2022 CVEs (page 153)
Page 153 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-35692 | Medium | 5.3 | 2022-08-19 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that co… |
CVE-2022-35554 | Medium | 6.1 | 2022-08-19 | Multiple reflected XSS vulnerabilities occur when handling error message of BPC SmartVista version 3.28.0 allowing an attacker to execute javascript code at cl… |
CVE-2022-2793 | Medium | 5.9 | 2022-08-19 | Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-353 Missing Support for Integrity Check, and has no authentication or au… |
CVE-2022-2792 | Medium | 6.6 | 2022-08-19 | Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-284 Improper Access Control, and stores project data in a directory with… |
CVE-2022-2790 | Medium | 5.9 | 2022-08-19 | Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-347 Improper Verification of Cryptographic Signature, and does not prope… |
CVE-2022-2789 | Medium | 4.7 | 2022-08-19 | Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulnerable to CWE-345 Insufficient Verification of Data Authenticity, and can display logi… |
CVE-2022-36233 | Medium | 5.5 | 2022-08-19 | Tenda AC9 V15.03.2.13 is vulnerable to Buffer Overflow via httpd, form_fast_setting_wifi_set. httpd. |
CVE-2022-36171 | High | 8.1 | 2022-08-19 | MapGIS IGServer 10.5.6.11 is vulnerable to Arbitrary file deletion. |
CVE-2022-36157 | High | 8.8 | 2022-08-19 | XXL-JOB all versions as of 11 July 2022 are vulnerable to Insecure Permissions resulting in the ability to execute admin function with low Privilege account. |
CVE-2022-37175 | Critical | 9.8 | 2022-08-19 | Tenda ac15 firmware V15.03.05.18 httpd server has stack buffer overflow in /goform/formWifiBasicSet. |
CVE-2022-36170 | High | 8.8 | 2022-08-19 | MapGIS 10.5 Pro IGServer has hardcoded credentials in the front-end and can lead to escalation of privileges and arbitrary file deletion. |
CVE-2022-36031 | Medium | 6.5 | 2022-08-19 | Directus is a free and open-source data platform for headless content management. The Directus process can be aborted by having an authorized user update the `… |
CVE-2022-36009 | Medium | 5.0 | 2022-08-19 | gomatrixserverlib is a Go library for matrix protocol federation. Dendrite is a Matrix homeserver written in Go, an alternative to Synapse. The power level par… |
CVE-2022-36008 | High | 7.1 | 2022-08-19 | Frontier is Substrate's Ethereum compatibility layer. A security issue was discovered affecting parsing of the RPC result of the exit reason in case of EVM rev… |
CVE-2022-2788 | Low | 3.9 | 2022-08-19 | Emerson Electric's Proficy Machine Edition Version 9.80 and prior is vulnerable to CWE-29 Path Traversal: '\..\Filename', also known as a ZipSlip attack, throu… |
CVE-2022-23460 | Medium | 5.9 | 2022-08-19 | Jsonxx or Json++ is a JSON parser, writer and reader written in C++. In affected versions of jsonxx json parsing may lead to stack exhaustion in an address san… |
CVE-2022-23459 | High | 8.1 | 2022-08-19 | Jsonxx or Json++ is a JSON parser, writer and reader written in C++. In affected versions of jsonxx use of the Value class may lead to memory corruption via a… |
CVE-2022-22489 | Critical | 9.1 | 2022-08-19 | IBM MQ 8.0, (9.0, 9.1, 9.2 LTS), and (9.1 and 9.2 CD) are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attack… |
CVE-2022-0542 | Medium | 6.1 | 2022-08-19 | Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.7.0. |
CVE-2022-37254 | Medium | 5.4 | 2022-08-19 | DolphinPHP 1.5.1 is vulnerable to Cross Site Scripting (XSS) via Background - > System - > system function - > configuration management. |
CVE-2022-36579 | High | 8.8 | 2022-08-19 | Wellcms 2.2.0 is vulnerable to Cross Site Request Forgery (CSRF). |
CVE-2022-36578 | Critical | 9.8 | 2022-08-19 | jizhicms v2.3.1 has SQL injection in the background. |
CVE-2022-36577 | High | 8.8 | 2022-08-19 | An issue was discovered in jizhicms v2.3.1. There is a CSRF vulnerability that can add a admin. |
CVE-2022-36225 | High | 8.8 | 2022-08-19 | EyouCMS V1.5.8-UTF8-SP1 is vulnerable to Cross Site Request Forgery (CSRF) via the background, column management function and add. |
CVE-2022-36224 | High | 8.8 | 2022-08-19 | XunRuiCMS V4.5.6 is vulnerable to Cross Site Request Forgery (CSRF). |
CVE-2022-36606 | Critical | 9.8 | 2022-08-19 | Ywoa before v6.1 was discovered to contain a SQL injection vulnerability via /oa/setup/checkPool?database. |
CVE-2022-36605 | Critical | 9.8 | 2022-08-19 | Yimioa v6.1 was discovered to contain a SQL injection vulnerability via the orderbyGET parameter. |
CVE-2022-36263 | High | 7.3 | 2022-08-19 | StreamLabs Desktop Application 1.9.0 is vulnerable to Incorrect Access Control via obs64.exe. An attacker can execute arbitrary code via a crafted .exe file. |
CVE-2022-35201 | Critical | 9.8 | 2022-08-19 | Tenda-AC18 V15.03.05.05 was discovered to contain a remote command execution (RCE) vulnerability. |
CVE-2022-34624 | Medium | 5.9 | 2022-08-19 | Mealie1.0.0beta3 does not terminate download tokens after a user logs out, allowing attackers to perform a man-in-the-middle attack via a crafted GET request. |
CVE-2022-34621 | Medium | 6.5 | 2022-08-19 | Mealie 1.0.0beta3 was discovered to contain an Insecure Direct Object Reference (IDOR) vulnerability which allows attackers to modify user passwords and other… |
CVE-2022-34615 | Critical | 9.8 | 2022-08-19 | Mealie 1.0.0beta3 employs weak password requirements which allows attackers to potentially gain unauthorized access to the application via brute-force attacks. |
CVE-2022-36220 | Critical | 9.8 | 2022-08-19 | Kiosk breakout (without quit password) in Safe Exam Browser (Windows) <3.4.0, which allows an attacker to achieve code execution via the browsers' print dialog. |
CVE-2022-35910 | Medium | 5.4 | 2022-08-19 | In Jellyfin before 10.8, stored XSS allows theft of an admin access token. |
CVE-2022-35909 | High | 8.8 | 2022-08-19 | In Jellyfin before 10.8, the /users endpoint has incorrect access control for admin functionality. |
CVE-2022-2889 | High | 7.8 | 2022-08-19 | Use After Free in GitHub repository vim/vim prior to 9.0.0225. |
CVE-2022-29805 | Critical | 9.8 | 2022-08-19 | A Java Deserialization vulnerability in the Fishbowl Server in Fishbowl Inventory before 2022.4.1 allows remote attackers to execute arbitrary code via a craft… |
CVE-2022-1021 | Medium | 5.4 | 2022-08-19 | Insecure Storage of Sensitive Information in GitHub repository chatwoot/chatwoot prior to 2.6.0. |
CVE-2022-2886 | Medium | 5.0 | 2022-08-19 | A vulnerability, which was classified as critical, was found in Laravel 5.1. Affected is an unknown function. The manipulation leads to deserialization. It is… |
CVE-2022-2075 | High | 7.5 | 2022-08-19 | In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service targeting the build information request validation. |
CVE-2022-2074 | High | 7.5 | 2022-08-19 | In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service using the Variable Project Template. |
CVE-2022-2049 | High | 7.5 | 2022-08-19 | In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service via the package upload function. |
CVE-2022-1901 | Medium | 5.3 | 2022-08-19 | In affected versions of Octopus Deploy it is possible to unmask sensitive variables by using variable preview. |
CVE-2022-35167 | High | 8.8 | 2022-08-19 | Printix Cloud Print Management v1.3.1149.0 for Windows was discovered to contain insecure permissions. |
CVE-2022-35540 | Critical | 9.8 | 2022-08-18 | Hardcoded JWT Secret in AgileConfig <1.6.8 Server allows remote attackers to use the generated JWT token to gain administrator access. |
CVE-2022-36947 | Critical | 9.8 | 2022-08-18 | Unsafe Parsing of a PNG tRNS chunk in FastStone Image Viewer through 7.5 results in a stack buffer overflow. |
CVE-2022-34488 | High | 7.8 | 2022-08-18 | Improper buffer restrictions in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially enable escalati… |
CVE-2022-34345 | Medium | 6.2 | 2022-08-18 | Improper input validation in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially enable escalation… |
CVE-2022-33209 | High | 7.8 | 2022-08-18 | Improper input validation in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially enable escalation… |
CVE-2022-32579 | High | 7.2 | 2022-08-18 | Improper initialization in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially enable escalation of… |
CVE-2022-30944 | Medium | 5.5 | 2022-08-18 | Insufficiently protected credentials for Intel(R) AMT and Intel(R) Standard Manageability may allow a privileged user to potentially enable information disclos… |
CVE-2022-30601 | Critical | 9.8 | 2022-08-18 | Insufficiently protected credentials for Intel(R) AMT and Intel(R) Standard Manageability may allow an unauthenticated user to potentially enable information d… |
CVE-2022-28858 | High | 7.8 | 2022-08-18 | Improper buffer restriction in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially enable escalatio… |
CVE-2022-28697 | Medium | 6.8 | 2022-08-18 | Improper access control in firmware for Intel(R) AMT and Intel(R) Standard Manageability may allow an unauthenticated user to potentially enable escalation of… |
CVE-2022-27493 | High | 7.8 | 2022-08-18 | Improper initialization in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially enable an escalation… |
CVE-2022-37770 | Medium | 6.5 | 2022-08-18 | libjpeg commit 281daa9 was discovered to contain a segmentation fault via LineMerger::GetNextLowpassLine at linemerger.cpp. This vulnerability allows attackers… |
CVE-2022-37769 | Medium | 6.5 | 2022-08-18 | libjpeg commit 281daa9 was discovered to contain a segmentation fault via HuffmanDecoder::Get at huffmandecoder.hpp. This vulnerability allows attackers to cau… |
CVE-2022-37768 | High | 7.5 | 2022-08-18 | libjpeg commit 281daa9 was discovered to contain an infinite loop via the component Frame::ParseTrailer. |
CVE-2022-37049 | High | 7.8 | 2022-08-18 | The component tcpprep in Tcpreplay v4.4.1 was discovered to contain a heap-based buffer overflow in parse_mpls at common/get.c:150. NOTE: this is different fro… |
CVE-2022-37048 | High | 7.8 | 2022-08-18 | The component tcprewrite in Tcpreplay v4.4.1 was discovered to contain a heap-based buffer overflow in get_l2len_protocol at common/get.c:344. NOTE: this is di… |
CVE-2022-37047 | High | 7.8 | 2022-08-18 | The component tcprewrite in Tcpreplay v4.4.1 was discovered to contain a heap-based buffer overflow in get_ipv6_next at common/get.c:713. NOTE: this is differe… |
CVE-2022-36729 | Critical | 9.8 | 2022-08-18 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the M_Id parameter at /librarian/del.php. |
CVE-2022-36728 | Critical | 9.8 | 2022-08-18 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the RollNo parameter at /staff/delstu.php. |
CVE-2022-36727 | Critical | 9.8 | 2022-08-18 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at /staff/delete.php. |
CVE-2022-36725 | Critical | 9.8 | 2022-08-18 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the M_Id parameter at /student/dele.php. |
CVE-2022-36722 | Critical | 9.8 | 2022-08-18 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the title parameter at /librarian/history.php. |
CVE-2022-35213 | Medium | 6.1 | 2022-08-18 | Ecommerce-CodeIgniter-Bootstrap before commit 56465f was discovered to contain a cross-site scripting (XSS) vulnerability via the function base_url() at /blog/… |
CVE-2022-35212 | Medium | 6.1 | 2022-08-18 | osCommerce2 before v2.3.4.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the function tep_db_error(). |
CVE-2022-30296 | High | 7.5 | 2022-08-18 | Insufficiently protected credentials in the Intel(R) Datacenter Group Event iOS application, all versions, may allow an unauthenticated user to potentially ena… |
CVE-2022-2568 | Medium | 6.5 | 2022-08-18 | A privilege escalation flaw was found in the Ansible Automation Platform. This flaw allows a remote authenticated user with 'change user' permissions to modify… |
CVE-2022-29507 | Medium | 5.5 | 2022-08-18 | Insufficiently protected credentials in the Intel(R) Team Blue mobile application in all versions may allow an authenticated user to potentially enable informa… |
CVE-2022-28757 | High | 8.8 | 2022-08-18 | The Zoom Client for Meetings for macOS (Standard and for IT Admin) starting with version 5.7.3 and before 5.11.6 contains a vulnerability in the auto update pr… |
CVE-2022-28709 | Medium | 4.4 | 2022-08-18 | Improper access control in the firmware for some Intel(R) E810 Ethernet Controllers before version 1.6.1.9 may allow a privileged user to potentially enable de… |
CVE-2022-28696 | High | 7.8 | 2022-08-18 | Uncontrolled search path in the Intel(R) Distribution for Python before version 2022.0.3 may allow an authenticated user to potentially enable escalation of pr… |
CVE-2022-27500 | Medium | 5.5 | 2022-08-18 | Incorrect default permissions for the Intel(R) Support Android application before 21.07.40 may allow an authenticated user to potentially enable information di… |
CVE-2022-26844 | High | 7.8 | 2022-08-18 | Insufficiently protected credentials in the installation binaries for Intel(R) SEAPI in all versions may allow an authenticated user to potentially enable esca… |
CVE-2022-26374 | High | 7.8 | 2022-08-18 | Uncontrolled search path in the installation binaries for Intel(R) SEAPI all versions may allow an authenticated user to potentially enable escalation of privi… |
CVE-2022-26373 | Medium | 5.5 | 2022-08-18 | Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information… |
CVE-2022-26344 | High | 7.8 | 2022-08-18 | Incorrect default permissions in the installation binaries for Intel(R) SEAPI all versions may allow an authenticated user to potentially enable escalation of… |
CVE-2022-26074 | Medium | 4.4 | 2022-08-18 | Incomplete cleanup in a firmware subsystem for Intel(R) SPS before versions SPS_E3_04.08.04.330.0 and SPS_E3_04.01.04.530.0 may allow a privileged user to pote… |
CVE-2022-26017 | High | 8.0 | 2022-08-18 | Improper access control in the Intel(R) DSA software for before version 22.2.14 may allow an authenticated user to potentially enable escalation of privilege v… |
CVE-2022-25999 | High | 7.8 | 2022-08-18 | Uncontrolled search path element in the Intel(R) Enpirion(R) Digital Power Configurator GUI software, all versions may allow an authenticated user to potential… |
CVE-2022-25966 | High | 7.8 | 2022-08-18 | Improper access control in the Intel(R) Edge Insights for Industrial software before version 2.6.1 may allow an authenticated user to potentially enable escala… |
CVE-2022-25899 | Critical | 9.8 | 2022-08-18 | Authentication bypass for the Open AMT Cloud Toolkit software maintained by Intel(R) before versions 2.0.2 and 2.2.2 may allow an unauthenticated user to poten… |
CVE-2022-25841 | High | 7.8 | 2022-08-18 | Uncontrolled search path elements in the Intel(R) Datacenter Group Event Android application, all versions, may allow an authenticated user to potentially enab… |
CVE-2022-25228 | Medium | 6.5 | 2022-08-18 | CandidATS Version 3.0.0 Beta allows an authenticated user to inject SQL queries in '/index.php?m=settings&a=show' via the 'userID' parameter, in '/index.php?m=… |
CVE-2022-24378 | Medium | 5.5 | 2022-08-18 | Improper initialization in the Intel(R) Data Center Manager software before version 4.1 may allow an authenticated user to potentially enable denial of service… |
CVE-2022-23403 | Medium | 5.5 | 2022-08-18 | Improper input validation in the Intel(R) Data Center Manager software before version 4.1 may allow an authenticated user to potentially enable denial of servi… |
CVE-2022-23182 | High | 8.8 | 2022-08-18 | Improper access control in the Intel(R) Data Center Manager software before version 4.1 may allow an unauthenticated user to potentially enable escalation of p… |
CVE-2022-22730 | Critical | 9.8 | 2022-08-18 | Improper authentication in the Intel(R) Edge Insights for Industrial software before version 2.6.1 may allow an unauthenticated user to potentially enable esca… |
CVE-2022-21812 | High | 7.8 | 2022-08-18 | Improper access control in the Intel(R) HAXM software before version 7.7.1 may allow an authenticated user to potentially enable escalation of privilege via lo… |
CVE-2022-21807 | High | 7.8 | 2022-08-18 | Uncontrolled search path elements in the Intel(R) VTune(TM) Profiler software before version 2022.2.0 may allow an authenticated user to potentially enable esc… |
CVE-2022-21793 | Medium | 5.5 | 2022-08-18 | Insufficient control flow management in the Intel(R) Ethernet 500 Series Controller drivers for VMWare before version 1.11.4.0 and in the Intel(R) Ethernet 700… |
CVE-2022-21240 | Medium | 4.4 | 2022-08-18 | Out of bounds read for some Intel(R) PROSet/Wireless WiFi products may allow a privileged user to potentially enable information disclosure via local access. |
CVE-2022-21233 | Medium | 5.5 | 2022-08-18 | Improper isolation of shared resources in some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access. |
CVE-2022-21229 | High | 7.8 | 2022-08-18 | Improper buffer restrictions for some Intel(R) NUC 9 Extreme Laptop Kit drivers before version 2.2.0.22 may allow an authenticated user to potentially enable e… |
CVE-2022-21225 | High | 8.0 | 2022-08-18 | Improper neutralization in the Intel(R) Data Center Manager software before version 4.1 may allow an authenticated user to potentially enable escalation of pri… |
CVE-2022-21212 | Medium | 6.5 | 2022-08-18 | Improper input validation for some Intel(R) PROSet/Wireless WiFi products may allow an unauthenticated user to potentially enable denial of service via adjacen… |
CVE-2022-21197 | High | 7.5 | 2022-08-18 | Improper input validation for some Intel(R) PROSet/Wireless WiFi products may allow an unauthenticated user to potentially enable denial of service via network… |
CVE-2022-21181 | High | 7.8 | 2022-08-18 | Improper input validation for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enable escalation of p… |