2022 CVEs (page 109)
Page 109 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-41973 | High | 7.8 | 2022-10-29 | multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with CVE-2022-41974. Local users able to… |
CVE-2022-3754 | Critical | 9.8 | 2022-10-29 | Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8. |
CVE-2022-42916 | High | 7.5 | 2022-10-29 | In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed to use HTTPS directl… |
CVE-2022-2826 | Low | 2.7 | 2022-10-28 | An issue has been discovered in GitLab affecting all versions starting from 10.0 before 12.9.8, all versions starting from 12.10 before 12.10.7, all versions s… |
CVE-2022-43286 | Critical | 9.8 | 2022-10-28 | Nginx NJS v0.7.2 was discovered to contain a heap-use-after-free bug caused by illegal memory copy in the function njs_json_parse_iterator_call at njs_json.c. |
CVE-2022-43285 | High | 7.5 | 2022-10-28 | Nginx NJS v0.7.4 was discovered to contain a segmentation violation in njs_promise_reaction_job. NOTE: the vendor disputes the significance of this report beca… |
CVE-2022-43284 | High | 7.5 | 2022-10-28 | Nginx NJS v0.7.2 to v0.7.4 was discovered to contain a segmentation violation via njs_scope_valid_value at njs_scope.h. NOTE: the vendor disputes the significa… |
CVE-2022-43283 | Medium | 5.5 | 2022-10-28 | wasm2c v1.0.29 was discovered to contain an abort in CWriter::Write. |
CVE-2022-43282 | High | 7.1 | 2022-10-28 | wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallIndirectExpr->GetReturnCallDropKeepCount. |
CVE-2022-43281 | High | 7.8 | 2022-10-28 | wasm-interp v1.0.29 was discovered to contain a heap overflow via the component std::vector<wabt::Type, std::allocator<wabt::Type>>::size() at /bits/stl_vector… |
CVE-2022-43280 | High | 7.1 | 2022-10-28 | wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallExpr->GetReturnCallDropKeepCount. |
CVE-2022-37621 | Critical | 9.8 | 2022-10-28 | Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the fullPath variable in resolve-shims.js. |
CVE-2022-3708 | Critical | 9.6 | 2022-10-28 | The Web Stories plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including 1.24.0 due to insufficient validation of URL… |
CVE-2022-3402 | Medium | 6.1 | 2022-10-28 | The Log HTTP Requests plugin for WordPress is vulnerable to Stored Cross-Site Scripting via logged HTTP requests in versions up to, and including, 1.3.1 due to… |
CVE-2022-3401 | High | 8.8 | 2022-10-28 | The Bricks theme for WordPress is vulnerable to remote code execution due to the theme allowing site editors to include executable code blocks in website conte… |
CVE-2022-43233 | High | 7.2 | 2022-10-28 | Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the userid parameter at /php_action/fetchSelectedUser.php. |
CVE-2022-43232 | High | 7.2 | 2022-10-28 | Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the userid parameter at /php_action/fetchOrderData.php. |
CVE-2022-43231 | High | 7.2 | 2022-10-28 | Canteen Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via /youthappam/manage_website.php. This vulnerability allows a… |
CVE-2022-43230 | High | 7.2 | 2022-10-28 | Simple Cold Storage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=bookings/view_details. |
CVE-2022-43229 | High | 7.2 | 2022-10-28 | Simple Cold Storage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /bookings/update_status.php. |
CVE-2022-43228 | High | 7.2 | 2022-10-28 | Barangay Management System v1.0 was discovered to contain a SQL injection vulnerability via the hidden_id parameter at /clearance/clearance.php. |
CVE-2022-41648 | Critical | 9.8 | 2022-10-28 | The HEIDENHAIN Controller TNC 640 NC software Version 340590 07 SP5, is vulnerable to improper authentication in its DNC communication for CNC machines. Authen… |
CVE-2022-41636 | Critical | 9.1 | 2022-10-28 | Communication traffic involving "Ethernet Q Commands" service of Haas Controller version 100.20.000.1110 is transmitted in cleartext. This allows an attacker t… |
CVE-2022-3228 | Medium | 6.5 | 2022-10-28 | Using custom code, an attacker can write into name or description fields larger than the appropriate buffer size causing a stack-based buffer overflow on Host… |
CVE-2022-2475 | Critical | 9.8 | 2022-10-28 | Haas Controller version 100.20.000.1110 has insufficient granularity of access control when using the "Ethernet Q Commands" service. Any user is able to write… |
CVE-2022-2474 | Critical | 9.8 | 2022-10-28 | Authentication is currently unsupported in Haas Controller version 100.20.000.1110 when using the “Ethernet Q Commands” service, which allows any user on the s… |
CVE-2022-43170 | Medium | 5.4 | 2022-10-28 | A stored cross-site scripting (XSS) vulnerability in the Dashboard Configuration feature (index.php?module=dashboard_configure/index) of Rukovoditel v3.2.1 all… |
CVE-2022-43169 | Medium | 5.4 | 2022-10-28 | A stored cross-site scripting (XSS) vulnerability in the Users Access Groups feature (/index.php?module=users_groups/users_groups) of Rukovoditel v3.2.1 allows… |
CVE-2022-43168 | Critical | 9.8 | 2022-10-28 | Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the reports_id parameter. |
CVE-2022-43167 | Medium | 5.4 | 2022-10-28 | A stored cross-site scripting (XSS) vulnerability in the Users Alerts feature (/index.php?module=users_alerts/users_alerts) of Rukovoditel v3.2.1 allows authen… |
CVE-2022-43166 | Medium | 5.4 | 2022-10-28 | A stored cross-site scripting (XSS) vulnerability in the Global Entities feature (/index.php?module=entities/entities) of Rukovoditel v3.2.1 allows authenticat… |
CVE-2022-43165 | Medium | 5.4 | 2022-10-28 | A stored cross-site scripting (XSS) vulnerability in the Global Variables feature (/index.php?module=global_vars/vars) of Rukovoditel v3.2.1 allows authenticat… |
CVE-2022-43164 | Medium | 5.4 | 2022-10-28 | A stored cross-site scripting (XSS) vulnerability in the Global Lists feature (/index.php?module=global_lists/lists) of Rukovoditel v3.2.1 allows authenticated… |
CVE-2022-3400 | Medium | 6.5 | 2022-10-28 | The Bricks theme for WordPress is vulnerable to authorization bypass due to a missing capability check on the bricks_save_post AJAX action in versions 1.0 to 1… |
CVE-2022-39366 | Critical | 9.9 | 2022-10-28 | DataHub is an open-source metadata platform. Prior to version 0.8.45, the `StatelessTokenService` of the DataHub metadata service (GMS) does not verify the sig… |
CVE-2022-2864 | High | 8.8 | 2022-10-28 | The demon image annotation plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.7. This is due to missing nonce… |
CVE-2022-3697 | High | 7.5 | 2022-10-28 | A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an a… |
CVE-2022-39367 | High | 8.6 | 2022-10-28 | QTIWorks is a software suite for standards-based assessment delivery. Prior to version 1.0-beta15, the QTIWorks Engine allows users to upload QTI content packa… |
CVE-2022-37426 | Medium | 4.3 | 2022-10-28 | Unrestricted Upload of File with Dangerous Type vulnerability in OpenNebula OpenNebula core on Linux allows File Content Injection. |
CVE-2022-37425 | Critical | 9.9 | 2022-10-28 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in OpenNebula OpenNebula core on Linux allows Remote Code Inc… |
CVE-2022-37424 | Medium | 6.5 | 2022-10-28 | Files or Directories Accessible to External Parties vulnerability in OpenNebula on Linux allows File Discovery. |
CVE-2022-3018 | Medium | 6.8 | 2022-10-28 | An information disclosure vulnerability in GitLab CE/EE affecting all versions starting from 9.3 before 15.2.5, all versions starting from 15.3 before 15.3.4… |
CVE-2022-2882 | Medium | 5.5 | 2022-10-28 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versio… |
CVE-2022-43276 | High | 7.2 | 2022-10-28 | Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the productId parameter at /php_action/fetchSelectedfood.php. |
CVE-2022-43275 | High | 7.2 | 2022-10-28 | Canteen Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via /youthappam/php_action/editProductImage.php. This vulnerabi… |
CVE-2022-3741 | Critical | 9.8 | 2022-10-28 | Impact varies for each individual vulnerability in the application. For generation of accounts, it may be possible, depending on the amount of system resources… |
CVE-2022-3512 | Medium | 6.7 | 2022-10-28 | Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch" feature resulting in Zero Trust policies… |
CVE-2022-3337 | Medium | 6.7 | 2022-10-28 | It was possible for a user to delete a VPN profile from WARP mobile client on iOS platform despite the Lock WARP switch https://developers.cloudflare.com/clou… |
CVE-2022-3322 | Medium | 6.7 | 2022-10-28 | Lock Warp switch is a feature of Zero Trust platform which, when enabled, prevents users of enrolled devices from disabling WARP client. Due to insufficient… |
CVE-2022-3321 | Medium | 6.7 | 2022-10-28 | It was possible to bypass Lock WARP switch feature https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-… |
CVE-2022-3320 | Medium | 6.7 | 2022-10-28 | It was possible to bypass policies configured for Zero Trust Secure Web Gateway by using warp-cli 'set-custom-endpoint' subcommand. Using this command with an… |
CVE-2022-3735 | Medium | 6.3 | 2022-10-28 | A vulnerability was found in seccome Ehoney. It has been rated as critical. This issue affects some unknown processing of the file /api/public/signup. The mani… |
CVE-2022-3734 | Medium | 6.3 | 2022-10-28 | A vulnerability was found in a port or fork of Redis. It has been declared as critical. This vulnerability affects unknown code in the library C:/Program Files… |
CVE-2022-3733 | Medium | 5.0 | 2022-10-28 | A vulnerability was found in SourceCodester Web-Based Student Clearance System. It has been classified as critical. This affects an unknown part of the file Ad… |
CVE-2022-3732 | Medium | 6.3 | 2022-10-28 | A vulnerability was found in seccome Ehoney and classified as critical. Affected by this issue is some unknown functionality of the file /api/v1/bait/set. The… |
CVE-2022-3731 | Medium | 6.3 | 2022-10-28 | A vulnerability has been found in seccome Ehoney and classified as critical. Affected by this vulnerability is an unknown functionality of the file /api/v1/att… |
CVE-2022-3730 | Medium | 6.3 | 2022-10-28 | A vulnerability, which was classified as critical, was found in seccome Ehoney. Affected is an unknown function of the file /api/v1/attack/falco. The manipulat… |
CVE-2022-3729 | Medium | 6.3 | 2022-10-28 | A vulnerability, which was classified as critical, has been found in seccome Ehoney. This issue affects some unknown processing of the file /api/v1/attack. The… |
CVE-2022-26884 | Medium | 6.5 | 2022-10-28 | Users can read any files by log server, Apache DolphinScheduler users should upgrade to version 2.0.6 or higher. |
CVE-2022-3616 | Medium | 5.4 | 2022-10-28 | Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash… |
CVE-2022-37915 | Critical | 9.8 | 2022-10-28 | A vulnerability in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote attacker to run arbitr… |
CVE-2022-37914 | Critical | 9.8 | 2022-10-28 | Vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote attacker to bypass aut… |
CVE-2022-37913 | Critical | 9.8 | 2022-10-28 | Vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote attacker to bypass aut… |
CVE-2022-33859 | High | 8.1 | 2022-10-28 | A security vulnerability was discovered in the Eaton Foreseer EPMS software. Foreseer EPMS connects an operation’s vast array of devices to assist in the reduc… |
CVE-2022-31678 | Critical | 9.1 | 2022-10-28 | VMware Cloud Foundation (NSX-V) contains an XML External Entity (XXE) vulnerability. On VCF 3.x instances with NSX-V deployed, this may allow a user to exploit… |
CVE-2022-3379 | High | 7.8 | 2022-10-27 | Horner Automation's Cscape version 9.90 SP7 and prior does not properly validate user-supplied data. If a user opens a maliciously formed FNT file, then an at… |
CVE-2022-3378 | High | 7.8 | 2022-10-27 | Horner Automation's Cscape version 9.90 SP 7 and prior does not properly validate user-supplied data. If a user opens a maliciously formed FNT file, then an a… |
CVE-2022-41773 | High | 8.8 | 2022-10-27 | The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in CheckDIACloud. A low-privileged authenticated a… |
CVE-2022-41702 | High | 8.7 | 2022-10-27 | The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the InsertReg API. |
CVE-2022-41701 | High | 8.7 | 2022-10-27 | The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the PutShift API. |
CVE-2022-41651 | High | 8.7 | 2022-10-27 | The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the SetPF API. |
CVE-2022-41627 | Medium | 4.8 | 2022-10-27 | The physical IoT device of the AliveCor's KardiaMobile, a smartphone-based personal electrocardiogram (EKG) has no encryption for its data-over-sound protocol… |
CVE-2022-41555 | High | 8.7 | 2022-10-27 | The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the PutLineMessageSetting… |
CVE-2022-41133 | High | 8.8 | 2022-10-27 | The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in GetDIAE_line_message_settingsListParameters. A… |
CVE-2022-40967 | High | 8.8 | 2022-10-27 | The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in CheckIoTHubNameExisted. A low-privileged authen… |
CVE-2022-40965 | High | 8.7 | 2022-10-27 | The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the PostEnergyType API. |
CVE-2022-40876 | Critical | 9.8 | 2022-10-27 | In Tenda ax1803 v1.0.0.1, the http requests handled by the fromAdvSetMacMtuWan functions, wanSpeed, cloneType, mac, can cause a stack overflow and enable remot… |
CVE-2022-3387 | Medium | 6.5 | 2022-10-27 | Advantech R-SeeNet Versions 2.4.19 and prior are vulnerable to path traversal attacks. An unauthorized attacker could remotely exploit vulnerable PHP code to… |
CVE-2022-3386 | Critical | 9.8 | 2022-10-27 | Advantech R-SeeNet Versions 2.4.17 and prior are vulnerable to a stack-based buffer overflow. An unauthorized attacker can use an outsized filename to overflo… |
CVE-2022-3385 | Critical | 9.8 | 2022-10-27 | Advantech R-SeeNet Versions 2.4.17 and prior are vulnerable to a stack-based buffer overflow. An unauthorized attacker can remotely overflow the stack buffer… |
CVE-2022-43340 | High | 8.8 | 2022-10-27 | A Cross-Site Request Forgery (CSRF) in dzzoffice 2.02.1_SC_UTF8 allows attackers to arbitrarily create user accounts and grant Administrator rights to regular… |
CVE-2022-39978 | High | 7.2 | 2022-10-27 | Online Pet Shop We App v1.0 was discovered to contain an arbitrary file upload vulnerability via the Editing function in the Product List module. This vulnerab… |
CVE-2022-39977 | High | 7.2 | 2022-10-27 | Online Pet Shop We App v1.0 was discovered to contain an arbitrary file upload vulnerability via the Editing function in the User module. This vulnerability al… |
CVE-2022-39976 | Critical | 9.8 | 2022-10-27 | School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /modules/announcement/index… |
CVE-2022-0074 | High | 8.8 | 2022-10-27 | Untrusted Search Path vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server Container allows Privilege Escalation. This aff… |
CVE-2022-0073 | High | 8.8 | 2022-10-27 | Improper Input Validation vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Command Injection. This a… |
CVE-2022-0072 | Medium | 5.8 | 2022-10-27 | Directory Traversal vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Path Traversal. This affects ve… |
CVE-2022-32407 | Medium | 6.1 | 2022-10-27 | Softr v2.0 was discovered to contain a Cross-Site Scripting (XSS) vulnerability via the First Name parameter under the Create A New Account module. This vulner… |
CVE-2022-43367 | Critical | 9.8 | 2022-10-27 | IP-COM EW9 V15.11.0.14(9732) was discovered to contain a command injection vulnerability in the formSetDebugCfg function. |
CVE-2022-43366 | High | 7.5 | 2022-10-27 | IP-COM EW9 V15.11.0.14(9732) allows unauthenticated attackers to access sensitive information via the checkLoginUser, ate, telnet, version, setDebugCfg, and bo… |
CVE-2022-43365 | High | 7.5 | 2022-10-27 | IP-COM EW9 V15.11.0.14(9732) was discovered to contain a buffer overflow in the formSetDebugCfg function. This vulnerability allows attackers to cause a Denial… |
CVE-2022-43364 | High | 7.5 | 2022-10-27 | An access control issue in the password reset page of IP-COM EW9 V15.11.0.14(9732) allows unauthenticated attackers to arbitrarily change the admin password. |
CVE-2022-42055 | Medium | 6.5 | 2022-10-27 | Multiple command injection vulnerabilities in GL.iNet GoodCloud IoT Device Management System Version 1.00.220412.00 via the ping and traceroute tools allow att… |
CVE-2022-42054 | Medium | 5.4 | 2022-10-27 | Multiple stored cross-site scripting (XSS) vulnerabilities in GL.iNet GoodCloud IoT Device Management System Version 1.00.220412.00 allow attackers to execute… |
CVE-2022-40875 | High | 7.5 | 2022-10-27 | Tenda AX1803 v1.0.0.1 was discovered to contain a heap overflow in the function GetParentControlInfo. |
CVE-2022-40874 | High | 7.5 | 2022-10-27 | Tenda AX1803 v1.0.0.1 was discovered to contain a heap overflow vulnerability in the GetParentControlInfo function, which can cause a denial of service attack… |
CVE-2022-31898 | Medium | 6.8 | 2022-10-27 | gl-inet GL-MT300N-V2 Mango v3.212 and GL-AX1800 Flint v3.214 were discovered to contain multiple command injection vulnerabilities via the ping_addr and trace_… |
CVE-2022-41996 | High | 8.8 | 2022-10-27 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada premium theme versions <= 7.8.1 on WordPress leading to arbitrary plugin installation/acti… |
CVE-2022-40184 | Medium | 5.1 | 2022-10-27 | Incomplete filtering of JavaScript code in different configuration fields of the web based interface of the VIDEOJET multi 4000 allows an attacker with adminis… |
CVE-2022-40183 | Medium | 5.8 | 2022-10-27 | An error in the URL handler of the VIDEOJET multi 4000 may lead to a reflected cross site scripting (XSS) in the web-based interface. An attacker with knowledg… |