2022 CVEs (page 110)
Page 110 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-43340 | High | 8.8 | 2022-10-27 | A Cross-Site Request Forgery (CSRF) in dzzoffice 2.02.1_SC_UTF8 allows attackers to arbitrarily create user accounts and grant Administrator rights to regular… |
CVE-2022-39978 | High | 7.2 | 2022-10-27 | Online Pet Shop We App v1.0 was discovered to contain an arbitrary file upload vulnerability via the Editing function in the Product List module. This vulnerab… |
CVE-2022-39977 | High | 7.2 | 2022-10-27 | Online Pet Shop We App v1.0 was discovered to contain an arbitrary file upload vulnerability via the Editing function in the User module. This vulnerability al… |
CVE-2022-39976 | Critical | 9.8 | 2022-10-27 | School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /modules/announcement/index… |
CVE-2022-0074 | High | 8.8 | 2022-10-27 | Untrusted Search Path vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server Container allows Privilege Escalation. This aff… |
CVE-2022-0073 | High | 8.8 | 2022-10-27 | Improper Input Validation vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Command Injection. This a… |
CVE-2022-0072 | Medium | 5.8 | 2022-10-27 | Directory Traversal vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Path Traversal. This affects ve… |
CVE-2022-32407 | Medium | 6.1 | 2022-10-27 | Softr v2.0 was discovered to contain a Cross-Site Scripting (XSS) vulnerability via the First Name parameter under the Create A New Account module. This vulner… |
CVE-2022-43367 | Critical | 9.8 | 2022-10-27 | IP-COM EW9 V15.11.0.14(9732) was discovered to contain a command injection vulnerability in the formSetDebugCfg function. |
CVE-2022-43366 | High | 7.5 | 2022-10-27 | IP-COM EW9 V15.11.0.14(9732) allows unauthenticated attackers to access sensitive information via the checkLoginUser, ate, telnet, version, setDebugCfg, and bo… |
CVE-2022-43365 | High | 7.5 | 2022-10-27 | IP-COM EW9 V15.11.0.14(9732) was discovered to contain a buffer overflow in the formSetDebugCfg function. This vulnerability allows attackers to cause a Denial… |
CVE-2022-43364 | High | 7.5 | 2022-10-27 | An access control issue in the password reset page of IP-COM EW9 V15.11.0.14(9732) allows unauthenticated attackers to arbitrarily change the admin password. |
CVE-2022-42055 | Medium | 6.5 | 2022-10-27 | Multiple command injection vulnerabilities in GL.iNet GoodCloud IoT Device Management System Version 1.00.220412.00 via the ping and traceroute tools allow att… |
CVE-2022-42054 | Medium | 5.4 | 2022-10-27 | Multiple stored cross-site scripting (XSS) vulnerabilities in GL.iNet GoodCloud IoT Device Management System Version 1.00.220412.00 allow attackers to execute… |
CVE-2022-40875 | High | 7.5 | 2022-10-27 | Tenda AX1803 v1.0.0.1 was discovered to contain a heap overflow in the function GetParentControlInfo. |
CVE-2022-40874 | High | 7.5 | 2022-10-27 | Tenda AX1803 v1.0.0.1 was discovered to contain a heap overflow vulnerability in the GetParentControlInfo function, which can cause a denial of service attack… |
CVE-2022-31898 | Medium | 6.8 | 2022-10-27 | gl-inet GL-MT300N-V2 Mango v3.212 and GL-AX1800 Flint v3.214 were discovered to contain multiple command injection vulnerabilities via the ping_addr and trace_… |
CVE-2022-41996 | High | 8.8 | 2022-10-27 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada premium theme versions <= 7.8.1 on WordPress leading to arbitrary plugin installation/acti… |
CVE-2022-40184 | Medium | 5.1 | 2022-10-27 | Incomplete filtering of JavaScript code in different configuration fields of the web based interface of the VIDEOJET multi 4000 allows an attacker with adminis… |
CVE-2022-40183 | Medium | 5.8 | 2022-10-27 | An error in the URL handler of the VIDEOJET multi 4000 may lead to a reflected cross site scripting (XSS) in the web-based interface. An attacker with knowledg… |
CVE-2022-3725 | Medium | 6.3 | 2022-10-27 | Crash in the OPUS protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial of service via packet injection or crafted capture file |
CVE-2022-24670 | High | 7.1 | 2022-10-27 | An attacker can use the unrestricted LDAP queries to determine configuration entries |
CVE-2022-24669 | Medium | 6.5 | 2022-10-27 | It may be possible to gain some details of the deployment through a well-crafted attack. This may allow that data to be used to probe internal network services. |
CVE-2022-3095 | Critical | 9.8 | 2022-10-27 | The implementation of backslash parsing in the Dart URI class for versions prior to 2.18 and Flutter versions prior to 3.30 differs from the WhatWG URL standar… |
CVE-2022-39365 | Critical | 9.8 | 2022-10-27 | Pimcore is an open source data and experience management platform. Prior to version 10.5.9, the user controlled twig templates rendering in `Pimcore/Mail` & `C… |
CVE-2022-39364 | Medium | 4.0 | 2022-10-27 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server prior to versions 23.0.9 and 24.0.5 and Ne… |
CVE-2022-42993 | Medium | 5.4 | 2022-10-27 | Password Storage Application v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Setup page. |
CVE-2022-42991 | Medium | 5.4 | 2022-10-27 | A stored cross-site scripting (XSS) vulnerability in Simple Online Public Access Catalog v1.0 allows attackers to execute arbitrary web scripts or HTML via a c… |
CVE-2022-39330 | Medium | 4.8 | 2022-10-27 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to versions 23.0.10 and 24.0.6 and Next… |
CVE-2022-39329 | Low | 3.5 | 2022-10-27 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to vers… |
CVE-2022-38744 | High | 7.5 | 2022-10-27 | An unauthenticated attacker with network access to a victim's Rockwell Automation FactoryTalk Alarm and Events service could open a connection, causing the s… |
CVE-2022-3409 | High | 8.2 | 2022-10-27 | A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. This vulnerability was identified during mitigation for CVE-2022-2809. Whe… |
CVE-2022-36182 | Medium | 6.1 | 2022-10-27 | Hashicorp Boundary v0.8.0 is vulnerable to Clickjacking which allow for the interception of login credentials, re-direction of users to malicious sites, or cau… |
CVE-2022-2809 | High | 8.2 | 2022-10-27 | A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. When fuzzing the multipart_parser code using AFL++ with address sanitizer… |
CVE-2022-42992 | Medium | 5.4 | 2022-10-27 | Multiple stored cross-site scripting (XSS) vulnerabilities in Train Scheduler App v1.0 allow attackers to execute arbitrary web scripts or HTML via a crafted p… |
CVE-2022-3716 | Low | 3.5 | 2022-10-27 | A vulnerability classified as problematic was found in SourceCodester Online Medicine Ordering System 1.0. Affected by this vulnerability is an unknown functio… |
CVE-2022-3714 | Medium | 5.0 | 2022-10-27 | A vulnerability classified as critical has been found in SourceCodester Online Medicine Ordering System 1.0. Affected is an unknown function of the file admin/… |
CVE-2022-2782 | Critical | 9.1 | 2022-10-27 | In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the session token parameters. |
CVE-2022-2508 | Medium | 5.3 | 2022-10-27 | In affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user does not have access to due to verbose erro… |
CVE-2022-25918 | Medium | 5.3 | 2022-10-27 | The package shescape from 1.5.10 and before 1.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the escape function in index.js, due to th… |
CVE-2022-40703 | Medium | 5.2 | 2022-10-26 | CWE-302 Authentication Bypass by Assumed-Immutable Data in AliveCor Kardia App version 5.17.1-754993421 and prior on Android allows an unauthenticated attack… |
CVE-2022-3363 | Critical | 9.8 | 2022-10-26 | Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.0a7. |
CVE-2022-3705 | Medium | 5.0 | 2022-10-26 | A vulnerability was found in vim and classified as problematic. Affected by this issue is the function qf_update_buffer of the file quickfix.c of the component… |
CVE-2022-3704 | Low | 3.5 | 2022-10-26 | A vulnerability classified as problematic has been found in Ruby on Rails. This affects an unknown part of the file actionpack/lib/action_dispatch/middleware/t… |
CVE-2022-39355 | Critical | 9.1 | 2022-10-26 | Discourse Patreon enables syncronization between Discourse Groups and Patreon rewards. On sites with Patreon login enabled, an improper authentication vulnerab… |
CVE-2022-39348 | Medium | 5.4 | 2022-10-26 | Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.web.v… |
CVE-2022-39286 | High | 8.8 | 2022-10-26 | Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vuln… |
CVE-2022-43003 | Critical | 9.8 | 2022-10-26 | D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the pskValue parameter in the setRepeaterSecurity function. |
CVE-2022-43002 | Critical | 9.8 | 2022-10-26 | D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the wizardstep54_pskpwd parameter at /goform/form2WizardStep54. |
CVE-2022-43001 | Critical | 9.8 | 2022-10-26 | D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the pskValue parameter in the setSecurity function. |
CVE-2022-43000 | Critical | 9.8 | 2022-10-26 | D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the wizardstep4_pskpwd parameter at /goform/form2WizardStep4. |
CVE-2022-42999 | High | 7.5 | 2022-10-26 | D-Link DIR-816 A2 1.10 B05 was discovered to contain multiple command injection vulnerabilities via the admuser and admpass parameters at /goform/setSysAdm. |
CVE-2022-42998 | Critical | 9.8 | 2022-10-26 | D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the srcip parameter at /goform/form2IPQoSTcAdd. |
CVE-2022-3670 | High | 7.3 | 2022-10-26 | A vulnerability was found in Axiomatic Bento4. It has been classified as critical. Affected is the function WriteSample of the component mp42hevc. The manipula… |
CVE-2022-3669 | Medium | 5.3 | 2022-10-26 | A vulnerability was found in Axiomatic Bento4 and classified as problematic. This issue affects the function AP4_AvccAtom::Create of the component mp4edit. The… |
CVE-2022-3668 | Medium | 5.3 | 2022-10-26 | A vulnerability has been found in Axiomatic Bento4 and classified as problematic. This vulnerability affects the function AP4_AtomFactory::CreateAtomFromStream… |
CVE-2022-3667 | High | 7.3 | 2022-10-26 | A vulnerability, which was classified as critical, was found in Axiomatic Bento4. This affects the function AP4_MemoryByteStream::WritePartial of the file Ap4B… |
CVE-2022-3666 | High | 7.3 | 2022-10-26 | A vulnerability, which was classified as critical, has been found in Axiomatic Bento4. Affected by this issue is the function AP4_LinearReader::Advance of the… |
CVE-2022-3665 | High | 7.3 | 2022-10-26 | A vulnerability classified as critical was found in Axiomatic Bento4. Affected by this vulnerability is an unknown functionality of the file AvcInfo.cpp of the… |
CVE-2022-3664 | High | 7.3 | 2022-10-26 | A vulnerability classified as critical has been found in Axiomatic Bento4. Affected is the function AP4_BitStream::WriteBytes of the file Ap4BitStream.cpp of t… |
CVE-2022-3663 | Medium | 5.3 | 2022-10-26 | A vulnerability was found in Axiomatic Bento4. It has been rated as problematic. This issue affects the function AP4_StsdAtom of the file Ap4StsdAtom.cpp of th… |
CVE-2022-3662 | High | 7.3 | 2022-10-26 | A vulnerability was found in Axiomatic Bento4. It has been declared as critical. This vulnerability affects the function GetOffset of the file Ap4Sample.h of t… |
CVE-2022-3474 | Medium | 4.3 | 2022-10-26 | A bad credential handling in the remote assets API for Bazel versions prior to 5.3.2 and 4.2.3 sends all user-provided credentials instead of only the required… |
CVE-2022-39362 | High | 8.8 | 2022-10-26 | Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, unsaved SQL queries are auto-exe… |
CVE-2022-39361 | High | 8.8 | 2022-10-26 | Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, H2 (Sample Database) could allow… |
CVE-2022-39360 | Medium | 6.5 | 2022-10-26 | Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9 single sign on (SSO) users were a… |
CVE-2022-39359 | Medium | 6.5 | 2022-10-26 | Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, custom GeoJSON map URL address w… |
CVE-2022-39358 | Medium | 6.5 | 2022-10-26 | Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, and 1.42.6, it was possible to circumvent locked parameters… |
CVE-2022-43776 | Medium | 6.5 | 2022-10-26 | The url parameter of the /api/geojson endpoint in Metabase versions <44.5 can be used to perform Server Side Request Forgery attacks. Previously implemented bl… |
CVE-2022-43775 | Critical | 9.8 | 2022-10-26 | The HICT_Loop class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that could allow an attacker to gain code execution on a remote system. |
CVE-2022-43774 | Critical | 9.8 | 2022-10-26 | The HandlerPageP_KID class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that could allow an attacker to gain code execution on a remote sy… |
CVE-2022-37202 | High | 8.8 | 2022-10-26 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/advicefeedback/list |
CVE-2022-3674 | High | 7.3 | 2022-10-26 | A vulnerability has been found in SourceCodester Sanitization Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown fu… |
CVE-2022-3673 | Low | 3.5 | 2022-10-26 | A vulnerability, which was classified as problematic, was found in SourceCodester Sanitization Management System 1.0. Affected is an unknown function of the fi… |
CVE-2022-3672 | Low | 3.5 | 2022-10-26 | A vulnerability, which was classified as problematic, has been found in SourceCodester Sanitization Management System 1.0. This issue affects some unknown proc… |
CVE-2022-3671 | Medium | 6.3 | 2022-10-26 | A vulnerability classified as critical was found in SourceCodester eLearning System 1.0. This vulnerability affects unknown code of the file /admin/students/ma… |
CVE-2022-43766 | High | 7.5 | 2022-10-26 | Apache IoTDB version 0.12.2 to 0.12.6, 0.13.0 to 0.13.2 are vulnerable to a Denial of Service attack when accepting untrusted patterns for REGEXP queries with… |
CVE-2022-42468 | Critical | 9.8 | 2022-10-26 | Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe provide… |
CVE-2022-40238 | High | 8.8 | 2022-10-26 | A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5. An authenticated attacker can inject arbitrary pickle object as part of… |
CVE-2022-39944 | High | 8.8 | 2022-10-26 | In Apache Linkis <=1.2.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attack… |
CVE-2022-39357 | High | 8.1 | 2022-10-26 | Winter is a free, open-source content management system based on the Laravel PHP framework. The Snowboard framework in versions 1.1.8, 1.1.9, and 1.2.0 is vuln… |
CVE-2022-20959 | Medium | 6.1 | 2022-10-26 | A vulnerability in the External RESTful Services (ERS) API of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker to co… |
CVE-2022-20955 | Medium | 5.5 | 2022-10-26 | Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an attacker to conduct path traversal… |
CVE-2022-20954 | Medium | 5.5 | 2022-10-26 | Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an attacker to conduct path traversal… |
CVE-2022-20953 | Medium | 5.5 | 2022-10-26 | Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an attacker to conduct path traversal… |
CVE-2022-20933 | High | 8.6 | 2022-10-26 | A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z3 Teleworker Gateway devices could allow an unauthenticated, remote att… |
CVE-2022-20822 | High | 7.1 | 2022-10-26 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to read and delete… |
CVE-2022-20811 | Medium | 5.5 | 2022-10-26 | Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an attacker to conduct path traversal… |
CVE-2022-20776 | Medium | 5.5 | 2022-10-26 | Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an attacker to conduct path traversal… |
CVE-2022-43749 | Medium | 4.3 | 2022-10-26 | Improper privilege management vulnerability in summary report management in Synology Presto File Server before 2.1.2-1601 allows remote authenticated users to… |
CVE-2022-43748 | Medium | 5.8 | 2022-10-26 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file operation management in Synology Presto File Server before… |
CVE-2022-2422 | Critical | 10.0 | 2022-10-26 | Due to improper input validation in the Feathers js library, it is possible to perform a SQL injection attack on the back-end database, in case the feathers-se… |
CVE-2022-2421 | Critical | 10.0 | 2022-10-26 | Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to… |
CVE-2022-29823 | Critical | 10.0 | 2022-10-26 | Feather-Sequalize cleanQuery method uses insecure recursive logic to filter unsupported keys from the query object. This results in a Remote Code Execution (RC… |
CVE-2022-29822 | Critical | 10.0 | 2022-10-26 | Due to improper parameter filtering in the Feathers js library, which may ultimately lead to SQL injection |
CVE-2022-31256 | High | 7.7 | 2022-10-26 | A Improper Link Resolution Before File Access ('Link Following') vulnerability in a script called by the sendmail systemd service of openSUSE Factory allows lo… |
CVE-2022-25849 | Medium | 5.4 | 2022-10-26 | The package joyqi/hyper-down from 0.0.0 are vulnerable to Cross-site Scripting (XSS) because the module of parse markdown does not filter the href attribute ve… |
CVE-2022-43750 | Medium | 6.7 | 2022-10-26 | drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-space client to corrupt the monitor's internal memory. |
CVE-2022-43747 | High | 7.5 | 2022-10-26 | baramundi Management Agent (bMA) in baramundi Management Suite (bMS) 2021 R1 and R2 and 2022 R1 allows remote code execution. This is fixed in security update… |
CVE-2022-41711 | Critical | 9.8 | 2022-10-25 | Badaso version 2.6.0 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does… |