CVEs published in May 2022
2,612 vulnerabilities, 425 critical, 9 exploited.
- vmware identity manager, vrealize automation, workspace one access +2 more +4 moreVMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication...9.8 Critical
- vmware identity manager, workspace one access, cloud foundation +1 more +3 moreVMware Workspace ONE Access and Identity Manager contain a privilege escalation vulnerability. A...7.8 High
- wow-company hover effects, hover effects – easily create any hover effect (wordpress plugin) +1 moreWordPress Hover Effects plugin <= 2.1 - Authenticated Local File Inclusion (LFI) vulnerability6.8 Medium
- disable right click for wp wordpress right click for wp, aftab muni disable right click for wp (wordpress plugin) +1 moreWordPress Disable Right Click For WP plugin <= 1.1.6 - Cross-Site Request Forgery (CSRF) vulnerability4.3 Medium
- dicer project dicerDenial of Service (DoS)7.5 High
- 2joomla 2j slideshow, 2j slideshow team slideshow, image slider by 2j (wordpress plugin) +1 moreWordPress Slideshow, Image Slider by 2J plugin <= 1.3.54 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability5.4 Medium
- url-regex project url-regexRegular Expression Denial of Service (ReDoS)5.3 Medium
- wow-estore herd effects, wow-company herd effects (wordpress plugin) +1 moreWordPress Herd Effects plugin <= 5.2 - Local File Inclusion (LFI) vulnerability6.8 Medium
- wpwham checkout files upload for woocommerce, wp wham checkout files upload for woocommerce (wordpress plugin) +1 moreWordPress Checkout Files Upload for WooCommerce plugin <= 2.1.2 - Cross-Site Scripting (XSS) vulnerability6.1 Medium
- oxilab image hover effects ultimate, biplob adhikari image hover effects ultimate (wordpress plugin) +1 moreWordPress Image Hover Effects Ultimate plugin <= 9.7.1 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability4.8 Medium
- dvankooten mc4wp: mailchimp for wordpress, ibericode mailchimp for wordpress +1 moreWordPress MC4WP plugin <= 4.8.6 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability4.8 Medium
- gocdCommand Injection/Argument Injection in GoCD8.8 High
- gocdReflected XSS in GoCD4.3 Medium
- gocdDOM-based XSS in GoCD4.3 Medium
- yogeshojha rengineRengine v1.0.2 was discovered to contain a remote code execution (RCE) vulnerability via the yaml...9.8 Critical
- ciliumImproper Privilege Management in Cilium7.5 High
- covid-19 directory on vaccination system project directory on vaccination systemSourcecodester Covid-19 Directory on Vaccination System1.0 is vulnerable to SQL Injection via the...9.8 Critical
- ciliumIncorrect Default Permissions in Cilium8.8 High
- wasm3 project wasm3Buffer overflow in wasm37.8 High
- polonel polonel/trudesk, trudesk project trudesk +1 moreImproper Privilege Management in polonel/trudesk9.9 Critical
- ibm websphere application serverIBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0, with the Ajax Proxy Web Application ...5.6 Medium
- ibm jazz team serverIBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to stored cross-site...6.4 Medium
- ethereum go-ethereum, go ethereum +1 moreDoS via malicious p2p message in Go-Ethereum5.9 Medium
- grafanaGrafana Enterprise datasource network restrictions bypass via HTTP redirects6.6 Medium
- nextcloud server, kiteworks security-advisories +1 moreBypass of password requirements when sharing a folder via the Circles app in Nextcloud Server3.5 Low
- nextcloud, kiteworks security-advisories +1 moreSensitive files/data exist after deletion of user account in Nextcloud Android2.8 Low
- nextcloud deck, kiteworks security-advisories +1 moreError in deleting deck cards attachment reveals the full application path in Nextcloud Deck3.5 Low
- nextcloud deck, kiteworks security-advisories +1 morePossibility for anyone to add a stack with existing tasks on anyone's board in Nextcloud Deck5.0 Medium
- sooteway wi-fi range extender project wi-fi range extenderSOOTEWAY Wi-Fi Range Extender v1.5 was discovered to use default credentials (the admin password...7.2 High
- pix-link lv-wr09 firmwarePix-Link MiNi Router 28K.MiniRouter.20190211 was discovered to contain a stored cross-site...5.4 Medium
- pix-link lv-wr09 firmwarePix-Link MiNi Router 28K.MiniRouter.20190211 was discovered to contain a stored cross-site...5.4 Medium
- grafanaThe querier component in Grafana Enterprise Logs 1.1.x through 1.3.x before 1.4.0 does not...9.8 Critical
- mailcow mailcow\mailcow before 2022-05d allows a remote authenticated user to inject OS commands and escalate...8.8 High
- argoproj argo cd, argo-cd +1 moreArgo CD will blindly trust JWT claims if anonymous access is enabled10.0 Critical
- argoproj argo cd, argo-cd +1 moreArgo CD login screen allows message spoofing if SSO is enabled4.3 Medium
- argoproj argo cd, argo-cd +1 moreSymlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server4.3 Medium
- school dormitory management system project dormitory management systemSchool Dormitory Management System v1.0 was discovered to contain a SQL injection vulnerability...9.8 Critical
- pharmacy management system project management systemPharmacy Management System v1.0 was discovered to contain a remote code execution (RCE)...9.8 Critical
- chatbot application with a suggestion feature project application with a suggestion featureChatBot Application with a Suggestion Feature 1.0 was discovered to contain a SQL injection...9.8 Critical
- minitool partition wizardMiniTool Partition Wizard v12.0 contains an unquoted service path which allows attackers to...7.8 High
- bdtask multi store inventory management systemMulti Store Inventory Management System v1.0 allows attackers to perform an account takeover via...9.8 Critical
- phpgurukul online banquet booking systemA Cross-Site Request Forgery (CSRF) in Online Banquet Booking System v1.0 allows attackers to...8.8 High
- bdtask multi store inventory management systemMulti Store Inventory Management System v1.0 was discovered to contain an information disclosure...7.5 High
- online sports complex booking system project sports complex booking systemOnline Sports Complex Booking System v1.0 was discovered to allow attackers to take over user...9.8 Critical
- online sports complex booking system project sports complex booking systemOnline Sports Complex Booking System v1.0 was discovered to contain a blind SQL injection...9.8 Critical
- battleyeBattlEye v0.9 contains an unquoted service path which allows attackers to escalate privileges to...7.8 High
- foxit pdf editorFoxit PDF Editor v11.3.1 was discovered to contain an arbitrary file upload vulnerability.9.8 Critical
- sony playmemories homeSony PlayMemories Home v6.0 contains an unquoted service path which allows attackers to escalate...6.7 Medium
- hma hidemyassHMA VPN v5.3.5913.0 contains an unquoted service path which allows attackers to escalate...7.8 High
- simple student quarterly result\/grade system project student quarterly result\/grade systemSimple Student Quarterly Result/Grade System v1.0 was discovered to contain a SQL injection...9.8 Critical
- Show moreLoading…