2022 CVEs (page 112)
Page 112 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-33193 | Critical | 10.0 | 2022-10-25 | Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A XCMD… |
CVE-2022-33192 | Critical | 10.0 | 2022-10-25 | Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A XCMD… |
CVE-2022-33189 | Critical | 9.8 | 2022-10-25 | An OS command injection vulnerability exists in the XCMD setAlexa functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. A specially-crafted X… |
CVE-2022-33150 | Critical | 9.8 | 2022-10-25 | An OS command injection vulnerability exists in the js_package install functionality of Robustel R1510 3.1.16. A specially-crafted network request can lead to… |
CVE-2022-32775 | High | 8.8 | 2022-10-25 | An integer overflow vulnerability exists in the web interface /action/ipcamRecordPost functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X an… |
CVE-2022-32773 | Critical | 9.8 | 2022-10-25 | An OS command injection vulnerability exists in the XCMD doDebug functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-c… |
CVE-2022-32765 | Critical | 9.8 | 2022-10-25 | An OS command injection vulnerability exists in the sysupgrade command injection functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network… |
CVE-2022-32760 | High | 7.5 | 2022-10-25 | A denial of service vulnerability exists in the XCMD doDebug functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-craft… |
CVE-2022-32586 | High | 8.8 | 2022-10-25 | An OS command injection vulnerability exists in the web interface /action/ipcamRecordPost functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9… |
CVE-2022-32574 | Medium | 6.5 | 2022-10-25 | A double-free vulnerability exists in the web interface /action/ipcamSetParamPost functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6… |
CVE-2022-32454 | Critical | 9.8 | 2022-10-25 | A stack-based buffer overflow vulnerability exists in the XCMD setIPCam functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A spec… |
CVE-2022-30603 | High | 8.8 | 2022-10-25 | An OS command injection vulnerability exists in the web interface /action/iperf functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z… |
CVE-2022-30541 | Critical | 9.8 | 2022-10-25 | An OS command injection vulnerability exists in the XCMD setUPnP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-c… |
CVE-2022-2762 | Medium | 6.5 | 2022-10-25 | The AdminPad WordPress plugin before 2.2 does not have CSRF check when updating admin's note, allowing attackers to make a logged in admin update their notes v… |
CVE-2022-29889 | Critical | 9.8 | 2022-10-25 | A hard-coded password vulnerability exists in the telnet functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. Use of a hard-coded root passw… |
CVE-2022-29851 | Critical | 9.8 | 2022-10-25 | documentconverter in OX App Suite through 7.10.6, in a non-default configuration with ghostscript, allows OS Command Injection because file conversion may occu… |
CVE-2022-29520 | Critical | 9.8 | 2022-10-25 | An OS command injection vulnerability exists in the console_main_loop :sys functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. A specially-… |
CVE-2022-29477 | Critical | 9.8 | 2022-10-25 | An authentication bypass vulnerability exists in the web interface /action/factory* functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and… |
CVE-2022-29475 | High | 8.1 | 2022-10-25 | An information disclosure vulnerability exists in the XFINDER functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-craf… |
CVE-2022-29472 | Critical | 9.8 | 2022-10-25 | An OS command injection vulnerability exists in the web interface util_set_serial_mac functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X an… |
CVE-2022-27805 | Critical | 9.8 | 2022-10-25 | An authentication bypass vulnerability exists in the GHOME control functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially… |
CVE-2022-27804 | Critical | 9.8 | 2022-10-25 | An os command injection vulnerability exists in the web interface util_set_abode_code functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X an… |
CVE-2022-27623 | High | 7.4 | 2022-10-25 | Missing authentication for critical function vulnerability in iSCSI management functionality in Synology DiskStation Manager (DSM) before 7.1-42661 allows remo… |
CVE-2022-27622 | Medium | 4.1 | 2022-10-25 | Server-Side Request Forgery (SSRF) vulnerability in Package Center functionality in Synology DiskStation Manager (DSM) before 7.1-42661 allows remote authentic… |
CVE-2022-43680 | High | 7.5 | 2022-10-24 | In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situati… |
CVE-2022-43677 | Medium | 5.5 | 2022-10-24 | In free5GC 3.2.1, a malformed NGAP message can crash the AMF and NGAP decoders via an index-out-of-range panic in aper.GetBitString. |
CVE-2022-41986 | High | 7.5 | 2022-10-24 | Information disclosure vulnerability in Android App 'IIJ SmartKey' versions prior to 2.1.4 allows an attacker to obtain a one-time password issued by the produ… |
CVE-2022-41799 | Medium | 6.5 | 2022-10-24 | Improper access control vulnerability in GROWI prior to v5.1.4 (v5 series) and versions prior to v4.5.25 (v4 series) allows a remote authenticated attacker to… |
CVE-2022-41797 | Medium | 6.5 | 2022-10-24 | Improper authorization in handler for custom URL scheme vulnerability in Lemon8 App for Android versions prior to 3.3.5 and Lemon8 App for iOS versions prior t… |
CVE-2022-41796 | High | 7.8 | 2022-10-24 | Untrusted search path vulnerability in the installer of Content Transfer (for Windows) Ver.1.3 and prior allows an attacker to gain privileges via a Trojan hor… |
CVE-2022-40984 | Critical | 9.8 | 2022-10-24 | Stack-based buffer overflow in WTViewerE series WTViewerE 761941 from 1.31 to 1.61 and WTViewerEfree from 1.01 to 1.52 allows an attacker to cause the product… |
CVE-2022-40690 | Medium | 5.4 | 2022-10-24 | Cross-site scripting vulnerability in BookStack versions prior to v22.09 allows a remote authenticated attacker to inject an arbitrary script. |
CVE-2022-3676 | Medium | 6.5 | 2022-10-24 | In Eclipse Openj9 before version 0.35.0, interface calls can be inlined without a runtime type check. Malicious bytecode could make use of this inlining to acc… |
CVE-2022-39314 | Low | 3.7 | 2022-10-24 | Kirby is a flat-file CMS. In versions prior to 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1, Kirby is subject to user enumeration due to Improper Restriction of Excess… |
CVE-2022-39313 | High | 7.5 | 2022-10-24 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 4.10.17, and prior to 5.2.8 on the 5… |
CVE-2022-39305 | Critical | 9.8 | 2022-10-24 | Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Versions prior to 2.5.4 contain a fi… |
CVE-2022-38117 | Medium | 5.5 | 2022-10-24 | Juiker app hard-coded its AES key in the source code. A physical attacker, after getting the Android root privilege, can use the AES key to decrypt users’ ciph… |
CVE-2022-36368 | Medium | 4.8 | 2022-10-24 | Multiple stored cross-site scripting vulnerabilities in the web user interface of IPFire versions prior to 2.27 allows a remote authenticated attacker with adm… |
CVE-2022-39272 | Medium | 5.0 | 2022-10-22 | Flux is an open and extensible continuous delivery solution for Kubernetes. Versions prior to 0.35.0 are subject to a Denial of Service. Users that have permis… |
CVE-2022-39259 | Low | 3.3 | 2022-10-21 | jadx is a set of command line and GUI tools for producing Java source code from Android Dex and Apk files. versions prior to 1.4.5 are subject to a Denial of S… |
CVE-2022-23462 | Medium | 6.2 | 2022-10-21 | IOWOW is a C utility library and persistent key/value storage engine. Versions 1.4.15 and prior contain a stack buffer overflow vulnerability that allows for D… |
CVE-2022-3649 | Low | 3.1 | 2022-10-21 | A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is the function nilfs_new_inode of the file fs/nilfs2/inode.c of the… |
CVE-2022-3647 | Low | 3.1 | 2022-10-21 | ** DISPUTED ** A vulnerability, which was classified as problematic, was found in Redis up to 6.2.7/7.0.5. Affected is the function sigsegvHandler of the file… |
CVE-2022-3646 | Low | 3.1 | 2022-10-21 | A vulnerability, which was classified as problematic, has been found in Linux Kernel. This issue affects the function nilfs_attach_log_writer of the file fs/ni… |
CVE-2022-34439 | Medium | 5.3 | 2022-10-21 | Dell PowerScale OneFS, versions 8.2.0.x-9.4.0.x contain allocation of Resources Without Limits or Throttling vulnerability. A remote unauthenticated attacker c… |
CVE-2022-34438 | Medium | 6.7 | 2022-10-21 | Dell PowerScale OneFS, versions 8.2.x-9.4.0.x, contain a privilege context switching error. A local authenticated malicious user with high privileges could pot… |
CVE-2022-34437 | Medium | 6.7 | 2022-10-21 | Dell PowerScale OneFS, versions 8.2.2-9.3.0, contain an OS command injection vulnerability. A privileged local malicious user could potentially exploit this vu… |
CVE-2022-31239 | Medium | 6.7 | 2022-10-21 | Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.19, 9.2.1.12, and 9.3.0.6, contain sensitive data in log files vulnerability. A privileged loca… |
CVE-2022-26870 | High | 7.0 | 2022-10-21 | Dell PowerStore versions 2.1.0.x contain an Authentication bypass vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability… |
CVE-2022-42944 | High | 7.8 | 2022-10-21 | A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by read access violation… |
CVE-2022-42943 | High | 7.8 | 2022-10-21 | A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by read access violation… |
CVE-2022-42942 | High | 7.8 | 2022-10-21 | A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by read access violation… |
CVE-2022-42941 | High | 7.8 | 2022-10-21 | A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by read access violation… |
CVE-2022-42940 | High | 7.8 | 2022-10-21 | A malicious crafted TGA file when consumed through DesignReview.exe application could lead to memory corruption vulnerability. This vulnerability in conjunctio… |
CVE-2022-42939 | High | 7.8 | 2022-10-21 | A malicious crafted TGA file when consumed through DesignReview.exe application could lead to memory corruption vulnerability. This vulnerability in conjunctio… |
CVE-2022-42938 | High | 7.8 | 2022-10-21 | A malicious crafted TGA file when consumed through DesignReview.exe application could lead to memory corruption vulnerability. This vulnerability in conjunctio… |
CVE-2022-42937 | High | 7.8 | 2022-10-21 | A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violatio… |
CVE-2022-42936 | High | 7.8 | 2022-10-21 | A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violatio… |
CVE-2022-42935 | High | 7.8 | 2022-10-21 | A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violatio… |
CVE-2022-42934 | High | 7.8 | 2022-10-21 | A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violatio… |
CVE-2022-42933 | High | 7.8 | 2022-10-21 | A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violatio… |
CVE-2022-41638 | Medium | 5.4 | 2022-10-21 | Auth. Stored Cross-Site Scripting (XSS) in Pop-Up Chop Chop plugin <= 2.1.7 on WordPress. |
CVE-2022-41310 | High | 7.8 | 2022-10-21 | A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violatio… |
CVE-2022-41309 | High | 7.8 | 2022-10-21 | A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violatio… |
CVE-2022-40311 | Medium | 4.8 | 2022-10-21 | Auth. (admin+) Stored Cross-Site Scripting (XSS) in Fatcat Apps Analytics Cat plugin <= 1.0.9 on WordPress. |
CVE-2022-3639 | Medium | 4.3 | 2022-10-21 | A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions from 10.8 before 15.1.6, all versions starting from 15.2 before 15.2.4, all… |
CVE-2022-3627 | Medium | 5.5 | 2022-10-21 | LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection, tools/tiffcrop.c:6860, allowing attacke… |
CVE-2022-3626 | Medium | 5.5 | 2022-10-21 | LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemset in libtiff/tif_unix.c:340 when called from processCropSelections, tools/tiffcrop.c:7619, allowing attac… |
CVE-2022-3599 | Medium | 5.5 | 2022-10-21 | LibTIFF 4.4.0 has an out-of-bounds read in writeSingleSection in tools/tiffcrop.c:7345, allowing attackers to cause a denial-of-service via a crafted tiff file… |
CVE-2022-3598 | Medium | 5.5 | 2022-10-21 | LibTIFF 4.4.0 has an out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c:3604, allowing attackers to cause a denial-of-service via a c… |
CVE-2022-3597 | Medium | 5.5 | 2022-10-21 | LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection, tools/tiffcrop.c:6826, allowing attacke… |
CVE-2022-3570 | High | 7.7 | 2022-10-21 | Multiple heap buffer overflows in tiffcrop.c utility in libtiff library Version 4.4.0 allows attacker to trigger unsafe or out of bounds memory access via craf… |
CVE-2022-38104 | High | 7.2 | 2022-10-21 | Auth. WordPress Options Change (siteurl, users_can_register, default_role, admin_email and new_admin_email) vulnerability in Biplob Adhikari's Accordions – Mul… |
CVE-2022-27494 | High | 8.2 | 2022-10-21 | Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials. |
CVE-2022-26423 | High | 8.2 | 2022-10-21 | Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials. |
CVE-2022-1070 | High | 8.2 | 2022-10-21 | Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials. |
CVE-2022-1066 | High | 8.2 | 2022-10-21 | Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials. |
CVE-2022-1059 | High | 8.2 | 2022-10-21 | Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials. |
CVE-2022-3640 | Medium | 5.5 | 2022-10-21 | A vulnerability, which was classified as critical, was found in Linux Kernel. Affected is the function l2cap_conn_del of the file net/bluetooth/l2cap_core.c of… |
CVE-2022-43400 | Critical | 9.8 | 2022-10-21 | A vulnerability has been identified in Siveillance Video Mobile Server V2022 R2 (All versions < V22.2a (80)). The mobile server component of affected applicati… |
CVE-2022-42206 | Medium | 5.4 | 2022-10-21 | PHPGurukul Hospital Management System In PHP V 4.0 is vulnerable to Cross Site Scripting (XSS) via doctor/view-patient.php, admin/view-patient.php, and view-me… |
CVE-2022-42205 | Medium | 5.4 | 2022-10-21 | PHPGurukul Hospital Management System In PHP V 4.0 is vulnerable to Cross Site Scripting (XSS) via add-patient.php. |
CVE-2022-3203 | Critical | 9.8 | 2022-10-21 | On ORing net IAP-420(+) with FW version 2.0m a telnet server is enabled by default and cannot permanently be disabled. You can connect to the device via LAN or… |
CVE-2022-42189 | High | 7.2 | 2022-10-21 | Emlog Pro 1.6.0 plugins upload suffers from a remote code execution (RCE) vulnerability. |
CVE-2022-41575 | High | 7.5 | 2022-10-21 | A credential-exposure vulnerability in the support-bundle mechanism in Gradle Enterprise 2022.3 through 2022.3.3 allows remote attackers to access a subset of… |
CVE-2022-36122 | High | 7.8 | 2022-10-21 | The Automox Agent before 40 on Windows incorrectly sets permissions on key files. |
CVE-2022-3637 | Low | 2.6 | 2022-10-21 | A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function jlink_init of the file monitor/jlink.c of… |
CVE-2022-3636 | Medium | 5.5 | 2022-10-21 | A vulnerability was identified in Linux Kernel 33fc42de33278b2b3ec6f3390512987bc29a62b7. This affects the function __mtk_ppe_check_skb of the file drivers/net/… |
CVE-2022-3635 | Medium | 5.5 | 2022-10-21 | A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue is the function tst_timer of the file drivers/atm/idt… |
CVE-2022-3633 | Low | 3.5 | 2022-10-21 | A vulnerability classified as problematic has been found in Linux Kernel. Affected is the function j1939_session_destroy of the file net/can/j1939/transport.c… |
CVE-2022-3630 | Low | 3.1 | 2022-10-21 | A vulnerability was found in Linux Kernel. It has been rated as problematic. This issue affects some unknown processing of the file fs/fscache/cookie.c of the… |
CVE-2022-3629 | Low | 2.6 | 2022-10-21 | A vulnerability was found in Linux Kernel. It has been declared as problematic. This vulnerability affects the function vsock_connect of the file net/vmw_vsock… |
CVE-2022-3625 | Medium | 4.6 | 2022-10-21 | A vulnerability was found in Linux Kernel. It has been classified as critical. This affects the function devlink_param_set/devlink_param_get of the file net/co… |
CVE-2022-3624 | Low | 3.5 | 2022-10-21 | A vulnerability was found in Linux Kernel and classified as problematic. Affected by this issue is the function rlb_arp_xmit of the file drivers/net/bonding/bo… |
CVE-2022-37454 | Critical | 9.8 | 2022-10-21 | The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary… |
CVE-2022-39823 | High | 7.5 | 2022-10-20 | An issue was discovered in Softing OPC UA C++ SDK 5.66 through 6.x before 6.10. An OPC/UA browse request exceeding the server limit on continuation points may… |
CVE-2022-38108 | High | 7.2 | 2022-10-20 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account acces… |
CVE-2022-37453 | High | 7.5 | 2022-10-20 | An issue was discovered in Softing OPC UA C++ SDK before 6.10. A buffer overflow or an excess allocation happens due to unchecked array and matrix bounds in st… |
CVE-2022-36966 | Medium | 5.4 | 2022-10-20 | Users with Node Management rights were able to view and edit all nodes due to Insufficient control on URL parameter causing insecure direct object reference (I… |
CVE-2022-36958 | High | 8.8 | 2022-10-20 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with valid access to SolarWinds Web… |