2022 CVEs (page 123)
Page 123 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-36360 | High | 7.5 | 2022-10-11 | A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Affected devices load firmware updates without checking the au… |
CVE-2022-31766 | High | 8.6 | 2022-10-11 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.1.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2D… |
CVE-2022-31765 | High | 8.8 | 2022-10-11 | Affected devices do not properly authorize the change password function of the web interface. This could allow low privileged users to escalate their privileg… |
CVE-2022-37616 | Critical | 9.8 | 2022-10-11 | A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the… |
CVE-2022-40138 | Critical | 9.8 | 2022-10-11 | An integer conversion error in Hermes bytecode generation, prior to commit 6aa825e480d48127b480b08d13adf70033237097, could have been used to perform Out-Of-Bou… |
CVE-2022-35289 | Critical | 9.8 | 2022-10-11 | A write-what-where condition in hermes caused by an integer overflow, prior to commit 5b6255ae049fa4641791e47fad994e8e8c4da374 allows attackers to potentially… |
CVE-2022-32234 | Critical | 9.8 | 2022-10-11 | An out of bounds write in hermes, while handling large arrays, prior to commit 06eaec767e376bfdb883d912cb15e987ddf2bda1 allows attackers to potentially execute… |
CVE-2022-3433 | Medium | 6.5 | 2022-10-10 | The aeson library is not safe to use to consume untrusted JSON input. A remote user could abuse this flaw to produce a hash collision in the underlying unorder… |
CVE-2022-41749 | High | 7.8 | 2022-10-10 | An origin validation error vulnerability in Trend Micro Apex One agents could allow a local attacker to escalate privileges on affected installations. Please n… |
CVE-2022-41748 | Medium | 6.7 | 2022-10-10 | A registry permissions vulnerability in the Trend Micro Apex One Data Loss Prevention (DLP) module could allow a local attacker with administrative credentials… |
CVE-2022-41747 | High | 7.8 | 2022-10-10 | An improper certification validation vulnerability in Trend Micro Apex One agents could allow a local attacker to load a DLL file with system service privilege… |
CVE-2022-41746 | Critical | 9.1 | 2022-10-10 | A forced browsing vulnerability in Trend Micro Apex One could allow an attacker with access to the Apex One console on affected installations to escalate privi… |
CVE-2022-41745 | High | 7.0 | 2022-10-10 | An Out-of-Bounds access vulnerability in Trend Micro Apex One could allow a local attacker to create a specially crafted message to cause memory corruption on… |
CVE-2022-41744 | High | 7.0 | 2022-10-10 | A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One Vulnerability Protection integrated component could allow a local attacker to escalate pr… |
CVE-2022-3220 | Medium | 4.8 | 2022-10-10 | The Advanced Comment Form WordPress plugin before 1.2.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross… |
CVE-2022-3209 | Medium | 6.1 | 2022-10-10 | The soledad WordPress theme before 8.2.5 does not sanitise the {id,datafilter[type],...} parameters in its penci_more_slist_post_ajax AJAX action, leading to a… |
CVE-2022-3208 | Medium | 6.5 | 2022-10-10 | The Simple File List WordPress plugin before 4.4.12 does not implement nonce checks, which could allow attackers to make a logged in admin create new page and… |
CVE-2022-3207 | Medium | 4.8 | 2022-10-10 | The Simple File List WordPress plugin before 4.4.12 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2022-3154 | High | 7.1 | 2022-10-10 | The Woo Billingo Plus WordPress plugin before 4.4.5.4, Integration for Billingo & Gravity Forms WordPress plugin before 1.0.4, Integration for Szamlazz.hu & Gr… |
CVE-2022-3137 | Medium | 5.4 | 2022-10-10 | The Taskbuilder WordPress plugin before 1.0.8 does not validate and sanitise task's attachments, which could allow any authenticated user (such as subscriber)… |
CVE-2022-3136 | Medium | 4.8 | 2022-10-10 | The Social Rocket WordPress plugin before 1.3.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2022-39288 | High | 7.5 | 2022-10-10 | fastify is a fast and low overhead web framework, for Node.js. Affected versions of fastify are subject to a denial of service via malicious use of the Content… |
CVE-2022-36063 | High | 7.6 | 2022-10-10 | Azure RTOS USBx is a USB host, device, and on-the-go (OTG) embedded stack, fully integrated with Azure RTOS ThreadX and available for all Azure RTOS ThreadX–su… |
CVE-2022-34425 | High | 7.5 | 2022-10-10 | Dell Enterprise SONiC OS, 4.0.0, 4.0.1, contain a cryptographic key vulnerability in SSH. An unauthenticated remote attacker could potentially exploit this vul… |
CVE-2022-34402 | Medium | 6.8 | 2022-10-10 | Dell Wyse ThinOS 2205 contains a Regular Expression Denial of Service Vulnerability in UI. An admin privilege attacker could potentially exploit this vulnerabi… |
CVE-2022-34334 | Medium | 6.5 | 2022-10-10 | IBM Sterling Partner Engagement Manager 2.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the… |
CVE-2022-2981 | Medium | 4.9 | 2022-10-10 | The Download Monitor WordPress plugin before 4.5.98 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high p… |
CVE-2022-2891 | Medium | 5.9 | 2022-10-10 | The WP 2FA WordPress plugin before 2.3.0 uses comparison operators that don't mitigate time-based attacks, which could be abused to leak information about the… |
CVE-2022-2823 | Medium | 4.8 | 2022-10-10 | The Slider, Gallery, and Carousel by MetaSlider WordPress plugin before 3.27.9 does not sanitise and escape some of its Gallery Image parameters, which could a… |
CVE-2022-2629 | Medium | 4.8 | 2022-10-10 | The Top Bar WordPress plugin before 3.0.4 does not sanitise and escape some of its settings before outputting them in frontend pages, which could allow high pr… |
CVE-2022-2554 | Medium | 4.9 | 2022-10-10 | The Enable Media Replace WordPress plugin before 4.0.0 does not ensure that renamed files are moved to the Upload folder, which could allow high privilege user… |
CVE-2022-2448 | Medium | 4.8 | 2022-10-10 | The reSmush.it WordPress plugin before 0.4.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2022-2350 | Medium | 5.3 | 2022-10-10 | The Disable User Login WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating its settings, allowing unauthenticated attacker… |
CVE-2022-20944 | Medium | 6.1 | 2022-10-10 | A vulnerability in the software image verification functionality of Cisco IOS XE Software for Cisco Catalyst 9200 Series Switches could allow an unauthenticate… |
CVE-2022-20920 | High | 7.7 | 2022-10-10 | A vulnerability in the SSH implementation of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause an affected de… |
CVE-2022-20915 | High | 7.4 | 2022-10-10 | A vulnerability in the implementation of IPv6 VPN over MPLS (6VPE) with Zone-Based Firewall (ZBFW) of Cisco IOS XE Software could allow an unauthenticated, adj… |
CVE-2022-20870 | High | 8.6 | 2022-10-10 | A vulnerability in the egress MPLS packet processing function of Cisco IOS XE Software for Cisco Catalyst 3650, Catalyst 3850, and Catalyst 9000 Family Switche… |
CVE-2022-20864 | Medium | 4.6 | 2022-10-10 | A vulnerability in the password-recovery disable feature of Cisco IOS XE ROM Monitor (ROMMON) Software for Cisco Catalyst Switches could allow an unauthenticat… |
CVE-2022-20837 | High | 8.6 | 2022-10-10 | A vulnerability in the DNS application layer gateway (ALG) functionality that is used by Network Address Translation (NAT) in Cisco IOS XE Software could allow… |
CVE-2022-20830 | Medium | 5.3 | 2022-10-10 | A vulnerability in authentication mechanism of Cisco Software-Defined Application Visibility and Control (SD-AVC) on Cisco vManage could allow an unauthenticat… |
CVE-2022-40257 | Medium | 5.4 | 2022-10-10 | An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via a crafted email with… |
CVE-2022-40248 | Medium | 5.4 | 2022-10-10 | An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via form using the "Produ… |
CVE-2022-39292 | High | 7.5 | 2022-10-10 | Slack Morphism is a modern client library for Slack Web/Events API/Socket Mode and Block Kit. Debug logs expose sensitive URLs for Slack webhooks that contain… |
CVE-2022-3442 | Low | 3.5 | 2022-10-10 | A vulnerability was found in Crealogix EBICS 7.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /ebics-ser… |
CVE-2022-26121 | Low | 3.7 | 2022-10-10 | An exposure of resource to wrong sphere vulnerability [CWE-668] in FortiAnalyzer and FortiManager GUI 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.0 through 6… |
CVE-2022-3438 | Medium | 6.1 | 2022-10-10 | Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.0a4. |
CVE-2022-42725 | High | 7.5 | 2022-10-10 | Warpinator through 1.2.14 allows access outside of an intended directory, as demonstrated by symbolic directory links. |
CVE-2022-42724 | Medium | 4.3 | 2022-10-10 | app/Controller/UsersController.php in MISP before 2.4.164 allows attackers to discover role names (this is information that only the site admin should have). |
CVE-2022-42012 | Medium | 6.5 | 2022-10-10 | An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and… |
CVE-2022-42011 | Medium | 6.5 | 2022-10-10 | An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and… |
CVE-2022-42010 | Medium | 6.5 | 2022-10-10 | An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and… |
CVE-2022-42703 | Medium | 5.5 | 2022-10-09 | mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse. |
CVE-2022-3436 | Medium | 6.3 | 2022-10-09 | A vulnerability classified as critical was found in SourceCodester Web-Based Student Clearance System 1.0. Affected by this vulnerability is an unknown functio… |
CVE-2022-3435 | Medium | 4.3 | 2022-10-08 | A vulnerability classified as problematic has been found in Linux Kernel. This affects the function fib_nh_match of the file net/ipv4/fib_semantics.c of the co… |
CVE-2022-3434 | Low | 3.5 | 2022-10-08 | A vulnerability was found in SourceCodester Web-Based Student Clearance System. It has been rated as problematic. Affected by this issue is the function prepar… |
CVE-2022-39281 | Medium | 6.5 | 2022-10-08 | fat_free_crm is a an open source, Ruby on Rails customer relationship management platform (CRM). In versions prior to 0.20.1 an authenticated user can perform… |
CVE-2022-36635 | High | 8.8 | 2022-10-07 | ZKteco ZKBioSecurity V5000 4.1.3 was discovered to contain a SQL injection vulnerability via the component /baseOpLog.do. |
CVE-2022-41442 | Medium | 6.1 | 2022-10-07 | PicUploader v2.6.3 was discovered to contain cross-site scripting (XSS) vulnerability via the setStorageParams function in SettingController.php. |
CVE-2022-39959 | High | 7.8 | 2022-10-07 | Panini Everest Engine 2.0.4 allows unprivileged users to create a file named Everest.exe in the %PROGRAMDATA%\Panini folder. This leads to privilege escalation… |
CVE-2022-41574 | High | 7.5 | 2022-10-07 | An access-control vulnerability in Gradle Enterprise 2022.4 through 2022.3.1 allows remote attackers to prevent backups from occurring, and send emails with ar… |
CVE-2022-3276 | High | 8.4 | 2022-10-07 | Command injection is possible in the puppetlabs-mysql module prior to version 13.0.0. A malicious actor is able to exploit this vulnerability only if they are… |
CVE-2022-3275 | High | 8.4 | 2022-10-07 | Command injection is possible in the puppetlabs-apt module prior to version 9.0.0. A malicious actor is able to exploit this vulnerability only if they are abl… |
CVE-2022-39291 | Medium | 5.4 | 2022-10-07 | ZoneMinder is a free, open source Closed-circuit television software application. Affected versions of zoneminder are subject to a vulnerability which allows u… |
CVE-2022-39290 | High | 8.0 | 2022-10-07 | ZoneMinder is a free, open source Closed-circuit television software application. In affected versions authenticated users can bypass CSRF keys by modifying th… |
CVE-2022-39289 | Critical | 9.1 | 2022-10-07 | ZoneMinder is a free, open source Closed-circuit television software application. In affected versions the ZoneMinder API Exposes Database Log contents to user… |
CVE-2022-39285 | High | 7.6 | 2022-10-07 | ZoneMinder is a free, open source Closed-circuit television software application The file parameter is vulnerable to a cross site scripting vulnerability (XSS)… |
CVE-2022-31681 | Medium | 6.5 | 2022-10-07 | VMware ESXi contains a null-pointer deference vulnerability. A malicious actor with privileges within the VMX process only, may create a denial of service cond… |
CVE-2022-31680 | Critical | 9.1 | 2022-10-07 | The vCenter Server contains an unsafe deserialisation vulnerability in the PSC (Platform services controller). A malicious actor with admin access on vCenter s… |
CVE-2022-39287 | High | 8.1 | 2022-10-07 | tiny-csrf is a Node.js cross site request forgery (CSRF) protection middleware. In versions prior to 1.1.0 cookies were not encrypted and thus CSRF tokens were… |
CVE-2022-36634 | High | 8.8 | 2022-10-07 | An access control issue in ZKTeco ZKBioSecurity V5000 3.0.5_r allows attackers to arbitrarily create admin users via a crafted HTTP request. |
CVE-2022-32593 | Medium | 6.7 | 2022-10-07 | In vowe, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileg… |
CVE-2022-32592 | Medium | 6.7 | 2022-10-07 | In cpu dvfs, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution priv… |
CVE-2022-32591 | High | 7.5 | 2022-10-07 | In ril, there is a possible system crash due to an incorrect bounds check. This could lead to remote denial of service with no additional execution privileges… |
CVE-2022-32590 | Medium | 6.7 | 2022-10-07 | In wlan, there is a possible use after free due to an incorrect status check. This could lead to local escalation of privilege with System execution privileges… |
CVE-2022-32589 | High | 7.5 | 2022-10-07 | In Wi-Fi driver, there is a possible way to disconnect Wi-Fi due to an improper resource release. This could lead to remote denial of service with no additiona… |
CVE-2022-26475 | Medium | 6.7 | 2022-10-07 | In wlan, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileg… |
CVE-2022-26474 | Medium | 6.7 | 2022-10-07 | In sensorhub, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to local escalation of privilege with Sys… |
CVE-2022-26473 | Medium | 6.7 | 2022-10-07 | In vdec fmt, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution privileges need… |
CVE-2022-26472 | High | 7.8 | 2022-10-07 | In ims, there is a possible escalation of privilege due to a parcel format mismatch. This could lead to local escalation of privilege with no additional execut… |
CVE-2022-26471 | High | 7.8 | 2022-10-07 | In telephony, there is a possible escalation of privilege due to a parcel format mismatch. This could lead to local escalation of privilege with no additional… |
CVE-2022-26452 | Medium | 6.7 | 2022-10-07 | In isp, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. U… |
CVE-2022-42075 | Critical | 9.8 | 2022-10-07 | Wedding Planner v1.0 is vulnerable to arbitrary code execution. |
CVE-2022-42074 | High | 7.2 | 2022-10-07 | Online Diagnostic Lab Management System v1.0 is vulnerable to SQL Injection via /diagnostic/editcategory.php?id=. |
CVE-2022-42073 | High | 7.2 | 2022-10-07 | Online Diagnostic Lab Management System v1.0 is vulnerable to SQL Injection via /diagnostic/editclient.php?id=. |
CVE-2022-41392 | Medium | 5.4 | 2022-10-07 | A cross-site scripting (XSS) vulnerability in TotalJS commit 8c2c8909 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected… |
CVE-2022-41379 | High | 7.2 | 2022-10-07 | An arbitrary file upload vulnerability in the component /leave_system/classes/Users.php?f=save of Online Leave Management System v1.0 allows attackers to execu… |
CVE-2022-41378 | High | 7.2 | 2022-10-07 | Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /pet_shop/admin/?page=inventory/manage_inventory. |
CVE-2022-41377 | High | 7.2 | 2022-10-07 | Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /pet_shop/admin/?page=maintenance/manage_category. |
CVE-2022-37896 | Medium | 6.1 | 2022-10-07 | A vulnerability in the Aruba InstantOS and ArubaOS 10 web management interface could allow a remote attacker to conduct a reflected cross-site scripting (XSS)… |
CVE-2022-37895 | Medium | 4.9 | 2022-10-07 | An unauthenticated Denial of Service (DoS) vulnerability exists in the handling of certain SSID strings by Aruba InstantOS and ArubaOS 10. Successful exploitat… |
CVE-2022-37894 | Medium | 6.5 | 2022-10-07 | An unauthenticated Denial of Service (DoS) vulnerability exists in the handling of certain SSID strings by Aruba InstantOS and ArubaOS 10. Successful exploitat… |
CVE-2022-37893 | High | 7.8 | 2022-10-07 | An authenticated command injection vulnerability exists in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of this vulnerabi… |
CVE-2022-42092 | High | 7.2 | 2022-10-07 | Backdrop CMS 1.22.0 has Unrestricted File Upload vulnerability via 'themes' that allows attackers to Remote Code Execution. Note: Third parties dispute this an… |
CVE-2022-41515 | High | 7.2 | 2022-10-07 | Open Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /sacco_shield/ajax.php?action=delete_p… |
CVE-2022-41514 | High | 7.2 | 2022-10-07 | Open Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /sacco_shield/ajax.php?action=delete_l… |
CVE-2022-41513 | High | 7.2 | 2022-10-07 | Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /diagnostic/edittest.php. |
CVE-2022-41512 | High | 7.2 | 2022-10-07 | An arbitrary file upload vulnerability in the component /php_action/editFile.php of Online Diagnostic Lab Management System v1.0 allows attackers to execute ar… |
CVE-2022-41414 | Medium | 5.3 | 2022-10-07 | An insecure default in the component auth.login.prompt.enabled of Liferay Portal v7.0.0 through v7.4.2 allows attackers to enumerate usernames, site names, and… |
CVE-2022-37892 | Medium | 5.4 | 2022-10-07 | A vulnerability in the Aruba InstantOS and ArubaOS 10 web management interface could allow an unauthenticated remote attacker to conduct a stored cross-site sc… |
CVE-2022-37891 | Critical | 9.8 | 2022-10-07 | Unauthenticated buffer overflow vulnerabilities exist within the Aruba InstantOS and ArubaOS 10 web management interface. Successful exploitation results in th… |