2022 CVEs (page 126)
Page 126 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-28851 | Medium | 5.4 | 2022-09-30 | Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convinc… |
CVE-2022-21826 | Medium | 5.4 | 2022-09-30 | Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the req… |
CVE-2022-1959 | Medium | 6.6 | 2022-09-30 | AppLock version 7.9.29 allows an attacker with physical access to the device to bypass biometric authentication. This is possible because the application did n… |
CVE-2022-41440 | High | 7.2 | 2022-09-30 | Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinventory/editcategory.php. |
CVE-2022-41439 | High | 7.2 | 2022-09-30 | Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinventory/edituser.php. |
CVE-2022-41437 | High | 7.2 | 2022-09-30 | Billing System Project v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /php_action/createProduct.php. |
CVE-2022-23726 | Medium | 5.4 | 2022-09-30 | PingCentral versions prior to listed versions expose Spring Boot actuator endpoints that with administrative authentication return large amounts of sensitive e… |
CVE-2022-3371 | High | 7.5 | 2022-09-30 | Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3. |
CVE-2022-37461 | Medium | 6.1 | 2022-09-30 | Multiple cross-site scripting (XSS) vulnerabilities in Canon Medical Vitrea View 7.x before 7.7.6 allow remote attackers to inject arbitrary web script or HTML… |
CVE-2022-2529 | High | 7.5 | 2022-09-30 | sflow decode package does not employ sufficient packet sanitisation which can lead to a denial of service attack. Attackers can craft malformed packets causing… |
CVE-2022-2922 | Medium | 4.9 | 2022-09-30 | Relative Path Traversal in GitHub repository dnnsoftware/dnn.platform prior to 9.11.0. |
CVE-2022-41850 | Medium | 4.7 | 2022-09-30 | roccat_report_event in drivers/hid/hid-roccat.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free in certain situations whe… |
CVE-2022-41849 | Medium | 4.2 | 2022-09-30 | drivers/video/fbdev/smscufx.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically proximate attacker removes… |
CVE-2022-41848 | Medium | 4.2 | 2022-09-30 | drivers/char/pcmcia/synclink_cs.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically proximate attacker remo… |
CVE-2022-41847 | Medium | 5.5 | 2022-09-30 | An issue was discovered in Bento4 1.6.0-639. A memory leak exists in AP4_StdcFileByteStream::Create(AP4_FileByteStream*, char const*, AP4_FileByteStream::Mode… |
CVE-2022-41846 | Medium | 5.5 | 2022-09-30 | An issue was discovered in Bento4 1.6.0-639. There ie excessive memory consumption in the function AP4_DataBuffer::ReallocateBuffer in Core/Ap4DataBuffer.cpp. |
CVE-2022-41845 | Medium | 5.5 | 2022-09-30 | An issue was discovered in Bento4 1.6.0-639. There ie excessive memory consumption in the function AP4_Array<AP4_ElstEntry>::EnsureCapacity in Core/Ap4Array.h. |
CVE-2022-41844 | Medium | 5.5 | 2022-09-30 | An issue was discovered in Xpdf 4.04. There is a crash in XRef::fetch(int, int, Object*, int) in xpdf/XRef.cc, a different vulnerability than CVE-2018-16369 an… |
CVE-2022-41843 | Medium | 5.5 | 2022-09-30 | An issue was discovered in Xpdf 4.04. There is a crash in convertToType0 in fofi/FoFiType1C.cc, a different vulnerability than CVE-2022-38928. |
CVE-2022-41842 | Medium | 5.5 | 2022-09-30 | An issue was discovered in Xpdf 4.04. There is a crash in gfseek(_IO_FILE*, long, int) in goo/gfile.cc. |
CVE-2022-41841 | Medium | 5.5 | 2022-09-30 | An issue was discovered in Bento4 through 1.6.0-639. A NULL pointer dereference occurs in AP4_File::ParseStream in Core/Ap4File.cpp, which is called from AP4_F… |
CVE-2022-24373 | Medium | 5.3 | 2022-09-30 | The package react-native-reanimated before 3.0.0-rc.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper usage of regular expressio… |
CVE-2022-21222 | Medium | 5.3 | 2022-09-30 | The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of insecure regular expression in the re_attr… |
CVE-2022-2778 | Critical | 9.8 | 2022-09-30 | In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes. |
CVE-2022-41828 | High | 8.1 | 2022-09-29 | In Amazon AWS Redshift JDBC Driver (aka amazon-redshift-jdbc-driver or redshift-jdbc42) before 2.1.0.8, the Object Factory does not check the class type when i… |
CVE-2022-3364 | High | 7.5 | 2022-09-29 | Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3. |
CVE-2022-39232 | Medium | 6.5 | 2022-09-29 | Discourse is an open source discussion platform. Starting with version 2.9.0.beta5 and prior to version 2.9.0.beta10, an incomplete quote can generate a JavaSc… |
CVE-2022-40472 | High | 8.0 | 2022-09-29 | ZKTeco Xiamen Information Technology ZKBio Time 8.0.7 Build: 20220721.14829 was discovered to contain a CSV injection vulnerability. This vulnerability allows… |
CVE-2022-39226 | Medium | 4.3 | 2022-09-29 | Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` b… |
CVE-2022-36068 | High | 7.2 | 2022-09-29 | Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` b… |
CVE-2022-36066 | Critical | 9.1 | 2022-09-29 | Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` b… |
CVE-2022-35137 | Medium | 5.4 | 2022-09-29 | DGIOT Lightweight industrial IoT v4.5.4 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities. |
CVE-2022-33880 | Critical | 9.8 | 2022-09-29 | hms-staff.php in Projectworlds Hospital Management System Mini-Project through 2018-06-17 allows SQL injection via the type parameter. |
CVE-2022-39266 | Critical | 9.6 | 2022-09-29 | isolated-vm is a library for nodejs which gives the user access to v8's Isolate interface. In versions 4.3.6 and prior, if the untrusted v8 cached data is pass… |
CVE-2022-40887 | Critical | 9.8 | 2022-09-29 | SourceCodester Best Student Result Management System 1.0 is vulnerable to SQL Injection. |
CVE-2022-40879 | Medium | 6.1 | 2022-09-29 | kkFileView v4.1.0 is vulnerable to Cross Site Scripting (XSS) via the parameter 'errorMsg.' |
CVE-2022-29503 | Critical | 9.8 | 2022-09-29 | A memory corruption vulnerability exists in the libpthread linuxthreads functionality of uClibC 0.9.33.2 and uClibC-ng 1.0.40. Thread allocation can lead to me… |
CVE-2022-40931 | Medium | 6.1 | 2022-09-29 | dutchcoders Transfer.sh 1.4.0 is vulnerable to Cross Site Scripting (XSS). |
CVE-2022-39168 | High | 7.5 | 2022-09-29 | IBM Robotic Process Automation Clients are vulnerable to proxy credentials being exposed in upgrade logs. IBM X-Force ID: 235422. |
CVE-2022-39254 | High | 8.6 | 2022-09-29 | matrix-nio is a Python Matrix client library, designed according to sans I/O principles. Prior to version 0.20, when a users requests a room key from their dev… |
CVE-2022-39252 | High | 8.6 | 2022-09-29 | matrix-rust-sdk is an implementation of a Matrix client-server library in Rust, and matrix-sdk-crypto is the Matrix encryption library. Prior to version 0.6, w… |
CVE-2022-38732 | High | 7.5 | 2022-09-29 | SnapCenter versions prior to 4.7 shipped without Content Security Policy (CSP) implemented which could allow certain types of attacks that otherwise would be p… |
CVE-2022-40408 | Medium | 5.4 | 2022-09-29 | FeehiCMS v2.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted payload injected into the Comment box under the Single Page… |
CVE-2022-40407 | High | 8.8 | 2022-09-29 | A zip slip vulnerability in the file upload function of Chamilo v1.11 allows attackers to execute arbitrary code via a crafted Zip file. |
CVE-2022-40890 | High | 7.5 | 2022-09-29 | A vulnerability in /src/amf/amf-context.c in Open5GS 2.4.10 and earlier leads to AMF denial of service. |
CVE-2022-40363 | Medium | 5.5 | 2022-09-29 | A buffer overflow in the component nfc_device_load_mifare_ul_data of Flipper Devices Inc., Flipper Zero before v0.65.2 allows attackers to cause a Denial of Se… |
CVE-2022-39250 | High | 8.6 | 2022-09-29 | Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malici… |
CVE-2022-40475 | Critical | 9.8 | 2022-09-29 | TOTOLINK A860R V4.1.2cu.5182_B20201027 was discovered to contain a command injection via the component /cgi-bin/downloadFile.cgi. |
CVE-2022-40126 | High | 7.8 | 2022-09-29 | A misconfiguration in the Service Mode profile directory of Clash for Windows v0.19.9 allows attackers to escalate privileges and execute arbitrary commands wh… |
CVE-2022-3352 | High | 7.8 | 2022-09-29 | Use After Free in GitHub repository vim/vim prior to 9.0.0614. |
CVE-2022-3355 | Medium | 5.4 | 2022-09-29 | Cross-site Scripting (XSS) - Stored in GitHub repository inventree/inventree prior to 0.8.3. |
CVE-2022-40279 | High | 7.5 | 2022-09-29 | An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). l2_packet_receive_timeout in wpa_supplicant/src/l2_packet/l2_packet_pcap.c has a miss… |
CVE-2022-40278 | High | 7.5 | 2022-09-29 | An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). createDB in security/provisioning/src/provisioningdatabasemanager.c has a missing sql… |
CVE-2022-38222 | High | 7.8 | 2022-09-29 | There is a use-after-free issue in JBIG2Stream::close() located in JBIG2Stream.cc in Xpdf 4.04. It can be triggered by sending a crafted PDF file to (for examp… |
CVE-2022-1725 | Medium | 5.5 | 2022-09-29 | NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4959. |
CVE-2022-1719 | Medium | 5.4 | 2022-09-29 | Reflected XSS on ticket filter function in GitHub repository polonel/trudesk prior to 1.2.2. This vulnerability is capable of executing a malicious javascript… |
CVE-2022-1718 | High | 7.5 | 2022-09-29 | The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to cause a Denial of Ser… |
CVE-2022-40048 | High | 7.2 | 2022-09-29 | Flatpress v1.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the Upload File function. |
CVE-2022-39173 | High | 7.5 | 2022-09-29 | In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake. This occurs when an attacker supposedly resumes a previous T… |
CVE-2022-35888 | Medium | 6.5 | 2022-09-29 | Ampere Altra and Ampere Altra Max devices through 2022-07-15 allow attacks via Hertzbleed, which is a power side-channel attack that extracts secret informatio… |
CVE-2022-3326 | Medium | 4.3 | 2022-09-29 | Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.9. |
CVE-2022-31629 | Medium | 6.5 | 2022-09-28 | In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's b… |
CVE-2022-31628 | Low | 2.3 | 2022-09-28 | In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop. |
CVE-2022-39264 | High | 8.6 | 2022-09-28 | nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting malicious secrets, which cou… |
CVE-2022-40710 | High | 7.8 | 2022-09-28 | A link following vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows could allow a local attacker to escalate pri… |
CVE-2022-40709 | Low | 3.3 | 2022-09-28 | An Out-of-bounds read vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows could allow a local attacker to disclos… |
CVE-2022-40708 | Low | 3.3 | 2022-09-28 | An Out-of-bounds read vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows could allow a local attacker to disclos… |
CVE-2022-40707 | Low | 3.3 | 2022-09-28 | An Out-of-bounds read vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows could allow a local attacker to disclos… |
CVE-2022-3292 | Medium | 4.6 | 2022-09-28 | Use of Cache Containing Sensitive Information in GitHub repository ikus060/rdiffweb prior to 2.4.8. |
CVE-2022-39263 | Medium | 6.8 | 2022-09-28 | `@next-auth/upstash-redis-adapter` is the Upstash Redis adapter for NextAuth.js, which provides authentication for Next.js. Applications that use `next-auth` E… |
CVE-2022-39257 | High | 7.5 | 2022-09-28 | Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a malicious homeserver can co… |
CVE-2022-39255 | High | 8.6 | 2022-09-28 | Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a malicious homeserver can co… |
CVE-2022-34424 | High | 7.5 | 2022-09-28 | Networking OS10, versions 10.5.1.x, 10.5.2.x, and 10.5.3.x contain a vulnerability that could allow an attacker to cause a system crash by running particular s… |
CVE-2022-34394 | Low | 3.7 | 2022-09-28 | Dell OS10, version 10.5.3.4, contains an Improper Certificate Validation vulnerability in Support Assist. A remote unauthenticated attacker could potentially e… |
CVE-2022-29089 | Medium | 6.4 | 2022-09-28 | Dell Networking OS10, versions prior to October 2021 with Smart Fabric Services enabled, contains an information disclosure vulnerability. A remote, unauthenti… |
CVE-2022-3287 | Medium | 6.5 | 2022-09-28 | When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction… |
CVE-2022-3215 | High | 7.5 | 2022-09-28 | NIOHTTP1 and projects using it for generating HTTP responses can be subject to a HTTP Response Injection attack. This occurs when a HTTP/1.1 server accepts use… |
CVE-2022-39251 | High | 8.6 | 2022-09-28 | Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construc… |
CVE-2022-39249 | High | 7.5 | 2022-09-28 | Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construc… |
CVE-2022-39248 | High | 8.6 | 2022-09-28 | matrix-android-sdk2 is the Matrix SDK for Android. Prior to version 1.5.1, an attacker cooperating with a malicious homeserver can construct messages that legi… |
CVE-2022-39246 | High | 7.5 | 2022-09-28 | matrix-android-sdk2 is the Matrix SDK for Android. Prior to version 1.5.1, an attacker cooperating with a malicious homeserver can construct messages appearing… |
CVE-2022-36781 | Medium | 5.3 | 2022-09-28 | ConnectWise ScreenConnect versions 22.6 and below contained a flaw allowing potential brute force attacks on custom access tokens due to inadequate rate-limiti… |
CVE-2022-23716 | Medium | 5.3 | 2022-09-28 | A flaw was discovered in ECE before 3.1.1 that could lead to the disclosure of the SAML signing private key used for the RBAC features, in deployment logs in t… |
CVE-2022-1270 | High | 7.8 | 2022-09-28 | In GraphicsMagick, a heap buffer overflow was found when parsing MIFF. |
CVE-2022-3193 | Medium | 6.1 | 2022-09-28 | An HTML injection/reflected Cross-site scripting (XSS) vulnerability was found in the ovirt-engine. A parameter "error_description" fails to sanitize the entry… |
CVE-2022-40929 | Critical | 9.8 | 2022-09-28 | XXL-JOB 2.2.0 has a Command execution vulnerability in background tasks. NOTE: this is disputed because the issues/4929 report is about an intended and support… |
CVE-2022-39236 | Medium | 4.3 | 2022-09-28 | Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Starting with version 17.1.0-rc.1, improperly formed beacon events can disrupt or impede… |
CVE-2022-38934 | Low | 3.3 | 2022-09-28 | readelf in ToaruOS 2.0.1 has some arbitrary address read vulnerabilities when parsing a crafted ELF file. |
CVE-2022-3354 | Low | 3.5 | 2022-09-28 | A vulnerability has been found in Open5GS up to 2.4.10 and classified as problematic. This vulnerability affects unknown code in the library lib/core/ogs-tlv-m… |
CVE-2022-36771 | Medium | 6.5 | 2022-09-28 | IBM QRadar User Behavior Analytics could allow an authenticated user to obtain sensitive information from that they should not have access to. IBM X-Force ID… |
CVE-2022-36448 | High | 8.2 | 2022-09-28 | An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. There is an SMM memory corruption vulnerability in the Software SMI handler in the Pnp… |
CVE-2022-35722 | Medium | 5.4 | 2022-09-28 | IBM Jazz for Service Management is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2022-35282 | Medium | 6.5 | 2022-09-28 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, an attacke… |
CVE-2022-22387 | Medium | 5.4 | 2022-09-28 | IBM Application Gateway is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering t… |
CVE-2022-40942 | Critical | 9.8 | 2022-09-28 | Tenda TX3 US_TX3V1.0br_V16.03.13.11 is vulnerable to stack overflow via compare_parentcontrol_time. |
CVE-2022-40912 | Medium | 6.1 | 2022-09-28 | ETAP Lighting International NV ETAP Safety Manager 1.0.0.32 is vulnerable to Cross Site Scripting (XSS). Input passed to the GET parameter 'action' is not prop… |
CVE-2022-40083 | Critical | 9.6 | 2022-09-28 | Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by attacker… |
CVE-2022-40082 | High | 7.5 | 2022-09-28 | Hertz v0.3.0 ws discovered to contain a path traversal vulnerability via the normalizePath function. |
CVE-2022-39261 | High | 7.5 | 2022-09-28 | Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader lo… |
CVE-2022-28816 | Medium | 6.1 | 2022-09-28 | In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 the Sentilo Proxy is prone to reflected XSS which only affects the Sentil… |