2022 CVEs (page 119)
Page 119 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-2780 | High | 8.1 | 2022-10-14 | In affected versions of Octopus Server it is possible to use the Git Connectivity test function on the VCS project to initiate an SMB request resulting in the… |
CVE-2022-41536 | High | 7.2 | 2022-10-14 | Open Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /sacco_shield/manage_user.php. |
CVE-2022-41535 | High | 7.2 | 2022-10-14 | Open Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /sacco_shield/manage_borrower.php. |
CVE-2022-41539 | High | 8.8 | 2022-10-14 | Wedding Planner v1.0 was discovered to contain an arbitrary file upload vulnerability in the component /admin/users_add.php. This vulnerability allows attacker… |
CVE-2022-41538 | High | 8.8 | 2022-10-14 | Wedding Planner v1.0 was discovered to contain an arbitrary file upload vulnerability in the component /Wedding-Management-PHP/admin/photos_add.php. This vulne… |
CVE-2022-36803 | High | 8.8 | 2022-10-14 | The MasterUserEdit API in Atlassian Jira Align Server before version 10.109.2 allows An authenticated attacker with the People role permission to use the Maste… |
CVE-2022-36802 | Medium | 4.9 | 2022-10-14 | The ManageJiraConnectors API in Atlassian Jira Align before version 10.109.2 allows remote attackers to exploit this issue to access internal network resources… |
CVE-2022-42722 | Medium | 5.5 | 2022-10-14 | In the Linux kernel 5.8 through 5.19.x before 5.19.16, local attackers able to inject WLAN frames into the mac80211 stack could cause a NULL pointer dereferenc… |
CVE-2022-42721 | Medium | 5.5 | 2022-10-14 | A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inj… |
CVE-2022-42720 | High | 7.8 | 2022-10-14 | Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers… |
CVE-2022-41674 | High | 8.1 | 2022-10-14 | An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could cause a buffer overflow in the ieee80211_bss_info_update… |
CVE-2022-39302 | Medium | 5.5 | 2022-10-14 | Ree6 is a moderation bot. This vulnerability would allow other server owners to create configurations such as "Better-Audit-Logging" which contain a channel fr… |
CVE-2022-42719 | High | 8.8 | 2022-10-13 | A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through 5.19.x before 5.19.16 could be used by attackers (abl… |
CVE-2022-41391 | Critical | 9.8 | 2022-10-13 | OcoMon v4.0 was discovered to contain a SQL injection vulnerability via the cod parameter at showImg.php. |
CVE-2022-41390 | Critical | 9.8 | 2022-10-13 | OcoMon v4.0 was discovered to contain a SQL injection vulnerability via the cod parameter at download.php. |
CVE-2022-39303 | High | 8.1 | 2022-10-13 | Ree6 is a moderation bot. This vulnerability allows manipulation of SQL queries. This issue has been patched in version 1.7.0 by using Javas PreparedStatements… |
CVE-2022-39295 | Medium | 6.1 | 2022-10-13 | Knowage is an open source suite for modern business analytics alternative over big data systems. KnowageLabs / Knowage-Server starting with the 6.x branch and… |
CVE-2022-39278 | High | 7.5 | 2022-10-13 | Istio is an open platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection. Prior to versions 1.15.2, 1… |
CVE-2022-39229 | Medium | 4.3 | 2022-10-13 | Grafana is an open source data visualization platform for metrics, logs, and traces. Versions prior to 9.1.8 and 8.5.14 allow one user to block another user's… |
CVE-2022-39201 | Medium | 6.8 | 2022-10-13 | Grafana is an open source observability and data visualization platform. Starting with version 5.0.0-beta1 and prior to versions 8.5.14 and 9.1.8, Grafana coul… |
CVE-2022-35612 | Medium | 5.4 | 2022-10-13 | A cross-site scripting (XSS) vulnerability in MQTTRoute v3.3 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected… |
CVE-2022-35611 | Medium | 4.3 | 2022-10-13 | A Cross-Site Request Forgery (CSRF) in MQTTRoute v3.3 and below allows attackers to create and remove dashboards. |
CVE-2022-35136 | Medium | 6.5 | 2022-10-13 | Boodskap IoT Platform v4.4.9-02 allows attackers to make unauthenticated API requests. |
CVE-2022-35135 | High | 8.8 | 2022-10-13 | Boodskap IoT Platform v4.4.9-02 allows attackers to escalate privileges via a crafted request sent to /api/user/upsert/<uuid>. |
CVE-2022-35134 | Medium | 5.4 | 2022-10-13 | Boodskap IoT Platform v4.4.9-02 contains a cross-site scripting (XSS) vulnerability. |
CVE-2022-34022 | High | 7.2 | 2022-10-13 | SQL injection vulnerability in ResIOT IOT Platform + LoRaWAN Network Server through 4.1.1000114 via a crafted POST request to /ResiotQueryDBActive. |
CVE-2022-34021 | Medium | 5.4 | 2022-10-13 | Multiple Cross Site Scripting (XSS) vulnerabilities in ResIOT IOT Platform + LoRaWAN Network Server through 4.1.1000114 via the form fields. |
CVE-2022-31130 | Medium | 4.9 | 2022-10-13 | Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication… |
CVE-2022-39300 | High | 7.7 | 2022-10-13 | node SAML is a SAML 2.0 library based on the SAML implementation of passport-saml. A remote attacker may be able to bypass SAML authentication on a website usi… |
CVE-2022-35944 | Medium | 6.2 | 2022-10-13 | October is a self-hosted Content Management System (CMS) platform based on the Laravel PHP Framework. This vulnerability only affects installations that rely o… |
CVE-2022-31123 | Medium | 6.1 | 2022-10-13 | Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in the plugin signature… |
CVE-2022-41534 | High | 7.2 | 2022-10-13 | Online Diagnostic Lab Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /php_action/createOrder.php. Th… |
CVE-2022-41533 | High | 7.2 | 2022-10-13 | Online Diagnostic Lab Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /php_action/editProductImage.ph… |
CVE-2022-41497 | Critical | 9.8 | 2022-10-13 | ClipperCMS 1.3.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the pkg_url parameter at /manager/index.php. |
CVE-2022-41496 | Critical | 9.8 | 2022-10-13 | iCMS v7.0.16 was discovered to contain a Server-Side Request Forgery (SSRF) via the url parameter at admincp.php. |
CVE-2022-41495 | Critical | 9.8 | 2022-10-13 | ClipperCMS 1.3.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the rss_url_news parameter at /manager/index.php. |
CVE-2022-3457 | Critical | 9.8 | 2022-10-13 | Origin Validation Error in GitHub repository ikus060/rdiffweb prior to 2.5.0a5. |
CVE-2022-3456 | Critical | 9.8 | 2022-10-13 | Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0. |
CVE-2022-42161 | High | 8.8 | 2022-10-13 | D-Link COVR 1200,1202,1203 v1.08 was discovered to contain a command injection vulnerability via the /SetTriggerWPS/PIN parameter at function SetTriggerWPS. |
CVE-2022-42160 | High | 8.8 | 2022-10-13 | D-Link COVR 1200,1202,1203 v1.08 was discovered to contain a command injection vulnerability via the system_time_timezone parameter at function SetNTPServerSet… |
CVE-2022-42159 | Medium | 4.3 | 2022-10-13 | D-Link COVR 1200,1202,1203 v1.08 was discovered to have a predictable seed in a Pseudo-Random Number Generator. |
CVE-2022-42156 | High | 8.8 | 2022-10-13 | D-Link COVR 1200,1203 v1.08 was discovered to contain a command injection vulnerability via the tomography_ping_number parameter at function SetNetworkTomograp… |
CVE-2022-41485 | High | 7.5 | 2022-10-13 | Tenda AC1200 US_AC6V2.0RTL_V15.03.06.51_multi_TDE01 was discovered to contain a buffer overflow in the 0x47ce00 function. This vulnerability allows attackers t… |
CVE-2022-41484 | High | 7.5 | 2022-10-13 | Tenda AC1900 AP500(US)_V1_180320(Beta) was discovered to contain a buffer overflow in the 0x32384 function. This vulnerability allows attackers to cause a Deni… |
CVE-2022-41483 | High | 7.5 | 2022-10-13 | Tenda AC1200 US_AC6V2.0RTL_V15.03.06.51_multi_TDE01 was discovered to contain a buffer overflow in the 0x4a12cc function. This vulnerability allows attackers t… |
CVE-2022-41482 | High | 7.5 | 2022-10-13 | Tenda AC1200 US_AC6V2.0RTL_V15.03.06.51_multi_TDE01 was discovered to contain a buffer overflow in the 0x47c5dc function. This vulnerability allows attackers t… |
CVE-2022-41481 | High | 7.5 | 2022-10-13 | Tenda AC1200 US_AC6V2.0RTL_V15.03.06.51_multi_TDE01 was discovered to contain a buffer overflow in the 0x47de1c function. This vulnerability allows attackers t… |
CVE-2022-41480 | High | 7.5 | 2022-10-13 | Tenda AC1200 US_AC6V2.0RTL_V15.03.06.51_multi_TDE01 was discovered to contain a buffer overflow in the 0x475dc function. This vulnerability allows attackers to… |
CVE-2022-39293 | High | 8.6 | 2022-10-13 | Azure RTOS USBX is a high-performance USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. The case is, in [… |
CVE-2022-3493 | Low | 3.5 | 2022-10-13 | A vulnerability, which was classified as problematic, has been found in SourceCodester Human Resource Management System 1.0. This issue affects some unknown pr… |
CVE-2022-3492 | Medium | 6.3 | 2022-10-13 | A vulnerability classified as critical was found in SourceCodester Human Resource Management System 1.0. This vulnerability affects unknown code of the compone… |
CVE-2022-41489 | High | 8.1 | 2022-10-13 | WAYOS LQ_09 22.03.17V was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to send crafted requests to the server from the affe… |
CVE-2022-41475 | High | 8.8 | 2022-10-13 | RPCMS v3.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add an administrator account. |
CVE-2022-41474 | Medium | 6.5 | 2022-10-13 | RPCMS v3.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily change the password of any account. |
CVE-2022-41473 | Medium | 6.1 | 2022-10-13 | RPCMS v3.0.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the Search function. |
CVE-2022-42889 | Critical | 9.8 | 2022-10-13 | Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${… |
CVE-2022-38902 | Medium | 5.4 | 2022-10-13 | A Cross-site scripting (XSS) vulnerability in the Blog module - add new topic functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote att… |
CVE-2022-24697 | Critical | 9.8 | 2022-10-13 | Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu. RCE can be implem… |
CVE-2022-37208 | High | 8.8 | 2022-10-13 | JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenat… |
CVE-2022-35081 | Medium | 5.5 | 2022-10-13 | SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via png_read_header at /src/png2swf.c. |
CVE-2022-35080 | Medium | 5.5 | 2022-10-13 | SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via png_load at /lib/png.c. |
CVE-2022-2828 | Medium | 6.5 | 2022-10-13 | In affected versions of Octopus Server it is possible to reveal information about teams via the API due to an Insecure Direct Object Reference (IDOR) vulnerabi… |
CVE-2022-3473 | Medium | 6.3 | 2022-10-13 | A vulnerability classified as critical has been found in SourceCodester Human Resource Management System. This affects an unknown part of the file getstatecity… |
CVE-2022-3472 | Medium | 6.3 | 2022-10-13 | A vulnerability was found in SourceCodester Human Resource Management System. It has been rated as critical. Affected by this issue is some unknown functionali… |
CVE-2022-3471 | Medium | 6.3 | 2022-10-13 | A vulnerability was found in SourceCodester Human Resource Management System. It has been declared as critical. Affected by this vulnerability is an unknown fu… |
CVE-2022-3470 | Medium | 6.3 | 2022-10-13 | A vulnerability was found in SourceCodester Human Resource Management System. It has been classified as critical. Affected is an unknown function of the file g… |
CVE-2022-42906 | High | 7.8 | 2022-10-13 | powerline-gitstatus (aka Powerline Gitstatus) before 1.3.2 allows arbitrary code execution. git repositories can contain per-repository configuration that chan… |
CVE-2022-42902 | High | 8.8 | 2022-10-13 | In Linaro Automated Validation Architecture (LAVA) before 2022.10, there is dynamic code execution in lava_server/lavatable.py. Due to improper input sanitizat… |
CVE-2022-42901 | High | 7.8 | 2022-10-13 | Bentley MicroStation and MicroStation-based applications may be affected by out-of-bounds and stack overflow issues when opening crafted XMT files. Exploiting… |
CVE-2022-42900 | High | 7.8 | 2022-10-13 | Bentley MicroStation and MicroStation-based applications may be affected by out-of-bounds read issues when opening crafted FBX files. Exploiting these issues c… |
CVE-2022-42899 | High | 7.8 | 2022-10-13 | Bentley MicroStation and MicroStation-based applications may be affected by out-of-bounds read and stack overflow issues when opening crafted SKP files. Exploi… |
CVE-2022-40187 | High | 8.0 | 2022-10-13 | Foresight GC3 Launch Monitor 1.3.15.68 ships with a Target Communication Framework (TCF) service enabled. This service listens on a TCP port on all interfaces… |
CVE-2022-34020 | High | 8.8 | 2022-10-13 | Cross Site Request Forgery (CSRF) vulnerability in ResIOT ResIOT IOT Platform + LoRaWAN Network Server through 4.1.1000114 allows attackers to add new admin us… |
CVE-2022-42897 | Critical | 9.8 | 2022-10-13 | Array Networks AG/vxAG with ArrayOS AG before 9.4.0.469 allows unauthenticated command injection that leads to privilege escalation and control of the system… |
CVE-2022-3171 | Medium | 4.3 | 2022-10-12 | A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inp… |
CVE-2022-39298 | High | 7.7 | 2022-10-12 | MelisFront is the engine that displays website hosted on Melis Platform. It deals with showing pages, plugins, URL rewritting, search optimization and SEO, etc… |
CVE-2022-39297 | High | 7.7 | 2022-10-12 | MelisCms provides a full CMS for Melis Platform, including templating system, drag'n'drop of plugins, SEO and many administration tools. Attackers can deserial… |
CVE-2022-39283 | Medium | 5.9 | 2022-10-12 | FreeRDP is a free remote desktop protocol library and clients. All FreeRDP based clients when using the `/video` command line switch might read uninitialized d… |
CVE-2022-39282 | Low | 3.5 | 2022-10-12 | FreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using `/parallel` command line switch might read uninitial… |
CVE-2022-41316 | Medium | 5.3 | 2022-10-12 | HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role's CA into memory on… |
CVE-2022-39299 | High | 7.4 | 2022-10-12 | Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML authenticati… |
CVE-2022-41351 | Medium | 6.1 | 2022-10-12 | In Zimbra Collaboration Suite (ZCS) 8.8.15, at the URL /h/calendar, one can trigger XSS by adding JavaScript code to the view parameter and changing the value… |
CVE-2022-41350 | Medium | 6.1 | 2022-10-12 | In Zimbra Collaboration Suite (ZCS) 8.8.15, /h/search?action=voicemail&action=listen accepts a phone parameter that is vulnerable to Reflected XSS. This allows… |
CVE-2022-41349 | Medium | 6.1 | 2022-10-12 | In Zimbra Collaboration Suite (ZCS) 8.8.15, the URL at /h/compose accepts an attachUrl parameter that is vulnerable to Reflected XSS. This allows executing arb… |
CVE-2022-41348 | Medium | 6.1 | 2022-10-12 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0. XSS can occur via the onerror attribute of an IMG element, leading to information disclosure. |
CVE-2022-37601 | Critical | 9.8 | 2022-10-12 | Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all vers… |
CVE-2022-34391 | High | 7.5 | 2022-10-12 | Dell Client BIOS Versions prior to the remediated version contain an improper input validation vulnerability. A local authenticated malicious user may potentia… |
CVE-2022-34390 | High | 7.5 | 2022-10-12 | Dell BIOS contains a use of uninitialized variable vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an S… |
CVE-2022-33937 | High | 7.1 | 2022-10-12 | Dell GeoDrive, Versions 1.0 - 2.2, contain a Path Traversal Vulnerability in the reporting function. A local, low privileged attacker could potentially exploit… |
CVE-2022-33922 | High | 7.0 | 2022-10-12 | Dell GeoDrive, versions prior to 2.2, contains Insecure File and Folder Permissions vulnerabilities. A low privilege attacker could potentially exploit this vu… |
CVE-2022-33921 | High | 7.0 | 2022-10-12 | Dell GeoDrive, versions prior to 2.2, contains Multiple DLL Hijacking Vulnerabilities. A low privilege attacker could potentially exploit this vulnerability, l… |
CVE-2022-33920 | High | 7.8 | 2022-10-12 | Dell GeoDrive, versions prior to 2.2, contains an Unquoted File Path vulnerability. A low privilege attacker could potentially exploit this vulnerability, lead… |
CVE-2022-33919 | High | 7.8 | 2022-10-12 | Dell GeoDrive, versions 2.1 - 2.2, contains an information disclosure vulnerability in GUI. An authenticated non-admin user could potentially exploit this vuln… |
CVE-2022-33918 | Medium | 5.5 | 2022-10-12 | Dell GeoDrive, Versions 2.1 - 2.2, contains an information disclosure vulnerability. An authenticated non-admin user could potentially exploit this vulnerabili… |
CVE-2022-32493 | Medium | 6.0 | 2022-10-12 | Dell BIOS contains an Stack-Based Buffer Overflow vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SM… |
CVE-2022-32491 | Medium | 4.1 | 2022-10-12 | Dell Client BIOS contains a Buffer Overflow vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by manipulating an S… |
CVE-2022-32489 | High | 8.2 | 2022-10-12 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI… |
CVE-2022-32488 | High | 8.2 | 2022-10-12 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI… |
CVE-2022-32487 | High | 7.5 | 2022-10-12 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI… |
CVE-2022-32485 | High | 7.5 | 2022-10-12 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI… |