2022 CVEs (page 151)
Page 151 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-36472 | High | 7.8 | 2022-08-25 | H3C B5 Mini B5MiniV100R005 was discovered to contain a stack overflow via the function SetMobileAPInfoById. |
CVE-2022-36471 | High | 7.8 | 2022-08-25 | H3C B5 Mini B5MiniV100R005 was discovered to contain a stack overflow via the function SetMacAccessMode. |
CVE-2022-36470 | High | 7.8 | 2022-08-25 | H3C B5 Mini B5MiniV100R005 was discovered to contain a stack overflow via the function SetAP5GWifiById. |
CVE-2022-36469 | High | 7.8 | 2022-08-25 | H3C B5 Mini B5MiniV100R005 was discovered to contain a stack overflow via the function SetAPWifiorLedInfoById. |
CVE-2022-36468 | High | 7.8 | 2022-08-25 | H3C B5 Mini B5MiniV100R005 was discovered to contain a stack overflow via the function Asp_SetTimingtimeWifiAndLed. |
CVE-2022-36467 | High | 7.8 | 2022-08-25 | H3C B5 Mini B5MiniV100R005 was discovered to contain a stack overflow via the function EditMacList.d. |
CVE-2022-36466 | High | 7.8 | 2022-08-25 | TOTOLINK A3700R V9.1.2u.6134_B20201202 was discovered to contain a stack overflow via the ip parameter in the function setDiagnosisCfg. |
CVE-2022-36465 | High | 7.8 | 2022-08-25 | TOTOLINK A3700R V9.1.2u.6134_B20201202 was discovered to contain a stack overflow via the pppoeUser parameter. |
CVE-2022-36464 | High | 7.8 | 2022-08-25 | TOTOLINK A3700R V9.1.2u.6134_B20201202 was discovered to contain a stack overflow via the sPort parameter in the function setIpPortFilterRules. |
CVE-2022-36463 | High | 7.8 | 2022-08-25 | TOTOLINK A3700R V9.1.2u.6134_B20201202 was discovered to contain a stack overflow via the command parameter in the function setTracerouteCfg. |
CVE-2022-36462 | High | 7.8 | 2022-08-25 | TOTOLINK A3700R V9.1.2u.6134_B20201202 was discovered to contain a stack overflow via the lang parameter in the function setLanguageCfg. |
CVE-2022-36461 | High | 7.8 | 2022-08-25 | TOTOLINK A3700R V9.1.2u.6134_B20201202 was discovered to contain a command injection vulnerability via the hostName parameter in the function setOpModeCfg. |
CVE-2022-36460 | High | 7.8 | 2022-08-25 | TOTOLINK A3700R V9.1.2u.6134_B20201202 was discovered to contain a command injection vulnerability via the FileName parameter in the function UploadFirmwareFil… |
CVE-2022-36459 | High | 7.8 | 2022-08-25 | TOTOLINK A3700R V9.1.2u.6134_B20201202 was discovered to contain a command injection vulnerability via the host_time parameter in the function NTPSyncWithHost. |
CVE-2022-36458 | High | 7.8 | 2022-08-25 | TOTOLINK A3700R V9.1.2u.6134_B20201202 was discovered to contain a command injection vulnerability via the command parameter in the function setTracerouteCfg. |
CVE-2022-36456 | High | 7.8 | 2022-08-25 | TOTOLink A720R V4.1.5cu.532_B20210610 was discovered to contain a command injection vulnerability via the username parameter in /cstecgi.cgi. |
CVE-2022-36804 | High | 8.8 | 2022-08-25 | Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18… |
CVE-2022-2957 | Medium | 6.3 | 2022-08-25 | A vulnerability classified as critical was found in SourceCodester Simple and Nice Shopping Cart Script. Affected by this vulnerability is an unknown functiona… |
CVE-2022-34960 | Critical | 9.8 | 2022-08-25 | The container package in MikroTik RouterOS 7.4beta4 allows an attacker to create mount points pointing to symbolic links, which resolve to locations on the hos… |
CVE-2022-32427 | High | 8.8 | 2022-08-25 | PrinterLogic Windows Client through 25.0.0.676 allows attackers to execute directory traversal. Authenticated users with prior knowledge of the driver filename… |
CVE-2022-32894 | High | 7.8 | 2022-08-24 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS 15.6.1, macOS Monterey 12.5.1. An applic… |
CVE-2022-32893 | High | 8.8 | 2022-08-24 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS 15.6.1, macOS Monterey 12.5.1, Safari 15… |
CVE-2022-32857 | Medium | 4.3 | 2022-08-24 | This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8, Security U… |
CVE-2022-32840 | High | 7.8 | 2022-08-24 | This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.5, watchOS 8.7, iOS 15.6 and iPadOS 15.6. An app may be able to execute… |
CVE-2022-32839 | Critical | 9.8 | 2022-08-24 | The issue was addressed with improved bounds checks. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8, Security Update 2022-005 Catalina, iOS 1… |
CVE-2022-32838 | Medium | 5.5 | 2022-08-24 | A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8, Security Update 2022-005 Catalina… |
CVE-2022-32837 | High | 7.8 | 2022-08-24 | This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.5, tvOS 15.6, iOS 15.6 and iPadOS 15.6. An app may be able to cause une… |
CVE-2022-32834 | Medium | 5.5 | 2022-08-24 | An access issue was addressed with improvements to the sandbox. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8, Security Update 2022-005 Cata… |
CVE-2022-32813 | High | 7.8 | 2022-08-24 | The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8, Security Update 2022-005 Catalina, iOS… |
CVE-2022-32812 | High | 7.8 | 2022-08-24 | The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8, Security Update 2022-005 Catalina. An… |
CVE-2022-32811 | High | 7.8 | 2022-08-24 | A memory corruption vulnerability was addressed with improved locking. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8, Security Update 2022-0… |
CVE-2022-32810 | High | 7.8 | 2022-08-24 | The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.5, watchOS 8.7, iOS 15.6 and iPadOS 15.6. An app may be able to… |
CVE-2022-32793 | High | 7.5 | 2022-08-24 | Multiple out-of-bounds write issues were addressed with improved bounds checking. This issue is fixed in macOS Monterey 12.5, watchOS 8.7, tvOS 15.6, iOS 15.6… |
CVE-2022-37181 | Critical | 9.8 | 2022-08-24 | 72crm 9.0 has an Arbitrary file upload vulnerability. |
CVE-2022-37178 | High | 8.8 | 2022-08-24 | An issue was discovered in 72crm 9.0. There is a SQL Injection vulnerability in View the task calendar. |
CVE-2022-34838 | High | 8.1 | 2022-08-24 | Storing Passwords in a Recoverable Format vulnerability in ABB Zenon 8.20 allows an attacker who successfully exploit the vulnerability may add or alter data p… |
CVE-2022-34837 | Medium | 6.2 | 2022-08-24 | Storing Passwords in a Recoverable Format vulnerability in ABB Zenon 8.20 allows an attacker who successfully exploit the vulnerability may add more network cl… |
CVE-2022-34836 | Medium | 5.9 | 2022-08-24 | Relative Path Traversal vulnerability in ABB Zenon 8.20 allows the user to access files on the Zenon system and user also can add own log messages and e.g., fl… |
CVE-2022-2978 | High | 7.8 | 2022-08-24 | A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function security_inode_alloc to fail with following call to fun… |
CVE-2022-2569 | Medium | 5.5 | 2022-08-24 | The affected device stores sensitive information in cleartext, which may allow an authenticated user to access session data stored in the OAuth database belong… |
CVE-2022-2234 | Critical | 9.9 | 2022-08-24 | An authenticated mySCADA myPRO 8.26.0 user may be able to modify parameters to run commands directly in the operating system. |
CVE-2022-20122 | Critical | 9.8 | 2022-08-24 | The PowerVR GPU driver allows unprivileged apps to allocated pinned memory, unpin it (which makes it available to be freed), and continue using the page in GPU… |
CVE-2022-37153 | Medium | 6.1 | 2022-08-24 | An issue was discovered in Artica Proxy 4.30.000000. There is a XSS vulnerability via the password parameter in /fw.login.php. |
CVE-2022-36633 | High | 8.8 | 2022-08-24 | Teleport 9.3.6 is vulnerable to Command injection leading to Remote Code Execution. An attacker can craft a malicious ssh agent installation link by URL encodi… |
CVE-2022-33172 | Medium | 5.5 | 2022-08-24 | de.fac2 1.34 allows bypassing the User Presence protection mechanism when there is malware on the victim's PC. |
CVE-2022-27812 | High | 7.5 | 2022-08-24 | Flooding SNS firewall versions 3.7.0 to 3.7.29, 3.11.0 to 3.11.17, 4.2.0 to 4.2.10, and 4.3.0 to 4.3.6 with specific forged traffic, can lead to SNS DoS. |
CVE-2022-38089 | Medium | 5.4 | 2022-08-24 | Stored cross-site scripting vulnerability in Exment ((PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-admin v3.0.0 and earlier, (PHP7) exceedon… |
CVE-2022-38080 | Medium | 5.4 | 2022-08-24 | Reflected cross-site scripting vulnerability in Exment ((PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-admin v3.0.0 and earlier, (PHP7) excee… |
CVE-2022-38078 | Critical | 9.8 | 2022-08-24 | Movable Type XMLRPC API provided by Six Apart Ltd. contains a command injection vulnerability. Sending a specially crafted message by POST method to Movable Ty… |
CVE-2022-37333 | High | 8.8 | 2022-08-24 | SQL injection vulnerability in the Exment ((PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-admin v3.0.0 and earlier, (PHP7) exceedone/exment v… |
CVE-2022-37418 | Medium | 6.4 | 2022-08-24 | The Remote Keyless Entry (RKE) receiving unit on certain Nissan, Kia, and Hyundai vehicles through 2017 allows remote attackers to perform unlock operations an… |
CVE-2022-37305 | Medium | 6.4 | 2022-08-24 | The Remote Keyless Entry (RKE) receiving unit on certain Honda vehicles through 2018 allows remote attackers to perform unlock operations and force a resynchro… |
CVE-2022-36945 | Medium | 6.4 | 2022-08-24 | The Remote Keyless Entry (RKE) receiving unit on certain Mazda vehicles through 2020 allows remote attackers to perform unlock operations and force a resynchro… |
CVE-2022-25903 | High | 7.5 | 2022-08-24 | The package opcua from 0.0.0 are vulnerable to Denial of Service (DoS) via the ExtensionObjects and Variants objects, when it allows unlimited nesting levels… |
CVE-2022-24375 | High | 7.5 | 2022-08-24 | The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multi… |
CVE-2022-38132 | High | 8.2 | 2022-08-24 | Command injection vulnerability in Linksys MR8300 router while Registration to DDNS Service. By specifying username and password, an attacker connected to the… |
CVE-2022-31676 | High | 7.8 | 2022-08-23 | VMware Tools (12.0.0, 11.x.y and 10.x.y) contains a local privilege escalation vulnerability. A malicious actor with local non-administrative access to the Gue… |
CVE-2022-2938 | High | 7.8 | 2022-08-23 | A flaw was found in the Linux kernel's implementation of Pressure Stall Information. While the feature is disabled by default, it could allow an attacker to cr… |
CVE-2022-38463 | Medium | 6.1 | 2022-08-23 | ServiceNow through San Diego Patch 4b and Patch 6 allows reflected XSS in the logout functionality. |
CVE-2022-38172 | Medium | 6.1 | 2022-08-23 | ServiceNow through San Diego Patch 3 allows XSS via the name field during creation of a new dashboard for the Performance Analytics dashboard. |
CVE-2022-35115 | Critical | 9.8 | 2022-08-23 | IceWarp WebClient DC2 - Update 2 Build 9 (13.0.2.9) was discovered to contain a SQL injection vulnerability via the search parameter at /webmail/server/webmail… |
CVE-2022-1513 | High | 7.3 | 2022-08-23 | A potential vulnerability was reported in Lenovo PCManager prior to version 5.0.10.4191 that may allow code execution when visiting a specially crafted website. |
CVE-2022-38665 | Medium | 6.5 | 2022-08-23 | Jenkins CollabNet Plugins Plugin 2.0.8 and earlier stores a RabbitMQ password unencrypted in its global configuration file on the Jenkins controller where it c… |
CVE-2022-38664 | Medium | 5.4 | 2022-08-23 | Jenkins Job Configuration History Plugin 1165.v8cc9fd1f4597 and earlier does not escape the job name on the System Configuration History page, resulting in a s… |
CVE-2022-38663 | Medium | 6.5 | 2022-08-23 | Jenkins Git Plugin 4.11.4 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log provided by the Git Username and Passw… |
CVE-2022-37428 | Medium | 6.5 | 2022-08-23 | PowerDNS Recursor up to and including 4.5.9, 4.6.2 and 4.7.1, when protobuf logging is enabled, has Improper Cleanup upon a Thrown Exception, leading to a deni… |
CVE-2022-2946 | High | 7.8 | 2022-08-23 | Use After Free in GitHub repository vim/vim prior to 9.0.0246. |
CVE-2022-37113 | Critical | 9.8 | 2022-08-23 | Bluecms 1.6 has SQL injection in line 132 of admin/area.php |
CVE-2022-37112 | Critical | 9.8 | 2022-08-23 | BlueCMS 1.6 has SQL injection in line 55 of admin/model.php |
CVE-2022-37111 | Critical | 9.8 | 2022-08-23 | BlueCMS 1.6 has SQL injection in line 132 of admin/article.php |
CVE-2022-36405 | Medium | 5.4 | 2022-08-23 | Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in amCharts: Charts and Maps plugin <= 1.4 at WordPress. |
CVE-2022-36394 | High | 7.6 | 2022-08-23 | Authenticated (author+) SQL Injection (SQLi) vulnerability in Contest Gallery plugin <= 17.0.4 at WordPress. |
CVE-2022-36389 | Medium | 4.3 | 2022-08-23 | Cross-Site Request Forgery (CSRF) vulnerability in WordPlus Better Messages plugin <= 1.9.9.148 at WordPress. |
CVE-2022-36379 | High | 8.8 | 2022-08-23 | Cross-Site Request Forgery (CSRF) leading to plugin settings update in YooMoney ЮKassa для WooCommerce plugin <= 2.3.0 at WordPress. |
CVE-2022-36347 | Medium | 4.8 | 2022-08-23 | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alpine Press Alpine PhotoTile for Pinterest plugin <= 1.3.1 at WordPress. |
CVE-2022-36341 | Medium | 5.4 | 2022-08-23 | Authenticated (subscriber+) plugin settings change leading to Stored Cross-Site Scripting (XSS) vulnerability in Akash soni's AS – Create Pinterest Pinboard Pa… |
CVE-2022-36292 | Medium | 5.4 | 2022-08-23 | Cross-Site Request Forgery (CSRF) vulnerabilities in WPChill Gallery PhotoBlocks plugin <= 1.2.6 at WordPress. |
CVE-2022-36288 | Medium | 5.4 | 2022-08-23 | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in W3 Eden Download Manager plugin <= 3.2.48 at WordPress. |
CVE-2022-36285 | High | 7.2 | 2022-08-23 | Authenticated Arbitrary File Upload vulnerability in dmitrylitvinov Uploading SVG, WEBP and ICO files plugin <= 1.0.1 at WordPress. |
CVE-2022-36282 | Medium | 4.8 | 2022-08-23 | Authenticated (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Roman Pronskiy's Search Exclude plugin <= 1.2.6 at WordPress. |
CVE-2022-35726 | Medium | 4.3 | 2022-08-23 | Broken Authentication vulnerability in yotuwp Video Gallery plugin <= 1.3.4.5 at WordPress. |
CVE-2022-35242 | Medium | 6.5 | 2022-08-23 | Unauthenticated plugin settings change vulnerability in 59sec THE Leads Management System: 59sec LITE plugin <= 3.4.1 at WordPress. |
CVE-2022-35235 | Medium | 4.9 | 2022-08-23 | Authenticated (admin+) Arbitrary File Read vulnerability in XplodedThemes WPide plugin <= 2.6 at WordPress. |
CVE-2022-34868 | High | 8.8 | 2022-08-23 | Authenticated Arbitrary Settings Update vulnerability in YooMoney ЮKassa для WooCommerce plugin <= 2.3.0 at WordPress. |
CVE-2022-34658 | Medium | 5.4 | 2022-08-23 | Multiple Authenticated (contributor+) Persistent Cross-Site Scripting (XSS) vulnerabilities in W3 Eden Download Manager plugin <= 3.2.48 at WordPress. |
CVE-2022-34648 | Medium | 4.8 | 2022-08-23 | Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in dmitrylitvinov Uploading SVG, WEBP and ICO files plugin <= 1.0.1 at WordPress. |
CVE-2022-33142 | High | 7.7 | 2022-08-23 | Authenticated (subscriber+) Denial Of Service (DoS) vulnerability in WordPlus WordPress Better Messages plugin <= 1.9.10.57 at WordPress. |
CVE-2022-2965 | Medium | 4.3 | 2022-08-23 | Improper Restriction of Rendered UI Layers or Frames in GitHub repository notrinos/notrinoserp prior to 0.7. |
CVE-2022-29476 | Medium | 6.1 | 2022-08-23 | Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in 8 Degree Themes otification Bar for WordPress plugin <= 1.1.8 at WordPress. |
CVE-2022-28883 | Low | 3.5 | 2022-08-23 | A Denial-of-Service (DoS) vulnerability was discovered in F-Secure & WithSecure products whereby the aerdl unpack function crashes. This can lead to a possible… |
CVE-2022-28882 | Medium | 4.3 | 2022-08-23 | A Denial-of-Service (DoS) vulnerability was discovered in F-Secure & WithSecure products whereby the aegen.dll will go into an infinite loop when unpacking PE… |
CVE-2022-35278 | Medium | 6.1 | 2022-08-23 | In Apache ActiveMQ Artemis prior to 2.24.0, an attacker could show malicious content and/or redirect users to a malicious URL in the web console by using HTML… |
CVE-2022-37223 | Critical | 9.8 | 2022-08-23 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/role/list. |
CVE-2022-37199 | Critical | 9.8 | 2022-08-23 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/user/list. |
CVE-2022-36261 | Critical | 9.1 | 2022-08-23 | An arbitrary file deletion vulnerability was discovered in taocms 3.0.2, that allows attacker to delete file in server when request url admin.php?action=file&c… |
CVE-2022-35203 | High | 7.2 | 2022-08-23 | An access control issue in TrendNet TV-IP572PI v1.0 allows unauthenticated attackers to access sensitive system information. |
CVE-2022-2956 | Low | 3.5 | 2022-08-23 | A vulnerability classified as problematic has been found in ConsoleTVs Noxen. Affected is an unknown function of the file /Noxen-master/users.php. The manipula… |
CVE-2022-1989 | Medium | 5.3 | 2022-08-23 | All CODESYS Visualization versions before V4.2.0.0 generate a login dialog vulnerable to information exposure allowing a remote, unauthenticated attacker to en… |
CVE-2022-2796 | Medium | 4.8 | 2022-08-23 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.4. |
CVE-2022-36350 | Medium | 5.4 | 2022-08-23 | Stored cross-site scripting vulnerability in PukiWiki versions 1.3.1 to 1.5.3 allows a remote attacker to inject an arbitrary script via unspecified vectors. |