2022 CVEs (page 156)
Page 156 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-2831 | High | 7.5 | 2022-08-16 | A flaw was found in Blender 3.3.0. An interger overflow in source/blender/blendthumb/src/blendthumb_extract.cc may lead to program crash or memory corruption. |
CVE-2022-2662 | Critical | 9.6 | 2022-08-16 | Sequi PortBloque S has a improper authentication issues which may allow an attacker to bypass the authentication process and gain user-level access to the devi… |
CVE-2022-2661 | Critical | 9.9 | 2022-08-16 | Sequi PortBloque S has an improper authorization vulnerability, which may allow a low-privileged user to perform administrative functions using specifically cr… |
CVE-2022-37393 | High | 7.8 | 2022-08-16 | Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters. As part of its intended functionality, zms… |
CVE-2022-2847 | Medium | 6.3 | 2022-08-16 | A vulnerability, which was classified as critical, has been found in SourceCodester Guest Management System. This issue affects some unknown processing of the… |
CVE-2022-2846 | Medium | 4.3 | 2022-08-16 | The Calendar Event Multi View WordPress plugin before 1.4.07 does not have any authorisation and CSRF checks in place when creating an event, and is also lacki… |
CVE-2022-2844 | Low | 3.5 | 2022-08-16 | A vulnerability classified as problematic has been found in MotoPress Timetable and Event Schedule up to 1.4.06. This affects an unknown part of the file /wp/?… |
CVE-2022-2843 | Low | 3.5 | 2022-08-16 | A vulnerability was found in MotoPress Timetable and Event Schedule. It has been rated as problematic. Affected by this issue is some unknown functionality of… |
CVE-2022-38189 | Medium | 5.4 | 2022-08-16 | A stored Cross Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS may allow a remote, authenticated attacker to pass and store malicious strings via… |
CVE-2022-38184 | High | 7.5 | 2022-08-16 | There is an improper access control vulnerability in Portal for ArcGIS versions 10.8.1 and below which could allow a remote, unauthenticated attacker to access… |
CVE-2022-36242 | Critical | 9.8 | 2022-08-16 | Clinic's Patient Management System v1.0 is vulnerable to SQL Injection via /pms/update_medicine.php?id=. |
CVE-2022-30576 | High | 8.7 | 2022-08-16 | The Web Console component of TIBCO Software Inc.'s TIBCO Data Science - Workbench, TIBCO Statistica, TIBCO Statistica - Estore Edition, and TIBCO Statistica Tr… |
CVE-2022-30575 | High | 7.3 | 2022-08-16 | The Web Console component of TIBCO Software Inc.'s TIBCO Data Science - Workbench, TIBCO Statistica, TIBCO Statistica - Estore Edition, and TIBCO Statistica Tr… |
CVE-2022-38194 | Medium | 6.7 | 2022-08-16 | In Esri Portal for ArcGIS versions 10.8.1, a system property is not properly encrypted. This may lead to a local user reading sensitive information from a prop… |
CVE-2022-38193 | Medium | 6.1 | 2022-08-16 | There is a code injection vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below that may allow a remote, unauthenticated attacker to pass strings w… |
CVE-2022-38192 | Medium | 6.1 | 2022-08-16 | A stored Cross Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS may allow a remote, authenticated attacker to pass and store malicious strings via… |
CVE-2022-38362 | High | 8.8 | 2022-08-16 | Apache Airflow Docker's Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to (authenticated) remote code exploit of code on the Airflow w… |
CVE-2022-36599 | Critical | 9.8 | 2022-08-16 | Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/model/delete URI via models Lists. |
CVE-2022-36530 | Medium | 6.1 | 2022-08-16 | An issue was discovered in rageframe2 2.6.37. There is a XSS vulnerability in the user agent related parameters of the info.php page. |
CVE-2022-36273 | Critical | 9.8 | 2022-08-16 | Tenda AC9 V15.03.2.21_cn is vulnerable to command injection via goform/SetSysTimeCfg. |
CVE-2022-36272 | Critical | 9.8 | 2022-08-16 | Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/page/verify URI via fieldName parameter. |
CVE-2022-30264 | Critical | 9.8 | 2022-08-16 | The Emerson ROC and FloBoss RTU product lines through 2022-05-02 perform insecure filesystem operations. They utilize the ROC protocol (4000/TCP, 5000/TCP) for… |
CVE-2022-29959 | Medium | 5.5 | 2022-08-16 | Emerson OpenBSI through 2022-04-29 mishandles credential storage. It is an engineering environment for the ControlWave and Bristol Babcock line of RTUs. This e… |
CVE-2022-2838 | Medium | 5.3 | 2022-08-16 | In Eclipse Sphinx™ before version 0.13.1, Apache Xerces XML Parser was used without disabling processing of referenced external entities allowing the injection… |
CVE-2022-36381 | High | 7.2 | 2022-08-16 | OS command injection vulnerability in Nintendo Wi-Fi Network Adaptor WAP-001 All versions allows an attacker with an administrative privilege to execute arbitr… |
CVE-2022-36344 | Critical | 9.8 | 2022-08-16 | An unquoted search path vulnerability exists in 'JustSystems JUST Online Update for J-License' bundled with multiple products for corporate users as in Ichitar… |
CVE-2022-36293 | High | 7.2 | 2022-08-16 | Buffer overflow vulnerability in Nintendo Wi-Fi Network Adaptor WAP-001 All versions allows an attacker with an administrative privilege to execute arbitrary c… |
CVE-2022-35734 | High | 7.5 | 2022-08-16 | 'Hulu / フールー' App for Android from version 3.0.47 to the version prior to 3.1.2 uses a hard-coded API key for an external service. By exploiting this vulnerabi… |
CVE-2022-35239 | High | 8.8 | 2022-08-16 | The image file management page of SolarView Compact SV-CPT-MC310 Ver.7.23 and earlier, and SV-CPT-MC310F Ver.7.23 and earlier contains an insufficient verifica… |
CVE-2022-34156 | Medium | 4.8 | 2022-08-16 | 'Hulu / フールー' App for iOS versions prior to 3.0.81 improperly verifies server certificates, which may allow an attacker to eavesdrop on an encrypted communicat… |
CVE-2022-33939 | High | 7.5 | 2022-08-16 | CENTUM VP / CS 3000 controller FCS (CP31, CP33, CP345, CP401, and CP451) contains an issue in processing communication packets, which may lead to resource cons… |
CVE-2022-38216 | High | 7.5 | 2022-08-16 | An integer overflow exists in Mapbox's closed source gl-native library prior to version 10.6.1, which is bundled with multiple Mapbox products including open s… |
CVE-2022-36312 | High | 8.8 | 2022-08-16 | Airspan AirVelocity 1500 software version 15.18.00.2511 lacks CSRF protections in the eNodeB's web management UI. This issue may affect other AirVelocity and A… |
CVE-2022-36311 | Medium | 6.1 | 2022-08-16 | Airspan AirVelocity 1500 prior to software version 15.18.00.2511 is vulnerable to injection leading to XSS in the SNMP community field in the eNodeB's web mana… |
CVE-2022-36310 | High | 8.8 | 2022-08-16 | Airspan AirVelocity 1500 software prior to version 15.18.00.2511 had NET-SNMP-EXTEND-MIB enabled on its snmpd service, enabling an attacker with SNMP write abi… |
CVE-2022-36309 | High | 8.8 | 2022-08-16 | Airspan AirVelocity 1500 software versions prior to 15.18.00.2511 have a root command injection vulnerability in the ActiveBank parameter of the recoverySubmit… |
CVE-2022-36308 | Critical | 9.1 | 2022-08-16 | Airspan AirVelocity 1500 web management UI displays SNMP credentials in plaintext on software versions older than 15.18.00.2511, and stores SNMPv3 credentials… |
CVE-2022-36307 | Medium | 6.8 | 2022-08-16 | The AirVelocity 1500 prints SNMP credentials on its physically accessible serial port during boot. This was fixed in AirVelocity 1500 software version 15.18.00… |
CVE-2022-36306 | Medium | 6.5 | 2022-08-16 | An authenticated attacker can enumerate and download sensitive files, including the eNodeB's web management UI's TLS private key, the web server binary, and th… |
CVE-2022-24952 | Medium | 6.5 | 2022-08-16 | Several denial of service vulnerabilities exist in Eternal Terminal prior to version 6.2.0, including a DoS triggered remotely by an invalid sequence number an… |
CVE-2022-24951 | High | 7.0 | 2022-08-16 | A race condition exists in Eternal Terminal prior to version 6.2.0 which allows a local attacker to hijack Eternal Terminal's IPC socket, enabling access to Et… |
CVE-2022-24950 | High | 7.5 | 2022-08-16 | A race condition exists in Eternal Terminal prior to version 6.2.0 that allows an authenticated attacker to hijack other users' SSH authorization socket, enabl… |
CVE-2022-24949 | High | 7.5 | 2022-08-16 | A privilege escalation to root exists in Eternal Terminal prior to version 6.2.0. This is due to the combination of a race condition, buffer overflow, and logi… |
CVE-2022-38359 | High | 8.8 | 2022-08-15 | Cross-site request forgery attacks can be carried out against the Eyes of Network web application, due to an absence of adequate protections. An attacker can… |
CVE-2022-38358 | Medium | 6.1 | 2022-08-15 | Improper neutralization of input during web page generation leaves the Eyes of Network web application vulnerable to cross-site scripting attacks at /module/ad… |
CVE-2022-38357 | High | 8.8 | 2022-08-15 | Improper neutralization of special elements leaves the Eyes of Network Web application vulnerable to an iFrame injection attack, via the url parameter of /modu… |
CVE-2022-2817 | High | 7.8 | 2022-08-15 | Use After Free in GitHub repository vim/vim prior to 9.0.0213. |
CVE-2022-28756 | High | 8.8 | 2022-08-15 | The Zoom Client for Meetings for macOS (Standard and for IT Admin) starting with version 5.7.3 and before 5.11.5 contains a vulnerability in the auto update pr… |
CVE-2022-38368 | High | 8.8 | 2022-08-15 | An issue was discovered in Aviatrix Gateway before 6.6.5712 and 6.7.x before 6.7.1376. Because Gateway API functions mishandle authentication, an authenticated… |
CVE-2022-2816 | High | 7.8 | 2022-08-15 | Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.0212. |
CVE-2022-38191 | Medium | 6.1 | 2022-08-15 | There is an HTML injection issue in Esri Portal for ArcGIS versions 10.9.0 and below which may allow a remote, authenticated attacker to inject HTML into some… |
CVE-2022-38190 | Medium | 6.1 | 2022-08-15 | A stored Cross Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS configurable apps may allow a remote, unauthenticated attacker to pass and store ma… |
CVE-2022-38188 | Medium | 6.1 | 2022-08-15 | There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 which may allow a remote attacker able to convince a user to click on a crafte… |
CVE-2022-38187 | High | 7.5 | 2022-08-15 | Prior to version 10.9.0, the sharing/rest/content/features/analyze endpoint is always accessible to anonymous users, which could allow an unauthenticated attac… |
CVE-2022-38186 | Medium | 6.1 | 2022-08-15 | There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below which may allow a remote attacker able to convince a user to click o… |
CVE-2022-35822 | High | 7.1 | 2022-08-15 | Windows Defender Credential Guard Security Feature Bypass Vulnerability |
CVE-2022-34711 | High | 7.8 | 2022-08-15 | Windows Defender Credential Guard Elevation of Privilege Vulnerability |
CVE-2022-36010 | Critical | 10.0 | 2022-08-15 | This library allows strings to be parsed as functions and stored as a specialized component, [`JsonFunctionValue`](https://github.com/oxyno-zeta/react-editable… |
CVE-2022-35978 | High | 7.7 | 2022-08-15 | Minetest is a free open-source voxel game engine with easy modding and game creation. In **single player**, a mod can set a global setting that controls the Lu… |
CVE-2022-24654 | Medium | 5.4 | 2022-08-15 | Authenticated stored cross-site scripting (XSS) vulnerability in "Field Server Address" field in INTELBRAS ATA 200 Firmware 74.19.10.21 allows attackers to inj… |
CVE-2022-36526 | High | 7.5 | 2022-08-15 | D-Link GO-RT-AC750 GORTAC750_revA_v101b03 & GO-RT-AC750_revB_FWv200b02 is vulnerable to Authentication Bypass via function phpcgi_main in cgibin. |
CVE-2022-36525 | Critical | 9.8 | 2022-08-15 | D-Link Go-RT-AC750 GORTAC750_revA_v101b03 & GO-RT-AC750_revB_FWv200b02 is vulnerable to Buffer Overflow via authenticationcgi_main. |
CVE-2022-36524 | High | 7.5 | 2022-08-15 | D-Link GO-RT-AC750 GORTAC750_revA_v101b03 & GO-RT-AC750_revB_FWv200b02 is vulnerable to Static Default Credentials via /etc/init0.d/S80telnetd.sh. |
CVE-2022-36523 | Critical | 9.8 | 2022-08-15 | D-Link Go-RT-AC750 GORTAC750_revA_v101b03 & GO-RT-AC750_revB_FWv200b02 is vulnerable to command injection via /htdocs/upnpinc/gena.php. |
CVE-2022-35624 | High | 8.2 | 2022-08-15 | In Nordic nRF5 SDK for Mesh 5.0, a heap overflow vulnerability can be triggered by sending a series of segmented packets with SegO > SegN |
CVE-2022-35623 | High | 8.2 | 2022-08-15 | In Nordic nRF5 SDK for Mesh 5.0, a heap overflow vulnerability can be triggered by sending a series of segmented control packets and access packets with the sa… |
CVE-2022-2824 | High | 8.8 | 2022-08-15 | Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.1. |
CVE-2022-33991 | Medium | 5.3 | 2022-08-15 | dproxy-nexgen (aka dproxy nexgen) forwards and caches DNS queries with the CD (aka checking disabled) bit set to 1. This leads to disabling of DNSSEC protectio… |
CVE-2022-33990 | High | 7.5 | 2022-08-15 | Misinterpretation of special domain name characters in dproxy-nexgen (aka dproxy nexgen) leads to cache poisoning because domain names and their associated IP… |
CVE-2022-33989 | Medium | 5.3 | 2022-08-15 | dproxy-nexgen (aka dproxy nexgen) uses a static UDP source port (selected randomly only at boot time) in upstream queries sent to DNS resolvers. This allows DN… |
CVE-2022-33988 | High | 7.5 | 2022-08-15 | dproxy-nexgen (aka dproxy nexgen) re-uses the DNS transaction id (TXID) value from client queries, which allows attackers (able to send queries to the resolver… |
CVE-2022-36262 | Critical | 9.8 | 2022-08-15 | An issue was discovered in taocms 3.0.2. in the website settings that allows arbitrary php code to be injected by modifying config.php. |
CVE-2022-34294 | Critical | 9.8 | 2022-08-15 | totd 1.5.3 uses a fixed UDP source port in upstream queries sent to DNS resolvers. This allows DNS cache poisoning because there is not enough entropy to preve… |
CVE-2022-33993 | Medium | 5.3 | 2022-08-15 | Misinterpretation of special domain name characters in DNRD (aka Domain Name Relay Daemon) 2.20.3 leads to cache poisoning because domain names and their assoc… |
CVE-2022-33992 | High | 7.5 | 2022-08-15 | DNRD (aka Domain Name Relay Daemon) 2.20.3 forwards and caches DNS queries with the CD (aka checking disabled) bit set to 1. This leads to disabling of DNSSEC… |
CVE-2022-38223 | High | 7.8 | 2022-08-15 | There is an out-of-bounds write in checkType located in etc.c in w3m 0.5.3. It can be triggered by sending a crafted HTML file to the w3m binary. It allows an… |
CVE-2022-38221 | Critical | 9.8 | 2022-08-15 | A buffer overflow in the FTcpListener thread in The Isle Evrima (the dedicated server on Windows and Linux) 0.9.88.07 before 2022-08-12 allows a remote attacke… |
CVE-2022-37401 | High | 8.8 | 2022-08-15 | Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encrypted with a single… |
CVE-2022-37400 | High | 8.8 | 2022-08-15 | Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encrypted with a single… |
CVE-2022-36007 | Medium | 6.1 | 2022-08-15 | Venice is a Clojure inspired sandboxed Lisp dialect with excellent Java interoperability. A partial path traversal issue exists within the functions `load-file… |
CVE-2022-36006 | High | 7.9 | 2022-08-15 | Arvados is an open source platform for managing, processing, and sharing genomic and other large scientific and biomedical data. A remote code execution (RCE)… |
CVE-2022-35961 | High | 7.9 | 2022-08-15 | OpenZeppelin Contracts is a library for secure smart contract development. The functions `ECDSA.recover` and `ECDSA.tryRecover` are vulnerable to a kind of sig… |
CVE-2022-35954 | Medium | 5.0 | 2022-08-15 | The GitHub Actions ToolKit provides a set of packages to make creating actions easier. The `core.exportVariable` function uses a well known delimiter that atta… |
CVE-2022-35948 | Medium | 5.3 | 2022-08-15 | undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection_ on headers when using unsanitized inp… |
CVE-2022-2822 | High | 7.5 | 2022-08-15 | An attacker can freely brute force username and password and can takeover any account. An attacker could easily guess user passwords and gain access to user an… |
CVE-2022-2821 | High | 7.5 | 2022-08-15 | Missing Critical Step in Authentication in GitHub repository namelessmc/nameless prior to v2.0.2. |
CVE-2022-2820 | High | 7.0 | 2022-08-15 | Session Fixation in GitHub repository namelessmc/nameless prior to v2.0.2. |
CVE-2022-2819 | High | 7.8 | 2022-08-15 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0211. |
CVE-2022-2818 | Critical | 9.8 | 2022-08-15 | Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository cockpit-hq/cockpit prior to 2.2.2. |
CVE-2022-2814 | Low | 3.5 | 2022-08-15 | A vulnerability has been found in SourceCodester Simple and Nice Shopping Cart Script and classified as problematic. Affected by this vulnerability is an unkno… |
CVE-2022-2813 | Medium | 4.3 | 2022-08-15 | A vulnerability, which was classified as problematic, was found in SourceCodester Guest Management System. Affected is an unknown function. The manipulation le… |
CVE-2022-2812 | High | 7.3 | 2022-08-15 | A vulnerability classified as critical was found in SourceCodester Guest Management System. This vulnerability affects unknown code of the file index.php. The… |
CVE-2022-2811 | Low | 3.5 | 2022-08-15 | A vulnerability classified as problematic has been found in SourceCodester Guest Management System. This affects an unknown part of the file myform.php. The ma… |
CVE-2022-2535 | Medium | 5.3 | 2022-08-15 | The SearchWP Live Ajax Search WordPress plugin before 1.6.2 does not ensure that users making a live search are limited to published posts only, allowing unaut… |
CVE-2022-2384 | Medium | 4.8 | 2022-08-15 | The Digital Publications by Supsystic WordPress plugin before 1.7.4 does not sanitise and escape its settings, allowing high privilege users such as admin to p… |
CVE-2022-2381 | High | 8.8 | 2022-08-15 | The E Unlocked - Student Result WordPress plugin through 1.0.4 is lacking CSRF and validation when uploading the School logo, which could allow attackers to ma… |
CVE-2022-2379 | High | 7.5 | 2022-08-15 | The Easy Student Results WordPress plugin through 2.2.8 lacks authorisation in its REST API, allowing unauthenticated users to retrieve information related to… |
CVE-2022-2378 | Medium | 6.1 | 2022-08-15 | The Easy Student Results WordPress plugin through 2.2.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected… |
CVE-2022-2354 | High | 7.2 | 2022-08-15 | The WP-DBManager WordPress plugin before 2.80.8 does not prevent administrators from running arbitrary commands on the server in multisite installations, where… |
CVE-2022-2314 | Critical | 9.8 | 2022-08-15 | The VR Calendar WordPress plugin through 2.3.2 lets any user execute arbitrary PHP functions on the site. |