2022 CVEs (page 149)
Page 149 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-36121 | Medium | 5.3 | 2022-08-26 | An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possibl… |
CVE-2022-36120 | High | 8.1 | 2022-08-26 | An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possibl… |
CVE-2022-35192 | High | 7.5 | 2022-08-26 | D-Link Wireless AC1200 Dual Band VDSL ADSL Modem Router DSL-3782 Firmware v1.01 allows unauthenticated attackers to cause a Denial of Service (DoS) via the Use… |
CVE-2022-30984 | High | 7.8 | 2022-08-26 | A buffer overflow vulnerability in the Rubrik Backup Service (RBS) Agent for Linux or Unix-based systems in Rubrik CDM 7.0.1, 7.0.1-p1, 7.0.1-p2 or 7.0.1-p3 be… |
CVE-2022-29850 | High | 8.1 | 2022-08-26 | Various Lexmark products through 2022-04-27 allow an attacker who has already compromised an affected Lexmark device to maintain persistence across reboots. |
CVE-2022-37318 | High | 7.0 | 2022-08-25 | Archer Platform 6.9 SP2 P2 before 6.11 P3 (6.11.0.3) contain a reflected XSS vulnerability. A remote unauthenticated malicious Archer user could potentially ex… |
CVE-2022-37317 | High | 7.6 | 2022-08-25 | Archer Platform 6.x before 6.11 P3 contain an HTML injection vulnerability. An authenticated remote attacker could potentially exploit this vulnerability by tr… |
CVE-2022-37316 | Medium | 6.5 | 2022-08-25 | Archer Platform 6.8 before 6.11 P3 (6.11.0.3) contains an improper API access control vulnerability in a multi-instance system that could potentially present u… |
CVE-2022-36119 | High | 8.8 | 2022-08-25 | An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possibl… |
CVE-2022-36118 | Medium | 5.3 | 2022-08-25 | An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possibl… |
CVE-2022-36117 | Low | 3.1 | 2022-08-25 | An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possibl… |
CVE-2022-36116 | Medium | 5.3 | 2022-08-25 | An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possibl… |
CVE-2022-36115 | High | 7.1 | 2022-08-25 | An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possibl… |
CVE-2022-31798 | Medium | 6.1 | 2022-08-25 | Nortek Linear eMerge E3-Series 0.32-07p devices are vulnerable to /card_scan.php?CardFormatNo= XSS with session fixation (via PHPSESSID) when they are chained… |
CVE-2022-31499 | Critical | 9.8 | 2022-08-25 | Nortek Linear eMerge E3-Series devices before 0.32-08f allow an unauthenticated attacker to inject OS commands via ReaderNo. NOTE: this issue exists because of… |
CVE-2022-28747 | Critical | 9.8 | 2022-08-25 | Key reuse in GoSecure Titan Inbox Detection & Response (IDR) through 2022-04-05 leads to remote code execution. To exploit this vulnerability, an attacker must… |
CVE-2022-36721 | High | 8.8 | 2022-08-25 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Textbook parameter at /admin/modify.php. |
CVE-2022-36720 | High | 8.8 | 2022-08-25 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/modify1.php. |
CVE-2022-36719 | Critical | 9.8 | 2022-08-25 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the ok parameter at /admin/history.php. |
CVE-2022-36716 | Critical | 9.8 | 2022-08-25 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/changestock.php. |
CVE-2022-36715 | Critical | 9.8 | 2022-08-25 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter at /admin/search.php. |
CVE-2022-36697 | Critical | 9.8 | 2022-08-25 | Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_waste. |
CVE-2022-36696 | Critical | 9.8 | 2022-08-25 | Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_stockout. |
CVE-2022-36695 | Critical | 9.8 | 2022-08-25 | Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_stockin. |
CVE-2022-36693 | Critical | 9.8 | 2022-08-25 | Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_item. |
CVE-2022-36692 | Critical | 9.8 | 2022-08-25 | Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_category. |
CVE-2022-31269 | High | 8.2 | 2022-08-25 | Nortek Linear eMerge E3-Series devices through 0.32-09c place admin credentials in /test.txt that allow an attacker to open a building's doors. (This occurs in… |
CVE-2022-36703 | High | 8.8 | 2022-08-25 | Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /stocks/manage_stockin.php. |
CVE-2022-36701 | High | 8.8 | 2022-08-25 | Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /items/view_item.php. |
CVE-2022-36700 | High | 8.8 | 2022-08-25 | Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /items/manage_item.php. |
CVE-2022-36699 | High | 8.8 | 2022-08-25 | Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /categories/manage_category.php. |
CVE-2022-36698 | High | 8.8 | 2022-08-25 | Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /categories/view_category.php. |
CVE-2022-2997 | High | 8.0 | 2022-08-25 | Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10. |
CVE-2022-2982 | High | 7.8 | 2022-08-25 | Use After Free in GitHub repository vim/vim prior to 9.0.0260. |
CVE-2022-2980 | Medium | 5.5 | 2022-08-25 | NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0259. |
CVE-2022-36527 | Medium | 5.4 | 2022-08-25 | Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the post title text field under the publish blo… |
CVE-2022-20921 | High | 8.8 | 2022-08-25 | A vulnerability in the API implementation of Cisco ACI Multi-Site Orchestrator (MSO) could allow an authenticated, remote attacker to elevate privileges on an… |
CVE-2022-20865 | Medium | 6.7 | 2022-08-25 | A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privile… |
CVE-2022-20824 | High | 8.8 | 2022-08-25 | A vulnerability in the Cisco Discovery Protocol feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to ex… |
CVE-2022-20823 | High | 8.6 | 2022-08-25 | A vulnerability in the OSPF version 3 (OSPFv3) feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (Do… |
CVE-2022-37953 | Medium | 4.7 | 2022-08-25 | An HTTP response splitting vulnerability exists in the AM Gateway Challenge-Response dialog of WorkstationST (<v07.09.15) and could allow an attacker to compro… |
CVE-2022-37952 | Medium | 4.7 | 2022-08-25 | A reflected cross-site scripting (XSS) vulnerability exists in the iHistorian Data Display of WorkstationST (<v07.09.15) could allow an attacker to compromise… |
CVE-2022-36358 | Medium | 5.4 | 2022-08-25 | Cross-Site Request Forgery (CSRF) vulnerability in SEO Scout plugin <= 0.9.83 at WordPress allows attackers to trick users with administrative rights to uninte… |
CVE-2022-32746 | Medium | 5.4 | 2022-08-25 | A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database module, resu… |
CVE-2022-32745 | High | 8.1 | 2022-08-25 | A flaw was found in Samba. Samba AD users can cause the server to access uninitialized data with an LDAP add or modify the request, usually resulting in a segm… |
CVE-2022-32744 | High | 8.8 | 2022-08-25 | A flaw was found in Samba. The KDC accepts kpasswd requests encrypted with any key known to it. By encrypting forged kpasswd requests with its own key, a user… |
CVE-2022-32742 | Medium | 4.3 | 2022-08-25 | A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client had sent enough data to fulfill the write, allowing s… |
CVE-2022-2991 | Medium | 6.7 | 2022-08-25 | A heap-based buffer overflow was found in the Linux kernel's LightNVM subsystem. The issue results from the lack of proper validation of the length of user-sup… |
CVE-2022-2959 | High | 7.0 | 2022-08-25 | A race condition was found in the Linux kernel's watch queue due to a missing lock in pipe_resize_ring(). The specific flaw exists within the handling of pipe… |
CVE-2022-2465 | High | 8.6 | 2022-08-25 | Rockwell Automation ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Deserialization of Untrusted Data vulnerability. ISaGRAF Workbench… |
CVE-2022-2464 | High | 7.7 | 2022-08-25 | Rockwell Automation ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Path Traversal vulnerability. Crafted malicious files can allow an… |
CVE-2022-2463 | Medium | 6.1 | 2022-08-25 | Rockwell Automation ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Path Traversal vulnerability. A crafted malicious .7z exchange file… |
CVE-2022-2255 | High | 7.5 | 2022-08-25 | A vulnerability was found in mod_wsgi. The X-Client-IP header is not removed from a request from an untrusted proxy, allowing an attacker to pass the X-Client-… |
CVE-2022-2031 | High | 8.8 | 2022-08-25 | A flaw was found in Samba. The security vulnerability occurs when KDC and the kpasswd service share a single account and set of keys, allowing them to decrypt… |
CVE-2022-23715 | Medium | 6.5 | 2022-08-25 | A flaw was discovered in ECE before 3.4.0 that might lead to the disclosure of sensitive information such as user passwords and Elasticsearch keystore settings… |
CVE-2022-23235 | Medium | 5.3 | 2022-08-25 | Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows versions prior to 9.10P1 are susceptible to a vulnerability which could allow an att… |
CVE-2022-0135 | High | 7.8 | 2022-08-25 | An out-of-bounds write issue was found in the VirGL virtual OpenGL renderer (virglrenderer). This flaw allows a malicious guest to create a specially crafted v… |
CVE-2022-37162 | Medium | 5.4 | 2022-08-25 | Claroline 13.5.7 and prior is vulnerable to Cross Site Scripting (XSS). An attacker can obtain javascript code execution by adding arbitrary javascript code in… |
CVE-2022-37161 | Medium | 6.1 | 2022-08-25 | Claroline 13.5.7 and prior is vulnerable to Cross Site Scripting (XSS) via SVG file upload. |
CVE-2022-37160 | Medium | 5.4 | 2022-08-25 | Claroline 13.5.7 and prior allows an authenticated attacker to elevate privileges via the arbitrary creation of a privileged user. By combining the XSS vulnera… |
CVE-2022-37159 | Critical | 9.8 | 2022-08-25 | Claroline 13.5.7 and prior is vulnerable to Remote code execution via arbitrary file upload. |
CVE-2022-37158 | Critical | 9.8 | 2022-08-25 | RuoYi v3.8.3 has a Weak password vulnerability in the management system. |
CVE-2022-37292 | Medium | 5.5 | 2022-08-25 | Tenda AX12 V22.03.01.21_CN is vulnerable to Buffer Overflow. This overflow is triggered in the sub_42FDE4 function, which satisfies the request of the upper-le… |
CVE-2022-37238 | Medium | 5.4 | 2022-08-25 | MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the currentRequest parameter. |
CVE-2022-37824 | High | 7.8 | 2022-08-25 | Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow via the shareSpeed parameter in the function fromSetWifiGusetBasic. |
CVE-2022-37823 | High | 7.8 | 2022-08-25 | Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow via the list parameter in the function formSetVirtualSer. |
CVE-2022-37822 | High | 7.8 | 2022-08-25 | Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow via the function fromSetRouteStatic. |
CVE-2022-37821 | High | 7.8 | 2022-08-25 | Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow via the ProvinceCode parameter in the function formSetProvince. |
CVE-2022-37820 | High | 7.8 | 2022-08-25 | Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow via the ddnsEn parameter in the function formSetSysToolDDNS. |
CVE-2022-37819 | High | 7.8 | 2022-08-25 | Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow via the timezone parameter in the function fromSetSysTime. |
CVE-2022-37818 | High | 7.8 | 2022-08-25 | Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow via the list parameter at the function formSetQosBand. |
CVE-2022-37817 | High | 7.8 | 2022-08-25 | Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow via the function fromSetIpMacBind. |
CVE-2022-37816 | Critical | 9.8 | 2022-08-25 | Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the function fromSetIpMacBind. |
CVE-2022-37815 | Critical | 9.8 | 2022-08-25 | Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the PPPOEPassword parameter in the function formQuickIndex. |
CVE-2022-37814 | Critical | 9.8 | 2022-08-25 | Tenda AC1206 V15.03.06.23 was discovered to contain multiple stack overflows via the deviceMac and the device_id parameters in the function addWifiMacFilter. |
CVE-2022-37813 | Critical | 9.8 | 2022-08-25 | Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the function fromSetSysTime. |
CVE-2022-37812 | Critical | 9.8 | 2022-08-25 | Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the firewallEn parameter in the function formSetFirewallCfg. |
CVE-2022-37811 | Critical | 9.8 | 2022-08-25 | Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the startIp parameter in the function formSetPPTPServer. |
CVE-2022-37810 | Critical | 9.8 | 2022-08-25 | Tenda AC1206 V15.03.06.23 was discovered to contain a command injection vulnerability via the mac parameter in the function formWriteFacMac. |
CVE-2022-37809 | Critical | 9.8 | 2022-08-25 | Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the speed_dir parameter in the function formSetSpeedWan. |
CVE-2022-37808 | Critical | 9.8 | 2022-08-25 | Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the index parameter in the function formWifiWpsOOB. |
CVE-2022-37807 | Critical | 9.8 | 2022-08-25 | Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the function formSetClientState. |
CVE-2022-37806 | Critical | 9.8 | 2022-08-25 | Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the page parameter in the function fromDhcpListClient. |
CVE-2022-37805 | Critical | 9.8 | 2022-08-25 | Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the function fromWizardHandle. |
CVE-2022-37804 | Critical | 9.8 | 2022-08-25 | Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the time parameter in the function saveParentControlInfo. |
CVE-2022-37803 | Critical | 9.8 | 2022-08-25 | Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the page parameter in the function fromAddressNat. |
CVE-2022-37802 | Critical | 9.8 | 2022-08-25 | Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the page parameter in the function fromNatStaticSetting. |
CVE-2022-37801 | Critical | 9.8 | 2022-08-25 | Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the list parameter at the function formSetQosBand. |
CVE-2022-37800 | Critical | 9.8 | 2022-08-25 | Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the list parameter at the function fromSetRouteStatic. |
CVE-2022-37799 | Critical | 9.8 | 2022-08-25 | Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the time parameter at the function setSmartPowerManagement. |
CVE-2022-37798 | Critical | 9.8 | 2022-08-25 | Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the list parameter at the function formSetVirtualSer. |
CVE-2022-37245 | Medium | 5.4 | 2022-08-25 | MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the Blacklist endpoint. |
CVE-2022-37244 | Medium | 5.4 | 2022-08-25 | MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to IFRAME Injectionvia the currentRequest parameter. after login leads to inject mal… |
CVE-2022-37243 | Medium | 5.4 | 2022-08-25 | MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the whitelist endpoint. |
CVE-2022-37242 | Critical | 9.8 | 2022-08-25 | MDaemon Technologies SecurityGateway for Email Servers 8.5.2, is vulnerable to HTTP Response splitting via the data parameter. |
CVE-2022-37241 | Medium | 5.4 | 2022-08-25 | MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the data_leak_list_ajax endpoint. |
CVE-2022-37240 | Critical | 9.8 | 2022-08-25 | MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to HTTP Response splitting via the format parameter. |
CVE-2022-37239 | Medium | 5.4 | 2022-08-25 | MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the rulles_list_ajax endpoint. |
CVE-2022-37100 | Critical | 9.8 | 2022-08-25 | H3C H200 H200V100R004 was discovered to contain a stack overflow via the function UpdateMacClone. |
CVE-2022-37099 | Critical | 9.8 | 2022-08-25 | H3C H200 H200V100R004 was discovered to contain a stack overflow via the function UpdateSnat. |