2022 CVEs (page 131)
Page 131 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-35022 | Medium | 6.5 | 2022-09-22 | OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x6badae. |
CVE-2022-35021 | Medium | 6.5 | 2022-09-22 | OTFCC commit 617837b was discovered to contain a global buffer overflow via /release-x64/otfccdump+0x718693. |
CVE-2022-40932 | High | 7.2 | 2022-09-22 | In Zoo Management System v1.0, there is an arbitrary file upload vulnerability in the picture upload point of the "gallery" file of the "Gallery" module in the… |
CVE-2022-35408 | High | 8.2 | 2022-09-22 | An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An SMM callout vulnerability in the SMM driver in UsbLegacyControlSmm leads to possibl… |
CVE-2022-40146 | High | 7.5 | 2022-09-22 | Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache… |
CVE-2022-38648 | Medium | 5.3 | 2022-09-22 | Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML… |
CVE-2022-38398 | Medium | 5.3 | 2022-09-22 | Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. This issue affects Apa… |
CVE-2022-1941 | High | 7.5 | 2022-09-22 | A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for pr… |
CVE-2022-40447 | High | 7.2 | 2022-09-22 | ZZCMS 2022 was discovered to contain a SQL injection vulnerability via the keyword parameter at /admin/baojia_list.php. |
CVE-2022-40446 | High | 7.2 | 2022-09-22 | ZZCMS 2022 was discovered to contain a SQL injection vulnerability via the component /admin/sendmailto.php?tomail=&groupid=. |
CVE-2022-40444 | Medium | 5.3 | 2022-09-22 | ZZCMS 2022 was discovered to contain a full path disclosure vulnerability via the page /admin/index.PHP? _server. |
CVE-2022-40443 | Medium | 5.3 | 2022-09-22 | An absolute path traversal vulnerability in ZZCMS 2022 allows attackers to obtain sensitive information via a crafted GET request sent to /one/siteinfo.php. |
CVE-2022-3256 | High | 7.8 | 2022-09-22 | Use After Free in GitHub repository vim/vim prior to 9.0.0530. |
CVE-2022-3268 | Critical | 9.8 | 2022-09-22 | Weak Password Requirements in GitHub repository ikus060/minarca prior to 4.2.2. |
CVE-2022-3267 | Medium | 4.3 | 2022-09-22 | Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.6. |
CVE-2022-40705 | High | 7.5 | 2022-09-22 | An Improper Restriction of XML External Entity Reference vulnerability in RPCRouterServlet of Apache SOAP allows an attacker to read arbitrary files over HTTP… |
CVE-2022-2266 | Medium | 6.1 | 2022-09-22 | University Library Automation System developed by Yordam Bilgi Teknolojileri before version 19.2 has an unauthenticated Reflected XSS vulnerability. This has b… |
CVE-2022-40186 | Critical | 9.1 | 2022-09-22 | An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3. A vulnerability in the Identity Engine was found where, in a deployment where an… |
CVE-2022-39197 | Medium | 6.1 | 2022-09-22 | An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Str… |
CVE-2022-38512 | Medium | 6.5 | 2022-09-22 | The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not check permissions before allowing a user… |
CVE-2022-28981 | High | 7.5 | 2022-09-22 | Path traversal vulnerability in the Hypermedia REST APIs module in Liferay Portal 7.4.0 through 7.4.2 allows remote attackers to access files outside of com.li… |
CVE-2022-28980 | Medium | 6.1 | 2022-09-22 | Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal v7.4.3.4 and Liferay DXP v7.4 GA allows attackers to execute arbitrary web scripts or HTM… |
CVE-2022-28977 | Medium | 6.1 | 2022-09-22 | HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through… |
CVE-2022-39975 | Medium | 4.3 | 2022-09-22 | The Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update 10, and 7.4 before update 35 does not check user permission bef… |
CVE-2022-35896 | Medium | 6.0 | 2022-09-22 | An issue SMM memory leak vulnerability in SMM driver (SMRAM was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An attacker can dump SMRAM contents… |
CVE-2022-28982 | Medium | 6.1 | 2022-09-22 | A cross-site scripting (XSS) vulnerability in Liferay Portal v7.3.3 through v7.4.2 and Liferay DXP v7.3 before service pack 3 allows attackers to execute arbit… |
CVE-2022-28979 | Medium | 6.1 | 2022-09-22 | Liferay Portal v7.1.0 through v7.4.2 and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was discovered to contain a… |
CVE-2022-28978 | Medium | 5.4 | 2022-09-22 | Stored cross-site scripting (XSS) vulnerability in the Site module's user membership administration page in Liferay Portal 7.0.1 through 7.4.1, and Liferay DXP… |
CVE-2022-39224 | High | 7.0 | 2022-09-21 | Arr-pm is an RPM reader/writer library written in Ruby. Versions prior to 0.0.12 are subject to OS command injection resulting in shell execution if the RPM co… |
CVE-2022-35895 | High | 8.2 | 2022-09-21 | An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. The FwBlockSericceSmm driver does not properly validate input parameters for a softwar… |
CVE-2022-40217 | Medium | 6.5 | 2022-09-21 | Authenticated (admin+) Arbitrary File Edit/Upload vulnerability in XplodedThemes WPide plugin <= 2.6 at WordPress. |
CVE-2022-3233 | Medium | 4.3 | 2022-09-21 | Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.6. |
CVE-2022-38073 | Medium | 5.4 | 2022-09-21 | Multiple Authenticated (custom specific plugin role) Persistent Cross-Site Scripting (XSS) vulnerability in Awesome Support plugin <= 6.0.7 at WordPress. |
CVE-2022-36390 | Medium | 4.1 | 2022-09-21 | Authenticated (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Totalsoft Event Calendar – Calendar plugin <= 1.4.6 at WordPress. |
CVE-2022-36386 | Critical | 9.1 | 2022-09-21 | Authenticated Arbitrary Code Execution vulnerability in Soflyy Import any XML or CSV File to WordPress plugin <= 3.6.7 at WordPress. |
CVE-2022-36383 | Medium | 5.4 | 2022-09-21 | Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in WHA Word Search Puzzles game plugin <= 2.0.1 at WordPress. |
CVE-2022-36365 | Medium | 5.4 | 2022-09-21 | Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in WHA Crossword plugin <= 1.1.10 at WordPress. |
CVE-2022-28802 | Critical | 9.9 | 2022-09-21 | Code by Zapier before 2022-08-17 allowed intra-account privilege escalation that included execution of Python or JavaScript code. In other words, Code by Zapie… |
CVE-2022-40219 | Medium | 5.4 | 2022-09-21 | Cross-Site Request Forgery (CSRF) vulnerability in SedLex FavIcon Switcher plugin <= 1.2.11 at WordPress allows plugin settings change. |
CVE-2022-3252 | High | 7.5 | 2022-09-21 | Improper detection of complete HTTP body decompression SwiftNIO Extras provides a pair of helpers for transparently decompressing received HTTP request or resp… |
CVE-2022-35621 | Medium | 5.3 | 2022-09-21 | Access control vulnerability in Evoh NFT EvohClaimable contract with sha256 hash code fa2084d5abca91a62ed1d2f1cad3ec318e6a9a2d7f1510a00d898737b05f48ae allows r… |
CVE-2022-29800 | Medium | 4.7 | 2022-09-21 | A time-of-check-time-of-use (TOCTOU) race condition vulnerability was found in networkd-dispatcher. This flaw exists because there is a certain time between th… |
CVE-2022-29799 | Medium | 5.5 | 2022-09-21 | A vulnerability was found in networkd-dispatcher. This flaw exists because no functions are sanitized by the OperationalState or the AdministrativeState of net… |
CVE-2022-23952 | High | 7.5 | 2022-09-21 | In Keylime before 6.3.0, current keylime installer installs the keylime.conf file, which can contain sensitive data, as world-readable. |
CVE-2022-23951 | Medium | 5.5 | 2022-09-21 | In Keylime before 6.3.0, quote responses from the agent can contain possibly untrusted ZIP data which can lead to zip bombs. |
CVE-2022-23950 | High | 7.5 | 2022-09-21 | In Keylime before 6.3.0, Revocation Notifier uses a fixed /tmp path for UNIX domain socket which can allow unprivileged users a method to prohibit keylime oper… |
CVE-2022-23949 | High | 7.5 | 2022-09-21 | In Keylime before 6.3.0, unsanitized UUIDs can be passed by a rogue agent and can lead to log spoofing on the verifier and registrar. |
CVE-2022-23948 | High | 7.5 | 2022-09-21 | A flaw was found in Keylime before 6.3.0. The logic in the Keylime agent for checking for a secure mount can be fooled by previously created unprivileged mount… |
CVE-2022-40030 | Critical | 9.8 | 2022-09-21 | SourceCodester Simple Task Managing System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at changeStatus.php. |
CVE-2022-40029 | Medium | 4.8 | 2022-09-21 | SourceCodester Simple Task Managing System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component newProjectValidation.php… |
CVE-2022-40028 | Medium | 4.8 | 2022-09-21 | SourceCodester Simple Task Managing System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component newProjectValidation.php… |
CVE-2022-40027 | Medium | 6.1 | 2022-09-21 | SourceCodester Simple Task Managing System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component newTask.php. This vulner… |
CVE-2022-40026 | High | 7.2 | 2022-09-21 | SourceCodester Simple Task Managing System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at board.php. |
CVE-2022-31679 | Low | 3.7 | 2022-09-21 | Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.5.5, 3.7.0 - 3.7.2, and older unsupported versions, if… |
CVE-2022-30578 | High | 8.0 | 2022-09-21 | The Web Server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an easily exploitable vulnerability that allows a low privileged attacker with net… |
CVE-2022-30577 | High | 8.0 | 2022-09-21 | The Web Server component of TIBCO Software Inc.'s TIBCO EBX contains an easily exploitable vulnerability that allows a low privileged attacker with network acc… |
CVE-2022-40616 | High | 8.1 | 2022-09-21 | IBM Maximo Asset Management 7.6.1.1, 7.6.1.2, and 7.6.1.3 could allow a user to bypass authentication and obtain sensitive information or perform tasks they sh… |
CVE-2022-3251 | Medium | 5.3 | 2022-09-21 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/minarca prior to 4.2.2. |
CVE-2022-3250 | Medium | 5.3 | 2022-09-21 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.6. |
CVE-2022-37027 | High | 7.2 | 2022-09-21 | Ahsay AhsayCBS 9.1.4.0 allows an authenticated system user to inject arbitrary Java JVM options. Administrators that can modify the Runtime Options in the web… |
CVE-2022-41255 | Medium | 6.5 | 2022-09-21 | Jenkins CONS3RT Plugin 1.0.0 and earlier stores Cons3rt API token unencrypted in job config.xml files on the Jenkins controller where it can be viewed by users… |
CVE-2022-41254 | Medium | 6.5 | 2022-09-21 | Missing permission checks in Jenkins CONS3RT Plugin 1.0.0 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP ser… |
CVE-2022-41253 | High | 8.8 | 2022-09-21 | A cross-site request forgery (CSRF) vulnerability in Jenkins CONS3RT Plugin 1.0.0 and earlier allows attackers to connect to an attacker-specified HTTP server… |
CVE-2022-41252 | Medium | 4.3 | 2022-09-21 | Missing permission checks in Jenkins CONS3RT Plugin 1.0.0 and earlier allows users with Overall/Read permission to enumerate credentials ID of credentials stor… |
CVE-2022-41251 | Medium | 4.3 | 2022-09-21 | A missing permission check in Jenkins Apprenda Plugin 2.2.0 and earlier allows users with Overall/Read permission to enumerate credentials IDs of credentials s… |
CVE-2022-41250 | Medium | 6.5 | 2022-09-21 | A missing permission check in Jenkins SCM HttpClient Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified H… |
CVE-2022-41249 | High | 8.8 | 2022-09-21 | A cross-site request forgery (CSRF) vulnerability in Jenkins SCM HttpClient Plugin 1.5 and earlier allows attackers to connect to an attacker-specified HTTP se… |
CVE-2022-41248 | Medium | 5.3 | 2022-09-21 | Jenkins BigPanda Notifier Plugin 1.4.0 and earlier does not mask the BigPanda API key on the global configuration form, increasing the potential for attackers… |
CVE-2022-41247 | Medium | 4.3 | 2022-09-21 | Jenkins BigPanda Notifier Plugin 1.4.0 and earlier stores the BigPanda API key unencrypted in its global configuration file on the Jenkins controller where the… |
CVE-2022-41246 | Medium | 6.5 | 2022-09-21 | A missing permission check in Jenkins Worksoft Execution Manager Plugin 10.0.3.503 and earlier allows attackers with Overall/Read permission to connect to an a… |
CVE-2022-41245 | High | 8.8 | 2022-09-21 | A cross-site request forgery (CSRF) vulnerability in Jenkins Worksoft Execution Manager Plugin 10.0.3.503 and earlier allows attackers to connect to an attacke… |
CVE-2022-41244 | High | 8.1 | 2022-09-21 | Jenkins View26 Test-Reporting Plugin 1.0.7 and earlier does not perform hostname validation when connecting to the configured View26 server that could be abuse… |
CVE-2022-41243 | High | 8.1 | 2022-09-21 | Jenkins SmallTest Plugin 1.0.4 and earlier does not perform hostname validation when connecting to the configured View26 server that could be abused using a ma… |
CVE-2022-41242 | Medium | 5.4 | 2022-09-21 | A missing permission check in Jenkins extreme-feedback Plugin 1.7 and earlier allows attackers with Overall/Read permission to discover information about job n… |
CVE-2022-41241 | Critical | 9.1 | 2022-09-21 | Jenkins RQM Plugin 2.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-41240 | Medium | 5.4 | 2022-09-21 | Jenkins Walti Plugin 1.0.1 and earlier does not escape the information provided by the Walti API, resulting in a stored cross-site scripting (XSS) vulnerabilit… |
CVE-2022-41239 | Medium | 5.4 | 2022-09-21 | Jenkins DotCi Plugin 2.40.00 and earlier does not escape the GitHub user name parameter provided to commit notifications when displaying them in a build cause… |
CVE-2022-41238 | Critical | 9.8 | 2022-09-21 | A missing permission check in Jenkins DotCi Plugin 2.40.00 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker… |
CVE-2022-41237 | Critical | 9.8 | 2022-09-21 | Jenkins DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code executi… |
CVE-2022-41236 | High | 8.8 | 2022-09-21 | A cross-site request forgery (CSRF) vulnerability in Jenkins Security Inspector Plugin 117.v6eecc36919c2 and earlier allows attackers to replace the generated… |
CVE-2022-41235 | Medium | 5.3 | 2022-09-21 | Jenkins WildFly Deployer Plugin 1.0.2 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file s… |
CVE-2022-41234 | High | 8.8 | 2022-09-21 | Jenkins Rundeck Plugin 3.6.11 and earlier does not protect access to the /plugin/rundeck/webhook/ endpoint, allowing users with Overall/Read permission to trig… |
CVE-2022-41233 | Medium | 4.3 | 2022-09-21 | Jenkins Rundeck Plugin 3.6.11 and earlier does not perform Run/Artifacts permission checks in multiple HTTP endpoints, allowing attackers with Item/Read permis… |
CVE-2022-41232 | High | 8.0 | 2022-09-21 | A cross-site request forgery (CSRF) vulnerability in Jenkins Build-Publisher Plugin 1.22 and earlier allows attackers to replace any config.xml file on the Jen… |
CVE-2022-41231 | Medium | 5.7 | 2022-09-21 | Jenkins Build-Publisher Plugin 1.22 and earlier allows attackers with Item/Configure permission to create or replace any config.xml file on the Jenkins control… |
CVE-2022-41230 | Medium | 4.3 | 2022-09-21 | Jenkins Build-Publisher Plugin 1.22 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to obt… |
CVE-2022-41229 | Medium | 5.4 | 2022-09-21 | Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.134 and earlier does not escape configuration options of the Execute NetStorm/NetCloud Test build… |
CVE-2022-41228 | High | 8.8 | 2022-09-21 | A missing permission check in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attackers with Overall/Read permissions to co… |
CVE-2022-41227 | High | 8.8 | 2022-09-21 | A cross-site request forgery (CSRF) vulnerability in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attackers to connect t… |
CVE-2022-41226 | Critical | 9.8 | 2022-09-21 | Jenkins Compuware Common Configuration Plugin 1.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-41225 | Medium | 5.4 | 2022-09-21 | Jenkins Anchore Container Image Scanner Plugin 1.0.24 and earlier does not escape content provided by the Anchore engine API, resulting in a stored cross-site… |
CVE-2022-41224 | Medium | 5.4 | 2022-09-21 | Jenkins 2.367 through 2.369 (both inclusive) does not escape tooltips of the l:helpIcon UI component used for some help icons on the Jenkins web UI, resulting… |
CVE-2022-37246 | Medium | 5.4 | 2022-09-21 | Craft CMS 4.2.0.1 is affected by Cross Site Scripting (XSS) in the file src/web/assets/cp/src/js/BaseElementSelectInput.js and in specific on the line label: e… |
CVE-2022-37026 | Critical | 9.8 | 2022-09-21 | In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situation… |
CVE-2022-2265 | High | 7.5 | 2022-09-21 | The Identity and Directory Management System developed by Çekino Bilgi Teknolojileri before version 2.1.25 has an unauthenticated Path traversal vulnerability… |
CVE-2022-3255 | Medium | 4.8 | 2022-09-21 | If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the att… |
CVE-2022-38928 | High | 7.8 | 2022-09-21 | XPDF 4.04 is vulnerable to Null Pointer Dereference in FoFiType1C.cc:2393. |
CVE-2022-3068 | High | 8.8 | 2022-09-21 | Improper Privilege Management in GitHub repository octoprint/octoprint prior to 1.8.3. |
CVE-2022-2888 | Medium | 4.4 | 2022-09-21 | If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as lon… |
CVE-2022-3080 | High | 7.5 | 2022-09-21 | By sending specific queries to the resolver, an attacker can cause named to crash. |