2022 CVEs (page 132)
Page 132 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-41234 | High | 8.8 | 2022-09-21 | Jenkins Rundeck Plugin 3.6.11 and earlier does not protect access to the /plugin/rundeck/webhook/ endpoint, allowing users with Overall/Read permission to trig… |
CVE-2022-41233 | Medium | 4.3 | 2022-09-21 | Jenkins Rundeck Plugin 3.6.11 and earlier does not perform Run/Artifacts permission checks in multiple HTTP endpoints, allowing attackers with Item/Read permis… |
CVE-2022-41232 | High | 8.0 | 2022-09-21 | A cross-site request forgery (CSRF) vulnerability in Jenkins Build-Publisher Plugin 1.22 and earlier allows attackers to replace any config.xml file on the Jen… |
CVE-2022-41231 | Medium | 5.7 | 2022-09-21 | Jenkins Build-Publisher Plugin 1.22 and earlier allows attackers with Item/Configure permission to create or replace any config.xml file on the Jenkins control… |
CVE-2022-41230 | Medium | 4.3 | 2022-09-21 | Jenkins Build-Publisher Plugin 1.22 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to obt… |
CVE-2022-41229 | Medium | 5.4 | 2022-09-21 | Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.134 and earlier does not escape configuration options of the Execute NetStorm/NetCloud Test build… |
CVE-2022-41228 | High | 8.8 | 2022-09-21 | A missing permission check in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attackers with Overall/Read permissions to co… |
CVE-2022-41227 | High | 8.8 | 2022-09-21 | A cross-site request forgery (CSRF) vulnerability in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attackers to connect t… |
CVE-2022-41226 | Critical | 9.8 | 2022-09-21 | Jenkins Compuware Common Configuration Plugin 1.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-41225 | Medium | 5.4 | 2022-09-21 | Jenkins Anchore Container Image Scanner Plugin 1.0.24 and earlier does not escape content provided by the Anchore engine API, resulting in a stored cross-site… |
CVE-2022-41224 | Medium | 5.4 | 2022-09-21 | Jenkins 2.367 through 2.369 (both inclusive) does not escape tooltips of the l:helpIcon UI component used for some help icons on the Jenkins web UI, resulting… |
CVE-2022-37246 | Medium | 5.4 | 2022-09-21 | Craft CMS 4.2.0.1 is affected by Cross Site Scripting (XSS) in the file src/web/assets/cp/src/js/BaseElementSelectInput.js and in specific on the line label: e… |
CVE-2022-37026 | Critical | 9.8 | 2022-09-21 | In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situation… |
CVE-2022-2265 | High | 7.5 | 2022-09-21 | The Identity and Directory Management System developed by Çekino Bilgi Teknolojileri before version 2.1.25 has an unauthenticated Path traversal vulnerability… |
CVE-2022-3255 | Medium | 4.8 | 2022-09-21 | If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the att… |
CVE-2022-38928 | High | 7.8 | 2022-09-21 | XPDF 4.04 is vulnerable to Null Pointer Dereference in FoFiType1C.cc:2393. |
CVE-2022-3068 | High | 8.8 | 2022-09-21 | Improper Privilege Management in GitHub repository octoprint/octoprint prior to 1.8.3. |
CVE-2022-2888 | Medium | 4.4 | 2022-09-21 | If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as lon… |
CVE-2022-3080 | High | 7.5 | 2022-09-21 | By sending specific queries to the resolver, an attacker can cause named to crash. |
CVE-2022-38178 | High | 7.5 | 2022-09-21 | By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually… |
CVE-2022-38177 | High | 7.5 | 2022-09-21 | By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually… |
CVE-2022-2906 | High | 7.5 | 2022-09-21 | An attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would… |
CVE-2022-2881 | Medium | 5.5 | 2022-09-21 | The underlying bug might cause read past end of the buffer and either read memory it should not read, or crash the process. |
CVE-2022-2795 | Medium | 5.3 | 2022-09-21 | By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitima… |
CVE-2022-2872 | Medium | 5.4 | 2022-09-21 | Unrestricted Upload of File with Dangerous Type in GitHub repository octoprint/octoprint prior to 1.8.3. |
CVE-2022-0495 | Critical | 9.4 | 2022-09-21 | The library automation system product KOHA developed by Parantez Teknoloji before version 19.05.03 has an unauthenticated SQL Injection vulnerability. This has… |
CVE-2022-41222 | High | 7.0 | 2022-09-21 | mm/mremap.c in the Linux kernel before 5.13.3 has a use-after-free via a stale TLB because an rmap lock is not held during a PUD move. |
CVE-2022-40754 | Medium | 6.1 | 2022-09-21 | In Apache Airflow 2.3.0 through 2.3.4, there was an open redirect in the webserver's `/confirm` endpoint. |
CVE-2022-40604 | High | 7.5 | 2022-09-21 | In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction. |
CVE-2022-2315 | Critical | 9.4 | 2022-09-21 | Database Software Accreditation Tracking/Presentation Module product before version 2 has an unauthenticated SQL Injection vulnerability. This is fixed in vers… |
CVE-2022-41220 | Critical | 9.8 | 2022-09-21 | md2roff 1.9 has a stack-based buffer overflow via a Markdown file, a different vulnerability than CVE-2022-34913. NOTE: the vendor's position is that the produ… |
CVE-2022-41218 | Medium | 5.5 | 2022-09-21 | In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused by refcount races, affecting dvb_demux_open and dvb_dm… |
CVE-2022-39221 | High | 7.5 | 2022-09-21 | McWebserver mod runs a simple HTTP server alongside the Minecraft server in seperate threads. Path traversal in McWebserver Minecraft Mod for Fabric and Quilt… |
CVE-2022-38619 | Critical | 9.8 | 2022-09-21 | SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j_id90 parameter at /SVFE2/pages/feegroups/mcc_group.jsf. |
CVE-2022-35090 | Medium | 5.5 | 2022-09-21 | SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via __asan_memcpy at /asan/asan_interceptors_memintrinsics.cpp:. |
CVE-2022-35089 | Medium | 5.5 | 2022-09-21 | SWFTools commit 772e55a2 was discovered to contain a heap-buffer-overflow via getTransparentColor at /home/bupt/Desktop/swftools/src/gif2swf. |
CVE-2022-35088 | Medium | 5.5 | 2022-09-21 | SWFTools commit 772e55a2 was discovered to contain a heap buffer-overflow via getGifDelayTime at /home/bupt/Desktop/swftools/src/src/gif2swf.c. |
CVE-2022-35087 | Medium | 5.5 | 2022-09-21 | SWFTools commit 772e55a2 was discovered to contain a segmentation violation via MovieAddFrame at /src/gif2swf.c. |
CVE-2022-35086 | Medium | 5.5 | 2022-09-21 | SWFTools commit 772e55a2 was discovered to contain a segmentation violation via /multiarch/memmove-vec-unaligned-erms.S. |
CVE-2022-35085 | Medium | 5.5 | 2022-09-21 | SWFTools commit 772e55a2 was discovered to contain a memory leak via /lib/mem.c. |
CVE-2022-35957 | Medium | 6.6 | 2022-09-20 | Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server ad… |
CVE-2022-39220 | Medium | 6.1 | 2022-09-20 | SFTPGo is an SFTP server written in Go. Versions prior to 2.3.5 are subject to Cross-site scripting (XSS) vulnerabilities in the SFTPGo WebClient, allowing rem… |
CVE-2022-40357 | Critical | 9.8 | 2022-09-20 | A security issue was discovered in Z-BlogPHP <= 1.7.2. A Server-Side Request Forgery (SSRF) vulnerability in the zb_users/plugin/UEditor/php/action_crawler.php… |
CVE-2022-32917 | High | 7.8 | 2022-09-20 | The issue was addressed with improved bounds checks. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15.7, iOS 16, macOS Big Sur 11.7. An appli… |
CVE-2022-32912 | High | 8.8 | 2022-09-20 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Safari 16, iOS 16, iOS 15.7 and iPadOS 15.7. Processing maliciously c… |
CVE-2022-32911 | High | 7.8 | 2022-09-20 | The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15.7, iOS 16, macOS Big Sur 11.7. An app… |
CVE-2022-32908 | High | 7.8 | 2022-09-20 | A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15.7, iOS 16, macOS Big… |
CVE-2022-32886 | High | 8.8 | 2022-09-20 | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in Safari 16, iOS 16, iOS 15.7 and iPadOS 15.7. Processing maliciously… |
CVE-2022-32883 | Medium | 5.5 | 2022-09-20 | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15.7, iOS 16, macOS Big Sur 11.7. An ap… |
CVE-2022-32882 | Critical | 9.8 | 2022-09-20 | This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.4, macOS Big Sur 11.6.6. An app may be able to bypass Privacy preferenc… |
CVE-2022-32880 | Medium | 6.5 | 2022-09-20 | This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.5. An app may be able to access user-sensitive data. |
CVE-2022-32872 | Low | 2.4 | 2022-09-20 | A logic issue was addressed with improved restrictions. This issue is fixed in iOS 16, iOS 15.7 and iPadOS 15.7. A person with physical access to an iOS device… |
CVE-2022-32868 | Medium | 4.3 | 2022-09-20 | A logic issue was addressed with improved state management. This issue is fixed in Safari 16, iOS 16, iOS 15.7 and iPadOS 15.7. A website may be able to track… |
CVE-2022-32864 | Medium | 5.5 | 2022-09-20 | The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15.7, iOS 16, macOS Big Sur 11.7. An app… |
CVE-2022-32863 | Critical | 9.8 | 2022-09-20 | A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 15.6, macOS Monterey 12.5. Processing maliciously crafted… |
CVE-2022-32861 | Medium | 5.3 | 2022-09-20 | A logic issue was addressed with improved state management. This issue is fixed in Safari 15.6, macOS Monterey 12.5. A user may be tracked through their IP add… |
CVE-2022-32854 | Medium | 5.5 | 2022-09-20 | This issue was addressed with improved checks. This issue is fixed in iOS 15.7 and iPadOS 15.7, iOS 16, macOS Big Sur 11.7. An app may be able to bypass Privac… |
CVE-2022-32802 | High | 7.8 | 2022-09-20 | A logic issue was addressed with improved checks. This issue is fixed in iOS 15.6 and iPadOS 15.6, tvOS 15.6, macOS Monterey 12.5. Processing a maliciously cra… |
CVE-2022-32795 | Medium | 4.3 | 2022-09-20 | This issue was addressed with improved checks. This issue is fixed in iOS 16, iOS 15.7 and iPadOS 15.7. Visiting a malicious website may lead to address bar sp… |
CVE-2022-32788 | Critical | 9.8 | 2022-09-20 | A buffer overflow was addressed with improved bounds checking. This issue is fixed in watchOS 8.7, tvOS 15.6, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. A… |
CVE-2022-28640 | High | 8.8 | 2022-09-20 | A potential local adjacent arbitrary code execution vulnerability that could potentially lead to a loss of confidentiality, integrity, and availability was dis… |
CVE-2022-28639 | High | 8.8 | 2022-09-20 | A remote potential adjacent denial of service (DoS) and potential adjacent arbitrary code execution vulnerability that could potentially lead to a loss of conf… |
CVE-2022-28638 | High | 7.8 | 2022-09-20 | An isolated local disclosure of information and potential isolated local arbitrary code execution vulnerability that could potentially lead to a loss of confid… |
CVE-2022-28637 | High | 7.8 | 2022-09-20 | A local Denial of Service (DoS) and local arbitrary code execution vulnerability that could potentially lead to a loss of confidentiality, integrity, and avail… |
CVE-2022-26696 | High | 8.8 | 2022-09-20 | This issue was addressed with improved environment sanitization. This issue is fixed in macOS Monterey 12.4. A sandboxed process may be able to circumvent sand… |
CVE-2022-23696 | High | 8.8 | 2022-09-20 | Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks… |
CVE-2022-23695 | High | 8.8 | 2022-09-20 | Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks… |
CVE-2022-23694 | High | 8.8 | 2022-09-20 | Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks… |
CVE-2022-23693 | High | 8.8 | 2022-09-20 | Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks… |
CVE-2022-23692 | High | 8.8 | 2022-09-20 | Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks… |
CVE-2022-23685 | High | 8.8 | 2022-09-20 | A vulnerability in the ClearPass Policy Manager web-based management interface exists which exposes some endpoints to a lack of Cross-Site Request Forgery (CSR… |
CVE-2022-40009 | Critical | 9.8 | 2022-09-20 | SWFTools commit 772e55a was discovered to contain a heap-use-after-free via the function grow_unicode at /lib/ttf.c. |
CVE-2022-40008 | Critical | 9.8 | 2022-09-20 | SWFTools commit 772e55a was discovered to contain a heap-buffer overflow via the function readU8 at /lib/ttf.c. |
CVE-2022-39218 | High | 7.5 | 2022-09-20 | The JS Compute Runtime for Fastly's Compute@Edge platform provides the environment JavaScript is executed in when using the Compute@Edge JavaScript SDK. In ver… |
CVE-2022-38931 | High | 8.8 | 2022-09-20 | A Server-Side Request Forgery (SSRF) in fetch_net_file_upload function of baijiacmsV4 v4.1.4 allows remote attackers to force the application to make arbitrary… |
CVE-2022-37884 | High | 7.5 | 2022-09-20 | A vulnerability exists in the ClearPass Policy Manager Guest User Interface that can allow an unauthenticated attacker to send specific operations which result… |
CVE-2022-37883 | High | 7.2 | 2022-09-20 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying hos… |
CVE-2022-37882 | High | 7.2 | 2022-09-20 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying hos… |
CVE-2022-37881 | High | 7.2 | 2022-09-20 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying hos… |
CVE-2022-37880 | High | 7.2 | 2022-09-20 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying hos… |
CVE-2022-37879 | High | 7.2 | 2022-09-20 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying hos… |
CVE-2022-37878 | High | 7.2 | 2022-09-20 | Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying hos… |
CVE-2022-37877 | High | 7.8 | 2022-09-20 | A vulnerability in the ClearPass OnGuard macOS agent could allow malicious users on a macOS instance to elevate their user privileges. A successful exploit cou… |
CVE-2022-37395 | High | 7.5 | 2022-09-20 | A Huawei device has an input verification vulnerability. Successful exploitation of this vulnerability may lead to DoS attacks.Affected product versions includ… |
CVE-2022-33735 | Medium | 6.5 | 2022-09-20 | There is a password verification vulnerability in WS7200-10 11.0.2.13. Attackers on the LAN may use brute force cracking to obtain passwords, which may cause s… |
CVE-2022-37972 | High | 7.5 | 2022-09-20 | Microsoft Endpoint Configuration Manager Spoofing Vulnerability |
CVE-2022-30579 | High | 7.1 | 2022-09-20 | The Web Player component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a difficult to explo… |
CVE-2022-41138 | Critical | 9.8 | 2022-09-20 | In Zutty before 0.13, DECRQSS in text written to the terminal can achieve arbitrary code execution. |
CVE-2022-40262 | High | 8.2 | 2022-09-20 | A potential attacker can execute an arbitrary code at the time of the PEI phase and influence the subsequent boot stages. This can lead to the mitigations bypa… |
CVE-2022-40261 | High | 8.2 | 2022-09-20 | An attacker can exploit this vulnerability to elevate privileges from ring 0 to ring -2, execute arbitrary code in System Management Mode - an environment more… |
CVE-2022-40250 | High | 8.8 | 2022-09-20 | An attacker can exploit this vulnerability to elevate privileges from ring 0 to ring -2, execute arbitrary code in System Management Mode - an environment more… |
CVE-2022-40246 | High | 7.2 | 2022-09-20 | A potential attacker can write one byte by arbitrary address at the time of the PEI phase (only during S3 resume boot mode) and influence the subsequent boot s… |
CVE-2022-39974 | High | 7.5 | 2022-09-20 | WASM3 v0.5.0 was discovered to contain a segmentation fault via the component op_Select_i32_srs in wasm3/source/m3_exec.h. |
CVE-2022-38956 | Medium | 5.3 | 2022-09-20 | An exploitable firmware downgrade vulnerability was discovered on the Netgear WPN824EXT WiFi Range Extender. An attacker can conduct a MITM attack to replace t… |
CVE-2022-38955 | High | 7.5 | 2022-09-20 | An exploitable firmware modification vulnerability was discovered on the Netgear WPN824EXT WiFi Range Extender. An attacker can conduct a MITM attack to modify… |
CVE-2022-38340 | Critical | 9.1 | 2022-09-20 | Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a Path Traversal vulnerability via the component fmedataupload. |
CVE-2022-37265 | Critical | 9.8 | 2022-09-20 | Prototype pollution vulnerability in stealjs steal 2.2.4 via the alias variable in babel.js. |
CVE-2022-37259 | High | 7.5 | 2022-09-20 | A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the string variable in babel.js. |
CVE-2022-37205 | High | 8.8 | 2022-09-20 | JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenati… |
CVE-2022-26873 | High | 8.2 | 2022-09-20 | A potential attacker can execute an arbitrary code at the time of the PEI phase and influence the subsequent boot stages. This can lead to the mitigations bypa… |