2022 CVEs (page 140)
Page 140 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-38610 | High | 7.2 | 2022-09-12 | Garage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /garage/editclient.php. |
CVE-2022-38606 | High | 7.2 | 2022-09-12 | Garage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /garage/editcategory.php. |
CVE-2022-38605 | High | 7.2 | 2022-09-12 | Church Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/edit_event.php. |
CVE-2022-38296 | Critical | 9.8 | 2022-09-12 | Cuppa CMS v1.0 was discovered to contain an arbitrary file upload vulnerability via the File Manager. |
CVE-2022-38295 | Medium | 6.1 | 2022-09-12 | Cuppa CMS v1.0 was discovered to contain a cross-site scripting vulnerability at /table_manager/view/cu_user_groups. This vulnerability allows attackers to exe… |
CVE-2022-38292 | Critical | 9.8 | 2022-09-12 | SLiMS Senayan Library Management System v9.4.2 was discovered to contain multiple Server-Side Request Forgeries via the components /bibliography/marcsru.php an… |
CVE-2022-38291 | Medium | 6.1 | 2022-09-12 | SLiMS Senayan Library Management System v9.4.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Search function. This vulnerability… |
CVE-2022-38135 | Medium | 5.4 | 2022-09-12 | Broken Access Control vulnerability in Dean Oakley's Photospace Gallery plugin <= 2.3.5 at WordPress allows users with subscriber or higher role to change plug… |
CVE-2022-36174 | High | 8.1 | 2022-09-12 | FreshService Windows Agent < 2.11.0 and FreshService macOS Agent < 4.2.0 and FreshService Linux Agent < 3.3.0. are vulnerable to Broken integrity checking via… |
CVE-2022-36173 | High | 8.1 | 2022-09-12 | FreshService macOS Agent < 4.4.0 and FreshServce Linux Agent < 3.4.0 are vulnerable to TLS Man-in-The-Middle via the FreshAgent client and scheduled update ser… |
CVE-2022-2979 | High | 7.8 | 2022-09-12 | Opening a specially crafted file could cause the affected product to fail to release its memory reference potentially resulting in arbitrary code execution. |
CVE-2022-29490 | High | 8.5 | 2022-09-12 | Improper Authorization vulnerability exists in the Workplace X WebUI of the Hitachi Energy MicroSCADA X SYS600 allows an authenticated user to execute any Micr… |
CVE-2022-39200 | High | 7.3 | 2022-09-12 | Dendrite is a Matrix homeserver written in Go. In affected versions events retrieved from a remote homeserver using the `/get_missing_events` path did not have… |
CVE-2022-36102 | Medium | 6.3 | 2022-09-12 | Shopware is an open source e-commerce software. In affected versions if backend admin controllers are called with a certain notation, the ACL could be bypassed… |
CVE-2022-36101 | Medium | 5.4 | 2022-09-12 | Shopware is an open source e-commerce software. In affected versions the request for the customer detail view in the backend administration contained sensitive… |
CVE-2022-31226 | High | 7.1 | 2022-09-12 | Dell BIOS versions contain a Stack-based Buffer Overflow vulnerability. A local authenticated malicious user could potentially exploit this vulnerability by se… |
CVE-2022-31225 | Low | 3.0 | 2022-09-12 | Dell BIOS versions contain an Unchecked Return Value vulnerability. A local authenticated administrator user could potentially exploit this vulnerability in or… |
CVE-2022-31224 | Low | 2.0 | 2022-09-12 | Dell BIOS versions contain an Improper Protection Against Voltage and Clock Glitches vulnerability. An attacker with physical access to the system could potent… |
CVE-2022-31223 | Low | 2.3 | 2022-09-12 | Dell BIOS versions contain an Improper Neutralization of Null Byte vulnerability. A local authenticated administrator user could potentially exploit this vulne… |
CVE-2022-31222 | Low | 2.3 | 2022-09-12 | Dell BIOS versions contain a Missing Release of Resource after Effective Lifetime vulnerability. A local authenticated administrator user could potentially exp… |
CVE-2022-31221 | Low | 2.3 | 2022-09-12 | Dell BIOS versions contain an Information Exposure vulnerability. A local authenticated administrator user could potentially exploit this vulnerability in orde… |
CVE-2022-31220 | Low | 3.0 | 2022-09-12 | Dell BIOS versions contain an Unchecked Return Value vulnerability. A local authenticated administrator user could potentially exploit this vulnerability in or… |
CVE-2022-1700 | High | 7.5 | 2022-09-12 | Improper Restriction of XML External Entity Reference ('XXE') vulnerability in the Policy Engine of Forcepoint Data Loss Prevention (DLP), which is also levera… |
CVE-2022-37860 | Critical | 9.8 | 2022-09-12 | The web configuration interface of the TP-Link M7350 V3 with firmware version 190531 is affected by a pre-authentication command injection vulnerability. |
CVE-2022-37300 | Critical | 9.8 | 2022-09-12 | A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists that could cause unauthorized access in read and write mode to the cont… |
CVE-2022-3178 | High | 7.8 | 2022-09-12 | Buffer Over-read in GitHub repository gpac/gpac prior to 2.1.0-DEV. |
CVE-2022-37797 | High | 7.5 | 2022-09-12 | In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null… |
CVE-2022-37767 | Critical | 9.8 | 2022-09-12 | Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok. NOTE: the vendor disputes this… |
CVE-2022-37734 | High | 7.5 | 2022-09-12 | graphql-java before19.0 is vulnerable to Denial of Service. An attacker can send a malicious GraphQL query that consumes CPU resources. The fixed versions are… |
CVE-2022-37835 | High | 7.5 | 2022-09-12 | Torguard VPN 4.8, has a vulnerability that allows an attacker to dump sensitive information, such as credentials and information about the server, without admi… |
CVE-2022-36259 | High | 7.5 | 2022-09-12 | A SQL injection vulnerability in ConnectionFactory.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via the pa… |
CVE-2022-36258 | High | 7.5 | 2022-09-12 | A SQL injection vulnerability in CustomerDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via the paramete… |
CVE-2022-36257 | High | 7.5 | 2022-09-12 | A SQL injection vulnerability in UserDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via the parameters s… |
CVE-2022-36256 | High | 7.5 | 2022-09-12 | A SQL injection vulnerability in Stocks.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via the parameters su… |
CVE-2022-36255 | High | 7.5 | 2022-09-12 | A SQL injection vulnerability in SupplierDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via the paramete… |
CVE-2022-36254 | Medium | 5.4 | 2022-09-12 | Multiple persistent cross-site scripting (XSS) vulnerabilities in index.php in tramyardg Hotel Management System 1.0 allow remote attackers to inject arbitrary… |
CVE-2022-34110 | Medium | 5.5 | 2022-09-12 | An issue in Micro-Star International MSI Feature Navigator v1.0.1808.0901 allows attackers to download arbitrary files regardless of file type or size. |
CVE-2022-34109 | High | 7.1 | 2022-09-12 | An issue in Micro-Star International MSI Feature Navigator v1.0.1808.0901 allows attackers to write arbitrary files to the directory \PromoPhoto\, regardless o… |
CVE-2022-34108 | High | 7.1 | 2022-09-12 | An issue in the Feature Navigator of Micro-Star International MSI Feature Nagivator v1.0.1808.0901 allows attackers to cause a Denial of Service (DoS) via a cr… |
CVE-2022-38972 | Medium | 6.1 | 2022-09-12 | Cross-site scripting vulnerability in Movable Type plugin A-Form versions prior to 4.1.1 (for Movable Type 7 Series) and versions prior to 3.9.1 (for Movable T… |
CVE-2022-37796 | Medium | 5.4 | 2022-09-12 | In Simple Online Book Store System 1.0 in /admin_book.php the Title, Author, and Description parameters are vulnerable to Cross Site Scripting(XSS). |
CVE-2022-37794 | Critical | 9.8 | 2022-09-12 | In Library Management System 1.0 the /card/in-card.php file id_no parameters are vulnerable to SQL injection. |
CVE-2022-40325 | Medium | 6.1 | 2022-09-11 | SysAid Help Desk before 22.1.65 allows XSS via the Asset Dashboard, aka FR# 67262. |
CVE-2022-40324 | Medium | 6.1 | 2022-09-11 | SysAid Help Desk before 22.1.65 allows XSS via the Linked SRs field, aka FR# 67258. |
CVE-2022-40323 | Medium | 6.1 | 2022-09-11 | SysAid Help Desk before 22.1.65 allows XSS in the Password Services module, aka FR# 67241. |
CVE-2022-40322 | Medium | 6.1 | 2022-09-11 | SysAid Help Desk before 22.1.65 allows XSS, aka FR# 66542 and 65579. |
CVE-2022-26049 | Medium | 5.3 | 2022-09-11 | This affects the package com.diffplug.gradle:goomph before 3.37.2. It allows a malicious zip file to potentially break out of the expected destination director… |
CVE-2022-25295 | Medium | 5.4 | 2022-09-11 | This affects the package github.com/gophish/gophish before 0.12.0. The Open Redirect vulnerability exists in the next query parameter. The application uses url… |
CVE-2022-39135 | Critical | 9.8 | 2022-09-11 | Apache Calcite 1.22.0 introduced the SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM and EXTRACT_VALUE do not restrict XML External Entity references in… |
CVE-2022-38266 | Medium | 6.5 | 2022-09-09 | An issue in the Leptonica linked library (v1.79.0) allows attackers to cause an arithmetic exception leading to a Denial of Service (DoS) via a crafted JPEG fi… |
CVE-2022-40320 | High | 8.8 | 2022-09-09 | cfg_tilde_expand in confuse.c in libConfuse 3.3 has a heap-based buffer over-read. |
CVE-2022-36087 | Medium | 5.7 | 2022-09-09 | OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing malicious redir… |
CVE-2022-38638 | Critical | 9.1 | 2022-09-09 | Casdoor v1.97.3 was discovered to contain an arbitrary file write vulnerability via the fullFilePath parameter at /api/upload-resource. |
CVE-2022-36110 | High | 8.8 | 2022-09-09 | Netmaker makes networks with WireGuard. Prior to version 0.15.1, Improper Authorization functions lead to non-privileged users running privileged API calls. If… |
CVE-2022-38639 | Medium | 5.4 | 2022-09-09 | A cross-site scripting (XSS) vulnerability in Markdown-Nice v1.8.22 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected in… |
CVE-2022-31006 | High | 7.5 | 2022-09-09 | indy-node is the server portion of Hyperledger Indy, a distributed ledger purpose-built for decentralized identity. In vulnerable versions of indy-node, an att… |
CVE-2022-3133 | High | 7.8 | 2022-09-09 | OS Command Injection in GitHub repository jgraph/drawio prior to 20.3.0. |
CVE-2022-36109 | Medium | 5.3 | 2022-09-09 | Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where supplementary groups are no… |
CVE-2022-40317 | Medium | 5.4 | 2022-09-09 | OpenKM 6.3.11 allows stored XSS related to the javascript: substring in an A element. |
CVE-2022-39810 | Medium | 6.1 | 2022-09-09 | An issue was discovered in WSO2 Enterprise Integrator 6.4.0. A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Management Console… |
CVE-2022-39809 | Medium | 6.1 | 2022-09-09 | An issue was discovered in WSO2 Enterprise Integrator 6.4.0. A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Management Console… |
CVE-2022-38615 | High | 8.8 | 2022-09-09 | SmartVista SVFE2 v2.2.22 was discovered to contain multiple SQL injection vulnerabilities via the UserForm:j_id88, UserForm:j_id90, and UserForm:j_id92 paramet… |
CVE-2022-38614 | High | 7.5 | 2022-09-09 | An issue in the IGB Files and OutfileService features of SmartVista Cardgen v3.28.0 allows attackers to list and download arbitrary files via modifying the PAT… |
CVE-2022-38613 | Medium | 6.5 | 2022-09-09 | A Path Traversal vulnerability in SmartVista Cardgen v3.28.0 allows authenticated attackers to read arbitrary files in the system. |
CVE-2022-36617 | Medium | 4.9 | 2022-09-09 | Arq Backup 7.19.5.0 and below stores backup encryption passwords using reversible encryption. This issue allows attackers with administrative privileges to rec… |
CVE-2022-34165 | Medium | 5.4 | 2022-09-09 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.9 are vulnerable to HTTP header in… |
CVE-2022-28742 | High | 7.5 | 2022-09-09 | aEnrich eHRD Learning Management Key Performance Indicator System 5+ has Improper Access Control. The web application does not validate user session when acces… |
CVE-2022-28741 | High | 8.1 | 2022-09-09 | aEnrich a+HRD 5.x Learning Management Key Performance Indicator System has a local file inclusion (LFI) vulnerability that occurs due to missing input validati… |
CVE-2022-28740 | High | 7.5 | 2022-09-09 | aEnrich eHRD Learning Management Key Performance Indicator System 5+ exposes Sensitive Information to an Unauthorized Actor. |
CVE-2022-40191 | Medium | 5.4 | 2022-09-09 | Authenticated (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in Ali Khallad's Contact Form By Mega Forms plugin <= 1.2.4 at WordPress. |
CVE-2022-40133 | Medium | 6.3 | 2022-09-09 | A use-after-free(UAF) vulnerability was found in function 'vmw_execbuf_tie_context' in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in Linux kernel's vmwgfx driver with… |
CVE-2022-3169 | Medium | 5.5 | 2022-09-09 | A flaw was found in the Linux kernel. A denial of service flaw may occur if there is a consecutive request of the NVME_IOCTL_RESET and the NVME_IOCTL_SUBSYS_RE… |
CVE-2022-3147 | Low | 3.1 | 2022-09-09 | Mattermost version 7.0.x and earlier fails to sufficiently limit the in-memory sizes of concurrently uploaded JPEG images, which allows authenticated users to… |
CVE-2022-3077 | Medium | 5.5 | 2022-09-09 | A buffer overflow vulnerability was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way it handled the I2C_SMBUS_BLOCK_PROC_CALL cas… |
CVE-2022-39846 | Medium | 6.2 | 2022-09-09 | DLL hijacking vulnerability in Smart Switch PC prior to version 4.3.22083_3 allows attacker to execute arbitrary code. |
CVE-2022-39845 | Medium | 5.5 | 2022-09-09 | Improper validation of integrity check vulnerability in Samsung Kies prior to version 2.6.4.22074 allows local attackers to delete arbitrary directory using di… |
CVE-2022-39844 | Medium | 5.5 | 2022-09-09 | Improper validation of integrity check vulnerability in Smart Switch PC prior to version 4.3.22083 allows local attackers to delete arbitrary directory using d… |
CVE-2022-39119 | High | 7.8 | 2022-09-09 | In network service, there is a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed |
CVE-2022-38701 | Medium | 6.2 | 2022-09-09 | OpenHarmony-v3.1.2 and prior versions have a heap overflow vulnerability. Local attackers can trigger a heap overflow and get network sensitive information. |
CVE-2022-38700 | High | 8.8 | 2022-09-09 | OpenHarmony-v3.1.1 and prior versions have a permission bypass vulnerability. LAN attackers can bypass permission control and get control of camera service. |
CVE-2022-38457 | Medium | 6.3 | 2022-09-09 | A use-after-free(UAF) vulnerability was found in function 'vmw_cmd_res_check' in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in Linux kernel's vmwgfx driver with devic… |
CVE-2022-38144 | High | 8.8 | 2022-09-09 | Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 at WordPress. |
CVE-2022-38096 | Medium | 6.3 | 2022-09-09 | A NULL pointer dereference vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file '/… |
CVE-2022-38093 | Medium | 5.4 | 2022-09-09 | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in All in One SEO plugin <= 4.2.3.1 at WordPress. |
CVE-2022-38081 | Medium | 6.2 | 2022-09-09 | OpenHarmony-v3.1.2 and prior versions have a permission bypass vulnerability. LAN attackers can bypass the distributed permission control.To take advantage of… |
CVE-2022-38070 | Medium | 5.4 | 2022-09-09 | Privilege Escalation (subscriber+) vulnerability in Pop-up plugin <= 1.1.5 at WordPress. |
CVE-2022-38068 | Medium | 4.8 | 2022-09-09 | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Apasionados Export Post Info plugin <= 1.1.0 at WordPress. |
CVE-2022-38067 | Medium | 6.5 | 2022-09-09 | Unauthenticated Event Deletion vulnerability in Totalsoft Event Calendar – Calendar plugin <= 1.4.6 at WordPress. |
CVE-2022-38064 | Medium | 6.2 | 2022-09-09 | OpenHarmony-v3.1.2 and prior versions have a permission bypass vulnerability. Local attackers can bypass permission control and get sensitive information. |
CVE-2022-38059 | Medium | 5.5 | 2022-09-09 | Cross-Site Request Forgery (CSRF) vulnerability in Alexey Trofimov's Access Code Feeder plugin <= 1.0.3 at WordPress. |
CVE-2022-38058 | Medium | 4.3 | 2022-09-09 | Authenticated (subscriber+) Plugin Setting change vulnerability in WP Shamsi plugin <= 4.1.1 at WordPress. |
CVE-2022-37412 | Medium | 4.8 | 2022-09-09 | Authenticated (admin+) Reflected Cross-Site Scripting (XSS) vulnerability in Galerio & Urda's Better Delete Revision plugin <= 1.6.1 at WordPress. |
CVE-2022-37411 | Medium | 5.4 | 2022-09-09 | Cross-Site Request Forgery (CSRF) vulnerability in Vinoj Cardoza's Captcha Code plugin <= 2.7 at WordPress. |
CVE-2022-37407 | Medium | 4.1 | 2022-09-09 | Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in WPChill Gallery PhotoBlocks plugin <= 1.2.6 at WordPress. |
CVE-2022-37405 | Medium | 4.3 | 2022-09-09 | Cross-Site Request Forgery (CSRF) vulnerability in Mickey Kay's Better Font Awesome plugin <= 2.0.1 at WordPress. |
CVE-2022-37404 | Medium | 4.8 | 2022-09-09 | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Christian Salazar's add2fav plugin <= 1.0 at WordPress. |
CVE-2022-37403 | Medium | 4.8 | 2022-09-09 | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Nikhil Vaghela's Add User Role plugin <= 0.0.1 at WordPress. |
CVE-2022-37335 | Medium | 4.8 | 2022-09-09 | Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in WHA's Word Search Puzzles game plugin <= 2.0.1 at WordPress. |
CVE-2022-37299 | Medium | 6.5 | 2022-09-09 | An issue was discovered in Shirne CMS 1.2.0. There is a Path Traversal vulnerability which could cause arbitrary file read via /static/ueditor/php/controller.p… |
CVE-2022-36878 | Low | 3.3 | 2022-09-09 | Exposure of Sensitive Information in Find My Mobile prior to version 7.2.25.14 allows local attacker to access IMEI via log. |