2022 CVEs (page 148)
Page 148 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-36686 | High | 8.8 | 2022-08-29 | Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the month parameter at /admin/?page=reports/stockin&month=. |
CVE-2022-35020 | Medium | 5.5 | 2022-08-29 | Advancecomp v2.3 was discovered to contain a heap buffer overflow via the component __interceptor_memcpy at /sanitizer_common/sanitizer_common_interceptors.inc. |
CVE-2022-35019 | Medium | 5.5 | 2022-08-29 | Advancecomp v2.3 was discovered to contain a segmentation fault. |
CVE-2022-35018 | Medium | 5.5 | 2022-08-29 | Advancecomp v2.3 was discovered to contain a segmentation fault. |
CVE-2022-35017 | Medium | 5.5 | 2022-08-29 | Advancecomp v2.3 was discovered to contain a heap buffer overflow. |
CVE-2022-35016 | Medium | 5.5 | 2022-08-29 | Advancecomp v2.3 was discovered to contain a heap buffer overflow. |
CVE-2022-35015 | Medium | 5.5 | 2022-08-29 | Advancecomp v2.3 was discovered to contain a heap buffer overflow via le_uint32_read at /lib/endianrw.h. |
CVE-2022-35014 | Medium | 5.5 | 2022-08-29 | Advancecomp v2.3 contains a segmentation fault. |
CVE-2022-37059 | Medium | 4.8 | 2022-08-29 | Cross Site Scripting (XSS) in Admin Panel of Subrion CMS 4.2.1 allows attacker to inject arbitrary code via Login Field |
CVE-2022-3019 | High | 8.8 | 2022-08-29 | The forgot password token basically just makes us capable of taking over the account of whoever comment in an app that we can see (bruteforcing comment id's mi… |
CVE-2022-36194 | Medium | 5.4 | 2022-08-29 | Centreon 22.04.0 is vulnerable to Cross Site Scripting (XSS) from the function Pollers > Broker Configuration by adding a crafted payload into the name paramet… |
CVE-2022-32548 | Critical | 10.0 | 2022-08-29 | An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. /cgi-bin/wlogin.cgi has a buffer overflow via t… |
CVE-2022-22897 | Critical | 9.8 | 2022-08-29 | A SQL injection vulnerability in the product_all_one_img and image_product parameters of the ApolloTheme AP PageBuilder component through 2.4.4 for PrestaShop… |
CVE-2022-25921 | High | 8.1 | 2022-08-29 | All versions of package morgan-json are vulnerable to Arbitrary Code Execution due to missing sanitization of input passed to the Function constructor. |
CVE-2022-25644 | Critical | 9.8 | 2022-08-29 | All versions of package @pendo324/get-process-by-name are vulnerable to Arbitrary Code Execution due to improper sanitization of getProcessByName function. |
CVE-2022-25641 | Medium | 5.5 | 2022-08-29 | Foxit PDF Reader before 11.2.2 and PDF Editor before 11.2.2, and PhantomPDF before 10.1.8, mishandle cross-reference information during compressed-object parsi… |
CVE-2022-21165 | Critical | 9.8 | 2022-08-29 | All versions of package font-converter are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the child… |
CVE-2022-34668 | Critical | 9.8 | 2022-08-29 | NVFLARE, versions prior to 2.1.4, contains a vulnerability that deserialization of Untrusted Data due to Pickle usage may allow an unprivileged network attacke… |
CVE-2022-38511 | High | 7.8 | 2022-08-29 | TOTOLINK A810R V5.9c.4050_B20190424 was discovered to contain a command injection vulnerability via the component downloadFile.cgi. |
CVE-2022-38510 | High | 7.8 | 2022-08-29 | Tenda_TX9pro V22.03.02.10 was discovered to contain a buffer overflow via the component httpd/SetNetControlList. |
CVE-2022-36616 | High | 7.8 | 2022-08-29 | TOTOLINK A810R V4.1.2cu.5182_B20201026 and V5.9c.4050_B20190424 was discovered to contain a hardcoded password for root at /etc/shadow.sample. |
CVE-2022-36615 | High | 7.8 | 2022-08-29 | TOTOLINK A3000RU V4.1.2cu.5185_B20201128 was discovered to contain a hardcoded password for root at /etc/shadow.sample. |
CVE-2022-36614 | High | 7.8 | 2022-08-29 | TOTOLINK A860R V4.1.2cu.5182_B20201027 was discovered to contain a hardcoded password for root at /etc/shadow.sample. |
CVE-2022-36613 | High | 7.8 | 2022-08-29 | TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a hardcoded password for root at /etc/shadow.sample. |
CVE-2022-36612 | High | 7.8 | 2022-08-29 | TOTOLINK A950RG V4.1.2cu.5204_B20210112 was discovered to contain a hardcoded password for root at /etc/shadow.sample. |
CVE-2022-36611 | High | 7.8 | 2022-08-29 | TOTOLINK A800R V4.1.2cu.5137_B20200730 was discovered to contain a hardcoded password for root at /etc/shadow.sample. |
CVE-2022-36610 | High | 7.8 | 2022-08-29 | TOTOLINK A720R V4.1.5cu.532_B20210610 was discovered to contain a hardcoded password for root at /etc/shadow.sample. |
CVE-2022-36573 | Medium | 6.1 | 2022-08-29 | A cross-site scripting (XSS) vulnerability in Pagekit CMS v1.0.18 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into… |
CVE-2022-36572 | Critical | 9.8 | 2022-08-29 | Sinsiu Sinsiu Enterprise Website System v1.1.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /upload/admin.php?/dea… |
CVE-2022-36708 | Critical | 9.8 | 2022-08-28 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Id parameter at /student/bookdetails.php. |
CVE-2022-36706 | Critical | 9.8 | 2022-08-28 | Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the Id parameter at /stocks/manage_stockout.php. |
CVE-2022-36705 | Critical | 9.8 | 2022-08-28 | Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the Id parameter at /stocks/manage_waste.php. |
CVE-2022-36704 | High | 8.8 | 2022-08-28 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Id parameter at /librarian/studentdetails.php. |
CVE-2022-38571 | High | 7.5 | 2022-08-28 | Tenda M3 V1.0.0.12(4856) was discovered to contain a buffer overflow in the function formSetGuideListItem. |
CVE-2022-38570 | High | 7.5 | 2022-08-28 | Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow in the function formDelPushedAd. This vulnerability allows attackers to cause a Denial of S… |
CVE-2022-38569 | High | 7.5 | 2022-08-28 | Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow in the function formDelAd. |
CVE-2022-38568 | High | 7.5 | 2022-08-28 | Tenda M3 V1.0.0.12(4856) was discovered to contain a heap buffer overflow vulnerability in the function formSetFixTools. This vulnerability allows attackers to… |
CVE-2022-38567 | High | 7.5 | 2022-08-28 | Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow vulnerability in the function formSetAdConfigInfo. This vulnerability allows attackers to c… |
CVE-2022-38566 | High | 7.5 | 2022-08-28 | Tenda M3 V1.0.0.12(4856) was discovered to contain a heap buffer overflow vulnerability in the function formEmailTest. This vulnerability allows attackers to c… |
CVE-2022-38565 | High | 7.5 | 2022-08-28 | Tenda M3 V1.0.0.12(4856) was discovered to contain a heap buffer overflow vulnerability in the function formEmailTest. This vulnerability allows attackers to c… |
CVE-2022-38564 | High | 7.5 | 2022-08-28 | Tenda M3 V1.0.0.12(4856) was discovered to contain a buffer overflow vulnerability in the function formSetPicListItem. This vulnerability allows attackers to c… |
CVE-2022-38563 | High | 7.5 | 2022-08-28 | Tenda M3 V1.0.0.12(4856) was discovered to contain a heap buffer overflow vulnerability in the function formSetFixTools. This vulnerability allows attackers to… |
CVE-2022-38562 | High | 7.5 | 2022-08-28 | Tenda M3 V1.0.0.12(4856) was discovered to contain a heap buffer overflow vulnerability in the function formSetFixTools. This vulnerability allows attackers to… |
CVE-2022-38555 | Critical | 9.8 | 2022-08-28 | Linksys E1200 v1.0.04 is vulnerable to Buffer Overflow via ej_get_web_page_name. |
CVE-2022-37056 | Critical | 9.8 | 2022-08-28 | D-Link GO-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 is vulnerable to Command Injection via /cgibin, hnap_main, |
CVE-2022-37055 | Critical | 9.8 | 2022-08-28 | D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Buffer Overflow via cgibin, hnap_main, |
CVE-2022-38557 | Critical | 9.8 | 2022-08-28 | D-Link DIR845L v1.00-v1.03 contains a Static Default Credential vulnerability in /etc/init0.d/S80telnetd.sh. |
CVE-2022-38556 | Critical | 9.8 | 2022-08-28 | Trendnet TEW733GR v1.03B01 contains a Static Default Credential vulnerability in /etc/init0.d/S80telnetd.sh. |
CVE-2022-37057 | Critical | 9.8 | 2022-08-28 | D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Command Injection via cgibin, ssdpcgi_main. |
CVE-2022-37053 | Critical | 9.8 | 2022-08-28 | TRENDnet TEW733GR v1.03B01 is vulnerable to Command injection via /htdocs/upnpinc/gena.php. |
CVE-2022-36756 | Critical | 9.8 | 2022-08-28 | DIR845L A1 v1.00-v1.03 is vulnerable to command injection via /htdocs/upnpinc/gena.php. |
CVE-2022-36755 | Critical | 9.8 | 2022-08-28 | D-Link DIR845L A1 contains a authentication vulnerability via an AUTHORIZED_GROUP=1 value, as demonstrated by a request for getcfg.php. |
CVE-2022-3017 | Medium | 6.5 | 2022-08-28 | Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 0.10.38. |
CVE-2022-3016 | High | 7.8 | 2022-08-28 | Use After Free in GitHub repository vim/vim prior to 9.0.0286. |
CVE-2022-38794 | High | 7.5 | 2022-08-27 | Zaver through 2020-12-15 allows directory traversal via the GET /.. substring. |
CVE-2022-38792 | Critical | 9.8 | 2022-08-27 | The exotel (aka exotel-py) package in PyPI as of 0.1.6 includes a code execution backdoor inserted by a third party. |
CVE-2022-38791 | Medium | 5.5 | 2022-08-27 | In MariaDB before 10.9.2, compress_write in extra/mariabackup/ds_compress.cc does not release data_mutex upon a stream write failure, which allows local users… |
CVE-2022-2787 | Medium | 4.3 | 2022-08-27 | Schroot before 1.6.13 had too permissive rules on chroot or session names, allowing a denial of service on the schroot service for all users that may start a s… |
CVE-2022-3015 | Low | 3.5 | 2022-08-27 | A vulnerability, which was classified as problematic, has been found in oretnom23 Fast Food Ordering System. This issue affects some unknown processing of the… |
CVE-2022-3014 | Low | 3.5 | 2022-08-27 | A vulnerability classified as problematic was found in SourceCodester Simple Task Managing System. This vulnerability affects unknown code. The manipulation of… |
CVE-2022-3013 | Medium | 6.3 | 2022-08-27 | A vulnerability classified as critical has been found in SourceCodester Simple Task Managing System. This affects an unknown part of the file /loginVaLidation… |
CVE-2022-3012 | Medium | 6.3 | 2022-08-27 | A vulnerability was found in oretnom23 Fast Food Ordering System. It has been rated as critical. Affected by this issue is some unknown functionality of the fi… |
CVE-2022-36548 | Medium | 5.4 | 2022-08-26 | Edoc-doctor-appointment-system v1.0.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability at /patient/settings.php. This vulnerability… |
CVE-2022-36547 | Medium | 6.1 | 2022-08-26 | Edoc-doctor-appointment-system v1.0.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability at /patient/index.php. This vulnerability… |
CVE-2022-36546 | High | 8.8 | 2022-08-26 | Edoc-doctor-appointment-system v1.0.1 was discovered to contain a Cross-Site Request Forgery (CSRF) via /patient/settings.php. |
CVE-2022-36545 | Critical | 9.8 | 2022-08-26 | Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/settings.php. |
CVE-2022-36544 | Critical | 9.8 | 2022-08-26 | Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/booking.php. |
CVE-2022-36543 | Critical | 9.8 | 2022-08-26 | Edoc-doctor-appointment-system v1.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /patient/doctors.php. |
CVE-2022-36542 | Medium | 6.5 | 2022-08-26 | An access control issue in the component /ip/admin/ of Edoc-doctor-appointment-system v1.0.1 allows attackers to arbitrarily edit, read, and delete Administrat… |
CVE-2022-2915 | High | 8.8 | 2022-08-26 | A Heap-based Buffer Overflow vulnerability in the SonicWall SMA100 appliance allows a remote authenticated attacker to cause Denial of Service (DoS) on the app… |
CVE-2022-36537 | High | 7.5 | 2022-08-26 | ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component Au… |
CVE-2022-36529 | High | 8.8 | 2022-08-26 | Kensite CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities via the name and oldname parameters at /framework/mod/db/DBMapper.xml. |
CVE-2022-36522 | Medium | 6.5 | 2022-08-26 | Mikrotik RouterOs through stable v6.48.3 was discovered to contain an assertion failure in the component /advanced-tools/nova/bin/netwatch. This vulnerability… |
CVE-2022-35714 | Medium | 5.4 | 2022-08-26 | IBM Maximo Asset Management 7.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… |
CVE-2022-34303 | Medium | 6.7 | 2022-08-26 | A flaw was found in Eurosoft bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper with Secure Boot protections. In order to l… |
CVE-2022-34302 | Medium | 6.7 | 2022-08-26 | A flaw was found in New Horizon Datasys bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper with Secure Boot protections. In… |
CVE-2022-34301 | Medium | 6.7 | 2022-08-26 | A flaw was found in CryptoPro Secure Disk bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper with Secure Boot protections… |
CVE-2022-31773 | High | 8.8 | 2022-08-26 | IBM DataPower Gateway V10CD, 10.0.1, and 2018.4.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthoriz… |
CVE-2022-0225 | Medium | 5.4 | 2022-08-26 | A flaw was found in Keycloak. This flaw allows a privileged attacker to use the malicious payload as the group name while creating a new group from the admin c… |
CVE-2022-0217 | High | 7.5 | 2022-08-26 | It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given… |
CVE-2022-0216 | Medium | 4.4 | 2022-08-26 | A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs while processing repeated messages to cance… |
CVE-2022-0207 | Medium | 4.7 | 2022-08-26 | A race condition was found in vdsm. Functionality to obfuscate sensitive values in log files that may lead to values being stored in clear text. |
CVE-2022-0175 | Medium | 5.5 | 2022-08-26 | A flaw was found in the VirGL virtual OpenGL renderer (virglrenderer). The virgl did not properly initialize memory when allocating a host-backed memory resour… |
CVE-2022-0171 | Medium | 5.5 | 2022-08-26 | A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root (host) user-level application to crash the host kerne… |
CVE-2022-0168 | Medium | 4.4 | 2022-08-26 | A denial of service (DOS) issue was found in the Linux kernel’s smb2_ioctl_query_info function in the fs/cifs/smb2ops.c Common Internet File System (CIFS) due… |
CVE-2022-0084 | High | 7.5 | 2022-08-26 | A flaw was found in XNIO, specifically in the notifyReadClosed method. The issue revealed this method was logging a message to another expected end. This flaw… |
CVE-2022-25625 | High | 8.8 | 2022-08-26 | A malicious unauthorized PAM user can access the administration configuration data and change the values. |
CVE-2022-36521 | High | 7.5 | 2022-08-26 | Insecure permissions in cskefu v7.0.1 allows unauthenticated attackers to arbitrarily add administrator accounts. |
CVE-2022-37152 | Critical | 9.8 | 2022-08-26 | An issue was discovered in Online Diagnostic Lab Management System 1.0, There is a SQL injection vulnerability via "dob" parameter in "/classes/Users.php?f=sav… |
CVE-2022-37151 | High | 7.5 | 2022-08-26 | There is an unauthorized access vulnerability in Online Diagnostic Lab Management System 1.0. |
CVE-2022-37150 | Medium | 5.4 | 2022-08-26 | An issue was discovered in Online Diagnostic Lab Management System 1.0. There is a stored XSS vulnerability via firstname, address, middlename, lastname , gend… |
CVE-2022-36683 | Critical | 9.8 | 2022-08-26 | Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_payment. |
CVE-2022-36682 | Critical | 9.8 | 2022-08-26 | Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_student. |
CVE-2022-36681 | Critical | 9.8 | 2022-08-26 | Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_account. |
CVE-2022-36680 | Critical | 9.8 | 2022-08-26 | Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_schedule. |
CVE-2022-36679 | Critical | 9.8 | 2022-08-26 | Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=user/manage_user. |
CVE-2022-36678 | Critical | 9.8 | 2022-08-26 | Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_category. |
CVE-2022-38533 | Medium | 5.5 | 2022-08-26 | In GNU Binutils before 2.40, there is a heap-buffer-overflow in the error function bfd_getl32 when called from the strip_main function in strip-new via a craft… |
CVE-2022-36226 | High | 7.2 | 2022-08-26 | SiteServerCMS 5.X has a Remote-download-Getshell-vulnerability via /SiteServer/Ajax/ajaxOtherService.aspx. |
CVE-2022-36168 | Low | 2.7 | 2022-08-26 | A directory traversal vulnerability was discovered in Wuzhicms 4.1.0. via /coreframe/app/attachment/admin/index.php: |