2022 CVEs (page 154)
Page 154 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-25999 | High | 7.8 | 2022-08-18 | Uncontrolled search path element in the Intel(R) Enpirion(R) Digital Power Configurator GUI software, all versions may allow an authenticated user to potential… |
CVE-2022-25966 | High | 7.8 | 2022-08-18 | Improper access control in the Intel(R) Edge Insights for Industrial software before version 2.6.1 may allow an authenticated user to potentially enable escala… |
CVE-2022-25899 | Critical | 9.8 | 2022-08-18 | Authentication bypass for the Open AMT Cloud Toolkit software maintained by Intel(R) before versions 2.0.2 and 2.2.2 may allow an unauthenticated user to poten… |
CVE-2022-25841 | High | 7.8 | 2022-08-18 | Uncontrolled search path elements in the Intel(R) Datacenter Group Event Android application, all versions, may allow an authenticated user to potentially enab… |
CVE-2022-25228 | Medium | 6.5 | 2022-08-18 | CandidATS Version 3.0.0 Beta allows an authenticated user to inject SQL queries in '/index.php?m=settings&a=show' via the 'userID' parameter, in '/index.php?m=… |
CVE-2022-24378 | Medium | 5.5 | 2022-08-18 | Improper initialization in the Intel(R) Data Center Manager software before version 4.1 may allow an authenticated user to potentially enable denial of service… |
CVE-2022-23403 | Medium | 5.5 | 2022-08-18 | Improper input validation in the Intel(R) Data Center Manager software before version 4.1 may allow an authenticated user to potentially enable denial of servi… |
CVE-2022-23182 | High | 8.8 | 2022-08-18 | Improper access control in the Intel(R) Data Center Manager software before version 4.1 may allow an unauthenticated user to potentially enable escalation of p… |
CVE-2022-22730 | Critical | 9.8 | 2022-08-18 | Improper authentication in the Intel(R) Edge Insights for Industrial software before version 2.6.1 may allow an unauthenticated user to potentially enable esca… |
CVE-2022-21812 | High | 7.8 | 2022-08-18 | Improper access control in the Intel(R) HAXM software before version 7.7.1 may allow an authenticated user to potentially enable escalation of privilege via lo… |
CVE-2022-21807 | High | 7.8 | 2022-08-18 | Uncontrolled search path elements in the Intel(R) VTune(TM) Profiler software before version 2022.2.0 may allow an authenticated user to potentially enable esc… |
CVE-2022-21793 | Medium | 5.5 | 2022-08-18 | Insufficient control flow management in the Intel(R) Ethernet 500 Series Controller drivers for VMWare before version 1.11.4.0 and in the Intel(R) Ethernet 700… |
CVE-2022-21240 | Medium | 4.4 | 2022-08-18 | Out of bounds read for some Intel(R) PROSet/Wireless WiFi products may allow a privileged user to potentially enable information disclosure via local access. |
CVE-2022-21233 | Medium | 5.5 | 2022-08-18 | Improper isolation of shared resources in some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access. |
CVE-2022-21229 | High | 7.8 | 2022-08-18 | Improper buffer restrictions for some Intel(R) NUC 9 Extreme Laptop Kit drivers before version 2.2.0.22 may allow an authenticated user to potentially enable e… |
CVE-2022-21225 | High | 8.0 | 2022-08-18 | Improper neutralization in the Intel(R) Data Center Manager software before version 4.1 may allow an authenticated user to potentially enable escalation of pri… |
CVE-2022-21212 | Medium | 6.5 | 2022-08-18 | Improper input validation for some Intel(R) PROSet/Wireless WiFi products may allow an unauthenticated user to potentially enable denial of service via adjacen… |
CVE-2022-21197 | High | 7.5 | 2022-08-18 | Improper input validation for some Intel(R) PROSet/Wireless WiFi products may allow an unauthenticated user to potentially enable denial of service via network… |
CVE-2022-21181 | High | 7.8 | 2022-08-18 | Improper input validation for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enable escalation of p… |
CVE-2022-21172 | Medium | 6.7 | 2022-08-18 | Out of bounds write for some Intel(R) PROSet/Wireless WiFi products may allow a privileged user to potentially enable escalation of privilege via local access. |
CVE-2022-21160 | High | 7.5 | 2022-08-18 | Improper buffer restrictions for some Intel(R) PROSet/Wireless WiFi products may allow an unauthenticated user to potentially enable denial of service via netw… |
CVE-2022-21152 | Medium | 5.5 | 2022-08-18 | Improper access control in the Intel(R) Edge Insights for Industrial software before version 2.6.1 may allow an authenticated user to potentially enable inform… |
CVE-2022-21148 | High | 7.8 | 2022-08-18 | Improper access control in the Intel(R) Edge Insights for Industrial software before version 2.6.1 may allow an authenticated user to potentially enable escala… |
CVE-2022-21140 | Medium | 5.5 | 2022-08-18 | Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enable information discl… |
CVE-2022-21139 | High | 8.8 | 2022-08-18 | Inadequate encryption strength for some Intel(R) PROSet/Wireless WiFi products may allow an unauthenticated user to potentially enable escalation of privilege… |
CVE-2022-37422 | High | 7.5 | 2022-08-18 | Payara through 5.2022.2 allows directory traversal without authentication. This affects Payara Server, Payara Micro, and Payara Server Embedded. |
CVE-2022-35976 | Medium | 5.2 | 2022-08-18 | The GitOps Tools Extension for VSCode relies on kubeconfigs in order to communicate with Kubernetes clusters. A specially crafted kubeconfig leads to arbitrary… |
CVE-2022-35204 | Medium | 4.3 | 2022-08-18 | Vitejs Vite before v2.9.13 was discovered to allow attackers to perform a directory traversal via a crafted URL to the victim's service. |
CVE-2022-2625 | High | 8.0 | 2022-08-18 | A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait fo… |
CVE-2022-37063 | Medium | 5.4 | 2022-08-18 | All FLIR AX8 thermal sensor cameras versions up to and including 1.46.16 are vulnerable to Cross Site Scripting (XSS) due to improper input sanitization. An au… |
CVE-2022-37062 | High | 7.5 | 2022-08-18 | All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are affected by an insecure design vulnerability due to an improper directory access re… |
CVE-2022-37061 | Critical | 9.8 | 2022-08-18 | All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to Remote Command Injection. This can be exploited to inject and execute… |
CVE-2022-35975 | Critical | 9.0 | 2022-08-18 | The GitOps Tools Extension for VSCode can make it easier to manage Flux objects. A specially crafted Flux object may allow for remote code execution in the mac… |
CVE-2022-35175 | Critical | 9.8 | 2022-08-18 | Barangay Management System v1.0 was discovered to contain a SQL injection vulnerability via the hidden_id parameter at /blotter/blotter.php. |
CVE-2022-35174 | Medium | 5.4 | 2022-08-18 | A stored cross-site scripting (XSS) vulnerability in Kirby's Starterkit v3.7.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payloa… |
CVE-2022-37060 | High | 7.5 | 2022-08-18 | FLIR AX8 thermal sensor cameras version up to and including 1.46.16 is vulnerable to Directory Traversal due to an improper access restriction. An unauthentica… |
CVE-2022-36023 | High | 7.0 | 2022-08-18 | Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. If a gateway client application… |
CVE-2022-2874 | Medium | 5.5 | 2022-08-18 | NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0224. |
CVE-2022-36024 | High | 7.5 | 2022-08-18 | py-cord is a an API wrapper for Discord written in Python. Bots creating using py-cord version 2.0.0 are vulnerable to remote shutdown if they are added to the… |
CVE-2022-37025 | High | 7.8 | 2022-08-18 | An improper privilege management vulnerability in McAfee Security Scan Plus (MSS+) before 4.1.262.1 could allow a local user to modify a configuration file and… |
CVE-2022-29550 | Medium | 5.5 | 2022-08-18 | An issue was discovered in Qualys Cloud Agent 4.8.0-49. It writes "ps auxwwe" output to the /var/log/qualys/qualys-cloud-agent-scan.log file. This may, for exa… |
CVE-2022-29549 | High | 7.3 | 2022-08-18 | An issue was discovered in Qualys Cloud Agent 4.8.0-49. It executes programs at various full pathnames without first making ownership and permission checks (e… |
CVE-2022-33311 | Medium | 4.3 | 2022-08-18 | Browse restriction bypass vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to obtain the data of Address… |
CVE-2022-33151 | Medium | 6.1 | 2022-08-18 | Cross-site scripting vulnerability in the specific parameters of Cybozu Office 10.0.0 to 10.8.5 allows remote attackers to inject an arbitrary script via unspe… |
CVE-2022-32583 | Medium | 4.3 | 2022-08-18 | Operation restriction bypass vulnerability in Scheduler of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to alter the data of Scheduler… |
CVE-2022-32544 | Medium | 4.3 | 2022-08-18 | Operation restriction bypass vulnerability in Project of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to alter the data of Project via… |
CVE-2022-32453 | Medium | 6.5 | 2022-08-18 | HTTP header injection vulnerability in Cybozu Office 10.0.0 to 10.8.5 may allow a remote attacker to obtain and/or alter the data of the product via unspecifie… |
CVE-2022-32283 | Medium | 4.3 | 2022-08-18 | Browse restriction bypass vulnerability in Cabinet of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to obtain the data of Cabinet via u… |
CVE-2022-30693 | Medium | 5.3 | 2022-08-18 | Information disclosure vulnerability in the system configuration of Cybozu Office 10.0.0 to 10.8.5 allows a remote attacker to obtain the data of the product v… |
CVE-2022-30604 | Medium | 6.1 | 2022-08-18 | Cross-site scripting vulnerability in the specific parameters of Cybozu Office 10.0.0 to 10.8.5 allows a remote attacker to inject an arbitrary script via unsp… |
CVE-2022-2876 | Medium | 6.3 | 2022-08-18 | A vulnerability, which was classified as critical, was found in SourceCodester Student Management System. Affected is an unknown function of the file index.php… |
CVE-2022-29891 | Medium | 4.3 | 2022-08-18 | Browse restriction bypass vulnerability in Custom Ap of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to obtain the data of Custom App… |
CVE-2022-29487 | Medium | 6.1 | 2022-08-18 | Cross-site scripting vulnerability in Cybozu Office 10.0.0 to 10.8.5 allows a remote attacker to inject an arbitrary script via unspecified vectors. |
CVE-2022-28715 | Medium | 6.1 | 2022-08-18 | Cross-site scripting vulnerability in the specific parameters of Cybozu Office 10.0.0 to 10.8.5 allows a remote attacker to inject an arbitrary script via unsp… |
CVE-2022-25986 | Medium | 4.3 | 2022-08-18 | Browse restriction bypass vulnerability in Scheduler of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to obtain the data of Scheduler. |
CVE-2022-35198 | High | 7.5 | 2022-08-18 | Contract Management System v2.0 contains a weak default password which gives attackers to access database connection information. |
CVE-2022-35173 | High | 7.5 | 2022-08-18 | An issue was discovered in Nginx NJS v0.7.5. The JUMP offset for a break instruction was not set to a correct offset during code generation, leading to a segme… |
CVE-2022-35166 | Medium | 5.5 | 2022-08-18 | libjpeg commit 842c7ba was discovered to contain an infinite loop via the component JPEG::ReadInternal. |
CVE-2022-35165 | Medium | 5.5 | 2022-08-18 | An issue in AP4_SgpdAtom::AP4_SgpdAtom() of Bento4-1.6.0-639 allows attackers to cause a Denial of Service (DoS) via a crafted mp4 input. |
CVE-2022-35164 | Critical | 9.8 | 2022-08-18 | LibreDWG v0.12.4.4608 & commit f2dea29 was discovered to contain a heap use-after-free via bit_copy_chain. |
CVE-2022-35154 | Critical | 9.8 | 2022-08-18 | Shopro Mall System v1.3.8 was discovered to contain a SQL injection vulnerability via the value parameter. |
CVE-2022-35153 | Critical | 9.8 | 2022-08-18 | FusionPBX 5.0.1 was discovered to contain a command injection vulnerability via /fax/fax_send.php. |
CVE-2022-35606 | Critical | 9.8 | 2022-08-18 | A SQL injection vulnerability in CustomerDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via the paramete… |
CVE-2022-35605 | Critical | 9.8 | 2022-08-18 | A SQL injection vulnerability in UserDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via the parameters s… |
CVE-2022-35603 | Critical | 9.8 | 2022-08-18 | A SQL injection vulnerability in CustomerDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via parameter se… |
CVE-2022-35602 | Critical | 9.8 | 2022-08-18 | A SQL injection vulnerability in UserDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via parameter user. |
CVE-2022-35601 | Critical | 9.8 | 2022-08-18 | A SQL injection vulnerability in SupplierDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via parameter se… |
CVE-2022-35599 | Critical | 9.8 | 2022-08-18 | A SQL injection vulnerability in Stocks.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via parameter product… |
CVE-2022-35598 | Critical | 9.8 | 2022-08-18 | A SQL injection vulnerability in ConnectionFactoryDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via par… |
CVE-2022-35151 | Medium | 6.1 | 2022-08-17 | kkFileView v4.1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the urls and currentUrl parameters at /controller/OnlinePre… |
CVE-2022-2869 | Medium | 5.5 | 2022-08-17 | libtiff's tiffcrop tool has a uint32_t underflow which leads to out of bounds read and write in the extractContigSamples8bits routine. An attacker who supplies… |
CVE-2022-2868 | Medium | 5.5 | 2022-08-17 | libtiff's tiffcrop utility has a improper input validation flaw that can lead to out of bounds read and ultimately cause a crash if an attacker is able to supp… |
CVE-2022-2867 | Medium | 5.5 | 2022-08-17 | libtiff's tiffcrop utility has a uint32_t underflow that can lead to out of bounds read and write. An attacker who supplies a crafted file to tiffcrop (likely… |
CVE-2022-28752 | High | 8.8 | 2022-08-17 | Zoom Rooms for Conference Rooms for Windows versions before 5.11.0 are susceptible to a Local Privilege Escalation vulnerability. A local low-privileged malici… |
CVE-2022-28751 | High | 8.8 | 2022-08-17 | The Zoom Client for Meetings for MacOS (Standard and for IT Admin) before version 5.11.3 contains a vulnerability in the package signature validation during th… |
CVE-2022-35148 | Medium | 6.5 | 2022-08-17 | maccms10 v2021.1000.1081 to v2022.1000.3031 was discovered to contain a SQL injection vulnerability via the table parameter at database/columns.html. |
CVE-2022-35147 | Critical | 9.8 | 2022-08-17 | DoraCMS v2.18 and earlier allows attackers to bypass login authentication via a crafted HTTP request. |
CVE-2022-35133 | Medium | 6.1 | 2022-08-17 | A cross-site scripting (XSS) vulnerability in CherryTree v0.99.30 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into… |
CVE-2022-35122 | Critical | 9.1 | 2022-08-17 | An access control issue in Ecowitt GW1100 Series Weather Stations <=GW1100B_v2.1.5 allows unauthenticated attackers to access sensitive information including d… |
CVE-2022-2547 | High | 7.5 | 2022-08-17 | A crafted HTTP packet without a content-type header can create a denial-of-service condition in Softing Secure Integration Server V1.22. |
CVE-2022-2338 | Medium | 5.7 | 2022-08-17 | Softing Secure Integration Server V1.22 is vulnerable to authentication bypass via a machine-in-the-middle attack. The default the administration interface is… |
CVE-2022-2337 | High | 7.5 | 2022-08-17 | A crafted HTTP packet with a missing HTTP URI can create a denial-of-service condition in Softing Secure Integration Server V1.22. |
CVE-2022-2336 | Critical | 9.8 | 2022-08-17 | Softing Secure Integration Server, edgeConnector, and edgeAggregator software ships with the default administrator credentials as `admin` and password as `admi… |
CVE-2022-2335 | High | 7.5 | 2022-08-17 | A crafted HTTP packet with a -1 content-length header can create a denial-of-service condition in Softing Secure Integration Server V1.22. |
CVE-2022-2334 | High | 7.2 | 2022-08-17 | The application searches for a library dll that is not found. If an attacker can place a dll with this name, then the attacker can leverage it to execute arbit… |
CVE-2022-23765 | High | 8.0 | 2022-08-17 | This vulnerability occured by sending a malicious POST request to a specific page while logged in random user from some family of IPTIME NAS. Remote attackers… |
CVE-2022-23764 | High | 8.8 | 2022-08-17 | The vulnerability causing from insufficient verification procedures for downloaded files during WebCube update. Remote attackers can bypass this verification l… |
CVE-2022-23747 | Critical | 9.8 | 2022-08-17 | In Sony Xperia series 1, 5, and Pro, an out of bound memory access can occur due to lack of validation of the number of frames being passed during music playba… |
CVE-2022-1748 | High | 7.5 | 2022-08-17 | Softing OPC UA C++ Server SDK, Secure Integration Server, edgeConnector, edgeAggregator, OPC Suite, and uaGate are affected by a NULL pointer dereference vulne… |
CVE-2022-1373 | High | 7.2 | 2022-08-17 | The “restore configuration” feature of Softing Secure Integration Server V1.22 is vulnerable to a directory traversal vulnerability when processing zip files… |
CVE-2022-1069 | High | 7.5 | 2022-08-17 | A crafted HTTP packet with a large content-length header can create a denial-of-service condition in Softing Secure Integration Server V1.22. |
CVE-2022-36216 | High | 7.2 | 2022-08-17 | DedeCMS v5.7.94 - v5.7.97 was discovered to contain a remote code execution vulnerability in member_toadmin.php. |
CVE-2022-36215 | High | 7.2 | 2022-08-17 | DedeBIZ v6 was discovered to contain a remote code execution vulnerability in sys_info.php. |
CVE-2022-35516 | Critical | 9.8 | 2022-08-17 | DedeCMS v5.7.93 - v5.7.96 was discovered to contain a remote code execution vulnerability in login.php. |
CVE-2022-35121 | Critical | 9.8 | 2022-08-17 | Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/BookServiceImpl.java. |
CVE-2022-2862 | High | 7.8 | 2022-08-17 | Use After Free in GitHub repository vim/vim prior to 9.0.0221. |
CVE-2022-2870 | Medium | 4.1 | 2022-08-17 | A vulnerability was found in laravel 5.1 and classified as problematic. This issue affects some unknown processing. The manipulation leads to deserialization… |
CVE-2022-38392 | Medium | 5.3 | 2022-08-17 | Certain 5400 RPM hard drives, for laptops and other PCs in approximately 2005 and later, allow physically proximate attackers to cause a denial of service (dev… |
CVE-2022-35117 | Medium | 4.8 | 2022-08-17 | Clinic's Patient Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via update_medicine_details.php. This vulnerabilit… |
CVE-2022-2849 | High | 7.8 | 2022-08-17 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0220. |