Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: May 2022

125 records · 9 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 2 of 2

  • CVE-2022-30065
    31Monitor

    A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern

    HighCVSS 7.8No exploitEPSS 1%

    busybox · busyboxMay 18, 2022

  • CVE-2022-22978
    43Plan

    In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigure

    CriticalCVSS 9.8Proof of conceptEPSS 12%

    vmware · spring securityMay 19, 2022

  • CVE-2022-28927
    49Plan

    A remote code execution (RCE) vulnerability in Subconverter v0.7.2 allows attackers to execute arbitrary code via crafted config and url par

    CriticalCVSS 9.8No exploitEPSS 34%

    subconverter project · subconverterMay 19, 2022

  • CVE-2022-21500
    52Plan

    Vulnerability in Oracle E-Business Suite (component: Manage Proxies).

    HighCVSS 7.5Proof of conceptEPSS 71%

    oracle · e-business suiteMay 19, 2022

  • CVE-2022-28987
    24Monitor

    Zoho ManageEngine ADSelfService Plus before 6202 allows attackers to perform username enumeration via a crafted POST request to /ServletAPI/

    MediumCVSS 5.3Proof of conceptEPSS 10%

    zohocorp · manageengine adselfservice plusMay 19, 2022

  • CVE-2022-30887
    47Plan

    Pharmacy Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /php_action/editProd

    CriticalCVSS 9.8Proof of conceptEPSS 25%

    pharmacy management system project · pharmacy management systemMay 20, 2022

  • CVE-2022-28531
    43Plan

    Sourcecodester Covid-19 Directory on Vaccination System1.0 is vulnerable to SQL Injection via the admin/login.php txtusername (aka Username)

    CriticalCVSS 9.8No exploitEPSS 14%

    covid-19 directory on vaccination system project · covid-19 directory on vaccination systemMay 20, 2022

  • CVE-2022-22972
    56Plan

    VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain

    CriticalCVSS 9.8Proof of conceptEPSS 56%

    vmware · identity managerMay 20, 2022

  • CVE-2022-31259
    46Plan

    The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to bypass access control.

    CriticalCVSS 9.8No exploitEPSS 22%

    beego · beegoMay 21, 2022

  • CVE-2022-31267
    44Plan

    Gitblit 1.9.2 allows privilege escalation via the Config User Service: a control character can be placed in a profile data field, such as an

    CriticalCVSS 9.8No exploitEPSS 17%

    gitblit · gitblitMay 21, 2022

  • CVE-2022-31268
    33Monitor

    A Path Traversal vulnerability in Gitblit 1.9.3 can lead to reading website files via /resources//../ (e.g., followed by a WEB-INF or META-I

    HighCVSS 7.5Proof of conceptEPSS 10%

    gitblit · gitblitMay 21, 2022

  • CVE-2022-0781
    43Plan

    Nirweb support < 2.8.2 - Unauthenticated SQLi

    CriticalCVSS 9.8Proof of conceptEPSS 13%

    nirweb · nirweb supportMay 23, 2022

  • CVE-2021-32941
    43Plan

    Annke Network Video Recorder - Stack-based Buffer Overflow

    CriticalCVSS 9.8No exploitEPSS 14%

    annke · n48pbb firmwareMay 23, 2022

  • CVE-2022-29337
    50Plan

    C-DATA FD702XW-X-R430 v2.1.13_X001 was discovered to contain a command injection vulnerability via the va_cmd parameter in formlanipv6.

    CriticalCVSS 9.8Proof of conceptEPSS 35%

    cdatatec · fd702xw-x-r430 firmwareMay 24, 2022

  • CVE-2022-26082
    45Plan

    A file write vulnerability exists in the OAS Engine SecureTransferFiles functionality of Open Automation Software OAS Platform V16.00.0112.

    CriticalCVSS 9.8No exploitEPSS 20%

    openautomationsoftware · oas platformMay 25, 2022

  • CVE-2022-26833
    48Plan

    An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V16.00.0121.

    CriticalCVSS 9.4Proof of conceptEPSS 37%

    openautomationsoftware · oas platformMay 25, 2022

  • CVE-2022-20821
    60This week

    Cisco IOS XR Software Health Check Open Port Vulnerability

    MediumCVSS 6.5KEVWeaponizedEPSS 11%

    cisco · ios xrMay 26, 2022

  • CVE-2022-29660
    43Plan

    CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/pic/del.

    CriticalCVSS 9.8No exploitEPSS 11%

    chshcms · cscms music portal systemMay 26, 2022

  • CVE-2022-24422
    57Plan

    Dell iDRAC9 versions 5.00.00.00 and later but prior to 5.10.10.00, contain an improper authentication vulnerability.

    CriticalCVSS 9.8No exploitEPSS 58%

    dell · idrac9May 26, 2022

  • CVE-2022-22616
    40Plan

    This issue was addressed with improved checks.

    MediumCVSS 5.5WeaponizedEPSS 8%

    apple · mac os xMay 26, 2022

  • CVE-2022-22674
    52Plan

    An out-of-bounds read issue existed that led to the disclosure of kernel memory.

    MediumCVSS 5.5KEVWeaponizedEPSS 1%

    apple · mac os xMay 26, 2022

  • CVE-2022-22675
    65This week

    An out-of-bounds write issue was addressed with improved bounds checking.

    HighCVSS 7.8KEVWeaponizedEPSS 12%

    apple · ipadosMay 26, 2022

  • CVE-2022-29632
    44Plan

    An arbitrary file upload vulnerability in the component /course/api/upload/pic of Roncoo Education v9.0.0 allows attackers to execute arbitr

    CriticalCVSS 9.8No exploitEPSS 17%

    roncoo · roncoo-educationMay 26, 2022

  • CVE-2022-1556
    45Plan

    StaffList < 3.1.5 - Admin+ SQLi

    CriticalCVSS 9.8No exploitEPSS 20%

    era404 · stafflistMay 30, 2022

  • CVE-2022-31007
    36Monitor

    Privilege escalation from administrator in eLabFTW

    HighCVSS 7.2Proof of conceptEPSS 26%

    elabftw · elabftwMay 31, 2022