2022 CVEs (page 139)
Page 139 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-34734 | High | 8.8 | 2022-09-13 | Microsoft ODBC Driver Remote Code Execution Vulnerability |
CVE-2022-34733 | High | 8.8 | 2022-09-13 | Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability |
CVE-2022-34732 | High | 8.8 | 2022-09-13 | Microsoft ODBC Driver Remote Code Execution Vulnerability |
CVE-2022-34731 | High | 8.8 | 2022-09-13 | Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability |
CVE-2022-34730 | High | 8.8 | 2022-09-13 | Microsoft ODBC Driver Remote Code Execution Vulnerability |
CVE-2022-34729 | High | 7.8 | 2022-09-13 | Windows GDI Elevation of Privilege Vulnerability |
CVE-2022-34728 | Medium | 5.5 | 2022-09-13 | Windows Graphics Component Information Disclosure Vulnerability |
CVE-2022-34727 | High | 8.8 | 2022-09-13 | Microsoft ODBC Driver Remote Code Execution Vulnerability |
CVE-2022-34726 | High | 8.8 | 2022-09-13 | Microsoft ODBC Driver Remote Code Execution Vulnerability |
CVE-2022-34725 | High | 7.0 | 2022-09-13 | Windows ALPC Elevation of Privilege Vulnerability |
CVE-2022-34724 | High | 7.5 | 2022-09-13 | Windows DNS Server Denial of Service Vulnerability |
CVE-2022-34723 | Medium | 5.5 | 2022-09-13 | Windows DPAPI (Data Protection Application Programming Interface) Information Disclosure Vulnerability |
CVE-2022-34722 | Critical | 9.8 | 2022-09-13 | Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability |
CVE-2022-34721 | Critical | 9.8 | 2022-09-13 | Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability |
CVE-2022-34720 | High | 7.5 | 2022-09-13 | Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability |
CVE-2022-34719 | High | 7.8 | 2022-09-13 | Windows Distributed File System (DFS) Elevation of Privilege Vulnerability |
CVE-2022-34718 | Critical | 9.8 | 2022-09-13 | Windows TCP/IP Remote Code Execution Vulnerability |
CVE-2022-34700 | High | 8.8 | 2022-09-13 | Microsoft Dynamics CRM (on-premises) Remote Code Execution Vulnerability |
CVE-2022-34100 | High | 8.8 | 2022-09-13 | A vulnerability was discovered in the Crestron AirMedia Windows Application, version 4.3.1.39, in which a low-privileged user can gain a SYSTEM level command p… |
CVE-2022-33679 | High | 8.1 | 2022-09-13 | Windows Kerberos Elevation of Privilege Vulnerability |
CVE-2022-33647 | High | 8.1 | 2022-09-13 | Windows Kerberos Elevation of Privilege Vulnerability |
CVE-2022-30200 | High | 7.8 | 2022-09-13 | Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability |
CVE-2022-30196 | High | 8.2 | 2022-09-13 | Windows Secure Channel Denial of Service Vulnerability |
CVE-2022-30170 | High | 7.3 | 2022-09-13 | Windows Credential Roaming Service Elevation of Privilege Vulnerability |
CVE-2022-26929 | High | 7.8 | 2022-09-13 | .NET Framework Remote Code Execution Vulnerability |
CVE-2022-26928 | High | 7.0 | 2022-09-13 | Windows Photo Import API Elevation of Privilege Vulnerability |
CVE-2022-39202 | Medium | 4.3 | 2022-09-13 | matrix-appservice-irc is an open source Node.js IRC bridge for Matrix. The Internet Relay Chat (IRC) protocol allows you to specify multiple modes in a single… |
CVE-2022-36108 | Medium | 6.5 | 2022-09-13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the `f:asset.css` view helper is vulner… |
CVE-2022-36107 | Medium | 6.5 | 2022-09-13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the `FileDumpController` (backend and f… |
CVE-2022-36106 | Medium | 5.4 | 2022-09-13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the expiration time of a password reset… |
CVE-2022-36105 | Medium | 5.3 | 2022-09-13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that observing response time during user aut… |
CVE-2022-36104 | Medium | 5.9 | 2022-09-13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions requesting invalid or non-existing resources v… |
CVE-2022-32190 | High | 7.5 | 2022-09-13 | JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https… |
CVE-2022-3179 | High | 8.8 | 2022-09-13 | Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.2. |
CVE-2022-36103 | High | 7.2 | 2022-09-13 | Talos Linux is a Linux distribution built for Kubernetes deployments. Talos worker nodes use a join token to get accepted into the Talos cluster. Due to improp… |
CVE-2022-36020 | Medium | 6.1 | 2022-09-13 | The typo3/html-sanitizer package is an HTML sanitizer, written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and value… |
CVE-2022-3170 | High | 7.8 | 2022-09-13 | An out-of-bounds access issue was found in the Linux kernel sound subsystem. It could occur when the 'id->name' provided by the user did not end with '\0'. A p… |
CVE-2022-3029 | High | 7.5 | 2022-09-13 | In NLnet Labs Routinator 0.9.0 up to and including 0.11.2, due to a mistake in error handling, data in RRDP snapshot and delta files that isn’t correctly base… |
CVE-2022-39801 | High | 7.5 | 2022-09-13 | SAP GRC Access control Emergency Access Management allows an authenticated attacker to access a Firefighter session even after it is closed in Firefighter Logo… |
CVE-2022-39799 | Medium | 6.1 | 2022-09-13 | An attacker with no prior authentication could craft and send malicious script to SAP GUI for HTML within Fiori Launchpad, resulting in reflected cross-site sc… |
CVE-2022-39014 | Medium | 5.3 | 2022-09-13 | Under certain conditions SAP BusinessObjects Business Intelligence Platform Central Management Console (CMC) - version 430, allows an attacker to access certai… |
CVE-2022-35298 | Medium | 6.1 | 2022-09-13 | SAP NetWeaver Enterprise Portal (KMC) - version 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability. KMC… |
CVE-2022-35295 | Medium | 4.9 | 2022-09-13 | In SAP Host Agent (SAPOSCOL) - version 7.22, an attacker may use files created by saposcol to escalate privileges for themselves. |
CVE-2022-35294 | Medium | 5.4 | 2022-09-13 | An attacker with basic business user privileges could craft and upload a malicious file to SAP NetWeaver Application Server ABAP, which is then downloaded and… |
CVE-2022-35292 | High | 7.8 | 2022-09-13 | In SAP Business One application when a service is created, the executable path contains spaces and isn’t enclosed within quotes, leading to a vulnerability kno… |
CVE-2022-3190 | Medium | 6.3 | 2022-09-13 | Infinite loop in the F5 Ethernet Trailer protocol dissector in Wireshark 3.6.0 to 3.6.7 and 3.4.0 to 3.4.15 allows denial of service via packet injection or cr… |
CVE-2022-3027 | Medium | 5.7 | 2022-09-13 | The CMS8000 device does not properly control or sanitize the SSID name of a new Wi-Fi access point. A threat actor could create an SSID with a malicious name… |
CVE-2022-38542 | Critical | 9.8 | 2022-09-13 | Archery v1.4.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the ThreadIDs parameter in the kill_session interface. The project has rel… |
CVE-2022-38541 | Critical | 9.8 | 2022-09-13 | Archery v1.8.3 to v1.8.5 was discovered to contain multiple SQL injection vulnerabilities via the start_time and stop_time parameters in the my2sql interface. |
CVE-2022-38540 | Critical | 9.8 | 2022-09-13 | Archery v1.4.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the ThreadIDs parameter in the create_kill_session interface. |
CVE-2022-38539 | Critical | 9.8 | 2022-09-13 | Archery v1.7.5 to v1.8.5 was discovered to contain a SQL injection vulnerability via the where parameter at /archive/apply. |
CVE-2022-38538 | Critical | 9.8 | 2022-09-13 | Archery v1.7.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the checksum parameter in the report module. |
CVE-2022-38537 | Critical | 9.8 | 2022-09-13 | Archery v1.4.5 to v1.8.5 was discovered to contain multiple SQL injection vulnerabilities via the start_file, end_file, start_time, and stop_time parameters in… |
CVE-2022-38453 | Low | 3.0 | 2022-09-13 | Multiple binary application files on the CMS8000 device are compiled with 'not stripped' and 'debug_info' compilation settings. These compiler settings greatly… |
CVE-2022-38100 | High | 7.5 | 2022-09-13 | The CMS800 device fails while attempting to parse malformed network data sent by a threat actor. A threat actor with network access can remotely issue a specia… |
CVE-2022-38069 | Medium | 4.3 | 2022-09-13 | Multiple globally default credentials exist across all CMS8000 devices, that once exposed, allow a threat actor with momentary physical access to gain privileg… |
CVE-2022-36782 | Medium | 5.9 | 2022-09-13 | Pal Electronics Systems - Pal Gate Authorization Errors. The vulnerability is an authorization problem in PalGate device management android client app. Gates o… |
CVE-2022-36780 | Medium | 4.9 | 2022-09-13 | Avdor CIS - crystal quality Credentials Management Errors. The product is phone call recorder, you can hear all the recorded calls without authenticate to the… |
CVE-2022-36779 | Medium | 6.5 | 2022-09-13 | PROSCEND - PROSCEND / ADVICE .Ltd - G/5G Industrial Cellular Router (with GPS)4 Unauthenticated OS Command Injection Proscend M330-w / M33-W5 / M350-5G / M350-… |
CVE-2022-36778 | Medium | 6.5 | 2022-09-13 | insert HTML / js code inside input how to get to the vulnerable input : Workers > worker nickname > inject in this input the code. |
CVE-2022-36385 | Medium | 6.8 | 2022-09-13 | A threat actor with momentary access to the device can plug in a USB drive and perform a malicious firmware update, resulting in permanent changes to device fu… |
CVE-2022-1602 | Medium | 5.5 | 2022-09-13 | A potential security vulnerability has been identified in HP ThinPro 7.2 Service Pack 8 (SP8). The security vulnerability in SP8 is not remedied after upgradin… |
CVE-2022-38139 | Medium | 5.4 | 2022-09-13 | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in RD Station plugin <= 5.2.0 at WordPress. |
CVE-2022-2990 | High | 7.1 | 2022-09-13 | An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modificat… |
CVE-2022-2989 | High | 7.1 | 2022-09-13 | An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modificati… |
CVE-2022-1278 | High | 7.5 | 2022-09-13 | A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain. |
CVE-2022-38616 | High | 8.8 | 2022-09-13 | SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j_id90 parameter at /feegroups/tgrt_group.jsf. |
CVE-2022-3175 | Medium | 5.3 | 2022-09-13 | Missing Custom Error Page in GitHub repository ikus060/rdiffweb prior to 2.4.2. |
CVE-2022-3174 | High | 7.5 | 2022-09-13 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.2. |
CVE-2022-39158 | Medium | 5.3 | 2022-09-13 | A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RU… |
CVE-2022-39156 | High | 7.8 | 2022-09-13 | A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (Al… |
CVE-2022-39155 | High | 7.8 | 2022-09-13 | A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (Al… |
CVE-2022-39154 | High | 7.8 | 2022-09-13 | A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (Al… |
CVE-2022-39153 | High | 7.8 | 2022-09-13 | A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (Al… |
CVE-2022-39152 | High | 7.8 | 2022-09-13 | A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (Al… |
CVE-2022-39151 | High | 7.8 | 2022-09-13 | A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (Al… |
CVE-2022-39150 | High | 7.8 | 2022-09-13 | A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (Al… |
CVE-2022-39149 | High | 7.8 | 2022-09-13 | A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (Al… |
CVE-2022-39148 | High | 7.8 | 2022-09-13 | A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (Al… |
CVE-2022-39147 | High | 7.8 | 2022-09-13 | A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (Al… |
CVE-2022-39146 | High | 7.8 | 2022-09-13 | A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (Al… |
CVE-2022-39145 | High | 7.8 | 2022-09-13 | A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (Al… |
CVE-2022-39144 | High | 7.8 | 2022-09-13 | A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (Al… |
CVE-2022-39143 | High | 7.8 | 2022-09-13 | A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (Al… |
CVE-2022-39142 | High | 7.8 | 2022-09-13 | A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (Al… |
CVE-2022-39141 | High | 7.8 | 2022-09-13 | A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions <… |
CVE-2022-39140 | High | 7.8 | 2022-09-13 | A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions <… |
CVE-2022-39139 | High | 7.8 | 2022-09-13 | A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions <… |
CVE-2022-39138 | High | 7.8 | 2022-09-13 | A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions <… |
CVE-2022-39137 | High | 7.8 | 2022-09-13 | A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions <… |
CVE-2022-38466 | High | 7.8 | 2022-09-13 | A vulnerability has been identified in CoreShield One-Way Gateway (OWG) Software (All versions < V2.2). The default installation sets insecure file permissions… |
CVE-2022-37302 | Medium | 5.5 | 2022-09-13 | A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a crash of the Control Expert software… |
CVE-2022-37011 | Critical | 9.8 | 2022-09-13 | A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions < V1.17.0), Mendix SAML (Mendix 8 compatible) (All versions < V2.3.0), M… |
CVE-2022-38304 | High | 7.2 | 2022-09-12 | Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /maintenance/manage_leave_type.php. |
CVE-2022-38303 | High | 7.2 | 2022-09-12 | Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /employees/manage_leave_type.php. |
CVE-2022-38302 | High | 7.2 | 2022-09-12 | Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /maintenance/manage_department.php. |
CVE-2022-38297 | Critical | 9.8 | 2022-09-12 | UCMS v1.6.0 contains an authentication bypass vulnerability which is exploited via cookie poisoning. |
CVE-2022-38299 | Medium | 4.3 | 2022-09-12 | An issue in the Elasticsearch plugin of Appsmith v1.7.11 allows attackers to connect disallowed hosts to the AWS/GCP internal metadata endpoint. |
CVE-2022-38298 | High | 8.8 | 2022-09-12 | Appsmith v1.7.11 was discovered to allow attackers to execute an authenticated Server-Side Request Forgery (SSRF) via redirecting incoming requests to the AWS… |
CVE-2022-35572 | High | 7.5 | 2022-09-12 | On Linksys E5350 WiFi Router with firmware version 1.0.00.037 and lower, (and potentially other vendors/devices due to code reuse), the /SysInfo.htm URI does n… |