2022 CVEs (page 104)
Page 104 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-44795 | Medium | 6.5 | 2022-11-07 | An issue was discovered in Object First Ootbi BETA build 1.0.7.712. A flaw was found in the Web Service, which could lead to local information disclosure. The… |
CVE-2022-44794 | High | 8.8 | 2022-11-07 | An issue was discovered in Object First Ootbi BETA build 1.0.7.712. Management protocol has a flow which allows a remote attacker to execute arbitrary Bash cod… |
CVE-2022-44793 | Medium | 6.5 | 2022-11-07 | handle_ipv6IpForwarding in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.4.3 through 5.9.3 has a NULL Pointer Exception bug that can be used by a remote att… |
CVE-2022-44792 | Medium | 6.5 | 2022-11-07 | handle_ipDefaultTTL in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.8 through 5.9.3 has a NULL Pointer Exception bug that can be used by a remote attacker… |
CVE-2022-42919 | High | 7.8 | 2022-11-07 | Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-default configuration. The Python multiprocessing libra… |
CVE-2022-42905 | Critical | 9.1 | 2022-11-07 | In wolfSSL before 5.5.2, if callback functions are enabled (via the WOLFSSL_CALLBACKS flag), then a malicious TLS 1.3 client or network attacker can trigger a… |
CVE-2022-37710 | High | 7.8 | 2022-11-07 | Patterson Dental Eaglesoft 21 has AES-256 encryption but there are two ways to obtain a keyfile: (1) keybackup.data > License > Encryption Key or (2) Eaglesoft… |
CVE-2022-40284 | High | 7.8 | 2022-11-06 | A buffer overflow was discovered in NTFS-3G before 2022.10.3. Crafted metadata in an NTFS image can cause code execution. A local attacker can exploit this if… |
CVE-2022-44544 | Critical | 9.8 | 2022-11-06 | Mahara 21.04 before 21.04.7, 21.10 before 21.10.5, 22.04 before 22.04.3, and 22.10 before 22.10.0 potentially allow a PDF export to trigger a remote shell if t… |
CVE-2022-42707 | High | 7.5 | 2022-11-06 | In Mahara 21.04 before 21.04.7, 21.10 before 21.10.5, 22.04 before 22.04.3, and 22.10 before 22.10.0, embedded images are accessible without a sufficient permi… |
CVE-2022-3869 | Medium | 6.1 | 2022-11-05 | Code Injection in GitHub repository froxlor/froxlor prior to 0.10.38.2. |
CVE-2022-3868 | Medium | 4.7 | 2022-11-05 | A vulnerability classified as critical has been found in SourceCodester Sanitization Management System. Affected is an unknown function of the file /php-sms/cl… |
CVE-2022-43572 | High | 7.5 | 2022-11-04 | In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, sending a malformed file through the Splunk-to-Splunk (S2S) or HTTP Event Collector (HEC) protoco… |
CVE-2022-43570 | High | 8.8 | 2022-11-04 | In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, an authenticated user can perform an extensible markup language (XML) external entity (XXE) injec… |
CVE-2022-43569 | High | 8.0 | 2022-11-04 | In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, an authenticated user can inject and store arbitrary scripts that can lead to persistent cross-si… |
CVE-2022-43568 | High | 8.8 | 2022-11-04 | In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a View allows for a Reflected Cross Site Scripting via JavaScript Object Notation (JSON) in a que… |
CVE-2022-43567 | High | 8.8 | 2022-11-04 | In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system commands remotely through the use of spe… |
CVE-2022-43566 | High | 7.3 | 2022-11-04 | In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more privileged user’s permissions to bypass… |
CVE-2022-43565 | High | 8.1 | 2022-11-04 | In Splunk Enterprise versions below 8.2.9 and 8.1.12, the way that the ‘tstats command handles Javascript Object Notation (JSON) lets an attacker bypass SPL s… |
CVE-2022-43564 | Medium | 4.9 | 2022-11-04 | In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a remote user who can create search macros and schedule search reports can cause a denial of serv… |
CVE-2022-43563 | High | 8.1 | 2022-11-04 | In Splunk Enterprise versions below 8.2.9 and 8.1.12, the way that the rex search command handles field names lets an attacker bypass SPL safeguards for risky… |
CVE-2022-43562 | Low | 3.0 | 2022-11-04 | In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, Splunk Enterprise fails to properly validate and escape the Host header, which could let a remote… |
CVE-2022-39384 | Medium | 5.6 | 2022-11-04 | OpenZeppelin Contracts is a library for secure smart contract development. Before version 4.4.1 but after 3.2.0, initializer functions that are invoked separat… |
CVE-2022-38654 | Medium | 5.5 | 2022-11-04 | HCL Domino is susceptible to an information disclosure vulnerability. In some scenarios, local calls made on the server to search the Domino directory will ig… |
CVE-2022-39344 | Critical | 9.8 | 2022-11-04 | Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. Prior to version 6.1.12, the USB D… |
CVE-2022-38660 | High | 8.3 | 2022-11-04 | HCL XPages applications are susceptible to a Cross Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker could exploit this vulnerability to… |
CVE-2022-43945 | High | 7.5 | 2022-11-04 | The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer overflow. NFSD tracks the number of pages held by each NFSD t… |
CVE-2022-40263 | Medium | 6.6 | 2022-11-04 | BD Totalys MultiProcessor, versions 1.70 and earlier, contain hardcoded credentials. If exploited, threat actors may be able to access, modify or delete sensit… |
CVE-2022-39387 | Critical | 9.1 | 2022-11-04 | XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Prior to version 1.29.1, even if a wiki has an OpenID provider configured through… |
CVE-2022-31691 | Critical | 9.8 | 2022-11-04 | Spring Tools 4 for Eclipse version 4.16.0 and below as well as VSCode extensions such as Spring Boot Tools, Concourse CI Pipeline Editor, Bosh Editor and Cloud… |
CVE-2022-27894 | Medium | 4.8 | 2022-11-04 | The Foundry Blobster service was found to have a cross-site scripting (XSS) vulnerability that could have allowed an attacker with access to Foundry to launch… |
CVE-2022-20969 | Medium | 4.8 | 2022-11-04 | A vulnerability in multiple management dashboard pages of Cisco Umbrella could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS)… |
CVE-2022-20963 | Medium | 5.4 | 2022-11-04 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct a cross-… |
CVE-2022-20962 | Low | 3.8 | 2022-11-04 | A vulnerability in the Localdisk Management feature of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to make unauthorized… |
CVE-2022-20961 | High | 8.8 | 2022-11-04 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cros… |
CVE-2022-20960 | High | 7.5 | 2022-11-04 | A vulnerability in Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated remote attacker to cause a denial of service… |
CVE-2022-20958 | High | 8.3 | 2022-11-04 | A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot application could allow an unauthenticated, remote attacker to perform a se… |
CVE-2022-20956 | High | 7.1 | 2022-11-04 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to bypass authoriza… |
CVE-2022-20951 | High | 7.7 | 2022-11-04 | A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot application could allow an authenticated, remote attacker to perform a serv… |
CVE-2022-20942 | Medium | 6.5 | 2022-11-04 | A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA), Cisco Secure Email and Web Manager, and Cisco Secure Web Applian… |
CVE-2022-20937 | Medium | 5.3 | 2022-11-04 | A vulnerability in a feature that monitors RADIUS requests on Cisco Identity Services Engine (ISE) Software could allow an unauthenticated, remote attacker to… |
CVE-2022-20868 | Medium | 4.7 | 2022-11-04 | A vulnerability in the web-based management interface of Cisco Email Security Appliance, Cisco Secure Email and Web Manager and Cisco Secure Web Appliance coul… |
CVE-2022-20867 | Medium | 5.4 | 2022-11-04 | A vulnerability in web-based management interface of the of Cisco Email Security Appliance and Cisco Secure Email and Web Manager could allow an authenticated… |
CVE-2022-20772 | Medium | 4.7 | 2022-11-04 | A vulnerability in Cisco Email Security Appliance (ESA) and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to conduct an HT… |
CVE-2022-27893 | Medium | 4.2 | 2022-11-04 | The Foundry Magritte plugin osisoft-pi-web-connector versions 0.15.0 - 0.43.0 was found to be logging in a manner that captured authentication requests. This v… |
CVE-2022-41671 | High | 7.0 | 2022-11-04 | A CWE-89: Improper Neutralization of Special Elements used in SQL Command (‘SQL Injection’) vulnerability exists that allows adversaries with local user privil… |
CVE-2022-41670 | High | 7.0 | 2022-11-04 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in the SGIUtility component that allows adversari… |
CVE-2022-41669 | High | 7.0 | 2022-11-04 | A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists in the SGIUtility component that allows adversaries with local user privileges… |
CVE-2022-3721 | Medium | 4.6 | 2022-11-04 | Code Injection in GitHub repository froxlor/froxlor prior to 0.10.39. |
CVE-2022-41668 | High | 7.0 | 2022-11-04 | A CWE-704: Incorrect Project Conversion vulnerability exists that allows adversaries with local user privileges to load a project file from an adversary-contro… |
CVE-2022-41667 | High | 7.0 | 2022-11-04 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that allows adversaries with local user privilege… |
CVE-2022-3340 | Medium | 5.9 | 2022-11-04 | XML External Entity (XXE) vulnerability in Trellix IPS Manager prior to 10.1 M8 allows a remote authenticated administrator to perform XXE attack in the admini… |
CVE-2022-3023 | Critical | 9.8 | 2022-11-04 | Use of Externally-Controlled Format String in GitHub repository pingcap/tidb prior to 6.4.0, 6.1.3. |
CVE-2022-38582 | Medium | 6.5 | 2022-11-04 | Incorrect access control in the anti-virus driver wsdkd.sys of Watchdog Antivirus v1.4.158 allows attackers to write arbitrary files. |
CVE-2022-33684 | High | 8.1 | 2022-11-04 | The Apache Pulsar C++ Client does not verify peer TLS certificates when making HTTPS calls for the OAuth2.0 Client Credential Flow, even when tlsAllowInsecureC… |
CVE-2022-44724 | High | 8.9 | 2022-11-04 | The Handy Tip macro in Stiltsoft Handy Macros for Confluence Server/Data Center 3.x before 3.5.5 allows remote attackers to inject arbitrary HTML or JavaScript… |
CVE-2022-41666 | High | 7.0 | 2022-11-04 | A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that allows adversaries with local user privileges to load a malicious DLL whi… |
CVE-2022-43571 | High | 8.8 | 2022-11-03 | In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through the dashboard PDF generation component. |
CVE-2022-43561 | Medium | 6.4 | 2022-11-03 | In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a remote user that holds the “power” Splunk role can store arbitrary scripts that can lead to per… |
CVE-2022-38168 | Critical | 9.1 | 2022-11-03 | Broken Access Control in User Authentication in Avaya Scopia Pathfinder 10 and 20 PTS version 8.3.7.0.4 allows remote unauthenticated attackers to bypass the l… |
CVE-2022-44628 | Medium | 5.9 | 2022-11-03 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in JumpDEMAND Inc. 4ECPS Web Forms plugin <= 0.2.17 on WordPress. |
CVE-2022-44627 | Medium | 5.4 | 2022-11-03 | Cross-Site Request Forgery (CSRF) vulnerability in David Cole Simple SEO plugin <= 1.8.12 on WordPress allows attackers to create or delete sitemaps. |
CVE-2022-43574 | High | 7.5 | 2022-11-03 | "IBM Robotic Process Automation 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to incorrect permission assignment which could allow access to applica… |
CVE-2022-43495 | Medium | 6.5 | 2022-11-03 | OpenHarmony-v3.1.2 and prior versions had a DOS vulnerability in distributedhardware_device_manager when joining a network. Network attakcers can send an abono… |
CVE-2022-43451 | High | 8.4 | 2022-11-03 | OpenHarmony-v3.1.2 and prior versions had an Multiple path traversal vulnerability in appspawn and nwebspawn services. Local attackers can create arbitrary dir… |
CVE-2022-43449 | Medium | 6.2 | 2022-11-03 | OpenHarmony-v3.1.2 and prior versions had an Arbitrary file read vulnerability via download_server. Local attackers can install an malicious application on the… |
CVE-2022-43063 | High | 7.2 | 2022-11-03 | Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Users.php?f=delete_client. |
CVE-2022-43062 | High | 7.2 | 2022-11-03 | Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_appoi… |
CVE-2022-43061 | High | 7.2 | 2022-11-03 | Online Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload vulnerability in the component /operations/travellers.php. Thi… |
CVE-2022-42749 | Medium | 6.1 | 2022-11-03 | CandidATS version 3.0.0 on 'page' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the… |
CVE-2022-42748 | Medium | 6.1 | 2022-11-03 | CandidATS version 3.0.0 on 'sortDirection' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible bec… |
CVE-2022-42747 | Medium | 6.1 | 2022-11-03 | CandidATS version 3.0.0 on 'sortBy' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because th… |
CVE-2022-42746 | Medium | 6.1 | 2022-11-03 | CandidATS version 3.0.0 on 'indexFile' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because… |
CVE-2022-42745 | High | 7.5 | 2022-11-03 | CandidATS version 3.0.0 allows an external attacker to read arbitrary files from the server. This is possible because the application is vulnerable to XXE. |
CVE-2022-42744 | Critical | 9.8 | 2022-11-03 | CandidATS version 3.0.0 allows an external attacker to perform CRUD operations on the application databases. This is possible because the application does not… |
CVE-2022-42743 | Medium | 5.3 | 2022-11-03 | deep-parse-json version 1.0.2 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correct… |
CVE-2022-42442 | Low | 3.3 | 2022-11-03 | IBM Robotic Process Automation for Cloud Pak 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to exposure of the first tenant owner e-mail address to… |
CVE-2022-41714 | Medium | 5.3 | 2022-11-03 | fastest-json-copy version 1.0.1 allows an external attacker to edit or add new properties to an object. This is possible because the application does not corre… |
CVE-2022-41713 | Medium | 5.3 | 2022-11-03 | deep-object-diff version 1.1.0 allows an external attacker to edit or add new properties to an object. This is possible because the application does not proper… |
CVE-2022-41710 | Medium | 5.5 | 2022-11-03 | Markdownify version 1.4.1 allows an external attacker to remotely obtain arbitrary local files on any client that attempts to view a malicious markdown file th… |
CVE-2022-40747 | Critical | 9.1 | 2022-11-03 | "IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploi… |
CVE-2022-40276 | Medium | 5.5 | 2022-11-03 | Zettlr version 2.3.0 allows an external attacker to remotely obtain arbitrary local files on any client that attempts to view a malicious markdown file through… |
CVE-2022-40235 | Medium | 6.5 | 2022-11-03 | "IBM InfoSphere Information Server 11.7 could allow a user to cause a denial of service by removing the ability to run jobs due to improper input validation. I… |
CVE-2022-40230 | Medium | 6.5 | 2022-11-03 | "IBM MQ Appliance 9.2 CD, 9.2 LTS, 9.3 CD, and LTS 9.3 does not invalidate session after logout which could allow an authenticated user to impersonate another… |
CVE-2022-40131 | Medium | 5.4 | 2022-11-03 | Cross-Site Request Forgery (CSRF) vulnerability in a3rev Software Page View Count plugin <= 2.5.5 on WordPress allows an attacker to reset the plugin settings. |
CVE-2022-38712 | Medium | 5.9 | 2022-11-03 | "IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Web services could allow a man-in-the-middle attacker to conduct SOAPAction spoofing to execute unwant… |
CVE-2022-38710 | Medium | 5.3 | 2022-11-03 | IBM Robotic Process Automation 21.0.1 and 21.0.2 could disclose sensitive version to an unauthorized control sphere information that could aid in further attac… |
CVE-2022-36428 | Medium | 4.8 | 2022-11-03 | Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Stage Rock Convert plugin <= 2.11.0 on WordPress. |
CVE-2022-36404 | Medium | 5.4 | 2022-11-03 | Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in David Cole Simple SEO (WordPress plugin) plugin <= 1.8.12 versions. |
CVE-2022-35717 | High | 7.8 | 2022-11-03 | "IBM InfoSphere Information Server 11.7 could allow a locally authenticated attacker to execute arbitrary commands on the system by sending a specially crafted… |
CVE-2022-35642 | Medium | 5.4 | 2022-11-03 | "IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2022-35279 | Medium | 4.3 | 2022-11-03 | "IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.2, 21.0.3, and 22.0.1 could disclose sen… |
CVE-2022-34339 | Medium | 6.5 | 2022-11-03 | "IBM Cognos Analytics 11.2.1, 11.2.0, 11.1.7 stores user credentials in plain clear text which can be read by an authenticated user. IBM X-Force ID: 229963." |
CVE-2022-30615 | Medium | 5.4 | 2022-11-03 | "IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2022-30608 | High | 8.8 | 2022-11-03 | "IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions… |
CVE-2022-25952 | Medium | 4.3 | 2022-11-03 | Cross-Site Request Forgery (CSRF) vulnerability in Keywordrush Content Egg plugin <= 5.4.0 on WordPress. |
CVE-2022-22442 | Medium | 6.5 | 2022-11-03 | "IBM InfoSphere Information Server 11.7 could allow an authenticated user to access information restricted to users with elevated privileges due to improper ac… |
CVE-2022-22425 | Critical | 9.8 | 2022-11-03 | "IBM InfoSphere Information Server 11.7 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by… |
CVE-2022-3258 | Low | 3.7 | 2022-11-03 | Incorrect Permission Assignment for Critical Resource vulnerability in HYPR Workforce Access on Windows allows Authentication Abuse. |
CVE-2022-43372 | Medium | 4.8 | 2022-11-03 | Emlog Pro v1.7.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability at /admin/store.php. |