Security Vulnerabilities - CVEs Published In May 2022
Openmoney API through 2020-06-29 uses the JavaScript Math.random function, which does not provide cryptographically secure random numbers.
CVSS Score
7.5
EPSS Score
0.003
Published
2022-05-16
Konica Minolta bizhub MFP devices before 2022-04-14 allow a Sandbox Escape. An attacker must attach a keyboard to a USB port, press F12, and then escape from the kiosk mode.
CVSS Score
7.4
EPSS Score
0.0
Published
2022-05-16
Gitea before 1.16.7 does not escape git fetch remote.
CVSS Score
7.5
EPSS Score
0.807
Published
2022-05-16
Janet before 1.22.0 mishandles arrays.
CVSS Score
7.5
EPSS Score
0.006
Published
2022-05-16
nfs_lookup_reply in net/nfs.c in Das U-Boot through 2022.04 (and through 2022.07-rc2) has an unbounded memcpy with a failed length check, leading to a buffer overflow. NOTE: this issue exists because of an incorrect fix for CVE-2019-14196.
CVSS Score
9.8
EPSS Score
0.002
Published
2022-05-16
Terminalfour versions 8.3.7, 8.3.x versions prior to version 8.3.8 and r 8.2.x versions prior to version 8.2.18.5 or 8.2.18.2.1 are vulnerable to (XSS) vulnerability that could be exploited by an attacker to mislead an administrator and steal their credentials.
CVSS Score
6.1
EPSS Score
0.007
Published
2022-05-16
xpdf 4.04 allocates excessive memory when presented with crafted input. This can be triggered by (for example) sending a crafted PDF document to the pdftoppm binary. It is most easily reproduced with the DCMAKE_CXX_COMPILER=afl-clang-fast++ option.
CVSS Score
5.5
EPSS Score
0.002
Published
2022-05-16
Calibre-Web before 0.6.18 allows user table SQL Injection.
CVSS Score
9.8
EPSS Score
0.003
Published
2022-05-16
ERP-Pro v3.7.5 was discovered to contain a SQL injection vulnerability via the component /base/SysEveMenuAuthPointMapper.xml..
CVSS Score
9.8
EPSS Score
0.003
Published
2022-05-15
A Server-Side Request Forgery (SSRF) in Rebuild v2.8.3 allows attackers to obtain the real IP address and scan Intranet information via the fileurl parameter.
CVSS Score
7.5
EPSS Score
0.002
Published
2022-05-15