2022 CVEs (page 102)
Page 102 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-31687 | Critical | 9.8 | 2022-11-09 | VMware Workspace ONE Assist prior to 22.10 contains a Broken Access Control vulnerability. A malicious actor with network access to Workspace ONE Assist may be… |
CVE-2022-31686 | Critical | 9.8 | 2022-11-09 | VMware Workspace ONE Assist prior to 22.10 contains a Broken Authentication Method vulnerability. A malicious actor with network access to Workspace ONE Assist… |
CVE-2022-31685 | Critical | 9.8 | 2022-11-09 | VMware Workspace ONE Assist prior to 22.10 contains an Authentication Bypass vulnerability. A malicious actor with network access to Workspace ONE Assist may b… |
CVE-2022-29836 | Low | 1.9 | 2022-11-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability was discovered via an HTTP API on Western Digital My Cloud Home; M… |
CVE-2022-27674 | High | 7.5 | 2022-11-09 | Insufficient validation in the IOCTL input/output buffer in AMD μProf may allow an attacker to bypass bounds checks potentially leading to a Windows kernel cra… |
CVE-2022-27673 | High | 7.5 | 2022-11-09 | Insufficient access controls in the AMD Link Android app may potentially result in information disclosure. |
CVE-2022-23831 | High | 7.5 | 2022-11-09 | Insufficient validation of the IOCTL input buffer in AMD μProf may allow an attacker to send an arbitrary buffer leading to a potential Windows kernel crash re… |
CVE-2022-23824 | Medium | 5.5 | 2022-11-09 | IBPB may not prevent return branch predictions from being specified by pre-IBPB branch targets leading to a potential information disclosure. |
CVE-2022-42966 | Medium | 5.9 | 2022-11-09 | An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the cleo PyPI package, when an attacker is able to supply arbitrary input to th… |
CVE-2022-42965 | Low | 3.7 | 2022-11-09 | An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the snowflake-connector-python PyPI package, when an attacker is able to supply… |
CVE-2022-42964 | Medium | 5.9 | 2022-11-09 | An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the pymatgen PyPI package, when an attacker is able to supply arbitrary input t… |
CVE-2022-3450 | High | 8.8 | 2022-11-09 | Use after free in Peer Connection in Google Chrome prior to 106.0.5249.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2022-3449 | High | 8.8 | 2022-11-09 | Use after free in Safe Browsing in Google Chrome prior to 106.0.5249.119 allowed an attacker who convinced a user to install a malicious extension to potential… |
CVE-2022-3448 | High | 8.8 | 2022-11-09 | Use after free in Permissions API in Google Chrome prior to 106.0.5249.119 allowed a remote attacker who convinced a user to engage in specific UI gestures to… |
CVE-2022-3447 | Medium | 4.3 | 2022-11-09 | Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 106.0.5249.119 allowed a remote attacker to spoof the contents of the Omnibox… |
CVE-2022-3446 | High | 8.8 | 2022-11-09 | Heap buffer overflow in WebSQL in Google Chrome prior to 106.0.5249.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pag… |
CVE-2022-3445 | High | 8.8 | 2022-11-09 | Use after free in Skia in Google Chrome prior to 106.0.5249.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
CVE-2022-32588 | High | 7.8 | 2022-11-09 | An out-of-bounds write vulnerability exists in the PICT parsing pctwread_14841 functionality of Accusoft ImageGear 20.0. A specially-crafted malformed file can… |
CVE-2022-30543 | High | 8.8 | 2022-11-09 | A leftover debug code vulnerability exists in the console infct functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted series of network req… |
CVE-2022-29888 | High | 8.1 | 2022-11-09 | A leftover debug code vulnerability exists in the httpd port 4444 upload.cgi functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted HTTP req… |
CVE-2022-29481 | Medium | 6.5 | 2022-11-09 | A leftover debug code vulnerability exists in the console nvram functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted series of network req… |
CVE-2022-28689 | High | 8.8 | 2022-11-09 | A leftover debug code vulnerability exists in the console support functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted network request can… |
CVE-2022-26023 | Medium | 6.5 | 2022-11-09 | A leftover debug code vulnerability exists in the console verify functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted series of network re… |
CVE-2022-25932 | Critical | 9.8 | 2022-11-09 | The firmware of InHand Networks InRouter302 V3.5.45 introduces fixes for TALOS-2022-1472 and TALOS-2022-1474. The fixes are incomplete. An attacker can still p… |
CVE-2022-0031 | Medium | 6.7 | 2022-11-09 | A local privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XSOAR engine software running on a Linux operating system allows a local attac… |
CVE-2022-43488 | Medium | 5.4 | 2022-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 on WordPress leading to rule type migration. |
CVE-2022-43278 | High | 7.2 | 2022-11-09 | Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the categoriesId parameter at /php_action/fetchSelectedCategories.ph… |
CVE-2022-43277 | High | 7.2 | 2022-11-09 | Canteen Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via ip/youthappam/php_action/editFile.php. This vulnerability a… |
CVE-2022-43121 | Medium | 6.1 | 2022-11-09 | A cross-site scripting (XSS) vulnerability in the CMS Field Add page of Intelliants Subrion CMS v4.2.1 allows attackers to execute arbitrary web scripts or HTM… |
CVE-2022-43120 | Medium | 6.1 | 2022-11-09 | A cross-site scripting (XSS) vulnerability in the /panel/fields/add component of Intelliants Subrion CMS v4.2.1 allows attackers to execute arbitrary web scrip… |
CVE-2022-43119 | Medium | 6.1 | 2022-11-09 | A cross-site scripting (XSS) vulnerability in Clansphere CMS v2011.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected i… |
CVE-2022-43118 | Medium | 6.1 | 2022-11-09 | A cross-site scripting (XSS) vulnerability in flatCore-CMS v2.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into… |
CVE-2022-41978 | High | 8.8 | 2022-11-09 | Auth. (subscriber+) Arbitrary Options Update vulnerability in Zoho CRM Lead Magnet plugin <= 1.7.5.8 on WordPress. |
CVE-2022-43292 | High | 7.2 | 2022-11-09 | Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /youthappam/editfood.php. |
CVE-2022-43291 | High | 7.2 | 2022-11-09 | Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /youthappam/editclient.php. |
CVE-2022-43290 | High | 7.2 | 2022-11-09 | Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /youthappam/editcategory.php. |
CVE-2022-43321 | Medium | 6.1 | 2022-11-09 | Shopwind v3.4.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the component /common/library/Page.php. |
CVE-2022-43320 | Medium | 6.1 | 2022-11-09 | FeehiCMS v2.1.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the id parameter at /web/admin/index.php?r=log%2Fview-layer. |
CVE-2022-31253 | High | 7.1 | 2022-11-09 | A Untrusted Search Path vulnerability in openldap2 of openSUSE Factory allows local attackers with control of the ldap user or group to change ownership of arb… |
CVE-2022-45062 | Critical | 9.8 | 2022-11-09 | In Xfce xfce4-settings before 4.16.4 and 4.17.x before 4.17.1, there is an argument injection vulnerability in xfce4-mime-helper. |
CVE-2022-45061 | High | 7.5 | 2022-11-09 | An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decod… |
CVE-2022-40797 | Critical | 9.8 | 2022-11-09 | Roxy Fileman 1.4.6 allows Remote Code Execution via a .phar upload, because the default FORBIDDEN_UPLOADS value in conf.json only blocks .php, .php4, and .php5… |
CVE-2022-45060 | High | 7.5 | 2022-11-09 | An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce ch… |
CVE-2022-45059 | High | 7.5 | 2022-11-09 | An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling attack can be performed on Varnish Cache servers by reque… |
CVE-2022-3890 | Critical | 9.6 | 2022-11-09 | Heap buffer overflow in Crashpad in Google Chrome on Android prior to 107.0.5304.106 allowed a remote attacker who had compromised the renderer process to pote… |
CVE-2022-3889 | High | 8.8 | 2022-11-09 | Type confusion in V8 in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2022-3888 | High | 8.8 | 2022-11-09 | Use after free in WebCodecs in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2022-3887 | High | 8.8 | 2022-11-09 | Use after free in Web Workers in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2022-3886 | High | 8.8 | 2022-11-09 | Use after free in Speech Recognition in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HT… |
CVE-2022-3885 | High | 8.8 | 2022-11-09 | Use after free in V8 in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2022-43144 | Medium | 5.4 | 2022-11-08 | A cross-site scripting (XSS) vulnerability in Canteen Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. |
CVE-2022-39328 | Critical | 9.8 | 2022-11-08 | Grafana is an open-source platform for monitoring and observability. Versions starting with 9.2.0 and less than 9.2.4 contain a race condition in the authentic… |
CVE-2022-30515 | Medium | 5.3 | 2022-11-08 | ZKTeco BioTime 8.5.4 is missing authentication on folders containing employee photos, allowing an attacker to view them through filename enumeration. |
CVE-2022-41260 | Medium | 6.1 | 2022-11-08 | SAP Financial Consolidation - version 1010, does not sufficiently encode user-controlled input which may allow an unauthenticated attacker to inject a web scri… |
CVE-2022-41259 | Medium | 6.5 | 2022-11-08 | SAP SQL Anywhere - version 17.0, allows an authenticated attacker to prevent legitimate users from accessing a SQL Anywhere database server by crashing the ser… |
CVE-2022-41258 | Medium | 6.5 | 2022-11-08 | Due to insufficient input validation, SAP Financial Consolidation - version 1010, allows an authenticated attacker to inject malicious script when running a co… |
CVE-2022-41215 | Medium | 4.7 | 2022-11-08 | SAP NetWeaver ABAP Server and ABAP Platform allows an unauthenticated attacker to redirect users to a malicious site due to insufficient URL validation. This c… |
CVE-2022-41214 | High | 8.7 | 2022-11-08 | Due to insufficient input validation, SAP NetWeaver Application Server ABAP and ABAP Platform allows an attacker with high level privileges to use a remote ena… |
CVE-2022-41212 | Medium | 4.9 | 2022-11-08 | Due to insufficient input validation, SAP NetWeaver Application Server ABAP and ABAP Platform allows an attacker with high level privileges to use a remote ena… |
CVE-2022-41211 | High | 7.0 | 2022-11-08 | Due to lack of proper memory management, when a victim opens manipulated file received from untrusted sources in SAP 3D Visual Enterprise Author and SAP 3D Vis… |
CVE-2022-41208 | Medium | 5.4 | 2022-11-08 | Due to insufficient input validation, SAP Financial Consolidation - version 1010, allows an authenticated attacker with user privileges to alter current user s… |
CVE-2022-41207 | Medium | 6.1 | 2022-11-08 | SAP Biller Direct allows an unauthenticated attacker to craft a legitimate looking URL. When clicked by an unsuspecting victim, it will use an unsensitized par… |
CVE-2022-41205 | Medium | 5.5 | 2022-11-08 | SAP GUI allows an authenticated attacker to execute scripts in the local network. On successful exploitation, the attacker can gain access to registries which… |
CVE-2022-41203 | High | 8.8 | 2022-11-08 | In some workflow of SAP BusinessObjects BI Platform (Central Management Console and BI LaunchPad), an authenticated attacker with low privileges can intercept… |
CVE-2022-3821 | Medium | 5.5 | 2022-11-08 | An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accurac… |
CVE-2022-39386 | High | 7.5 | 2022-11-08 | @fastify/websocket provides WebSocket support for Fastify. Any application using @fastify/websocket could crash if a specific, malformed packet is sent. All ve… |
CVE-2022-37015 | Critical | 9.8 | 2022-11-08 | Symantec Endpoint Detection and Response (SEDR) Appliance, prior to 4.7.0, may be susceptible to a privilege escalation vulnerability, which is a type of issue… |
CVE-2022-34825 | Critical | 9.8 | 2022-11-08 | Uncontrolled Search Path Element in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 SingleServerSafe f… |
CVE-2022-34824 | Critical | 9.8 | 2022-11-08 | Weak File and Folder Permissions vulnerability in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 Sing… |
CVE-2022-34823 | Critical | 9.8 | 2022-11-08 | Buffer overflow vulnerability in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 SingleServerSafe for… |
CVE-2022-34822 | Critical | 9.8 | 2022-11-08 | Path traversal vulnerability in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 SingleServerSafe for W… |
CVE-2022-27516 | Medium | 5.3 | 2022-11-08 | User login brute force protection functionality bypass |
CVE-2022-27513 | High | 8.3 | 2022-11-08 | Remote desktop takeover via phishing |
CVE-2022-27510 | Critical | 9.8 | 2022-11-08 | Unauthorized access to Gateway user capabilities |
CVE-2022-20465 | Medium | 4.6 | 2022-11-08 | In dismiss and related functions of KeyguardHostViewController.java and related files, there is a possible lockscreen bypass due to a logic error in the code… |
CVE-2022-20462 | High | 7.8 | 2022-11-08 | In phNxpNciHal_write_unlocked of phNxpNciHal.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of… |
CVE-2022-20457 | Medium | 5.5 | 2022-11-08 | In getMountModeInternal of StorageManagerService.java, there is a possible prevention of package installation due to improper input validation. This could lead… |
CVE-2022-20454 | Medium | 6.7 | 2022-11-08 | In fdt_next_tag of fdt.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System exec… |
CVE-2022-20453 | Medium | 5.5 | 2022-11-08 | In update of MmsProvider.java, there is a possible constriction of directory permissions due to a path traversal error. This could lead to local denial of serv… |
CVE-2022-20452 | High | 7.8 | 2022-11-08 | In initializeFromParcelLocked of BaseBundle.java, there is a possible method arbitrary code execution due to a confused deputy. This could lead to local escala… |
CVE-2022-20451 | High | 7.8 | 2022-11-08 | In onCallRedirectionComplete of CallsManager.java, there is a possible permissions bypass due to a missing permission check. This could lead to local escalatio… |
CVE-2022-20450 | High | 7.8 | 2022-11-08 | In restorePermissionState of PermissionManagerServiceImpl.java, there is a possible way to bypass user consent due to a missing permission check. This could le… |
CVE-2022-20448 | Medium | 5.5 | 2022-11-08 | In buzzBeepBlinkLocked of NotificationManagerService.java, there is a possible way to share data across users due to a permissions bypass. This could lead to l… |
CVE-2022-20447 | Medium | 6.5 | 2022-11-08 | In PAN_WriteBuf of pan_api.cc, there is a possible out of bounds read due to a use after free. This could lead to remote information disclosure over Bluetooth… |
CVE-2022-20446 | Low | 3.3 | 2022-11-08 | In AlwaysOnHotwordDetector of AlwaysOnHotwordDetector.java, there is a possible way to access the microphone from the background due to a missing permission ch… |
CVE-2022-20445 | High | 7.5 | 2022-11-08 | In process_service_search_rsp of sdp_discovery.cc, there is a possible out of bounds read due to improper input validation. This could lead to remote informati… |
CVE-2022-20441 | High | 7.8 | 2022-11-08 | In navigateUpTo of Task.java, there is a possible way to launch an unexported intent handler due to a logic error in the code. This could lead to local escalat… |
CVE-2022-20426 | Medium | 5.5 | 2022-11-08 | In multiple functions of many files, there is a possible obstruction of the user's ability to select a phone account due to resource exhaustion. This could lea… |
CVE-2022-20414 | Medium | 5.5 | 2022-11-08 | In setImpl of AlarmManagerService.java, there is a possible way to put a device into a boot loop due to an uncaught exception. This could lead to local denial… |
CVE-2022-32618 | Medium | 6.8 | 2022-11-08 | In typec, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to local escalation of privilege, for an atta… |
CVE-2022-32617 | Medium | 6.8 | 2022-11-08 | In typec, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to local escalation of privilege, for an atta… |
CVE-2022-32616 | Medium | 6.7 | 2022-11-08 | In isp, there is a possible out of bounds write due to uninitialized data. This could lead to local escalation of privilege with System execution privileges ne… |
CVE-2022-32615 | Medium | 6.7 | 2022-11-08 | In ccd, there is a possible out of bounds write due to uninitialized data. This could lead to local escalation of privilege with System execution privileges ne… |
CVE-2022-32614 | Medium | 6.7 | 2022-11-08 | In audio, there is a possible memory corruption due to a logic error. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2022-32613 | Medium | 6.4 | 2022-11-08 | In vcu, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2022-32612 | Medium | 6.4 | 2022-11-08 | In vcu, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. U… |
CVE-2022-32611 | Medium | 6.7 | 2022-11-08 | In isp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2022-32610 | Medium | 6.4 | 2022-11-08 | In vcu, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. U… |
CVE-2022-32609 | Medium | 6.4 | 2022-11-08 | In vcu, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. U… |
CVE-2022-32608 | Medium | 6.4 | 2022-11-08 | In jpeg, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed… |