2022 CVEs (page 113)
Page 113 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-36957 | High | 7.2 | 2022-10-20 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account acces… |
CVE-2022-3623 | Medium | 5.0 | 2022-10-20 | A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function follow_page_pte of the file mm/g… |
CVE-2022-3621 | Medium | 4.3 | 2022-10-20 | A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is the function nilfs_bmap_lookup_at_level of the file fs/nilfs2/ino… |
CVE-2022-3620 | Medium | 5.6 | 2022-10-20 | A vulnerability was found in Exim and classified as problematic. This issue affects the function dmarc_dns_lookup of the file dmarc.c of the component DMARC Ha… |
CVE-2022-3619 | Low | 3.5 | 2022-10-20 | A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function l2cap_recv_acldata of the file net/blueto… |
CVE-2022-42344 | High | 8.8 | 2022-10-20 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Incorrect Authorization vulnerability. An aut… |
CVE-2022-42233 | Critical | 9.8 | 2022-10-20 | Tenda 11N with firmware version V5.07.33_cn suffers from an Authentication Bypass vulnerability. |
CVE-2022-3577 | High | 7.8 | 2022-10-20 | An out-of-bounds memory write flaw was found in the Linux kernel’s Kid-friendly Wired Controller driver. This flaw allows a local user to crash or potentially… |
CVE-2022-2069 | High | 7.8 | 2022-10-20 | The APDFL.dll in Siemens JT2Go prior to V13.3.0.5 and Siemens Teamcenter Visualization prior to V14.0.0.2 contains an out of bounds write past the fixed-length… |
CVE-2022-42176 | High | 7.8 | 2022-10-20 | In PCTechSoft PCSecure V5.0.8.xw, use of Hard-coded Credentials in configuration files leads to admin panel access. |
CVE-2022-42021 | Critical | 9.8 | 2022-10-20 | Best Student Result Management System v1.0 is vulnerable to SQL Injection via /upresult/upresult/notice-details.php?nid=. |
CVE-2022-40084 | Medium | 5.3 | 2022-10-20 | OpenCRX before v5.2.2 was discovered to be vulnerable to password enumeration due to the difference in error messages received during a password reset which co… |
CVE-2022-42201 | High | 7.2 | 2022-10-20 | Simple Exam Reviewer Management System v1.0 is vulnerable to Insecure file upload. |
CVE-2022-42200 | Medium | 5.4 | 2022-10-20 | Simple Exam Reviewer Management System v1.0 is vulnerable to Stored Cross Site Scripting (XSS) via the Exam List. |
CVE-2022-42199 | High | 8.8 | 2022-10-20 | Simple Exam Reviewer Management System v1.0 is vulnerable to Cross Site Request Forgery (CSRF) via the Exam List. |
CVE-2022-42198 | High | 8.8 | 2022-10-20 | In Simple Exam Reviewer Management System v1.0 the User List function suffers from insecure file upload. |
CVE-2022-42197 | Medium | 6.5 | 2022-10-20 | In Simple Exam Reviewer Management System v1.0 the User List function has improper access control that allows low privileged users to modify user permissions t… |
CVE-2022-31366 | High | 7.2 | 2022-10-20 | An arbitrary file upload vulnerability in the apiImportLabs function in api_labs.php of EVE-NG 2.0.3-112 Community allows attackers to execute arbitrary code v… |
CVE-2022-37598 | Critical | 9.8 | 2022-10-20 | Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js. NOTE: the vendor considers this an i… |
CVE-2022-37298 | Critical | 9.8 | 2022-10-20 | Shinken Solutions Shinken Monitoring Version 2.4.3 affected is vulnerable to Incorrect Access Control. The SafeUnpickler class found in shinken/safepickle.py i… |
CVE-2022-26954 | Medium | 6.1 | 2022-10-20 | Multiple open redirect vulnerabilities in NopCommerce 4.10 through 4.50.1 allow remote attackers to conduct phishing attacks by redirecting users to attacker-c… |
CVE-2022-3576 | Medium | 5.3 | 2022-10-20 | A vulnerability regarding out-of-bounds read is found in the session processing functionality of Out-of-Band (OOB) Management. This allows remote attackers to… |
CVE-2022-27626 | Critical | 10.0 | 2022-10-20 | A vulnerability regarding concurrent execution using shared resource with improper synchronization ('Race Condition') is found in the session processing functi… |
CVE-2022-27625 | Critical | 10.0 | 2022-10-20 | A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the message processing functionality of Out-of-Ba… |
CVE-2022-27624 | Critical | 10.0 | 2022-10-20 | A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the packet decryption functionality of Out-of-Ban… |
CVE-2022-41358 | Medium | 5.4 | 2022-10-20 | A stored cross-site scripting (XSS) vulnerability in Garage Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payl… |
CVE-2022-3327 | Critical | 9.8 | 2022-10-20 | Missing Authentication for Critical Function in GitHub repository ikus060/rdiffweb prior to 2.5.0a6. |
CVE-2022-41983 | Low | 3.7 | 2022-10-19 | On specific hardware platforms, on BIG-IP versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, 14.1.x before 14.1.5.1, and all versions of 13.1.x, while Inte… |
CVE-2022-41836 | High | 7.5 | 2022-10-19 | When an 'Attack Signature False Positive Mode' enabled security policy is configured on a virtual server, undisclosed requests can cause the bd process to term… |
CVE-2022-41835 | High | 7.3 | 2022-10-19 | In F5OS-A version 1.x before 1.1.0 and F5OS-C version 1.x before 1.5.0, excessive file permissions in F5OS allows an authenticated local attacker to execute li… |
CVE-2022-41833 | High | 7.5 | 2022-10-19 | In all BIG-IP 13.1.x versions, when an iRule containing the HTTP::collect command is configured on a virtual server, undisclosed requests can cause Traffic Man… |
CVE-2022-41832 | High | 7.5 | 2022-10-19 | In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and 13.1.x before 13.1.5.1, when a SIP profi… |
CVE-2022-41813 | Medium | 6.5 | 2022-10-19 | In versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when BIG-IP is provisioned with PEM or AFM module… |
CVE-2022-41806 | High | 7.5 | 2022-10-19 | In versions 16.1.x before 16.1.3.2 and 15.1.x before 15.1.5.1, when BIG-IP AFM Network Address Translation policy with IPv6/IPv4 translation rules is configure… |
CVE-2022-41787 | High | 7.5 | 2022-10-19 | In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and 13.1.x before 13.1.5.1, when DNS profile… |
CVE-2022-41780 | Medium | 5.5 | 2022-10-19 | In F5OS-A version 1.x before 1.1.0 and F5OS-C version 1.x before 1.4.0, a directory traversal vulnerability exists in an undisclosed location of the F5OS CLI t… |
CVE-2022-41770 | Medium | 6.5 | 2022-10-19 | In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, 14.1.x before 14.1.5.1, and all versions of 13.1.x, and BIG-IQ all ver… |
CVE-2022-41743 | High | 7.0 | 2022-10-19 | NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_hls_module that might allow a local attacker to corrupt NGINX worker m… |
CVE-2022-41742 | High | 7.1 | 2022-10-19 | NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and… |
CVE-2022-41741 | High | 7.0 | 2022-10-19 | NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and… |
CVE-2022-41694 | Medium | 4.9 | 2022-10-19 | In BIG-IP versions 16.1.x before 16.1.3, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, and BIG-IQ versions 8.x before 8.2.0.1 and a… |
CVE-2022-41691 | High | 7.5 | 2022-10-19 | When a BIG-IP Advanced WAF/ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate. |
CVE-2022-41624 | High | 7.5 | 2022-10-19 | In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.2, 15.1.x before 15.1.7, 14.1.x before 14.1.5.2, and 13.1.x before 13.1.5.1, when a sideband iR… |
CVE-2022-41617 | High | 7.2 | 2022-10-19 | In versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and 13.1.x before 13.1.5.1, When the Advanced WAF / ASM module is provision… |
CVE-2022-38107 | Medium | 5.3 | 2022-10-19 | Sensitive information could be displayed when a detailed technical error message is posted. This information could disclose environmental details. |
CVE-2022-36795 | Medium | 5.3 | 2022-10-19 | In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, and 14.1.x before 14.1.5.1, when an LTM TCP profile with Auto Receive… |
CVE-2022-31684 | Medium | 4.3 | 2022-10-19 | Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid acc… |
CVE-2022-43029 | Critical | 9.8 | 2022-10-19 | Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the time parameter at /goform/SetSysTimeCfg. |
CVE-2022-43028 | Critical | 9.8 | 2022-10-19 | Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the timeZone parameter at /goform/SetSysTimeCfg. |
CVE-2022-43027 | Critical | 9.8 | 2022-10-19 | Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the firewallEn parameter at /goform/SetFirewallCfg. |
CVE-2022-43026 | Critical | 9.8 | 2022-10-19 | Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the endIp parameter at /goform/SetPptpServerCfg. |
CVE-2022-43025 | Critical | 9.8 | 2022-10-19 | Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the startIp parameter at /goform/SetPptpServerCfg. |
CVE-2022-43024 | Critical | 9.8 | 2022-10-19 | Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the list parameter at /goform/SetVirtualServerCfg. |
CVE-2022-41708 | Medium | 4.3 | 2022-10-19 | Relatedcode's Messenger version 7bcd20b allows an authenticated external attacker to access existing chats in the workspaces of any user of the application. Th… |
CVE-2022-43023 | Medium | 6.5 | 2022-10-19 | OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function. |
CVE-2022-43022 | Medium | 6.5 | 2022-10-19 | OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the tag_id variable in the Tag deletion function. |
CVE-2022-43021 | Medium | 6.5 | 2022-10-19 | OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the entriesPerPage variable. |
CVE-2022-43020 | Medium | 6.5 | 2022-10-19 | OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the tag_id variable in the Tag update function. |
CVE-2022-43019 | Critical | 9.8 | 2022-10-19 | OpenCATS v0.9.6 was discovered to contain a remote code execution (RCE) vulnerability via the getDataGridPager's ajax functionality. |
CVE-2022-43018 | Medium | 6.1 | 2022-10-19 | OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the email parameter in the Check Email function. |
CVE-2022-43017 | Medium | 6.1 | 2022-10-19 | OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the indexFile component. |
CVE-2022-43016 | Medium | 6.1 | 2022-10-19 | OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback component. |
CVE-2022-43015 | Medium | 6.1 | 2022-10-19 | OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the entriesPerPage parameter. |
CVE-2022-43014 | Medium | 6.1 | 2022-10-19 | OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the joborderID parameter. |
CVE-2022-42227 | High | 7.5 | 2022-10-19 | jsonlint 1.0 is vulnerable to heap-buffer-overflow via /home/hjsz/jsonlint/src/lexer. |
CVE-2022-40885 | Medium | 5.5 | 2022-10-19 | Bento4 v1.6.0-639 has a memory allocation issue that can cause denial of service. |
CVE-2022-40884 | Medium | 5.5 | 2022-10-19 | Bento4 1.6.0 has memory leaks via the mp4fragment. |
CVE-2022-3586 | Medium | 5.5 | 2022-10-19 | A flaw was found in the Linux kernel’s networking code. A use-after-free was found in the way the sch_sfb enqueue function used the socket buffer (SKB) cb fiel… |
CVE-2022-2805 | Medium | 6.5 | 2022-10-19 | A flaw was found in ovirt-engine, which leads to the logging of plaintext passwords in the log file when using otapi-style. This flaw allows an attacker with s… |
CVE-2022-23241 | High | 8.1 | 2022-10-19 | Clustered Data ONTAP versions 9.11.1 through 9.11.1P2 with SnapLock configured FlexGroups are susceptible to a vulnerability which could allow an authenticated… |
CVE-2022-1738 | High | 8.7 | 2022-10-19 | Fuji Electric D300win prior to version 3.7.1.17 is vulnerable to an out-of-bounds read, which could allow an attacker to leak sensitive data from the process m… |
CVE-2022-1523 | Medium | 6.1 | 2022-10-19 | Fuji Electric D300win prior to version 3.7.1.17 is vulnerable to a write-what-where condition, which could allow an attacker to overwrite program memory to man… |
CVE-2022-1414 | High | 8.8 | 2022-10-19 | 3scale API Management 2 does not perform adequate sanitation for user input in multiple fields. An authenticated user could use this flaw to inject scripts and… |
CVE-2022-41709 | High | 7.8 | 2022-10-19 | Markdownify version 1.4.1 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Mar… |
CVE-2022-41707 | Medium | 6.5 | 2022-10-19 | Relatedcode's Messenger version 7bcd20b allows an authenticated external attacker to access sensitive data of any user of the application. This is possible bec… |
CVE-2022-43435 | Medium | 5.3 | 2022-10-19 | Jenkins 360 FireLine Plugin 1.7.2 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived a… |
CVE-2022-43434 | Medium | 5.3 | 2022-10-19 | Jenkins NeuVector Vulnerability Scanner Plugin 1.20 and earlier programmatically disables Content-Security-Policy protection for user-generated content in work… |
CVE-2022-43433 | Medium | 4.3 | 2022-10-19 | Jenkins ScreenRecorder Plugin 0.7 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived a… |
CVE-2022-43432 | Medium | 4.3 | 2022-10-19 | Jenkins XFramium Builder Plugin 1.0.22 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archi… |
CVE-2022-43431 | Medium | 4.3 | 2022-10-19 | Jenkins Compuware Strobe Measurement Plugin 1.0.1 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read per… |
CVE-2022-43430 | High | 7.5 | 2022-10-19 | Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-43429 | High | 7.5 | 2022-10-19 | Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing a… |
CVE-2022-43428 | Medium | 5.3 | 2022-10-19 | Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing a… |
CVE-2022-43427 | Medium | 4.3 | 2022-10-19 | Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/R… |
CVE-2022-43426 | Medium | 5.3 | 2022-10-19 | Jenkins S3 Explorer Plugin 1.0.8 and earlier does not mask the AWS_SECRET_ACCESS_KEY form field, increasing the potential for attackers to observe and capture… |
CVE-2022-43425 | Medium | 5.4 | 2022-10-19 | Jenkins Custom Checkbox Parameter Plugin 1.4 and earlier does not escape the name and description of Custom Checkbox Parameter parameters on views displaying p… |
CVE-2022-43424 | Medium | 5.3 | 2022-10-19 | Jenkins Compuware Xpediter Code Coverage Plugin 1.0.7 and earlier implements an agent/controller message that does not limit where it can be executed, allowing… |
CVE-2022-43423 | Medium | 5.3 | 2022-10-19 | Jenkins Compuware Source Code Download for Endevor, PDS, and ISPW Plugin 2.0.12 and earlier implements an agent/controller message that does not limit where it… |
CVE-2022-43422 | Medium | 5.3 | 2022-10-19 | Jenkins Compuware Topaz Utilities Plugin 1.0.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attack… |
CVE-2022-43421 | Medium | 5.3 | 2022-10-19 | A missing permission check in Jenkins Tuleap Git Branch Source Plugin 3.2.4 and earlier allows unauthenticated attackers to trigger Tuleap projects whose confi… |
CVE-2022-43420 | Medium | 5.4 | 2022-10-19 | Jenkins Contrast Continuous Application Security Plugin 3.9 and earlier does not escape data returned from the Contrast service when generating a report, resul… |
CVE-2022-43419 | Medium | 6.5 | 2022-10-19 | Jenkins Katalon Plugin 1.0.32 and earlier stores API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with… |
CVE-2022-43418 | Medium | 4.3 | 2022-10-19 | A cross-site request forgery (CSRF) vulnerability in Jenkins Katalon Plugin 1.0.33 and earlier allows attackers to connect to an attacker-specified URL using a… |
CVE-2022-43417 | Medium | 4.3 | 2022-10-19 | Jenkins Katalon Plugin 1.0.32 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to conn… |
CVE-2022-43416 | High | 8.8 | 2022-10-19 | Jenkins Katalon Plugin 1.0.32 and earlier implements an agent/controller message that does not limit where it can be executed and allows invoking Katalon with… |
CVE-2022-43415 | High | 7.5 | 2022-10-19 | Jenkins REPO Plugin 1.15.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-43414 | Medium | 5.3 | 2022-10-19 | Jenkins NUnit Plugin 0.27 and earlier implements an agent-to-controller message that parses files inside a user-specified directory as test results, allowing a… |
CVE-2022-43413 | Medium | 4.3 | 2022-10-19 | Jenkins Job Import Plugin 3.5 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate… |
CVE-2022-43412 | Medium | 5.3 | 2022-10-19 | Jenkins Generic Webhook Trigger Plugin 1.84.1 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook… |
CVE-2022-43411 | Medium | 5.3 | 2022-10-19 | Jenkins GitLab Plugin 1.5.35 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal… |