2022 CVEs (page 122)
Page 122 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-37990 | High | 7.8 | 2022-10-11 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2022-37989 | High | 7.8 | 2022-10-11 | Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability |
CVE-2022-37988 | High | 7.8 | 2022-10-11 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2022-37987 | High | 7.8 | 2022-10-11 | Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability |
CVE-2022-37986 | High | 7.8 | 2022-10-11 | Windows Win32k Elevation of Privilege Vulnerability |
CVE-2022-37985 | Medium | 5.5 | 2022-10-11 | Windows Graphics Component Information Disclosure Vulnerability |
CVE-2022-37984 | High | 7.8 | 2022-10-11 | Windows WLAN Service Elevation of Privilege Vulnerability |
CVE-2022-37983 | High | 7.8 | 2022-10-11 | Microsoft DWM Core Library Elevation of Privilege Vulnerability |
CVE-2022-37982 | High | 8.8 | 2022-10-11 | Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability |
CVE-2022-37981 | Medium | 4.3 | 2022-10-11 | Windows Event Logging Service Denial of Service Vulnerability |
CVE-2022-37980 | High | 7.8 | 2022-10-11 | Windows DHCP Client Elevation of Privilege Vulnerability |
CVE-2022-37979 | High | 7.8 | 2022-10-11 | Windows Hyper-V Elevation of Privilege Vulnerability |
CVE-2022-37978 | High | 7.5 | 2022-10-11 | Windows Active Directory Certificate Services Security Feature Bypass |
CVE-2022-37977 | Medium | 6.5 | 2022-10-11 | Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability |
CVE-2022-37976 | High | 8.8 | 2022-10-11 | Active Directory Certificate Services Elevation of Privilege Vulnerability |
CVE-2022-37975 | High | 8.8 | 2022-10-11 | Windows Group Policy Elevation of Privilege Vulnerability |
CVE-2022-37974 | Medium | 6.5 | 2022-10-11 | Windows Mixed Reality Developer Tools Information Disclosure Vulnerability |
CVE-2022-37973 | High | 7.7 | 2022-10-11 | Windows Local Session Manager (LSM) Denial of Service Vulnerability |
CVE-2022-37971 | High | 7.1 | 2022-10-11 | Microsoft Windows Defender Elevation of Privilege Vulnerability |
CVE-2022-37970 | High | 7.8 | 2022-10-11 | Windows DWM Core Library Elevation of Privilege Vulnerability |
CVE-2022-37968 | Critical | 10.0 | 2022-10-11 | Microsoft has identified a vulnerability affecting the cluster connect feature of Azure Arc-enabled Kubernetes clusters. This vulnerability could allow an unau… |
CVE-2022-37965 | Medium | 5.9 | 2022-10-11 | Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerability |
CVE-2022-37609 | Critical | 9.8 | 2022-10-11 | Prototype pollution vulnerability in beautify-web js-beautify 1.13.7 via the name variable in options.js. |
CVE-2022-37599 | High | 7.5 | 2022-10-11 | A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the resourceP… |
CVE-2022-35829 | Medium | 6.2 | 2022-10-11 | Service Fabric Explorer Spoofing Vulnerability |
CVE-2022-35770 | Medium | 6.5 | 2022-10-11 | Windows NTLM Spoofing Vulnerability |
CVE-2022-34689 | High | 7.5 | 2022-10-11 | Windows CryptoAPI Spoofing Vulnerability |
CVE-2022-33645 | High | 7.5 | 2022-10-11 | Windows TCP/IP Driver Denial of Service Vulnerability |
CVE-2022-33635 | High | 7.8 | 2022-10-11 | Windows GDI+ Remote Code Execution Vulnerability |
CVE-2022-33634 | High | 8.1 | 2022-10-11 | Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability |
CVE-2022-30198 | High | 8.1 | 2022-10-11 | Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability |
CVE-2022-24504 | High | 8.1 | 2022-10-11 | Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability |
CVE-2022-22035 | High | 8.1 | 2022-10-11 | Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability |
CVE-2022-42238 | High | 8.8 | 2022-10-11 | A Vertical Privilege Escalation issue in Merchandise Online Store v.1.0 allows an attacker to get access to the admin dashboard. |
CVE-2022-42236 | Medium | 5.4 | 2022-10-11 | A Stored XSS issue in Merchandise Online Store v.1.0 allows to injection of Arbitrary JavaScript in edit account form. |
CVE-2022-42235 | Medium | 5.4 | 2022-10-11 | A Stored XSS issue in Student Clearance System v.1.0 allows the injection of arbitrary JavaScript in the Student registration form. |
CVE-2022-42230 | High | 7.2 | 2022-10-11 | Simple Cold Storage Management System v1.0 is vulnerable to SQL Injection via /csms/admin/?page=user/manage_user&id=. |
CVE-2022-42229 | High | 8.8 | 2022-10-11 | Wedding Planner v1.0 is vulnerable to Arbitrary code execution via package_edit.php. |
CVE-2022-42034 | High | 8.8 | 2022-10-11 | Wedding Planner v1.0 is vulnerable to arbitrary code execution via users_profile.php. |
CVE-2022-3453 | Low | 3.5 | 2022-10-11 | A vulnerability was found in SourceCodester Book Store Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of t… |
CVE-2022-3452 | Low | 3.5 | 2022-10-11 | A vulnerability was found in SourceCodester Book Store Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of t… |
CVE-2022-39296 | High | 8.6 | 2022-10-11 | MelisAssetManager provides deliveries of Melis Platform's assets located in every module's public folder. Attackers can read arbitrary files on affected versio… |
CVE-2022-41376 | Medium | 6.1 | 2022-10-11 | Metro UI v4.4.0 to v4.5.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Javascript function. |
CVE-2022-34434 | Medium | 6.7 | 2022-10-11 | Cloud Mobility for Dell Storage versions 1.3.0 and earlier contains an Improper Access Control vulnerability within the Postgres database. A threat actor with… |
CVE-2022-34432 | High | 7.3 | 2022-10-11 | Dell Hybrid Client below 1.8 version contains a gedit vulnerability. A guest attacker could potentially exploit this vulnerability, allowing deletion of user a… |
CVE-2022-34431 | Medium | 6.5 | 2022-10-11 | Dell Hybrid Client below 1.8 version contains a guest user profile corruption vulnerability. A WMS privilege attacker could potentially exploit this vulnerabil… |
CVE-2022-34430 | High | 7.1 | 2022-10-11 | Dell Hybrid Client below 1.8 version contains a Zip Bomb Vulnerability in UI. A guest privilege attacker could potentially exploit this vulnerability, leading… |
CVE-2022-34427 | High | 8.8 | 2022-10-11 | Dell Container Storage Modules 1.2 contains an OS Command Injection in goiscsi and gobrick libraries. A remote unauthenticated attacker could exploit this vuln… |
CVE-2022-34426 | High | 8.8 | 2022-10-11 | Dell Container Storage Modules 1.2 contains an Improper Limitation of a Pathname to a Restricted Directory in goiscsi and gobrick libraries which could lead to… |
CVE-2022-33978 | Medium | 6.1 | 2022-10-11 | Reflected Cross-Site Scripting (XSS) vulnerability FontMeister plugin <= 1.08 at WordPress. |
CVE-2022-32492 | High | 7.5 | 2022-10-11 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI… |
CVE-2022-32486 | High | 7.5 | 2022-10-11 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI… |
CVE-2022-38388 | Medium | 5.5 | 2022-10-11 | IBM Navigator Mobile Android 3.4.1.1 and 3.4.1.2 app could allow a local user to obtain sensitive information due to improper access control. IBM X-Force ID: 2… |
CVE-2022-3358 | High | 7.5 | 2022-10-11 | OpenSSL supports creating a custom cipher via the legacy EVP_CIPHER_meth_new() function and associated function calls. This function was deprecated in OpenSSL… |
CVE-2022-32175 | Medium | 5.4 | 2022-10-11 | In AdGuardHome, versions v0.95 through v0.108.0-b.13 are vulnerable to Cross-Site Request Forgery (CSRF), in the custom filtering rules functionality. An attac… |
CVE-2022-32174 | Critical | 9.0 | 2022-10-11 | In Gogs, versions v0.6.5 through v0.12.10 are vulnerable to Stored Cross-Site Scripting (XSS) that leads to an account takeover. |
CVE-2022-42731 | High | 7.5 | 2022-10-11 | mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device reg… |
CVE-2022-39271 | High | 7.5 | 2022-10-11 | Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer that assists in deploying microservices. There is a potential vulnerability in Tr… |
CVE-2022-33749 | Medium | 5.3 | 2022-10-11 | XAPI open file limit DoS It is possible for an unauthenticated client on the network to cause XAPI to hit its file-descriptor limit. This causes XAPI to be una… |
CVE-2022-33748 | Medium | 5.6 | 2022-10-11 | lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was inserted on an error handling path. While doing so, lockin… |
CVE-2022-33747 | Low | 3.8 | 2022-10-11 | Arm: unbounded memory consumption for 2nd-level page tables Certain actions require e.g. removing pages from a guest's P2M (Physical-to-Machine) mapping. When… |
CVE-2022-33746 | Medium | 6.5 | 2022-10-11 | P2M pool freeing may take excessively long The P2M pool backing second level address translation for guests may be of significant size. Therefore its freeing m… |
CVE-2022-41851 | High | 7.8 | 2022-10-11 | A vulnerability has been identified in JTTK (All versions < V11.1.1.0), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versio… |
CVE-2022-41665 | Critical | 9.8 | 2022-10-11 | A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.10), SICAM P850 (7KG8500-0AA00-2AA0) (All versions < V3.10), SICAM P8… |
CVE-2022-40631 | Medium | 6.1 | 2022-10-11 | A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5.0), SCALANCE X201-3P IRT (All versions < V5.5.0), SCALANCE X201-3P IRT PRO (Al… |
CVE-2022-40227 | High | 7.5 | 2022-10-11 | A vulnerability has been identified in SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions < V17 Update 4), SIMATIC HMI KTP Mobile Panels (All ver… |
CVE-2022-40226 | High | 7.5 | 2022-10-11 | A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.10), SICAM P850 (7KG8500-0AA00-2AA0) (All versions < V3.10), SICAM P8… |
CVE-2022-40182 | High | 8.8 | 2022-10-11 | A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All… |
CVE-2022-40181 | High | 8.3 | 2022-10-11 | A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All… |
CVE-2022-40180 | Medium | 5.3 | 2022-10-11 | A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All… |
CVE-2022-40179 | High | 8.1 | 2022-10-11 | A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All… |
CVE-2022-40178 | Medium | 5.4 | 2022-10-11 | A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All… |
CVE-2022-40177 | Medium | 5.7 | 2022-10-11 | A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All… |
CVE-2022-40176 | High | 8.0 | 2022-10-11 | A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All… |
CVE-2022-40147 | High | 7.4 | 2022-10-11 | A vulnerability has been identified in Industrial Edge Management (All versions < V1.5.1). The affected software does not properly validate the server certific… |
CVE-2022-38465 | Critical | 9.3 | 2022-10-11 | A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS va… |
CVE-2022-38371 | High | 7.5 | 2022-10-11 | A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All… |
CVE-2022-37864 | High | 7.8 | 2022-10-11 | A vulnerability has been identified in Solid Edge (All Versions < SE2022MP9). The affected application contains an out of bounds write past the fixed-length he… |
CVE-2022-36363 | Medium | 5.3 | 2022-10-11 | A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA1) (All versions), LOGO! 230RCE (6… |
CVE-2022-36362 | High | 7.5 | 2022-10-11 | A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions), LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versions), LOGO! 12/24RCEo… |
CVE-2022-36361 | Critical | 9.8 | 2022-10-11 | A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA1) (All versions), LOGO! 230RCE (6… |
CVE-2022-36360 | High | 7.5 | 2022-10-11 | A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Affected devices load firmware updates without checking the au… |
CVE-2022-31766 | High | 8.6 | 2022-10-11 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.1.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2D… |
CVE-2022-31765 | High | 8.8 | 2022-10-11 | Affected devices do not properly authorize the change password function of the web interface. This could allow low privileged users to escalate their privileg… |
CVE-2022-37616 | Critical | 9.8 | 2022-10-11 | A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the… |
CVE-2022-40138 | Critical | 9.8 | 2022-10-11 | An integer conversion error in Hermes bytecode generation, prior to commit 6aa825e480d48127b480b08d13adf70033237097, could have been used to perform Out-Of-Bou… |
CVE-2022-35289 | Critical | 9.8 | 2022-10-11 | A write-what-where condition in hermes caused by an integer overflow, prior to commit 5b6255ae049fa4641791e47fad994e8e8c4da374 allows attackers to potentially… |
CVE-2022-32234 | Critical | 9.8 | 2022-10-11 | An out of bounds write in hermes, while handling large arrays, prior to commit 06eaec767e376bfdb883d912cb15e987ddf2bda1 allows attackers to potentially execute… |
CVE-2022-3433 | Medium | 6.5 | 2022-10-10 | The aeson library is not safe to use to consume untrusted JSON input. A remote user could abuse this flaw to produce a hash collision in the underlying unorder… |
CVE-2022-41749 | High | 7.8 | 2022-10-10 | An origin validation error vulnerability in Trend Micro Apex One agents could allow a local attacker to escalate privileges on affected installations. Please n… |
CVE-2022-41748 | Medium | 6.7 | 2022-10-10 | A registry permissions vulnerability in the Trend Micro Apex One Data Loss Prevention (DLP) module could allow a local attacker with administrative credentials… |
CVE-2022-41747 | High | 7.8 | 2022-10-10 | An improper certification validation vulnerability in Trend Micro Apex One agents could allow a local attacker to load a DLL file with system service privilege… |
CVE-2022-41746 | Critical | 9.1 | 2022-10-10 | A forced browsing vulnerability in Trend Micro Apex One could allow an attacker with access to the Apex One console on affected installations to escalate privi… |
CVE-2022-41745 | High | 7.0 | 2022-10-10 | An Out-of-Bounds access vulnerability in Trend Micro Apex One could allow a local attacker to create a specially crafted message to cause memory corruption on… |
CVE-2022-41744 | High | 7.0 | 2022-10-10 | A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One Vulnerability Protection integrated component could allow a local attacker to escalate pr… |
CVE-2022-3220 | Medium | 4.8 | 2022-10-10 | The Advanced Comment Form WordPress plugin before 1.2.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross… |
CVE-2022-3209 | Medium | 6.1 | 2022-10-10 | The soledad WordPress theme before 8.2.5 does not sanitise the {id,datafilter[type],...} parameters in its penci_more_slist_post_ajax AJAX action, leading to a… |
CVE-2022-3208 | Medium | 6.5 | 2022-10-10 | The Simple File List WordPress plugin before 4.4.12 does not implement nonce checks, which could allow attackers to make a logged in admin create new page and… |
CVE-2022-3207 | Medium | 4.8 | 2022-10-10 | The Simple File List WordPress plugin before 4.4.12 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2022-3154 | High | 7.1 | 2022-10-10 | The Woo Billingo Plus WordPress plugin before 4.4.5.4, Integration for Billingo & Gravity Forms WordPress plugin before 1.0.4, Integration for Szamlazz.hu & Gr… |