQL Injection via /ordering/admin/stockin/loaddata.php.
- CVE-2022-31337Online Ordering System 2.3.2 is vulnerable to SQL Injection via /ordering/admin/category/index.php?view=edit&id=.
- CVE-2022-31338Online Ordering System 2.3.2 is vulnerable to SQL Injection via /ordering/admin/user/index.php?view=edit&id=.
- CVE-2022-29725An arbitrary file upload in the image upload component of wityCMS v0.6.2 allows attackers to execute arbitrary code via a crafted PHP file.
- CVE-2022-30973Missing fix for CVE-2022-30126 in 1.28.2Apache Software Foundation Apache Tika · org.apache.tika:ti…
- CVE-2022-29712LibreNMS v22.3.0 was discovered to contain multiple command injection vulnerabilities via the service_ip, hostname, and service_param paramelibrenms/librenms
- CVE-2022-29711LibreNMS v22.3.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /Table/GraylogController.php.librenms/librenms
- CVE-2022-30034Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass.flower
- CVE-2022-31500In KNIME Analytics Platform below 4.6.0, the Windows installer sets improper filesystem permissions.
- CVE-2022-26491An issue was discovered in Pidgin before 2.14.9.
- CVE-2022-1934Use After Free in mruby/mrubymruby/mruby
- CVE-2022-1215A format string vulnerability was found in libinputlibinput
- CVE-2022-1462An out-of-bounds read flaw was found in the Linux kernel’s TeleTYpe subsystem.kernel