2022 CVEs (page 124)
Page 124 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-37890 | Critical | 9.8 | 2022-10-07 | Unauthenticated buffer overflow vulnerabilities exist within the Aruba InstantOS and ArubaOS 10 web management interface. Successful exploitation results in th… |
CVE-2022-37889 | Critical | 9.8 | 2022-10-07 | There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted… |
CVE-2022-37887 | Critical | 9.8 | 2022-10-07 | There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted… |
CVE-2022-37886 | Critical | 9.8 | 2022-10-07 | There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted… |
CVE-2022-37885 | Critical | 9.8 | 2022-10-07 | There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted… |
CVE-2022-21936 | High | 8.1 | 2022-10-07 | On Metasys ADX Server version 12.0 running MVE, an Active Directory user could execute validated actions without providing a valid password when using MVE SMP… |
CVE-2022-41291 | Medium | 6.5 | 2022-10-07 | IBM InfoSphere Information Server 11.7 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the syst… |
CVE-2022-36772 | Medium | 6.5 | 2022-10-07 | IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information that should only be available to a privileged user. |
CVE-2022-34308 | Medium | 5.5 | 2022-10-07 | IBM CICS TX 11.1 could allow a local user to cause a denial of service due to improper load handling. IBM X-Force ID: 229437. |
CVE-2022-30613 | Medium | 5.5 | 2022-10-07 | IBM QRadar SIEM 7.4 and 7.5 could disclose sensitive information via a local service to a privileged user. IBM X-Force ID: 227366. |
CVE-2022-22493 | High | 8.8 | 2022-10-07 | IBM WebSphere Automation for Cloud Pak for Watson AIOps 1.4.2 is vulnerable to cross-site request forgery, caused by improper cookie attribute setting. IBM X-F… |
CVE-2022-22480 | High | 7.5 | 2022-10-07 | IBM QRadar SIEM 7.4 and 7.5 data node rebalancing does not function correctly when using encrypted hosts which could result in information disclosure. IBM X-Fo… |
CVE-2022-39878 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability in Samsung Checkout prior to version 5.0.55.3 allows attackers to access sensitive information via implicit intent broadc… |
CVE-2022-39877 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability in ProfileSharingAccount in Group Sharing prior to versions 13.0.6.15 in Android S(12), 13.0.6.14 in Android R(11) and be… |
CVE-2022-39876 | Medium | 5.9 | 2022-10-07 | Insertion of Sensitive Information into Log in PushRegIdUpdateClient of SReminder prior to 8.2.01.13 allows attacker to access device IMEI. |
CVE-2022-39875 | Medium | 5.1 | 2022-10-07 | Improper component protection vulnerability in Samsung Account prior to version 13.5.0 allows attackers to unauthorized logout. |
CVE-2022-39874 | Medium | 4.0 | 2022-10-07 | Sensitive log information leakage vulnerability in Samsung Account prior to version 13.5.0 allows attackers to unauthorized logout. |
CVE-2022-39873 | Medium | 4.3 | 2022-10-07 | Improper authorization vulnerability in Samsung Internet prior to version 18.0.4.14 allows physical attackers to add bookmarks in secret mode without user auth… |
CVE-2022-39872 | Medium | 5.9 | 2022-10-07 | Improper restriction of broadcasting Intent in ShareLive prior to version 13.2.03.5 leaks MAC address of the connected Bluetooth device. |
CVE-2022-39871 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability cloudNotificationManager.java in SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information v… |
CVE-2022-39870 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information v… |
CVE-2022-39869 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information v… |
CVE-2022-39868 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability in GedSamsungAccount.kt SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via implic… |
CVE-2022-39867 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information v… |
CVE-2022-39866 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability in RegisteredEventMediator.kt SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via… |
CVE-2022-39865 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability in ContentsSharingActivity.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information vi… |
CVE-2022-39864 | Low | 3.3 | 2022-10-07 | Improper access control vulnerability in WifiSetupLaunchHelper in SmartThings prior to version 1.7.89.25 allows attackers to access sensitive information via i… |
CVE-2022-39863 | Low | 3.6 | 2022-10-07 | Intent redirection vulnerability in Samsung Account prior to version 13.5.01.3 allows attackers to access content providers without permission. |
CVE-2022-39862 | Medium | 5.3 | 2022-10-07 | Improper authorization in Dynamic Lockscreen prior to SMR Sep-2022 Release 1 in Android R(11) and 3.3.03.66 in Android S(12) allows unauthorized use of javascr… |
CVE-2022-39861 | Medium | 5.9 | 2022-10-07 | Unprotected Receiver in AtBroadcastReceiver in FactoryCamera prior to version 3.5.51 allows attackers to record video without camera privilege. |
CVE-2022-39860 | Medium | 4.4 | 2022-10-07 | Improper access control vulnerability in QuickShare prior to version 13.2.3.5 allows attackers to access sensitive information via implicit broadcast. |
CVE-2022-39859 | Medium | 4.0 | 2022-10-07 | Implicit intent hijacking vulnerability in UPHelper library prior to version 3.0.12 allows attackers to access sensitive information via implicit intent. |
CVE-2022-39858 | High | 7.3 | 2022-10-07 | Path traversal vulnerability in AtBroadcastReceiver in FactoryCamera prior to version 3.5.51 allows attackers to write arbitrary file as FactoryCamera privileg… |
CVE-2022-39857 | High | 7.3 | 2022-10-07 | Improper access control vulnerability in CameraTestActivity in FactoryCameraFB prior to version 3.5.51 allows attackers to access broadcasting Intent as system… |
CVE-2022-39856 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability in imsservice application prior to SMR Oct-2022 Release 1 allows local attackers to access call information. |
CVE-2022-39855 | Medium | 5.1 | 2022-10-07 | Improper access control vulnerability in FACM application prior to SMR Oct-2022 Release 1 allows a local attacker to connect arbitrary AP and Bluetooth devices. |
CVE-2022-39854 | Medium | 6.4 | 2022-10-07 | Improper protection in IOMMU prior to SMR Oct-2022 Release 1 allows unauthorized access to secure memory. |
CVE-2022-39853 | Medium | 4.4 | 2022-10-07 | A use after free vulnerability in perf-mgr driver prior to SMR Oct-2022 Release 1 allows attacker to cause memory access fault. |
CVE-2022-39852 | High | 8.0 | 2022-10-07 | A heap-based overflow vulnerability in makeContactAGIF in libagifencoder.quram.so library prior to SMR Oct-2022 Release 1 allows attacker to perform code execu… |
CVE-2022-39851 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability in CocktailBarService prior to SMR Oct-2022 Release 1 allows local attacker to bind service that require BIND_REMOTEVIEWS… |
CVE-2022-39850 | Low | 3.3 | 2022-10-07 | Improper access control in mum_container_policy service prior to SMR Oct-2022 Release 1 allows allows unauthorized read of configuration data. |
CVE-2022-39849 | Low | 3.3 | 2022-10-07 | Improper access control in knox_vpn_policy service prior to SMR Oct-2022 Release 1 allows allows unauthorized read of configuration data. |
CVE-2022-39848 | Medium | 4.0 | 2022-10-07 | Exposure of sensitive information in AT_Distributor prior to SMR Oct-2022 Release 1 allows local attacker to access SerialNo via log. |
CVE-2022-39847 | Medium | 4.9 | 2022-10-07 | Use after free vulnerability in set_nft_pid and signal_handler function of NFC driver prior to SMR Oct-2022 Release 1 allows attackers to perform malicious act… |
CVE-2022-36868 | Medium | 5.9 | 2022-10-07 | Improper restriction of broadcasting Intent in MouseNKeyHidDevice prior to SMR Oct-2022 Release 1 leaks MAC address of the connected Bluetooth device. |
CVE-2022-33896 | High | 7.8 | 2022-10-07 | A buffer underflow vulnerability exists in the way Hword of Hancom Office 2020 version 11.0.0.5357 parses XML-based office files. A specially-crafted malformed… |
CVE-2022-40872 | Critical | 9.8 | 2022-10-07 | An SQL injection vulnerability issue was discovered in Sourcecodester Simple E-Learning System 1.0., in /vcs/classRoom.php?classCode=, classCode. |
CVE-2022-40835 | Critical | 9.8 | 2022-10-07 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php. Note: Multiple third parties have di… |
CVE-2022-40834 | Critical | 9.8 | 2022-10-07 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_not_like() function. Note: Multipl… |
CVE-2022-40833 | Critical | 9.8 | 2022-10-07 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where_in() function. Note: Multipl… |
CVE-2022-40832 | Critical | 9.8 | 2022-10-07 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php having() function. Note: Multiple thi… |
CVE-2022-40831 | Critical | 9.8 | 2022-10-07 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php like() function. Note: Multiple third… |
CVE-2022-40830 | Critical | 9.8 | 2022-10-07 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where_not_in() function. Note: Multip… |
CVE-2022-40829 | Critical | 9.8 | 2022-10-07 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_like() function. Note: Multiple th… |
CVE-2022-40828 | Critical | 9.8 | 2022-10-07 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where_not_in() function. Note: Mul… |
CVE-2022-40827 | Critical | 9.8 | 2022-10-07 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where() function. Note: Multiple thir… |
CVE-2022-40826 | Critical | 9.8 | 2022-10-07 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_having() function. Note: Multiple… |
CVE-2022-40825 | Critical | 9.8 | 2022-10-07 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where_in() function. Note: Multiple t… |
CVE-2022-40824 | Critical | 9.8 | 2022-10-07 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where() function. Note: Multiple t… |
CVE-2022-3423 | High | 7.3 | 2022-10-07 | Allocation of Resources Without Limits or Throttling in GitHub repository nocodb/nocodb prior to 0.92.0. |
CVE-2022-3422 | High | 7.5 | 2022-10-07 | Account Takeover :: when see the info i can see the hash pass i can creaked it ............... Account Takeover :: when see the info i can see the forgot_passw… |
CVE-2022-41672 | High | 8.1 | 2022-10-07 | In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API. |
CVE-2022-3414 | Medium | 5.0 | 2022-10-07 | A vulnerability was found in SourceCodester Web-Based Student Clearance System. It has been classified as critical. Affected is an unknown function of the file… |
CVE-2022-2929 | Medium | 6.5 | 2022-10-07 | In ISC DHCP 1.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1 a system with access to a DHCP server, sending DHCP packets crafted to include fqdn labels long… |
CVE-2022-2928 | Medium | 6.5 | 2022-10-07 | In ISC DHCP 4.4.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1, when the function option_code_hash_lookup() is called from add_option(), it increases the op… |
CVE-2022-26238 | Medium | 5.5 | 2022-10-06 | The default privileges for the running service Normand Service Manager in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows non-privileged users to ov… |
CVE-2022-26236 | Medium | 5.5 | 2022-10-06 | The default privileges for the running service Normand Remisol Advance Launcher in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows non-privileged us… |
CVE-2022-40494 | Critical | 9.8 | 2022-10-06 | NPS before v0.26.10 was discovered to contain an authentication bypass vulnerability via constantly generating and sending the Auth key and Timestamp parameter… |
CVE-2022-41355 | High | 7.2 | 2022-10-06 | Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /leave_system/classes/Master.php?f=delete_d… |
CVE-2022-39284 | Low | 2.6 | 2022-10-06 | CodeIgniter is a PHP full-stack web framework. In versions prior to 4.2.7 setting `$secure` or `$httponly` value to `true` in `Config\Cookie` is not reflected… |
CVE-2022-39279 | Medium | 4.3 | 2022-10-06 | discourse-chat is a plugin for the Discourse message board which adds chat functionality. In versions prior to 0.9 some places render a chat channel's name and… |
CVE-2022-27810 | High | 7.5 | 2022-10-06 | It was possible to trigger an infinite recursion condition in the error handler when Hermes executed specific maliciously formed JavaScript. This condition was… |
CVE-2022-41528 | High | 8.8 | 2022-10-06 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the text parameter in the setSmsCfg function. |
CVE-2022-41527 | High | 8.8 | 2022-10-06 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the pppoeUser parameter in the setOpModeCfg function. |
CVE-2022-41526 | High | 8.8 | 2022-10-06 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the ip parameter in the setDiagnosisCfg function. |
CVE-2022-41525 | Critical | 9.8 | 2022-10-06 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a command injection vulnerability via the OpModeCfg function at /cgi-bin/cstecgi.cgi. |
CVE-2022-41524 | High | 8.8 | 2022-10-06 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the week, sTime, and eTime parameters in the setParentalR… |
CVE-2022-41523 | High | 8.8 | 2022-10-06 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the command parameter in the setTracerouteCfg function. |
CVE-2022-41522 | Critical | 9.8 | 2022-10-06 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an unauthenticated stack overflow via the "main" function. |
CVE-2022-42457 | Critical | 9.1 | 2022-10-06 | Generex CS141 through 2.10 allows remote command execution by administrators via a web interface that reaches run_update in /usr/bin/gxserve-update.sh (e.g., c… |
CVE-2022-42250 | High | 7.2 | 2022-10-06 | Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/admin/inquiries/view_details.php?id=. |
CVE-2022-42249 | High | 7.2 | 2022-10-06 | Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/admin/storages/view_storage.php?id=. |
CVE-2022-42243 | High | 7.2 | 2022-10-06 | Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/admin/storages/manage_storage.php?id=. |
CVE-2022-42242 | High | 7.2 | 2022-10-06 | Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/classes/Master.php?f=delete_booking. |
CVE-2022-42241 | High | 7.2 | 2022-10-06 | Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/classes/Master.php?f=delete_message. |
CVE-2022-41853 | High | 8.0 | 2022-10-06 | Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execut… |
CVE-2022-41556 | High | 7.5 | 2022-10-06 | A resource leak in gw_backend.c in lighttpd 1.4.56 through 1.4.66 could lead to a denial of service (connection-slot exhaustion) after a large amount of anomal… |
CVE-2022-41521 | High | 8.8 | 2022-10-06 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the sPort/ePort parameter in the setIpPortFilterRules fun… |
CVE-2022-41520 | High | 8.8 | 2022-10-06 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the File parameter in the UploadCustomModule function. |
CVE-2022-41518 | Critical | 9.8 | 2022-10-06 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a command injection vulnerability via the UploadFirmwareFile function at /cgi-bin/cstecgi.cgi. |
CVE-2022-41517 | High | 8.8 | 2022-10-06 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a stack overflow in the lang parameter in the setLanguageCfg function |
CVE-2022-41294 | Medium | 6.5 | 2022-10-06 | IBM Robotic Process Automation 21.0.0, 21.0.1, 21.0.2, 21.0.3, and 21.0.4 is vulnerable to cross origin resource sharing using the bot api. IBM X-Force ID: 236… |
CVE-2022-40895 | Critical | 9.1 | 2022-10-06 | In certain Nedi products, a vulnerability in the web UI of NeDi login & Community login could allow an unauthenticated, remote attacker to affect the integrity… |
CVE-2022-40160 | Medium | 6.5 | 2022-10-06 | ** DISPUTED ** This record was originally reported by the oss-fuzz project who failed to consider the security context in which JXPath is intended to be used a… |
CVE-2022-40159 | Medium | 6.5 | 2022-10-06 | ** DISPUTED ** This record was originally reported by the oss-fuzz project who failed to consider the security context in which JXPath is intended to be used a… |
CVE-2022-3398 | High | 7.8 | 2022-10-06 | OMRON CX-Programmer 9.78 and prior is vulnerable to an Out-of-Bounds Write, which may allow an attacker to execute arbitrary code. |
CVE-2022-3397 | High | 7.8 | 2022-10-06 | OMRON CX-Programmer 9.78 and prior is vulnerable to an Out-of-Bounds Write, which may allow an attacker to execute arbitrary code. |
CVE-2022-3396 | High | 7.8 | 2022-10-06 | OMRON CX-Programmer 9.78 and prior is vulnerable to an Out-of-Bounds Write, which may allow an attacker to execute arbitrary code. |
CVE-2022-3389 | High | 7.5 | 2022-10-06 | Path Traversal in GitHub repository ikus060/rdiffweb prior to 2.4.10. |
CVE-2022-3376 | Medium | 5.3 | 2022-10-06 | Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.5.0a4. |