2022 CVEs (page 151)
Page 151 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-32427 | High | 8.8 | 2022-08-25 | PrinterLogic Windows Client through 25.0.0.676 allows attackers to execute directory traversal. Authenticated users with prior knowledge of the driver filename… |
CVE-2022-32894 | High | 7.8 | 2022-08-24 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS 15.6.1, macOS Monterey 12.5.1. An applic… |
CVE-2022-32893 | High | 8.8 | 2022-08-24 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS 15.6.1, macOS Monterey 12.5.1, Safari 15… |
CVE-2022-32857 | Medium | 4.3 | 2022-08-24 | This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8, Security U… |
CVE-2022-32840 | High | 7.8 | 2022-08-24 | This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.5, watchOS 8.7, iOS 15.6 and iPadOS 15.6. An app may be able to execute… |
CVE-2022-32839 | Critical | 9.8 | 2022-08-24 | The issue was addressed with improved bounds checks. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8, Security Update 2022-005 Catalina, iOS 1… |
CVE-2022-32838 | Medium | 5.5 | 2022-08-24 | A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8, Security Update 2022-005 Catalina… |
CVE-2022-32837 | High | 7.8 | 2022-08-24 | This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.5, tvOS 15.6, iOS 15.6 and iPadOS 15.6. An app may be able to cause une… |
CVE-2022-32834 | Medium | 5.5 | 2022-08-24 | An access issue was addressed with improvements to the sandbox. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8, Security Update 2022-005 Cata… |
CVE-2022-32813 | High | 7.8 | 2022-08-24 | The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8, Security Update 2022-005 Catalina, iOS… |
CVE-2022-32812 | High | 7.8 | 2022-08-24 | The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8, Security Update 2022-005 Catalina. An… |
CVE-2022-32811 | High | 7.8 | 2022-08-24 | A memory corruption vulnerability was addressed with improved locking. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8, Security Update 2022-0… |
CVE-2022-32810 | High | 7.8 | 2022-08-24 | The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.5, watchOS 8.7, iOS 15.6 and iPadOS 15.6. An app may be able to… |
CVE-2022-32793 | High | 7.5 | 2022-08-24 | Multiple out-of-bounds write issues were addressed with improved bounds checking. This issue is fixed in macOS Monterey 12.5, watchOS 8.7, tvOS 15.6, iOS 15.6… |
CVE-2022-37181 | Critical | 9.8 | 2022-08-24 | 72crm 9.0 has an Arbitrary file upload vulnerability. |
CVE-2022-37178 | High | 8.8 | 2022-08-24 | An issue was discovered in 72crm 9.0. There is a SQL Injection vulnerability in View the task calendar. |
CVE-2022-34838 | High | 8.1 | 2022-08-24 | Storing Passwords in a Recoverable Format vulnerability in ABB Zenon 8.20 allows an attacker who successfully exploit the vulnerability may add or alter data p… |
CVE-2022-34837 | Medium | 6.2 | 2022-08-24 | Storing Passwords in a Recoverable Format vulnerability in ABB Zenon 8.20 allows an attacker who successfully exploit the vulnerability may add more network cl… |
CVE-2022-34836 | Medium | 5.9 | 2022-08-24 | Relative Path Traversal vulnerability in ABB Zenon 8.20 allows the user to access files on the Zenon system and user also can add own log messages and e.g., fl… |
CVE-2022-2978 | High | 7.8 | 2022-08-24 | A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function security_inode_alloc to fail with following call to fun… |
CVE-2022-2569 | Medium | 5.5 | 2022-08-24 | The affected device stores sensitive information in cleartext, which may allow an authenticated user to access session data stored in the OAuth database belong… |
CVE-2022-2234 | Critical | 9.9 | 2022-08-24 | An authenticated mySCADA myPRO 8.26.0 user may be able to modify parameters to run commands directly in the operating system. |
CVE-2022-20122 | Critical | 9.8 | 2022-08-24 | The PowerVR GPU driver allows unprivileged apps to allocated pinned memory, unpin it (which makes it available to be freed), and continue using the page in GPU… |
CVE-2022-37153 | Medium | 6.1 | 2022-08-24 | An issue was discovered in Artica Proxy 4.30.000000. There is a XSS vulnerability via the password parameter in /fw.login.php. |
CVE-2022-36633 | High | 8.8 | 2022-08-24 | Teleport 9.3.6 is vulnerable to Command injection leading to Remote Code Execution. An attacker can craft a malicious ssh agent installation link by URL encodi… |
CVE-2022-33172 | Medium | 5.5 | 2022-08-24 | de.fac2 1.34 allows bypassing the User Presence protection mechanism when there is malware on the victim's PC. |
CVE-2022-27812 | High | 7.5 | 2022-08-24 | Flooding SNS firewall versions 3.7.0 to 3.7.29, 3.11.0 to 3.11.17, 4.2.0 to 4.2.10, and 4.3.0 to 4.3.6 with specific forged traffic, can lead to SNS DoS. |
CVE-2022-38089 | Medium | 5.4 | 2022-08-24 | Stored cross-site scripting vulnerability in Exment ((PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-admin v3.0.0 and earlier, (PHP7) exceedon… |
CVE-2022-38080 | Medium | 5.4 | 2022-08-24 | Reflected cross-site scripting vulnerability in Exment ((PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-admin v3.0.0 and earlier, (PHP7) excee… |
CVE-2022-38078 | Critical | 9.8 | 2022-08-24 | Movable Type XMLRPC API provided by Six Apart Ltd. contains a command injection vulnerability. Sending a specially crafted message by POST method to Movable Ty… |
CVE-2022-37333 | High | 8.8 | 2022-08-24 | SQL injection vulnerability in the Exment ((PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-admin v3.0.0 and earlier, (PHP7) exceedone/exment v… |
CVE-2022-37418 | Medium | 6.4 | 2022-08-24 | The Remote Keyless Entry (RKE) receiving unit on certain Nissan, Kia, and Hyundai vehicles through 2017 allows remote attackers to perform unlock operations an… |
CVE-2022-37305 | Medium | 6.4 | 2022-08-24 | The Remote Keyless Entry (RKE) receiving unit on certain Honda vehicles through 2018 allows remote attackers to perform unlock operations and force a resynchro… |
CVE-2022-36945 | Medium | 6.4 | 2022-08-24 | The Remote Keyless Entry (RKE) receiving unit on certain Mazda vehicles through 2020 allows remote attackers to perform unlock operations and force a resynchro… |
CVE-2022-25903 | High | 7.5 | 2022-08-24 | The package opcua from 0.0.0 are vulnerable to Denial of Service (DoS) via the ExtensionObjects and Variants objects, when it allows unlimited nesting levels… |
CVE-2022-24375 | High | 7.5 | 2022-08-24 | The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multi… |
CVE-2022-38132 | High | 8.2 | 2022-08-24 | Command injection vulnerability in Linksys MR8300 router while Registration to DDNS Service. By specifying username and password, an attacker connected to the… |
CVE-2022-31676 | High | 7.8 | 2022-08-23 | VMware Tools (12.0.0, 11.x.y and 10.x.y) contains a local privilege escalation vulnerability. A malicious actor with local non-administrative access to the Gue… |
CVE-2022-2938 | High | 7.8 | 2022-08-23 | A flaw was found in the Linux kernel's implementation of Pressure Stall Information. While the feature is disabled by default, it could allow an attacker to cr… |
CVE-2022-38463 | Medium | 6.1 | 2022-08-23 | ServiceNow through San Diego Patch 4b and Patch 6 allows reflected XSS in the logout functionality. |
CVE-2022-38172 | Medium | 6.1 | 2022-08-23 | ServiceNow through San Diego Patch 3 allows XSS via the name field during creation of a new dashboard for the Performance Analytics dashboard. |
CVE-2022-35115 | Critical | 9.8 | 2022-08-23 | IceWarp WebClient DC2 - Update 2 Build 9 (13.0.2.9) was discovered to contain a SQL injection vulnerability via the search parameter at /webmail/server/webmail… |
CVE-2022-1513 | High | 7.3 | 2022-08-23 | A potential vulnerability was reported in Lenovo PCManager prior to version 5.0.10.4191 that may allow code execution when visiting a specially crafted website. |
CVE-2022-38665 | Medium | 6.5 | 2022-08-23 | Jenkins CollabNet Plugins Plugin 2.0.8 and earlier stores a RabbitMQ password unencrypted in its global configuration file on the Jenkins controller where it c… |
CVE-2022-38664 | Medium | 5.4 | 2022-08-23 | Jenkins Job Configuration History Plugin 1165.v8cc9fd1f4597 and earlier does not escape the job name on the System Configuration History page, resulting in a s… |
CVE-2022-38663 | Medium | 6.5 | 2022-08-23 | Jenkins Git Plugin 4.11.4 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log provided by the Git Username and Passw… |
CVE-2022-37428 | Medium | 6.5 | 2022-08-23 | PowerDNS Recursor up to and including 4.5.9, 4.6.2 and 4.7.1, when protobuf logging is enabled, has Improper Cleanup upon a Thrown Exception, leading to a deni… |
CVE-2022-2946 | High | 7.8 | 2022-08-23 | Use After Free in GitHub repository vim/vim prior to 9.0.0246. |
CVE-2022-37113 | Critical | 9.8 | 2022-08-23 | Bluecms 1.6 has SQL injection in line 132 of admin/area.php |
CVE-2022-37112 | Critical | 9.8 | 2022-08-23 | BlueCMS 1.6 has SQL injection in line 55 of admin/model.php |
CVE-2022-37111 | Critical | 9.8 | 2022-08-23 | BlueCMS 1.6 has SQL injection in line 132 of admin/article.php |
CVE-2022-36405 | Medium | 5.4 | 2022-08-23 | Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in amCharts: Charts and Maps plugin <= 1.4 at WordPress. |
CVE-2022-36394 | High | 7.6 | 2022-08-23 | Authenticated (author+) SQL Injection (SQLi) vulnerability in Contest Gallery plugin <= 17.0.4 at WordPress. |
CVE-2022-36389 | Medium | 4.3 | 2022-08-23 | Cross-Site Request Forgery (CSRF) vulnerability in WordPlus Better Messages plugin <= 1.9.9.148 at WordPress. |
CVE-2022-36379 | High | 8.8 | 2022-08-23 | Cross-Site Request Forgery (CSRF) leading to plugin settings update in YooMoney ЮKassa для WooCommerce plugin <= 2.3.0 at WordPress. |
CVE-2022-36347 | Medium | 4.8 | 2022-08-23 | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alpine Press Alpine PhotoTile for Pinterest plugin <= 1.3.1 at WordPress. |
CVE-2022-36341 | Medium | 5.4 | 2022-08-23 | Authenticated (subscriber+) plugin settings change leading to Stored Cross-Site Scripting (XSS) vulnerability in Akash soni's AS – Create Pinterest Pinboard Pa… |
CVE-2022-36292 | Medium | 5.4 | 2022-08-23 | Cross-Site Request Forgery (CSRF) vulnerabilities in WPChill Gallery PhotoBlocks plugin <= 1.2.6 at WordPress. |
CVE-2022-36288 | Medium | 5.4 | 2022-08-23 | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in W3 Eden Download Manager plugin <= 3.2.48 at WordPress. |
CVE-2022-36285 | High | 7.2 | 2022-08-23 | Authenticated Arbitrary File Upload vulnerability in dmitrylitvinov Uploading SVG, WEBP and ICO files plugin <= 1.0.1 at WordPress. |
CVE-2022-36282 | Medium | 4.8 | 2022-08-23 | Authenticated (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Roman Pronskiy's Search Exclude plugin <= 1.2.6 at WordPress. |
CVE-2022-35726 | Medium | 4.3 | 2022-08-23 | Broken Authentication vulnerability in yotuwp Video Gallery plugin <= 1.3.4.5 at WordPress. |
CVE-2022-35242 | Medium | 6.5 | 2022-08-23 | Unauthenticated plugin settings change vulnerability in 59sec THE Leads Management System: 59sec LITE plugin <= 3.4.1 at WordPress. |
CVE-2022-35235 | Medium | 4.9 | 2022-08-23 | Authenticated (admin+) Arbitrary File Read vulnerability in XplodedThemes WPide plugin <= 2.6 at WordPress. |
CVE-2022-34868 | High | 8.8 | 2022-08-23 | Authenticated Arbitrary Settings Update vulnerability in YooMoney ЮKassa для WooCommerce plugin <= 2.3.0 at WordPress. |
CVE-2022-34658 | Medium | 5.4 | 2022-08-23 | Multiple Authenticated (contributor+) Persistent Cross-Site Scripting (XSS) vulnerabilities in W3 Eden Download Manager plugin <= 3.2.48 at WordPress. |
CVE-2022-34648 | Medium | 4.8 | 2022-08-23 | Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in dmitrylitvinov Uploading SVG, WEBP and ICO files plugin <= 1.0.1 at WordPress. |
CVE-2022-33142 | High | 7.7 | 2022-08-23 | Authenticated (subscriber+) Denial Of Service (DoS) vulnerability in WordPlus WordPress Better Messages plugin <= 1.9.10.57 at WordPress. |
CVE-2022-2965 | Medium | 4.3 | 2022-08-23 | Improper Restriction of Rendered UI Layers or Frames in GitHub repository notrinos/notrinoserp prior to 0.7. |
CVE-2022-29476 | Medium | 6.1 | 2022-08-23 | Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in 8 Degree Themes otification Bar for WordPress plugin <= 1.1.8 at WordPress. |
CVE-2022-28883 | Low | 3.5 | 2022-08-23 | A Denial-of-Service (DoS) vulnerability was discovered in F-Secure & WithSecure products whereby the aerdl unpack function crashes. This can lead to a possible… |
CVE-2022-28882 | Medium | 4.3 | 2022-08-23 | A Denial-of-Service (DoS) vulnerability was discovered in F-Secure & WithSecure products whereby the aegen.dll will go into an infinite loop when unpacking PE… |
CVE-2022-35278 | Medium | 6.1 | 2022-08-23 | In Apache ActiveMQ Artemis prior to 2.24.0, an attacker could show malicious content and/or redirect users to a malicious URL in the web console by using HTML… |
CVE-2022-37223 | Critical | 9.8 | 2022-08-23 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/role/list. |
CVE-2022-37199 | Critical | 9.8 | 2022-08-23 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/user/list. |
CVE-2022-36261 | Critical | 9.1 | 2022-08-23 | An arbitrary file deletion vulnerability was discovered in taocms 3.0.2, that allows attacker to delete file in server when request url admin.php?action=file&c… |
CVE-2022-35203 | High | 7.2 | 2022-08-23 | An access control issue in TrendNet TV-IP572PI v1.0 allows unauthenticated attackers to access sensitive system information. |
CVE-2022-2956 | Low | 3.5 | 2022-08-23 | A vulnerability classified as problematic has been found in ConsoleTVs Noxen. Affected is an unknown function of the file /Noxen-master/users.php. The manipula… |
CVE-2022-1989 | Medium | 5.3 | 2022-08-23 | All CODESYS Visualization versions before V4.2.0.0 generate a login dialog vulnerable to information exposure allowing a remote, unauthenticated attacker to en… |
CVE-2022-2796 | Medium | 4.8 | 2022-08-23 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.4. |
CVE-2022-36350 | Medium | 5.4 | 2022-08-23 | Stored cross-site scripting vulnerability in PukiWiki versions 1.3.1 to 1.5.3 allows a remote attacker to inject an arbitrary script via unspecified vectors. |
CVE-2022-34486 | High | 7.2 | 2022-08-23 | Path traversal vulnerability in PukiWiki versions 1.4.5 to 1.5.3 allows a remote authenticated attacker with an administrative privilege to execute a malicious… |
CVE-2022-27637 | Medium | 6.1 | 2022-08-23 | Reflected cross-site scripting vulnerability in PukiWiki versions 1.5.1 to 1.5.3 allows a remote attacker to inject an arbitrary script via unspecified vectors. |
CVE-2022-25888 | High | 7.5 | 2022-08-23 | The package opcua from 0.0.0 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in… |
CVE-2022-25761 | High | 7.5 | 2022-08-23 | The package open62541/open62541 before 1.2.5, from 1.3-rc1 and before 1.3.1 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number… |
CVE-2022-25304 | High | 7.5 | 2022-08-23 | All versions of package opcua; all versions of package asyncua are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received… |
CVE-2022-25302 | High | 7.5 | 2022-08-23 | All versions of package asneg/opcuastack are vulnerable to Denial of Service (DoS) due to a missing handler for failed casting when unvalidated data is forward… |
CVE-2022-25231 | High | 7.5 | 2022-08-23 | The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) by sending a specifically crafted OPC UA message with a special OPC UA NodeID, w… |
CVE-2022-24381 | High | 7.5 | 2022-08-23 | All versions of package asneg/opcuastack are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single se… |
CVE-2022-24298 | High | 7.5 | 2022-08-23 | All versions of package freeopcua/freeopcua are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sendin… |
CVE-2022-21208 | High | 7.5 | 2022-08-23 | The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single sessio… |
CVE-2022-2829 | Medium | 5.4 | 2022-08-23 | Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. |
CVE-2022-35733 | Critical | 9.8 | 2022-08-23 | Missing authentication for critical function vulnerability in UNIMO Technology digital video recorders (UDR-JA1004/JA1008/JA1016 firmware versions v1.0.20.13 a… |
CVE-2022-34919 | Critical | 9.8 | 2022-08-23 | The file upload wizard in Zengenti Contensis Classic before 15.2.1.79 does not correctly check that a user has authenticated. By uploading a crafted aspx file… |
CVE-2022-33916 | High | 7.5 | 2022-08-23 | OPC UA .NET Standard Reference Server 1.04.368 allows a remote attacker to cause the application to access sensitive information. |
CVE-2022-35191 | Medium | 6.5 | 2022-08-23 | D-Link Wireless AC1200 Dual Band VDSL ADSL Modem Router DSL-3782 Firmware v1.01 allows unauthenticated attackers to cause a Denial of Service (DoS) via a craft… |
CVE-2022-2923 | Medium | 5.5 | 2022-08-22 | NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240. |
CVE-2022-38668 | High | 7.5 | 2022-08-22 | HTTP applications (servers) based on Crow through 1.0+4 may reveal potentially sensitive uninitialized data from stack memory when fulfilling a request for a s… |
CVE-2022-38667 | Critical | 9.8 | 2022-08-22 | HTTP applications (servers) based on Crow through 1.0+4 may allow a Use-After-Free and code execution when HTTP pipelining is used. The HTTP parser supports HT… |
CVE-2022-38171 | High | 7.8 | 2022-08-22 | Xpdf prior to version 4.04 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIG2Stream.cc). Processing a specially craft… |