2022 CVEs (page 100)
Page 100 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-26024 | Medium | 6.7 | 2022-11-11 | Improper access control in the Intel(R) NUC HDMI Firmware Update Tool for NUC7i3DN, NUC7i5DN and NUC7i7DN before version 1.78.2.0.7 may allow an authenticated… |
CVE-2022-26006 | High | 8.2 | 2022-11-11 | Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local… |
CVE-2022-25917 | Medium | 6.0 | 2022-11-11 | Uncaught exception in the firmware for some Intel(R) Server Board M50CYP Family before version R01.01.0005 may allow a privileged user to potentially enable a… |
CVE-2022-21794 | High | 7.7 | 2022-11-11 | Improper authentication in BIOS firmware for some Intel(R) NUC Boards, Intel(R) NUC Business, Intel(R) NUC Enthusiast, Intel(R) NUC Kits before version HN0067… |
CVE-2022-21198 | High | 7.9 | 2022-11-11 | Time-of-check time-of-use race condition in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of priv… |
CVE-2022-3952 | Low | 2.6 | 2022-11-11 | A vulnerability has been found in ManyDesigns Portofino 5.3.2 and classified as problematic. Affected by this vulnerability is the function createTempDir of th… |
CVE-2022-3950 | Low | 3.5 | 2022-11-11 | A vulnerability, which was classified as problematic, was found in sanluan PublicCMS. Affected is the function initLink of the file dwz.min.js of the component… |
CVE-2022-41854 | Medium | 5.8 | 2022-11-11 | Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an a… |
CVE-2022-3949 | Low | 3.5 | 2022-11-11 | A vulnerability, which was classified as problematic, has been found in Sourcecodester Simple Cashiering System. This issue affects some unknown processing of… |
CVE-2022-3948 | Medium | 6.3 | 2022-11-11 | A vulnerability classified as critical was found in eolinker goku_lite. This vulnerability affects unknown code of the file /plugin/getList. The manipulation o… |
CVE-2022-3947 | Medium | 6.3 | 2022-11-11 | A vulnerability classified as critical has been found in eolinker goku_lite. This affects an unknown part of the file /balance/service/list. The manipulation o… |
CVE-2022-3945 | Medium | 5.3 | 2022-11-11 | Improper Restriction of Excessive Authentication Attempts in GitHub repository kareadita/kavita prior to 0.6.0.3. |
CVE-2022-3944 | Medium | 6.3 | 2022-11-11 | A vulnerability was found in jerryhanjj ERP. It has been declared as critical. Affected by this vulnerability is the function uploadImages of the file applicat… |
CVE-2022-3943 | Low | 3.5 | 2022-11-11 | A vulnerability was found in ForU CMS. It has been classified as problematic. Affected is an unknown function of the file cms_chip.php. The manipulation of the… |
CVE-2022-3942 | Medium | 4.3 | 2022-11-11 | A vulnerability was found in SourceCodester Sanitization Management System and classified as problematic. This issue affects some unknown processing of the fil… |
CVE-2022-3941 | Medium | 5.3 | 2022-11-11 | A vulnerability has been found in Activity Log Plugin and classified as critical. This vulnerability affects unknown code of the component HTTP Header Handler… |
CVE-2022-3940 | Low | 3.5 | 2022-11-11 | A vulnerability, which was classified as problematic, was found in lanyulei ferry. This affects an unknown part of the file apis/process/task.go. The manipulat… |
CVE-2022-3939 | Medium | 6.3 | 2022-11-11 | A vulnerability, which was classified as critical, has been found in lanyulei ferry. Affected by this issue is some unknown functionality of the file apis/publ… |
CVE-2022-41892 | High | 8.6 | 2022-11-11 | Arches is a web platform for creating, managing, & visualizing geospatial data. Versions prior to 6.1.2, 6.2.1, and 7.1.2 are vulnerable to SQL Injection. With… |
CVE-2022-41873 | Medium | 4.2 | 2022-11-11 | Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. Versions prior to 4.9 are vulnerable to an Out-of-bounds read. W… |
CVE-2022-36938 | Critical | 9.8 | 2022-11-11 | DexLoader function get_stringidx_fromdex() in Redex prior to commit 3b44c64 can load an out of bound address when loading the string index table, potentially a… |
CVE-2022-41878 | High | 7.2 | 2022-11-10 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 5.3.2 or 4.10.19, keywords that ar… |
CVE-2022-42460 | Medium | 6.5 | 2022-11-10 | Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS) in Traffic Manager plugin <= 1.4.5 on WordPress. |
CVE-2022-41607 | Medium | 6.2 | 2022-11-10 | All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior’s application programmable interface (API) is vulnerable to directory traversal through… |
CVE-2022-40981 | Medium | 5.9 | 2022-11-10 | All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior is vulnerable to malicious file upload. An attacker could take advantage of this to sto… |
CVE-2022-40225 | Medium | 6.5 | 2022-11-10 | A vulnerability has been identified in SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0) (All versions < V2.4.8), TIM 1531 IRC (6GK7543-1MX00-0XE0) (All versions < V2.4… |
CVE-2022-3703 | High | 7.6 | 2022-11-10 | All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior’s web portal is vulnerable to accepting malicious firmware packages that could provide… |
CVE-2022-43679 | Medium | 4.2 | 2022-11-10 | The Docker image of ownCloud Server through 10.11 contains a misconfiguration that renders the trusted_domains config useless. This could be abused to spoof th… |
CVE-2022-41879 | High | 7.2 | 2022-11-10 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 5.3.3 or 4.10.20, a compromised Pa… |
CVE-2022-41876 | High | 7.5 | 2022-11-10 | ezplatform-graphql is a GraphQL server implementation for Ibexa DXP and Ibexa Open Source. Versions prior to 2.3.12 and 1.0.13 are subject to Insecure Storage… |
CVE-2022-41874 | Low | 2.6 | 2022-11-10 | Tauri is a framework for building binaries for all major desktop platforms. In versions prior to 1.0.7 and 1.1.2, Tauri is vulnerable to an Incorrectly-Resolve… |
CVE-2022-35740 | Medium | 6.1 | 2022-11-10 | dotCMS before 22.06 allows remote attackers to bypass intended access control and obtain sensitive information by using a semicolon in a URL to introduce a mat… |
CVE-2022-26088 | Medium | 5.4 | 2022-11-10 | An issue was discovered in BMC Remedy before 22.1. Email-based Incident Forwarding allows remote authenticated users to inject HTML (such as an SSRF payload) i… |
CVE-2022-43074 | Critical | 9.8 | 2022-11-10 | AyaCMS v3.1.2 was discovered to contain an arbitrary file upload vulnerability via the component /admin/fst_upload.inc.php. This vulnerability allows attackers… |
CVE-2022-41719 | High | 7.5 | 2022-11-10 | Unmarshal can panic on some inputs, possibly allowing for denial of service attacks. |
CVE-2022-39394 | Low | 3.8 | 2022-11-10 | Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's C API implementation where the definition of the `wasmti… |
CVE-2022-39393 | High | 8.6 | 2022-11-10 | Wasmtime is a standalone runtime for WebAssembly. Prior to versions 2.0.2 and 1.0.2, there is a bug in Wasmtime's implementation of its pooling instance alloca… |
CVE-2022-39392 | Medium | 5.9 | 2022-11-10 | Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's implementation of its pooling instance allocator when th… |
CVE-2022-39388 | High | 7.6 | 2022-11-10 | Istio is an open platform to connect, manage, and secure microservices. In versions on the 1.15.x branch prior to 1.15.3, a user can impersonate any workload i… |
CVE-2022-39395 | Critical | 9.6 | 2022-11-10 | Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. In Vela Server and Vela Worker prior to version 0.16.0 a… |
CVE-2022-36022 | Medium | 5.3 | 2022-11-10 | Deeplearning4J is a suite of tools for deploying and training deep learning models using the JVM. Packages org.deeplearning4j:dl4j-examples and org.deeplearnin… |
CVE-2022-44727 | Critical | 9.1 | 2022-11-10 | The EU Cookie Law GDPR (Banner + Blocker) module before 2.1.3 for PrestaShop allows SQL Injection via a cookie ( lgcookieslaw or __lglaw ). |
CVE-2022-45063 | Critical | 9.8 | 2022-11-10 | xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command execution within the vi lin… |
CVE-2022-34666 | Medium | 6.5 | 2022-11-10 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a local user with basic capabilities can cause a null-… |
CVE-2022-44089 | Critical | 9.8 | 2022-11-10 | ESPCMS P8.21120101 was discovered to contain a remote code execution (RCE) vulnerability in the component IS_GETCACHE. |
CVE-2022-44088 | Critical | 9.8 | 2022-11-10 | ESPCMS P8.21120101 was discovered to contain a remote code execution (RCE) vulnerability in the component INPUT_ISDESCRIPTION. |
CVE-2022-44087 | Critical | 9.8 | 2022-11-10 | ESPCMS P8.21120101 was discovered to contain a remote code execution (RCE) vulnerability in the component UPFILE_PIC_ZOOM_HIGHT. |
CVE-2022-43754 | Low | 2.6 | 2022-11-10 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in spacewalk/Uyuni of SUSE Linux Enterprise Module for SU… |
CVE-2022-43753 | Medium | 4.3 | 2022-11-10 | A Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in spacewalk/Uyuni of SUSE Linux Enterprise Module for SUSE Mana… |
CVE-2022-39038 | High | 8.8 | 2022-11-10 | Agentflow BPM enterprise management system has improper authentication. A remote attacker with general user privilege can change the name of the user account t… |
CVE-2022-39037 | High | 7.5 | 2022-11-10 | Agentflow BPM file download function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to bypass authentica… |
CVE-2022-39036 | Critical | 9.8 | 2022-11-10 | The file upload function of Agentflow BPM has insufficient filtering for special characters in URLs. An unauthenticated remote attacker can exploit this vulner… |
CVE-2022-38122 | High | 7.5 | 2022-11-10 | UPSMON PRO transmits sensitive data in cleartext over HTTP protocol. An unauthenticated remote attacker can exploit this vulnerability to access sensitive data. |
CVE-2022-38121 | Medium | 6.5 | 2022-11-10 | UPSMON PRO configuration file stores user password in plaintext under public user directory. A remote attacker with general user privilege can access all users… |
CVE-2022-38120 | Medium | 6.5 | 2022-11-10 | UPSMON PRO’s has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerability to bypass authentication and acce… |
CVE-2022-38119 | Critical | 9.8 | 2022-11-10 | UPSMON Pro login function has insufficient authentication. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and get a… |
CVE-2022-31255 | Medium | 4.3 | 2022-11-10 | An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in spacewalk/Uyuni of SUSE Linux Enterprise Module for SUSE Man… |
CVE-2022-42787 | High | 8.8 | 2022-11-10 | Multiple W&T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker ca… |
CVE-2022-42786 | Medium | 5.4 | 2022-11-10 | Multiple W&T Products of the ComServer Series are prone to an XSS attack. An authenticated remote Attacker can execute arbitrary web scripts or HTML via a craf… |
CVE-2022-45130 | Medium | 6.5 | 2022-11-10 | Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password. NOTE: Obsidian is a specific version of the Plesk… |
CVE-2022-45129 | High | 7.5 | 2022-11-10 | Payara before 2022-11-04, when deployed to the root context, allows attackers to visit META-INF and WEB-INF, a different vulnerability than CVE-2022-37422. Thi… |
CVE-2022-3867 | Low | 2.7 | 2022-11-10 | HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 event stream subscribers using a token with TTL receive updates until token garbage is collected. Fixed… |
CVE-2022-3866 | Medium | 5.0 | 2022-11-10 | HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 workload identity token can list non-sensitive metadata for paths under nomad/ that belong to other jobs… |
CVE-2022-39398 | High | 8.8 | 2022-11-10 | tasklists is a tasklists plugin for GLPI (Kanban). Versions prior to 2.0.3 are vulnerable to Cross-site Scripting. Cross-site Scripting (XSS) - Create XSS in t… |
CVE-2022-39396 | Critical | 9.8 | 2022-11-10 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 4.10.18, and prior to 5.3.1 on the 5… |
CVE-2022-3819 | Low | 3.5 | 2022-11-10 | An improper authorization issue in GitLab CE/EE affecting all versions from 15.0 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows a malic… |
CVE-2022-3818 | Medium | 5.3 | 2022-11-10 | An uncontrolled resource consumption issue when parsing URLs in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15… |
CVE-2022-3793 | Medium | 4.3 | 2022-11-10 | An improper authorization issue in GitLab CE/EE affecting all versions from 14.4 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an atta… |
CVE-2022-3726 | Medium | 4.8 | 2022-11-10 | Lack of sand-boxing of OpenAPI documents in GitLab CE/EE affecting all versions from 12.6 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allow… |
CVE-2022-3706 | Low | 3.1 | 2022-11-10 | Improper authorization in GitLab CE/EE affecting all versions from 7.14 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows a user retrying… |
CVE-2022-3413 | Medium | 4.3 | 2022-11-10 | Incorrect authorization during display of Audit Events in GitLab EE affecting all versions from 14.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 1… |
CVE-2022-39368 | High | 8.2 | 2022-11-10 | Eclipse Californium is a Java implementation of RFC7252 - Constrained Application Protocol for IoT Cloud services. In versions prior to 3.7.0, and 2.7.4, Calif… |
CVE-2022-3486 | Medium | 4.7 | 2022-11-09 | An open redirect vulnerability in GitLab EE/CE affecting all versions from 9.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2, allows an attac… |
CVE-2022-3483 | Medium | 5.5 | 2022-11-09 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.1 before 15.3.5, all versions starting from 15.4 before 15.4.4, all versio… |
CVE-2022-3285 | Medium | 5.3 | 2022-11-09 | Bypass of healthcheck endpoint allow list affecting all versions from 12.0 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows an unauthoriz… |
CVE-2022-3280 | Low | 3.5 | 2022-11-09 | An open redirect in GitLab CE/EE affecting all versions from 10.1 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to trick u… |
CVE-2022-3265 | High | 7.3 | 2022-11-09 | A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. It was… |
CVE-2022-39307 | Medium | 6.7 | 2022-11-09 | Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is made to the `/api/user… |
CVE-2022-2761 | Medium | 4.3 | 2022-11-09 | An information disclosure issue in GitLab CE/EE affecting all versions from 14.4 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an atta… |
CVE-2022-44590 | Medium | 6.4 | 2022-11-09 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in James Lao's Simple Video Embedder plugin <= 2.2 on WordPress. |
CVE-2022-44244 | Medium | 6.6 | 2022-11-09 | An authentication bypass in Lin-CMS v0.2.1 allows attackers to escalate privileges to Super Administrator. |
CVE-2022-41128 | High | 8.8 | 2022-11-09 | Windows Scripting Languages Remote Code Execution Vulnerability |
CVE-2022-41125 | High | 7.8 | 2022-11-09 | Windows CNG Key Isolation Service Elevation of Privilege Vulnerability |
CVE-2022-41123 | High | 7.8 | 2022-11-09 | Microsoft Exchange Server Elevation of Privilege Vulnerability |
CVE-2022-41122 | Medium | 6.5 | 2022-11-09 | Microsoft SharePoint Server Spoofing Vulnerability |
CVE-2022-41120 | High | 7.8 | 2022-11-09 | Microsoft Windows System Monitor (Sysmon) Elevation of Privilege Vulnerability |
CVE-2022-41119 | High | 7.8 | 2022-11-09 | Visual Studio Remote Code Execution Vulnerability |
CVE-2022-41118 | High | 7.5 | 2022-11-09 | Windows Scripting Languages Remote Code Execution Vulnerability |
CVE-2022-41116 | Medium | 5.9 | 2022-11-09 | Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerability |
CVE-2022-41114 | High | 7.0 | 2022-11-09 | Windows Bind Filter Driver Elevation of Privilege Vulnerability |
CVE-2022-41113 | High | 7.8 | 2022-11-09 | Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability |
CVE-2022-41109 | High | 7.8 | 2022-11-09 | Windows Win32k Elevation of Privilege Vulnerability |
CVE-2022-41107 | High | 7.8 | 2022-11-09 | Microsoft Office Graphics Remote Code Execution Vulnerability |
CVE-2022-41106 | High | 8.8 | 2022-11-09 | Microsoft Excel Remote Code Execution Vulnerability |
CVE-2022-41105 | Medium | 5.5 | 2022-11-09 | Microsoft Excel Information Disclosure Vulnerability |
CVE-2022-41104 | Medium | 5.5 | 2022-11-09 | Microsoft Excel Security Feature Bypass Vulnerability |
CVE-2022-41103 | Medium | 5.5 | 2022-11-09 | Microsoft Word Information Disclosure Vulnerability |
CVE-2022-41102 | High | 7.8 | 2022-11-09 | Windows Overlay Filter Elevation of Privilege Vulnerability |
CVE-2022-41101 | High | 7.8 | 2022-11-09 | Windows Overlay Filter Elevation of Privilege Vulnerability |
CVE-2022-41100 | High | 7.8 | 2022-11-09 | Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability |