2022 CVEs (page 110)
Page 110 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-3725 | Medium | 6.3 | 2022-10-27 | Crash in the OPUS protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial of service via packet injection or crafted capture file |
CVE-2022-24670 | High | 7.1 | 2022-10-27 | An attacker can use the unrestricted LDAP queries to determine configuration entries |
CVE-2022-24669 | Medium | 6.5 | 2022-10-27 | It may be possible to gain some details of the deployment through a well-crafted attack. This may allow that data to be used to probe internal network services. |
CVE-2022-3095 | Critical | 9.8 | 2022-10-27 | The implementation of backslash parsing in the Dart URI class for versions prior to 2.18 and Flutter versions prior to 3.30 differs from the WhatWG URL standar… |
CVE-2022-39365 | Critical | 9.8 | 2022-10-27 | Pimcore is an open source data and experience management platform. Prior to version 10.5.9, the user controlled twig templates rendering in `Pimcore/Mail` & `C… |
CVE-2022-39364 | Medium | 4.0 | 2022-10-27 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server prior to versions 23.0.9 and 24.0.5 and Ne… |
CVE-2022-42993 | Medium | 5.4 | 2022-10-27 | Password Storage Application v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Setup page. |
CVE-2022-42991 | Medium | 5.4 | 2022-10-27 | A stored cross-site scripting (XSS) vulnerability in Simple Online Public Access Catalog v1.0 allows attackers to execute arbitrary web scripts or HTML via a c… |
CVE-2022-39330 | Medium | 4.8 | 2022-10-27 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to versions 23.0.10 and 24.0.6 and Next… |
CVE-2022-39329 | Low | 3.5 | 2022-10-27 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to vers… |
CVE-2022-38744 | High | 7.5 | 2022-10-27 | An unauthenticated attacker with network access to a victim's Rockwell Automation FactoryTalk Alarm and Events service could open a connection, causing the s… |
CVE-2022-3409 | High | 8.2 | 2022-10-27 | A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. This vulnerability was identified during mitigation for CVE-2022-2809. Whe… |
CVE-2022-36182 | Medium | 6.1 | 2022-10-27 | Hashicorp Boundary v0.8.0 is vulnerable to Clickjacking which allow for the interception of login credentials, re-direction of users to malicious sites, or cau… |
CVE-2022-2809 | High | 8.2 | 2022-10-27 | A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. When fuzzing the multipart_parser code using AFL++ with address sanitizer… |
CVE-2022-42992 | Medium | 5.4 | 2022-10-27 | Multiple stored cross-site scripting (XSS) vulnerabilities in Train Scheduler App v1.0 allow attackers to execute arbitrary web scripts or HTML via a crafted p… |
CVE-2022-3716 | Low | 3.5 | 2022-10-27 | A vulnerability classified as problematic was found in SourceCodester Online Medicine Ordering System 1.0. Affected by this vulnerability is an unknown functio… |
CVE-2022-3714 | Medium | 5.0 | 2022-10-27 | A vulnerability classified as critical has been found in SourceCodester Online Medicine Ordering System 1.0. Affected is an unknown function of the file admin/… |
CVE-2022-2782 | Critical | 9.1 | 2022-10-27 | In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the session token parameters. |
CVE-2022-2508 | Medium | 5.3 | 2022-10-27 | In affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user does not have access to due to verbose erro… |
CVE-2022-25918 | Medium | 5.3 | 2022-10-27 | The package shescape from 1.5.10 and before 1.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the escape function in index.js, due to th… |
CVE-2022-40703 | Medium | 5.2 | 2022-10-26 | CWE-302 Authentication Bypass by Assumed-Immutable Data in AliveCor Kardia App version 5.17.1-754993421 and prior on Android allows an unauthenticated attack… |
CVE-2022-3363 | Critical | 9.8 | 2022-10-26 | Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.0a7. |
CVE-2022-3705 | Medium | 5.0 | 2022-10-26 | A vulnerability was found in vim and classified as problematic. Affected by this issue is the function qf_update_buffer of the file quickfix.c of the component… |
CVE-2022-3704 | Low | 3.5 | 2022-10-26 | A vulnerability classified as problematic has been found in Ruby on Rails. This affects an unknown part of the file actionpack/lib/action_dispatch/middleware/t… |
CVE-2022-39355 | Critical | 9.1 | 2022-10-26 | Discourse Patreon enables syncronization between Discourse Groups and Patreon rewards. On sites with Patreon login enabled, an improper authentication vulnerab… |
CVE-2022-39348 | Medium | 5.4 | 2022-10-26 | Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.web.v… |
CVE-2022-39286 | High | 8.8 | 2022-10-26 | Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vuln… |
CVE-2022-43003 | Critical | 9.8 | 2022-10-26 | D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the pskValue parameter in the setRepeaterSecurity function. |
CVE-2022-43002 | Critical | 9.8 | 2022-10-26 | D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the wizardstep54_pskpwd parameter at /goform/form2WizardStep54. |
CVE-2022-43001 | Critical | 9.8 | 2022-10-26 | D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the pskValue parameter in the setSecurity function. |
CVE-2022-43000 | Critical | 9.8 | 2022-10-26 | D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the wizardstep4_pskpwd parameter at /goform/form2WizardStep4. |
CVE-2022-42999 | High | 7.5 | 2022-10-26 | D-Link DIR-816 A2 1.10 B05 was discovered to contain multiple command injection vulnerabilities via the admuser and admpass parameters at /goform/setSysAdm. |
CVE-2022-42998 | Critical | 9.8 | 2022-10-26 | D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the srcip parameter at /goform/form2IPQoSTcAdd. |
CVE-2022-3670 | High | 7.3 | 2022-10-26 | A vulnerability was found in Axiomatic Bento4. It has been classified as critical. Affected is the function WriteSample of the component mp42hevc. The manipula… |
CVE-2022-3669 | Medium | 5.3 | 2022-10-26 | A vulnerability was found in Axiomatic Bento4 and classified as problematic. This issue affects the function AP4_AvccAtom::Create of the component mp4edit. The… |
CVE-2022-3668 | Medium | 5.3 | 2022-10-26 | A vulnerability has been found in Axiomatic Bento4 and classified as problematic. This vulnerability affects the function AP4_AtomFactory::CreateAtomFromStream… |
CVE-2022-3667 | High | 7.3 | 2022-10-26 | A vulnerability, which was classified as critical, was found in Axiomatic Bento4. This affects the function AP4_MemoryByteStream::WritePartial of the file Ap4B… |
CVE-2022-3666 | High | 7.3 | 2022-10-26 | A vulnerability, which was classified as critical, has been found in Axiomatic Bento4. Affected by this issue is the function AP4_LinearReader::Advance of the… |
CVE-2022-3665 | High | 7.3 | 2022-10-26 | A vulnerability classified as critical was found in Axiomatic Bento4. Affected by this vulnerability is an unknown functionality of the file AvcInfo.cpp of the… |
CVE-2022-3664 | High | 7.3 | 2022-10-26 | A vulnerability classified as critical has been found in Axiomatic Bento4. Affected is the function AP4_BitStream::WriteBytes of the file Ap4BitStream.cpp of t… |
CVE-2022-3663 | Medium | 5.3 | 2022-10-26 | A vulnerability was found in Axiomatic Bento4. It has been rated as problematic. This issue affects the function AP4_StsdAtom of the file Ap4StsdAtom.cpp of th… |
CVE-2022-3662 | High | 7.3 | 2022-10-26 | A vulnerability was found in Axiomatic Bento4. It has been declared as critical. This vulnerability affects the function GetOffset of the file Ap4Sample.h of t… |
CVE-2022-3474 | Medium | 4.3 | 2022-10-26 | A bad credential handling in the remote assets API for Bazel versions prior to 5.3.2 and 4.2.3 sends all user-provided credentials instead of only the required… |
CVE-2022-39362 | High | 8.8 | 2022-10-26 | Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, unsaved SQL queries are auto-exe… |
CVE-2022-39361 | High | 8.8 | 2022-10-26 | Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, H2 (Sample Database) could allow… |
CVE-2022-39360 | Medium | 6.5 | 2022-10-26 | Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9 single sign on (SSO) users were a… |
CVE-2022-39359 | Medium | 6.5 | 2022-10-26 | Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, custom GeoJSON map URL address w… |
CVE-2022-39358 | Medium | 6.5 | 2022-10-26 | Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, and 1.42.6, it was possible to circumvent locked parameters… |
CVE-2022-43776 | Medium | 6.5 | 2022-10-26 | The url parameter of the /api/geojson endpoint in Metabase versions <44.5 can be used to perform Server Side Request Forgery attacks. Previously implemented bl… |
CVE-2022-43775 | Critical | 9.8 | 2022-10-26 | The HICT_Loop class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that could allow an attacker to gain code execution on a remote system. |
CVE-2022-43774 | Critical | 9.8 | 2022-10-26 | The HandlerPageP_KID class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that could allow an attacker to gain code execution on a remote sy… |
CVE-2022-37202 | High | 8.8 | 2022-10-26 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/advicefeedback/list |
CVE-2022-3674 | High | 7.3 | 2022-10-26 | A vulnerability has been found in SourceCodester Sanitization Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown fu… |
CVE-2022-3673 | Low | 3.5 | 2022-10-26 | A vulnerability, which was classified as problematic, was found in SourceCodester Sanitization Management System 1.0. Affected is an unknown function of the fi… |
CVE-2022-3672 | Low | 3.5 | 2022-10-26 | A vulnerability, which was classified as problematic, has been found in SourceCodester Sanitization Management System 1.0. This issue affects some unknown proc… |
CVE-2022-3671 | Medium | 6.3 | 2022-10-26 | A vulnerability classified as critical was found in SourceCodester eLearning System 1.0. This vulnerability affects unknown code of the file /admin/students/ma… |
CVE-2022-43766 | High | 7.5 | 2022-10-26 | Apache IoTDB version 0.12.2 to 0.12.6, 0.13.0 to 0.13.2 are vulnerable to a Denial of Service attack when accepting untrusted patterns for REGEXP queries with… |
CVE-2022-42468 | Critical | 9.8 | 2022-10-26 | Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe provide… |
CVE-2022-40238 | High | 8.8 | 2022-10-26 | A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5. An authenticated attacker can inject arbitrary pickle object as part of… |
CVE-2022-39944 | High | 8.8 | 2022-10-26 | In Apache Linkis <=1.2.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attack… |
CVE-2022-39357 | High | 8.1 | 2022-10-26 | Winter is a free, open-source content management system based on the Laravel PHP framework. The Snowboard framework in versions 1.1.8, 1.1.9, and 1.2.0 is vuln… |
CVE-2022-20959 | Medium | 6.1 | 2022-10-26 | A vulnerability in the External RESTful Services (ERS) API of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker to co… |
CVE-2022-20955 | Medium | 5.5 | 2022-10-26 | Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an attacker to conduct path traversal… |
CVE-2022-20954 | Medium | 5.5 | 2022-10-26 | Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an attacker to conduct path traversal… |
CVE-2022-20953 | Medium | 5.5 | 2022-10-26 | Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an attacker to conduct path traversal… |
CVE-2022-20933 | High | 8.6 | 2022-10-26 | A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z3 Teleworker Gateway devices could allow an unauthenticated, remote att… |
CVE-2022-20822 | High | 7.1 | 2022-10-26 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to read and delete… |
CVE-2022-20811 | Medium | 5.5 | 2022-10-26 | Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an attacker to conduct path traversal… |
CVE-2022-20776 | Medium | 5.5 | 2022-10-26 | Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an attacker to conduct path traversal… |
CVE-2022-43749 | Medium | 4.3 | 2022-10-26 | Improper privilege management vulnerability in summary report management in Synology Presto File Server before 2.1.2-1601 allows remote authenticated users to… |
CVE-2022-43748 | Medium | 5.8 | 2022-10-26 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file operation management in Synology Presto File Server before… |
CVE-2022-2422 | Critical | 10.0 | 2022-10-26 | Due to improper input validation in the Feathers js library, it is possible to perform a SQL injection attack on the back-end database, in case the feathers-se… |
CVE-2022-2421 | Critical | 10.0 | 2022-10-26 | Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to… |
CVE-2022-29823 | Critical | 10.0 | 2022-10-26 | Feather-Sequalize cleanQuery method uses insecure recursive logic to filter unsupported keys from the query object. This results in a Remote Code Execution (RC… |
CVE-2022-29822 | Critical | 10.0 | 2022-10-26 | Due to improper parameter filtering in the Feathers js library, which may ultimately lead to SQL injection |
CVE-2022-31256 | High | 7.7 | 2022-10-26 | A Improper Link Resolution Before File Access ('Link Following') vulnerability in a script called by the sendmail systemd service of openSUSE Factory allows lo… |
CVE-2022-25849 | Medium | 5.4 | 2022-10-26 | The package joyqi/hyper-down from 0.0.0 are vulnerable to Cross-site Scripting (XSS) because the module of parse markdown does not filter the href attribute ve… |
CVE-2022-43750 | Medium | 6.7 | 2022-10-26 | drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-space client to corrupt the monitor's internal memory. |
CVE-2022-43747 | High | 7.5 | 2022-10-26 | baramundi Management Agent (bMA) in baramundi Management Suite (bMS) 2021 R1 and R2 and 2022 R1 allows remote code execution. This is fixed in security update… |
CVE-2022-41711 | Critical | 9.8 | 2022-10-25 | Badaso version 2.6.0 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does… |
CVE-2022-33185 | High | 7.8 | 2022-10-25 | Several commands in Brocade Fabric OS before Brocade Fabric OS v.9.0.1e, and v9.1.0 use unsafe string functions to process user input. Authenticated local atta… |
CVE-2022-33184 | High | 7.8 | 2022-10-25 | A vulnerability in fab_seg.c.h libraries of all Brocade Fabric OS versions before Brocade Fabric OS v9.1.1, v9.0.1e, v8.2.3c, v8.2.0_cbn5, 7.4.2j could allow l… |
CVE-2022-33183 | High | 8.8 | 2022-10-25 | A vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5, 7.4.2.j could allow a remote authenticated attacker to per… |
CVE-2022-33182 | High | 7.8 | 2022-10-25 | A privilege escalation vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5, could allow a local authenticated use… |
CVE-2022-33181 | Medium | 5.5 | 2022-10-25 | An information disclosure vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5, 7.4.2.j could allow a local authen… |
CVE-2022-33180 | Medium | 5.5 | 2022-10-25 | A vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5 could allow a local authenticated attacker to export out se… |
CVE-2022-33179 | High | 8.8 | 2022-10-25 | A vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, and 7.4.2j could allow a local authenticated user to break out of res… |
CVE-2022-33178 | High | 7.2 | 2022-10-25 | A vulnerability in the radius authentication system of Brocade Fabric OS before Brocade Fabric OS 9.0 could allow a remote attacker to execute arbitrary code o… |
CVE-2022-28170 | Medium | 6.5 | 2022-10-25 | Brocade Fabric OS Web Application services before Brocade Fabric v9.1.0, v9.0.1e, v8.2.3c, v7.4.2j store server and user passwords in the debug statements. Thi… |
CVE-2022-28169 | High | 8.8 | 2022-10-25 | Brocade Webtools in Brocade Fabric OS versions before Brocade Fabric OS versions v9.1.1, v9.0.1e, and v8.2.3c could allow a low privilege webtools, user, to ga… |
CVE-2022-39354 | Medium | 5.9 | 2022-10-25 | SputnikVM, also called evm, is a Rust implementation of Ethereum Virtual Machine. A custom stateful precompile can use the `is_static` parameter to determine i… |
CVE-2022-38181 | High | 8.8 | 2022-10-25 | The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled. This affects Bifrost r0p0 through… |
CVE-2022-38162 | Medium | 6.1 | 2022-10-25 | Reflected cross-site scripting (XSS) vulnerabilities in WithSecure through 2022-08-10) exists within the F-Secure Policy Manager due to an unvalidated paramete… |
CVE-2022-36452 | Critical | 9.8 | 2022-10-25 | A vulnerability in the web conferencing component of Mitel MiCollab through 9.5.0.101 could allow an unauthenticated attacker to upload malicious files. A succ… |
CVE-2022-31468 | Medium | 6.1 | 2022-10-25 | OX App Suite through 8.2 allows XSS via an attachment or OX Drive content when a client uses the len or off parameter. |
CVE-2022-27913 | Medium | 6.1 | 2022-10-25 | An issue was discovered in Joomla! 4.2.0 through 4.2.3. Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in vari… |
CVE-2022-27912 | Medium | 5.3 | 2022-10-25 | An issue was discovered in Joomla! 4.0.0 through 4.2.3. Sites with publicly enabled debug mode exposed data of previous requests. |
CVE-2022-3644 | Medium | 5.5 | 2022-10-25 | The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API () in… |
CVE-2022-36454 | Medium | 6.5 | 2022-10-25 | A vulnerability in the MiCollab Client API of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to modify their profile parameters due to… |
CVE-2022-36453 | High | 8.8 | 2022-10-25 | A vulnerability in the MiCollab Client API of Mitel MiCollab 9.1.3 through 9.5.0.101 could allow an authenticated attacker to modify their profile parameters d… |