2022 CVEs (page 156)
Page 156 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-35010 | Medium | 6.5 | 2022-08-16 | PNGDec commit 8abf6be was discovered to contain a heap buffer overflow via asan_interceptors_memintrinsics.cpp. |
CVE-2022-35009 | Medium | 6.5 | 2022-08-16 | PNGDec commit 8abf6be was discovered to contain a memory allocation problem via asan_malloc_linux.cpp. |
CVE-2022-35008 | Medium | 6.5 | 2022-08-16 | PNGDec commit 8abf6be was discovered to contain a stack overflow via /linux/main.cpp. |
CVE-2022-35007 | Medium | 6.5 | 2022-08-16 | PNGDec commit 8abf6be was discovered to contain a heap buffer overflow via __interceptor_fwrite.part.57 at sanitizer_common_interceptors.inc. |
CVE-2022-35004 | Medium | 5.5 | 2022-08-16 | JPEGDEC commit be4843c was discovered to contain a FPE via TIFFSHORT at /src/jpeg.inl. |
CVE-2022-35003 | High | 7.8 | 2022-08-16 | JPEGDEC commit be4843c was discovered to contain a global buffer overflow via ucDitherBuffer at /src/jpeg.inl. |
CVE-2022-35002 | Medium | 5.5 | 2022-08-16 | JPEGDEC commit be4843c was discovered to contain a segmentation fault via TIFFSHORT at /src/jpeg.inl. |
CVE-2022-35000 | Medium | 5.5 | 2022-08-16 | JPEGDEC commit be4843c was discovered to contain a segmentation fault via fseek at /libio/fseek.c. |
CVE-2022-34999 | Medium | 5.5 | 2022-08-16 | JPEGDEC commit be4843c was discovered to contain a FPE via DecodeJPEG at /src/jpeg.inl. |
CVE-2022-34998 | High | 7.8 | 2022-08-16 | JPEGDEC commit be4843c was discovered to contain a global buffer overflow via JPEGDecodeMCU at /src/jpeg.inl. |
CVE-2022-34259 | Medium | 5.3 | 2022-08-16 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that co… |
CVE-2022-34258 | Medium | 4.8 | 2022-08-16 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerabilit… |
CVE-2022-34257 | Medium | 6.1 | 2022-08-16 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerabilit… |
CVE-2022-34256 | High | 7.5 | 2022-08-16 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Authorization vulnerability that cou… |
CVE-2022-34255 | High | 8.8 | 2022-08-16 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that co… |
CVE-2022-34254 | High | 8.8 | 2022-08-16 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restri… |
CVE-2022-34253 | High | 7.2 | 2022-08-16 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an XML Injection vulnerability in the Widgets Mo… |
CVE-2022-2833 | High | 7.5 | 2022-08-16 | Endless Infinite loop in Blender-thumnailing due to logical bugs. |
CVE-2022-2832 | High | 7.5 | 2022-08-16 | A flaw was found in Blender 3.3.0. A null pointer dereference exists in source/blender/gpu/opengl/gl_backend.cc that may lead to loss of confidentiality and in… |
CVE-2022-2831 | High | 7.5 | 2022-08-16 | A flaw was found in Blender 3.3.0. An interger overflow in source/blender/blendthumb/src/blendthumb_extract.cc may lead to program crash or memory corruption. |
CVE-2022-2662 | Critical | 9.6 | 2022-08-16 | Sequi PortBloque S has a improper authentication issues which may allow an attacker to bypass the authentication process and gain user-level access to the devi… |
CVE-2022-2661 | Critical | 9.9 | 2022-08-16 | Sequi PortBloque S has an improper authorization vulnerability, which may allow a low-privileged user to perform administrative functions using specifically cr… |
CVE-2022-37393 | High | 7.8 | 2022-08-16 | Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters. As part of its intended functionality, zms… |
CVE-2022-2847 | Medium | 6.3 | 2022-08-16 | A vulnerability, which was classified as critical, has been found in SourceCodester Guest Management System. This issue affects some unknown processing of the… |
CVE-2022-2846 | Medium | 4.3 | 2022-08-16 | The Calendar Event Multi View WordPress plugin before 1.4.07 does not have any authorisation and CSRF checks in place when creating an event, and is also lacki… |
CVE-2022-2844 | Low | 3.5 | 2022-08-16 | A vulnerability classified as problematic has been found in MotoPress Timetable and Event Schedule up to 1.4.06. This affects an unknown part of the file /wp/?… |
CVE-2022-2843 | Low | 3.5 | 2022-08-16 | A vulnerability was found in MotoPress Timetable and Event Schedule. It has been rated as problematic. Affected by this issue is some unknown functionality of… |
CVE-2022-38189 | Medium | 5.4 | 2022-08-16 | A stored Cross Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS may allow a remote, authenticated attacker to pass and store malicious strings via… |
CVE-2022-38184 | High | 7.5 | 2022-08-16 | There is an improper access control vulnerability in Portal for ArcGIS versions 10.8.1 and below which could allow a remote, unauthenticated attacker to access… |
CVE-2022-36242 | Critical | 9.8 | 2022-08-16 | Clinic's Patient Management System v1.0 is vulnerable to SQL Injection via /pms/update_medicine.php?id=. |
CVE-2022-30576 | High | 8.7 | 2022-08-16 | The Web Console component of TIBCO Software Inc.'s TIBCO Data Science - Workbench, TIBCO Statistica, TIBCO Statistica - Estore Edition, and TIBCO Statistica Tr… |
CVE-2022-30575 | High | 7.3 | 2022-08-16 | The Web Console component of TIBCO Software Inc.'s TIBCO Data Science - Workbench, TIBCO Statistica, TIBCO Statistica - Estore Edition, and TIBCO Statistica Tr… |
CVE-2022-38194 | Medium | 6.7 | 2022-08-16 | In Esri Portal for ArcGIS versions 10.8.1, a system property is not properly encrypted. This may lead to a local user reading sensitive information from a prop… |
CVE-2022-38193 | Medium | 6.1 | 2022-08-16 | There is a code injection vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below that may allow a remote, unauthenticated attacker to pass strings w… |
CVE-2022-38192 | Medium | 6.1 | 2022-08-16 | A stored Cross Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS may allow a remote, authenticated attacker to pass and store malicious strings via… |
CVE-2022-38362 | High | 8.8 | 2022-08-16 | Apache Airflow Docker's Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to (authenticated) remote code exploit of code on the Airflow w… |
CVE-2022-36599 | Critical | 9.8 | 2022-08-16 | Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/model/delete URI via models Lists. |
CVE-2022-36530 | Medium | 6.1 | 2022-08-16 | An issue was discovered in rageframe2 2.6.37. There is a XSS vulnerability in the user agent related parameters of the info.php page. |
CVE-2022-36273 | Critical | 9.8 | 2022-08-16 | Tenda AC9 V15.03.2.21_cn is vulnerable to command injection via goform/SetSysTimeCfg. |
CVE-2022-36272 | Critical | 9.8 | 2022-08-16 | Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/page/verify URI via fieldName parameter. |
CVE-2022-30264 | Critical | 9.8 | 2022-08-16 | The Emerson ROC and FloBoss RTU product lines through 2022-05-02 perform insecure filesystem operations. They utilize the ROC protocol (4000/TCP, 5000/TCP) for… |
CVE-2022-29959 | Medium | 5.5 | 2022-08-16 | Emerson OpenBSI through 2022-04-29 mishandles credential storage. It is an engineering environment for the ControlWave and Bristol Babcock line of RTUs. This e… |
CVE-2022-2838 | Medium | 5.3 | 2022-08-16 | In Eclipse Sphinx™ before version 0.13.1, Apache Xerces XML Parser was used without disabling processing of referenced external entities allowing the injection… |
CVE-2022-36381 | High | 7.2 | 2022-08-16 | OS command injection vulnerability in Nintendo Wi-Fi Network Adaptor WAP-001 All versions allows an attacker with an administrative privilege to execute arbitr… |
CVE-2022-36344 | Critical | 9.8 | 2022-08-16 | An unquoted search path vulnerability exists in 'JustSystems JUST Online Update for J-License' bundled with multiple products for corporate users as in Ichitar… |
CVE-2022-36293 | High | 7.2 | 2022-08-16 | Buffer overflow vulnerability in Nintendo Wi-Fi Network Adaptor WAP-001 All versions allows an attacker with an administrative privilege to execute arbitrary c… |
CVE-2022-35734 | High | 7.5 | 2022-08-16 | 'Hulu / フールー' App for Android from version 3.0.47 to the version prior to 3.1.2 uses a hard-coded API key for an external service. By exploiting this vulnerabi… |
CVE-2022-35239 | High | 8.8 | 2022-08-16 | The image file management page of SolarView Compact SV-CPT-MC310 Ver.7.23 and earlier, and SV-CPT-MC310F Ver.7.23 and earlier contains an insufficient verifica… |
CVE-2022-34156 | Medium | 4.8 | 2022-08-16 | 'Hulu / フールー' App for iOS versions prior to 3.0.81 improperly verifies server certificates, which may allow an attacker to eavesdrop on an encrypted communicat… |
CVE-2022-33939 | High | 7.5 | 2022-08-16 | CENTUM VP / CS 3000 controller FCS (CP31, CP33, CP345, CP401, and CP451) contains an issue in processing communication packets, which may lead to resource cons… |
CVE-2022-38216 | High | 7.5 | 2022-08-16 | An integer overflow exists in Mapbox's closed source gl-native library prior to version 10.6.1, which is bundled with multiple Mapbox products including open s… |
CVE-2022-36312 | High | 8.8 | 2022-08-16 | Airspan AirVelocity 1500 software version 15.18.00.2511 lacks CSRF protections in the eNodeB's web management UI. This issue may affect other AirVelocity and A… |
CVE-2022-36311 | Medium | 6.1 | 2022-08-16 | Airspan AirVelocity 1500 prior to software version 15.18.00.2511 is vulnerable to injection leading to XSS in the SNMP community field in the eNodeB's web mana… |
CVE-2022-36310 | High | 8.8 | 2022-08-16 | Airspan AirVelocity 1500 software prior to version 15.18.00.2511 had NET-SNMP-EXTEND-MIB enabled on its snmpd service, enabling an attacker with SNMP write abi… |
CVE-2022-36309 | High | 8.8 | 2022-08-16 | Airspan AirVelocity 1500 software versions prior to 15.18.00.2511 have a root command injection vulnerability in the ActiveBank parameter of the recoverySubmit… |
CVE-2022-36308 | Critical | 9.1 | 2022-08-16 | Airspan AirVelocity 1500 web management UI displays SNMP credentials in plaintext on software versions older than 15.18.00.2511, and stores SNMPv3 credentials… |
CVE-2022-36307 | Medium | 6.8 | 2022-08-16 | The AirVelocity 1500 prints SNMP credentials on its physically accessible serial port during boot. This was fixed in AirVelocity 1500 software version 15.18.00… |
CVE-2022-36306 | Medium | 6.5 | 2022-08-16 | An authenticated attacker can enumerate and download sensitive files, including the eNodeB's web management UI's TLS private key, the web server binary, and th… |
CVE-2022-24952 | Medium | 6.5 | 2022-08-16 | Several denial of service vulnerabilities exist in Eternal Terminal prior to version 6.2.0, including a DoS triggered remotely by an invalid sequence number an… |
CVE-2022-24951 | High | 7.0 | 2022-08-16 | A race condition exists in Eternal Terminal prior to version 6.2.0 which allows a local attacker to hijack Eternal Terminal's IPC socket, enabling access to Et… |
CVE-2022-24950 | High | 7.5 | 2022-08-16 | A race condition exists in Eternal Terminal prior to version 6.2.0 that allows an authenticated attacker to hijack other users' SSH authorization socket, enabl… |
CVE-2022-24949 | High | 7.5 | 2022-08-16 | A privilege escalation to root exists in Eternal Terminal prior to version 6.2.0. This is due to the combination of a race condition, buffer overflow, and logi… |
CVE-2022-38359 | High | 8.8 | 2022-08-15 | Cross-site request forgery attacks can be carried out against the Eyes of Network web application, due to an absence of adequate protections. An attacker can… |
CVE-2022-38358 | Medium | 6.1 | 2022-08-15 | Improper neutralization of input during web page generation leaves the Eyes of Network web application vulnerable to cross-site scripting attacks at /module/ad… |
CVE-2022-38357 | High | 8.8 | 2022-08-15 | Improper neutralization of special elements leaves the Eyes of Network Web application vulnerable to an iFrame injection attack, via the url parameter of /modu… |
CVE-2022-2817 | High | 7.8 | 2022-08-15 | Use After Free in GitHub repository vim/vim prior to 9.0.0213. |
CVE-2022-28756 | High | 8.8 | 2022-08-15 | The Zoom Client for Meetings for macOS (Standard and for IT Admin) starting with version 5.7.3 and before 5.11.5 contains a vulnerability in the auto update pr… |
CVE-2022-38368 | High | 8.8 | 2022-08-15 | An issue was discovered in Aviatrix Gateway before 6.6.5712 and 6.7.x before 6.7.1376. Because Gateway API functions mishandle authentication, an authenticated… |
CVE-2022-2816 | High | 7.8 | 2022-08-15 | Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.0212. |
CVE-2022-38191 | Medium | 6.1 | 2022-08-15 | There is an HTML injection issue in Esri Portal for ArcGIS versions 10.9.0 and below which may allow a remote, authenticated attacker to inject HTML into some… |
CVE-2022-38190 | Medium | 6.1 | 2022-08-15 | A stored Cross Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS configurable apps may allow a remote, unauthenticated attacker to pass and store ma… |
CVE-2022-38188 | Medium | 6.1 | 2022-08-15 | There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 which may allow a remote attacker able to convince a user to click on a crafte… |
CVE-2022-38187 | High | 7.5 | 2022-08-15 | Prior to version 10.9.0, the sharing/rest/content/features/analyze endpoint is always accessible to anonymous users, which could allow an unauthenticated attac… |
CVE-2022-38186 | Medium | 6.1 | 2022-08-15 | There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below which may allow a remote attacker able to convince a user to click o… |
CVE-2022-35822 | High | 7.1 | 2022-08-15 | Windows Defender Credential Guard Security Feature Bypass Vulnerability |
CVE-2022-34711 | High | 7.8 | 2022-08-15 | Windows Defender Credential Guard Elevation of Privilege Vulnerability |
CVE-2022-36010 | Critical | 10.0 | 2022-08-15 | This library allows strings to be parsed as functions and stored as a specialized component, [`JsonFunctionValue`](https://github.com/oxyno-zeta/react-editable… |
CVE-2022-35978 | High | 7.7 | 2022-08-15 | Minetest is a free open-source voxel game engine with easy modding and game creation. In **single player**, a mod can set a global setting that controls the Lu… |
CVE-2022-24654 | Medium | 5.4 | 2022-08-15 | Authenticated stored cross-site scripting (XSS) vulnerability in "Field Server Address" field in INTELBRAS ATA 200 Firmware 74.19.10.21 allows attackers to inj… |
CVE-2022-36526 | High | 7.5 | 2022-08-15 | D-Link GO-RT-AC750 GORTAC750_revA_v101b03 & GO-RT-AC750_revB_FWv200b02 is vulnerable to Authentication Bypass via function phpcgi_main in cgibin. |
CVE-2022-36525 | Critical | 9.8 | 2022-08-15 | D-Link Go-RT-AC750 GORTAC750_revA_v101b03 & GO-RT-AC750_revB_FWv200b02 is vulnerable to Buffer Overflow via authenticationcgi_main. |
CVE-2022-36524 | High | 7.5 | 2022-08-15 | D-Link GO-RT-AC750 GORTAC750_revA_v101b03 & GO-RT-AC750_revB_FWv200b02 is vulnerable to Static Default Credentials via /etc/init0.d/S80telnetd.sh. |
CVE-2022-36523 | Critical | 9.8 | 2022-08-15 | D-Link Go-RT-AC750 GORTAC750_revA_v101b03 & GO-RT-AC750_revB_FWv200b02 is vulnerable to command injection via /htdocs/upnpinc/gena.php. |
CVE-2022-35624 | High | 8.2 | 2022-08-15 | In Nordic nRF5 SDK for Mesh 5.0, a heap overflow vulnerability can be triggered by sending a series of segmented packets with SegO > SegN |
CVE-2022-35623 | High | 8.2 | 2022-08-15 | In Nordic nRF5 SDK for Mesh 5.0, a heap overflow vulnerability can be triggered by sending a series of segmented control packets and access packets with the sa… |
CVE-2022-2824 | High | 8.8 | 2022-08-15 | Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.1. |
CVE-2022-33991 | Medium | 5.3 | 2022-08-15 | dproxy-nexgen (aka dproxy nexgen) forwards and caches DNS queries with the CD (aka checking disabled) bit set to 1. This leads to disabling of DNSSEC protectio… |
CVE-2022-33990 | High | 7.5 | 2022-08-15 | Misinterpretation of special domain name characters in dproxy-nexgen (aka dproxy nexgen) leads to cache poisoning because domain names and their associated IP… |
CVE-2022-33989 | Medium | 5.3 | 2022-08-15 | dproxy-nexgen (aka dproxy nexgen) uses a static UDP source port (selected randomly only at boot time) in upstream queries sent to DNS resolvers. This allows DN… |
CVE-2022-33988 | High | 7.5 | 2022-08-15 | dproxy-nexgen (aka dproxy nexgen) re-uses the DNS transaction id (TXID) value from client queries, which allows attackers (able to send queries to the resolver… |
CVE-2022-36262 | Critical | 9.8 | 2022-08-15 | An issue was discovered in taocms 3.0.2. in the website settings that allows arbitrary php code to be injected by modifying config.php. |
CVE-2022-34294 | Critical | 9.8 | 2022-08-15 | totd 1.5.3 uses a fixed UDP source port in upstream queries sent to DNS resolvers. This allows DNS cache poisoning because there is not enough entropy to preve… |
CVE-2022-33993 | Medium | 5.3 | 2022-08-15 | Misinterpretation of special domain name characters in DNRD (aka Domain Name Relay Daemon) 2.20.3 leads to cache poisoning because domain names and their assoc… |
CVE-2022-33992 | High | 7.5 | 2022-08-15 | DNRD (aka Domain Name Relay Daemon) 2.20.3 forwards and caches DNS queries with the CD (aka checking disabled) bit set to 1. This leads to disabling of DNSSEC… |
CVE-2022-38223 | High | 7.8 | 2022-08-15 | There is an out-of-bounds write in checkType located in etc.c in w3m 0.5.3. It can be triggered by sending a crafted HTML file to the w3m binary. It allows an… |
CVE-2022-38221 | Critical | 9.8 | 2022-08-15 | A buffer overflow in the FTcpListener thread in The Isle Evrima (the dedicated server on Windows and Linux) 0.9.88.07 before 2022-08-12 allows a remote attacke… |
CVE-2022-37401 | High | 8.8 | 2022-08-15 | Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encrypted with a single… |
CVE-2022-37400 | High | 8.8 | 2022-08-15 | Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored passwords are encrypted with a single… |
CVE-2022-36007 | Medium | 6.1 | 2022-08-15 | Venice is a Clojure inspired sandboxed Lisp dialect with excellent Java interoperability. A partial path traversal issue exists within the functions `load-file… |
CVE-2022-36006 | High | 7.9 | 2022-08-15 | Arvados is an open source platform for managing, processing, and sharing genomic and other large scientific and biomedical data. A remote code execution (RCE)… |