2022 CVEs (page 138)
Page 138 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-38768 | Critical | 9.8 | 2022-09-13 | The mobile application in Transtek Mojodat FAM (Fixed Asset Management) 2.4.6 allows remote attackers to bypass authorization. |
CVE-2022-38305 | High | 8.8 | 2022-09-13 | AeroCMS v0.0.1 was discovered to contain an arbitrary file upload vulnerability via the component /admin/profile.php. This vulnerability allows attackers to ex… |
CVE-2022-37191 | Medium | 6.5 | 2022-09-13 | The component "cuppa/api/index.php" of CuppaCMS v1.0 is Vulnerable to LFI. An authenticated user can read system files via crafted POST request using [function… |
CVE-2022-37190 | High | 8.8 | 2022-09-13 | CuppaCMS 1.0 is vulnerable to Remote Code Execution (RCE). An authenticated user can control both parameters (action and function) from "/api/index.php. |
CVE-2022-38633 | High | 7.8 | 2022-09-13 | Genymotion Desktop v3.2.1 was discovered to contain a DLL hijacking vulnerability which allows attackers to escalate privileges and execute arbitrary code via… |
CVE-2022-35582 | High | 8.8 | 2022-09-13 | Penta Security Systems Inc WAPPLES 4.0.*, 5.0.0.*, 5.0.12.* are vulnerable to Incorrect Access Control. The operating system that WAPPLES runs on has a built-i… |
CVE-2022-35413 | Critical | 9.8 | 2022-09-13 | WAPPLES through 6.0 has a hardcoded systemi account. A threat actor could use this account to access the system configuration and confidential information (suc… |
CVE-2022-34102 | High | 8.8 | 2022-09-13 | Insufficient access control vulnerability was discovered in the Crestron AirMedia Windows Application, version 4.3.1.39, in which a user can pause the uninstal… |
CVE-2022-34101 | High | 7.8 | 2022-09-13 | A vulnerability was discovered in the Crestron AirMedia Windows Application, version 4.3.1.39, in which a user can place a malicious DLL in a certain path to e… |
CVE-2022-31861 | Medium | 5.4 | 2022-09-13 | Cross site Scripting (XSS) in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being sent to the audit logs. |
CVE-2022-31324 | Medium | 6.5 | 2022-09-13 | An arbitrary file download vulnerability in the downloadAction() function of Penta Security Systems Inc WAPPLES v6.0 r3 4.10-hotfix1 allows attackers to downlo… |
CVE-2022-31322 | High | 7.8 | 2022-09-13 | Penta Security Systems Inc WAPPLES v6.0 r3 4.10-hotfix1 allows attackers to escalate privileges via overwriting files using SUID flagged executables. |
CVE-2022-40623 | High | 8.8 | 2022-09-13 | The WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 does not utilize anti-CSRF tokens, which, when combined with other issues (such a… |
CVE-2022-40622 | High | 8.8 | 2022-09-13 | The WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 uses IP addresses to hold sessions and does not not use session tokens. Therefore… |
CVE-2022-40621 | High | 7.5 | 2022-09-13 | Because the WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 and earlier communicates over HTTP and not HTTPS, and because the hashing… |
CVE-2022-39821 | High | 7.5 | 2022-09-13 | In NOKIA 1350 OMS R14.2, an Insertion of Sensitive Information into an Application Log File vulnerability occurs. The web application stores critical informati… |
CVE-2022-39819 | High | 8.8 | 2022-09-13 | In NOKIA 1350 OMS R14.2, multiple OS Command Injection vulnerabilities occurs. This allows authenticated users to execute commands on the operating system. |
CVE-2022-39817 | High | 8.8 | 2022-09-13 | In NOKIA 1350 OMS R14.2, multiple SQL Injection vulnerabilities occurs. Exploitation requires an authenticated attacker. Through the injection of arbitrary SQL… |
CVE-2022-39816 | Medium | 6.5 | 2022-09-13 | In NOKIA 1350 OMS R14.2, Insufficiently Protected Credentials (cleartext administrator password) occur in the edit configuration page. Exploitation requires an… |
CVE-2022-39815 | Critical | 9.8 | 2022-09-13 | In NOKIA 1350 OMS R14.2, multiple OS Command Injection vulnerabilities occurs. This vulnerability allow unauthenticated users to execute commands on the operat… |
CVE-2022-39814 | Medium | 6.1 | 2022-09-13 | In NOKIA 1350 OMS R14.2, an Open Redirect vulnerability occurs is the login page via next HTTP GET parameter. |
CVE-2022-38637 | Critical | 9.8 | 2022-09-13 | Hospital Management System v1.0 was discovered to contain multiple SQL injection vulnerabilities via the Username and Password parameters on the Login page. |
CVE-2022-38497 | Medium | 5.5 | 2022-09-13 | LIEF commit 365a16a was discovered to contain a segmentation violation via the component CoreFile.tcc:69. |
CVE-2022-38496 | Medium | 5.5 | 2022-09-13 | LIEF commit 365a16a was discovered to contain a reachable assertion abort via the component BinaryStream.hpp. |
CVE-2022-38495 | High | 7.8 | 2022-09-13 | LIEF commit 365a16a was discovered to contain a heap-buffer overflow via the function print_binary at /c/macho_reader.c. |
CVE-2022-38329 | Medium | 4.3 | 2022-09-13 | A CSRF vulnerability in Shopxian CMS 3.0.0 could allow an unauthenticated, remote attacker to craft a malicious link, potentially causing the administrator to… |
CVE-2022-38307 | Medium | 5.5 | 2022-09-13 | LIEF commit 5d1d643 was discovered to contain a segmentation violation via the function LIEF::MachO::SegmentCommand::file_offset() at /MachO/SegmentCommand.cpp. |
CVE-2022-38306 | High | 7.8 | 2022-09-13 | LIEF commit 5d1d643 was discovered to contain a heap-buffer overflow in the component /core/CorePrPsInfo.tcc. |
CVE-2022-36768 | High | 7.8 | 2022-09-13 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout command to obtain root privileges. IBM X… |
CVE-2022-35637 | Medium | 6.5 | 2022-09-13 | IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a denial of service after entering a malformed SQL statement into the Db2e… |
CVE-2022-34356 | High | 7.8 | 2022-09-13 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to obtain root privileges. IBM X-Force… |
CVE-2022-34336 | Medium | 5.4 | 2022-09-13 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript co… |
CVE-2022-22483 | Medium | 6.5 | 2022-09-13 | IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to an information disclosure in some scenarios due to unauthorized access cau… |
CVE-2022-22330 | Medium | 5.3 | 2022-09-13 | IBM Control Desk 7.6.1 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could e… |
CVE-2022-22329 | Medium | 4.3 | 2022-09-13 | IBM Control Desk 7.6.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending… |
CVE-2022-3205 | Medium | 4.6 | 2022-09-13 | Cross site scripting in automation controller UI in Red Hat Ansible Automation Platform 1.2 and 2.0 where the project name is susceptible to XSS injection |
CVE-2022-3182 | High | 7.0 | 2022-09-13 | Improper Access Control vulnerability in the Duo SMS two-factor of Devolutions Remote Desktop Manager 2022.2.14 and earlier allows attackers to bypass the appl… |
CVE-2022-38342 | High | 8.5 | 2022-09-13 | Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a XML External Entity (XXE) vulnerability which allows authenticated attack… |
CVE-2022-37703 | Low | 3.3 | 2022-09-13 | In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An attacker can abuse this vulnerability to know if a directory exist… |
CVE-2022-32555 | High | 8.8 | 2022-09-13 | Unisys Data Exchange Management Studio before 6.0.IC2 and 7.x before 7.0.IC1 doesn't have an Anti-CSRF token to authenticate the POST request. Thus, a cross-si… |
CVE-2022-32244 | Medium | 5.2 | 2022-09-13 | Under certain conditions an attacker authenticated as a CMS administrator access the BOE Commentary database and retrieve (non-personal) system data, modify sy… |
CVE-2022-2962 | High | 7.8 | 2022-09-13 | A DMA reentrancy issue was found in the Tulip device emulation in QEMU. When Tulip reads or writes to the rx/tx descriptor or copies the rx/tx frame, it doesn'… |
CVE-2022-20399 | Medium | 5.5 | 2022-09-13 | In the SEPolicy configuration of system apps, there is a possible access to the 'ip' utility due to an insecure default value. This could lead to local informa… |
CVE-2022-20398 | High | 7.8 | 2022-09-13 | In addOrUpdateNetwork of WifiServiceImpl.java, there is a possible way for a guest user to configure Wi-Fi due to a permissions bypass. This could lead to loca… |
CVE-2022-20396 | Medium | 5.5 | 2022-09-13 | In SettingsActivity.java, there is a possible way to make a device discoverable over Bluetooth, without permission or user interaction, due to a permissions by… |
CVE-2022-20395 | High | 7.8 | 2022-09-13 | In checkAccess of MediaProvider.java, there is a possible file deletion due to a path traversal error. This could lead to local escalation of privilege with no… |
CVE-2022-20393 | Medium | 5.5 | 2022-09-13 | In extract3GPPGlobalDescriptions of TextDescriptions.cpp, there is a possible out of bounds read due to an integer overflow. This could lead to local informati… |
CVE-2022-20392 | High | 7.8 | 2022-09-13 | In declareDuplicatePermission of ParsedPermissionUtils.java, there is a possible way to obtain a dangerous permission without user consent due to improper inpu… |
CVE-2022-20391 | Critical | 9.8 | 2022-09-13 | Summary:Product: AndroidVersions: Android SoCAndroid ID: A-238257000 |
CVE-2022-20390 | Critical | 9.8 | 2022-09-13 | Summary:Product: AndroidVersions: Android SoCAndroid ID: A-238257002 |
CVE-2022-20389 | Critical | 9.8 | 2022-09-13 | Summary:Product: AndroidVersions: Android SoCAndroid ID: A-238257004 |
CVE-2022-20388 | Critical | 9.8 | 2022-09-13 | Summary:Product: AndroidVersions: Android SoCAndroid ID: A-238227323 |
CVE-2022-20387 | Critical | 9.8 | 2022-09-13 | Summary:Product: AndroidVersions: Android SoCAndroid ID: A-238227324 |
CVE-2022-20386 | Critical | 9.8 | 2022-09-13 | Summary:Product: AndroidVersions: Android SoCAndroid ID: A-238227328 |
CVE-2022-20385 | Critical | 9.8 | 2022-09-13 | a function called 'nla_parse', do not check the len of para, it will check nla_type (which can be controlled by userspace) with 'maxtype' (in this case, it is… |
CVE-2022-40635 | Medium | 6.4 | 2022-09-13 | Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands vi… |
CVE-2022-40634 | Medium | 6.4 | 2022-09-13 | Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands vi… |
CVE-2022-39208 | High | 7.5 | 2022-09-13 | Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. All files in the /opt/onedev/sites/ directory are exposed and can be read by unauthenti… |
CVE-2022-39207 | Medium | 5.4 | 2022-09-13 | Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. During CI/CD builds, it is possible to save build artifacts for later retrieval. They c… |
CVE-2022-39206 | Critical | 9.9 | 2022-09-13 | Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. When using Docker-based job executors, the Docker socket (e.g. /var/run/docker.sock on… |
CVE-2022-39205 | Critical | 9.0 | 2022-09-13 | Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. In versions of Onedev prior to 7.3.0 unauthenticated users can take over a OneDev insta… |
CVE-2022-39203 | High | 8.8 | 2022-09-13 | matrix-appservice-irc is an open source Node.js IRC bridge for Matrix. Attackers can specify a specific string of characters, which would confuse the bridge in… |
CVE-2022-38020 | High | 7.3 | 2022-09-13 | Visual Studio Code Elevation of Privilege Vulnerability |
CVE-2022-38019 | High | 7.8 | 2022-09-13 | AV1 Video Extension Remote Code Execution Vulnerability |
CVE-2022-38013 | High | 7.5 | 2022-09-13 | .NET Core and Visual Studio Denial of Service Vulnerability |
CVE-2022-38012 | High | 7.7 | 2022-09-13 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2022-38011 | High | 7.3 | 2022-09-13 | Raw Image Extension Remote Code Execution Vulnerability |
CVE-2022-38010 | High | 7.8 | 2022-09-13 | Microsoft Office Visio Remote Code Execution Vulnerability |
CVE-2022-38009 | High | 8.8 | 2022-09-13 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2022-38008 | High | 8.8 | 2022-09-13 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2022-38007 | High | 7.8 | 2022-09-13 | Azure Guest Configuration and Azure Arc-enabled servers Elevation of Privilege Vulnerability |
CVE-2022-38006 | Medium | 6.5 | 2022-09-13 | Windows Graphics Component Information Disclosure Vulnerability |
CVE-2022-38005 | High | 7.8 | 2022-09-13 | Windows Print Spooler Elevation of Privilege Vulnerability |
CVE-2022-38004 | High | 7.8 | 2022-09-13 | Windows Fax Service Remote Code Execution Vulnerability |
CVE-2022-37969 | High | 7.8 | 2022-09-13 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
CVE-2022-37964 | High | 7.8 | 2022-09-13 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2022-37963 | High | 7.8 | 2022-09-13 | Microsoft Office Visio Remote Code Execution Vulnerability |
CVE-2022-37962 | High | 7.8 | 2022-09-13 | Microsoft PowerPoint Remote Code Execution Vulnerability |
CVE-2022-37961 | High | 8.8 | 2022-09-13 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2022-37959 | Medium | 6.5 | 2022-09-13 | Network Device Enrollment Service (NDES) Security Feature Bypass Vulnerability |
CVE-2022-37958 | High | 8.1 | 2022-09-13 | SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability |
CVE-2022-37957 | High | 7.8 | 2022-09-13 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2022-37956 | High | 7.8 | 2022-09-13 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2022-37955 | High | 7.8 | 2022-09-13 | Windows Group Policy Elevation of Privilege Vulnerability |
CVE-2022-37954 | High | 7.8 | 2022-09-13 | DirectX Graphics Kernel Elevation of Privilege Vulnerability |
CVE-2022-35841 | High | 8.8 | 2022-09-13 | Windows Enterprise App Management Service Remote Code Execution Vulnerability |
CVE-2022-35840 | High | 8.8 | 2022-09-13 | Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability |
CVE-2022-35838 | High | 7.5 | 2022-09-13 | HTTP V3 Denial of Service Vulnerability |
CVE-2022-35837 | Medium | 6.5 | 2022-09-13 | Windows Graphics Component Information Disclosure Vulnerability |
CVE-2022-35836 | High | 8.8 | 2022-09-13 | Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability |
CVE-2022-35835 | High | 8.8 | 2022-09-13 | Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability |
CVE-2022-35834 | High | 8.8 | 2022-09-13 | Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability |
CVE-2022-35833 | High | 7.5 | 2022-09-13 | Windows Secure Channel Denial of Service Vulnerability |
CVE-2022-35832 | Medium | 5.5 | 2022-09-13 | Windows Event Tracing Denial of Service Vulnerability |
CVE-2022-35831 | Medium | 5.5 | 2022-09-13 | Windows Remote Access Connection Manager Information Disclosure Vulnerability |
CVE-2022-35830 | High | 8.1 | 2022-09-13 | Remote Procedure Call Runtime Remote Code Execution Vulnerability |
CVE-2022-35828 | High | 7.8 | 2022-09-13 | Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability |
CVE-2022-35823 | High | 8.8 | 2022-09-13 | Microsoft SharePoint Remote Code Execution Vulnerability |
CVE-2022-35805 | High | 8.8 | 2022-09-13 | Microsoft Dynamics CRM (on-premises) Remote Code Execution Vulnerability |
CVE-2022-35803 | High | 7.8 | 2022-09-13 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |