2022 CVEs (page 141)
Page 141 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-36877 | Low | 2.8 | 2022-09-09 | Exposure of Sensitive Information in FaqSymptomCardViewModel in Samsung Members prior to versions 4.3.00.11 in Global and 14.0.02.4 in China allows local attac… |
CVE-2022-36876 | Low | 1.8 | 2022-09-09 | Improper authorization in UPI payment in Samsung Pass prior to version 4.0.04.10 allows physical attackers to access account list without authentication. |
CVE-2022-36875 | Medium | 6.6 | 2022-09-09 | Improper restriction of broadcasting Intent in SaWebViewRelayActivity of?Waterplugin prior to version 2.2.11.22081151 allows attacker to access the file withou… |
CVE-2022-36874 | Medium | 5.9 | 2022-09-09 | Improper Handling of Insufficient Permissions or Privileges vulnerability in Waterplugin prior to 2.2.11.22040751 allows attacker to access device IMEI and Ser… |
CVE-2022-36873 | Medium | 5.9 | 2022-09-09 | Improper restriction of broadcasting Intent in GalaxyStoreBridgePageLinker of?Waterplugin prior to version 2.2.11.22081151 leaks MAC address of the connected B… |
CVE-2022-36872 | Medium | 5.0 | 2022-09-09 | Pending Intent hijacking vulnerability in SpayNotification in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files… |
CVE-2022-36871 | Medium | 5.0 | 2022-09-09 | Pending Intent hijacking vulnerability in NotiCenterUtils in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files… |
CVE-2022-36870 | Medium | 5.0 | 2022-09-09 | Pending Intent hijacking vulnerability in MTransferNotificationManager in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to… |
CVE-2022-36869 | Medium | 6.6 | 2022-09-09 | Improper access control vulnerability in ContactsDumpActivity of?Contacts Provider prior to version 12.7.59 allows attacker to access the file without permissi… |
CVE-2022-36867 | Medium | 5.9 | 2022-09-09 | Improper access control vulnerability in Editor Lite prior to version 4.0.40.14 allows attackers to access sensitive information. |
CVE-2022-36866 | Medium | 4.0 | 2022-09-09 | Improper access control vulnerability in Broadcaster in Group Sharing prior to versions 13.0.6.15 in Android S(12), 13.0.6.14 in Android R(11) and below allows… |
CVE-2022-36865 | Medium | 4.0 | 2022-09-09 | Improper access control in Group Sharing prior to versions 13.0.6.15 in Android S(12), 13.0.6.14 in Android R(11) and below allows attackers to access device i… |
CVE-2022-36864 | Medium | 4.0 | 2022-09-09 | Improper access control and intent redirection in Samsung Email prior to 6.1.70.20 allows attacker to access specific formatted file and execute privileged beh… |
CVE-2022-36863 | Medium | 4.4 | 2022-09-09 | A heap-based overflow vulnerability in GetCorrectDbLanguageTypeEsPKc function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 Release… |
CVE-2022-36862 | Medium | 4.4 | 2022-09-09 | A heap-based overflow vulnerability in HWR::EngineCJK::Impl::Construct() in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 Release 1 al… |
CVE-2022-36861 | Medium | 5.9 | 2022-09-09 | Custom permission misuse vulnerability in SystemUI prior to SMR Sep-2022 Release 1 allows attacker to use some protected functions with SystemUI privilege. |
CVE-2022-36860 | Medium | 4.4 | 2022-09-09 | A heap-based overflow vulnerability in LoadEnvironment function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 Release 1 allows atta… |
CVE-2022-36859 | Medium | 5.7 | 2022-09-09 | Improper input validation vulnerability in SmartTagPlugin prior to version 1.2.21-6 allows privileged attackers to trigger a XSS on a victim's devices. |
CVE-2022-36858 | Medium | 4.4 | 2022-09-09 | A heap-based overflow vulnerability in GetCorrectDbLanguageTypeEsPKc() function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 Relea… |
CVE-2022-36857 | Low | 1.9 | 2022-09-09 | Improper Authorization vulnerability in Photo Editor prior to SMR Sep-2022 Release 1 allows physical attackers to read internal application data. |
CVE-2022-36856 | Medium | 4.0 | 2022-09-09 | Improper access control vulnerability in Telecom application prior to SMR Sep-2022 Release 1 allows attacker to start emergency calls via undefined permission. |
CVE-2022-36855 | Medium | 4.4 | 2022-09-09 | A use after free vulnerability in iva_ctl driver prior to SMR Sep-2022 Release 1 allows attacker to cause memory access fault. |
CVE-2022-36854 | Medium | 4.0 | 2022-09-09 | Out of bound read in libapexjni.media.samsung.so prior to SMR Sep-2022 Release 1 allows attacker access unauthorized information. |
CVE-2022-36853 | Low | 3.3 | 2022-09-09 | Intent redirection in Photo Editor prior to SMR Sep-2022 Release 1 allows attacker to get sensitive information. |
CVE-2022-36852 | Low | 1.9 | 2022-09-09 | Improper Authorization vulnerability in Video Editor prior to SMR Sep-2022 Release 1 allows local attacker to access internal application data. |
CVE-2022-36851 | Low | 3.9 | 2022-09-09 | Improper access control vulnerability in Samsung pass prior to version 4.0.03.1 allow physical attackers to access data of Samsung pass on a certain state of a… |
CVE-2022-36850 | Medium | 4.0 | 2022-09-09 | Path traversal vulnerability in CallBGProvider prior to SMR Sep-2022 Release 1 allows attacker to overwrite arbitrary file with phone uid. |
CVE-2022-36849 | Medium | 4.9 | 2022-09-09 | Use after free vulnerability in sdp_mm_set_process_sensitive function of sdpmm driver prior to SMR Sep-2022 Release 1 allows attackers to perform malicious act… |
CVE-2022-36848 | Medium | 5.1 | 2022-09-09 | Improper Authorization vulnerability in setDualDARPolicyCmd prior to SMR Sep-2022 Release 1 allows local attackers to cause local permanent denial of service. |
CVE-2022-36847 | Medium | 4.9 | 2022-09-09 | Use after free vulnerability in mtp_send_signal function of MTP driver prior to SMR Sep-2022 Release 1 allows attackers to perform malicious actions. |
CVE-2022-36846 | Medium | 4.4 | 2022-09-09 | A heap-based overflow vulnerability in ConstructDictionary function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 Release 1 allows… |
CVE-2022-36845 | Medium | 4.4 | 2022-09-09 | A heap-based overflow vulnerability in MHW_RECOG_LIB_INFO function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 Release 1 allows a… |
CVE-2022-36844 | Medium | 4.4 | 2022-09-09 | A heap-based overflow vulnerability in HWR::EngJudgeModel::Construct() in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 Release 1 allo… |
CVE-2022-36843 | Medium | 4.4 | 2022-09-09 | A heap-based overflow vulnerability in MHW_RECOG_LIB_INFO function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 Release 1 allows a… |
CVE-2022-36842 | Medium | 4.4 | 2022-09-09 | A heap-based overflow vulnerability in prepareRecogLibrary function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 Release 1 allows… |
CVE-2022-36841 | Medium | 4.4 | 2022-09-09 | A heap-based overflow vulnerability in PrepareRecogLibrary_Part function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 Release 1 al… |
CVE-2022-36793 | Medium | 6.5 | 2022-09-09 | Unauthenticated Plugin Settings Change & Data Deletion vulnerabilities in WP Shop plugin <= 3.9.6 at WordPress. |
CVE-2022-36423 | High | 7.4 | 2022-09-09 | OpenHarmony-v3.1.2 and prior versions have an incorrect configuration of the cJSON library, which leads a Stack overflow vulnerability during recursive parsing… |
CVE-2022-36422 | Medium | 4.3 | 2022-09-09 | Rating increase/decrease via race condition in Lester 'GaMerZ' Chan WP-PostRatings plugin <= 1.89 at WordPress. |
CVE-2022-36376 | Medium | 6.8 | 2022-09-09 | Server-Side Request Forgery (SSRF) vulnerability in Rank Math SEO plugin <= 1.0.95 at WordPress. |
CVE-2022-36356 | Medium | 4.8 | 2022-09-09 | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Liam Gladdy / Thirty8 Digital Culture Object plugin <= 4.0.1 at WordPress. |
CVE-2022-36280 | Medium | 6.3 | 2022-09-09 | An out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_kms.c in GPU component in the Linux kernel with devic… |
CVE-2022-35725 | Medium | 4.8 | 2022-09-09 | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Hans Matzen's wp-forecast plugin <= 7.5 at WordPress. |
CVE-2022-35277 | Medium | 5.4 | 2022-09-09 | Cross-Site Request Forgery (CSRF) vulnerability in GetResponse plugin <= 5.5.20 at WordPress. |
CVE-2022-35275 | Medium | 4.8 | 2022-09-09 | Authenticated (shop manager+) Reflected Cross-Site Scripting (XSS) vulnerability in AlgolPlus Advanced Order Export For WooCommerce plugin <= 3.3.1 at WordPres… |
CVE-2022-2964 | High | 7.8 | 2022-09-09 | A flaw was found in the Linux kernel’s driver for the ASIX AX88179_178A-based USB 2.0/3.0 Gigabit Ethernet Devices. The vulnerability contains multiple out-of-… |
CVE-2022-2905 | Medium | 5.5 | 2022-09-09 | An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the bpf_tail_call function with a key larger than the max_e… |
CVE-2022-2526 | Critical | 9.8 | 2022-09-09 | A use-after-free vulnerability was found in systemd. This issue occurs due to the on_stream_io() function and dns_stream_complete() function in 'resolved-dns-s… |
CVE-2022-26394 | Medium | 5.5 | 2022-09-09 | The Baxter Spectrum WBM does not perform mutual authentication with the gateway server host. This may allow an attacker to perform a man in the middle attack t… |
CVE-2022-26393 | Medium | 5.0 | 2022-09-09 | The Baxter Spectrum WBM is susceptible to format string attacks via application messaging. An attacker could use this to read memory in the WBM to access sensi… |
CVE-2022-26392 | Low | 3.1 | 2022-09-09 | The Baxter Spectrum WBM (v16, v16D38) and Baxter Spectrum WBM (v17, v17D19, v20D29 to v20D32) when in superuser mode is susceptible to format string attacks vi… |
CVE-2022-26390 | Medium | 4.2 | 2022-09-09 | The Baxter Spectrum Wireless Battery Module (WBM) stores network credentials and PHI (only applicable to Spectrum IQ pumps using auto programming) in unencrypt… |
CVE-2022-38286 | High | 7.2 | 2022-09-09 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/role/list. |
CVE-2022-38285 | High | 7.2 | 2022-09-09 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/menu/list. |
CVE-2022-38284 | High | 7.2 | 2022-09-09 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/department/list. |
CVE-2022-38283 | High | 7.2 | 2022-09-09 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/video/list. |
CVE-2022-38282 | High | 7.2 | 2022-09-09 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/videoalbum/list. |
CVE-2022-38281 | High | 7.2 | 2022-09-09 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/site/list. |
CVE-2022-38280 | High | 7.2 | 2022-09-09 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/image/list. |
CVE-2022-38279 | High | 7.2 | 2022-09-09 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/imagealbum/list. |
CVE-2022-38278 | High | 7.2 | 2022-09-09 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/friendlylink/list. |
CVE-2022-38277 | High | 7.2 | 2022-09-09 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/folderrollpicture/list. |
CVE-2022-38276 | High | 7.2 | 2022-09-09 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/foldernotice/list. |
CVE-2022-38275 | High | 7.2 | 2022-09-09 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/contact/list. |
CVE-2022-38274 | High | 7.2 | 2022-09-09 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/comment/list. |
CVE-2022-38273 | High | 7.2 | 2022-09-09 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list_approve. |
CVE-2022-38272 | High | 7.2 | 2022-09-09 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list. |
CVE-2022-2528 | Medium | 6.5 | 2022-09-09 | In affected versions of Octopus Deploy it is possible to upload a package to built-in feed with insufficient permissions after re-indexing packages. |
CVE-2022-29061 | High | 7.2 | 2022-09-09 | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiSOAR before 7.2.1 allows… |
CVE-2022-2925 | Medium | 5.4 | 2022-09-09 | Cross-site Scripting (XSS) - Stored in GitHub repository appwrite/appwrite prior to 1.0.0-RC1. |
CVE-2022-40307 | Medium | 4.7 | 2022-09-09 | An issue was discovered in the Linux kernel through 5.19.8. drivers/firmware/efi/capsule-loader.c has a race condition with a resultant use-after-free. |
CVE-2022-40305 | Critical | 9.8 | 2022-09-09 | A Server-Side Request Forgery issue in Canto Cumulus through 11.1.3 allows attackers to enumerate the internal network, overload network resources, and possibl… |
CVE-2022-25765 | High | 7.3 | 2022-09-09 | The package pdfkit from 0.0.0 are vulnerable to Command Injection where the URL is not properly sanitized. |
CVE-2022-40299 | High | 7.8 | 2022-09-09 | In Singular before 4.3.1, a predictable /tmp pathname is used (e.g., by sdb.cc), which allows local users to gain the privileges of other users via a procedure… |
CVE-2022-40297 | High | 7.8 | 2022-09-09 | UBports Ubuntu Touch 16.04 allows the screen-unlock passcode to be used for a privileged shell via Sudo. This passcode is only four digits, far below typical l… |
CVE-2022-40281 | High | 7.5 | 2022-09-08 | An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). cyassl_connect_step2 in curl/vtls/cyassl.c has a missing X509_free after SSL_get_peer… |
CVE-2022-40280 | High | 7.5 | 2022-09-08 | An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). createDB in security/provisioning/src/provisioningdatabasemanager.c has a missing sql… |
CVE-2022-36084 | Critical | 9.9 | 2022-09-08 | cruddl is software for creating a GraphQL API for a database, using the GraphQL SDL to model a schema. If cruddl starting with version 1.1.0 and prior to versi… |
CVE-2022-38269 | High | 7.2 | 2022-09-08 | School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the component /modules/modstudent/index.php?view… |
CVE-2022-38268 | High | 7.2 | 2022-09-08 | School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the component /modules/autonumber/index.php?view… |
CVE-2022-38267 | High | 7.2 | 2022-09-08 | School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the component /modules/user/index.php?view=edit&… |
CVE-2022-38265 | High | 7.2 | 2022-09-08 | Apartment Visitor Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter at /avms/edit-apartment.php. |
CVE-2022-36100 | Critical | 9.9 | 2022-09-08 | XWiki Platform Applications Tag and XWiki Platform Tag UI are tag applications for XWiki, a generic wiki platform. Starting with version 1.7 in XWiki Platform… |
CVE-2022-36099 | Critical | 9.9 | 2022-09-08 | XWiki Platform Wiki UI Main Wiki is software for managing subwikis on XWiki Platform, a generic wiki platform. Starting with version 5.3-milestone-2 and prior… |
CVE-2022-36098 | High | 8.9 | 2022-09-08 | XWiki Platform Mentions UI is a user interface for mentioning users in wiki content for XWiki Platform, a generic wiki platform. Starting in version 12.5-rc-1… |
CVE-2022-36097 | High | 8.9 | 2022-09-08 | XWiki Platform Attachment UI provides a macro to easily upload and select attachments for XWiki Platform, a generic wiki platform. Starting with version 14.0-r… |
CVE-2022-36096 | High | 8.9 | 2022-09-08 | The XWiki Platform Index UI is an Index of all pages, attachments, orphans and deleted pages and attachments for XWiki Platform, a generic wiki platform. Prior… |
CVE-2022-36095 | Medium | 4.3 | 2022-09-08 | XWiki Platform is a generic wiki platform. Prior to versions 13.10.5 and 14.3, it is possible to perform a Cross-Site Request Forgery (CSRF) attack for adding… |
CVE-2022-36094 | High | 8.9 | 2022-09-08 | XWiki Platform Web Parent POM contains Web resources for the XWiki platform, a generic wiki platform. Starting with version 1.0 and prior to versions 13.10.6 a… |
CVE-2022-3167 | High | 8.8 | 2022-09-08 | Improper Restriction of Rendered UI Layers or Frames in GitHub repository ikus060/rdiffweb prior to 2.4.1. |
CVE-2022-38258 | High | 8.1 | 2022-09-08 | A local file inclusion (LFI) vulnerability in D-Link DIR 819 v1.06 allows attackers to cause a Denial of Service (DoS) or access sensitive server information v… |
CVE-2022-38256 | Medium | 5.4 | 2022-09-08 | TastyIgniter v3.5.0 was discovered to contain a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2022-36093 | High | 8.5 | 2022-09-08 | XWiki Platform Web Templates are templates for XWiki Platform, a generic wiki platform. By passing a template of the distribution wizard to the xpart template… |
CVE-2022-36092 | High | 7.5 | 2022-09-08 | XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Prior to versions 14.2 and 13.10.4, all rights checks that would normall… |
CVE-2022-38260 | High | 7.2 | 2022-09-08 | Interview Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /interview/delete.php?action=questiondelete&id=. |
CVE-2022-38255 | High | 7.2 | 2022-09-08 | Interview Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /interview/editQuestion.php. |
CVE-2022-37857 | High | 7.5 | 2022-09-08 | bilde2910 Hauk v1.6.1 requires a hardcoded password which by default is blank. This hardcoded password is hashed but stored within the config.php file server-s… |
CVE-2022-37164 | Critical | 9.8 | 2022-09-08 | Inoda OnTrack v3.4 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brute-force attacks. Ad… |
CVE-2022-37163 | Critical | 9.8 | 2022-09-08 | Bminusl IHateToBudget v1.5.7 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brute-force a… |
CVE-2022-36091 | High | 7.5 | 2022-09-08 | XWiki Platform Web Templates are templates for XWiki Platform, a generic wiki platform. Through the suggestion feature, string and list properties of objects t… |