2022 CVEs (page 126)
Page 126 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-20844 | Medium | 5.3 | 2022-09-30 | A vulnerability in authentication mechanism of Cisco Software-Defined Application Visibility and Control (SD-AVC) on Cisco vManage could allow an unauthenticat… |
CVE-2022-20818 | High | 7.8 | 2022-09-30 | Multiple vulnerabilities in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. These vulnerabilities ar… |
CVE-2022-20810 | Medium | 6.5 | 2022-09-30 | A vulnerability in the Simple Network Management Protocol (SNMP) of Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family could allow an authe… |
CVE-2022-20775 | High | 7.8 | 2022-09-30 | A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. This vulnerability is due to i… |
CVE-2022-20769 | High | 7.4 | 2022-09-30 | A vulnerability in the authentication functionality of Cisco Wireless LAN Controller (WLC) AireOS Software could allow an unauthenticated, adjacent attacker to… |
CVE-2022-20728 | Medium | 4.7 | 2022-09-30 | A vulnerability in the client forwarding code of multiple Cisco Access Points (APs) could allow an unauthenticated, adjacent attacker to inject packets from th… |
CVE-2022-20662 | Medium | 6.1 | 2022-09-30 | A vulnerability in the smart card login authentication of Cisco Duo for macOS could allow an unauthenticated attacker with physical access to bypass authentica… |
CVE-2022-41975 | High | 7.8 | 2022-09-30 | RealVNC VNC Server before 6.11.0 and VNC Viewer before 6.22.826 on Windows allow local privilege escalation via MSI installer Repair mode. |
CVE-2022-41870 | High | 7.2 | 2022-09-30 | AP Manager in Innovaphone before 13r2 Service Release 17 allows command injection via a modified service ID during app upload. |
CVE-2022-40944 | Critical | 9.8 | 2022-09-30 | Dairy Farm Shop Management System 1.0 is vulnerable to SQL Injection via sales-report-ds.php file. |
CVE-2022-40316 | Medium | 4.3 | 2022-09-30 | The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers about attempts/users… |
CVE-2022-40315 | Critical | 9.8 | 2022-09-30 | A limited SQL injection risk was identified in the "browse list of users" site administration page. |
CVE-2022-40314 | Critical | 9.8 | 2022-09-30 | A remote code execution risk when restoring backup files originating from Moodle 1.9 was identified. |
CVE-2022-40313 | High | 7.1 | 2022-09-30 | Recursive rendering of Mustache template helpers containing user input could, in some cases, result in an XSS risk or a page failing to load. |
CVE-2022-40277 | High | 7.8 | 2022-09-30 | Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Jopli… |
CVE-2022-40274 | High | 7.8 | 2022-09-30 | Gridea version 0.9.3 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Gridea… |
CVE-2022-36965 | Medium | 6.1 | 2022-09-30 | Insufficient sanitization of inputs in QoE application input field could lead to stored and Dom based XSS attack. This issue is fixed and released in SolarWind… |
CVE-2022-36961 | High | 8.8 | 2022-09-30 | A vulnerable component of Orion Platform was vulnerable to SQL Injection, an authenticated attacker could leverage this for privilege escalation or remote code… |
CVE-2022-32540 | Medium | 5.9 | 2022-09-30 | Information Disclosure in Operator Client application in BVMS 10.1.1, 11.0 and 11.1.0 and VIDEOJET Decoder VJD-7513 versions 10.23 and 10.30 allows man-in-the-… |
CVE-2022-28851 | Medium | 5.4 | 2022-09-30 | Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convinc… |
CVE-2022-21826 | Medium | 5.4 | 2022-09-30 | Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the req… |
CVE-2022-1959 | Medium | 6.6 | 2022-09-30 | AppLock version 7.9.29 allows an attacker with physical access to the device to bypass biometric authentication. This is possible because the application did n… |
CVE-2022-41440 | High | 7.2 | 2022-09-30 | Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinventory/editcategory.php. |
CVE-2022-41439 | High | 7.2 | 2022-09-30 | Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinventory/edituser.php. |
CVE-2022-41437 | High | 7.2 | 2022-09-30 | Billing System Project v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /php_action/createProduct.php. |
CVE-2022-23726 | Medium | 5.4 | 2022-09-30 | PingCentral versions prior to listed versions expose Spring Boot actuator endpoints that with administrative authentication return large amounts of sensitive e… |
CVE-2022-3371 | High | 7.5 | 2022-09-30 | Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3. |
CVE-2022-37461 | Medium | 6.1 | 2022-09-30 | Multiple cross-site scripting (XSS) vulnerabilities in Canon Medical Vitrea View 7.x before 7.7.6 allow remote attackers to inject arbitrary web script or HTML… |
CVE-2022-2529 | High | 7.5 | 2022-09-30 | sflow decode package does not employ sufficient packet sanitisation which can lead to a denial of service attack. Attackers can craft malformed packets causing… |
CVE-2022-2922 | Medium | 4.9 | 2022-09-30 | Relative Path Traversal in GitHub repository dnnsoftware/dnn.platform prior to 9.11.0. |
CVE-2022-41850 | Medium | 4.7 | 2022-09-30 | roccat_report_event in drivers/hid/hid-roccat.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free in certain situations whe… |
CVE-2022-41849 | Medium | 4.2 | 2022-09-30 | drivers/video/fbdev/smscufx.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically proximate attacker removes… |
CVE-2022-41848 | Medium | 4.2 | 2022-09-30 | drivers/char/pcmcia/synclink_cs.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically proximate attacker remo… |
CVE-2022-41847 | Medium | 5.5 | 2022-09-30 | An issue was discovered in Bento4 1.6.0-639. A memory leak exists in AP4_StdcFileByteStream::Create(AP4_FileByteStream*, char const*, AP4_FileByteStream::Mode… |
CVE-2022-41846 | Medium | 5.5 | 2022-09-30 | An issue was discovered in Bento4 1.6.0-639. There ie excessive memory consumption in the function AP4_DataBuffer::ReallocateBuffer in Core/Ap4DataBuffer.cpp. |
CVE-2022-41845 | Medium | 5.5 | 2022-09-30 | An issue was discovered in Bento4 1.6.0-639. There ie excessive memory consumption in the function AP4_Array<AP4_ElstEntry>::EnsureCapacity in Core/Ap4Array.h. |
CVE-2022-41844 | Medium | 5.5 | 2022-09-30 | An issue was discovered in Xpdf 4.04. There is a crash in XRef::fetch(int, int, Object*, int) in xpdf/XRef.cc, a different vulnerability than CVE-2018-16369 an… |
CVE-2022-41843 | Medium | 5.5 | 2022-09-30 | An issue was discovered in Xpdf 4.04. There is a crash in convertToType0 in fofi/FoFiType1C.cc, a different vulnerability than CVE-2022-38928. |
CVE-2022-41842 | Medium | 5.5 | 2022-09-30 | An issue was discovered in Xpdf 4.04. There is a crash in gfseek(_IO_FILE*, long, int) in goo/gfile.cc. |
CVE-2022-41841 | Medium | 5.5 | 2022-09-30 | An issue was discovered in Bento4 through 1.6.0-639. A NULL pointer dereference occurs in AP4_File::ParseStream in Core/Ap4File.cpp, which is called from AP4_F… |
CVE-2022-24373 | Medium | 5.3 | 2022-09-30 | The package react-native-reanimated before 3.0.0-rc.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper usage of regular expressio… |
CVE-2022-21222 | Medium | 5.3 | 2022-09-30 | The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of insecure regular expression in the re_attr… |
CVE-2022-2778 | Critical | 9.8 | 2022-09-30 | In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes. |
CVE-2022-41828 | High | 8.1 | 2022-09-29 | In Amazon AWS Redshift JDBC Driver (aka amazon-redshift-jdbc-driver or redshift-jdbc42) before 2.1.0.8, the Object Factory does not check the class type when i… |
CVE-2022-3364 | High | 7.5 | 2022-09-29 | Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3. |
CVE-2022-39232 | Medium | 6.5 | 2022-09-29 | Discourse is an open source discussion platform. Starting with version 2.9.0.beta5 and prior to version 2.9.0.beta10, an incomplete quote can generate a JavaSc… |
CVE-2022-40472 | High | 8.0 | 2022-09-29 | ZKTeco Xiamen Information Technology ZKBio Time 8.0.7 Build: 20220721.14829 was discovered to contain a CSV injection vulnerability. This vulnerability allows… |
CVE-2022-39226 | Medium | 4.3 | 2022-09-29 | Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` b… |
CVE-2022-36068 | High | 7.2 | 2022-09-29 | Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` b… |
CVE-2022-36066 | Critical | 9.1 | 2022-09-29 | Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.beta10 on the `beta` and `tests-passed` b… |
CVE-2022-35137 | Medium | 5.4 | 2022-09-29 | DGIOT Lightweight industrial IoT v4.5.4 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities. |
CVE-2022-33880 | Critical | 9.8 | 2022-09-29 | hms-staff.php in Projectworlds Hospital Management System Mini-Project through 2018-06-17 allows SQL injection via the type parameter. |
CVE-2022-39266 | Critical | 9.6 | 2022-09-29 | isolated-vm is a library for nodejs which gives the user access to v8's Isolate interface. In versions 4.3.6 and prior, if the untrusted v8 cached data is pass… |
CVE-2022-40887 | Critical | 9.8 | 2022-09-29 | SourceCodester Best Student Result Management System 1.0 is vulnerable to SQL Injection. |
CVE-2022-40879 | Medium | 6.1 | 2022-09-29 | kkFileView v4.1.0 is vulnerable to Cross Site Scripting (XSS) via the parameter 'errorMsg.' |
CVE-2022-29503 | Critical | 9.8 | 2022-09-29 | A memory corruption vulnerability exists in the libpthread linuxthreads functionality of uClibC 0.9.33.2 and uClibC-ng 1.0.40. Thread allocation can lead to me… |
CVE-2022-40931 | Medium | 6.1 | 2022-09-29 | dutchcoders Transfer.sh 1.4.0 is vulnerable to Cross Site Scripting (XSS). |
CVE-2022-39168 | High | 7.5 | 2022-09-29 | IBM Robotic Process Automation Clients are vulnerable to proxy credentials being exposed in upgrade logs. IBM X-Force ID: 235422. |
CVE-2022-39254 | High | 8.6 | 2022-09-29 | matrix-nio is a Python Matrix client library, designed according to sans I/O principles. Prior to version 0.20, when a users requests a room key from their dev… |
CVE-2022-39252 | High | 8.6 | 2022-09-29 | matrix-rust-sdk is an implementation of a Matrix client-server library in Rust, and matrix-sdk-crypto is the Matrix encryption library. Prior to version 0.6, w… |
CVE-2022-38732 | High | 7.5 | 2022-09-29 | SnapCenter versions prior to 4.7 shipped without Content Security Policy (CSP) implemented which could allow certain types of attacks that otherwise would be p… |
CVE-2022-40408 | Medium | 5.4 | 2022-09-29 | FeehiCMS v2.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted payload injected into the Comment box under the Single Page… |
CVE-2022-40407 | High | 8.8 | 2022-09-29 | A zip slip vulnerability in the file upload function of Chamilo v1.11 allows attackers to execute arbitrary code via a crafted Zip file. |
CVE-2022-40890 | High | 7.5 | 2022-09-29 | A vulnerability in /src/amf/amf-context.c in Open5GS 2.4.10 and earlier leads to AMF denial of service. |
CVE-2022-40363 | Medium | 5.5 | 2022-09-29 | A buffer overflow in the component nfc_device_load_mifare_ul_data of Flipper Devices Inc., Flipper Zero before v0.65.2 allows attackers to cause a Denial of Se… |
CVE-2022-39250 | High | 8.6 | 2022-09-29 | Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malici… |
CVE-2022-40475 | Critical | 9.8 | 2022-09-29 | TOTOLINK A860R V4.1.2cu.5182_B20201027 was discovered to contain a command injection via the component /cgi-bin/downloadFile.cgi. |
CVE-2022-40126 | High | 7.8 | 2022-09-29 | A misconfiguration in the Service Mode profile directory of Clash for Windows v0.19.9 allows attackers to escalate privileges and execute arbitrary commands wh… |
CVE-2022-3352 | High | 7.8 | 2022-09-29 | Use After Free in GitHub repository vim/vim prior to 9.0.0614. |
CVE-2022-3355 | Medium | 5.4 | 2022-09-29 | Cross-site Scripting (XSS) - Stored in GitHub repository inventree/inventree prior to 0.8.3. |
CVE-2022-40279 | High | 7.5 | 2022-09-29 | An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). l2_packet_receive_timeout in wpa_supplicant/src/l2_packet/l2_packet_pcap.c has a miss… |
CVE-2022-40278 | High | 7.5 | 2022-09-29 | An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). createDB in security/provisioning/src/provisioningdatabasemanager.c has a missing sql… |
CVE-2022-38222 | High | 7.8 | 2022-09-29 | There is a use-after-free issue in JBIG2Stream::close() located in JBIG2Stream.cc in Xpdf 4.04. It can be triggered by sending a crafted PDF file to (for examp… |
CVE-2022-1725 | Medium | 5.5 | 2022-09-29 | NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4959. |
CVE-2022-1719 | Medium | 5.4 | 2022-09-29 | Reflected XSS on ticket filter function in GitHub repository polonel/trudesk prior to 1.2.2. This vulnerability is capable of executing a malicious javascript… |
CVE-2022-1718 | High | 7.5 | 2022-09-29 | The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to cause a Denial of Ser… |
CVE-2022-40048 | High | 7.2 | 2022-09-29 | Flatpress v1.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the Upload File function. |
CVE-2022-39173 | High | 7.5 | 2022-09-29 | In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake. This occurs when an attacker supposedly resumes a previous T… |
CVE-2022-35888 | Medium | 6.5 | 2022-09-29 | Ampere Altra and Ampere Altra Max devices through 2022-07-15 allow attacks via Hertzbleed, which is a power side-channel attack that extracts secret informatio… |
CVE-2022-3326 | Medium | 4.3 | 2022-09-29 | Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.9. |
CVE-2022-31629 | Medium | 6.5 | 2022-09-28 | In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's b… |
CVE-2022-31628 | Low | 2.3 | 2022-09-28 | In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop. |
CVE-2022-39264 | High | 8.6 | 2022-09-28 | nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting malicious secrets, which cou… |
CVE-2022-40710 | High | 7.8 | 2022-09-28 | A link following vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows could allow a local attacker to escalate pri… |
CVE-2022-40709 | Low | 3.3 | 2022-09-28 | An Out-of-bounds read vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows could allow a local attacker to disclos… |
CVE-2022-40708 | Low | 3.3 | 2022-09-28 | An Out-of-bounds read vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows could allow a local attacker to disclos… |
CVE-2022-40707 | Low | 3.3 | 2022-09-28 | An Out-of-bounds read vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows could allow a local attacker to disclos… |
CVE-2022-3292 | Medium | 4.6 | 2022-09-28 | Use of Cache Containing Sensitive Information in GitHub repository ikus060/rdiffweb prior to 2.4.8. |
CVE-2022-39263 | Medium | 6.8 | 2022-09-28 | `@next-auth/upstash-redis-adapter` is the Upstash Redis adapter for NextAuth.js, which provides authentication for Next.js. Applications that use `next-auth` E… |
CVE-2022-39257 | High | 7.5 | 2022-09-28 | Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a malicious homeserver can co… |
CVE-2022-39255 | High | 8.6 | 2022-09-28 | Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a malicious homeserver can co… |
CVE-2022-34424 | High | 7.5 | 2022-09-28 | Networking OS10, versions 10.5.1.x, 10.5.2.x, and 10.5.3.x contain a vulnerability that could allow an attacker to cause a system crash by running particular s… |
CVE-2022-34394 | Low | 3.7 | 2022-09-28 | Dell OS10, version 10.5.3.4, contains an Improper Certificate Validation vulnerability in Support Assist. A remote unauthenticated attacker could potentially e… |
CVE-2022-29089 | Medium | 6.4 | 2022-09-28 | Dell Networking OS10, versions prior to October 2021 with Smart Fabric Services enabled, contains an information disclosure vulnerability. A remote, unauthenti… |
CVE-2022-3287 | Medium | 6.5 | 2022-09-28 | When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction… |
CVE-2022-3215 | High | 7.5 | 2022-09-28 | NIOHTTP1 and projects using it for generating HTTP responses can be subject to a HTTP Response Injection attack. This occurs when a HTTP/1.1 server accepts use… |
CVE-2022-39251 | High | 8.6 | 2022-09-28 | Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construc… |
CVE-2022-39249 | High | 7.5 | 2022-09-28 | Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construc… |
CVE-2022-39248 | High | 8.6 | 2022-09-28 | matrix-android-sdk2 is the Matrix SDK for Android. Prior to version 1.5.1, an attacker cooperating with a malicious homeserver can construct messages that legi… |
CVE-2022-39246 | High | 7.5 | 2022-09-28 | matrix-android-sdk2 is the Matrix SDK for Android. Prior to version 1.5.1, an attacker cooperating with a malicious homeserver can construct messages appearing… |