2022 CVEs (page 159)
Page 159 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-20376 | Medium | 6.7 | 2022-08-11 | In trusty_log_seq_start of trusty-log.c, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with Syst… |
CVE-2022-20375 | High | 7.5 | 2022-08-11 | In LteRrcNrProAsnDecode of LteRrcNr_Codec.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service… |
CVE-2022-20373 | Medium | 6.4 | 2022-08-11 | In st21nfc_loc_set_polaritymode of fc/st21nfc.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege w… |
CVE-2022-20372 | Medium | 6.7 | 2022-08-11 | In exynos5_i2c_irq of (TBD), there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with System exec… |
CVE-2022-20371 | Medium | 6.4 | 2022-08-11 | In dm_bow_dtr and related functions of dm-bow.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege w… |
CVE-2022-20370 | High | 7.5 | 2022-08-11 | Product: AndroidVersions: Android kernelAndroid ID: A-215730643References: N/A |
CVE-2022-20369 | Medium | 6.7 | 2022-08-11 | In v4l2_m2m_querybuf of v4l2-mem2mem.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privil… |
CVE-2022-20368 | High | 7.8 | 2022-08-11 | Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel |
CVE-2022-20367 | Medium | 6.7 | 2022-08-11 | In construct_transaction of lwis_ioctl.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege… |
CVE-2022-20366 | Medium | 6.7 | 2022-08-11 | In ioctl_dpm_clk_update of lwis_ioctl.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege w… |
CVE-2022-20365 | Critical | 9.8 | 2022-08-11 | Product: AndroidVersions: Android kernelAndroid ID: A-229632566References: N/A |
CVE-2022-20252 | Low | 3.3 | 2022-08-11 | In PackageManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Thi… |
CVE-2022-20251 | Low | 3.3 | 2022-08-11 | In LocaleManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This… |
CVE-2022-20250 | High | 7.8 | 2022-08-11 | In Messaging, there is a possible way to attach files to a message without proper access checks due to improper input validation. This could lead to local esca… |
CVE-2022-20249 | Low | 3.3 | 2022-08-11 | In LocaleManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This… |
CVE-2022-20248 | High | 7.8 | 2022-08-11 | In Settings, there is a possible way to connect to an open network bypassing DISALLOW_CONFIG_WIFI restriction due to a logic error in the code. This could lead… |
CVE-2022-20247 | High | 7.5 | 2022-08-11 | In Media, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution p… |
CVE-2022-20246 | High | 7.8 | 2022-08-11 | In WindowManager, there is a possible bypass of the restrictions for starting activities from the background due to an incorrect UID/permission check. This cou… |
CVE-2022-20245 | Low | 2.4 | 2022-08-11 | In WindowManager, there is a possible method to create a recording of the lock screen due to an insecure default value. This could lead to local information di… |
CVE-2022-20244 | High | 7.5 | 2022-08-11 | In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if more than 100 bluetoot… |
CVE-2022-20243 | Medium | 4.4 | 2022-08-11 | In Core Utilities, there is a possible log information disclosure. This could lead to local information disclosure of sensitive browsing data with System execu… |
CVE-2022-20242 | Medium | 5.5 | 2022-08-11 | In Telephony, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This cou… |
CVE-2022-20241 | Low | 3.3 | 2022-08-11 | In Messaging, there is a possible way to attach a private file to an SMS message due to improper input validation. This could lead to local information disclos… |
CVE-2022-20237 | Critical | 9.8 | 2022-08-11 | In BuildDevIDResponse of miscdatabuilder.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution w… |
CVE-2022-20180 | High | 7.8 | 2022-08-11 | In several functions of mali_gralloc_reference.cpp, there is a possible arbitrary code execution due to a missing bounds check. This could lead to local escala… |
CVE-2022-20158 | Medium | 6.7 | 2022-08-11 | In bdi_put and bdi_unregister of backing-dev.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege… |
CVE-2022-2776 | Medium | 5.4 | 2022-08-11 | A vulnerability classified as problematic has been found in SourceCodester Gym Management System. Affected is an unknown function of the file delete_user.php… |
CVE-2022-2774 | Medium | 6.3 | 2022-08-11 | A vulnerability was found in SourceCodester Library Management System. It has been declared as critical. This vulnerability affects unknown code of the file li… |
CVE-2022-2773 | Low | 3.5 | 2022-08-11 | A vulnerability was found in SourceCodester Apartment Visitor Management System. It has been classified as problematic. This affects an unknown part of the fil… |
CVE-2022-2772 | Medium | 6.3 | 2022-08-11 | A vulnerability was found in SourceCodester Apartment Visitor Management System and classified as critical. Affected by this issue is some unknown functionalit… |
CVE-2022-2771 | Medium | 6.3 | 2022-08-11 | A vulnerability has been found in SourceCodester Simple Online Book Store System and classified as critical. Affected by this vulnerability is an unknown funct… |
CVE-2022-2770 | Medium | 6.3 | 2022-08-11 | A vulnerability, which was classified as critical, was found in SourceCodester Simple Online Book Store System. Affected is an unknown function of the file /ob… |
CVE-2022-2769 | Low | 3.5 | 2022-08-11 | A vulnerability, which was classified as problematic, has been found in SourceCodester Company Website CMS. This issue affects some unknown processing of the f… |
CVE-2022-2768 | Low | 3.5 | 2022-08-11 | A vulnerability classified as problematic was found in SourceCodester Library Management System. This vulnerability affects unknown code of the file /qr/I/. Th… |
CVE-2022-2777 | Medium | 5.4 | 2022-08-11 | Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.1. |
CVE-2022-2767 | Low | 3.5 | 2022-08-11 | A vulnerability classified as problematic has been found in SourceCodester Online Admission System. This affects an unknown part of the file /index.php. The ma… |
CVE-2022-2766 | High | 7.3 | 2022-08-11 | A vulnerability was found in SourceCodester Loan Management System. It has been rated as critical. Affected by this issue is some unknown functionality of the… |
CVE-2022-2765 | Medium | 6.3 | 2022-08-11 | A vulnerability was found in SourceCodester Company Website CMS 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionali… |
CVE-2022-2751 | Medium | 6.3 | 2022-08-11 | A vulnerability was found in SourceCodester Company Website CMS and classified as critical. Affected by this issue is some unknown functionality of the file /d… |
CVE-2022-2750 | Medium | 6.3 | 2022-08-11 | A vulnerability, which was classified as critical, was found in SourceCodester Company Website CMS. Affected is an unknown function of the file /dashboard/add-… |
CVE-2022-2749 | Medium | 4.7 | 2022-08-11 | A vulnerability was found in SourceCodester Gym Management System. It has been declared as critical. Affected by this vulnerability is an unknown functionality… |
CVE-2022-2748 | Low | 3.5 | 2022-08-11 | A vulnerability was found in SourceCodester Simple Online Book Store System. It has been classified as problematic. Affected is an unknown function of the file… |
CVE-2022-2747 | Medium | 6.3 | 2022-08-11 | A vulnerability was found in SourceCodester Simple Online Book Store and classified as critical. This issue affects some unknown processing of the file book.ph… |
CVE-2022-2746 | Medium | 6.3 | 2022-08-11 | A vulnerability has been found in SourceCodester Simple Online Book Store System and classified as critical. This vulnerability affects unknown code of the fil… |
CVE-2022-2745 | Medium | 6.3 | 2022-08-11 | A vulnerability, which was classified as critical, was found in SourceCodester Gym Management System. This affects an unknown part of the file /admin/add_train… |
CVE-2022-2744 | Medium | 6.3 | 2022-08-11 | A vulnerability, which was classified as critical, has been found in SourceCodester Gym Management System. Affected by this issue is some unknown functionality… |
CVE-2022-2740 | Medium | 6.3 | 2022-08-11 | A vulnerability was found in SourceCodester Company Website CMS. It has been declared as critical. This vulnerability affects unknown code of the file /dashboa… |
CVE-2022-2736 | Medium | 6.3 | 2022-08-11 | A vulnerability was found in SourceCodester Company Website CMS. It has been classified as critical. This affects an unknown part of the file /dashboard/update… |
CVE-2022-38161 | High | 7.5 | 2022-08-11 | The Gumstix Overo SBC on the VSKS board through 2022-08-09, as used on the Orlan-10 and other platforms, allows unrestricted remapping of the NOR flash memory… |
CVE-2022-38155 | High | 7.5 | 2022-08-11 | TEE_Malloc in Samsung mTower through 0.3.0 allows a trusted application to achieve Excessive Memory Allocation via a large len value, as demonstrated by a Numa… |
CVE-2022-38150 | High | 7.5 | 2022-08-11 | In Varnish Cache 7.0.0, 7.0.1, 7.0.2, and 7.1.0, it is possible to cause the Varnish Server to assert and automatically restart through forged HTTP/1 backend r… |
CVE-2022-38130 | Critical | 9.8 | 2022-08-10 | The com.keysight.tentacle.config.ResourceManager.smsRestoreDatabaseZip() method is used to restore the HSQLDB database used in SMS. It takes the path of the zi… |
CVE-2022-38129 | Critical | 9.8 | 2022-08-10 | A path traversal vulnerability exists in the com.keysight.tentacle.licensing.LicenseManager.addLicenseFile() method in the Keysight Sensor Management Server (S… |
CVE-2022-37024 | High | 8.8 | 2022-08-10 | Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 through 2022-07-30 (… |
CVE-2022-37008 | High | 7.5 | 2022-08-10 | The recovery module has a vulnerability of bypassing the verification of an update package before use. Successful exploitation of this vulnerability may affect… |
CVE-2022-37007 | High | 7.5 | 2022-08-10 | The chinadrm module has an out-of-bounds read vulnerability. Successful exploitation of this vulnerability may affect the availability. |
CVE-2022-37006 | High | 7.5 | 2022-08-10 | Permission control vulnerability in the network module. Successful exploitation of this vulnerability may affect service availability. |
CVE-2022-37005 | High | 7.5 | 2022-08-10 | The Settings application has an argument injection vulnerability. Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2022-37004 | High | 7.5 | 2022-08-10 | The Settings application has a vulnerability of bypassing the out-of-box experience (OOBE). Successful exploitation of this vulnerability may affect the availa… |
CVE-2022-37003 | Critical | 9.8 | 2022-08-10 | The AOD module has a vulnerability in permission assignment. Successful exploitation of this vulnerability may cause permission escalation and unauthorized acc… |
CVE-2022-37002 | Critical | 9.8 | 2022-08-10 | The SystemUI module has a privilege escalation vulnerability. Successful exploitation of this vulnerability can cause malicious applications to pop up windows… |
CVE-2022-37001 | High | 7.5 | 2022-08-10 | The diag-router module has a vulnerability in intercepting excessive long and short instructions. Successful exploitation of this vulnerability will cause the… |
CVE-2022-36923 | High | 7.5 | 2022-08-10 | Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 t… |
CVE-2022-36750 | Critical | 9.8 | 2022-08-10 | Clinic's Patient Management System v1.0 is vulnerable to SQL injection via /pms/update_user.php?id=. |
CVE-2022-36270 | Critical | 9.8 | 2022-08-10 | Clinic's Patient Management System v1.0 has arbitrary code execution via url: ip/pms/users.php. |
CVE-2022-35697 | Medium | 5.4 | 2022-08-10 | Adobe Experience Manager Core Components version 2.20.6 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is ab… |
CVE-2022-35538 | Critical | 9.8 | 2022-08-10 | WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 wireless.cgi has no filtering on parameters: delete_list, delete_al_mac, b_delete_list and b_delete_al_mac… |
CVE-2022-35537 | Critical | 9.8 | 2022-08-10 | WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 wireless.cgi has no filtering on parameters: mac_5g and Newname, which leads to command injection in page… |
CVE-2022-35536 | Critical | 9.8 | 2022-08-10 | WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 qos.cgi has no filtering on parameters: qos_bandwith and qos_dat, which leads to command injection in page… |
CVE-2022-35535 | Critical | 9.8 | 2022-08-10 | WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 wireless.cgi has no filtering on parameter macAddr, which leads to command injection in page /wifi_mesh.sh… |
CVE-2022-35534 | Critical | 9.8 | 2022-08-10 | WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 wireless.cgi has no filtering on parameter hiddenSSID32g and SSID2G2, which leads to command injection in… |
CVE-2022-35533 | Critical | 9.8 | 2022-08-10 | WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 qos.cgi has no filtering on parameters: cli_list and cli_num, which leads to command injection in page /qo… |
CVE-2022-35526 | Critical | 9.8 | 2022-08-10 | WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 login.cgi has no filtering on parameter key, which leads to command injection in page /login.shtml. |
CVE-2022-35525 | Critical | 9.8 | 2022-08-10 | WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 adm.cgi has no filtering on parameter led_switch, which leads to command injection in page /ledonoff.shtml. |
CVE-2022-35524 | Critical | 9.8 | 2022-08-10 | WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 adm.cgi has no filtering on parameters: wlan_signal, web_pskValue, sel_EncrypTyp, sel_Automode, wlan_bssid… |
CVE-2022-35523 | Critical | 9.8 | 2022-08-10 | WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 firewall.cgi has no filtering on parameter del_mac and parameter flag, which leads to command injection in… |
CVE-2022-35522 | Critical | 9.8 | 2022-08-10 | WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 adm.cgi has no filtering on parameters: ppp_username, ppp_passwd, rwan_gateway, rwan_mask and rwan_ip, whi… |
CVE-2022-35521 | Critical | 9.8 | 2022-08-10 | WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 firewall.cgi has no filtering on parameters: remoteManagementEnabled, blockPortScanEnabled, pingFrmWANFilt… |
CVE-2022-35520 | Critical | 9.8 | 2022-08-10 | WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 api.cgi has no filtering on parameter ufconf, and this is a hidden parameter which doesn't appear in POST… |
CVE-2022-35519 | Critical | 9.8 | 2022-08-10 | WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 firewall.cgi has no filtering on parameter add_mac, which leads to command injection in page /cli_black_li… |
CVE-2022-35518 | Critical | 9.8 | 2022-08-10 | WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 nas.cgi has no filtering on parameters: User1Passwd and User1, which leads to command injection in page /n… |
CVE-2022-35517 | High | 8.8 | 2022-08-10 | WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 adm.cgi has no filtering on parameters: web_pskValue, wl_Method, wlan_ssid, EncrypType, rwan_ip, rwan_mask… |
CVE-2022-35509 | Medium | 5.4 | 2022-08-10 | An issue was discovered in EyouCMS 1.5.8. There is a Storage XSS vulnerability that can allows an attacker to execute arbitrary Web scripts or HTML by injectin… |
CVE-2022-35491 | Critical | 9.8 | 2022-08-10 | TOTOLINK A3002RU V3.0.0-B20220304.1804 has a hardcoded password for root in /etc/shadow.sample. |
CVE-2022-35426 | Critical | 9.8 | 2022-08-10 | UCMS 1.6 is vulnerable to arbitrary file upload via ucms/sadmin/file PHP file. |
CVE-2022-35293 | Critical | 9.1 | 2022-08-10 | Due to insecure session management, SAP Enable Now allows an unauthenticated attacker to gain access to user's account. On successful exploitation, an attacker… |
CVE-2022-35290 | High | 7.5 | 2022-08-10 | Under certain conditions SAP Authenticator for Android allows an attacker to access information which would otherwise be restricted. |
CVE-2022-32429 | Critical | 9.8 | 2022-08-10 | An authentication-bypass issue in the component http://MYDEVICEIP/cgi-bin-sdb/ExportSettings.sh of Mega System Technologies Inc MSNSwitch MNT.2408 allows unaut… |
CVE-2022-32245 | High | 8.2 | 2022-08-10 | SAP BusinessObjects Business Intelligence Platform (Open Document) - versions 420, 430, allows an unauthenticated attacker to retrieve sensitive information pl… |
CVE-2022-32189 | High | 7.5 | 2022-08-10 | A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial o… |
CVE-2022-32148 | Medium | 6.5 | 2022-08-10 | Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request… |
CVE-2022-31675 | High | 7.5 | 2022-08-10 | VMware vRealize Operations contains an authentication bypass vulnerability. An unauthenticated malicious actor with network access may be able to create a user… |
CVE-2022-31674 | Medium | 4.3 | 2022-08-10 | VMware vRealize Operations contains an information disclosure vulnerability. A low-privileged malicious actor with network access can access log files that lea… |
CVE-2022-31673 | High | 8.8 | 2022-08-10 | VMware vRealize Operations contains an information disclosure vulnerability. A low-privileged malicious actor with network access can create and leak hex dumps… |
CVE-2022-31672 | High | 7.2 | 2022-08-10 | VMware vRealize Operations contains a privilege escalation vulnerability. A malicious actor with administrative network access can escalate privileges to root. |
CVE-2022-30635 | High | 7.5 | 2022-08-10 | Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a mess… |
CVE-2022-30633 | High | 7.5 | 2022-08-10 | Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalli… |
CVE-2022-30632 | High | 7.5 | 2022-08-10 | Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containi… |
CVE-2022-30631 | High | 7.5 | 2022-08-10 | Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archi… |
CVE-2022-30630 | High | 7.5 | 2022-08-10 | Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a… |