2022 CVEs (page 146)
Page 146 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-36620 | High | 7.5 | 2022-08-31 | D-link DIR-816 A2_v1.10CNB04, DIR-878 DIR_878_FW1.30B08.img is vulnerable to Buffer Overflow via /goform/addRouting. |
CVE-2022-36203 | Medium | 6.1 | 2022-08-31 | Doctor's Appointment System 1.0 is vulnerable to Cross Site Scripting (XSS) via the admin panel. In addition, it leads to takeover the administrator account by… |
CVE-2022-36202 | Critical | 9.8 | 2022-08-31 | Doctor's Appointment System1.0 is vulnerable to Incorrect Access Control via edoc/patient/settings.php. The settings.php is affected by Broken Access Control (… |
CVE-2022-36201 | Critical | 9.8 | 2022-08-31 | Doctor’s Appointment System v1.0 is vulnerable to Blind SQLi via settings.php. |
CVE-2022-2898 | Medium | 6.1 | 2022-08-31 | Measuresoft ScadaPro Server and Client (All Versions) do not properly resolve links before file access; this could allow a denial-of-service condition. |
CVE-2022-2897 | High | 7.8 | 2022-08-31 | Measuresoft ScadaPro Server and Client (All Versions) do not properly resolve links before file access; this could allow privilege escalation.. |
CVE-2022-2896 | High | 7.8 | 2022-08-31 | Measuresoft ScadaPro Server (All Versions) allows use after free while processing a specific project file. |
CVE-2022-2895 | High | 7.8 | 2022-08-31 | Measuresoft ScadaPro Server (All Versions) uses unmaintained ActiveX controls. These controls may allow two stack-based buffer overflow instances while process… |
CVE-2022-2894 | High | 7.8 | 2022-08-31 | Measuresoft ScadaPro Server (All Versions) uses unmaintained ActiveX controls. The controls may allow seven untrusted pointer deference instances while process… |
CVE-2022-2892 | High | 7.8 | 2022-08-31 | Measuresoft ScadaPro Server (Versions prior to 6.8.0.1) uses an unmaintained ActiveX control, which may allow an out-of-bounds write condition while processing… |
CVE-2022-36582 | High | 7.2 | 2022-08-31 | An arbitrary file upload vulnerability in the component /php_action/createProduct.php of Garage Management System v1.0 allows attackers to execute arbitrary co… |
CVE-2022-36581 | High | 7.5 | 2022-08-31 | Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via the user_email parameter at /admin/login.php. |
CVE-2022-36580 | High | 7.2 | 2022-08-31 | An arbitrary file upload vulnerability in the component /admin/products/controller.php?action=add of Online Ordering System v2.3.2 allows attackers to execute… |
CVE-2022-36571 | High | 7.2 | 2022-08-31 | Tenda AC9 V15.03.05.19 was discovered to contain a stack overflow via the mask parameter at /goform/WanParameterSetting. |
CVE-2022-36570 | High | 7.2 | 2022-08-31 | Tenda AC9 V15.03.05.19 was discovered to contain a stack overflow via the time parameter at /goform/SetLEDCfg. |
CVE-2022-36569 | High | 8.8 | 2022-08-31 | Tenda AC9 V15.03.05.19 was discovered to contain a stack overflow via the deviceList parameter at /goform/setMacFilterCfg. |
CVE-2022-36568 | High | 8.8 | 2022-08-31 | Tenda AC9 V15.03.05.19 was discovered to contain a stack overflow via the list parameter at /goform/setPptpUserList. |
CVE-2022-36048 | Medium | 4.3 | 2022-08-31 | Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat. When displaying messages with embedded remote images… |
CVE-2022-34383 | High | 8.1 | 2022-08-31 | Dell Edge Gateway 5200 (EGW) versions before 1.03.10 contain an operating system command injection vulnerability. A local malicious user may potentially exploi… |
CVE-2022-34373 | High | 7.3 | 2022-08-31 | Dell Command | Integration Suite for System Center, versions prior to 6.2.0, contains arbitrary file write vulnerability. A locally authenticated malicious use… |
CVE-2022-31233 | Medium | 6.3 | 2022-08-31 | Unisphere for PowerMax versions before 9.2.3.15 contain a privilege escalation vulnerability. An adjacent malicious user may potentially exploit this vulnerabi… |
CVE-2022-1841 | High | 7.2 | 2022-08-31 | In subsys/net/ip/tcp.c , function tcp_flags , when the incoming parameter flags is ECN or CWR , the buf will out-of-bounds write a byte zero. |
CVE-2022-37128 | Critical | 9.8 | 2022-08-31 | In D-Link DIR-816 A2_v1.10CNB04.img the network can be initialized without authentication via /goform/wizard_end. |
CVE-2022-36046 | Medium | 5.3 | 2022-08-31 | Next.js is a React framework that can provide building blocks to create web applications. All of the following must be true to be affected by this CVE: Next.js… |
CVE-2022-38812 | Medium | 6.5 | 2022-08-31 | AeroCMS 0.1.1 is vulnerable to SQL Injection via the author parameter. |
CVE-2022-38153 | Medium | 5.9 | 2022-08-31 | An issue was discovered in wolfSSL before 5.5.0 (when --enable-session-ticket is used); however, only version 5.3.0 is exploitable. Man-in-the-middle attackers… |
CVE-2022-37184 | High | 8.8 | 2022-08-31 | The application manage_website.php on Garage Management System 1.0 is vulnerable to Shell File Upload. The already authenticated malicious user, can upload a d… |
CVE-2022-37183 | Medium | 6.1 | 2022-08-31 | Piwigo 12.3.0 is vulnerable to Cross Site Scripting (XSS) via /search/1940/created-monthly-list. |
CVE-2022-36566 | Critical | 9.8 | 2022-08-31 | Rengine v1.3.0 was discovered to contain a command injection vulnerability via the scan engine function. |
CVE-2022-38152 | High | 7.5 | 2022-08-31 | An issue was discovered in wolfSSL before 5.5.0. When a TLS 1.3 client connects to a wolfSSL server and SSL_clear is called on its session, the server crashes… |
CVE-2022-3028 | High | 7.0 | 2022-08-31 | A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_algs occurred simulta… |
CVE-2022-37122 | High | 7.5 | 2022-08-31 | Carel pCOWeb HVAC BACnet Gateway 2.1.0, Firmware: A2.1.0 - B2.1.0, Application Software: 2.15.4A Software v16 13020200 suffers from an unauthenticated arbitrar… |
CVE-2022-30318 | Critical | 9.8 | 2022-08-31 | Honeywell ControlEdge through R151.1 uses Hard-coded Credentials. According to FSCT-2022-0056, there is a Honeywell ControlEdge hardcoded credentials issue. Th… |
CVE-2022-30317 | Critical | 9.1 | 2022-08-31 | Honeywell Experion LX through 2022-05-06 has Missing Authentication for a Critical Function. According to FSCT-2022-0055, there is a Honeywell Experion LX Cont… |
CVE-2022-2866 | High | 7.8 | 2022-08-31 | FATEK FvDesigner version 1.5.103 and prior is vulnerable to an out-of-bounds write while processing project files. If a valid user is tricked into using malici… |
CVE-2022-2759 | Medium | 5.5 | 2022-08-31 | Delta Electronics Delta Robot Automation Studio (DRAS) versions prior to 1.13.20 are affected by improper restrictions where the software processes an XML docu… |
CVE-2022-2758 | Medium | 6.5 | 2022-08-31 | Passwords are not adequately encrypted during the communication process between all versions of LS Industrial Systems (LSIS) Co. Ltd LS Electric XG5000 softwar… |
CVE-2022-2590 | High | 7.0 | 2022-08-31 | A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only shared memory mappings… |
CVE-2022-2521 | Medium | 6.5 | 2022-08-31 | It was found in libtiff 4.4.0rc1 that there is an invalid pointer free operation in TIFFClose() at tif_close.c:131 called by tiffcrop.c:2522 that can cause a p… |
CVE-2022-2520 | Medium | 6.5 | 2022-08-31 | A flaw was found in libtiff 4.4.0rc1. There is a sysmalloc assertion fail in rotateImage() at tiffcrop.c:8621 that can cause program crash when reading a craft… |
CVE-2022-2519 | Medium | 6.5 | 2022-08-31 | There is a double free or corruption in rotateImage() at tiffcrop.c:8839 found in libtiff 4.4.0rc1 |
CVE-2022-2485 | Critical | 9.6 | 2022-08-31 | Any attempt (good or bad) to log into AutomationDirect Stride Field I/O with a web browser may result in the device responding with its password in the communi… |
CVE-2022-2466 | Critical | 9.8 | 2022-08-31 | It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior. |
CVE-2022-2153 | Medium | 5.5 | 2022-08-31 | A flaw was found in the Linux kernel’s KVM when attempting to set a SynIC IRQ. This issue makes it possible for a misbehaving VMM to write to SYNIC/STIMER MSRs… |
CVE-2022-2132 | High | 8.6 | 2022-08-31 | A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a denial of service triggered by sending a crafted Vho… |
CVE-2022-2044 | High | 8.2 | 2022-08-31 | MOXA NPort 5110: Firmware Versions 2.10 is vulnerable to an out-of-bounds write that may allow an attacker to overwrite values in memory, causing a denial-of-s… |
CVE-2022-2043 | High | 7.5 | 2022-08-31 | MOXA NPort 5110: Firmware Versions 2.10 is vulnerable to an out-of-bounds write that can cause the device to become unresponsive. |
CVE-2022-2006 | High | 7.8 | 2022-08-31 | AutomationDirect DirectLOGIC has a DLL vulnerability in the install directory that may allow an attacker to execute code during the installation process. This… |
CVE-2022-2005 | High | 7.5 | 2022-08-31 | AutomationDirect C-more EA9 HTTP webserver uses an insecure mechanism to transport credentials from client to web server, which may allow an attacker to obtain… |
CVE-2022-2004 | High | 7.5 | 2022-08-31 | AutomationDirect DirectLOGIC is vulnerable to a a specially crafted packet can be sent continuously to the PLC to prevent access from DirectSoft and other devi… |
CVE-2022-2003 | High | 7.7 | 2022-08-31 | AutomationDirect DirectLOGIC is vulnerable to a specifically crafted serial message to the CPU serial port that will cause the PLC to respond with the PLC pass… |
CVE-2022-28625 | Medium | 5.5 | 2022-08-31 | A local disclosure of sensitive information vulnerability was discovered in HPE OneView version(s): Prior to 7.0 or 6.60.01. A low privileged user could locall… |
CVE-2022-26331 | Medium | 6.1 | 2022-08-31 | Potential vulnerabilities have been identified in Micro Focus ArcSight Logger. The vulnerabilities could be remotely exploited resulting in Information Disclos… |
CVE-2022-26330 | Medium | 6.5 | 2022-08-31 | Potential vulnerabilities have been identified in Micro Focus ArcSight Logger. The vulnerabilities could be remotely exploited resulting in Information Disclos… |
CVE-2022-21941 | Critical | 10.0 | 2022-08-31 | All versions of iSTAR Ultra prior to version 6.8.9.CU01 are vulnerable to a command injection that could allow an unauthenticated user root access to the syste… |
CVE-2022-1976 | High | 7.8 | 2022-08-31 | A flaw was found in the Linux kernel’s implementation of IO-URING. This flaw allows an attacker with local executable permission to create a string of requests… |
CVE-2022-1975 | Medium | 5.5 | 2022-08-31 | There is a sleep-in-atomic bug in /net/nfc/netlink.c that allows an attacker to crash the Linux kernel by simulating a nfc device from user-space. |
CVE-2022-1974 | Medium | 4.1 | 2022-08-31 | A use-after-free flaw was found in the Linux kernel's NFC core functionality due to a race condition between kobject creation and delete. This vulnerability al… |
CVE-2022-1888 | High | 7.8 | 2022-08-31 | Alpha7 PC Loader (All versions) is vulnerable to a stack-based buffer overflow while processing a specifically crafted project file, which may allow an attacke… |
CVE-2022-1552 | High | 8.8 | 2022-08-31 | A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The A… |
CVE-2022-1508 | Medium | 6.1 | 2022-08-31 | An out-of-bounds read flaw was found in the Linux kernel’s io_uring module in the way a user triggers the io_read() function with some special parameters. This… |
CVE-2022-1405 | High | 7.8 | 2022-08-31 | CNCSoft: All versions prior to 1.01.32 does not properly sanitize input while processing a specific project file, allowing a possible stack-based buffer overfl… |
CVE-2022-1404 | Low | 3.3 | 2022-08-31 | Delta Electronics CNCSoft (All versions prior to 1.01.32) does not properly sanitize input while processing a specific project file, allowing a possible out-of… |
CVE-2022-1355 | Medium | 6.1 | 2022-08-31 | A stack buffer overflow flaw was found in Libtiffs' tiffcp.c in main() function. This flaw allows an attacker to pass a crafted TIFF file to the tiffcp tool, t… |
CVE-2022-1354 | Medium | 5.5 | 2022-08-31 | A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped() function. This flaw allows an attacker to pass a crafted TIFF file to… |
CVE-2022-1325 | Medium | 5.5 | 2022-08-31 | A flaw was found in Clmg, where with the help of a maliciously crafted pandore or bmp file with modified dx and dy header field values it is possible to trick… |
CVE-2022-1319 | High | 7.5 | 2022-08-31 | A flaw was found in Undertow. For an AJP 400 response, EAP 7 is improperly sending two response packets, and those packets have the reuse flag set even though… |
CVE-2022-1271 | High | 8.8 | 2022-08-31 | An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted f… |
CVE-2022-1263 | Medium | 5.5 | 2022-08-31 | A NULL pointer dereference issue was found in KVM when releasing a vCPU with dirty ring support enabled. This flaw allows an unprivileged local attacker on the… |
CVE-2022-1259 | High | 7.5 | 2022-08-31 | A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the s… |
CVE-2022-1247 | High | 7.0 | 2022-08-31 | An issue found in linux-kernel that leads to a race condition in rose_connect(). The rose driver uses rose_neigh->use to represent how many objects are using t… |
CVE-2022-1205 | Medium | 4.7 | 2022-08-31 | A NULL pointer dereference flaw was found in the Linux kernel’s Amateur Radio AX.25 protocol functionality in the way a user connects with the protocol. This f… |
CVE-2022-36045 | Critical | 9.0 | 2022-08-31 | NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. It utilizes web sockets for instant interactions and… |
CVE-2022-36035 | High | 7.7 | 2022-08-31 | Flux is a tool for keeping Kubernetes clusters in sync with sources of configuration (like Git repositories), and automating updates to configuration when ther… |
CVE-2022-27911 | Medium | 5.3 | 2022-08-31 | An issue was discovered in Joomla! 4.2.0. Multiple Full Path Disclosures because of missing '_JEXEC or die check' caused by the PSR12 changes. |
CVE-2022-37023 | Medium | 6.5 | 2022-08-31 | Apache Geode versions prior to 1.15.0 are vulnerable to a deserialization of untrusted data flaw when using REST API on Java 8 or Java 11. Any user wishing to… |
CVE-2022-37022 | High | 8.8 | 2022-08-31 | Apache Geode versions up to 1.12.2 and 1.13.2 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 11. Any user wishing t… |
CVE-2022-37021 | Critical | 9.8 | 2022-08-31 | Apache Geode versions up to 1.12.5, 1.13.4 and 1.14.0 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 8. Any user st… |
CVE-2022-39047 | High | 8.8 | 2022-08-31 | Freeciv before 2.6.7 and before 3.0.3 is prone to a buffer overflow vulnerability in the Modpack Installer utility's handling of the modpack URL. |
CVE-2022-39046 | High | 7.5 | 2022-08-31 | An issue was discovered in the GNU C Library (glibc) 2.36. When the syslog function is passed a crafted input string larger than 1024 bytes, it reads uninitial… |
CVE-2022-36749 | Critical | 9.8 | 2022-08-30 | RPi-Jukebox-RFID v2.3.0 was discovered to contain a command injection vulnerability via the component /htdocs/utils/Files.php. This vulnerability is exploited… |
CVE-2022-36748 | Medium | 6.1 | 2022-08-30 | PicUploader v2.6.3 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /master/index.php. |
CVE-2022-36747 | Medium | 6.1 | 2022-08-30 | Razor v0.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the function uploadchannel(). |
CVE-2022-36746 | Medium | 6.1 | 2022-08-30 | LibreNMS v22.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component oxidized-cfg-check.inc.php. |
CVE-2022-36745 | Medium | 6.1 | 2022-08-30 | LibreNMS v22.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component print-customoid.php. |
CVE-2022-27563 | High | 7.5 | 2022-08-30 | An unauthenticated user can overload a part of HCL VersionVault Express and cause a denial of service. |
CVE-2022-27560 | Medium | 6.0 | 2022-08-30 | HCL VersionVault Express exposes administrator credentials. |
CVE-2022-3037 | High | 7.8 | 2022-08-30 | Use After Free in GitHub repository vim/vim prior to 9.0.0322. |
CVE-2022-37173 | High | 7.8 | 2022-08-30 | An issue in the installer of gvim 9.0.0000 allows authenticated attackers to execute arbitrary code via a binary hijacking attack on C:\Program.exe. |
CVE-2022-37172 | High | 7.8 | 2022-08-30 | Incorrect access control in the install directory (C:\msys64) of Msys2 v20220603 and below allows authenticated attackers to execute arbitrary code via overwri… |
CVE-2022-36735 | Critical | 9.8 | 2022-08-30 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at /admin/delete.php. |
CVE-2022-36734 | Critical | 9.8 | 2022-08-30 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the RollNo parameter at /admin/delstu.php. |
CVE-2022-36733 | Critical | 9.8 | 2022-08-30 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the M_Id parameter at /admin/del.php. |
CVE-2022-36732 | Critical | 9.8 | 2022-08-30 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /librarian/dele.php. |
CVE-2022-36731 | Critical | 9.8 | 2022-08-30 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the RollNo parameter at /librarian/delstu.php. |
CVE-2022-36730 | Critical | 9.8 | 2022-08-30 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at /librarian/delete.php. |
CVE-2022-36657 | Medium | 4.8 | 2022-08-30 | Library Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /librarian/edit_book_details.php. |
CVE-2022-36565 | High | 8.8 | 2022-08-30 | Incorrect access control in the install directory (C:\Wamp64) of Wamp v3.2.6 and below allows authenticated attackers to execute arbitrary code via overwriting… |
CVE-2022-36564 | High | 8.8 | 2022-08-30 | Incorrect access control in the install directory (C:\Strawberry) of StrawberryPerl v5.32.1.1 and below allows authenticated attackers to execute arbitrary cod… |
CVE-2022-36563 | High | 8.8 | 2022-08-30 | Incorrect access control in the install directory (C:\RailsInstaller) of Rubyinstaller2 v3.1.2 and below allows authenticated attackers to execute arbitrary co… |