2022 CVEs (page 142)
Page 142 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-27969 | Medium | 5.3 | 2022-09-08 | Cynet 360 Web Portal before v4.5 was discovered to allow attackers to access a list of decoy users via a crafted GET request sent to /WebApp/DeceptionUser/GetA… |
CVE-2022-27968 | Medium | 5.3 | 2022-09-08 | Cynet 360 Web Portal before v4.5 was discovered to allow attackers to access a list of monitored files and profiles via a crafted GET request sent to /WebApp/S… |
CVE-2022-27967 | Medium | 5.3 | 2022-09-08 | Cynet 360 Web Portal before v4.5 was discovered to allow attackers to access a list of excluded files and profiles via a crafted GET request sent to /WebApp/Se… |
CVE-2022-22314 | Low | 3.3 | 2022-09-08 | IBM Planning Analytics Local 2.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 217371. |
CVE-2022-3153 | Medium | 5.5 | 2022-09-08 | NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404. |
CVE-2022-36090 | High | 8.1 | 2022-09-08 | XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Prior to versions 13.1.0.5 and 14.3-rc-1, some resources are missing a c… |
CVE-2022-36085 | High | 7.4 | 2022-09-08 | Open Policy Agent (OPA) is an open source, general-purpose policy engine. The Rego compiler provides a (deprecated) `WithUnsafeBuiltins` function, which allows… |
CVE-2022-36736 | Medium | 6.1 | 2022-09-08 | Jitsi-2.10.5550 was discovered to contain a vulnerability in its web UI which allows attackers to perform a clickjacking attack via a crafted HTTP request. NOT… |
CVE-2022-20923 | Medium | 4.0 | 2022-09-08 | A vulnerability in the IPSec VPN Server authentication functionality of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthent… |
CVE-2022-20863 | Medium | 4.3 | 2022-09-08 | A vulnerability in the messaging interface of Cisco Webex App, formerly Webex Teams, could allow an unauthenticated, remote attacker to manipulate links or oth… |
CVE-2022-20696 | High | 7.5 | 2022-09-08 | A vulnerability in the binding configuration of Cisco SD-WAN vManage Software containers could allow an unauthenticated, adjacent attacker who has access to th… |
CVE-2022-30079 | High | 8.8 | 2022-09-08 | Command injection vulnerability was discovered in Netgear R6200 v2 firmware through R6200v2-V1.0.3.12 via binary /sbin/acos_service that could allow remote aut… |
CVE-2022-27593 | Critical | 10.0 | 2022-09-08 | An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an at… |
CVE-2022-3148 | Medium | 6.1 | 2022-09-08 | Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0. |
CVE-2022-3138 | Medium | 6.1 | 2022-09-08 | Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0. |
CVE-2022-38400 | Medium | 5.9 | 2022-09-08 | Mailform Pro CGI 4.3.1 and earlier allow a remote unauthenticated attacker to obtain the user input data by having a use of the product to access a specially c… |
CVE-2022-38399 | Medium | 6.8 | 2022-09-08 | Missing protection mechanism for alternate hardware interface in SmaCam CS-QR10 all versions and SmaCam Night Vision CS-QR20 all versions allows an attacker to… |
CVE-2022-38394 | Critical | 9.8 | 2022-09-08 | Use of hard-coded credentials for the telnet server of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote unauthenticated attacker to exe… |
CVE-2022-38094 | High | 8.8 | 2022-09-08 | OS command injection vulnerability in the telnet function of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote authenticated attacker to… |
CVE-2022-36403 | High | 7.8 | 2022-09-08 | Untrusted search path vulnerability in the installer of Device Software Manager prior to Ver.2.20.3.0 allows an attacker to gain privileges via a Trojan horse… |
CVE-2022-35273 | High | 8.8 | 2022-09-08 | OS command injection vulnerability in GUI setting page of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote authenticated attacker to ex… |
CVE-2022-34869 | High | 8.8 | 2022-09-08 | Undocumented hidden command that can be executed from the telnet function of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote authentic… |
CVE-2022-33941 | Critical | 9.8 | 2022-09-08 | PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability. Sending a specially crafted message by POST method to PowerCMS XMLRPC… |
CVE-2022-28220 | High | 7.5 | 2022-09-08 | Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. Fix of CVE-2021-38542, which solv… |
CVE-2022-25914 | Medium | 5.6 | 2022-09-08 | The package com.google.cloud.tools:jib-core before 0.22.0 are vulnerable to Remote Code Execution (RCE) via the isDockerInstalled function, due to attempting t… |
CVE-2022-25897 | Medium | 5.9 | 2022-09-08 | The package org.eclipse.milo:sdk-server before 0.6.8 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption… |
CVE-2022-37146 | Medium | 5.3 | 2022-09-08 | The PlexTrac platform prior to version 1.28.0 allows for username enumeration via HTTP response times on invalid login attempts for users configured to use the… |
CVE-2022-37145 | High | 7.5 | 2022-09-08 | The PlexTrac platform prior to version 1.17.0 does not restrict excessive authentication attempts for accounts configured to use the PlexTrac authentication pr… |
CVE-2022-37144 | High | 8.8 | 2022-09-08 | The PlexTrac platform prior to API version 1.17.0 does not restrict excessive MFA TOTP submission attempts. An unauthenticated remote attacker in possession of… |
CVE-2022-38531 | High | 8.8 | 2022-09-08 | FPT G-97RG6M R4.2.98.035 and G-97RG3 R4.2.43.078 are vulnerable to Remote Command Execution in the ping function. |
CVE-2022-37779 | High | 7.2 | 2022-09-08 | Phicomm FIR151B A2, FIR302E A2, FIR300B A2, FIR303B A2 routers V3.0.1.17 were discovered to contain a remote command execution (RCE) vulnerability via the send… |
CVE-2022-37778 | High | 7.2 | 2022-09-08 | Phicomm FIR151B A2, FIR302E A2, FIR300B A2, FIR303B A2 routers V3.0.1.17 were discovered to contain a remote command execution (RCE) vulnerability via the curr… |
CVE-2022-37777 | High | 7.2 | 2022-09-08 | Phicomm FIR151B A2, FIR302E A2, FIR300B A2, FIR303B A2 routers 3.0.1.17 and earlier were discovered to contain a remote command execution (RCE) vulnerability v… |
CVE-2022-36588 | Critical | 9.8 | 2022-09-08 | In D-Link DAP1650 v1.04 firmware, the fileaccess.cgi program in the firmware has a buffer overflow vulnerability caused by strncpy. |
CVE-2022-36586 | Critical | 9.8 | 2022-09-08 | In Tenda G3 US_G3V3.0br_V15.11.0.6(7663)_EN_TDE, there is a buffer overflow vulnerability caused by strcpy in function 0x869f4 in the httpd binary. |
CVE-2022-36585 | Critical | 9.8 | 2022-09-07 | In Tenda G3 US_G3V3.0br_V15.11.0.6(7663)_EN_TDE, in httpd binary, the addDhcpRule function has a buffer overflow caused by sscanf. |
CVE-2022-36089 | High | 8.2 | 2022-09-07 | KubeVela is an application delivery platform Users using KubeVela's VelaUX APIServer could be affected by an authentication bypass vulnerability. In KubeVela p… |
CVE-2022-36088 | Medium | 5.0 | 2022-09-07 | GoCD is a continuous delivery server. Windows installations via either the server or agent installers for GoCD prior to 22.2.0 do not adequately restrict permi… |
CVE-2022-36086 | High | 8.4 | 2022-09-07 | linked_list_allocator is an allocator usable for no_std systems. Prior to version 0.10.2, the heap initialization methods were missing a minimum size check for… |
CVE-2022-38254 | Medium | 6.1 | 2022-09-07 | Nagios XI before v5.8.7 was discovered to contain a cross-site scripting (XSS) vulnerability via the ajax.php script in CCM 3.1.5. |
CVE-2022-38251 | Medium | 4.8 | 2022-09-07 | Nagios XI v5.8.6 was discovered to contain a cross-site scripting (XSS) vulnerability via the System Performance Settings page under the Admin panel. |
CVE-2022-38250 | Critical | 9.8 | 2022-09-07 | Nagios XI v5.8.6 was discovered to contain a SQL injection vulnerability via the mib_name parameter at the Manage MIBs page. |
CVE-2022-38249 | Medium | 6.1 | 2022-09-07 | Nagios XI v5.8.6 was discovered to contain a cross-site scripting (XSS) vulnerability via the MTR component in version 1.0.4. |
CVE-2022-38248 | Medium | 6.1 | 2022-09-07 | Nagios XI before v5.8.7 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities at auditlog.php. |
CVE-2022-38247 | Medium | 4.8 | 2022-09-07 | Nagios XI v5.8.6 was discovered to contain a cross-site scripting (XSS) vulnerability via the System Settings page under the Admin panel. |
CVE-2022-36083 | Medium | 5.3 | 2022-09-07 | JOSE is "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto in Node.js, Browser, Cloudflare Workers… |
CVE-2022-36082 | Medium | 5.3 | 2022-09-07 | mangadex-downloader is a command-line tool to download manga from MangaDex. When using `file:<location>` command and `<location>` is a web URL location (http… |
CVE-2022-36081 | High | 7.5 | 2022-09-07 | Wikmd is a file based wiki that uses markdown. Prior to version 1.7.1, Wikmd is vulnerable to path traversal when accessing `/list/<path:folderpath>` and discl… |
CVE-2022-36080 | Medium | 6.1 | 2022-09-07 | Wikmd is a file based wiki that uses markdown. Prior to version 1.7.1, an attacker could capture user's session cookies or execute malicious Javascript when a… |
CVE-2022-36079 | High | 8.6 | 2022-09-07 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Internal fields (keys used internally by Parse Server… |
CVE-2022-36049 | High | 7.7 | 2022-09-07 | Flux2 is a tool for keeping Kubernetes clusters in sync with sources of configuration, and Flux's helm-controller is a Kubernetes operator that allows one to d… |
CVE-2022-3130 | High | 7.3 | 2022-09-07 | A vulnerability classified as critical has been found in codeprojects Online Driving School. This affects an unknown part of the file /login.php. The manipulat… |
CVE-2022-3129 | Medium | 6.3 | 2022-09-07 | A vulnerability was found in codeprojects Online Driving School. It has been rated as critical. Affected by this issue is some unknown functionality of the fil… |
CVE-2022-36073 | High | 8.3 | 2022-09-07 | RubyGems.org is the Ruby community gem host. A bug in password & email change confirmation code allowed an attacker to change their RubyGems.org account's emai… |
CVE-2022-38314 | Critical | 9.8 | 2022-09-07 | Tenda AC18 router v15.03.05.19 and v15.03.05.05 was discovered to contain a stack overflow via the urls parameter at /goform/saveParentControlInfo. |
CVE-2022-38313 | Critical | 9.8 | 2022-09-07 | Tenda AC18 router v15.03.05.19 and v15.03.05.05 was discovered to contain a stack overflow via the time parameter at /goform/saveParentControlInfo. |
CVE-2022-38312 | Critical | 9.8 | 2022-09-07 | Tenda AC18 router v15.03.05.19 and v15.03.05.05 was discovered to contain a stack overflow via the list parameter at /goform/SetIpMacBind. |
CVE-2022-38311 | Critical | 9.8 | 2022-09-07 | Tenda AC18 router v15.03.05.19 and v15.03.05.05 was discovered to contain a stack overflow via the time parameter at /goform/PowerSaveSet. |
CVE-2022-38310 | Critical | 9.8 | 2022-09-07 | Tenda AC18 router v15.03.05.19 and v15.03.05.05 was discovered to contain a stack overflow via the list parameter at /goform/SetStaticRouteCfg. |
CVE-2022-38309 | Critical | 9.8 | 2022-09-07 | Tenda AC18 router v15.03.05.19 and v15.03.05.05 was discovered to contain a stack overflow via the list parameter at /goform/SetVirtualServerCfg. |
CVE-2022-36070 | High | 7.3 | 2022-09-07 | Poetry is a dependency manager for Python. To handle dependencies that come from a Git repository, Poetry executes various commands, e.g. `git config`. These c… |
CVE-2022-36069 | High | 7.3 | 2022-09-07 | Poetry is a dependency manager for Python. When handling dependencies that come from a Git repository instead of a registry, Poetry uses various commands, such… |
CVE-2022-30078 | High | 8.8 | 2022-09-07 | NETGEAR R6200_V2 firmware versions through R6200v2-V1.0.3.12_10.1.11 and R6300_V2 firmware versions through R6300v2-V1.0.4.52_10.0.93 allow remote authenticate… |
CVE-2022-30312 | Medium | 6.5 | 2022-09-07 | The Trend Controls IC protocol through 2022-05-06 allows Cleartext Transmission of Sensitive Information. According to FSCT-2022-0050, there is a Trend Control… |
CVE-2022-1807 | High | 7.2 | 2022-09-07 | Multiple SQLi vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 18.5 MR4 and version 1… |
CVE-2022-37780 | High | 7.2 | 2022-09-07 | Phicomm FIR151B A2, FIR302E A2, FIR300B A2, FIR303B A2 routers V3.0.1.17 were discovered to contain a remote command execution (RCE) vulnerability via the ping… |
CVE-2022-36661 | Medium | 6.5 | 2022-09-07 | xhyve commit dfbe09b was discovered to contain a NULL pointer dereference via the component vi_pci_read(). This vulnerability allows attackers to cause a Denia… |
CVE-2022-36660 | Critical | 9.8 | 2022-09-07 | xhyve commit dfbe09b was discovered to contain a stack buffer overflow via the component pci_vtrnd_notify(). |
CVE-2022-36659 | Medium | 6.5 | 2022-09-07 | xhyve commit dfbe09b was discovered to contain a NULL pointer dereference via the component vi_pci_write(). This vulnerability allows attackers to cause a Deni… |
CVE-2022-36587 | Critical | 9.8 | 2022-09-07 | In Tenda G3 US_G3V3.0br_V15.11.0.6(7663)_EN_TDE, there is a buffer overflow vulnerability caused by sprintf in function in the httpd binary. |
CVE-2022-36539 | High | 7.5 | 2022-09-07 | WeDayCare B.V Ouderapp before v1.1.22 allows attackers to alter the ID value within intercepted calls to gain access to data of other parents and children. |
CVE-2022-31414 | High | 7.5 | 2022-09-07 | D-Link DIR-1960 firmware DIR-1960_A1_1.11 was discovered to contain a buffer overflow via srtcat in prog.cgi. This vulnerability allowed attackers to cause a D… |
CVE-2022-3152 | High | 8.8 | 2022-09-07 | Unverified Password Change in GitHub repository phpfusion/phpfusion prior to 9.10.20. |
CVE-2022-37731 | Medium | 6.1 | 2022-09-07 | ftcms 2.1 poster.PHP has a XSS vulnerability. The attacker inserts malicious JavaScript code into the web page, causing the user / administrator to trigger mal… |
CVE-2022-37730 | High | 8.8 | 2022-09-07 | In ftcms 2.1, there is a Cross Site Request Forgery (CSRF) vulnerability in the PHP page, which causes the attacker to forge a link to trick him to click on a… |
CVE-2022-37108 | High | 8.7 | 2022-09-07 | An injection vulnerability in the syslog-ng configuration wizard in Securonix Snypr 6.4 allows an application user with the "Manage Ingesters" permission to ex… |
CVE-2022-36271 | High | 7.8 | 2022-09-07 | Outbyte PC Repair Installation File 1.7.112.7856 is vulnerable to Dll Hijacking. iertutil.dll is missing so an attacker can use a malicious dll with same name… |
CVE-2022-35513 | High | 7.5 | 2022-09-07 | The Blink1Control2 application <= 2.2.7 uses weak password encryption and an insecure method of storage. |
CVE-2022-31167 | High | 7.1 | 2022-09-07 | XWiki Platform Security Parent POM contains the security APIs for XWiki Platform, a generic wiki platform. Starting with version 5.0 and prior to 12.10.11, 13… |
CVE-2022-31166 | High | 8.1 | 2022-09-07 | XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Starting in versions 11.3.7, 11.0.3, and 12.0RC1, it is possible to expl… |
CVE-2022-31149 | High | 8.8 | 2022-09-07 | ActivityWatch open-source automated time tracker. Versions prior to 0.12.0b2 are vulnerable to DNS rebinding attacks. This vulnerability impacts everyone runni… |
CVE-2022-40023 | High | 7.5 | 2022-09-07 | Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and lingu… |
CVE-2022-37189 | High | 7.5 | 2022-09-07 | DDMAL MEI2Volpiano 0.8.2 is vulnerable to XML External Entity (XXE), leading to a Denial of Service. This occurs due to the usage of the unsafe 'xml.etree' lib… |
CVE-2022-31251 | Medium | 6.5 | 2022-09-07 | A Incorrect Default Permissions vulnerability in the packaging of the slurm testsuite of openSUSE Factory allows local attackers with control over the slurm us… |
CVE-2022-31247 | Critical | 9.1 | 2022-09-07 | An Improper Authorization vulnerability in SUSE Rancher, allows any user who has permissions to create/edit cluster role template bindings or project role temp… |
CVE-2022-21950 | Medium | 5.3 | 2022-09-07 | A Improper Access Control vulnerability in the systemd service of cana in openSUSE Backports SLE-15-SP3, openSUSE Backports SLE-15-SP4 allows local users to hi… |
CVE-2022-38530 | High | 7.8 | 2022-09-06 | GPAC v2.1-DEV-rev232-gfcaa01ebb-master was discovered to contain a stack overflow when processing ISOM_IOD. |
CVE-2022-38529 | High | 7.8 | 2022-09-06 | tinyexr commit 0647fb3 was discovered to contain a heap-buffer overflow via the component rleUncompress. |
CVE-2022-38528 | Medium | 6.5 | 2022-09-06 | Open Asset Import Library (assimp) commit 3c253ca was discovered to contain a segmentation violation via the component Assimp::XFileImporter::CreateMeshes. |
CVE-2022-37344 | High | 7.6 | 2022-09-06 | Missing Access Control vulnerability in PHP Crafts Accommodation System plugin <= 1.0.1 at WordPress. |
CVE-2022-36427 | High | 7.3 | 2022-09-06 | Missing Access Control vulnerability in About Rentals. Inc. About Rentals plugin <= 1.5 at WordPress. |
CVE-2022-36387 | High | 7.6 | 2022-09-06 | Broken Access Control vulnerability in Alessio Caiazza's About Me plugin <= 1.0.12 at WordPress. |
CVE-2022-35913 | Medium | 4.3 | 2022-09-06 | Samourai Wallet Stonewallx2 0.99.98e allows a denial of service via a P2P coinjoin. The attacker and victim must follow each other's paynym. Then, the victim m… |
CVE-2022-1525 | Critical | 9.1 | 2022-09-06 | The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-602: Client-Side Enforcement of Server-Side Security, w… |
CVE-2022-1522 | Medium | 5.3 | 2022-09-06 | The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-117: Improper Output Neutralization for Logs, which all… |
CVE-2022-1368 | Critical | 9.8 | 2022-09-06 | The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-306: Missing Authentication for Critical Function, whic… |
CVE-2022-36067 | Critical | 10.0 | 2022-09-06 | vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandb… |
CVE-2022-38176 | High | 7.8 | 2022-09-06 | An issue was discovered in YSoft SAFEQ 6 before 6.0.72. Incorrect privileges were configured as part of the installer package for the Client V3 services, allow… |
CVE-2022-36663 | Critical | 9.8 | 2022-09-06 | Gluu Oxauth before v4.4.1 allows attackers to execute blind SSRF (Server-Side Request Forgery) attacks via a crafted request_uri parameter. |
CVE-2022-36072 | Medium | 5.9 | 2022-09-06 | SilverwareGames.io is a social network for users to play video games online. In version 1.1.8 and prior, due to an unobvious feature of PHP, hashes generated b… |