2022 CVEs (page 125)
Page 125 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-31008 | Medium | 5.5 | 2022-10-06 | RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker (li… |
CVE-2022-2986 | High | 8.8 | 2022-10-06 | Enabling and disabling installed H5P libraries did not include the necessary token to prevent a CSRF risk. |
CVE-2022-2975 | High | 7.7 | 2022-10-06 | A vulnerability related to weak permissions was detected in Avaya Aura Application Enablement Services web application, allowing an administrative user to modi… |
CVE-2022-2783 | Medium | 5.3 | 2022-10-06 | In affected versions of Octopus Server it was identified that a session cookie could be used as the CSRF token |
CVE-2022-2781 | Medium | 5.3 | 2022-10-06 | In affected versions of Octopus Server it was identified that the same encryption process was used for both encrypting session cookies and variables. |
CVE-2022-2637 | Medium | 5.4 | 2022-10-06 | Incorrect Privilege Assignment vulnerability in Hitachi Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privilege escalat… |
CVE-2022-26240 | Medium | 6.5 | 2022-10-06 | The default privileges for the running service Normand Message Buffer in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows non-privileged users to ove… |
CVE-2022-26239 | Medium | 5.5 | 2022-10-06 | The default privileges for the running service Normand License Manager in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows unprivileged users to over… |
CVE-2022-26237 | Medium | 5.5 | 2022-10-06 | The default privileges for the running service Normand Viewer Service in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows non-privileged users to ove… |
CVE-2022-26235 | High | 7.8 | 2022-10-06 | A vulnerability was discovered in the Remisol Advance v2.0.12.1 and below for the Normand Message Server. On installation, the permissions set by Remisol Advan… |
CVE-2022-22503 | Medium | 6.1 | 2022-10-06 | IBM Robotic Process Automation 21.0.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious We… |
CVE-2022-42247 | Medium | 6.1 | 2022-10-03 | pfSense v2.5.2 was discovered to contain a cross-site scripting (XSS) vulnerability in the browser.php component. This vulnerability allows attackers to execut… |
CVE-2022-41443 | Critical | 9.8 | 2022-10-03 | phpipam v1.5.0 was discovered to contain a header injection vulnerability via the component /admin/subnets/ripe-query.php. |
CVE-2022-33882 | Critical | 9.8 | 2022-10-03 | Under certain conditions, an attacker could create an unintended sphere of control through a vulnerability present in file delete operation in Autodesk desktop… |
CVE-2022-42308 | Critical | 9.0 | 2022-10-03 | An issue was discovered in Veritas NetBackup through 8.2 and related Veritas products. An attacker with local access can delete arbitrary files by leveraging a… |
CVE-2022-42307 | Medium | 5.3 | 2022-10-03 | An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to an XML External Entit… |
CVE-2022-42306 | Medium | 6.5 | 2022-10-03 | An issue was discovered in Veritas NetBackup through 8.2 and related Veritas products. An attacker with local access can send a crafted packet to pbx_exchange… |
CVE-2022-42305 | Medium | 5.3 | 2022-10-03 | An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to a Path traversal atta… |
CVE-2022-42304 | High | 8.0 | 2022-10-03 | An issue was discovered in Veritas NetBackup through 10.0 and related Veritas products. The NetBackup Primary server is vulnerable to a SQL Injection attack af… |
CVE-2022-42303 | High | 8.0 | 2022-10-03 | An issue was discovered in Veritas NetBackup through 10.0 and related Veritas products. The NetBackup Primary server is vulnerable to a second-order SQL Inject… |
CVE-2022-42302 | Critical | 9.0 | 2022-10-03 | An issue was discovered in Veritas NetBackup through 10.0 and related Veritas products. The NetBackup Primary server is vulnerable to a SQL Injection attack af… |
CVE-2022-42301 | Medium | 5.4 | 2022-10-03 | An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to an XML External Entit… |
CVE-2022-42300 | Medium | 4.3 | 2022-10-03 | An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server nbars process can be crashed resulting… |
CVE-2022-42299 | Medium | 5.3 | 2022-10-03 | An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to a denial of service a… |
CVE-2022-41301 | High | 7.8 | 2022-10-03 | A maliciously crafted PKT file when consumed through SubassemblyComposer.exe application could lead to memory corruption vulnerability by read access violation… |
CVE-2022-40764 | High | 7.8 | 2022-10-03 | Snyk CLI before 1.996.0 allows arbitrary command execution, affecting Snyk IDE plugins and the snyk npm package. Exploitation could follow from the common prac… |
CVE-2022-40721 | Critical | 9.8 | 2022-10-03 | Arbitrary file upload vulnerability in php uploader |
CVE-2022-33890 | High | 7.8 | 2022-10-03 | A maliciously crafted PCT or DWF file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by read access violation… |
CVE-2022-33889 | High | 7.8 | 2022-10-03 | A maliciously crafted GIF or JPEG files when parsed through Autodesk Design Review 2018, and AutoCAD 2023 and 2022 could be used to write beyond the allocated… |
CVE-2022-33888 | High | 7.8 | 2022-10-03 | A malicious crafted Dwg2Spd file when processed through Autodesk DWG application could lead to memory corruption vulnerability by write access violation. This… |
CVE-2022-33887 | High | 7.8 | 2022-10-03 | A maliciously crafted PDF file when parsed through Autodesk AutoCAD 2023 causes an unhandled exception. An attacker can leverage this vulnerability to cause a… |
CVE-2022-33886 | High | 7.8 | 2022-10-03 | A maliciously crafted MODEL and SLDPRT file can be used to write beyond the allocated buffer while parsing through Autodesk AutoCAD 2023, 2022, 2021, 2020, and… |
CVE-2022-33885 | High | 7.8 | 2022-10-03 | A maliciously crafted X_B, CATIA, and PDF file when parsed through Autodesk AutoCAD 2023 and 2022 can be used to write beyond the allocated buffer. This vulner… |
CVE-2022-33884 | High | 7.5 | 2022-10-03 | Parsing a maliciously crafted X_B file can force Autodesk AutoCAD 2023 and 2022 to read beyond allocated boundaries. This vulnerability in conjunction with oth… |
CVE-2022-33883 | High | 7.8 | 2022-10-03 | A malicious crafted file consumed through Moldflow Synergy, Moldflow Adviser, Moldflow Communicator, and Advanced Material Exchange applications could lead to… |
CVE-2022-41430 | High | 8.8 | 2022-10-03 | Bento4 v1.6.0-639 was discovered to contain a heap overflow via the AP4_BitReader::ReadBit function in mp4mux. |
CVE-2022-41429 | High | 8.8 | 2022-10-03 | Bento4 v1.6.0-639 was discovered to contain a heap overflow via the AP4_Atom::TypeFromString function in mp4tag. |
CVE-2022-41428 | High | 8.8 | 2022-10-03 | Bento4 v1.6.0-639 was discovered to contain a heap overflow via the AP4_BitReader::ReadBits function in mp4mux. |
CVE-2022-41427 | Medium | 6.5 | 2022-10-03 | Bento4 v1.6.0-639 was discovered to contain a memory leak in the AP4_AvcFrameParser::Feed function in mp4mux. |
CVE-2022-41426 | Medium | 6.5 | 2022-10-03 | Bento4 v1.6.0-639 was discovered to contain a memory leak via the AP4_AtomFactory::CreateAtomFromStream function in mp4split. |
CVE-2022-41425 | Medium | 6.5 | 2022-10-03 | Bento4 v1.6.0-639 was discovered to contain a segmentation violation via the AP4_Processor::ProcessFragments function in mp4decrypt. |
CVE-2022-41424 | Medium | 6.5 | 2022-10-03 | Bento4 v1.6.0-639 was discovered to contain a memory leak via the AP4_SttsAtom::Create function in mp42hls. |
CVE-2022-41423 | Medium | 6.5 | 2022-10-03 | Bento4 v1.6.0-639 was discovered to contain a segmentation violation in the mp4fragment component. |
CVE-2022-41420 | Medium | 5.5 | 2022-10-03 | nasm v2.16 was discovered to contain a stack overflow in the Ndisasm component |
CVE-2022-41419 | Medium | 6.5 | 2022-10-03 | Bento4 v1.6.0-639 was discovered to contain a memory leak via the AP4_Processor::Process function in the mp4encrypt binary. |
CVE-2022-3132 | Medium | 4.8 | 2022-10-03 | The Goolytics WordPress plugin before 1.1.2 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scr… |
CVE-2022-3128 | Medium | 4.8 | 2022-10-03 | The Donation Thermometer WordPress plugin before 2.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… |
CVE-2022-3125 | High | 8.8 | 2022-10-03 | The Frontend File Manager Plugin WordPress plugin before 21.3 allows any authenticated users, such as subscriber, to rename a file to an arbitrary extension, l… |
CVE-2022-3124 | Medium | 5.3 | 2022-10-03 | The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermore, due to the lack… |
CVE-2022-2839 | Medium | 5.4 | 2022-10-03 | The Zephyr Project Manager WordPress plugin before 3.2.55 does not have any authorisation as well as CSRF in all its AJAX actions, allowing unauthenticated use… |
CVE-2022-2763 | Medium | 4.8 | 2022-10-03 | The WP Socializer WordPress plugin before 7.3 does not sanitise and escape some of its Icons settings, which could allow high privilege users such as admin to… |
CVE-2022-2628 | Medium | 4.8 | 2022-10-03 | The DSGVO All in one for WP WordPress plugin before 4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… |
CVE-2022-40922 | Medium | 6.5 | 2022-10-03 | A vulnerability in the LIEF::MachO::BinaryParser::init_and_parse function of LIEF v0.12.1 allows attackers to cause a denial of service (DOS) through a segment… |
CVE-2022-40123 | Medium | 6.5 | 2022-10-03 | mojoPortal v2.7 was discovered to contain a path traversal vulnerability via the "f" parameter at /DesignTools/CssEditor.aspx. This vulnerability allows authen… |
CVE-2022-38817 | High | 7.5 | 2022-10-03 | Dapr Dashboard v0.1.0 through v0.10.0 is vulnerable to Incorrect Access Control that allows attackers to obtain sensitive data. |
CVE-2022-32173 | Medium | 5.4 | 2022-10-03 | In OrchardCore rc1-11259 to v1.2.2 vulnerable to HTML injection, allow an authenticated user with an editor security role to inject a persistent HTML modal dia… |
CVE-2022-36551 | Medium | 6.5 | 2022-10-03 | A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.0 and earlier allows an authenticated u… |
CVE-2022-40886 | High | 7.2 | 2022-10-03 | DedeCMS 5.7.98 has a file upload vulnerability in the background. |
CVE-2022-41082 | High | 8.0 | 2022-10-03 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2022-41040 | High | 8.8 | 2022-10-03 | Microsoft Exchange Server Elevation of Privilege Vulnerability |
CVE-2022-42004 | High | 7.5 | 2022-10-02 | In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent us… |
CVE-2022-42003 | High | 7.5 | 2022-10-02 | In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserialize… |
CVE-2022-42002 | Critical | 9.1 | 2022-10-01 | SonicJS through 0.6.0 allows file overwrite. It has the following mutations that are used for updating files: fileCreate and fileUpdate. Both of these mutation… |
CVE-2022-39268 | High | 8.1 | 2022-09-30 | ### Impact In a CSRF attack, an innocent end user is tricked by an attacker into submitting a web request that they did not intend. This may cause actions to b… |
CVE-2022-34429 | Medium | 6.5 | 2022-09-30 | Dell Hybrid Client below 1.8 version contains a Zip Slip Vulnerability in UI. A guest privilege attacker could potentially exploit this vulnerability, leading… |
CVE-2022-34428 | Medium | 5.0 | 2022-09-30 | Dell Hybrid Client prior to version 1.8 contains a Regular Expression Denial of Service Vulnerability in the UI. An adversary with WMS group admin access could… |
CVE-2022-40943 | Critical | 9.8 | 2022-09-30 | Dairy Farm Shop Management System 1.0 is vulnerable to SQL Injection via bwdate-report-ds.php file. |
CVE-2022-40923 | Medium | 6.5 | 2022-09-30 | A vulnerability in the LIEF::MachO::SegmentCommand::virtual_address function of LIEF v0.12.1 allows attackers to cause a denial of service (DOS) through a segm… |
CVE-2022-40756 | High | 8.8 | 2022-09-30 | If folder security is misconfigured for Actian Zen PSQL BEFORE Patch Update 1 for Zen 15 SP1 (v15.11.005), Patch Update 4 for Zen 15 (v15.01.017), or Patch Upd… |
CVE-2022-40341 | High | 8.8 | 2022-09-30 | mojoPortal v2.7 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted PNG file. |
CVE-2022-35156 | Critical | 9.8 | 2022-09-30 | Bus Pass Management System 1.0 was discovered to contain a SQL Injection vulnerability via the searchdata parameter at /buspassms/download-pass.php.. |
CVE-2022-35155 | Medium | 6.1 | 2022-09-30 | Bus Pass Management System v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the searchdata parameter. |
CVE-2022-20945 | High | 7.4 | 2022-09-30 | A vulnerability in the 802.11 association frame validation of Cisco Catalyst 9100 Series Access Points (APs) could allow an unauthenticated, adjacent attacker… |
CVE-2022-20930 | Medium | 6.7 | 2022-09-30 | A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to overwrite and possibly corrupt files on an affected system… |
CVE-2022-20919 | High | 8.6 | 2022-09-30 | A vulnerability in the processing of malformed Common Industrial Protocol (CIP) packets that are sent to Cisco IOS Software and Cisco IOS XE Software could all… |
CVE-2022-20856 | High | 8.6 | 2022-09-30 | A vulnerability in the processing of Control and Provisioning of Wireless Access Points (CAPWAP) Mobility messages in Cisco IOS XE Wireless Controller Software… |
CVE-2022-20855 | High | 7.9 | 2022-09-30 | A vulnerability in the self-healing functionality of Cisco IOS XE Software for Embedded Wireless Controllers on Catalyst Access Points could allow an authentic… |
CVE-2022-20851 | Medium | 5.5 | 2022-09-30 | A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to perform an injection attack against an affected… |
CVE-2022-20850 | Medium | 5.5 | 2022-09-30 | A vulnerability in the CLI of stand-alone Cisco IOS XE SD-WAN Software and Cisco SD-WAN Software could allow an authenticated, local attacker to delete arbitra… |
CVE-2022-20848 | High | 8.6 | 2022-09-30 | A vulnerability in the UDP processing functionality of Cisco IOS XE Software for Embedded Wireless Controllers on Catalyst 9100 Series Access Points could allo… |
CVE-2022-20847 | High | 8.6 | 2022-09-30 | A vulnerability in the DHCP processing functionality of Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family could allow an unauthenticated… |
CVE-2022-20844 | Medium | 5.3 | 2022-09-30 | A vulnerability in authentication mechanism of Cisco Software-Defined Application Visibility and Control (SD-AVC) on Cisco vManage could allow an unauthenticat… |
CVE-2022-20818 | High | 7.8 | 2022-09-30 | Multiple vulnerabilities in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. These vulnerabilities ar… |
CVE-2022-20810 | Medium | 6.5 | 2022-09-30 | A vulnerability in the Simple Network Management Protocol (SNMP) of Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family could allow an authe… |
CVE-2022-20775 | High | 7.8 | 2022-09-30 | A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. This vulnerability is due to i… |
CVE-2022-20769 | High | 7.4 | 2022-09-30 | A vulnerability in the authentication functionality of Cisco Wireless LAN Controller (WLC) AireOS Software could allow an unauthenticated, adjacent attacker to… |
CVE-2022-20728 | Medium | 4.7 | 2022-09-30 | A vulnerability in the client forwarding code of multiple Cisco Access Points (APs) could allow an unauthenticated, adjacent attacker to inject packets from th… |
CVE-2022-20662 | Medium | 6.1 | 2022-09-30 | A vulnerability in the smart card login authentication of Cisco Duo for macOS could allow an unauthenticated attacker with physical access to bypass authentica… |
CVE-2022-41975 | High | 7.8 | 2022-09-30 | RealVNC VNC Server before 6.11.0 and VNC Viewer before 6.22.826 on Windows allow local privilege escalation via MSI installer Repair mode. |
CVE-2022-41870 | High | 7.2 | 2022-09-30 | AP Manager in Innovaphone before 13r2 Service Release 17 allows command injection via a modified service ID during app upload. |
CVE-2022-40944 | Critical | 9.8 | 2022-09-30 | Dairy Farm Shop Management System 1.0 is vulnerable to SQL Injection via sales-report-ds.php file. |
CVE-2022-40316 | Medium | 4.3 | 2022-09-30 | The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers about attempts/users… |
CVE-2022-40315 | Critical | 9.8 | 2022-09-30 | A limited SQL injection risk was identified in the "browse list of users" site administration page. |
CVE-2022-40314 | Critical | 9.8 | 2022-09-30 | A remote code execution risk when restoring backup files originating from Moodle 1.9 was identified. |
CVE-2022-40313 | High | 7.1 | 2022-09-30 | Recursive rendering of Mustache template helpers containing user input could, in some cases, result in an XSS risk or a page failing to load. |
CVE-2022-40277 | High | 7.8 | 2022-09-30 | Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Jopli… |
CVE-2022-40274 | High | 7.8 | 2022-09-30 | Gridea version 0.9.3 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Gridea… |
CVE-2022-36965 | Medium | 6.1 | 2022-09-30 | Insufficient sanitization of inputs in QoE application input field could lead to stored and Dom based XSS attack. This issue is fixed and released in SolarWind… |
CVE-2022-36961 | High | 8.8 | 2022-09-30 | A vulnerable component of Orion Platform was vulnerable to SQL Injection, an authenticated attacker could leverage this for privilege escalation or remote code… |
CVE-2022-32540 | Medium | 5.9 | 2022-09-30 | Information Disclosure in Operator Client application in BVMS 10.1.1, 11.0 and 11.1.0 and VIDEOJET Decoder VJD-7513 versions 10.23 and 10.30 allows man-in-the-… |