2022 CVEs (page 160)
Page 160 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-30629 | Low | 3.1 | 2022-08-10 | Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to corr… |
CVE-2022-30580 | High | 7.8 | 2022-08-10 | Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe… |
CVE-2022-2719 | Medium | 5.5 | 2022-08-10 | In ImageMagick, a crafted file could trigger an assertion failure when a call to WriteImages was made in MagickWand/operation.c, due to a NULL image list. This… |
CVE-2022-2634 | Critical | 10.0 | 2022-08-10 | An attacker may be able to execute malicious actions due to the lack of device access protections and device permissions when using the web application. This c… |
CVE-2022-2458 | High | 8.2 | 2022-08-10 | XML external entity injection(XXE) is a vulnerability that allows an attacker to interfere with an application's processing of XML data. This attack occurs whe… |
CVE-2022-2457 | Critical | 9.8 | 2022-08-10 | A flaw was found in Red Hat Process Automation Manager 7 where an attacker can benefit from a brute force attack against Administration Console as the applicat… |
CVE-2022-29804 | High | 7.5 | 2022-08-10 | Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential di… |
CVE-2022-28881 | Medium | 4.3 | 2022-08-10 | A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the aerdl.dll component used in certain WithSecure products unpacker function… |
CVE-2022-28131 | High | 7.5 | 2022-08-10 | Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply… |
CVE-2022-25793 | High | 7.8 | 2022-08-10 | A Stack-based Buffer Overflow Vulnerability in Autodesk 3ds Max 2022, 2021, and 2020 may lead to code execution through the lack of proper validation of the le… |
CVE-2022-23238 | Medium | 6.5 | 2022-08-10 | Linux deployments of StorageGRID (formerly StorageGRID Webscale) versions 11.6.0 through 11.6.0.2 deployed with a Linux kernel version less than 4.7.0 are susc… |
CVE-2022-22983 | Medium | 5.9 | 2022-08-10 | VMware Workstation (16.x prior to 16.2.4) contains an unprotected storage of credentials vulnerability. A malicious actor with local user privileges to the vic… |
CVE-2022-20361 | Critical | 9.8 | 2022-08-10 | In btif_dm_auth_cmpl_evt of btif_dm.cc, there is a possible vulnerability in Cross-Transport Key Derivation due to Weakness in Bluetooth Standard. This could l… |
CVE-2022-20360 | High | 7.8 | 2022-08-10 | In setChecked of SecureNfcPreferenceController.java, there is a missing permission check. This could lead to local escalation of privilege from the guest user… |
CVE-2022-20358 | Low | 3.3 | 2022-08-10 | In startSync of AbstractThreadedSyncAdapter.java, there is a possible way to access protected content of content providers due to a missing permission check. T… |
CVE-2022-20357 | Medium | 5.5 | 2022-08-10 | In writeToParcel of SurfaceControl.cpp, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure w… |
CVE-2022-20356 | High | 7.8 | 2022-08-10 | In shouldAllowFgsWhileInUsePermissionLocked of ActiveServices.java, there is a possible way to start foreground service from background due to improper input v… |
CVE-2022-20355 | Medium | 5.5 | 2022-08-10 | In get of PacProxyService.java, there is a possible system service crash due to improper input validation. This could lead to local denial of service with User… |
CVE-2022-20354 | High | 7.8 | 2022-08-10 | In onDefaultNetworkChanged of Vpn.java, there is a possible way to disable VPN due to a logic error in the code. This could lead to local escalation of privile… |
CVE-2022-20353 | Medium | 5.5 | 2022-08-10 | In onSaveRingtone of DefaultRingtonePreference.java, there is a possible inappropriate file read due to improper input validation. This could lead to local inf… |
CVE-2022-20352 | Medium | 5.5 | 2022-08-10 | In addProviderRequestListener of LocationManagerService.java, there is a possible way to learn which packages request location information due to a missing per… |
CVE-2022-20350 | Medium | 5.5 | 2022-08-10 | In onCreate of NotificationAccessConfirmationActivity.java, there is a possible way to trick the victim to grant notification access to the wrong app due to im… |
CVE-2022-20349 | High | 7.8 | 2022-08-10 | In WifiScanningPreferenceController and BluetoothScanningPreferenceController, there is a possible admin restriction bypass due to a missing permission check… |
CVE-2022-20348 | High | 7.8 | 2022-08-10 | In updateState of LocationServicesWifiScanningPreferenceController.java, there is a possible admin restriction bypass due to a missing permission check. This c… |
CVE-2022-20347 | High | 8.8 | 2022-08-10 | In onAttach of ConnectedDeviceDashboardFragment.java, there is a possible permission bypass due to a confused deputy. This could lead to remote escalation of p… |
CVE-2022-20346 | Medium | 6.5 | 2022-08-10 | In updateAudioTrackInfoFromESDS_MPEG4Audio of MPEG4Extractor.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could lead to r… |
CVE-2022-20345 | High | 8.8 | 2022-08-10 | In l2cble_process_sig_cmd of l2c_ble.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution over B… |
CVE-2022-20344 | High | 7.0 | 2022-08-10 | In stealReceiveChannel of EventThread.cpp, there is a possible way to interfere with process communication due to a race condition. This could lead to local es… |
CVE-2022-20239 | Critical | 9.8 | 2022-08-10 | remap_pfn_range' here may map out of size kernel memory (for example, may map the kernel area), and because the 'vma->vm_page_prot' can also be controlled by u… |
CVE-2022-1962 | Medium | 5.5 | 2022-08-10 | Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deepl… |
CVE-2022-1705 | Medium | 6.5 | 2022-08-10 | Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined… |
CVE-2022-35715 | High | 7.5 | 2022-08-10 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in a s… |
CVE-2022-35280 | Critical | 9.8 | 2022-08-10 | IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 does not require that users should have strong passwords by default, which makes it easier for attack… |
CVE-2022-34365 | Medium | 6.5 | 2022-08-10 | WMS 3.7 contains a Path Traversal Vulnerability in Device API. An attacker could potentially exploit this vulnerability, to gain unauthorized read access to th… |
CVE-2022-33931 | Medium | 6.3 | 2022-08-10 | Dell Wyse Management Suite 3.6.1 and below contains an Improper Access control vulnerability in UI. An attacker with no access to Alert Classification page cou… |
CVE-2022-33930 | Medium | 4.3 | 2022-08-10 | Dell Wyse Management Suite 3.6.1 and below contains Information Disclosure in Devices error pages. An attacker could potentially exploit this vulnerability, le… |
CVE-2022-33929 | Medium | 6.1 | 2022-08-10 | Dell Wyse Management Suite 3.6.1 and below contains a Reflected Cross-Site Scripting Vulnerability in EndUserSummary page. An authenticated attacker could pote… |
CVE-2022-33928 | Medium | 6.4 | 2022-08-10 | Dell Wyse Management Suite 3.6.1 and below contains an Plain-text Password Storage Vulnerability in UI. An attacker with low privileges could potentially explo… |
CVE-2022-33927 | Medium | 5.4 | 2022-08-10 | Dell Wyse Management Suite 3.6.1 and below contains a Session Fixation vulnerability. A unauthenticated attacker could exploit this by taking advantage of a us… |
CVE-2022-33926 | High | 7.1 | 2022-08-10 | Dell Wyse Management Suite 3.6.1 and below contains an improper access control vulnerability. A remote malicious user could exploit this vulnerability in order… |
CVE-2022-33925 | Medium | 6.5 | 2022-08-10 | Dell Wyse Management Suite 3.6.1 and below contains an Improper Access control vulnerability in UI. An remote authenticated attacker could potentially exploit… |
CVE-2022-33924 | Medium | 4.3 | 2022-08-10 | Dell Wyse Management Suite 3.6.1 and below contains an Improper Access control vulnerability with which an attacker with no access to create rules could potent… |
CVE-2022-29090 | High | 8.5 | 2022-08-10 | Dell Wyse Management Suite 3.6.1 and below contains a Sensitive Data Exposure vulnerability. A low privileged malicious user could potentially exploit this vul… |
CVE-2022-22490 | Medium | 4.9 | 2022-08-10 | IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a privileged user to obtain sensitive Azure bot credential information. IBM X-Force ID: 2… |
CVE-2022-22411 | Medium | 6.5 | 2022-08-10 | IBM Spectrum Scale Data Access Services (DAS) 5.1.3.1 could allow an authenticated user to insert code which could allow the attacker to manipulate cluster res… |
CVE-2022-22369 | High | 7.1 | 2022-08-10 | IBM Workload Scheduler 9.4 and 9.5 could allow a local user to overwrite key system files which would cause the system to crash. IBM X-Force ID: 221187. |
CVE-2022-20866 | High | 7.4 | 2022-08-10 | A vulnerability in the handling of RSA keys on devices running Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Softwa… |
CVE-2022-20713 | Medium | 4.3 | 2022-08-10 | A vulnerability in the VPN web client services component of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software… |
CVE-2022-38133 | Low | 3.2 | 2022-08-10 | In JetBrains TeamCity before 2022.04.3 the private SSH key could be written to the server log in some cases |
CVE-2022-2756 | Medium | 6.5 | 2022-08-10 | Server-Side Request Forgery (SSRF) in GitHub repository kareadita/kavita prior to 0.5.4.1. |
CVE-2022-0028 | High | 8.6 | 2022-08-10 | A PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks. Th… |
CVE-2022-36325 | Medium | 6.8 | 2022-08-10 | Affected devices do not properly sanitize data introduced by an user when rendering the web interface. This could allow an authenticated remote attacker with a… |
CVE-2022-36324 | High | 7.5 | 2022-08-10 | Affected devices do not properly handle the renegotiation of SSL/TLS parameters. This could allow an unauthenticated remote attacker to bypass the TCP brute fo… |
CVE-2022-36323 | Critical | 9.1 | 2022-08-10 | Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges to inject code or s… |
CVE-2022-34661 | High | 7.5 | 2022-08-10 | A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.15), Teamcenter V13.0 (All versions < V13.0.0.10), Teamcenter V13.1 (All versio… |
CVE-2022-34660 | Critical | 9.8 | 2022-08-10 | A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.15), Teamcenter V13.0 (All versions < V13.0.0.10), Teamcenter V13.1 (All versio… |
CVE-2022-34659 | Medium | 5.3 | 2022-08-10 | A vulnerability has been identified in Simcenter STAR-CCM+ (All versions only if the Power-on-Demand public license server is used). Affected applications expo… |
CVE-2022-2242 | Critical | 9.8 | 2022-08-10 | The KUKA SystemSoftware V/KSS in versions prior to 8.6.5 is prone to improper access control as an unauthorized attacker can directly read and write robot conf… |
CVE-2022-20914 | Medium | 4.9 | 2022-08-10 | A vulnerability in the External RESTful Services (ERS) API of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker to ob… |
CVE-2022-20869 | Medium | 6.1 | 2022-08-10 | A vulnerability in the web-based management interface of Cisco BroadWorks Application Delivery Platform Software could allow an unauthenticated, remote attacke… |
CVE-2022-20852 | Medium | 5.4 | 2022-08-10 | Multiple vulnerabilities in the web interface of Cisco Webex Meetings could allow a remote attacker to conduct a cross-site scripting (XSS) attack or a frame h… |
CVE-2022-20842 | Critical | 9.0 | 2022-08-10 | Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an unauthenticated, remote attacker to execute arbit… |
CVE-2022-20827 | Critical | 9.0 | 2022-08-10 | Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an unauthenticated, remote attacker to execute arbit… |
CVE-2022-20820 | Medium | 5.4 | 2022-08-10 | Multiple vulnerabilities in the web interface of Cisco Webex Meetings could allow a remote attacker to conduct a cross-site scripting (XSS) attack or a frame h… |
CVE-2022-20816 | Medium | 6.5 | 2022-08-10 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Man… |
CVE-2022-20792 | High | 7.8 | 2022-08-10 | A vulnerability in the regex module used by the signature database load module of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.10… |
CVE-2022-20841 | Critical | 9.0 | 2022-08-10 | Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an unauthenticated, remote attacker to execute arbit… |
CVE-2022-31780 | High | 7.5 | 2022-08-10 | Improper Input Validation vulnerability in HTTP/2 frame handling of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Tra… |
CVE-2022-31779 | High | 7.5 | 2022-08-10 | Improper Input Validation vulnerability in HTTP/2 header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Tra… |
CVE-2022-31778 | High | 7.5 | 2022-08-10 | Improper Input Validation vulnerability in handling the Transfer-Encoding header of Apache Traffic Server allows an attacker to poison the cache. This issue af… |
CVE-2022-28129 | High | 7.5 | 2022-08-10 | Improper Input Validation vulnerability in HTTP/1.1 header parsing of Apache Traffic Server allows an attacker to send invalid headers. This issue affects Apac… |
CVE-2022-25763 | High | 7.5 | 2022-08-10 | Improper Input Validation vulnerability in HTTP/2 request validation of Apache Traffic Server allows an attacker to create smuggle or cache poison attacks. Thi… |
CVE-2022-25973 | High | 7.8 | 2022-08-10 | All versions of package mc-kill-port are vulnerable to Arbitrary Command Execution via the kill function, due to missing sanitization of the port argument. |
CVE-2022-36801 | Medium | 6.1 | 2022-08-10 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site S… |
CVE-2022-29083 | Medium | 6.8 | 2022-08-09 | Prior Dell BIOS versions contain an Improper Authentication vulnerability. An unauthenticated attacker with physical access to the system could potentially exp… |
CVE-2022-35827 | High | 8.8 | 2022-08-09 | Visual Studio Remote Code Execution Vulnerability |
CVE-2022-35826 | High | 8.8 | 2022-08-09 | Visual Studio Remote Code Execution Vulnerability |
CVE-2022-35825 | High | 8.8 | 2022-08-09 | Visual Studio Remote Code Execution Vulnerability |
CVE-2022-35824 | High | 7.2 | 2022-08-09 | Azure Site Recovery Remote Code Execution Vulnerability |
CVE-2022-35821 | Medium | 4.4 | 2022-08-09 | Azure Sphere Information Disclosure Vulnerability |
CVE-2022-35820 | High | 7.8 | 2022-08-09 | Windows Bluetooth Driver Elevation of Privilege Vulnerability |
CVE-2022-35819 | Medium | 6.5 | 2022-08-09 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-35818 | Medium | 6.5 | 2022-08-09 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-35817 | Medium | 6.5 | 2022-08-09 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-35816 | Medium | 6.5 | 2022-08-09 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-35815 | Medium | 6.5 | 2022-08-09 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-35814 | Medium | 6.5 | 2022-08-09 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-35813 | Medium | 6.5 | 2022-08-09 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-35812 | Medium | 4.9 | 2022-08-09 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-35811 | Medium | 6.5 | 2022-08-09 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-35810 | Medium | 6.5 | 2022-08-09 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-35809 | Medium | 6.5 | 2022-08-09 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-35808 | Medium | 6.5 | 2022-08-09 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-35807 | Medium | 6.5 | 2022-08-09 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-35806 | High | 7.8 | 2022-08-09 | Azure RTOS GUIX Studio Remote Code Execution Vulnerability |
CVE-2022-35804 | High | 8.8 | 2022-08-09 | SMB Client and Server Remote Code Execution Vulnerability |
CVE-2022-35802 | High | 8.1 | 2022-08-09 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-35801 | Medium | 6.5 | 2022-08-09 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-35800 | Medium | 4.9 | 2022-08-09 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-35799 | Medium | 6.5 | 2022-08-09 | Azure Site Recovery Elevation of Privilege Vulnerability |