2022 CVEs (page 120)
Page 120 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-32484 | Medium | 5.6 | 2022-10-12 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileges may potentially exploit this vulnerab… |
CVE-2022-32483 | Medium | 5.6 | 2022-10-12 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileges may potentially exploit this vulnerab… |
CVE-2022-31228 | High | 8.1 | 2022-10-12 | Dell EMC XtremIO versions prior to X2 6.4.0-22 contain a bruteforce vulnerability. A remote unauthenticated attacker can potentially exploit this vulnerability… |
CVE-2022-42087 | Medium | 6.5 | 2022-10-12 | Tenda AX1803 US_AX1803v2.0br_v1.0.0.1_2994_CN_ZGYD01_4 is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolReboot. |
CVE-2022-42086 | Medium | 6.5 | 2022-10-12 | Tenda AX1803 US_AX1803v2.0br_v1.0.0.1_2994_CN_ZGYD01_4 is vulnerable to Cross Site Request Forgery (CSRF) via function TendaAteMode. |
CVE-2022-42081 | High | 7.5 | 2022-10-12 | Tenda AC1206 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01 was discovered to contain a stack overflow via sched_end_time parameter. |
CVE-2022-42080 | High | 7.5 | 2022-10-12 | Tenda AC1206 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01 was discovered to contain a heap overflow via sched_start_time parameter. |
CVE-2022-42079 | High | 7.5 | 2022-10-12 | Tenda AC1206 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01 was discovered to contain a stack overflow via the function formWifiBasicSet. |
CVE-2022-42078 | Medium | 6.5 | 2022-10-12 | Tenda AC1206 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01 is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolRestoreSet. |
CVE-2022-42077 | Medium | 6.5 | 2022-10-12 | Tenda AC1206 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01 is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolReboot. |
CVE-2022-2249 | High | 7.7 | 2022-10-12 | Privilege escalation related vulnerabilities were discovered in Avaya Aura Communication Manager that may allow local administrative users to escalate their pr… |
CVE-2022-41403 | Critical | 9.8 | 2022-10-12 | OpenCart 3.x Newsletter Custom Popup was discovered to contain a SQL injection vulnerability via the email parameter at index.php?route=extension/module/so_new… |
CVE-2022-28887 | Medium | 4.3 | 2022-10-12 | Multiple Denial-of-Service (DoS) vulnerability was discovered in F-Secure & WithSecure products whereby the aerdl.dll unpacker handler function crashes. This c… |
CVE-2022-0030 | High | 8.1 | 2022-10-12 | An authentication bypass vulnerability in the Palo Alto Networks PAN-OS 8.1 web interface allows a network-based attacker with specific knowledge of the target… |
CVE-2022-3467 | Medium | 5.5 | 2022-10-12 | A vulnerability classified as critical was found in Jiusi OA. Affected by this vulnerability is an unknown functionality of the file /jsoa/hntdCustomDesktopAct… |
CVE-2022-33106 | Critical | 9.8 | 2022-10-12 | WiJungle NGFW Version U250 was discovered to be vulnerable to No Rate Limit attack, allowing the attacker to brute force the admin password leading to Account… |
CVE-2022-42715 | Medium | 6.1 | 2022-10-12 | A reflected XSS vulnerability exists in REDCap before 12.04.18 in the Alerts & Notifications upload feature. A crafted CSV file will, when uploaded, trigger ar… |
CVE-2022-40871 | Critical | 9.8 | 2022-10-12 | Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection. By default, any administrator can be added to the installation page of dolibarr, and if successful… |
CVE-2022-37614 | Critical | 9.8 | 2022-10-12 | Prototype pollution vulnerability in function enable in mockery.js in mfncooper mockery commit 822f0566fd6d72af8c943ae5ca2aa92e516aa2cf via the key variable in… |
CVE-2022-3465 | High | 7.3 | 2022-10-12 | A vulnerability classified as critical was found in Mediabridge Medialink. This vulnerability affects unknown code of the file /index.asp. The manipulation lea… |
CVE-2022-3464 | Medium | 4.3 | 2022-10-12 | A vulnerability classified as problematic has been found in puppyCMS up to 5.1. This affects an unknown part of the file /admin/settings.php. The manipulation… |
CVE-2022-40664 | Critical | 9.8 | 2022-10-12 | Apache Shiro before 1.10.0, Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher. |
CVE-2022-3458 | Medium | 6.3 | 2022-10-12 | A vulnerability has been found in SourceCodester Human Resource Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown… |
CVE-2022-2720 | Medium | 5.3 | 2022-10-12 | In affected versions of Octopus Server it was identified that when a sensitive value is a substring of another value, sensitive value masking will only partial… |
CVE-2022-42711 | Critical | 9.6 | 2022-10-12 | In Progress WhatsUp Gold before 22.1.0, an SNMP MIB Walker application endpoint failed to adequately sanitize malicious input. This could allow an unauthentica… |
CVE-2022-40469 | High | 8.8 | 2022-10-12 | iKuai OS v3.6.7 was discovered to contain an authenticated remote code execution (RCE) vulnerability. |
CVE-2022-37611 | Critical | 9.8 | 2022-10-12 | Prototype pollution vulnerability in tschaub gh-pages 3.1.0 via the partial variable in util.js. |
CVE-2022-41606 | Medium | 6.5 | 2022-10-12 | HashiCorp Nomad and Nomad Enterprise 1.0.2 up to 1.2.12, and 1.3.5 jobs submitted with an artifact stanza using invalid S3 or GCS URLs can be used to crash cli… |
CVE-2022-41532 | High | 7.2 | 2022-10-12 | Open Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /sacco_shield/ajax.php?action=delete_p… |
CVE-2022-41530 | High | 7.2 | 2022-10-12 | Open Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /sacco_shield/ajax.php?action=delete_b… |
CVE-2022-41408 | Critical | 9.8 | 2022-10-12 | Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/view_order. |
CVE-2022-41407 | High | 7.2 | 2022-10-12 | Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/view_order. |
CVE-2022-41406 | High | 7.2 | 2022-10-12 | An arbitrary file upload vulnerability in the /admin/admin_pic.php component of Church Management System v1.0 allows attackers to execute arbitrary code via a… |
CVE-2022-40921 | High | 7.2 | 2022-10-12 | DedeCMS V5.7.99 was discovered to contain an arbitrary file upload vulnerability via the component /dede/file_manage_control.php. |
CVE-2022-40440 | Medium | 6.1 | 2022-10-12 | mxGraph v4.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the setTooltips() function. |
CVE-2022-28866 | High | 8.8 | 2022-10-12 | Multiple Improper Access Control was discovered in Nokia AirFrame BMC Web GUI < R18 Firmware v4.13.00. It does not properly validate requests for access to (or… |
CVE-2022-42717 | High | 7.8 | 2022-10-11 | An issue was discovered in Hashicorp Packer before 2.3.1. The recommended sudoers configuration for Vagrant on Linux is insecure. If the host has been configur… |
CVE-2022-41404 | High | 7.5 | 2022-10-11 | An issue in the fetch() method in the BasicProfile class of org.ini4j through version v0.5.4 allows attackers to cause a Denial of Service (DoS) via unspecifie… |
CVE-2022-40777 | High | 8.8 | 2022-10-11 | Interspire Email Marketer through 6.5.0 allows arbitrary file upload via a surveys_submit.php "create survey and submit survey" operation, which can cause a .p… |
CVE-2022-37617 | Critical | 9.8 | 2022-10-11 | Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the k variable in resolve-shims.js. |
CVE-2022-42044 | Critical | 9.8 | 2022-10-11 | The d8s-asns package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus… |
CVE-2022-42043 | Critical | 9.8 | 2022-10-11 | The d8s-xml package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-… |
CVE-2022-42042 | Critical | 9.8 | 2022-10-11 | The d8s-networking package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the demo… |
CVE-2022-42041 | Critical | 9.8 | 2022-10-11 | The d8s-file-system package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the dem… |
CVE-2022-42040 | Critical | 9.8 | 2022-10-11 | The d8s-algorithms package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the demo… |
CVE-2022-42039 | Critical | 9.8 | 2022-10-11 | The d8s-lists package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritu… |
CVE-2022-42038 | Critical | 9.8 | 2022-10-11 | The d8s-ip-addresses package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the de… |
CVE-2022-42037 | Critical | 9.8 | 2022-10-11 | The d8s-asns package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus… |
CVE-2022-42036 | Critical | 9.8 | 2022-10-11 | The d8s-urls package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus… |
CVE-2022-41550 | Medium | 6.5 | 2022-10-11 | GNU oSIP v5.3.0 was discovered to contain an integer overflow via the component osip_body_parse_header. |
CVE-2022-41387 | Critical | 9.8 | 2022-10-11 | The d8s-pdfs package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus… |
CVE-2022-41386 | Critical | 9.8 | 2022-10-11 | The d8s-utility package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democri… |
CVE-2022-41385 | Critical | 9.8 | 2022-10-11 | The d8s-html package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus… |
CVE-2022-41384 | Critical | 9.8 | 2022-10-11 | The d8s-domains package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democri… |
CVE-2022-41383 | Critical | 9.8 | 2022-10-11 | The d8s-archives package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democr… |
CVE-2022-41382 | Critical | 9.8 | 2022-10-11 | The d8s-json package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus… |
CVE-2022-41381 | Critical | 9.8 | 2022-10-11 | The d8s-utility package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democri… |
CVE-2022-41380 | Critical | 9.8 | 2022-10-11 | The d8s-yaml package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus… |
CVE-2022-41210 | Medium | 5.2 | 2022-10-11 | SAP Customer Data Cloud (Gigya mobile app for Android) - version 7.4, uses insecure random number generator program which makes it easy for the attacker to pre… |
CVE-2022-41209 | Medium | 5.2 | 2022-10-11 | SAP Customer Data Cloud (Gigya mobile app for Android) - version 7.4, uses encryption method which lacks proper diffusion and does not hide the patterns well… |
CVE-2022-41206 | Medium | 5.4 | 2022-10-11 | SAP BusinessObjects Business Intelligence platform (Analysis for OLAP) - versions 420, 430, allows an authenticated attacker to send user-controlled inputs whe… |
CVE-2022-41204 | High | 8.8 | 2022-10-11 | An attacker can change the content of an SAP Commerce - versions 1905, 2005, 2105, 2011, 2205, login page through a manipulated URL. They can inject code that… |
CVE-2022-41202 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated Visual Design Stream (.vds, vds.x3d) file received from untrusted sources in SAP 3D… |
CVE-2022-41201 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated Right Hemisphere Binary (.rh, rh.x3d) file received from untrusted sources in SAP 3D… |
CVE-2022-41200 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated Scalable Vector Graphic (.svg, svg.x3d) file received from untrusted sources in SAP… |
CVE-2022-41199 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated Open Inventor File (.iv, vrml.x3d) file received from untrusted sources in SAP 3D Vi… |
CVE-2022-41198 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated SketchUp (.skp, SketchUp.x3d) file received from untrusted sources in SAP 3D Visual… |
CVE-2022-41197 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated VRML Worlds (.wrl, vrml.x3d) file received from untrusted sources in SAP 3D Visual E… |
CVE-2022-41196 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated VRML Worlds (.wrl, vrml.x3d) file received from untrusted sources in SAP 3D Visual E… |
CVE-2022-41195 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated EAAmiga Interchange File Format (.iff, 2d.x3d) file received from untrusted sources… |
CVE-2022-41194 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated Encapsulated Postscript (.eps, ai.x3d) file received from untrusted sources in SAP 3… |
CVE-2022-41193 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated Encapsulated Post Script (.eps, ai.x3d) file received from untrusted sources in SAP… |
CVE-2022-41192 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens manipulated Jupiter Tesselation (.jt, JTReader.x3d) file received from untrusted sources in SAP 3D… |
CVE-2022-41191 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated Jupiter Tesselation (.jt, JTReader.x3d) file received from untrusted sources in SAP… |
CVE-2022-41190 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated AutoCAD (.dxf, TeighaTranslator.exe) file received from untrusted sources in SAP 3D… |
CVE-2022-41189 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated AutoCAD (.dwg, TeighaTranslator.exe) file received from untrusted sources in SAP 3D… |
CVE-2022-41188 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens manipulated Wavefront Object (.obj, ObjTranslator.exe) file received from untrusted sources in SAP… |
CVE-2022-41187 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated Wavefront Object (.obj, ObjTranslator.exe) file received from untrusted sources in S… |
CVE-2022-41186 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens manipulated Computer Graphics Metafile (.cgm, CgmCore.dll) file received from untrusted sources in… |
CVE-2022-41185 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated Visual Design Stream (.vds, MataiPersistence.dll) file received from untrusted sourc… |
CVE-2022-41184 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated Windows Cursor File (.cur, ico.x3d) file received from untrusted sources in SAP 3D V… |
CVE-2022-41183 | Medium | 5.5 | 2022-10-11 | Due to lack of proper memory management, when a victim opens manipulated Windows Cursor File (.cur, ico.x3d) file received from untrusted sources in SAP 3D Vis… |
CVE-2022-41182 | Medium | 5.5 | 2022-10-11 | Due to lack of proper memory management, when a victim opens manipulated Parasolid Part and Assembly (.x_b, CoreCadTranslator.exe) file received from untrusted… |
CVE-2022-41181 | Medium | 5.5 | 2022-10-11 | Due to lack of proper memory management, when a victim opens manipulated Portable Document Format (.pdf, PDFPublishing.dll) file received from untrusted source… |
CVE-2022-41180 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated Portable Document Format (.pdf, PDFPublishing.dll) file received from untrusted sour… |
CVE-2022-41179 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated Jupiter Tesselation (.jt, JtTranslator.exe) file received from untrusted sources in… |
CVE-2022-41178 | Medium | 5.5 | 2022-10-11 | Due to lack of proper memory management, when a victim opens manipulated Iges Part and Assembly (.igs, .iges, CoreCadTranslator.exe) file received from untrust… |
CVE-2022-41177 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated Iges Part and Assembly (.igs, .iges, CoreCadTranslator.exe) file received from untru… |
CVE-2022-41176 | Medium | 5.5 | 2022-10-11 | Due to lack of proper memory management, when a victim opens manipulated Enhanced Metafile (.emf, emf.x3d) file received from untrusted sources in SAP 3D Visua… |
CVE-2022-41175 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated Enhanced Metafile (.emf, emf.x3d) file received from untrusted sources in SAP 3D Vis… |
CVE-2022-41174 | Medium | 5.5 | 2022-10-11 | Due to lack of proper memory management, when a victim opens manipulated Right Hemisphere Material (.rhm, rh.x3d) file received from untrusted sources in SAP 3… |
CVE-2022-41173 | Medium | 5.5 | 2022-10-11 | Due to lack of proper memory management, when a victim opens manipulated AutoCAD (.dxf, TeighaTranslator.exe) file received from untrusted sources in SAP 3D Vi… |
CVE-2022-41172 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated AutoCAD (.dxf, TeighaTranslator.exe) file received from untrusted sources in SAP 3D… |
CVE-2022-41171 | Medium | 5.5 | 2022-10-11 | Due to lack of proper memory management, when a victim opens manipulated CATIA4 Part (.model, CatiaTranslator.exe) file received from untrusted sources in SAP… |
CVE-2022-41170 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated CATIA4 Part (.model, CatiaTranslator.exe) file received from untrusted sources in SA… |
CVE-2022-41169 | Medium | 5.5 | 2022-10-11 | Due to lack of proper memory management, when a victim opens manipulated CATIA5 Part (.catpart, CatiaTranslator.exe) file received from untrusted sources in SA… |
CVE-2022-41168 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated CATIA5 Part (.catpart, CatiaTranslator.exe) file received from untrusted sources in… |
CVE-2022-41167 | High | 7.8 | 2022-10-11 | Due to lack of proper memory management, when a victim opens a manipulated AutoCAD (.dwg, TeighaTranslator.exe) file received from untrusted sources in SAP 3D… |
CVE-2022-41166 | Medium | 5.5 | 2022-10-11 | Due to lack of proper memory management, when a victim opens manipulated Wavefront Object (.obj, ObjTranslator.exe) file received from untrusted sources in SAP… |
CVE-2022-3140 | Medium | 6.3 | 2022-10-11 | LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command'… |