2022 CVEs (page 149)
Page 149 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-0207 | Medium | 4.7 | 2022-08-26 | A race condition was found in vdsm. Functionality to obfuscate sensitive values in log files that may lead to values being stored in clear text. |
CVE-2022-0175 | Medium | 5.5 | 2022-08-26 | A flaw was found in the VirGL virtual OpenGL renderer (virglrenderer). The virgl did not properly initialize memory when allocating a host-backed memory resour… |
CVE-2022-0171 | Medium | 5.5 | 2022-08-26 | A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root (host) user-level application to crash the host kerne… |
CVE-2022-0168 | Medium | 4.4 | 2022-08-26 | A denial of service (DOS) issue was found in the Linux kernel’s smb2_ioctl_query_info function in the fs/cifs/smb2ops.c Common Internet File System (CIFS) due… |
CVE-2022-0084 | High | 7.5 | 2022-08-26 | A flaw was found in XNIO, specifically in the notifyReadClosed method. The issue revealed this method was logging a message to another expected end. This flaw… |
CVE-2022-25625 | High | 8.8 | 2022-08-26 | A malicious unauthorized PAM user can access the administration configuration data and change the values. |
CVE-2022-36521 | High | 7.5 | 2022-08-26 | Insecure permissions in cskefu v7.0.1 allows unauthenticated attackers to arbitrarily add administrator accounts. |
CVE-2022-37152 | Critical | 9.8 | 2022-08-26 | An issue was discovered in Online Diagnostic Lab Management System 1.0, There is a SQL injection vulnerability via "dob" parameter in "/classes/Users.php?f=sav… |
CVE-2022-37151 | High | 7.5 | 2022-08-26 | There is an unauthorized access vulnerability in Online Diagnostic Lab Management System 1.0. |
CVE-2022-37150 | Medium | 5.4 | 2022-08-26 | An issue was discovered in Online Diagnostic Lab Management System 1.0. There is a stored XSS vulnerability via firstname, address, middlename, lastname , gend… |
CVE-2022-36683 | Critical | 9.8 | 2022-08-26 | Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_payment. |
CVE-2022-36682 | Critical | 9.8 | 2022-08-26 | Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_student. |
CVE-2022-36681 | Critical | 9.8 | 2022-08-26 | Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_account. |
CVE-2022-36680 | Critical | 9.8 | 2022-08-26 | Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_schedule. |
CVE-2022-36679 | Critical | 9.8 | 2022-08-26 | Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=user/manage_user. |
CVE-2022-36678 | Critical | 9.8 | 2022-08-26 | Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_category. |
CVE-2022-38533 | Medium | 5.5 | 2022-08-26 | In GNU Binutils before 2.40, there is a heap-buffer-overflow in the error function bfd_getl32 when called from the strip_main function in strip-new via a craft… |
CVE-2022-36226 | High | 7.2 | 2022-08-26 | SiteServerCMS 5.X has a Remote-download-Getshell-vulnerability via /SiteServer/Ajax/ajaxOtherService.aspx. |
CVE-2022-36168 | Low | 2.7 | 2022-08-26 | A directory traversal vulnerability was discovered in Wuzhicms 4.1.0. via /coreframe/app/attachment/admin/index.php: |
CVE-2022-36121 | Medium | 5.3 | 2022-08-26 | An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possibl… |
CVE-2022-36120 | High | 8.1 | 2022-08-26 | An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possibl… |
CVE-2022-35192 | High | 7.5 | 2022-08-26 | D-Link Wireless AC1200 Dual Band VDSL ADSL Modem Router DSL-3782 Firmware v1.01 allows unauthenticated attackers to cause a Denial of Service (DoS) via the Use… |
CVE-2022-30984 | High | 7.8 | 2022-08-26 | A buffer overflow vulnerability in the Rubrik Backup Service (RBS) Agent for Linux or Unix-based systems in Rubrik CDM 7.0.1, 7.0.1-p1, 7.0.1-p2 or 7.0.1-p3 be… |
CVE-2022-29850 | High | 8.1 | 2022-08-26 | Various Lexmark products through 2022-04-27 allow an attacker who has already compromised an affected Lexmark device to maintain persistence across reboots. |
CVE-2022-37318 | High | 7.0 | 2022-08-25 | Archer Platform 6.9 SP2 P2 before 6.11 P3 (6.11.0.3) contain a reflected XSS vulnerability. A remote unauthenticated malicious Archer user could potentially ex… |
CVE-2022-37317 | High | 7.6 | 2022-08-25 | Archer Platform 6.x before 6.11 P3 contain an HTML injection vulnerability. An authenticated remote attacker could potentially exploit this vulnerability by tr… |
CVE-2022-37316 | Medium | 6.5 | 2022-08-25 | Archer Platform 6.8 before 6.11 P3 (6.11.0.3) contains an improper API access control vulnerability in a multi-instance system that could potentially present u… |
CVE-2022-36119 | High | 8.8 | 2022-08-25 | An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possibl… |
CVE-2022-36118 | Medium | 5.3 | 2022-08-25 | An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possibl… |
CVE-2022-36117 | Low | 3.1 | 2022-08-25 | An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possibl… |
CVE-2022-36116 | Medium | 5.3 | 2022-08-25 | An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possibl… |
CVE-2022-36115 | High | 7.1 | 2022-08-25 | An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possibl… |
CVE-2022-31798 | Medium | 6.1 | 2022-08-25 | Nortek Linear eMerge E3-Series 0.32-07p devices are vulnerable to /card_scan.php?CardFormatNo= XSS with session fixation (via PHPSESSID) when they are chained… |
CVE-2022-31499 | Critical | 9.8 | 2022-08-25 | Nortek Linear eMerge E3-Series devices before 0.32-08f allow an unauthenticated attacker to inject OS commands via ReaderNo. NOTE: this issue exists because of… |
CVE-2022-28747 | Critical | 9.8 | 2022-08-25 | Key reuse in GoSecure Titan Inbox Detection & Response (IDR) through 2022-04-05 leads to remote code execution. To exploit this vulnerability, an attacker must… |
CVE-2022-36721 | High | 8.8 | 2022-08-25 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Textbook parameter at /admin/modify.php. |
CVE-2022-36720 | High | 8.8 | 2022-08-25 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/modify1.php. |
CVE-2022-36719 | Critical | 9.8 | 2022-08-25 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the ok parameter at /admin/history.php. |
CVE-2022-36716 | Critical | 9.8 | 2022-08-25 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/changestock.php. |
CVE-2022-36715 | Critical | 9.8 | 2022-08-25 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter at /admin/search.php. |
CVE-2022-36697 | Critical | 9.8 | 2022-08-25 | Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_waste. |
CVE-2022-36696 | Critical | 9.8 | 2022-08-25 | Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_stockout. |
CVE-2022-36695 | Critical | 9.8 | 2022-08-25 | Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_stockin. |
CVE-2022-36693 | Critical | 9.8 | 2022-08-25 | Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_item. |
CVE-2022-36692 | Critical | 9.8 | 2022-08-25 | Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_category. |
CVE-2022-31269 | High | 8.2 | 2022-08-25 | Nortek Linear eMerge E3-Series devices through 0.32-09c place admin credentials in /test.txt that allow an attacker to open a building's doors. (This occurs in… |
CVE-2022-36703 | High | 8.8 | 2022-08-25 | Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /stocks/manage_stockin.php. |
CVE-2022-36701 | High | 8.8 | 2022-08-25 | Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /items/view_item.php. |
CVE-2022-36700 | High | 8.8 | 2022-08-25 | Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /items/manage_item.php. |
CVE-2022-36699 | High | 8.8 | 2022-08-25 | Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /categories/manage_category.php. |
CVE-2022-36698 | High | 8.8 | 2022-08-25 | Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /categories/view_category.php. |
CVE-2022-2997 | High | 8.0 | 2022-08-25 | Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10. |
CVE-2022-2982 | High | 7.8 | 2022-08-25 | Use After Free in GitHub repository vim/vim prior to 9.0.0260. |
CVE-2022-2980 | Medium | 5.5 | 2022-08-25 | NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0259. |
CVE-2022-36527 | Medium | 5.4 | 2022-08-25 | Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the post title text field under the publish blo… |
CVE-2022-20921 | High | 8.8 | 2022-08-25 | A vulnerability in the API implementation of Cisco ACI Multi-Site Orchestrator (MSO) could allow an authenticated, remote attacker to elevate privileges on an… |
CVE-2022-20865 | Medium | 6.7 | 2022-08-25 | A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privile… |
CVE-2022-20824 | High | 8.8 | 2022-08-25 | A vulnerability in the Cisco Discovery Protocol feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to ex… |
CVE-2022-20823 | High | 8.6 | 2022-08-25 | A vulnerability in the OSPF version 3 (OSPFv3) feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (Do… |
CVE-2022-37953 | Medium | 4.7 | 2022-08-25 | An HTTP response splitting vulnerability exists in the AM Gateway Challenge-Response dialog of WorkstationST (<v07.09.15) and could allow an attacker to compro… |
CVE-2022-37952 | Medium | 4.7 | 2022-08-25 | A reflected cross-site scripting (XSS) vulnerability exists in the iHistorian Data Display of WorkstationST (<v07.09.15) could allow an attacker to compromise… |
CVE-2022-36358 | Medium | 5.4 | 2022-08-25 | Cross-Site Request Forgery (CSRF) vulnerability in SEO Scout plugin <= 0.9.83 at WordPress allows attackers to trick users with administrative rights to uninte… |
CVE-2022-32746 | Medium | 5.4 | 2022-08-25 | A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database module, resu… |
CVE-2022-32745 | High | 8.1 | 2022-08-25 | A flaw was found in Samba. Samba AD users can cause the server to access uninitialized data with an LDAP add or modify the request, usually resulting in a segm… |
CVE-2022-32744 | High | 8.8 | 2022-08-25 | A flaw was found in Samba. The KDC accepts kpasswd requests encrypted with any key known to it. By encrypting forged kpasswd requests with its own key, a user… |
CVE-2022-32742 | Medium | 4.3 | 2022-08-25 | A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client had sent enough data to fulfill the write, allowing s… |
CVE-2022-2991 | Medium | 6.7 | 2022-08-25 | A heap-based buffer overflow was found in the Linux kernel's LightNVM subsystem. The issue results from the lack of proper validation of the length of user-sup… |
CVE-2022-2959 | High | 7.0 | 2022-08-25 | A race condition was found in the Linux kernel's watch queue due to a missing lock in pipe_resize_ring(). The specific flaw exists within the handling of pipe… |
CVE-2022-2465 | High | 8.6 | 2022-08-25 | Rockwell Automation ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Deserialization of Untrusted Data vulnerability. ISaGRAF Workbench… |
CVE-2022-2464 | High | 7.7 | 2022-08-25 | Rockwell Automation ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Path Traversal vulnerability. Crafted malicious files can allow an… |
CVE-2022-2463 | Medium | 6.1 | 2022-08-25 | Rockwell Automation ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Path Traversal vulnerability. A crafted malicious .7z exchange file… |
CVE-2022-2255 | High | 7.5 | 2022-08-25 | A vulnerability was found in mod_wsgi. The X-Client-IP header is not removed from a request from an untrusted proxy, allowing an attacker to pass the X-Client-… |
CVE-2022-2031 | High | 8.8 | 2022-08-25 | A flaw was found in Samba. The security vulnerability occurs when KDC and the kpasswd service share a single account and set of keys, allowing them to decrypt… |
CVE-2022-23715 | Medium | 6.5 | 2022-08-25 | A flaw was discovered in ECE before 3.4.0 that might lead to the disclosure of sensitive information such as user passwords and Elasticsearch keystore settings… |
CVE-2022-23235 | Medium | 5.3 | 2022-08-25 | Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows versions prior to 9.10P1 are susceptible to a vulnerability which could allow an att… |
CVE-2022-0135 | High | 7.8 | 2022-08-25 | An out-of-bounds write issue was found in the VirGL virtual OpenGL renderer (virglrenderer). This flaw allows a malicious guest to create a specially crafted v… |
CVE-2022-37162 | Medium | 5.4 | 2022-08-25 | Claroline 13.5.7 and prior is vulnerable to Cross Site Scripting (XSS). An attacker can obtain javascript code execution by adding arbitrary javascript code in… |
CVE-2022-37161 | Medium | 6.1 | 2022-08-25 | Claroline 13.5.7 and prior is vulnerable to Cross Site Scripting (XSS) via SVG file upload. |
CVE-2022-37160 | Medium | 5.4 | 2022-08-25 | Claroline 13.5.7 and prior allows an authenticated attacker to elevate privileges via the arbitrary creation of a privileged user. By combining the XSS vulnera… |
CVE-2022-37159 | Critical | 9.8 | 2022-08-25 | Claroline 13.5.7 and prior is vulnerable to Remote code execution via arbitrary file upload. |
CVE-2022-37158 | Critical | 9.8 | 2022-08-25 | RuoYi v3.8.3 has a Weak password vulnerability in the management system. |
CVE-2022-37292 | Medium | 5.5 | 2022-08-25 | Tenda AX12 V22.03.01.21_CN is vulnerable to Buffer Overflow. This overflow is triggered in the sub_42FDE4 function, which satisfies the request of the upper-le… |
CVE-2022-37238 | Medium | 5.4 | 2022-08-25 | MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the currentRequest parameter. |
CVE-2022-37824 | High | 7.8 | 2022-08-25 | Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow via the shareSpeed parameter in the function fromSetWifiGusetBasic. |
CVE-2022-37823 | High | 7.8 | 2022-08-25 | Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow via the list parameter in the function formSetVirtualSer. |
CVE-2022-37822 | High | 7.8 | 2022-08-25 | Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow via the function fromSetRouteStatic. |
CVE-2022-37821 | High | 7.8 | 2022-08-25 | Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow via the ProvinceCode parameter in the function formSetProvince. |
CVE-2022-37820 | High | 7.8 | 2022-08-25 | Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow via the ddnsEn parameter in the function formSetSysToolDDNS. |
CVE-2022-37819 | High | 7.8 | 2022-08-25 | Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow via the timezone parameter in the function fromSetSysTime. |
CVE-2022-37818 | High | 7.8 | 2022-08-25 | Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow via the list parameter at the function formSetQosBand. |
CVE-2022-37817 | High | 7.8 | 2022-08-25 | Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow via the function fromSetIpMacBind. |
CVE-2022-37816 | Critical | 9.8 | 2022-08-25 | Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the function fromSetIpMacBind. |
CVE-2022-37815 | Critical | 9.8 | 2022-08-25 | Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the PPPOEPassword parameter in the function formQuickIndex. |
CVE-2022-37814 | Critical | 9.8 | 2022-08-25 | Tenda AC1206 V15.03.06.23 was discovered to contain multiple stack overflows via the deviceMac and the device_id parameters in the function addWifiMacFilter. |
CVE-2022-37813 | Critical | 9.8 | 2022-08-25 | Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the function fromSetSysTime. |
CVE-2022-37812 | Critical | 9.8 | 2022-08-25 | Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the firewallEn parameter in the function formSetFirewallCfg. |
CVE-2022-37811 | Critical | 9.8 | 2022-08-25 | Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the startIp parameter in the function formSetPPTPServer. |
CVE-2022-37810 | Critical | 9.8 | 2022-08-25 | Tenda AC1206 V15.03.06.23 was discovered to contain a command injection vulnerability via the mac parameter in the function formWriteFacMac. |
CVE-2022-37809 | Critical | 9.8 | 2022-08-25 | Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the speed_dir parameter in the function formSetSpeedWan. |
CVE-2022-37808 | Critical | 9.8 | 2022-08-25 | Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the index parameter in the function formWifiWpsOOB. |