2022 CVEs (page 116)
Page 116 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-22218 | High | 7.5 | 2022-10-18 | On SRX Series devices, an Improper Check for Unusual or Exceptional Conditions when using Certificate Management Protocol Version 2 (CMPv2) auto re-enrollment… |
CVE-2022-22211 | High | 7.5 | 2022-10-18 | A limitless resource allocation vulnerability in FPC resources of Juniper Networks Junos OS Evolved on PTX Series allows an unprivileged attacker to cause Deni… |
CVE-2022-22208 | Medium | 5.9 | 2022-10-18 | A Use After Free vulnerability in the Routing Protocol Daemon (rdp) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based a… |
CVE-2022-22201 | High | 7.5 | 2022-10-18 | An Improper Validation of Specified Index, Position, or Offset in Input vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows… |
CVE-2022-22192 | High | 7.5 | 2022-10-18 | An Improper Validation of Syntactic Correctness of Input vulnerability in the kernel of Juniper Networks Junos OS Evolved on PTX series allows a network-based… |
CVE-2022-3569 | High | 7.8 | 2022-10-17 | Due to an issue with incorrect sudo permissions, Zimbra Collaboration Suite (ZCS) suffers from a local privilege escalation issue in versions 9.0.0 and prior… |
CVE-2022-3158 | High | 8.8 | 2022-10-17 | Rockwell Automation FactoryTalk VantagePoint versions 8.0, 8.10, 8.20, 8.30, 8.31 are vulnerable to an input validation vulnerability. The FactoryTalk VantageP… |
CVE-2022-42147 | Medium | 6.1 | 2022-10-17 | kkFileView 4.0 is vulnerable to Cross Site Scripting (XSS) via controller\ Filecontroller.java. |
CVE-2022-42143 | High | 7.2 | 2022-10-17 | Open Source SACCO Management System v1.0 is vulnerable to SQL Injection via /sacco_shield/manage_payment.php. |
CVE-2022-42142 | High | 7.2 | 2022-10-17 | Online Tours & Travels Management System v1.0 is vulnerable to Arbitrary code execution via ip/tour/admin/operations/update_settings.php. |
CVE-2022-41431 | Medium | 5.4 | 2022-10-17 | xzs v3.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /admin/question/edit. This vulnerability allows attackers to e… |
CVE-2022-40606 | Medium | 6.1 | 2022-10-17 | MITRE CALDERA before 4.1.0 allows XSS in the Operations tab and/or Debrief plugin via a crafted operation name, a different vulnerability than CVE-2022-40605. |
CVE-2022-3552 | High | 7.2 | 2022-10-17 | Unrestricted Upload of File with Dangerous Type in GitHub repository boxbilling/boxbilling prior to 0.0.1. |
CVE-2022-3368 | High | 7.3 | 2022-10-17 | A vulnerability within the Software Updater functionality of Avira Security for Windows allowed an attacker with write access to the filesystem, to escalate hi… |
CVE-2022-38743 | High | 8.8 | 2022-10-17 | Rockwell Automation FactoryTalk VantagePoint versions 8.0, 8.10, 8.20, 8.30, 8.31 are vulnerable to an improper access control vulnerability. The FactoryTalk V… |
CVE-2022-42149 | Critical | 9.8 | 2022-10-17 | kkFileView 4.0 is vulnerable to Server-side request forgery (SSRF) via controller\OnlinePreviewController.java. |
CVE-2022-41139 | Medium | 5.4 | 2022-10-17 | MITRE CALDERA 4.1.0 allows stored XSS via app.contact.gist (aka the gist contact configuration field), leading to execution of arbitrary commands on agents. |
CVE-2022-40605 | Medium | 6.1 | 2022-10-17 | MITRE CALDERA before 4.1.0 allows XSS in the Operations tab and/or Debrief plugin via a crafted operation name, a different vulnerability than CVE-2022-40606. |
CVE-2022-3517 | High | 7.5 | 2022-10-17 | A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with… |
CVE-2022-3421 | Medium | 5.6 | 2022-10-17 | An attacker can pre-create the `/Applications/Google\ Drive.app/Contents/MacOS` directory which is expected to be owned by root to be owned by a non-root user… |
CVE-2022-3382 | High | 7.5 | 2022-10-17 | HIWIN Robot System Software version 3.3.21.9869 does not properly address the terminated command source. As a result, an attacker could craft code to disconnec… |
CVE-2022-3567 | Medium | 4.6 | 2022-10-17 | A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function inet6_stream_ops/inet6_dgram_ops of the c… |
CVE-2022-3566 | Medium | 4.6 | 2022-10-17 | A vulnerability was identified in Linux Kernel up to 4.19.316/5.4.278/5.10.220/5.15.161. This impacts the function tcp_getsockopt/tcp_setsockopt of the compone… |
CVE-2022-3565 | Medium | 4.6 | 2022-10-17 | A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue is the function del_timer of the file drivers/isdn/mI… |
CVE-2022-3564 | Medium | 5.5 | 2022-10-17 | A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the function l2cap_reassemble_sdu of the file net/bluetooth… |
CVE-2022-3563 | Low | 3.5 | 2022-10-17 | A vulnerability classified as problematic has been found in Linux Kernel. Affected is the function read_50_controller_cap_complete of the file tools/mgmt-teste… |
CVE-2022-32176 | Critical | 9.0 | 2022-10-17 | In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3b are vulnerable to Unrestricted File Upload that leads to execution of javascript code, through the "Compres… |
CVE-2022-42029 | High | 8.8 | 2022-10-17 | Chamilo 1.11.16 is affected by an authenticated local file inclusion vulnerability which allows authenticated users with access to 'big file uploads' to copy/m… |
CVE-2022-41751 | High | 7.8 | 2022-10-17 | Jhead 3.06.0.1 allows attackers to execute arbitrary OS commands by placing them in a JPEG filename and then using the regeneration -rgt50 option. |
CVE-2022-40055 | Critical | 9.8 | 2022-10-17 | An issue in GX Group GPON ONT Titanium 2122A T2122-V1.26EXL allows attackers to escalate privileges via a brute force attack at the login page. |
CVE-2022-3559 | Medium | 4.6 | 2022-10-17 | A vulnerability was found in Exim and classified as problematic. This issue affects some unknown processing of the component Regex Handler. The manipulation le… |
CVE-2022-26375 | Medium | 4.8 | 2022-10-17 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mammothology AB Press Optimizer plugin <= 1.1.1 on WordPress. |
CVE-2022-42221 | High | 8.8 | 2022-10-17 | Netgear R6220 v1.1.0.114_1.0.1 suffers from Incorrect Access Control, resulting in a command injection vulnerability. |
CVE-2022-3540 | Medium | 6.5 | 2022-10-17 | An issue has been discovered in hunter2 affecting all versions before 2.1.0. Improper handling of auto-completion input allows an authenticated attacker to ext… |
CVE-2022-3351 | Medium | 4.3 | 2022-10-17 | An issue has been discovered in GitLab EE affecting all versions starting from 13.7 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions… |
CVE-2022-3331 | Low | 3.5 | 2022-10-17 | An issue has been discovered in GitLab EE affecting all versions starting from 14.5 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions… |
CVE-2022-3330 | Medium | 4.3 | 2022-10-17 | It was possible for a guest user to read a todo targeting an inaccessible note in Gitlab CE/EE affecting all versions from 15.0 prior to 15.2.5, 15.3 prior to… |
CVE-2022-3325 | Low | 2.7 | 2022-10-17 | Improper access control in the GitLab CE/EE API affecting all versions starting from 12.8 before 15.2.5, all versions starting from 15.3 before 15.3.4, all ver… |
CVE-2022-3293 | Low | 3.5 | 2022-10-17 | Email addresses were leaked in WebHook logs in GitLab EE affecting all versions from 9.3 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 |
CVE-2022-3291 | Medium | 6.5 | 2022-10-17 | Serialization of sensitive data in GitLab EE affecting all versions from 14.9 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 can leak sensitiv… |
CVE-2022-3288 | Low | 3.5 | 2022-10-17 | A branch/tag name confusion in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows an attacker to manipu… |
CVE-2022-3286 | Medium | 5.3 | 2022-10-17 | Lack of IP address checking in GitLab EE affecting all versions from 14.2 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows a group member… |
CVE-2022-3283 | High | 7.5 | 2022-10-17 | A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before before 15.2.5, all versions starting from 15.3 before 15.3.4, all ve… |
CVE-2022-3279 | Low | 2.7 | 2022-10-17 | An unhandled exception in job log parsing in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows an atta… |
CVE-2022-3165 | Medium | 6.5 | 2022-10-17 | An integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the extended format. A malicious client could use this f… |
CVE-2022-3067 | Medium | 6.5 | 2022-10-17 | An issue has been discovered in the Import functionality of GitLab CE/EE affecting all versions starting from 14.4 before 15.2.5, all versions starting from 15… |
CVE-2022-3066 | Medium | 5.4 | 2022-10-17 | An issue has been discovered in GitLab affecting all versions starting from 10.0 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions sta… |
CVE-2022-3060 | High | 7.3 | 2022-10-17 | Improper control of a resource identifier in Error Tracking in GitLab CE/EE affecting all versions from 12.7 allows an authenticated attacker to generate conte… |
CVE-2022-3031 | Low | 3.7 | 2022-10-17 | An issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15… |
CVE-2022-3030 | Medium | 4.3 | 2022-10-17 | An improper access control issue in GitLab CE/EE affecting all versions starting before 15.1.6, all versions from 15.2 before 15.2.4, all versions from 15.3 be… |
CVE-2022-2992 | Critical | 9.9 | 2022-10-17 | A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated user to achieve remot… |
CVE-2022-2931 | High | 7.5 | 2022-10-17 | A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions… |
CVE-2022-2908 | Medium | 4.3 | 2022-10-17 | A potential DoS vulnerability was discovered in Gitlab CE/EE versions starting from 10.7 before 15.1.5, all versions starting from 15.2 before 15.2.3, all vers… |
CVE-2022-2884 | Critical | 9.9 | 2022-10-17 | A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated user to a… |
CVE-2022-2865 | High | 7.3 | 2022-10-17 | A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, 15.2 to 15.2.4 and 15.3 prior to 15.3.2. It was possible… |
CVE-2022-2630 | Medium | 4.3 | 2022-10-17 | An improper access control issue in GitLab CE/EE affecting all versions starting from 15.2 before 15.2.4, all versions from 15.3 before 15.3.2 allows disclosur… |
CVE-2022-2592 | Medium | 6.5 | 2022-10-17 | A lack of length validation in Snippet descriptions in GitLab CE/EE affecting all versions prior to 15.1.6, 15.2 prior to 15.2.4 and 15.3 prior to 15.3.2 allow… |
CVE-2022-2533 | Medium | 6.5 | 2022-10-17 | An issue has been discovered in GitLab affecting all versions starting from 12.10 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions st… |
CVE-2022-2527 | High | 7.3 | 2022-10-17 | An issue in Incident Timelines has been discovered in GitLab CE/EE affecting all versions starting from 14.9 before 15.1.6, all versions starting from 15.2 bef… |
CVE-2022-2455 | Medium | 6.5 | 2022-10-17 | A business logic issue in the handling of large repositories in all versions of GitLab CE/EE from 10.0 before 15.1.6, all versions starting from 15.2 before 15… |
CVE-2022-2428 | Medium | 6.4 | 2022-10-17 | A crafted tag in the Jupyter Notebook viewer in GitLab EE/CE affecting all versions before 15.1.6, 15.2 to 15.2.4, and 15.3 to 15.3.2 allows an attacker to iss… |
CVE-2022-28291 | Medium | 6.5 | 2022-10-17 | Insufficiently Protected Credentials: An authenticated user with debug privileges can retrieve stored Nessus policy credentials from the “nessusd” process in c… |
CVE-2022-23771 | High | 8.0 | 2022-10-17 | This vulnerability occurs in user accounts creation and deleteion related pages of IPTIME NAS products. The vulnerability could be exploited by a lack of valid… |
CVE-2022-23770 | High | 8.8 | 2022-10-17 | This vulnerability could allow a remote attacker to execute remote commands with improper validation of parameters of certain API constructors. Remote attacker… |
CVE-2022-23769 | High | 7.5 | 2022-10-17 | Remote code execution vulnerability due to insufficient user privilege verification in reverseWall-MDS. Remote attackers can exploit the vulnerability such as… |
CVE-2022-22128 | Critical | 9.8 | 2022-10-17 | Tableau discovered a path traversal vulnerability affecting Tableau Server Administration Agent’s internal file transfer service that could allow remote code e… |
CVE-2022-0699 | Critical | 9.8 | 2022-10-17 | A double-free condition exists in contrib/shpsort.c of shapelib 1.5.0 and older releases. This issue may allow an attacker to cause a denial of service or have… |
CVE-2022-42237 | Critical | 9.8 | 2022-10-17 | A SQL Injection issue in Merchandise Online Store v.1.0 allows an attacker to log in to the admin account. |
CVE-2022-42171 | Critical | 9.8 | 2022-10-17 | Tenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/saveParentControlInfo. |
CVE-2022-42170 | Critical | 9.8 | 2022-10-17 | Tenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/formWifiWpsStart. |
CVE-2022-42169 | Critical | 9.8 | 2022-10-17 | Tenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/addWifiMacFilter. |
CVE-2022-42168 | Critical | 9.8 | 2022-10-17 | Tenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/fromSetIpMacBind. |
CVE-2022-42167 | Critical | 9.8 | 2022-10-17 | Tenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/formSetFirewallCfg. |
CVE-2022-42166 | Critical | 9.8 | 2022-10-17 | Tenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/formSetSpeedWan. |
CVE-2022-42154 | Critical | 9.8 | 2022-10-17 | An arbitrary file upload vulnerability in the component /apiadmin/upload/attach of 74cmsSE v3.13.0 allows attackers to execute arbitrary code via a crafted PHP… |
CVE-2022-41542 | Medium | 5.4 | 2022-10-17 | devhub 0.102.0 was discovered to contain a broken session control. |
CVE-2022-41498 | High | 7.2 | 2022-10-17 | Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinventory/editbrand.php. |
CVE-2022-41472 | Medium | 5.4 | 2022-10-17 | 74cmsSE v3.12.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /apiadmin/notice/add. This vulnerability allows attacker… |
CVE-2022-41471 | Medium | 6.5 | 2022-10-17 | 74cmsSE v3.12.0 allows authenticated attackers with low-level privileges to arbitrarily change the rights and credentials of the Super Administrator account. |
CVE-2022-42165 | Critical | 9.8 | 2022-10-17 | Tenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/formSetDeviceName. |
CVE-2022-42164 | Critical | 9.8 | 2022-10-17 | Tenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/formSetClientState. |
CVE-2022-42163 | Critical | 9.8 | 2022-10-17 | Tenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/fromNatStaticSetting. |
CVE-2022-3553 | Low | 3.5 | 2022-10-17 | A vulnerability, which was classified as problematic, was found in X.org Server. This affects an unknown part of the file hw/xquartz/X11Controller.m of the com… |
CVE-2022-3551 | Low | 3.5 | 2022-10-17 | A vulnerability, which was classified as problematic, has been found in X.org Server. Affected by this issue is the function ProcXkbGetKbdByName of the file xk… |
CVE-2022-3550 | Medium | 5.5 | 2022-10-17 | A vulnerability classified as critical was found in X.org Server. Affected by this vulnerability is the function _GetCountedString of the file xkb/xkb.c. The m… |
CVE-2022-3549 | Medium | 4.7 | 2022-10-17 | A vulnerability was found in SourceCodester Simple Cold Storage Management System 1.0. It has been rated as problematic. This issue affects some unknown proces… |
CVE-2022-3548 | Low | 2.4 | 2022-10-17 | A vulnerability was found in SourceCodester Simple Cold Storage Management System 1.0. It has been declared as problematic. This vulnerability affects unknown… |
CVE-2022-3547 | Low | 2.4 | 2022-10-17 | A vulnerability was found in SourceCodester Simple Cold Storage Management System 1.0. It has been classified as problematic. This affects an unknown part of t… |
CVE-2022-3546 | Low | 2.4 | 2022-10-17 | A vulnerability was found in SourceCodester Simple Cold Storage Management System 1.0 and classified as problematic. Affected by this issue is some unknown fun… |
CVE-2022-3545 | Medium | 5.5 | 2022-10-17 | A vulnerability has been found in Linux Kernel and classified as critical. Affected by this vulnerability is the function area_cache_get of the file drivers/ne… |
CVE-2022-3544 | Low | 3.5 | 2022-10-17 | A vulnerability, which was classified as problematic, was found in Linux Kernel. Affected is the function damon_sysfs_add_target of the file mm/damon/sysfs.c o… |
CVE-2022-3543 | Low | 3.5 | 2022-10-17 | A vulnerability, which was classified as problematic, has been found in Linux Kernel. This issue affects the function unix_sock_destructor/unix_release_sock of… |
CVE-2022-3541 | Medium | 5.5 | 2022-10-17 | A vulnerability classified as critical has been found in Linux Kernel. This affects the function spl2sw_nvmem_get_mac_address of the file drivers/net/ethernet/… |
CVE-2022-3282 | Medium | 4.3 | 2022-10-17 | The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.5 does not properly check for the upload size limit set in forms, taking the value from us… |
CVE-2022-3244 | Medium | 4.2 | 2022-10-17 | The Import all XML, CSV & TXT WordPress plugin before 6.5.8 does not have authorisation in some places, which could allow any authenticated users to access som… |
CVE-2022-3243 | High | 7.2 | 2022-10-17 | The Import all XML, CSV & TXT WordPress plugin before 6.5.8 does not properly sanitise and escape imported data before using them back SQL statements, leading… |
CVE-2022-3206 | Medium | 5.9 | 2022-10-17 | The Passster WordPress plugin before 3.5.5.5.2 stores the password inside a cookie named "passster" using base64 encoding method which is easy to decode. This… |
CVE-2022-3151 | Medium | 4.3 | 2022-10-17 | The WP Custom Cursors WordPress plugin before 3.0.1 does not have CSRF check in place when deleting cursors, which could allow attackers to made a logged in ad… |
CVE-2022-3150 | High | 7.2 | 2022-10-17 | The WP Custom Cursors WordPress plugin before 3.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL inject… |
CVE-2022-3149 | Medium | 6.1 | 2022-10-17 | The WP Custom Cursors WordPress plugin before 3.0.1 does not have CSRF check in place when creating and editing cursors, which could allow attackers to made a… |