CVEs published in May 2022
72 tracked CVEs from 9 vendors had their first vendor advisory published in May 2022: 2 critical, 31 high, 1 in CISA KEV. Newest first.
2 more from this month are covered only by Red Hat's per-package records, listed on the Red Hat vendor page.
- Added
CVE-2021-34360Medium
QTS: cross-site request forgery (CSRF) vulnerability has been reported to affect QNAP device running Proxy Server.
QNAP · 1 advisory - Added
CVE-2022-25762Unrated
Response mix-up with WebSocket concurrent send and close
Apache · 1 advisory - Added
CVE-2022-23742High
Check Point · 1 advisory - Added
CVE-2020-0896High
Check Point · 1 advisory - Added
CVE-2022-22971Unrated
In spring framework versions prior to 5.3.20+, 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user
VMware · 1 advisory - Added
CVE-2022-22970Unrated
In spring framework versions prior to 5.3.20+, 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object
VMware · 1 advisory - Added
CVE-2022-29885Unrated
EncryptInterceptor does not provide complete protection on insecure networks
Apache · 1 advisory - Added
CVE-2021-30361Medium
The Check Point Gaia Portal's GUI Clients allowed authenticated administrators with permission for the GUI Clients settings to…
Check Point · 1 advisory - Added
CVE-2022-23743High
Check Point ZoneAlarm before version 15.8.200.19118 allows a local actor to escalate privileges during the upgrade process
Check Point · 1 advisory - Added
CVE-2022-26931High
Windows Kerberos Elevation of Privilege Vulnerability
MS Server · 1 advisory - Added
CVE-2022-27183High
Splunk Enterprise: The Monitoring Console app configured in Distributed mode
Splunk · 1 advisory - Added
CVE-2022-26889High
In Splunk Enterprise versions before 8.1.2, the uri path to load a relative resource within a web page is vulnerable to path…
Splunk · 1 advisory - Added
CVE-2022-26070Medium
Splunk Enterprise: When handling a mismatched pre-authentication cookie, the application leaks the internal error message in the response
Splunk · 1 advisory - Added
CVE-2021-42743High
Splunk Enterprise: misconfiguration in the node default path
Splunk · 1 advisory - Added
CVE-2021-33845Medium
Splunk Enterprise: The Splunk Enterprise REST API allows enumeration of usernames via the lockout error message.
Splunk · 1 advisory - Added
CVE-2021-31559High
crafted request bypasses S2S TCP Token authentication writing arbitrary events to an index in Splunk Enterprise Indexer 8.1…
Splunk · 1 advisory - Added
CVE-2021-26253High
potential vulnerability in Splunk Enterprise's implementation of DUO MFA
Splunk · 1 advisory - Added
CVE-2020-36518High
FasterXML Jackson Databind Vulnerability in NetApp Products
NetApp · 1 advisory - Added
CVE-2021-25268High
Sophos Firewall: Multiple XSS vulnerabilities in Webadmin
Sophos · 1 advisory - Added
CVE-2021-25267Medium
Sophos Firewall: Multiple XSS vulnerabilities in Webadmin
Sophos · 1 advisory - Added
CVE-2022-29491High
On F5 BIG-IP LTM, Advanced WAF, ASM, or APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, 14.1.x versions…
F5 · 1 advisory - Added
CVE-2022-29480Medium
On F5 BIG-IP 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x
F5 · 1 advisory - Added
CVE-2022-29479Medium
On F5 BIG-IP 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all…
F5 · 1 advisory - Added
CVE-2022-29474Medium
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x…
F5 · 1 advisory - Added
CVE-2022-29473Medium
On F5 BIG-IP 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5
F5 · 1 advisory - Added
CVE-2022-29263High
On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x…
F5 · 1 advisory - Added
CVE-2022-28859Medium
On F5 BIG-IP 15.1.x versions prior to 15.1.5.1 and 14.1.x versions prior to 14.1.4.6
F5 · 1 advisory - Added
CVE-2022-28716High
BIG-IP: On 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions…
F5 · 1 advisory - Added
CVE-2022-28714High
On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x…
F5 · 1 advisory - Added
CVE-2022-28708Medium
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2 and 15.1.x versions prior to 15.1.5.1
F5 · 1 advisory - Added
CVE-2022-28707High
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, a…
F5 · 1 advisory - Added
CVE-2022-28706Medium
On F5 BIG-IP 16.1.x versions prior to 16.1.2 and 15.1.x versions prior to 15.1.5.1
F5 · 1 advisory - Added
CVE-2022-28705High
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x…
F5 · 1 advisory - Added
CVE-2022-28701High
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, when the stream profile is configured on a virtual server, undisclosed requests
F5 · 1 advisory - Added
CVE-2022-28695High
On F5 BIG-IP AFM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and…
F5 · 1 advisory - Added
CVE-2022-28691High
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and 13.1.x…
F5 · 1 advisory - Added
CVE-2022-27880Medium
On F5 Traffix SDC 5.2.x versions prior to 5.2.2 and 5.1.x versions prior to 5.1.35, a stored Cross-Site Scripting (XSS)…
F5 · 1 advisory - Added
CVE-2022-27878Medium
On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP, and F5 BIG-IP Guided Configuration (GC) all…
F5 · 1 advisory - Added
CVE-2022-27875Medium
On F5 Access for Android 3.x versions prior to 3.0.8, a Task Hijacking vulnerability exists in the F5 Access for Android…
F5 · 1 advisory - Added
CVE-2022-27806High
On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP…
F5 · 1 advisory - Added
CVE-2022-27662Medium
On F5 Traffix SDC 5.2.x versions prior to 5.2.2 and 5.1.x versions prior to 5.1.35, a stored Cross-Site Template Injection…
F5 · 1 advisory - Added
CVE-2022-27659Medium
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, an…
F5 · 1 advisory - Added
CVE-2022-27636Medium
On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x…
F5 · 1 advisory - Added
CVE-2022-27634Medium
On 16.1.x versions prior to 16.1.2.2 and 15.1.x versions prior to 15.1.5.1, BIG-IP APM does not properly validate…
F5 · 1 advisory - Added
CVE-2022-27588Critical
QVR: We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.6 build 20220401 and later
QNAP · 1 advisory - Added
CVE-2022-27495Medium
On all versions 1.3.x (fixed in 1.4.0) NGINX Service Mesh control plane endpoints are exposed to the cluster overlay network
F5 · 1 advisory - Added
CVE-2022-27230High
On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP APM, and F5 BIG-IP Guided Configuration (GC)…
F5 · 1 advisory - Added
CVE-2022-27189High
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x…
F5 · 1 advisory - Added
CVE-2022-27182Medium
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6
F5 · 1 advisory - Added
CVE-2022-27181Medium
On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x…
F5 · 1 advisory - Added
CVE-2022-26890High
On F5 BIG-IP Advanced WAF, ASM, and APM 16.1.x versions prior to 16.1.2.1, 15.1.x versions prior to 15.1.5, 14.1.x versions…
F5 · 1 advisory - Added
CVE-2022-26835Medium
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x…
F5 · 1 advisory - Added
CVE-2022-26517Medium
On F5 BIG-IP 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5
F5 · 1 advisory - Added
CVE-2022-26415High
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x…
F5 · 1 advisory - Added
CVE-2022-26372High
On F5 BIG-IP 15.1.x versions prior to 15.1.0.2, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all…
F5 · 1 advisory - Added
CVE-2022-26370Medium
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, and 14.1.x versions prior to 14.1.4.6
F5 · 1 advisory - Added
CVE-2022-26340Medium
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x…
F5 · 1 advisory - Added
CVE-2022-26130Medium
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x…
F5 · 1 advisory - Added
CVE-2022-26071High
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x…
F5 · 1 advisory - Added
CVE-2022-25990Medium
F5OS: On 1.0.x versions prior to 1.0.1, systems running F5OS-A software may expose certain registry ports externally.
F5 · 1 advisory - Added
CVE-2022-25946High
On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP…
F5 · 1 advisory - Added
CVE-2022-1468Medium
On all versions of 17.0.x, 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x on F5 BIG-IP, an authenticated iControl REST user…
F5 · 1 advisory - Added
On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP (fixed in 17.0.0), a cross-site request…
F5 · 1 advisory - Added
CVE-2022-1388CriticalCISA KEV
F5 BIG-IP Missing Authentication Vulnerability
F5 · 1 advisory - Added
CVE-2021-44057High
Photo Station: improper authentication vulnerability has been reported to affect QNAP device running Photo Station.
QNAP · 1 advisory - Added
CVE-2021-44056High
Video Station: improper authentication vulnerability has been reported to affect QNAP device running Video Station.
QNAP · 1 advisory - Added
CVE-2021-44055Medium
Video Station: missing authorization vulnerability has been reported to affect QNAP device running Video Station.
QNAP · 1 advisory - Added
CVE-2021-44054Medium
QTS: open redirect vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero and QTS.
QNAP · 1 advisory - Added
CVE-2021-44053Medium
QTS: cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running QTS, QuTS hero and QuTScloud.
QNAP · 1 advisory - Added
CVE-2021-44052Medium
QTS: improper link resolution before file access ('Link Following') vulnerability has been reported to affect QNAP device running…
QNAP · 1 advisory - Added
CVE-2021-44051High
QTS: command injection vulnerability has been reported to affect QNAP NAS running QuTScloud, QuTS hero and QTS.
QNAP · 1 advisory - Added
CVE-2021-38693Medium
path traversal vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, QTS, QVR Pro Appliance
QNAP · 1 advisory