2022 CVEs (page 154)
Page 154 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-21172 | Medium | 6.7 | 2022-08-18 | Out of bounds write for some Intel(R) PROSet/Wireless WiFi products may allow a privileged user to potentially enable escalation of privilege via local access. |
CVE-2022-21160 | High | 7.5 | 2022-08-18 | Improper buffer restrictions for some Intel(R) PROSet/Wireless WiFi products may allow an unauthenticated user to potentially enable denial of service via netw… |
CVE-2022-21152 | Medium | 5.5 | 2022-08-18 | Improper access control in the Intel(R) Edge Insights for Industrial software before version 2.6.1 may allow an authenticated user to potentially enable inform… |
CVE-2022-21148 | High | 7.8 | 2022-08-18 | Improper access control in the Intel(R) Edge Insights for Industrial software before version 2.6.1 may allow an authenticated user to potentially enable escala… |
CVE-2022-21140 | Medium | 5.5 | 2022-08-18 | Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enable information discl… |
CVE-2022-21139 | High | 8.8 | 2022-08-18 | Inadequate encryption strength for some Intel(R) PROSet/Wireless WiFi products may allow an unauthenticated user to potentially enable escalation of privilege… |
CVE-2022-37422 | High | 7.5 | 2022-08-18 | Payara through 5.2022.2 allows directory traversal without authentication. This affects Payara Server, Payara Micro, and Payara Server Embedded. |
CVE-2022-35976 | Medium | 5.2 | 2022-08-18 | The GitOps Tools Extension for VSCode relies on kubeconfigs in order to communicate with Kubernetes clusters. A specially crafted kubeconfig leads to arbitrary… |
CVE-2022-35204 | Medium | 4.3 | 2022-08-18 | Vitejs Vite before v2.9.13 was discovered to allow attackers to perform a directory traversal via a crafted URL to the victim's service. |
CVE-2022-2625 | High | 8.0 | 2022-08-18 | A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait fo… |
CVE-2022-37063 | Medium | 5.4 | 2022-08-18 | All FLIR AX8 thermal sensor cameras versions up to and including 1.46.16 are vulnerable to Cross Site Scripting (XSS) due to improper input sanitization. An au… |
CVE-2022-37062 | High | 7.5 | 2022-08-18 | All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are affected by an insecure design vulnerability due to an improper directory access re… |
CVE-2022-37061 | Critical | 9.8 | 2022-08-18 | All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to Remote Command Injection. This can be exploited to inject and execute… |
CVE-2022-35975 | Critical | 9.0 | 2022-08-18 | The GitOps Tools Extension for VSCode can make it easier to manage Flux objects. A specially crafted Flux object may allow for remote code execution in the mac… |
CVE-2022-35175 | Critical | 9.8 | 2022-08-18 | Barangay Management System v1.0 was discovered to contain a SQL injection vulnerability via the hidden_id parameter at /blotter/blotter.php. |
CVE-2022-35174 | Medium | 5.4 | 2022-08-18 | A stored cross-site scripting (XSS) vulnerability in Kirby's Starterkit v3.7.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payloa… |
CVE-2022-37060 | High | 7.5 | 2022-08-18 | FLIR AX8 thermal sensor cameras version up to and including 1.46.16 is vulnerable to Directory Traversal due to an improper access restriction. An unauthentica… |
CVE-2022-36023 | High | 7.0 | 2022-08-18 | Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. If a gateway client application… |
CVE-2022-2874 | Medium | 5.5 | 2022-08-18 | NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0224. |
CVE-2022-36024 | High | 7.5 | 2022-08-18 | py-cord is a an API wrapper for Discord written in Python. Bots creating using py-cord version 2.0.0 are vulnerable to remote shutdown if they are added to the… |
CVE-2022-37025 | High | 7.8 | 2022-08-18 | An improper privilege management vulnerability in McAfee Security Scan Plus (MSS+) before 4.1.262.1 could allow a local user to modify a configuration file and… |
CVE-2022-29550 | Medium | 5.5 | 2022-08-18 | An issue was discovered in Qualys Cloud Agent 4.8.0-49. It writes "ps auxwwe" output to the /var/log/qualys/qualys-cloud-agent-scan.log file. This may, for exa… |
CVE-2022-29549 | High | 7.3 | 2022-08-18 | An issue was discovered in Qualys Cloud Agent 4.8.0-49. It executes programs at various full pathnames without first making ownership and permission checks (e… |
CVE-2022-33311 | Medium | 4.3 | 2022-08-18 | Browse restriction bypass vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to obtain the data of Address… |
CVE-2022-33151 | Medium | 6.1 | 2022-08-18 | Cross-site scripting vulnerability in the specific parameters of Cybozu Office 10.0.0 to 10.8.5 allows remote attackers to inject an arbitrary script via unspe… |
CVE-2022-32583 | Medium | 4.3 | 2022-08-18 | Operation restriction bypass vulnerability in Scheduler of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to alter the data of Scheduler… |
CVE-2022-32544 | Medium | 4.3 | 2022-08-18 | Operation restriction bypass vulnerability in Project of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to alter the data of Project via… |
CVE-2022-32453 | Medium | 6.5 | 2022-08-18 | HTTP header injection vulnerability in Cybozu Office 10.0.0 to 10.8.5 may allow a remote attacker to obtain and/or alter the data of the product via unspecifie… |
CVE-2022-32283 | Medium | 4.3 | 2022-08-18 | Browse restriction bypass vulnerability in Cabinet of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to obtain the data of Cabinet via u… |
CVE-2022-30693 | Medium | 5.3 | 2022-08-18 | Information disclosure vulnerability in the system configuration of Cybozu Office 10.0.0 to 10.8.5 allows a remote attacker to obtain the data of the product v… |
CVE-2022-30604 | Medium | 6.1 | 2022-08-18 | Cross-site scripting vulnerability in the specific parameters of Cybozu Office 10.0.0 to 10.8.5 allows a remote attacker to inject an arbitrary script via unsp… |
CVE-2022-2876 | Medium | 6.3 | 2022-08-18 | A vulnerability, which was classified as critical, was found in SourceCodester Student Management System. Affected is an unknown function of the file index.php… |
CVE-2022-29891 | Medium | 4.3 | 2022-08-18 | Browse restriction bypass vulnerability in Custom Ap of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to obtain the data of Custom App… |
CVE-2022-29487 | Medium | 6.1 | 2022-08-18 | Cross-site scripting vulnerability in Cybozu Office 10.0.0 to 10.8.5 allows a remote attacker to inject an arbitrary script via unspecified vectors. |
CVE-2022-28715 | Medium | 6.1 | 2022-08-18 | Cross-site scripting vulnerability in the specific parameters of Cybozu Office 10.0.0 to 10.8.5 allows a remote attacker to inject an arbitrary script via unsp… |
CVE-2022-25986 | Medium | 4.3 | 2022-08-18 | Browse restriction bypass vulnerability in Scheduler of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to obtain the data of Scheduler. |
CVE-2022-35198 | High | 7.5 | 2022-08-18 | Contract Management System v2.0 contains a weak default password which gives attackers to access database connection information. |
CVE-2022-35173 | High | 7.5 | 2022-08-18 | An issue was discovered in Nginx NJS v0.7.5. The JUMP offset for a break instruction was not set to a correct offset during code generation, leading to a segme… |
CVE-2022-35166 | Medium | 5.5 | 2022-08-18 | libjpeg commit 842c7ba was discovered to contain an infinite loop via the component JPEG::ReadInternal. |
CVE-2022-35165 | Medium | 5.5 | 2022-08-18 | An issue in AP4_SgpdAtom::AP4_SgpdAtom() of Bento4-1.6.0-639 allows attackers to cause a Denial of Service (DoS) via a crafted mp4 input. |
CVE-2022-35164 | Critical | 9.8 | 2022-08-18 | LibreDWG v0.12.4.4608 & commit f2dea29 was discovered to contain a heap use-after-free via bit_copy_chain. |
CVE-2022-35154 | Critical | 9.8 | 2022-08-18 | Shopro Mall System v1.3.8 was discovered to contain a SQL injection vulnerability via the value parameter. |
CVE-2022-35153 | Critical | 9.8 | 2022-08-18 | FusionPBX 5.0.1 was discovered to contain a command injection vulnerability via /fax/fax_send.php. |
CVE-2022-35606 | Critical | 9.8 | 2022-08-18 | A SQL injection vulnerability in CustomerDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via the paramete… |
CVE-2022-35605 | Critical | 9.8 | 2022-08-18 | A SQL injection vulnerability in UserDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via the parameters s… |
CVE-2022-35603 | Critical | 9.8 | 2022-08-18 | A SQL injection vulnerability in CustomerDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via parameter se… |
CVE-2022-35602 | Critical | 9.8 | 2022-08-18 | A SQL injection vulnerability in UserDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via parameter user. |
CVE-2022-35601 | Critical | 9.8 | 2022-08-18 | A SQL injection vulnerability in SupplierDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via parameter se… |
CVE-2022-35599 | Critical | 9.8 | 2022-08-18 | A SQL injection vulnerability in Stocks.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via parameter product… |
CVE-2022-35598 | Critical | 9.8 | 2022-08-18 | A SQL injection vulnerability in ConnectionFactoryDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via par… |
CVE-2022-35151 | Medium | 6.1 | 2022-08-17 | kkFileView v4.1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the urls and currentUrl parameters at /controller/OnlinePre… |
CVE-2022-2869 | Medium | 5.5 | 2022-08-17 | libtiff's tiffcrop tool has a uint32_t underflow which leads to out of bounds read and write in the extractContigSamples8bits routine. An attacker who supplies… |
CVE-2022-2868 | Medium | 5.5 | 2022-08-17 | libtiff's tiffcrop utility has a improper input validation flaw that can lead to out of bounds read and ultimately cause a crash if an attacker is able to supp… |
CVE-2022-2867 | Medium | 5.5 | 2022-08-17 | libtiff's tiffcrop utility has a uint32_t underflow that can lead to out of bounds read and write. An attacker who supplies a crafted file to tiffcrop (likely… |
CVE-2022-28752 | High | 8.8 | 2022-08-17 | Zoom Rooms for Conference Rooms for Windows versions before 5.11.0 are susceptible to a Local Privilege Escalation vulnerability. A local low-privileged malici… |
CVE-2022-28751 | High | 8.8 | 2022-08-17 | The Zoom Client for Meetings for MacOS (Standard and for IT Admin) before version 5.11.3 contains a vulnerability in the package signature validation during th… |
CVE-2022-35148 | Medium | 6.5 | 2022-08-17 | maccms10 v2021.1000.1081 to v2022.1000.3031 was discovered to contain a SQL injection vulnerability via the table parameter at database/columns.html. |
CVE-2022-35147 | Critical | 9.8 | 2022-08-17 | DoraCMS v2.18 and earlier allows attackers to bypass login authentication via a crafted HTTP request. |
CVE-2022-35133 | Medium | 6.1 | 2022-08-17 | A cross-site scripting (XSS) vulnerability in CherryTree v0.99.30 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into… |
CVE-2022-35122 | Critical | 9.1 | 2022-08-17 | An access control issue in Ecowitt GW1100 Series Weather Stations <=GW1100B_v2.1.5 allows unauthenticated attackers to access sensitive information including d… |
CVE-2022-2547 | High | 7.5 | 2022-08-17 | A crafted HTTP packet without a content-type header can create a denial-of-service condition in Softing Secure Integration Server V1.22. |
CVE-2022-2338 | Medium | 5.7 | 2022-08-17 | Softing Secure Integration Server V1.22 is vulnerable to authentication bypass via a machine-in-the-middle attack. The default the administration interface is… |
CVE-2022-2337 | High | 7.5 | 2022-08-17 | A crafted HTTP packet with a missing HTTP URI can create a denial-of-service condition in Softing Secure Integration Server V1.22. |
CVE-2022-2336 | Critical | 9.8 | 2022-08-17 | Softing Secure Integration Server, edgeConnector, and edgeAggregator software ships with the default administrator credentials as `admin` and password as `admi… |
CVE-2022-2335 | High | 7.5 | 2022-08-17 | A crafted HTTP packet with a -1 content-length header can create a denial-of-service condition in Softing Secure Integration Server V1.22. |
CVE-2022-2334 | High | 7.2 | 2022-08-17 | The application searches for a library dll that is not found. If an attacker can place a dll with this name, then the attacker can leverage it to execute arbit… |
CVE-2022-23765 | High | 8.0 | 2022-08-17 | This vulnerability occured by sending a malicious POST request to a specific page while logged in random user from some family of IPTIME NAS. Remote attackers… |
CVE-2022-23764 | High | 8.8 | 2022-08-17 | The vulnerability causing from insufficient verification procedures for downloaded files during WebCube update. Remote attackers can bypass this verification l… |
CVE-2022-23747 | Critical | 9.8 | 2022-08-17 | In Sony Xperia series 1, 5, and Pro, an out of bound memory access can occur due to lack of validation of the number of frames being passed during music playba… |
CVE-2022-1748 | High | 7.5 | 2022-08-17 | Softing OPC UA C++ Server SDK, Secure Integration Server, edgeConnector, edgeAggregator, OPC Suite, and uaGate are affected by a NULL pointer dereference vulne… |
CVE-2022-1373 | High | 7.2 | 2022-08-17 | The “restore configuration” feature of Softing Secure Integration Server V1.22 is vulnerable to a directory traversal vulnerability when processing zip files… |
CVE-2022-1069 | High | 7.5 | 2022-08-17 | A crafted HTTP packet with a large content-length header can create a denial-of-service condition in Softing Secure Integration Server V1.22. |
CVE-2022-36216 | High | 7.2 | 2022-08-17 | DedeCMS v5.7.94 - v5.7.97 was discovered to contain a remote code execution vulnerability in member_toadmin.php. |
CVE-2022-36215 | High | 7.2 | 2022-08-17 | DedeBIZ v6 was discovered to contain a remote code execution vulnerability in sys_info.php. |
CVE-2022-35516 | Critical | 9.8 | 2022-08-17 | DedeCMS v5.7.93 - v5.7.96 was discovered to contain a remote code execution vulnerability in login.php. |
CVE-2022-35121 | Critical | 9.8 | 2022-08-17 | Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/BookServiceImpl.java. |
CVE-2022-2862 | High | 7.8 | 2022-08-17 | Use After Free in GitHub repository vim/vim prior to 9.0.0221. |
CVE-2022-2870 | Medium | 4.1 | 2022-08-17 | A vulnerability was found in laravel 5.1 and classified as problematic. This issue affects some unknown processing. The manipulation leads to deserialization… |
CVE-2022-38392 | Medium | 5.3 | 2022-08-17 | Certain 5400 RPM hard drives, for laptops and other PCs in approximately 2005 and later, allow physically proximate attackers to cause a denial of service (dev… |
CVE-2022-35117 | Medium | 4.8 | 2022-08-17 | Clinic's Patient Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via update_medicine_details.php. This vulnerabilit… |
CVE-2022-2849 | High | 7.8 | 2022-08-17 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0220. |
CVE-2022-36191 | Medium | 5.5 | 2022-08-17 | A heap-buffer-overflow had occurred in function gf_isom_dovi_config_get of isomedia/avc_ext.c:2490, as demonstrated by MP4Box. This vulnerability was fixed in… |
CVE-2022-22455 | Critical | 9.8 | 2022-08-17 | IBM Security Verify Governance Identity Manager 10.0 virtual appliance component performs an operation at a privilege level that is higher than the minimum lev… |
CVE-2022-38149 | High | 7.5 | 2022-08-17 | HashiCorp Consul Template up to 0.27.2, 0.28.2, and 0.29.1 may expose the contents of Vault secrets in the error returned by the *template.Template.Execute met… |
CVE-2022-36190 | Critical | 9.8 | 2022-08-17 | GPAC mp4box 2.1-DEV-revUNKNOWN-master has a use-after-free vulnerability in function gf_isom_dovi_config_get. This vulnerability was fixed in commit fef6242. |
CVE-2022-36186 | High | 7.5 | 2022-08-17 | A Null Pointer dereference vulnerability exists in GPAC 2.1-DEV-revUNKNOWN-master via the function gf_filter_pid_set_property_full () at filter_core/filter_pid… |
CVE-2022-31262 | High | 7.8 | 2022-08-17 | An exploitable local privilege escalation vulnerability exists in GOG Galaxy 2.0.46. Due to insufficient folder permissions, an attacker can hijack the %Progra… |
CVE-2022-30262 | High | 7.8 | 2022-08-17 | The Emerson ControlWave 'Next Generation' RTUs through 2022-05-02 mishandle firmware integrity. They utilize the BSAP-IP protocol to transmit firmware updates… |
CVE-2022-2845 | High | 7.8 | 2022-08-17 | Improper Validation of Specified Quantity in Input in GitHub repository vim/vim prior to 9.0.0218. |
CVE-2022-37459 | High | 7.8 | 2022-08-17 | Ampere Altra devices before 1.08g and Ampere Altra Max devices before 2.05a allow attackers to control the predictions for return addresses and potentially hij… |
CVE-2022-2871 | Medium | 5.4 | 2022-08-17 | Cross-site Scripting (XSS) - Stored in GitHub repository notrinos/notrinoserp prior to 0.7. |
CVE-2022-1410 | High | 8.0 | 2022-08-17 | OS Command Injection vulnerability in the db_optimize component of Device42 Asset Management Appliance allows an authenticated attacker to execute remote code… |
CVE-2022-1401 | Medium | 6.9 | 2022-08-17 | Improper Access Control vulnerability in the /Exago/WrImageResource.adx route as used in Device42 Asset Management Appliance allows an unauthenticated attacker… |
CVE-2022-1400 | High | 7.1 | 2022-08-17 | Use of Hard-coded Cryptographic Key vulnerability in the WebReportsApi.dll of Exago Web Reports, as used in the Device42 Asset Management Appliance, allows an… |
CVE-2022-1399 | Critical | 9.1 | 2022-08-17 | An Argument Injection or Modification vulnerability in the "Change Secret" username field as used in the Discovery component of Device42 CMDB allows a local at… |
CVE-2022-25799 | Medium | 6.1 | 2022-08-16 | An open redirect vulnerability exists in CERT/CC VINCE software prior to 1.50.0. An attacker could send a link that has a specially crafted URL and convince th… |
CVE-2022-38238 | High | 7.8 | 2022-08-16 | XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::lookChar() at /xpdf/Stream.cc. |
CVE-2022-38237 | High | 7.8 | 2022-08-16 | XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::readScan() at /xpdf/Stream.cc. |
CVE-2022-38236 | High | 7.8 | 2022-08-16 | XPDF commit ffaf11c was discovered to contain a global-buffer overflow via Lexer::getObj(Object*) at /xpdf/Lexer.cc. |
CVE-2022-38235 | Medium | 5.5 | 2022-08-16 | XPDF commit ffaf11c was discovered to contain a segmentation violation via DCTStream::getChar() at /xpdf/Stream.cc. |