2022 CVEs (page 132)
Page 132 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-38178 | High | 7.5 | 2022-09-21 | By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually… |
CVE-2022-38177 | High | 7.5 | 2022-09-21 | By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually… |
CVE-2022-2906 | High | 7.5 | 2022-09-21 | An attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would… |
CVE-2022-2881 | Medium | 5.5 | 2022-09-21 | The underlying bug might cause read past end of the buffer and either read memory it should not read, or crash the process. |
CVE-2022-2795 | Medium | 5.3 | 2022-09-21 | By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitima… |
CVE-2022-2872 | Medium | 5.4 | 2022-09-21 | Unrestricted Upload of File with Dangerous Type in GitHub repository octoprint/octoprint prior to 1.8.3. |
CVE-2022-0495 | Critical | 9.4 | 2022-09-21 | The library automation system product KOHA developed by Parantez Teknoloji before version 19.05.03 has an unauthenticated SQL Injection vulnerability. This has… |
CVE-2022-41222 | High | 7.0 | 2022-09-21 | mm/mremap.c in the Linux kernel before 5.13.3 has a use-after-free via a stale TLB because an rmap lock is not held during a PUD move. |
CVE-2022-40754 | Medium | 6.1 | 2022-09-21 | In Apache Airflow 2.3.0 through 2.3.4, there was an open redirect in the webserver's `/confirm` endpoint. |
CVE-2022-40604 | High | 7.5 | 2022-09-21 | In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction. |
CVE-2022-2315 | Critical | 9.4 | 2022-09-21 | Database Software Accreditation Tracking/Presentation Module product before version 2 has an unauthenticated SQL Injection vulnerability. This is fixed in vers… |
CVE-2022-41220 | Critical | 9.8 | 2022-09-21 | md2roff 1.9 has a stack-based buffer overflow via a Markdown file, a different vulnerability than CVE-2022-34913. NOTE: the vendor's position is that the produ… |
CVE-2022-41218 | Medium | 5.5 | 2022-09-21 | In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused by refcount races, affecting dvb_demux_open and dvb_dm… |
CVE-2022-39221 | High | 7.5 | 2022-09-21 | McWebserver mod runs a simple HTTP server alongside the Minecraft server in seperate threads. Path traversal in McWebserver Minecraft Mod for Fabric and Quilt… |
CVE-2022-38619 | Critical | 9.8 | 2022-09-21 | SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j_id90 parameter at /SVFE2/pages/feegroups/mcc_group.jsf. |
CVE-2022-35090 | Medium | 5.5 | 2022-09-21 | SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via __asan_memcpy at /asan/asan_interceptors_memintrinsics.cpp:. |
CVE-2022-35089 | Medium | 5.5 | 2022-09-21 | SWFTools commit 772e55a2 was discovered to contain a heap-buffer-overflow via getTransparentColor at /home/bupt/Desktop/swftools/src/gif2swf. |
CVE-2022-35088 | Medium | 5.5 | 2022-09-21 | SWFTools commit 772e55a2 was discovered to contain a heap buffer-overflow via getGifDelayTime at /home/bupt/Desktop/swftools/src/src/gif2swf.c. |
CVE-2022-35087 | Medium | 5.5 | 2022-09-21 | SWFTools commit 772e55a2 was discovered to contain a segmentation violation via MovieAddFrame at /src/gif2swf.c. |
CVE-2022-35086 | Medium | 5.5 | 2022-09-21 | SWFTools commit 772e55a2 was discovered to contain a segmentation violation via /multiarch/memmove-vec-unaligned-erms.S. |
CVE-2022-35085 | Medium | 5.5 | 2022-09-21 | SWFTools commit 772e55a2 was discovered to contain a memory leak via /lib/mem.c. |
CVE-2022-35957 | Medium | 6.6 | 2022-09-20 | Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server ad… |
CVE-2022-39220 | Medium | 6.1 | 2022-09-20 | SFTPGo is an SFTP server written in Go. Versions prior to 2.3.5 are subject to Cross-site scripting (XSS) vulnerabilities in the SFTPGo WebClient, allowing rem… |
CVE-2022-40357 | Critical | 9.8 | 2022-09-20 | A security issue was discovered in Z-BlogPHP <= 1.7.2. A Server-Side Request Forgery (SSRF) vulnerability in the zb_users/plugin/UEditor/php/action_crawler.php… |
CVE-2022-32917 | High | 7.8 | 2022-09-20 | The issue was addressed with improved bounds checks. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15.7, iOS 16, macOS Big Sur 11.7. An appli… |
CVE-2022-32912 | High | 8.8 | 2022-09-20 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Safari 16, iOS 16, iOS 15.7 and iPadOS 15.7. Processing maliciously c… |
CVE-2022-32911 | High | 7.8 | 2022-09-20 | The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15.7, iOS 16, macOS Big Sur 11.7. An app… |
CVE-2022-32908 | High | 7.8 | 2022-09-20 | A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15.7, iOS 16, macOS Big… |
CVE-2022-32886 | High | 8.8 | 2022-09-20 | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in Safari 16, iOS 16, iOS 15.7 and iPadOS 15.7. Processing maliciously… |
CVE-2022-32883 | Medium | 5.5 | 2022-09-20 | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15.7, iOS 16, macOS Big Sur 11.7. An ap… |
CVE-2022-32882 | Critical | 9.8 | 2022-09-20 | This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.4, macOS Big Sur 11.6.6. An app may be able to bypass Privacy preferenc… |
CVE-2022-32880 | Medium | 6.5 | 2022-09-20 | This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.5. An app may be able to access user-sensitive data. |
CVE-2022-32872 | Low | 2.4 | 2022-09-20 | A logic issue was addressed with improved restrictions. This issue is fixed in iOS 16, iOS 15.7 and iPadOS 15.7. A person with physical access to an iOS device… |
CVE-2022-32868 | Medium | 4.3 | 2022-09-20 | A logic issue was addressed with improved state management. This issue is fixed in Safari 16, iOS 16, iOS 15.7 and iPadOS 15.7. A website may be able to track… |
CVE-2022-32864 | Medium | 5.5 | 2022-09-20 | The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15.7, iOS 16, macOS Big Sur 11.7. An app… |
CVE-2022-32863 | Critical | 9.8 | 2022-09-20 | A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 15.6, macOS Monterey 12.5. Processing maliciously crafted… |
CVE-2022-32861 | Medium | 5.3 | 2022-09-20 | A logic issue was addressed with improved state management. This issue is fixed in Safari 15.6, macOS Monterey 12.5. A user may be tracked through their IP add… |
CVE-2022-32854 | Medium | 5.5 | 2022-09-20 | This issue was addressed with improved checks. This issue is fixed in iOS 15.7 and iPadOS 15.7, iOS 16, macOS Big Sur 11.7. An app may be able to bypass Privac… |
CVE-2022-32802 | High | 7.8 | 2022-09-20 | A logic issue was addressed with improved checks. This issue is fixed in iOS 15.6 and iPadOS 15.6, tvOS 15.6, macOS Monterey 12.5. Processing a maliciously cra… |
CVE-2022-32795 | Medium | 4.3 | 2022-09-20 | This issue was addressed with improved checks. This issue is fixed in iOS 16, iOS 15.7 and iPadOS 15.7. Visiting a malicious website may lead to address bar sp… |
CVE-2022-32788 | Critical | 9.8 | 2022-09-20 | A buffer overflow was addressed with improved bounds checking. This issue is fixed in watchOS 8.7, tvOS 15.6, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. A… |
CVE-2022-28640 | High | 8.8 | 2022-09-20 | A potential local adjacent arbitrary code execution vulnerability that could potentially lead to a loss of confidentiality, integrity, and availability was dis… |
CVE-2022-28639 | High | 8.8 | 2022-09-20 | A remote potential adjacent denial of service (DoS) and potential adjacent arbitrary code execution vulnerability that could potentially lead to a loss of conf… |
CVE-2022-28638 | High | 7.8 | 2022-09-20 | An isolated local disclosure of information and potential isolated local arbitrary code execution vulnerability that could potentially lead to a loss of confid… |
CVE-2022-28637 | High | 7.8 | 2022-09-20 | A local Denial of Service (DoS) and local arbitrary code execution vulnerability that could potentially lead to a loss of confidentiality, integrity, and avail… |
CVE-2022-26696 | High | 8.8 | 2022-09-20 | This issue was addressed with improved environment sanitization. This issue is fixed in macOS Monterey 12.4. A sandboxed process may be able to circumvent sand… |
CVE-2022-23696 | High | 8.8 | 2022-09-20 | Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks… |
CVE-2022-23695 | High | 8.8 | 2022-09-20 | Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks… |
CVE-2022-23694 | High | 8.8 | 2022-09-20 | Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks… |
CVE-2022-23693 | High | 8.8 | 2022-09-20 | Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks… |
CVE-2022-23692 | High | 8.8 | 2022-09-20 | Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks… |
CVE-2022-23685 | High | 8.8 | 2022-09-20 | A vulnerability in the ClearPass Policy Manager web-based management interface exists which exposes some endpoints to a lack of Cross-Site Request Forgery (CSR… |
CVE-2022-40009 | Critical | 9.8 | 2022-09-20 | SWFTools commit 772e55a was discovered to contain a heap-use-after-free via the function grow_unicode at /lib/ttf.c. |
CVE-2022-40008 | Critical | 9.8 | 2022-09-20 | SWFTools commit 772e55a was discovered to contain a heap-buffer overflow via the function readU8 at /lib/ttf.c. |
CVE-2022-39218 | High | 7.5 | 2022-09-20 | The JS Compute Runtime for Fastly's Compute@Edge platform provides the environment JavaScript is executed in when using the Compute@Edge JavaScript SDK. In ver… |
CVE-2022-38931 | High | 8.8 | 2022-09-20 | A Server-Side Request Forgery (SSRF) in fetch_net_file_upload function of baijiacmsV4 v4.1.4 allows remote attackers to force the application to make arbitrary… |
CVE-2022-37884 | High | 7.5 | 2022-09-20 | A vulnerability exists in the ClearPass Policy Manager Guest User Interface that can allow an unauthenticated attacker to send specific operations which result… |
CVE-2022-37883 | High | 7.2 | 2022-09-20 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying hos… |
CVE-2022-37882 | High | 7.2 | 2022-09-20 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying hos… |
CVE-2022-37881 | High | 7.2 | 2022-09-20 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying hos… |
CVE-2022-37880 | High | 7.2 | 2022-09-20 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying hos… |
CVE-2022-37879 | High | 7.2 | 2022-09-20 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying hos… |
CVE-2022-37878 | High | 7.2 | 2022-09-20 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying hos… |
CVE-2022-37877 | High | 7.8 | 2022-09-20 | A vulnerability in the ClearPass OnGuard macOS agent could allow malicious users on a macOS instance to elevate their user privileges. A successful exploit cou… |
CVE-2022-37395 | High | 7.5 | 2022-09-20 | A Huawei device has an input verification vulnerability. Successful exploitation of this vulnerability may lead to DoS attacks.Affected product versions includ… |
CVE-2022-33735 | Medium | 6.5 | 2022-09-20 | There is a password verification vulnerability in WS7200-10 11.0.2.13. Attackers on the LAN may use brute force cracking to obtain passwords, which may cause s… |
CVE-2022-37972 | High | 7.5 | 2022-09-20 | Microsoft Endpoint Configuration Manager Spoofing Vulnerability |
CVE-2022-30579 | High | 7.1 | 2022-09-20 | The Web Player component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a difficult to explo… |
CVE-2022-41138 | Critical | 9.8 | 2022-09-20 | In Zutty before 0.13, DECRQSS in text written to the terminal can achieve arbitrary code execution. |
CVE-2022-40262 | High | 8.2 | 2022-09-20 | A potential attacker can execute an arbitrary code at the time of the PEI phase and influence the subsequent boot stages. This can lead to the mitigations bypa… |
CVE-2022-40261 | High | 8.2 | 2022-09-20 | An attacker can exploit this vulnerability to elevate privileges from ring 0 to ring -2, execute arbitrary code in System Management Mode - an environment more… |
CVE-2022-40250 | High | 8.8 | 2022-09-20 | An attacker can exploit this vulnerability to elevate privileges from ring 0 to ring -2, execute arbitrary code in System Management Mode - an environment more… |
CVE-2022-40246 | High | 7.2 | 2022-09-20 | A potential attacker can write one byte by arbitrary address at the time of the PEI phase (only during S3 resume boot mode) and influence the subsequent boot s… |
CVE-2022-39974 | High | 7.5 | 2022-09-20 | WASM3 v0.5.0 was discovered to contain a segmentation fault via the component op_Select_i32_srs in wasm3/source/m3_exec.h. |
CVE-2022-38956 | Medium | 5.3 | 2022-09-20 | An exploitable firmware downgrade vulnerability was discovered on the Netgear WPN824EXT WiFi Range Extender. An attacker can conduct a MITM attack to replace t… |
CVE-2022-38955 | High | 7.5 | 2022-09-20 | An exploitable firmware modification vulnerability was discovered on the Netgear WPN824EXT WiFi Range Extender. An attacker can conduct a MITM attack to modify… |
CVE-2022-38340 | Critical | 9.1 | 2022-09-20 | Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a Path Traversal vulnerability via the component fmedataupload. |
CVE-2022-37265 | Critical | 9.8 | 2022-09-20 | Prototype pollution vulnerability in stealjs steal 2.2.4 via the alias variable in babel.js. |
CVE-2022-37259 | High | 7.5 | 2022-09-20 | A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the string variable in babel.js. |
CVE-2022-37205 | High | 8.8 | 2022-09-20 | JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenati… |
CVE-2022-26873 | High | 8.2 | 2022-09-20 | A potential attacker can execute an arbitrary code at the time of the PEI phase and influence the subsequent boot stages. This can lead to the mitigations bypa… |
CVE-2022-38916 | Critical | 9.8 | 2022-09-20 | A file upload vulnerability exists in the storage feature of pagekit 1.0.18, which allows an attacker to upload malicious files |
CVE-2022-37204 | Critical | 9.8 | 2022-09-20 | Final CMS 5.1.0 is vulnerable to SQL Injection. |
CVE-2022-35196 | High | 8.8 | 2022-09-20 | TestLink v1.9.20 was discovered to contain a Cross-Site Request Forgery (CSRF) via /lib/plan/planView.php. |
CVE-2022-32167 | Medium | 5.4 | 2022-09-20 | Cloudreve versions v1.0.0 through v3.5.3 are vulnerable to Stored Cross-Site Scripting (XSS), via the file upload functionality. A low privileged user will be… |
CVE-2022-40955 | High | 8.8 | 2022-09-20 | In versions of Apache InLong prior to 1.3.0, an attacker with sufficient privileges to specify MySQL JDBC connection URL parameters and to write arbitrary data… |
CVE-2022-3245 | Medium | 6.1 | 2022-09-20 | HTML injection attack is closely related to Cross-site Scripting (XSS). HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScri… |
CVE-2022-3242 | Medium | 6.1 | 2022-09-20 | Code Injection in GitHub repository microweber/microweber prior to 1.3.2. |
CVE-2022-3005 | Medium | 5.4 | 2022-09-20 | Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. |
CVE-2022-2177 | Critical | 9.4 | 2022-09-20 | Kayrasoft product before version 2 has an unauthenticated SQL Injection vulnerability. This is fixed in version 2. |
CVE-2022-3079 | High | 7.5 | 2022-09-20 | Festo control block CPX-CEC-C1 and CPX-CMXX in multiple versions allow unauthenticated, remote access to critical webpage functions which may cause a denial of… |
CVE-2022-3004 | Medium | 5.4 | 2022-09-20 | Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. |
CVE-2022-34917 | High | 7.5 | 2022-09-20 | A security vulnerability has been identified in Apache Kafka. It affects all releases since 2.8.0. The vulnerability allows malicious unauthenticated clients t… |
CVE-2022-3000 | Medium | 5.4 | 2022-09-20 | Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. |
CVE-2022-39958 | High | 7.5 | 2022-09-20 | The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass to sequentially exfiltrate small and undetectable sections of data by repeatedl… |
CVE-2022-39957 | High | 7.3 | 2022-09-20 | The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass. A client can issue an HTTP Accept header field containing an optional "charset… |
CVE-2022-39956 | High | 7.3 | 2022-09-20 | The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass for HTTP multipart requests by submitting a payload that uses a character en… |
CVE-2022-39955 | High | 7.3 | 2022-09-20 | The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass by submitting a specially crafted HTTP Content-Type header field that indica… |
CVE-2022-2924 | Medium | 5.4 | 2022-09-20 | Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.3. |
CVE-2022-34746 | Medium | 5.9 | 2022-09-20 | An insufficient entropy vulnerability caused by the improper use of randomness sources with low entropy for RSA key pair generation was found in Zyxel GS1900 s… |