2022 CVEs (page 147)
Page 147 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-36748 | Medium | 6.1 | 2022-08-30 | PicUploader v2.6.3 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /master/index.php. |
CVE-2022-36747 | Medium | 6.1 | 2022-08-30 | Razor v0.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the function uploadchannel(). |
CVE-2022-36746 | Medium | 6.1 | 2022-08-30 | LibreNMS v22.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component oxidized-cfg-check.inc.php. |
CVE-2022-36745 | Medium | 6.1 | 2022-08-30 | LibreNMS v22.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component print-customoid.php. |
CVE-2022-27563 | High | 7.5 | 2022-08-30 | An unauthenticated user can overload a part of HCL VersionVault Express and cause a denial of service. |
CVE-2022-27560 | Medium | 6.0 | 2022-08-30 | HCL VersionVault Express exposes administrator credentials. |
CVE-2022-3037 | High | 7.8 | 2022-08-30 | Use After Free in GitHub repository vim/vim prior to 9.0.0322. |
CVE-2022-37173 | High | 7.8 | 2022-08-30 | An issue in the installer of gvim 9.0.0000 allows authenticated attackers to execute arbitrary code via a binary hijacking attack on C:\Program.exe. |
CVE-2022-37172 | High | 7.8 | 2022-08-30 | Incorrect access control in the install directory (C:\msys64) of Msys2 v20220603 and below allows authenticated attackers to execute arbitrary code via overwri… |
CVE-2022-36735 | Critical | 9.8 | 2022-08-30 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at /admin/delete.php. |
CVE-2022-36734 | Critical | 9.8 | 2022-08-30 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the RollNo parameter at /admin/delstu.php. |
CVE-2022-36733 | Critical | 9.8 | 2022-08-30 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the M_Id parameter at /admin/del.php. |
CVE-2022-36732 | Critical | 9.8 | 2022-08-30 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /librarian/dele.php. |
CVE-2022-36731 | Critical | 9.8 | 2022-08-30 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the RollNo parameter at /librarian/delstu.php. |
CVE-2022-36730 | Critical | 9.8 | 2022-08-30 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at /librarian/delete.php. |
CVE-2022-36657 | Medium | 4.8 | 2022-08-30 | Library Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /librarian/edit_book_details.php. |
CVE-2022-36565 | High | 8.8 | 2022-08-30 | Incorrect access control in the install directory (C:\Wamp64) of Wamp v3.2.6 and below allows authenticated attackers to execute arbitrary code via overwriting… |
CVE-2022-36564 | High | 8.8 | 2022-08-30 | Incorrect access control in the install directory (C:\Strawberry) of StrawberryPerl v5.32.1.1 and below allows authenticated attackers to execute arbitrary cod… |
CVE-2022-36563 | High | 8.8 | 2022-08-30 | Incorrect access control in the install directory (C:\RailsInstaller) of Rubyinstaller2 v3.1.2 and below allows authenticated attackers to execute arbitrary co… |
CVE-2022-36562 | High | 8.8 | 2022-08-30 | Incorrect access control in the install directory (C:\Ruby31-x64) of Rubyinstaller2 v3.1.2 and below allows authenticated attackers to execute arbitrary code v… |
CVE-2022-36561 | Medium | 5.5 | 2022-08-30 | XPDF v4.0.4 was discovered to contain a segmentation violation via the component /xpdf/AcroForm.cc:538. |
CVE-2022-34375 | High | 8.8 | 2022-08-30 | Dell Container Storage Modules 1.2 contains a path traversal vulnerability in goiscsi and gobrick libraries. A remote authenticated malicious user with low pri… |
CVE-2022-34374 | High | 8.8 | 2022-08-30 | Dell Container Storage Modules 1.2 contains an OS command injection in goiscsi and gobrick libraries. A remote authenticated malicious user with low privileges… |
CVE-2022-34368 | Medium | 6.1 | 2022-08-30 | Dell EMC NetWorker 19.2.1.x 19.3.x, 19.4.x, 19.5.x, 19.6.x and 19.7.0.0 contain an Improper Handling of Insufficient Permissions or Privileges vulnerability. A… |
CVE-2022-33935 | Medium | 5.4 | 2022-08-30 | Dell EMC Data Protection Advisor versions 19.6 and earlier, contains a Stored Cross Site Scripting, an attacker could potentially exploit this vulnerability, l… |
CVE-2022-31232 | High | 8.6 | 2022-08-30 | SmartFabric storage software version 1.0.0 contains a Command-Injection vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerabi… |
CVE-2022-37237 | High | 7.5 | 2022-08-30 | An attacker can send malicious RTMP requests to make the ZLMediaKit server crash remotely. Affected version is below commit 7d8b212a3c3368bc2f6507cb74664fc419e… |
CVE-2022-37176 | Critical | 9.8 | 2022-08-30 | Tenda AC6(AC1200) v5.0 Firmware v02.03.01.114 and below contains a vulnerability which allows attackers to remove the Wi-Fi password and force the device into… |
CVE-2022-36552 | High | 7.5 | 2022-08-30 | Tenda AC6(AC1200) v5.0 Firmware v02.03.01.114 and below contains an issue in the component /cgi-bin/DownloadFlash which allows attackers to steal all data such… |
CVE-2022-37149 | Critical | 9.8 | 2022-08-30 | WAVLINK WL-WN575A3 RPT75A3.V4300.201217 was discovered to contain a command injection vulnerability when operating the file adm.cgi. This vulnerability allows… |
CVE-2022-2330 | Medium | 6.5 | 2022-08-30 | Improper Restriction of XML External Entity Reference vulnerability in DLP Endpoint for Windows prior to 11.9.100 allows a remote attacker to cause the DLP Age… |
CVE-2022-39028 | High | 7.5 | 2022-08-30 | telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference via 0xff 0xf7 or 0xff 0xf8. In a typical… |
CVE-2022-38118 | High | 8.8 | 2022-08-30 | OAKlouds Portal website’s Meeting Room has insufficient validation for user input. A remote attacker with general user privilege can perform SQL-injection to a… |
CVE-2022-38116 | Critical | 9.8 | 2022-08-30 | Le-yan Personnel and Salary Management System has hard-coded database account and password within the website source code. An unauthenticated remote attacker c… |
CVE-2022-26529 | Medium | 6.5 | 2022-08-30 | Realtek Linux/Android Bluetooth Mesh SDK has a buffer overflow vulnerability due to insufficient validation for segmented packets’ link parameter. An unauthent… |
CVE-2022-26528 | Medium | 6.5 | 2022-08-30 | Realtek Linux/Android Bluetooth Mesh SDK has a buffer overflow vulnerability due to insufficient validation for the length of segmented packets’ shift paramete… |
CVE-2022-26527 | Medium | 6.5 | 2022-08-30 | Realtek Linux/Android Bluetooth Mesh SDK has a buffer overflow vulnerability due to insufficient validation for the size of segmented packets’ reference parame… |
CVE-2022-25887 | Medium | 5.3 | 2022-08-30 | The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement log… |
CVE-2022-25857 | High | 7.5 | 2022-08-30 | The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections. |
CVE-2022-25646 | Medium | 5.4 | 2022-08-30 | All versions of package x-data-spreadsheet are vulnerable to Cross-site Scripting (XSS) due to missing sanitization of values inserted into the cells. |
CVE-2022-25635 | Medium | 6.5 | 2022-08-30 | Realtek Linux/Android Bluetooth Mesh SDK has a buffer overflow vulnerability due to insufficient validation for broadcast network packet length. An unauthentic… |
CVE-2022-24107 | High | 7.8 | 2022-08-30 | Xpdf prior to 4.04 lacked an integer overflow check in JPXStream.cc. |
CVE-2022-24106 | High | 7.8 | 2022-08-30 | In Xpdf prior to 4.04, the DCT (JPEG) decoder was incorrectly allowing the 'interleaved' flag to be changed after the first scan of the image, leading to an un… |
CVE-2022-38784 | High | 7.8 | 2022-08-30 | Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIGStream.cc). Processing a spec… |
CVE-2022-36714 | Critical | 9.8 | 2022-08-30 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Section parameter at /staff/lab.php. |
CVE-2022-36713 | Critical | 9.8 | 2022-08-30 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Section parameter at /librarian/lab.php. |
CVE-2022-36712 | Critical | 9.8 | 2022-08-30 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /staff/studentdetails.php. |
CVE-2022-36711 | Critical | 9.8 | 2022-08-30 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /staff/bookdetails.php. |
CVE-2022-36709 | Critical | 9.8 | 2022-08-30 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /staff/edit_book_details.php. |
CVE-2022-38625 | High | 8.8 | 2022-08-29 | Patlite NH-FB v1.46 and below was discovered to contain insufficient firmware validation during the upgrade firmware file upload process. This vulnerability al… |
CVE-2022-37681 | High | 7.5 | 2022-08-29 | Hitachi Kokusai Electric Newtork products for monitoring system (Camera, Decoder and Encoder) and below allows attckers to perform a directory traversal via a… |
CVE-2022-37680 | High | 7.5 | 2022-08-29 | An improper authentication for critical function issue in Hitachi Kokusai Electric Network products for monitoring system (Camera, Decoder and Encoder) and bel… |
CVE-2022-36560 | Critical | 9.8 | 2022-08-29 | Seiko SkyBridge MB-A200 v01.00.04 and below was discovered to contain multiple hard-coded passcodes for root. Attackers are able to access the passcodes at /et… |
CVE-2022-36559 | Critical | 9.8 | 2022-08-29 | Seiko SkyBridge MB-A200 v01.00.04 and below was discovered to contain a command injection vulnerability via the Ping parameter at ping_exec.cgi. |
CVE-2022-36558 | Critical | 9.8 | 2022-08-29 | Seiko SkyBridge MB-A100/A110 v4.2.0 and below implements a hard-coded passcode for the root account. Attackers are able to access the passcord via the file /et… |
CVE-2022-36557 | Critical | 9.8 | 2022-08-29 | Seiko SkyBridge MB-A100/A110 v4.2.0 and below was discovered to contain an arbitrary file upload vulnerability via the restore backup function. This vulnerabil… |
CVE-2022-36556 | Critical | 9.8 | 2022-08-29 | Seiko SkyBridge MB-A100/A110 v4.2.0 and below was discovered to contain a command injection vulnerability via the ipAddress parameter at 07system08execute_ping… |
CVE-2022-36555 | Critical | 9.8 | 2022-08-29 | Hytec Inter HWL-2511-SS v1.05 and below implements a SHA512crypt hash for the root account which can be easily cracked via a brute-force attack. |
CVE-2022-36554 | Critical | 9.8 | 2022-08-29 | A command injection vulnerability in the CLI (Command Line Interface) implementation of Hytec Inter HWL-2511-SS v1.05 and below allows attackers to execute arb… |
CVE-2022-36553 | Critical | 9.8 | 2022-08-29 | Hytec Inter HWL-2511-SS v1.05 and below was discovered to contain a command injection vulnerability via the component /www/cgi-bin/popen.cgi. |
CVE-2022-38772 | High | 8.8 | 2022-08-29 | Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 125658, 126003, 126105, and 126… |
CVE-2022-37177 | High | 7.5 | 2022-08-29 | HireVue Hiring Platform V1.0 suffers from Use of a Broken or Risky Cryptographic Algorithm. NOTE: this is disputed by the vendor for multiple reasons, e.g., it… |
CVE-2022-32993 | Critical | 9.8 | 2022-08-29 | TOTOLINK A7000R V4.1cu.4134 was discovered to contain an access control issue via /cgi-bin/ExportSettings.sh. |
CVE-2022-21385 | Medium | 6.2 | 2022-08-29 | A flaw in net_rds_alloc_sgs() in Oracle Linux kernels allows unprivileged local users to crash the machine. CVSS 3.1 Base Score 6.2 (Availability impacts). CVS… |
CVE-2022-3035 | Medium | 4.8 | 2022-08-29 | Cross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.0.11. |
CVE-2022-36037 | Medium | 5.9 | 2022-08-29 | kirby is a content management system (CMS) that adapts to many different projects and helps you build your own ideal interface. Cross-site scripting (XSS) is a… |
CVE-2022-36036 | Low | 3.6 | 2022-08-29 | mdx-mermaid provides plug and play access to Mermaid in MDX. There is a potential for an arbitrary javascript injection in versions less than 1.3.0 and 2.0.0-r… |
CVE-2022-2638 | Medium | 6.5 | 2022-08-29 | The Export All URLs WordPress plugin before 4.4 does not validate the path of the file to be removed on the system which is supposed to be the CSV file. This c… |
CVE-2022-2599 | Medium | 6.1 | 2022-08-29 | The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.21.83 does not sanitise and escape some parameters before outputting them back in… |
CVE-2022-2559 | High | 7.2 | 2022-08-29 | The Fluent Support WordPress plugin before 1.5.8 does not properly sanitise, validate and escape various parameters before using them in an SQL statement, lead… |
CVE-2022-2556 | Low | 2.7 | 2022-08-29 | The Mailchimp for WooCommerce WordPress plugin before 2.7.2 has an AJAX action that allows high privilege users to perform a POST request on behalf of the serv… |
CVE-2022-2538 | Medium | 6.1 | 2022-08-29 | The WP Hide & Security Enhancer WordPress plugin before 1.8 does not escape a parameter before outputting it back in an attribute of a backend page, leading to… |
CVE-2022-2537 | Medium | 6.1 | 2022-08-29 | The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 3.0.1 does not sanitise and escape some parameters before outputting them back in an attri… |
CVE-2022-2374 | Medium | 4.8 | 2022-08-29 | The Simply Schedule Appointments WordPress plugin before 1.5.7.7 does not sanitise and escape some of its settings, which could allow high privilege users such… |
CVE-2022-2373 | Medium | 5.3 | 2022-08-29 | The Simply Schedule Appointments WordPress plugin before 1.5.7.7 is missing authorisation in a REST endpoint, allowing unauthenticated users to retrieve WordPr… |
CVE-2022-2267 | Medium | 4.3 | 2022-08-29 | The Mailchimp for WooCommerce WordPress plugin before 2.7.1 has an AJAX action that allows any logged in users (such as subscriber) to perform a POST request o… |
CVE-2022-2261 | High | 7.2 | 2022-08-29 | The WPIDE WordPress plugin before 3.0 does not sanitize and validate the filename parameter before using it in a require statement in the admin dashboard, lead… |
CVE-2022-2080 | Medium | 4.3 | 2022-08-29 | The Sensei LMS WordPress plugin before 4.5.2 does not ensure that the sender of a private message is either the teacher or the original sender, allowing any au… |
CVE-2022-2034 | Medium | 5.3 | 2022-08-29 | The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private… |
CVE-2022-1663 | Medium | 6.5 | 2022-08-29 | The Stop Spam Comments WordPress plugin through 0.2.1.2 does not properly generate the Javascript access token for preventing abuse of comment section, allowin… |
CVE-2022-1123 | High | 7.2 | 2022-08-29 | The Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) WordPress plugin before 3.12.5 does not properly sanitize some parameters before inserting them… |
CVE-2022-36034 | High | 7.5 | 2022-08-29 | nitrado.js is a type safe wrapper for the Nitrado API. Possible ReDoS with lib input of `{{` and with many repetitions of `{{|`. This issue has been patched in… |
CVE-2022-36033 | Medium | 6.1 | 2022-08-29 | jsoup is a Java HTML parser, built for HTML editing, cleaning, scraping, and cross-site scripting (XSS) safety. jsoup may incorrectly sanitize HTML including `… |
CVE-2022-27558 | Medium | 5.9 | 2022-08-29 | HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability. Custom password policies are not enforced on certain iNotes forms which could all… |
CVE-2022-27547 | Medium | 6.1 | 2022-08-29 | HCL iNotes is susceptible to a link to non-existent domain vulnerability. An attacker could use this vulnerability to trick a user into supplying sensitive inf… |
CVE-2022-27546 | High | 8.3 | 2022-08-29 | HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input supplied with a form POS… |
CVE-2022-36200 | High | 7.5 | 2022-08-29 | In FiberHome VDSL2 Modem HG150-Ub_V3.0, Credentials of Admin are submitted in URL, which can be logged/sniffed. |
CVE-2022-35962 | High | 8.0 | 2022-08-29 | Zulip is an open source team chat and Zulip Mobile is an app for iOS and Andriod users. In Zulip Mobile through version 27.189, a crafted link in a message sen… |
CVE-2022-31677 | Medium | 5.4 | 2022-08-29 | An Insufficient Session Expiration issue was discovered in the Pinniped Supervisor (before v0.19.0). A user authenticating to Kubernetes clusters via the Pinni… |
CVE-2022-2961 | High | 7.0 | 2022-08-29 | A use-after-free flaw was found in the Linux kernel’s PLP Rose functionality in the way a user triggers a race condition by calling bind while simultaneously t… |
CVE-2022-2953 | Medium | 5.5 | 2022-08-29 | LibTIFF 4.4.0 has an out-of-bounds read in extractImageSection in tools/tiffcrop.c:6905, allowing attackers to cause a denial-of-service via a crafted tiff fil… |
CVE-2022-1204 | Medium | 5.5 | 2022-08-29 | A use-after-free flaw was found in the Linux kernel’s Amateur Radio AX.25 protocol functionality in the way a user connects with the protocol. This flaw allows… |
CVE-2022-1199 | High | 7.5 | 2022-08-29 | A flaw was found in the Linux kernel. This flaw allows an attacker to crash the Linux kernel by simulating amateur radio from the user space, resulting in a nu… |
CVE-2022-1198 | Medium | 5.5 | 2022-08-29 | A use-after-free vulnerabilitity was discovered in drivers/net/hamradio/6pack.c of linux that allows an attacker to crash linux kernel by simulating ax25 devic… |
CVE-2022-1184 | Medium | 5.5 | 2022-08-29 | A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel’s filesystem sub-component. This flaw allows a local attacker with a u… |
CVE-2022-1117 | High | 8.4 | 2022-08-29 | A vulnerability was found in fapolicyd. The vulnerability occurs due to an assumption on how glibc names the runtime linker, a build time regular expression ma… |
CVE-2022-1115 | Medium | 5.5 | 2022-08-29 | A heap-buffer-overflow flaw was found in ImageMagick’s PushShortPixel() function of quantum-private.h file. This vulnerability is triggered when an attacker pa… |
CVE-2022-1043 | High | 8.8 | 2022-08-29 | A flaw was found in the Linux kernel’s io_uring implementation. This flaw allows an attacker with a local account to corrupt system memory, crash the system or… |
CVE-2022-1016 | Medium | 5.5 | 2022-08-29 | A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a use-after-free. This issue needs to handle 'return' with… |
CVE-2022-0934 | High | 7.5 | 2022-08-29 | A single-byte, non-arbitrary write/use-after-free flaw was found in dnsmasq. This flaw allows an attacker who sends a crafted packet processed by dnsmasq, pote… |