2022 CVEs (page 124)
Page 124 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-39871 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability cloudNotificationManager.java in SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information v… |
CVE-2022-39870 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information v… |
CVE-2022-39869 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information v… |
CVE-2022-39868 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability in GedSamsungAccount.kt SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via implic… |
CVE-2022-39867 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information v… |
CVE-2022-39866 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability in RegisteredEventMediator.kt SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via… |
CVE-2022-39865 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability in ContentsSharingActivity.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information vi… |
CVE-2022-39864 | Low | 3.3 | 2022-10-07 | Improper access control vulnerability in WifiSetupLaunchHelper in SmartThings prior to version 1.7.89.25 allows attackers to access sensitive information via i… |
CVE-2022-39863 | Low | 3.6 | 2022-10-07 | Intent redirection vulnerability in Samsung Account prior to version 13.5.01.3 allows attackers to access content providers without permission. |
CVE-2022-39862 | Medium | 5.3 | 2022-10-07 | Improper authorization in Dynamic Lockscreen prior to SMR Sep-2022 Release 1 in Android R(11) and 3.3.03.66 in Android S(12) allows unauthorized use of javascr… |
CVE-2022-39861 | Medium | 5.9 | 2022-10-07 | Unprotected Receiver in AtBroadcastReceiver in FactoryCamera prior to version 3.5.51 allows attackers to record video without camera privilege. |
CVE-2022-39860 | Medium | 4.4 | 2022-10-07 | Improper access control vulnerability in QuickShare prior to version 13.2.3.5 allows attackers to access sensitive information via implicit broadcast. |
CVE-2022-39859 | Medium | 4.0 | 2022-10-07 | Implicit intent hijacking vulnerability in UPHelper library prior to version 3.0.12 allows attackers to access sensitive information via implicit intent. |
CVE-2022-39858 | High | 7.3 | 2022-10-07 | Path traversal vulnerability in AtBroadcastReceiver in FactoryCamera prior to version 3.5.51 allows attackers to write arbitrary file as FactoryCamera privileg… |
CVE-2022-39857 | High | 7.3 | 2022-10-07 | Improper access control vulnerability in CameraTestActivity in FactoryCameraFB prior to version 3.5.51 allows attackers to access broadcasting Intent as system… |
CVE-2022-39856 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability in imsservice application prior to SMR Oct-2022 Release 1 allows local attackers to access call information. |
CVE-2022-39855 | Medium | 5.1 | 2022-10-07 | Improper access control vulnerability in FACM application prior to SMR Oct-2022 Release 1 allows a local attacker to connect arbitrary AP and Bluetooth devices. |
CVE-2022-39854 | Medium | 6.4 | 2022-10-07 | Improper protection in IOMMU prior to SMR Oct-2022 Release 1 allows unauthorized access to secure memory. |
CVE-2022-39853 | Medium | 4.4 | 2022-10-07 | A use after free vulnerability in perf-mgr driver prior to SMR Oct-2022 Release 1 allows attacker to cause memory access fault. |
CVE-2022-39852 | High | 8.0 | 2022-10-07 | A heap-based overflow vulnerability in makeContactAGIF in libagifencoder.quram.so library prior to SMR Oct-2022 Release 1 allows attacker to perform code execu… |
CVE-2022-39851 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability in CocktailBarService prior to SMR Oct-2022 Release 1 allows local attacker to bind service that require BIND_REMOTEVIEWS… |
CVE-2022-39850 | Low | 3.3 | 2022-10-07 | Improper access control in mum_container_policy service prior to SMR Oct-2022 Release 1 allows allows unauthorized read of configuration data. |
CVE-2022-39849 | Low | 3.3 | 2022-10-07 | Improper access control in knox_vpn_policy service prior to SMR Oct-2022 Release 1 allows allows unauthorized read of configuration data. |
CVE-2022-39848 | Medium | 4.0 | 2022-10-07 | Exposure of sensitive information in AT_Distributor prior to SMR Oct-2022 Release 1 allows local attacker to access SerialNo via log. |
CVE-2022-39847 | Medium | 4.9 | 2022-10-07 | Use after free vulnerability in set_nft_pid and signal_handler function of NFC driver prior to SMR Oct-2022 Release 1 allows attackers to perform malicious act… |
CVE-2022-36868 | Medium | 5.9 | 2022-10-07 | Improper restriction of broadcasting Intent in MouseNKeyHidDevice prior to SMR Oct-2022 Release 1 leaks MAC address of the connected Bluetooth device. |
CVE-2022-33896 | High | 7.8 | 2022-10-07 | A buffer underflow vulnerability exists in the way Hword of Hancom Office 2020 version 11.0.0.5357 parses XML-based office files. A specially-crafted malformed… |
CVE-2022-40872 | Critical | 9.8 | 2022-10-07 | An SQL injection vulnerability issue was discovered in Sourcecodester Simple E-Learning System 1.0., in /vcs/classRoom.php?classCode=, classCode. |
CVE-2022-40835 | Critical | 9.8 | 2022-10-07 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php. Note: Multiple third parties have di… |
CVE-2022-40834 | Critical | 9.8 | 2022-10-07 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_not_like() function. Note: Multipl… |
CVE-2022-40833 | Critical | 9.8 | 2022-10-07 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where_in() function. Note: Multipl… |
CVE-2022-40832 | Critical | 9.8 | 2022-10-07 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php having() function. Note: Multiple thi… |
CVE-2022-40831 | Critical | 9.8 | 2022-10-07 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php like() function. Note: Multiple third… |
CVE-2022-40830 | Critical | 9.8 | 2022-10-07 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where_not_in() function. Note: Multip… |
CVE-2022-40829 | Critical | 9.8 | 2022-10-07 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_like() function. Note: Multiple th… |
CVE-2022-40828 | Critical | 9.8 | 2022-10-07 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where_not_in() function. Note: Mul… |
CVE-2022-40827 | Critical | 9.8 | 2022-10-07 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where() function. Note: Multiple thir… |
CVE-2022-40826 | Critical | 9.8 | 2022-10-07 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_having() function. Note: Multiple… |
CVE-2022-40825 | Critical | 9.8 | 2022-10-07 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where_in() function. Note: Multiple t… |
CVE-2022-40824 | Critical | 9.8 | 2022-10-07 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where() function. Note: Multiple t… |
CVE-2022-3423 | High | 7.3 | 2022-10-07 | Allocation of Resources Without Limits or Throttling in GitHub repository nocodb/nocodb prior to 0.92.0. |
CVE-2022-3422 | High | 7.5 | 2022-10-07 | Account Takeover :: when see the info i can see the hash pass i can creaked it ............... Account Takeover :: when see the info i can see the forgot_passw… |
CVE-2022-41672 | High | 8.1 | 2022-10-07 | In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API. |
CVE-2022-3414 | Medium | 5.0 | 2022-10-07 | A vulnerability was found in SourceCodester Web-Based Student Clearance System. It has been classified as critical. Affected is an unknown function of the file… |
CVE-2022-2929 | Medium | 6.5 | 2022-10-07 | In ISC DHCP 1.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1 a system with access to a DHCP server, sending DHCP packets crafted to include fqdn labels long… |
CVE-2022-2928 | Medium | 6.5 | 2022-10-07 | In ISC DHCP 4.4.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1, when the function option_code_hash_lookup() is called from add_option(), it increases the op… |
CVE-2022-26238 | Medium | 5.5 | 2022-10-06 | The default privileges for the running service Normand Service Manager in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows non-privileged users to ov… |
CVE-2022-26236 | Medium | 5.5 | 2022-10-06 | The default privileges for the running service Normand Remisol Advance Launcher in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows non-privileged us… |
CVE-2022-40494 | Critical | 9.8 | 2022-10-06 | NPS before v0.26.10 was discovered to contain an authentication bypass vulnerability via constantly generating and sending the Auth key and Timestamp parameter… |
CVE-2022-41355 | High | 7.2 | 2022-10-06 | Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /leave_system/classes/Master.php?f=delete_d… |
CVE-2022-39284 | Low | 2.6 | 2022-10-06 | CodeIgniter is a PHP full-stack web framework. In versions prior to 4.2.7 setting `$secure` or `$httponly` value to `true` in `Config\Cookie` is not reflected… |
CVE-2022-39279 | Medium | 4.3 | 2022-10-06 | discourse-chat is a plugin for the Discourse message board which adds chat functionality. In versions prior to 0.9 some places render a chat channel's name and… |
CVE-2022-27810 | High | 7.5 | 2022-10-06 | It was possible to trigger an infinite recursion condition in the error handler when Hermes executed specific maliciously formed JavaScript. This condition was… |
CVE-2022-41528 | High | 8.8 | 2022-10-06 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the text parameter in the setSmsCfg function. |
CVE-2022-41527 | High | 8.8 | 2022-10-06 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the pppoeUser parameter in the setOpModeCfg function. |
CVE-2022-41526 | High | 8.8 | 2022-10-06 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the ip parameter in the setDiagnosisCfg function. |
CVE-2022-41525 | Critical | 9.8 | 2022-10-06 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a command injection vulnerability via the OpModeCfg function at /cgi-bin/cstecgi.cgi. |
CVE-2022-41524 | High | 8.8 | 2022-10-06 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the week, sTime, and eTime parameters in the setParentalR… |
CVE-2022-41523 | High | 8.8 | 2022-10-06 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the command parameter in the setTracerouteCfg function. |
CVE-2022-41522 | Critical | 9.8 | 2022-10-06 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an unauthenticated stack overflow via the "main" function. |
CVE-2022-42457 | Critical | 9.1 | 2022-10-06 | Generex CS141 through 2.10 allows remote command execution by administrators via a web interface that reaches run_update in /usr/bin/gxserve-update.sh (e.g., c… |
CVE-2022-42250 | High | 7.2 | 2022-10-06 | Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/admin/inquiries/view_details.php?id=. |
CVE-2022-42249 | High | 7.2 | 2022-10-06 | Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/admin/storages/view_storage.php?id=. |
CVE-2022-42243 | High | 7.2 | 2022-10-06 | Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/admin/storages/manage_storage.php?id=. |
CVE-2022-42242 | High | 7.2 | 2022-10-06 | Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/classes/Master.php?f=delete_booking. |
CVE-2022-42241 | High | 7.2 | 2022-10-06 | Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/classes/Master.php?f=delete_message. |
CVE-2022-41853 | High | 8.0 | 2022-10-06 | Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execut… |
CVE-2022-41556 | High | 7.5 | 2022-10-06 | A resource leak in gw_backend.c in lighttpd 1.4.56 through 1.4.66 could lead to a denial of service (connection-slot exhaustion) after a large amount of anomal… |
CVE-2022-41521 | High | 8.8 | 2022-10-06 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the sPort/ePort parameter in the setIpPortFilterRules fun… |
CVE-2022-41520 | High | 8.8 | 2022-10-06 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the File parameter in the UploadCustomModule function. |
CVE-2022-41518 | Critical | 9.8 | 2022-10-06 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a command injection vulnerability via the UploadFirmwareFile function at /cgi-bin/cstecgi.cgi. |
CVE-2022-41517 | High | 8.8 | 2022-10-06 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a stack overflow in the lang parameter in the setLanguageCfg function |
CVE-2022-41294 | Medium | 6.5 | 2022-10-06 | IBM Robotic Process Automation 21.0.0, 21.0.1, 21.0.2, 21.0.3, and 21.0.4 is vulnerable to cross origin resource sharing using the bot api. IBM X-Force ID: 236… |
CVE-2022-40895 | Critical | 9.1 | 2022-10-06 | In certain Nedi products, a vulnerability in the web UI of NeDi login & Community login could allow an unauthenticated, remote attacker to affect the integrity… |
CVE-2022-40160 | Medium | 6.5 | 2022-10-06 | ** DISPUTED ** This record was originally reported by the oss-fuzz project who failed to consider the security context in which JXPath is intended to be used a… |
CVE-2022-40159 | Medium | 6.5 | 2022-10-06 | ** DISPUTED ** This record was originally reported by the oss-fuzz project who failed to consider the security context in which JXPath is intended to be used a… |
CVE-2022-3398 | High | 7.8 | 2022-10-06 | OMRON CX-Programmer 9.78 and prior is vulnerable to an Out-of-Bounds Write, which may allow an attacker to execute arbitrary code. |
CVE-2022-3397 | High | 7.8 | 2022-10-06 | OMRON CX-Programmer 9.78 and prior is vulnerable to an Out-of-Bounds Write, which may allow an attacker to execute arbitrary code. |
CVE-2022-3396 | High | 7.8 | 2022-10-06 | OMRON CX-Programmer 9.78 and prior is vulnerable to an Out-of-Bounds Write, which may allow an attacker to execute arbitrary code. |
CVE-2022-3389 | High | 7.5 | 2022-10-06 | Path Traversal in GitHub repository ikus060/rdiffweb prior to 2.4.10. |
CVE-2022-3376 | Medium | 5.3 | 2022-10-06 | Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.5.0a4. |
CVE-2022-3273 | Critical | 9.8 | 2022-10-06 | Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a4. |
CVE-2022-3002 | Medium | 5.4 | 2022-10-06 | Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. |
CVE-2022-39988 | Medium | 5.4 | 2022-10-06 | A cross-site scripting (XSS) vulnerability in Centreon 22.04.0 allows attackers to execute arbitrary web script or HTML via a crafted payload injected into the… |
CVE-2022-39280 | Medium | 5.9 | 2022-10-06 | dparse is a parser for Python dependency files. dparse in versions before 0.5.2 contain a regular expression that is vulnerable to a Regular Expression Denial… |
CVE-2022-39275 | Medium | 5.3 | 2022-10-06 | Saleor is a headless, GraphQL commerce platform. In affected versions some GraphQL mutations were not properly checking the ID type input which allowed to acce… |
CVE-2022-39274 | High | 7.5 | 2022-10-06 | LoRaMac-node is a reference implementation and documentation of a LoRa network node. Versions of LoRaMac-node prior to 4.7.0 are vulnerable to a buffer overflo… |
CVE-2022-39273 | Medium | 4.8 | 2022-10-06 | FlyteAdmin is the control plane for the data processing platform Flyte. Users who enable the default Flyte’s authorization server without changing the default… |
CVE-2022-39270 | Medium | 5.4 | 2022-10-06 | DiscoTOC is a Discourse theme component that generates a table of contents for topics. Users that can create topics in TOC-enabled categories (and have suffici… |
CVE-2022-39269 | Critical | 9.1 | 2022-10-06 | PJSIP is a free and open source multimedia communication library written in C. When processing certain packets, PJSIP may incorrectly switch from using SRTP me… |
CVE-2022-39265 | High | 7.2 | 2022-10-06 | MyBB is a free and open source forum software. The _Mail Settings_ → Additional Parameters for PHP's mail() function mail_parameters setting value, in connecti… |
CVE-2022-39244 | High | 7.5 | 2022-10-06 | PJSIP is a free and open source multimedia communication library written in C. In versions of PJSIP prior to 2.13 the PJSIP parser, PJMEDIA RTP decoder, and PJ… |
CVE-2022-39237 | Medium | 6.3 | 2022-10-06 | syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/integrity` package did… |
CVE-2022-39222 | Critical | 9.3 | 2022-10-06 | Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex instances with public clients (and by extension, clients accept… |
CVE-2022-38709 | Medium | 6.1 | 2022-10-06 | IBM Robotic Process Automation 21.0.1, 21.0.2, and 21.0.3 for Cloud Pak is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitra… |
CVE-2022-37888 | Critical | 9.8 | 2022-10-06 | There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted… |
CVE-2022-36774 | Medium | 5.3 | 2022-10-06 | IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to man in the middle attacks through manipulation of the client proxy configuration. IB… |
CVE-2022-32172 | | 2022-10-06 | In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete template functionality. When an authenticated user… | |
CVE-2022-32171 | | 2022-10-06 | In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete user functionality. When an authenticated user dele… | |
CVE-2022-31252 | Medium | 4.4 | 2022-10-06 | A Incorrect Authorization vulnerability in chkstat of SUSE Linux Enterprise Server 12-SP5; openSUSE Leap 15.3, openSUSE Leap 15.4, openSUSE Leap Micro 5.2 did… |