2022 CVEs (page 148)
Page 148 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-0852 | Medium | 5.5 | 2022-08-29 | There is a flaw in convert2rhel. convert2rhel passes the Red Hat account password to subscription-manager via the command line, which could allow unauthorized… |
CVE-2022-0851 | Medium | 5.5 | 2022-08-29 | There is a flaw in convert2rhel. When the --activationkey option is used with convert2rhel, the activation key is subsequently passed to subscription-manager v… |
CVE-2022-0850 | High | 7.1 | 2022-08-29 | A vulnerability was found in linux kernel, where an information leak occurs via ext4_extent_header to userspace. |
CVE-2022-0812 | Medium | 4.3 | 2022-08-29 | An information leak flaw was found in NFS over RDMA in the net/sunrpc/xprtrdma/rpc_rdma.c in the Linux Kernel. This flaw allows an attacker with normal user pr… |
CVE-2022-0718 | Medium | 4.9 | 2022-08-29 | A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote ( " ) in them cause incorrect masking in debug logs, causing any… |
CVE-2022-0669 | Medium | 6.5 | 2022-08-29 | A flaw was found in dpdk. This flaw allows a malicious vhost-user master to attach an unexpected number of fds as ancillary data to VHOST_USER_GET_INFLIGHT_FD… |
CVE-2022-0497 | High | 7.1 | 2022-08-29 | A vulnerbiility was found in Openscad, where a .scad file with no trailing newline could cause an out-of-bounds read during parsing of annotations. |
CVE-2022-0496 | Medium | 5.5 | 2022-08-29 | A vulnerbiility was found in Openscad, where a DXF-format drawing with particular (not necessarily malformed!) properties may cause an out-of-bounds memory acc… |
CVE-2022-0485 | Medium | 4.8 | 2022-08-29 | A flaw was found in the copying tool `nbdcopy` of libnbd. When performing multi-threaded copies using asynchronous nbd calls, nbdcopy was blindly treating the… |
CVE-2022-0480 | Medium | 5.5 | 2022-08-29 | A flaw was found in the filelock_init in fs/locks.c function in the Linux kernel. This issue can lead to host memory exhaustion due to memcg not limiting the n… |
CVE-2022-0400 | High | 7.5 | 2022-08-29 | An out-of-bounds read vulnerability was discovered in linux kernel in the smc protocol stack, causing remote dos. |
CVE-2022-0367 | High | 7.8 | 2022-08-29 | A heap-based buffer overflow flaw was found in libmodbus in function modbus_reply() in src/modbus.c. |
CVE-2022-0358 | High | 7.8 | 2022-08-29 | A flaw was found in the QEMU virtio-fs shared file system daemon (virtiofsd) implementation. This flaw is strictly related to CVE-2018-13405. A local guest use… |
CVE-2022-0336 | High | 8.8 | 2022-08-29 | The Samba AD DC includes checks when adding service principals names (SPNs) to an account to ensure that SPNs do not alias with those already in the database… |
CVE-2022-0284 | High | 7.1 | 2022-08-29 | A heap-based-buffer-over-read flaw was found in ImageMagick's GetPixelAlpha() function of 'pixel-accessor.h'. This vulnerability is triggered when an attacker… |
CVE-2022-36690 | High | 8.8 | 2022-08-29 | Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=user/manage_user&id=. |
CVE-2022-36689 | High | 8.8 | 2022-08-29 | Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the month parameter at /admin/?page=reports/waste&month=. |
CVE-2022-36688 | High | 8.8 | 2022-08-29 | Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the month parameter at /admin/?page=reports/stockout&month… |
CVE-2022-36687 | Medium | 6.5 | 2022-08-29 | Ingredients Stock Management System v1.0 was discovered to contain an arbitrary file deletion vulnerability via the component /classes/Master.php?f=delete_img. |
CVE-2022-36686 | High | 8.8 | 2022-08-29 | Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the month parameter at /admin/?page=reports/stockin&month=. |
CVE-2022-35020 | Medium | 5.5 | 2022-08-29 | Advancecomp v2.3 was discovered to contain a heap buffer overflow via the component __interceptor_memcpy at /sanitizer_common/sanitizer_common_interceptors.inc. |
CVE-2022-35019 | Medium | 5.5 | 2022-08-29 | Advancecomp v2.3 was discovered to contain a segmentation fault. |
CVE-2022-35018 | Medium | 5.5 | 2022-08-29 | Advancecomp v2.3 was discovered to contain a segmentation fault. |
CVE-2022-35017 | Medium | 5.5 | 2022-08-29 | Advancecomp v2.3 was discovered to contain a heap buffer overflow. |
CVE-2022-35016 | Medium | 5.5 | 2022-08-29 | Advancecomp v2.3 was discovered to contain a heap buffer overflow. |
CVE-2022-35015 | Medium | 5.5 | 2022-08-29 | Advancecomp v2.3 was discovered to contain a heap buffer overflow via le_uint32_read at /lib/endianrw.h. |
CVE-2022-35014 | Medium | 5.5 | 2022-08-29 | Advancecomp v2.3 contains a segmentation fault. |
CVE-2022-37059 | Medium | 4.8 | 2022-08-29 | Cross Site Scripting (XSS) in Admin Panel of Subrion CMS 4.2.1 allows attacker to inject arbitrary code via Login Field |
CVE-2022-3019 | High | 8.8 | 2022-08-29 | The forgot password token basically just makes us capable of taking over the account of whoever comment in an app that we can see (bruteforcing comment id's mi… |
CVE-2022-36194 | Medium | 5.4 | 2022-08-29 | Centreon 22.04.0 is vulnerable to Cross Site Scripting (XSS) from the function Pollers > Broker Configuration by adding a crafted payload into the name paramet… |
CVE-2022-32548 | Critical | 10.0 | 2022-08-29 | An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bin/wlogin.cgi has a buffer overflow via t… |
CVE-2022-22897 | Critical | 9.8 | 2022-08-29 | A SQL injection vulnerability in the product_all_one_img and image_product parameters of the ApolloTheme AP PageBuilder component through 2.4.4 for PrestaShop… |
CVE-2022-25921 | High | 8.1 | 2022-08-29 | All versions of package morgan-json are vulnerable to Arbitrary Code Execution due to missing sanitization of input passed to the Function constructor. |
CVE-2022-25644 | Critical | 9.8 | 2022-08-29 | All versions of package @pendo324/get-process-by-name are vulnerable to Arbitrary Code Execution due to improper sanitization of getProcessByName function. |
CVE-2022-25641 | Medium | 5.5 | 2022-08-29 | Foxit PDF Reader before 11.2.2 and PDF Editor before 11.2.2, and PhantomPDF before 10.1.8, mishandle cross-reference information during compressed-object parsi… |
CVE-2022-21165 | Critical | 9.8 | 2022-08-29 | All versions of package font-converter are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the child… |
CVE-2022-34668 | Critical | 9.8 | 2022-08-29 | NVFLARE, versions prior to 2.1.4, contains a vulnerability that deserialization of Untrusted Data due to Pickle usage may allow an unprivileged network attacke… |
CVE-2022-38511 | High | 7.8 | 2022-08-29 | TOTOLINK A810R V5.9c.4050_B20190424 was discovered to contain a command injection vulnerability via the component downloadFile.cgi. |
CVE-2022-38510 | High | 7.8 | 2022-08-29 | Tenda_TX9pro V22.03.02.10 was discovered to contain a buffer overflow via the component httpd/SetNetControlList. |
CVE-2022-36616 | High | 7.8 | 2022-08-29 | TOTOLINK A810R V4.1.2cu.5182_B20201026 and V5.9c.4050_B20190424 was discovered to contain a hardcoded password for root at /etc/shadow.sample. |
CVE-2022-36615 | High | 7.8 | 2022-08-29 | TOTOLINK A3000RU V4.1.2cu.5185_B20201128 was discovered to contain a hardcoded password for root at /etc/shadow.sample. |
CVE-2022-36614 | High | 7.8 | 2022-08-29 | TOTOLINK A860R V4.1.2cu.5182_B20201027 was discovered to contain a hardcoded password for root at /etc/shadow.sample. |
CVE-2022-36613 | High | 7.8 | 2022-08-29 | TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a hardcoded password for root at /etc/shadow.sample. |
CVE-2022-36612 | High | 7.8 | 2022-08-29 | TOTOLINK A950RG V4.1.2cu.5204_B20210112 was discovered to contain a hardcoded password for root at /etc/shadow.sample. |
CVE-2022-36611 | High | 7.8 | 2022-08-29 | TOTOLINK A800R V4.1.2cu.5137_B20200730 was discovered to contain a hardcoded password for root at /etc/shadow.sample. |
CVE-2022-36610 | High | 7.8 | 2022-08-29 | TOTOLINK A720R V4.1.5cu.532_B20210610 was discovered to contain a hardcoded password for root at /etc/shadow.sample. |
CVE-2022-36573 | Medium | 6.1 | 2022-08-29 | A cross-site scripting (XSS) vulnerability in Pagekit CMS v1.0.18 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into… |
CVE-2022-36572 | Critical | 9.8 | 2022-08-29 | Sinsiu Sinsiu Enterprise Website System v1.1.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /upload/admin.php?/dea… |
CVE-2022-36708 | Critical | 9.8 | 2022-08-28 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Id parameter at /student/bookdetails.php. |
CVE-2022-36706 | Critical | 9.8 | 2022-08-28 | Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the Id parameter at /stocks/manage_stockout.php. |
CVE-2022-36705 | Critical | 9.8 | 2022-08-28 | Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the Id parameter at /stocks/manage_waste.php. |
CVE-2022-36704 | High | 8.8 | 2022-08-28 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Id parameter at /librarian/studentdetails.php. |
CVE-2022-38571 | High | 7.5 | 2022-08-28 | Tenda M3 V1.0.0.12(4856) was discovered to contain a buffer overflow in the function formSetGuideListItem. |
CVE-2022-38570 | High | 7.5 | 2022-08-28 | Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow in the function formDelPushedAd. This vulnerability allows attackers to cause a Denial of S… |
CVE-2022-38569 | High | 7.5 | 2022-08-28 | Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow in the function formDelAd. |
CVE-2022-38568 | High | 7.5 | 2022-08-28 | Tenda M3 V1.0.0.12(4856) was discovered to contain a heap buffer overflow vulnerability in the function formSetFixTools. This vulnerability allows attackers to… |
CVE-2022-38567 | High | 7.5 | 2022-08-28 | Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow vulnerability in the function formSetAdConfigInfo. This vulnerability allows attackers to c… |
CVE-2022-38566 | High | 7.5 | 2022-08-28 | Tenda M3 V1.0.0.12(4856) was discovered to contain a heap buffer overflow vulnerability in the function formEmailTest. This vulnerability allows attackers to c… |
CVE-2022-38565 | High | 7.5 | 2022-08-28 | Tenda M3 V1.0.0.12(4856) was discovered to contain a heap buffer overflow vulnerability in the function formEmailTest. This vulnerability allows attackers to c… |
CVE-2022-38564 | High | 7.5 | 2022-08-28 | Tenda M3 V1.0.0.12(4856) was discovered to contain a buffer overflow vulnerability in the function formSetPicListItem. This vulnerability allows attackers to c… |
CVE-2022-38563 | High | 7.5 | 2022-08-28 | Tenda M3 V1.0.0.12(4856) was discovered to contain a heap buffer overflow vulnerability in the function formSetFixTools. This vulnerability allows attackers to… |
CVE-2022-38562 | High | 7.5 | 2022-08-28 | Tenda M3 V1.0.0.12(4856) was discovered to contain a heap buffer overflow vulnerability in the function formSetFixTools. This vulnerability allows attackers to… |
CVE-2022-38555 | Critical | 9.8 | 2022-08-28 | Linksys E1200 v1.0.04 is vulnerable to Buffer Overflow via ej_get_web_page_name. |
CVE-2022-37056 | Critical | 9.8 | 2022-08-28 | D-Link GO-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 is vulnerable to Command Injection via /cgibin, hnap_main, |
CVE-2022-37055 | Critical | 9.8 | 2022-08-28 | D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Buffer Overflow via cgibin, hnap_main, |
CVE-2022-38557 | Critical | 9.8 | 2022-08-28 | D-Link DIR845L v1.00-v1.03 contains a Static Default Credential vulnerability in /etc/init0.d/S80telnetd.sh. |
CVE-2022-38556 | Critical | 9.8 | 2022-08-28 | Trendnet TEW733GR v1.03B01 contains a Static Default Credential vulnerability in /etc/init0.d/S80telnetd.sh. |
CVE-2022-37057 | Critical | 9.8 | 2022-08-28 | D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Command Injection via cgibin, ssdpcgi_main. |
CVE-2022-37053 | Critical | 9.8 | 2022-08-28 | TRENDnet TEW733GR v1.03B01 is vulnerable to Command injection via /htdocs/upnpinc/gena.php. |
CVE-2022-36756 | Critical | 9.8 | 2022-08-28 | DIR845L A1 v1.00-v1.03 is vulnerable to command injection via /htdocs/upnpinc/gena.php. |
CVE-2022-36755 | Critical | 9.8 | 2022-08-28 | D-Link DIR845L A1 contains a authentication vulnerability via an AUTHORIZED_GROUP=1 value, as demonstrated by a request for getcfg.php. |
CVE-2022-3017 | Medium | 6.5 | 2022-08-28 | Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 0.10.38. |
CVE-2022-3016 | High | 7.8 | 2022-08-28 | Use After Free in GitHub repository vim/vim prior to 9.0.0286. |
CVE-2022-38794 | High | 7.5 | 2022-08-27 | Zaver through 2020-12-15 allows directory traversal via the GET /.. substring. |
CVE-2022-38792 | Critical | 9.8 | 2022-08-27 | The exotel (aka exotel-py) package in PyPI as of 0.1.6 includes a code execution backdoor inserted by a third party. |
CVE-2022-38791 | Medium | 5.5 | 2022-08-27 | In MariaDB before 10.9.2, compress_write in extra/mariabackup/ds_compress.cc does not release data_mutex upon a stream write failure, which allows local users… |
CVE-2022-2787 | Medium | 4.3 | 2022-08-27 | Schroot before 1.6.13 had too permissive rules on chroot or session names, allowing a denial of service on the schroot service for all users that may start a s… |
CVE-2022-3015 | Low | 3.5 | 2022-08-27 | A vulnerability, which was classified as problematic, has been found in oretnom23 Fast Food Ordering System. This issue affects some unknown processing of the… |
CVE-2022-3014 | Low | 3.5 | 2022-08-27 | A vulnerability classified as problematic was found in SourceCodester Simple Task Managing System. This vulnerability affects unknown code. The manipulation of… |
CVE-2022-3013 | Medium | 6.3 | 2022-08-27 | A vulnerability classified as critical has been found in SourceCodester Simple Task Managing System. This affects an unknown part of the file /loginVaLidation… |
CVE-2022-3012 | Medium | 6.3 | 2022-08-27 | A vulnerability was found in oretnom23 Fast Food Ordering System. It has been rated as critical. Affected by this issue is some unknown functionality of the fi… |
CVE-2022-36548 | Medium | 5.4 | 2022-08-26 | Edoc-doctor-appointment-system v1.0.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability at /patient/settings.php. This vulnerability… |
CVE-2022-36547 | Medium | 6.1 | 2022-08-26 | Edoc-doctor-appointment-system v1.0.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability at /patient/index.php. This vulnerability… |
CVE-2022-36546 | High | 8.8 | 2022-08-26 | Edoc-doctor-appointment-system v1.0.1 was discovered to contain a Cross-Site Request Forgery (CSRF) via /patient/settings.php. |
CVE-2022-36545 | Critical | 9.8 | 2022-08-26 | Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/settings.php. |
CVE-2022-36544 | Critical | 9.8 | 2022-08-26 | Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/booking.php. |
CVE-2022-36543 | Critical | 9.8 | 2022-08-26 | Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/doctors.php. |
CVE-2022-36542 | Medium | 6.5 | 2022-08-26 | An access control issue in the component /ip/admin/ of Edoc-doctor-appointment-system v1.0.1 allows attackers to arbitrarily edit, read, and delete Administrat… |
CVE-2022-2915 | High | 8.8 | 2022-08-26 | A Heap-based Buffer Overflow vulnerability in the SonicWall SMA100 appliance allows a remote authenticated attacker to cause Denial of Service (DoS) on the app… |
CVE-2022-36537 | High | 7.5 | 2022-08-26 | ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component Au… |
CVE-2022-36529 | High | 8.8 | 2022-08-26 | Kensite CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities via the name and oldname parameters at /framework/mod/db/DBMapper.xml. |
CVE-2022-36522 | Medium | 6.5 | 2022-08-26 | Mikrotik RouterOs through stable v6.48.3 was discovered to contain an assertion failure in the component /advanced-tools/nova/bin/netwatch. This vulnerability… |
CVE-2022-35714 | Medium | 5.4 | 2022-08-26 | IBM Maximo Asset Management 7.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… |
CVE-2022-34303 | Medium | 6.7 | 2022-08-26 | A flaw was found in Eurosoft bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper with Secure Boot protections. In order to l… |
CVE-2022-34302 | Medium | 6.7 | 2022-08-26 | A flaw was found in New Horizon Datasys bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper with Secure Boot protections. In… |
CVE-2022-34301 | Medium | 6.7 | 2022-08-26 | A flaw was found in CryptoPro Secure Disk bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper with Secure Boot protections… |
CVE-2022-31773 | High | 8.8 | 2022-08-26 | IBM DataPower Gateway V10CD, 10.0.1, and 2018.4.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthoriz… |
CVE-2022-0225 | Medium | 5.4 | 2022-08-26 | A flaw was found in Keycloak. This flaw allows a privileged attacker to use the malicious payload as the group name while creating a new group from the admin c… |
CVE-2022-0217 | High | 7.5 | 2022-08-26 | It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given… |
CVE-2022-0216 | Medium | 4.4 | 2022-08-26 | A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs while processing repeated messages to cance… |