2022 CVEs (page 133)
Page 133 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-38916 | Critical | 9.8 | 2022-09-20 | A file upload vulnerability exists in the storage feature of pagekit 1.0.18, which allows an attacker to upload malicious files |
CVE-2022-37204 | Critical | 9.8 | 2022-09-20 | Final CMS 5.1.0 is vulnerable to SQL Injection. |
CVE-2022-35196 | High | 8.8 | 2022-09-20 | TestLink v1.9.20 was discovered to contain a Cross-Site Request Forgery (CSRF) via /lib/plan/planView.php. |
CVE-2022-32167 | Medium | 5.4 | 2022-09-20 | Cloudreve versions v1.0.0 through v3.5.3 are vulnerable to Stored Cross-Site Scripting (XSS), via the file upload functionality. A low privileged user will be… |
CVE-2022-40955 | High | 8.8 | 2022-09-20 | In versions of Apache InLong prior to 1.3.0, an attacker with sufficient privileges to specify MySQL JDBC connection URL parameters and to write arbitrary data… |
CVE-2022-3245 | Medium | 6.1 | 2022-09-20 | HTML injection attack is closely related to Cross-site Scripting (XSS). HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScri… |
CVE-2022-3242 | Medium | 6.1 | 2022-09-20 | Code Injection in GitHub repository microweber/microweber prior to 1.3.2. |
CVE-2022-3005 | Medium | 5.4 | 2022-09-20 | Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. |
CVE-2022-2177 | Critical | 9.4 | 2022-09-20 | Kayrasoft product before version 2 has an unauthenticated SQL Injection vulnerability. This is fixed in version 2. |
CVE-2022-3079 | High | 7.5 | 2022-09-20 | Festo control block CPX-CEC-C1 and CPX-CMXX in multiple versions allow unauthenticated, remote access to critical webpage functions which may cause a denial of… |
CVE-2022-3004 | Medium | 5.4 | 2022-09-20 | Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. |
CVE-2022-34917 | High | 7.5 | 2022-09-20 | A security vulnerability has been identified in Apache Kafka. It affects all releases since 2.8.0. The vulnerability allows malicious unauthenticated clients t… |
CVE-2022-3000 | Medium | 5.4 | 2022-09-20 | Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. |
CVE-2022-39958 | High | 7.5 | 2022-09-20 | The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass to sequentially exfiltrate small and undetectable sections of data by repeatedl… |
CVE-2022-39957 | High | 7.3 | 2022-09-20 | The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass. A client can issue an HTTP Accept header field containing an optional "charset… |
CVE-2022-39956 | High | 7.3 | 2022-09-20 | The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass for HTTP multipart requests by submitting a payload that uses a character en… |
CVE-2022-39955 | High | 7.3 | 2022-09-20 | The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass by submitting a specially crafted HTTP Content-Type header field that indica… |
CVE-2022-2924 | Medium | 5.4 | 2022-09-20 | Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.3. |
CVE-2022-34746 | Medium | 5.9 | 2022-09-20 | An insufficient entropy vulnerability caused by the improper use of randomness sources with low entropy for RSA key pair generation was found in Zyxel GS1900 s… |
CVE-2022-38550 | Medium | 5.4 | 2022-09-19 | A stored cross-site scripting (XSS) vulnerability in the /weibo/list component of Jeesns v2.0.0 allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2022-38545 | Critical | 9.6 | 2022-09-19 | Valine v1.4.18 was discovered to contain a remote code execution (RCE) vulnerability which allows attackers to execute arbitrary code via a crafted POST reques… |
CVE-2022-38532 | High | 7.8 | 2022-09-19 | Micro-Star International Co., Ltd MSI Center 1.0.50.0 was discovered to contain a vulnerability in the component C_Features of MSI.CentralServer.exe. This vuln… |
CVE-2022-38527 | Medium | 6.1 | 2022-09-19 | UCMS v1.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Import function under the Site Management page. |
CVE-2022-38509 | Critical | 9.8 | 2022-09-19 | Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the booking_id parameter at /admin/budget.php. |
CVE-2022-38339 | Critical | 9.6 | 2022-09-19 | Safe Software FME Server v2021.2.5, v2022.0.0.2 and below contains a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web s… |
CVE-2022-37032 | Critical | 9.1 | 2022-09-19 | An out-of-bounds read in the BGP daemon of FRRouting FRR before 8.4 may lead to a segmentation fault and denial of service. This occurs in bgp_capability_msg_p… |
CVE-2022-35070 | Medium | 6.5 | 2022-09-19 | OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x65fc97. |
CVE-2022-35069 | Medium | 6.5 | 2022-09-19 | OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b544e. |
CVE-2022-35068 | Medium | 6.5 | 2022-09-19 | OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e420d. |
CVE-2022-35067 | Medium | 6.5 | 2022-09-19 | OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e41b0. |
CVE-2022-35066 | Medium | 6.5 | 2022-09-19 | OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e41b8. |
CVE-2022-35065 | Medium | 6.5 | 2022-09-19 | OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x65f724. |
CVE-2022-35064 | Medium | 6.5 | 2022-09-19 | OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x4adcdb in __asan_memset. |
CVE-2022-35063 | Medium | 6.5 | 2022-09-19 | OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e41a8. |
CVE-2022-35062 | Medium | 6.5 | 2022-09-19 | OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6c0bc3. |
CVE-2022-35061 | Medium | 6.5 | 2022-09-19 | OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e412a. |
CVE-2022-35060 | Medium | 6.5 | 2022-09-19 | OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6c0a32. |
CVE-2022-28321 | Critical | 9.8 | 2022-09-19 | The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't correctly restrict… |
CVE-2022-0143 | Critical | 9.3 | 2022-09-19 | When the LDAP connector is started with StartTLS configured, unauthenticated access is granted. This issue affects: all versions of the LDAP connector prior to… |
CVE-2022-38351 | High | 8.8 | 2022-09-19 | A vulnerability in Suprema BioStar (aka Bio Star) 2 v2.8.16 allows attackers to escalate privileges to System Administrator via a crafted PUT request to the up… |
CVE-2022-28204 | High | 7.5 | 2022-09-19 | A denial-of-service issue was discovered in MediaWiki 1.37.x before 1.37.2. Rendering of w/index.php?title=Special%3AWhatLinksHere&target=Property%3AP31&namesp… |
CVE-2022-28203 | High | 7.5 | 2022-09-19 | A denial-of-service issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. When many files exist, requesting Special… |
CVE-2022-28201 | Medium | 4.4 | 2022-09-19 | An issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. Users with the editinterface permission can trigger infinit… |
CVE-2022-3239 | High | 7.8 | 2022-09-19 | A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers em28xx_usb_probe() for the Empia 28xx based TV cards. A local u… |
CVE-2022-38576 | High | 7.2 | 2022-09-19 | Interview Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /interview/delete.php?action=deletecand&id=. |
CVE-2022-2995 | High | 7.1 | 2022-09-19 | Incorrect handling of the supplementary groups in the CRI-O container engine might lead to sensitive information disclosure or possible data modification if an… |
CVE-2022-29835 | Medium | 5.3 | 2022-09-19 | WD Discovery software executable files were signed with an unsafe SHA-1 hashing algorithm. An attacker could use this weakness to create forged certificate sig… |
CVE-2022-23768 | High | 8.8 | 2022-09-19 | This Vulnerability in NIS-HAP11AC is caused by an exposed external port for the telnet service. Remote attackers use this vulnerability to induce all attacks s… |
CVE-2022-23767 | High | 8.8 | 2022-09-19 | This vulnerability of SecureGate is SQL-Injection using login without password. A path traversal vulnerability is also identified during file transfer. An atta… |
CVE-2022-23766 | High | 7.8 | 2022-09-19 | An improper input validation vulnerability leading to arbitrary file execution was discovered in BigFileAgent. In order to cause arbitrary files to be executed… |
CVE-2022-40980 | Critical | 9.1 | 2022-09-19 | A potential unathenticated file deletion vulnerabilty on Trend Micro Mobile Security for Enterprise 9.8 SP5 could allow an attacker with access to the Manageme… |
CVE-2022-40608 | High | 7.5 | 2022-09-19 | IBM Spectrum Protect Plus 10.1.6 through 10.1.11 Microsoft File Systems restore operation can download any file on the target machine by manipulating the URL w… |
CVE-2022-40234 | Medium | 5.9 | 2022-09-19 | Versions of IBM Spectrum Protect Plus prior to 10.1.12 (excluding 10.1.12) include the private key information for a certificate inside the generated .crt file… |
CVE-2022-40144 | Critical | 9.8 | 2022-09-19 | A vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service could allow an attacker to bypass the product's login authentication by falsifyin… |
CVE-2022-40143 | High | 7.3 | 2022-09-19 | A link following local privilege escalation vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service servers could allow a local attacker to… |
CVE-2022-40142 | High | 7.8 | 2022-09-19 | A security link following local privilege escalation vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service agents could allow a local att… |
CVE-2022-40141 | High | 7.5 | 2022-09-19 | A vulnerability in Trend Micro Apex One and Apex One as a Service could allow an attacker to intercept and decode certain communication strings that may contai… |
CVE-2022-40140 | Medium | 5.5 | 2022-09-19 | An origin validation error vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to cause a denial-of-service on affecte… |
CVE-2022-40139 | High | 7.2 | 2022-09-19 | Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could allow a Apex… |
CVE-2022-3213 | Medium | 5.5 | 2022-09-19 | A heap buffer overflow issue was found in ImageMagick. When an application processes a malformed TIFF file, it could lead to undefined behavior or a crash caus… |
CVE-2022-38764 | High | 7.8 | 2022-09-19 | A vulnerability on Trend Micro HouseCall version 1.62.1.1133 and below could allow a local attacker to escalate privlieges due to an overly permissive folder o… |
CVE-2022-37348 | Medium | 5.5 | 2022-09-19 | Trend Micro Security 2021 and 2022 (Consumer) is vulnerable to an Out-Of-Bounds Read Information Disclosure Vulnerability that could allow an attacker to read… |
CVE-2022-37347 | Medium | 5.5 | 2022-09-19 | Trend Micro Security 2021 and 2022 (Consumer) is vulnerable to an Out-Of-Bounds Read Information Disclosure Vulnerability that could allow an attacker to read… |
CVE-2022-34893 | High | 7.8 | 2022-09-19 | Trend Micro Security 2022 (consumer) has a link following vulnerability where an attacker with lower privileges could manipulate a mountpoint which could lead… |
CVE-2022-40468 | High | 7.5 | 2022-09-19 | Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used. Tinyproxy commit 84f203f and earlier u… |
CVE-2022-3218 | Critical | 9.8 | 2022-09-19 | Due to a reliance on client-side authentication, the WiFi Mouse (Mouse Server) from Necta LLC's authentication mechanism is trivially bypassed, which can resul… |
CVE-2022-38333 | High | 7.5 | 2022-09-19 | Openwrt before v21.02.3 and Openwrt v22.03.0-rc6 were discovered to contain two skip loops in the function header_value(). This vulnerability allows attackers… |
CVE-2022-40978 | High | 7.5 | 2022-09-19 | The installer of JetBrains IntelliJ IDEA before 2022.2.2 was vulnerable to EXE search order hijacking |
CVE-2022-40812 | Critical | 9.8 | 2022-09-19 | The d8s-pdfs for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-sy… |
CVE-2022-40810 | Critical | 9.8 | 2022-09-19 | The d8s-ip-addresses for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus… |
CVE-2022-40809 | Critical | 9.8 | 2022-09-19 | The d8s-dicts for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypoth… |
CVE-2022-40715 | Medium | 6.5 | 2022-09-19 | An issue was discovered in NOKIA 1350OMS R14.2. An Absolute Path Traversal vulnerability exists for a specific endpoint via the logfile parameter, allowing a r… |
CVE-2022-40714 | Medium | 6.1 | 2022-09-19 | An issue was discovered in NOKIA 1350OMS R14.2. Reflected XSS exists under different /oms1350/* endpoints. |
CVE-2022-40713 | Medium | 6.5 | 2022-09-19 | An issue was discovered in NOKIA 1350OMS R14.2. Multiple Relative Path Traversal issues exist in different specific endpoints via the file parameter, allowing… |
CVE-2022-40712 | Medium | 6.1 | 2022-09-19 | An issue was discovered in NOKIA 1350OMS R14.2. Reflected XSS exists under different /cgi-bin/R14.2* endpoints. |
CVE-2022-40432 | Critical | 9.8 | 2022-09-19 | The d8s-strings for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypo… |
CVE-2022-40431 | Critical | 9.8 | 2022-09-19 | The d8s-pdfs for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-network… |
CVE-2022-40430 | Critical | 9.8 | 2022-09-19 | The d8s-utility for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-netw… |
CVE-2022-40429 | Critical | 9.8 | 2022-09-19 | The d8s-ip-addresses for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus… |
CVE-2022-40428 | Critical | 9.8 | 2022-09-19 | The d8s-mpeg for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-network… |
CVE-2022-40426 | Critical | 9.8 | 2022-09-19 | The d8s-asns for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-network… |
CVE-2022-40425 | Critical | 9.8 | 2022-09-19 | The d8s-html for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-network… |
CVE-2022-38887 | Critical | 9.8 | 2022-09-19 | The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The democritus-strings package. The… |
CVE-2022-38886 | Critical | 9.8 | 2022-09-19 | The d8s-xml for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings… |
CVE-2022-38885 | Critical | 9.8 | 2022-09-19 | The d8s-netstrings for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-s… |
CVE-2022-38884 | Critical | 9.8 | 2022-09-19 | The d8s-grammars for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-str… |
CVE-2022-38883 | Critical | 9.8 | 2022-09-19 | The d8s-math for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings… |
CVE-2022-38882 | Critical | 9.8 | 2022-09-19 | The d8s-json for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings… |
CVE-2022-38881 | Critical | 9.8 | 2022-09-19 | The d8s-archives for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-str… |
CVE-2022-38618 | High | 8.8 | 2022-09-19 | SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j_id88, UserForm:j_id90, and UserForm:j_id92 parameters at /S… |
CVE-2022-38577 | High | 8.8 | 2022-09-19 | ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page. This vulnerability allows attackers to escalate normal user… |
CVE-2022-38425 | Medium | 5.5 | 2022-09-19 | Adobe Bridge version 12.0.2 (and earlier) and 11.1.3 (and earlier) are affected by a Use After Free vulnerability that could lead to disclosure of sensitive me… |
CVE-2022-37700 | High | 7.5 | 2022-09-19 | Zentao Demo15 is vulnerable to Directory Traversal. The impact is: obtain sensitive information (remote). The component is: URL : view-source:https://demo15.ze… |
CVE-2022-37203 | Critical | 9.8 | 2022-09-19 | JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenat… |
CVE-2022-35914 | Critical | 9.8 | 2022-09-19 | /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection. |
CVE-2022-35709 | Medium | 5.5 | 2022-09-19 | Adobe Bridge version 12.0.2 (and earlier) and 11.1.3 (and earlier) are affected by a Use After Free vulnerability that could lead to disclosure of sensitive me… |
CVE-2022-35708 | High | 7.8 | 2022-09-19 | Adobe Bridge version 12.0.2 (and earlier) and 11.1.3 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary co… |
CVE-2022-35707 | High | 7.8 | 2022-09-19 | Adobe Bridge version 12.0.2 (and earlier) and 11.1.3 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could… |
CVE-2022-35706 | High | 7.8 | 2022-09-19 | Adobe Bridge version 12.0.2 (and earlier) and 11.1.3 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary co… |
CVE-2022-35705 | High | 7.8 | 2022-09-19 | Adobe Bridge version 12.0.2 (and earlier) and 11.1.3 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could… |