2022 CVEs (page 125)
Page 125 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-3273 | Critical | 9.8 | 2022-10-06 | Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a4. |
CVE-2022-3002 | Medium | 5.4 | 2022-10-06 | Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. |
CVE-2022-39988 | Medium | 5.4 | 2022-10-06 | A cross-site scripting (XSS) vulnerability in Centreon 22.04.0 allows attackers to execute arbitrary web script or HTML via a crafted payload injected into the… |
CVE-2022-39280 | Medium | 5.9 | 2022-10-06 | dparse is a parser for Python dependency files. dparse in versions before 0.5.2 contain a regular expression that is vulnerable to a Regular Expression Denial… |
CVE-2022-39275 | Medium | 5.3 | 2022-10-06 | Saleor is a headless, GraphQL commerce platform. In affected versions some GraphQL mutations were not properly checking the ID type input which allowed to acce… |
CVE-2022-39274 | High | 7.5 | 2022-10-06 | LoRaMac-node is a reference implementation and documentation of a LoRa network node. Versions of LoRaMac-node prior to 4.7.0 are vulnerable to a buffer overflo… |
CVE-2022-39273 | Medium | 4.8 | 2022-10-06 | FlyteAdmin is the control plane for the data processing platform Flyte. Users who enable the default Flyte’s authorization server without changing the default… |
CVE-2022-39270 | Medium | 5.4 | 2022-10-06 | DiscoTOC is a Discourse theme component that generates a table of contents for topics. Users that can create topics in TOC-enabled categories (and have suffici… |
CVE-2022-39269 | Critical | 9.1 | 2022-10-06 | PJSIP is a free and open source multimedia communication library written in C. When processing certain packets, PJSIP may incorrectly switch from using SRTP me… |
CVE-2022-39265 | High | 7.2 | 2022-10-06 | MyBB is a free and open source forum software. The _Mail Settings_ → Additional Parameters for PHP's mail() function mail_parameters setting value, in connecti… |
CVE-2022-39244 | High | 7.5 | 2022-10-06 | PJSIP is a free and open source multimedia communication library written in C. In versions of PJSIP prior to 2.13 the PJSIP parser, PJMEDIA RTP decoder, and PJ… |
CVE-2022-39237 | Medium | 6.3 | 2022-10-06 | syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/integrity` package did… |
CVE-2022-39222 | Critical | 9.3 | 2022-10-06 | Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex instances with public clients (and by extension, clients accept… |
CVE-2022-38709 | Medium | 6.1 | 2022-10-06 | IBM Robotic Process Automation 21.0.1, 21.0.2, and 21.0.3 for Cloud Pak is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitra… |
CVE-2022-37888 | Critical | 9.8 | 2022-10-06 | There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted… |
CVE-2022-36774 | Medium | 5.3 | 2022-10-06 | IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to man in the middle attacks through manipulation of the client proxy configuration. IB… |
CVE-2022-32172 | | 2022-10-06 | In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete template functionality. When an authenticated user… | |
CVE-2022-32171 | | 2022-10-06 | In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete user functionality. When an authenticated user dele… | |
CVE-2022-31252 | Medium | 4.4 | 2022-10-06 | A Incorrect Authorization vulnerability in chkstat of SUSE Linux Enterprise Server 12-SP5; openSUSE Leap 15.3, openSUSE Leap 15.4, openSUSE Leap Micro 5.2 did… |
CVE-2022-31008 | Medium | 5.5 | 2022-10-06 | RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker (li… |
CVE-2022-2986 | High | 8.8 | 2022-10-06 | Enabling and disabling installed H5P libraries did not include the necessary token to prevent a CSRF risk. |
CVE-2022-2975 | High | 7.7 | 2022-10-06 | A vulnerability related to weak permissions was detected in Avaya Aura Application Enablement Services web application, allowing an administrative user to modi… |
CVE-2022-2783 | Medium | 5.3 | 2022-10-06 | In affected versions of Octopus Server it was identified that a session cookie could be used as the CSRF token |
CVE-2022-2781 | Medium | 5.3 | 2022-10-06 | In affected versions of Octopus Server it was identified that the same encryption process was used for both encrypting session cookies and variables. |
CVE-2022-2637 | Medium | 5.4 | 2022-10-06 | Incorrect Privilege Assignment vulnerability in Hitachi Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privilege escalat… |
CVE-2022-26240 | Medium | 6.5 | 2022-10-06 | The default privileges for the running service Normand Message Buffer in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows non-privileged users to ove… |
CVE-2022-26239 | Medium | 5.5 | 2022-10-06 | The default privileges for the running service Normand License Manager in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows unprivileged users to over… |
CVE-2022-26237 | Medium | 5.5 | 2022-10-06 | The default privileges for the running service Normand Viewer Service in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows non-privileged users to ove… |
CVE-2022-26235 | High | 7.8 | 2022-10-06 | A vulnerability was discovered in the Remisol Advance v2.0.12.1 and below for the Normand Message Server. On installation, the permissions set by Remisol Advan… |
CVE-2022-22503 | Medium | 6.1 | 2022-10-06 | IBM Robotic Process Automation 21.0.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious We… |
CVE-2022-42247 | Medium | 6.1 | 2022-10-03 | pfSense v2.5.2 was discovered to contain a cross-site scripting (XSS) vulnerability in the browser.php component. This vulnerability allows attackers to execut… |
CVE-2022-41443 | Critical | 9.8 | 2022-10-03 | phpipam v1.5.0 was discovered to contain a header injection vulnerability via the component /admin/subnets/ripe-query.php. |
CVE-2022-33882 | Critical | 9.8 | 2022-10-03 | Under certain conditions, an attacker could create an unintended sphere of control through a vulnerability present in file delete operation in Autodesk desktop… |
CVE-2022-42308 | Critical | 9.0 | 2022-10-03 | An issue was discovered in Veritas NetBackup through 8.2 and related Veritas products. An attacker with local access can delete arbitrary files by leveraging a… |
CVE-2022-42307 | Medium | 5.3 | 2022-10-03 | An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to an XML External Entit… |
CVE-2022-42306 | Medium | 6.5 | 2022-10-03 | An issue was discovered in Veritas NetBackup through 8.2 and related Veritas products. An attacker with local access can send a crafted packet to pbx_exchange… |
CVE-2022-42305 | Medium | 5.3 | 2022-10-03 | An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to a Path traversal atta… |
CVE-2022-42304 | High | 8.0 | 2022-10-03 | An issue was discovered in Veritas NetBackup through 10.0 and related Veritas products. The NetBackup Primary server is vulnerable to a SQL Injection attack af… |
CVE-2022-42303 | High | 8.0 | 2022-10-03 | An issue was discovered in Veritas NetBackup through 10.0 and related Veritas products. The NetBackup Primary server is vulnerable to a second-order SQL Inject… |
CVE-2022-42302 | Critical | 9.0 | 2022-10-03 | An issue was discovered in Veritas NetBackup through 10.0 and related Veritas products. The NetBackup Primary server is vulnerable to a SQL Injection attack af… |
CVE-2022-42301 | Medium | 5.4 | 2022-10-03 | An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to an XML External Entit… |
CVE-2022-42300 | Medium | 4.3 | 2022-10-03 | An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server nbars process can be crashed resulting… |
CVE-2022-42299 | Medium | 5.3 | 2022-10-03 | An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to a denial of service a… |
CVE-2022-41301 | High | 7.8 | 2022-10-03 | A maliciously crafted PKT file when consumed through SubassemblyComposer.exe application could lead to memory corruption vulnerability by read access violation… |
CVE-2022-40764 | High | 7.8 | 2022-10-03 | Snyk CLI before 1.996.0 allows arbitrary command execution, affecting Snyk IDE plugins and the snyk npm package. Exploitation could follow from the common prac… |
CVE-2022-40721 | Critical | 9.8 | 2022-10-03 | Arbitrary file upload vulnerability in php uploader |
CVE-2022-33890 | High | 7.8 | 2022-10-03 | A maliciously crafted PCT or DWF file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by read access violation… |
CVE-2022-33889 | High | 7.8 | 2022-10-03 | A maliciously crafted GIF or JPEG files when parsed through Autodesk Design Review 2018, and AutoCAD 2023 and 2022 could be used to write beyond the allocated… |
CVE-2022-33888 | High | 7.8 | 2022-10-03 | A malicious crafted Dwg2Spd file when processed through Autodesk DWG application could lead to memory corruption vulnerability by write access violation. This… |
CVE-2022-33887 | High | 7.8 | 2022-10-03 | A maliciously crafted PDF file when parsed through Autodesk AutoCAD 2023 causes an unhandled exception. An attacker can leverage this vulnerability to cause a… |
CVE-2022-33886 | High | 7.8 | 2022-10-03 | A maliciously crafted MODEL and SLDPRT file can be used to write beyond the allocated buffer while parsing through Autodesk AutoCAD 2023, 2022, 2021, 2020, and… |
CVE-2022-33885 | High | 7.8 | 2022-10-03 | A maliciously crafted X_B, CATIA, and PDF file when parsed through Autodesk AutoCAD 2023 and 2022 can be used to write beyond the allocated buffer. This vulner… |
CVE-2022-33884 | High | 7.5 | 2022-10-03 | Parsing a maliciously crafted X_B file can force Autodesk AutoCAD 2023 and 2022 to read beyond allocated boundaries. This vulnerability in conjunction with oth… |
CVE-2022-33883 | High | 7.8 | 2022-10-03 | A malicious crafted file consumed through Moldflow Synergy, Moldflow Adviser, Moldflow Communicator, and Advanced Material Exchange applications could lead to… |
CVE-2022-41430 | High | 8.8 | 2022-10-03 | Bento4 v1.6.0-639 was discovered to contain a heap overflow via the AP4_BitReader::ReadBit function in mp4mux. |
CVE-2022-41429 | High | 8.8 | 2022-10-03 | Bento4 v1.6.0-639 was discovered to contain a heap overflow via the AP4_Atom::TypeFromString function in mp4tag. |
CVE-2022-41428 | High | 8.8 | 2022-10-03 | Bento4 v1.6.0-639 was discovered to contain a heap overflow via the AP4_BitReader::ReadBits function in mp4mux. |
CVE-2022-41427 | Medium | 6.5 | 2022-10-03 | Bento4 v1.6.0-639 was discovered to contain a memory leak in the AP4_AvcFrameParser::Feed function in mp4mux. |
CVE-2022-41426 | Medium | 6.5 | 2022-10-03 | Bento4 v1.6.0-639 was discovered to contain a memory leak via the AP4_AtomFactory::CreateAtomFromStream function in mp4split. |
CVE-2022-41425 | Medium | 6.5 | 2022-10-03 | Bento4 v1.6.0-639 was discovered to contain a segmentation violation via the AP4_Processor::ProcessFragments function in mp4decrypt. |
CVE-2022-41424 | Medium | 6.5 | 2022-10-03 | Bento4 v1.6.0-639 was discovered to contain a memory leak via the AP4_SttsAtom::Create function in mp42hls. |
CVE-2022-41423 | Medium | 6.5 | 2022-10-03 | Bento4 v1.6.0-639 was discovered to contain a segmentation violation in the mp4fragment component. |
CVE-2022-41420 | Medium | 5.5 | 2022-10-03 | nasm v2.16 was discovered to contain a stack overflow in the Ndisasm component |
CVE-2022-41419 | Medium | 6.5 | 2022-10-03 | Bento4 v1.6.0-639 was discovered to contain a memory leak via the AP4_Processor::Process function in the mp4encrypt binary. |
CVE-2022-3132 | Medium | 4.8 | 2022-10-03 | The Goolytics WordPress plugin before 1.1.2 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scr… |
CVE-2022-3128 | Medium | 4.8 | 2022-10-03 | The Donation Thermometer WordPress plugin before 2.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… |
CVE-2022-3125 | High | 8.8 | 2022-10-03 | The Frontend File Manager Plugin WordPress plugin before 21.3 allows any authenticated users, such as subscriber, to rename a file to an arbitrary extension, l… |
CVE-2022-3124 | Medium | 5.3 | 2022-10-03 | The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermore, due to the lack… |
CVE-2022-2839 | Medium | 5.4 | 2022-10-03 | The Zephyr Project Manager WordPress plugin before 3.2.55 does not have any authorisation as well as CSRF in all its AJAX actions, allowing unauthenticated use… |
CVE-2022-2763 | Medium | 4.8 | 2022-10-03 | The WP Socializer WordPress plugin before 7.3 does not sanitise and escape some of its Icons settings, which could allow high privilege users such as admin to… |
CVE-2022-2628 | Medium | 4.8 | 2022-10-03 | The DSGVO All in one for WP WordPress plugin before 4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… |
CVE-2022-40922 | Medium | 6.5 | 2022-10-03 | A vulnerability in the LIEF::MachO::BinaryParser::init_and_parse function of LIEF v0.12.1 allows attackers to cause a denial of service (DOS) through a segment… |
CVE-2022-40123 | Medium | 6.5 | 2022-10-03 | mojoPortal v2.7 was discovered to contain a path traversal vulnerability via the "f" parameter at /DesignTools/CssEditor.aspx. This vulnerability allows authen… |
CVE-2022-38817 | High | 7.5 | 2022-10-03 | Dapr Dashboard v0.1.0 through v0.10.0 is vulnerable to Incorrect Access Control that allows attackers to obtain sensitive data. |
CVE-2022-32173 | Medium | 5.4 | 2022-10-03 | In OrchardCore rc1-11259 to v1.2.2 vulnerable to HTML injection, allow an authenticated user with an editor security role to inject a persistent HTML modal dia… |
CVE-2022-36551 | Medium | 6.5 | 2022-10-03 | A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.0 and earlier allows an authenticated u… |
CVE-2022-40886 | High | 7.2 | 2022-10-03 | DedeCMS 5.7.98 has a file upload vulnerability in the background. |
CVE-2022-41082 | High | 8.0 | 2022-10-03 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2022-41040 | High | 8.8 | 2022-10-03 | Microsoft Exchange Server Elevation of Privilege Vulnerability |
CVE-2022-42004 | High | 7.5 | 2022-10-02 | In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent us… |
CVE-2022-42003 | High | 7.5 | 2022-10-02 | In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserialize… |
CVE-2022-42002 | Critical | 9.1 | 2022-10-01 | SonicJS through 0.6.0 allows file overwrite. It has the following mutations that are used for updating files: fileCreate and fileUpdate. Both of these mutation… |
CVE-2022-39268 | High | 8.1 | 2022-09-30 | ### Impact In a CSRF attack, an innocent end user is tricked by an attacker into submitting a web request that they did not intend. This may cause actions to b… |
CVE-2022-34429 | Medium | 6.5 | 2022-09-30 | Dell Hybrid Client below 1.8 version contains a Zip Slip Vulnerability in UI. A guest privilege attacker could potentially exploit this vulnerability, leading… |
CVE-2022-34428 | Medium | 5.0 | 2022-09-30 | Dell Hybrid Client prior to version 1.8 contains a Regular Expression Denial of Service Vulnerability in the UI. An adversary with WMS group admin access could… |
CVE-2022-40943 | Critical | 9.8 | 2022-09-30 | Dairy Farm Shop Management System 1.0 is vulnerable to SQL Injection via bwdate-report-ds.php file. |
CVE-2022-40923 | Medium | 6.5 | 2022-09-30 | A vulnerability in the LIEF::MachO::SegmentCommand::virtual_address function of LIEF v0.12.1 allows attackers to cause a denial of service (DOS) through a segm… |
CVE-2022-40756 | High | 8.8 | 2022-09-30 | If folder security is misconfigured for Actian Zen PSQL BEFORE Patch Update 1 for Zen 15 SP1 (v15.11.005), Patch Update 4 for Zen 15 (v15.01.017), or Patch Upd… |
CVE-2022-40341 | High | 8.8 | 2022-09-30 | mojoPortal v2.7 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted PNG file. |
CVE-2022-35156 | Critical | 9.8 | 2022-09-30 | Bus Pass Management System 1.0 was discovered to contain a SQL Injection vulnerability via the searchdata parameter at /buspassms/download-pass.php.. |
CVE-2022-35155 | Medium | 6.1 | 2022-09-30 | Bus Pass Management System v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the searchdata parameter. |
CVE-2022-20945 | High | 7.4 | 2022-09-30 | A vulnerability in the 802.11 association frame validation of Cisco Catalyst 9100 Series Access Points (APs) could allow an unauthenticated, adjacent attacker… |
CVE-2022-20930 | Medium | 6.7 | 2022-09-30 | A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to overwrite and possibly corrupt files on an affected system… |
CVE-2022-20919 | High | 8.6 | 2022-09-30 | A vulnerability in the processing of malformed Common Industrial Protocol (CIP) packets that are sent to Cisco IOS Software and Cisco IOS XE Software could all… |
CVE-2022-20856 | High | 8.6 | 2022-09-30 | A vulnerability in the processing of Control and Provisioning of Wireless Access Points (CAPWAP) Mobility messages in Cisco IOS XE Wireless Controller Software… |
CVE-2022-20855 | High | 7.9 | 2022-09-30 | A vulnerability in the self-healing functionality of Cisco IOS XE Software for Embedded Wireless Controllers on Catalyst Access Points could allow an authentic… |
CVE-2022-20851 | Medium | 5.5 | 2022-09-30 | A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to perform an injection attack against an affected… |
CVE-2022-20850 | Medium | 5.5 | 2022-09-30 | A vulnerability in the CLI of stand-alone Cisco IOS XE SD-WAN Software and Cisco SD-WAN Software could allow an authenticated, local attacker to delete arbitra… |
CVE-2022-20848 | High | 8.6 | 2022-09-30 | A vulnerability in the UDP processing functionality of Cisco IOS XE Software for Embedded Wireless Controllers on Catalyst 9100 Series Access Points could allo… |
CVE-2022-20847 | High | 8.6 | 2022-09-30 | A vulnerability in the DHCP processing functionality of Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family could allow an unauthenticated… |