2022 CVEs (page 137)
Page 137 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-40646 | High | 7.8 | 2022-09-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exp… |
CVE-2022-40645 | High | 7.8 | 2022-09-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exp… |
CVE-2022-40644 | High | 7.8 | 2022-09-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exp… |
CVE-2022-40643 | High | 7.8 | 2022-09-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exp… |
CVE-2022-40642 | High | 7.8 | 2022-09-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exp… |
CVE-2022-40641 | High | 7.8 | 2022-09-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exp… |
CVE-2022-40640 | High | 7.8 | 2022-09-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exp… |
CVE-2022-40639 | High | 7.8 | 2022-09-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exp… |
CVE-2022-40638 | High | 7.8 | 2022-09-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exp… |
CVE-2022-40637 | High | 7.8 | 2022-09-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exp… |
CVE-2022-40636 | High | 7.8 | 2022-09-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exp… |
CVE-2022-38890 | Medium | 5.5 | 2022-09-15 | Nginx NJS v0.7.7 was discovered to contain a segmentation violation via njs_utf8_next at src/njs_utf8.h |
CVE-2022-38851 | Medium | 5.5 | 2022-09-15 | Certain The MPlayer Project products are vulnerable to Out-of-bounds Read via function read_meta_record() of mplayer/libmpdemux/asfheader.c. This affects mplay… |
CVE-2022-38850 | Medium | 5.5 | 2022-09-15 | The MPlayer Project mencoder SVN-r38374-13.0.1 is vulnerable to Divide By Zero via the function config () of llibmpcodecs/vf_scale.c. |
CVE-2022-38600 | Medium | 5.5 | 2022-09-15 | Mplayer SVN-r38374-13.0.1 is vulnerable to Memory Leak via vf.c and vf_vo.c. |
CVE-2022-37861 | Critical | 9.8 | 2022-09-15 | There is a remote code execution (RCE) vulnerability in Tenhot TWS-100 V4.0-201809201424 router device. It is necessary to know that the device account passwor… |
CVE-2022-37264 | Critical | 9.8 | 2022-09-15 | Prototype pollution vulnerability in stealjs steal 2.2.4 via the optionName variable in main.js. |
CVE-2022-37262 | High | 7.5 | 2022-09-15 | A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the source and sourceWithComments variable in main.js. |
CVE-2022-37201 | High | 8.8 | 2022-09-15 | JFinal CMS 5.1.0 is vulnerable to SQL Injection. |
CVE-2022-1798 | High | 8.7 | 2022-09-15 | A path traversal vulnerability in KubeVirt versions up to 0.56 (and 0.55.1) on all platforms allows a user able to configure the kubevirt to read arbitrary fil… |
CVE-2022-40306 | Medium | 5.9 | 2022-09-15 | The login form /Login in ECi Printanista Hub (formerly FMAudit Printscout) before 5.5.2 (July 2023) performs expensive RSA key-generation operations, which all… |
CVE-2022-3001 | High | 7.5 | 2022-09-15 | This vulnerability exists in Milesight Video Management Systems (VMS), all firmware versions prior to 40.7.0.79-r1, due to improper input handling at camera’s… |
CVE-2022-38866 | Medium | 5.5 | 2022-09-15 | Certain The MPlayer Project products are vulnerable to Buffer Overflow via read_avi_header() of libmpdemux/aviheader.c . This affects mplayer SVN-r38374-13.0.1… |
CVE-2022-38865 | Medium | 5.5 | 2022-09-15 | Certain The MPlayer Project products are vulnerable to Divide By Zero via the function demux_avi_read_packet of libmpdemux/demux_avi.c. This affects mplyer SVN… |
CVE-2022-38864 | Medium | 5.5 | 2022-09-15 | Certain The MPlayer Project products are vulnerable to Buffer Overflow via the function mp_unescape03() of libmpdemux/mpeg_hdr.c. This affects mencoder SVN-r38… |
CVE-2022-38863 | Medium | 5.5 | 2022-09-15 | Certain The MPlayer Project products are vulnerable to Buffer Overflow via function mp_getbits() of libmpdemux/mpeg_hdr.c which affects mencoder and mplayer. T… |
CVE-2022-38862 | High | 7.8 | 2022-09-15 | Certain The MPlayer Project products are vulnerable to Buffer Overflow via function play() of libaf/af.c:639. This affects mplayer SVN-r38374-13.0.1 and mencod… |
CVE-2022-38861 | Medium | 5.5 | 2022-09-15 | The MPlayer Project mplayer SVN-r38374-13.0.1 is vulnerable to memory corruption via function free_mp_image() of libmpcodecs/mp_image.c. |
CVE-2022-38860 | Medium | 5.5 | 2022-09-15 | Certain The MPlayer Project products are vulnerable to Divide By Zero via function demux_open_avi() of libmpdemux/demux_avi.c which affects mencoder. This affe… |
CVE-2022-38858 | Medium | 5.5 | 2022-09-15 | Certain The MPlayer Project products are vulnerable to Buffer Overflow via function mov_build_index() of libmpdemux/demux_mov.c. This affects mplayer SVN-r3837… |
CVE-2022-38856 | Medium | 5.5 | 2022-09-15 | Certain The MPlayer Project products are vulnerable to Buffer Overflow via function mov_build_index() of libmpdemux/demux_mov.c. This affects mplayer SVN-r3837… |
CVE-2022-38855 | Medium | 5.5 | 2022-09-15 | Certain The MPlayer Project products are vulnerable to Buffer Overflow via function gen_sh_video () of mplayer/libmpdemux/demux_mov.c. This affects mplayer SVN… |
CVE-2022-38853 | Medium | 5.5 | 2022-09-15 | Certain The MPlayer Project products are vulnerable to Buffer Overflow via function asf_init_audio_stream() of libmpdemux/asfheader.c. This affects mplayer SVN… |
CVE-2022-37207 | High | 8.8 | 2022-09-15 | JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenati… |
CVE-2022-29649 | Medium | 6.1 | 2022-09-15 | Qsmart Next v4.1.2 was discovered to contain a cross-site scripting (XSS) vulnerability. |
CVE-2022-3211 | Medium | 5.4 | 2022-09-15 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.6. |
CVE-2022-2472 | High | 7.6 | 2022-09-15 | Improper Initialization vulnerability in the local server component of EZVIZ CS-C6N-A0-1C2WFR allows a local attacker to read the contents of the memory space… |
CVE-2022-2471 | Critical | 9.9 | 2022-09-15 | Stack-based Buffer Overflow vulnerability in the EZVIZ Motion Detection component as used in camera models CS-CV248, CS-C6N-A0-1C2WFR, CS-DB1C-A0-1E2W2FR, CS-C… |
CVE-2022-37266 | Critical | 9.8 | 2022-09-15 | Prototype pollution vulnerability in function extend in babel.js in stealjs steal 2.2.4 via the key variable in babel.js. |
CVE-2022-37257 | Critical | 9.8 | 2022-09-15 | Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the requestedVersion variable in npm-convert.js. |
CVE-2022-3224 | Medium | 6.1 | 2022-09-15 | Misinterpretation of Input in GitHub repository ionicabizau/parse-url prior to 8.1.0. |
CVE-2022-38789 | Critical | 9.1 | 2022-09-15 | An issue was discovered in Airties Smart Wi-Fi before 2020-08-04. It allows attackers to change the main/guest SSID and the PSK to arbitrary values, and map th… |
CVE-2022-38788 | Medium | 4.3 | 2022-09-15 | An issue was discovered in Nokia FastMile 5G Receiver 5G14-B 1.2104.00.0281. Bluetooth on the Nokia ODU uses outdated pairing mechanisms, allowing an attacker… |
CVE-2022-3222 | Medium | 5.5 | 2022-09-15 | Uncontrolled Recursion in GitHub repository gpac/gpac prior to 2.1.0-DEV. |
CVE-2022-3221 | High | 8.8 | 2022-09-15 | Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.3. |
CVE-2022-31735 | Medium | 6.1 | 2022-09-15 | OpenAM Consortium Edition version 14.0.0 provided by OpenAM Consortium contains an open redirect vulnerability (CWE-601). When accessing an affected server thr… |
CVE-2022-40738 | Medium | 6.5 | 2022-09-15 | An issue was discovered in Bento4 through 1.6.0-639. A NULL pointer dereference occurs in AP4_DescriptorListWriter::Action in Core/Ap4Descriptor.h, called from… |
CVE-2022-40737 | Medium | 6.5 | 2022-09-15 | An issue was discovered in Bento4 through 1.6.0-639. A buffer over-read exists in the function AP4_StdcFileByteStream::WritePartial located in System/StdC/Ap4S… |
CVE-2022-40736 | Medium | 6.5 | 2022-09-15 | An issue was discovered in Bento4 1.6.0-639. There ie excessive memory consumption in AP4_CttsAtom::Create in Core/Ap4CttsAtom.cpp. |
CVE-2022-38595 | High | 7.2 | 2022-09-15 | Church Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/edit_user.php. |
CVE-2022-38594 | High | 7.2 | 2022-09-15 | Church Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/edit_visitor.php. |
CVE-2022-38352 | Critical | 9.8 | 2022-09-15 | ThinkPHP v6.0.13 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\Psr6Cache. This vulnerability allo… |
CVE-2022-38323 | High | 7.2 | 2022-09-15 | Event Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /Royal_Event/update_image.php. This vulnerabili… |
CVE-2022-40734 | Medium | 6.5 | 2022-09-14 | UniSharp laravel-filemanager (aka Laravel Filemanager) before 2.6.4 allows download?working_dir=%2F.. directory traversal to read arbitrary files, as exploited… |
CVE-2022-40476 | Medium | 5.5 | 2022-09-14 | A null pointer dereference issue was discovered in fs/io_uring.c in the Linux kernel before 5.15.62. A local user could use this flaw to crash the system or po… |
CVE-2022-40439 | Medium | 6.5 | 2022-09-14 | An memory leak issue was discovered in AP4_StdcFileByteStream::Create in mp42ts in Bento4 v1.6.0-639, allows attackers to cause a denial of service via a craft… |
CVE-2022-40438 | Medium | 6.5 | 2022-09-14 | Buffer overflow vulnerability in function AP4_MemoryByteStream::WritePartial in mp42aac in Bento4 v1.6.0-639, allows attackers to cause a denial of service via… |
CVE-2022-40365 | Medium | 6.1 | 2022-09-14 | Cross site scripting (XSS) vulnerability in ouqiang gocron through 1.5.3, allows attackers to execute arbitrary code via scope.row.hostname in web/vue/src/page… |
CVE-2022-38308 | Critical | 9.8 | 2022-09-14 | TOTOLink A700RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the lang parameter in the function cstesystem. This vulne… |
CVE-2022-38301 | High | 8.8 | 2022-09-14 | Onedev v7.4.14 contains a path traversal vulnerability which allows attackers to access restricted files and directories via uploading a crafted JAR file into… |
CVE-2022-37724 | Medium | 6.1 | 2022-09-14 | Project Wonder WebObjects 1.0 through 5.4.3 is vulnerable to Arbitrary HTTP Header injection and URL- or Header-based XSS reflection in all web-server adaptor… |
CVE-2022-2977 | High | 7.8 | 2022-09-14 | A flaw was found in the Linux kernel implementation of proxied virtualized TPM devices. On a system where virtualized TPM devices are configured (this is not t… |
CVE-2022-3216 | Medium | 5.0 | 2022-09-14 | A vulnerability has been found in Nintendo Game Boy Color and classified as problematic. This vulnerability affects unknown code of the component Mobile Adapte… |
CVE-2022-36056 | Medium | 5.5 | 2022-09-14 | Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabili… |
CVE-2022-36114 | Medium | 4.8 | 2022-09-14 | Cargo is a package manager for the rust programming language. It was discovered that Cargo did not limit the amount of data extracted from compressed archives… |
CVE-2022-36113 | Medium | 4.6 | 2022-09-14 | Cargo is a package manager for the rust programming language. After a package is downloaded, Cargo extracts its source code in the ~/.cargo folder on disk, mak… |
CVE-2022-36112 | Low | 3.5 | 2022-09-14 | GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licen… |
CVE-2022-35947 | Critical | 10.0 | 2022-09-14 | GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licen… |
CVE-2022-35946 | Medium | 5.5 | 2022-09-14 | GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licen… |
CVE-2022-35945 | Medium | 6.3 | 2022-09-14 | GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licen… |
CVE-2022-31187 | Medium | 6.8 | 2022-09-14 | GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licen… |
CVE-2022-31143 | Medium | 5.3 | 2022-09-14 | GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licen… |
CVE-2022-2277 | High | 7.5 | 2022-09-14 | Improper Input Validation vulnerability exists in the Hitachi Energy MicroSCADA X SYS600's ICCP stack during the ICCP communication establishment causes a deni… |
CVE-2022-29922 | High | 7.5 | 2022-09-14 | Improper Input Validation vulnerability in the handling of a specially crafted IEC 61850 packet with a valid data item but with incorrect data type in the IEC… |
CVE-2022-29492 | Medium | 5.3 | 2022-09-14 | Improper Input Validation vulnerability in the handling of a malformed IEC 104 TCP packet in the Hitachi Energy MicroSCADA X SYS600, MicroSCADA Pro SYS600. Upo… |
CVE-2022-1778 | High | 7.5 | 2022-09-14 | Improper Input Validation vulnerability in Hitachi Energy MicroSCADA X SYS600 while reading a specific configuration file causes a buffer-overflow that causes… |
CVE-2022-0029 | Medium | 5.5 | 2022-09-14 | An improper link resolution vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local attacker to read files on the system wit… |
CVE-2022-3212 | High | 7.5 | 2022-09-14 | <bytes::Bytes as axum_core::extract::FromRequest>::from_request would not, by default, set a limit for the size of the request body. That meant if a malicious… |
CVE-2022-20364 | High | 7.8 | 2022-09-14 | In sysmmu_unmap of TBD, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additio… |
CVE-2022-20231 | Medium | 6.7 | 2022-09-14 | In smc_intc_request_fiq of arm_gic.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privileg… |
CVE-2022-3202 | High | 7.1 | 2022-09-14 | A NULL pointer dereference flaw in diFree in fs/jfs/inode.c in Journaled File System (JFS)in the Linux kernel. This could allow a local attacker to crash the s… |
CVE-2022-38796 | Medium | 6.1 | 2022-09-14 | A Host Header Injection vulnerability in Feehi CMS 2.1.1 may allow an attacker to spoof a particular header. This can be exploited by abusing password reset em… |
CVE-2022-22520 | Medium | 5.3 | 2022-09-14 | A remote, unauthenticated attacker can enumerate valid users by sending specific requests to the webservice of MB connect line mymbCONNECT24, mbCONNECT24 and H… |
CVE-2022-37661 | Critical | 9.8 | 2022-09-14 | SmartRG SR506n 2.5.15 and SR510n 2.6.13 routers are vulnerable to Remote Code Execution (RCE) via the ping host feature. |
CVE-2022-40674 | High | 8.1 | 2022-09-14 | libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c. |
CVE-2022-40673 | High | 7.8 | 2022-09-14 | KDiskMark before 3.1.0 lacks authorization checking for D-Bus methods such as Helper::flushPageCache. |
CVE-2022-40626 | Medium | 4.8 | 2022-09-14 | An unauthenticated user can create a link with reflected Javascript code inside the backurl parameter and send it to other authenticated users in order to crea… |
CVE-2022-37140 | High | 8.0 | 2022-09-14 | PayMoney 3.3 is vulnerable to Client Side Remote Code Execution (RCE). The vulnerability exists on the reply ticket function and upload the malicious file. A c… |
CVE-2022-37139 | Medium | 5.4 | 2022-09-14 | Loan Management System version 1.0 suffers from a persistent cross site scripting vulnerability. |
CVE-2022-37138 | Critical | 9.8 | 2022-09-14 | Loan Management System 1.0 is vulnerable to SQL Injection at the login page, which allows unauthorized users to login as Administrator after injecting username… |
CVE-2022-37137 | Medium | 5.4 | 2022-09-14 | PayMoney 3.3 is vulnerable to Stored Cross-Site Scripting (XSS) during replying the ticket. The XSS can be obtain from injecting under "Message" field with "de… |
CVE-2022-36669 | Critical | 9.8 | 2022-09-14 | Hospital Information System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass. |
CVE-2022-36668 | Medium | 5.4 | 2022-09-14 | Garage Management System 1.0 is vulnerable to Stored Cross Site Scripting (XSS) on several parameters. The vulnerabilities exist during creating or editing the… |
CVE-2022-36667 | High | 8.8 | 2022-09-14 | Garage Management System 1.0 is vulnerable to the Remote Code Execution (RCE) due to the lack of filtering from the file upload function. The vulnerability exi… |
CVE-2022-36436 | Critical | 9.8 | 2022-09-14 | OSU Open Source Lab VNCAuthProxy through 1.1.1 is affected by an vncap/vnc/protocol.py VNCServerAuthenticator authentication-bypass vulnerability that could al… |
CVE-2022-2900 | Critical | 9.1 | 2022-09-14 | Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 8.1.0. |
CVE-2022-34831 | Critical | 9.8 | 2022-09-14 | An issue was discovered in Keyfactor PrimeKey EJBCA before 7.9.0, related to possible inconsistencies in DNS identifiers submitted in an ACME order and the cor… |
CVE-2022-38771 | Critical | 9.8 | 2022-09-13 | The mobile application in Transtek Mojodat FAM (Fixed Asset Management) 2.4.6 allows remote attackers to send SCRIPT tags as injected input to the API request. |
CVE-2022-38770 | Medium | 5.3 | 2022-09-13 | The mobile application in Transtek Mojodat FAM (Fixed Asset Management) 2.4.6 allows remote attackers to fetch other users' data upon a successful login reques… |
CVE-2022-38769 | High | 7.5 | 2022-09-13 | The mobile application in Transtek Mojodat FAM (Fixed Asset Management) 2.4.6 allows remote attackers to fetch cleartext passwords upon a successful login requ… |