2022 CVEs (page 164)
Page 164 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-2673 | Medium | 6.3 | 2022-08-05 | A vulnerability was found in Rigatur Online Booking and Hotel Management System aff6409. It has been declared as critical. Affected by this vulnerability is an… |
CVE-2022-2672 | Medium | 6.3 | 2022-08-05 | A vulnerability was found in SourceCodester Garage Management System. It has been classified as critical. Affected is an unknown function of the file createUse… |
CVE-2022-2671 | Medium | 6.3 | 2022-08-05 | A vulnerability was found in SourceCodester Garage Management System and classified as critical. This issue affects some unknown processing of the file removeU… |
CVE-2022-2667 | Medium | 6.3 | 2022-08-05 | A vulnerability was found in SourceCodester Loan Management System and classified as critical. This issue affects some unknown processing of the file delete_lp… |
CVE-2022-2665 | Medium | 6.3 | 2022-08-05 | A vulnerability classified as critical was found in SourceCodester Simple E-Learning System. Affected by this vulnerability is an unknown functionality of the… |
CVE-2022-2664 | High | 7.3 | 2022-08-05 | A vulnerability classified as critical has been found in Private Cloud Management Platform. Affected is an unknown function of the file /management/api/rcx_man… |
CVE-2022-2636 | High | 8.5 | 2022-08-05 | Improper Control of Generation of Code ('Code Injection') in GitHub repository hestiacp/hestiacp prior to 1.6.6. |
CVE-2022-2626 | High | 7.2 | 2022-08-05 | Incorrect Privilege Assignment in GitHub repository hestiacp/hestiacp prior to 1.6.6. |
CVE-2022-37434 | Critical | 9.8 | 2022-08-05 | zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications t… |
CVE-2022-37431 | Medium | 6.1 | 2022-08-05 | A Reflected Cross-site scripting (XSS) issue was discovered in dotCMS Core through 22.06. This occurs in the admin portal when the configuration has XSS_PROTEC… |
CVE-2022-37416 | Medium | 6.5 | 2022-08-05 | Ittiam libmpeg2 before 2022-07-27 uses memcpy with overlapping memory blocks in impeg2_mc_fullx_fully_8x8. |
CVE-2022-21186 | Critical | 9.8 | 2022-08-05 | The package @acrontum/filesystem-template before 0.0.2 are vulnerable to Arbitrary Command Injection due to the fetchRepo API missing sanitization of the href… |
CVE-2022-37415 | High | 7.8 | 2022-08-05 | The Uniwill SparkIO.sys driver 1.0 is vulnerable to a stack-based buffer overflow via IOCTL 0x40002008. |
CVE-2022-37030 | High | 7.8 | 2022-08-04 | Weak permissions on the configuration file in the PAM module in Grommunio Gromox 0.5 through 1.x before 1.28 allow a local unprivileged user in the gromox grou… |
CVE-2022-35930 | High | 7.1 | 2022-08-04 | PolicyController is a utility used to enforce supply chain policy in Kubernetes clusters. In versions prior to 0.2.1 PolicyController will report a false posit… |
CVE-2022-31793 | High | 7.5 | 2022-08-04 | do_request in request.c in muhttpd before 1.1.7 allows remote attackers to read arbitrary files by constructing a URL with a single character before a desired… |
CVE-2022-35927 | High | 8.1 | 2022-08-04 | Contiki-NG is an open-source, cross-platform operating system for IoT devices. In the RPL-Classic routing protocol implementation in the Contiki-NG operating s… |
CVE-2022-35926 | Medium | 5.9 | 2022-08-04 | Contiki-NG is an open-source, cross-platform operating system for IoT devices. Because of insufficient validation of IPv6 neighbor discovery options in Contiki… |
CVE-2022-35858 | High | 7.8 | 2022-08-04 | The TEE_PopulateTransientObject and __utee_from_attr functions in Samsung mTower 0.3.0 allow a trusted application to trigger a memory overwrite, denial of ser… |
CVE-2022-35144 | Medium | 4.8 | 2022-08-04 | Renato v0.17.0 was discovered to contain a cross-site scripting (XSS) vulnerability. |
CVE-2022-35143 | Critical | 9.8 | 2022-08-04 | Renato v0.17.0 employs weak password complexity requirements, allowing attackers to crack user passwords via brute-force attacks. |
CVE-2022-35142 | High | 7.5 | 2022-08-04 | An issue in Renato v0.17.0 allows attackers to cause a Denial of Service (DoS) via a crafted payload injected into the Search parameter. |
CVE-2022-35929 | High | 7.1 | 2022-08-04 | cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. `cosign verif… |
CVE-2022-34993 | Critical | 9.8 | 2022-08-04 | Totolink A3600R_Firmware V4.1.2cu.5182_B20201102 contains a hard code password for root in /etc/shadow.sample. |
CVE-2022-34970 | Critical | 9.8 | 2022-08-04 | Crow before 1.0+4 has a heap-based buffer overflow via the function qs_parse in query_string.h. On successful exploitation this vulnerability allows attackers… |
CVE-2022-35735 | High | 7.2 | 2022-08-04 | In BIG-IP Versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, an authenticated attacker with Resource… |
CVE-2022-35728 | High | 8.1 | 2022-08-04 | In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, and BIG-IQ versi… |
CVE-2022-35272 | High | 7.5 | 2022-08-04 | In BIG-IP Versions 17.0.x before 17.0.0.1 and 16.1.x before 16.1.3.1, when source-port preserve-strict is configured on an HTTP Message Routing Framework (MRF)… |
CVE-2022-35245 | High | 7.5 | 2022-08-04 | In BIG-IP Versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5.1, when a BIG-IP APM access policy is configured on a virtual serve… |
CVE-2022-35243 | High | 8.7 | 2022-08-04 | In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.5.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when running in Appliance mode, an authentic… |
CVE-2022-35241 | Medium | 6.5 | 2022-08-04 | In versions 2.x before 2.3.1 and all versions of 1.x, when NGINX Instance Manager is in use, undisclosed requests can cause an increase in disk resource utiliz… |
CVE-2022-35240 | High | 7.5 | 2022-08-04 | In BIG-IP Versions 16.1.x before 16.1.2.2, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when the Message Routing (MR) Message Queuing Telemetry Transport… |
CVE-2022-35236 | High | 7.5 | 2022-08-04 | In BIG-IP Versions 16.1.x before 16.1.2.2, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when an HTTP2 profile is configured on a virtual server, undisclos… |
CVE-2022-34865 | Medium | 4.8 | 2022-08-04 | In BIG-IP Versions 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, Traffic Intelligence feeds, which use HTTPS, do not verify the rem… |
CVE-2022-34862 | High | 7.5 | 2022-08-04 | In BIG-IP Versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when an LTM virtual server is configured t… |
CVE-2022-34851 | Medium | 4.3 | 2022-08-04 | In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, and BIG-IQ Centr… |
CVE-2022-34844 | Medium | 5.9 | 2022-08-04 | In BIG-IP Versions 16.1.x before 16.1.3.1 and 15.1.x before 15.1.6.1, and all versions of BIG-IQ 8.x, when the Data Plane Development Kit (DPDK)/Elastic Networ… |
CVE-2022-34655 | High | 7.5 | 2022-08-04 | In BIG-IP Versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when an iRule containing the HTTP::payload command is configured o… |
CVE-2022-34651 | High | 7.5 | 2022-08-04 | In BIG-IP Versions 16.1.x before 16.1.3.1 and 15.1.x before 15.1.6.1, when an LTM Client or Server SSL profile with TLS 1.3 enabled is configured on a virtual… |
CVE-2022-33968 | Low | 3.7 | 2022-08-04 | In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, when an LTM moni… |
CVE-2022-33962 | Medium | 6.7 | 2022-08-04 | In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, certain iRules c… |
CVE-2022-33947 | Medium | 5.4 | 2022-08-04 | In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, a vulnerability exists in undisclosed pages… |
CVE-2022-33203 | High | 7.5 | 2022-08-04 | In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when a BIG-IP APM access policy with Service Connect agent is config… |
CVE-2022-32455 | High | 7.5 | 2022-08-04 | In BIG-IP Versions 16.1.x before 16.1.2.2, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when a BIG-IP LTM Client SSL profile is co… |
CVE-2022-31473 | Medium | 6.8 | 2022-08-04 | In BIG-IP Versions 16.1.x before 16.1.1 and 15.1.x before 15.1.4, when running in Appliance mode, an authenticated attacker may be able to bypass Appliance mod… |
CVE-2022-31119 | Low | 3.1 | 2022-08-04 | Nextcloud Mail is an email application for the nextcloud personal cloud product. Affected versions of Nextcloud mail would log user passwords to disk in the ev… |
CVE-2022-30535 | Medium | 6.5 | 2022-08-04 | In versions 2.x before 2.3.0 and all versions of 1.x, An attacker authorized to create or update ingress objects can obtain the secrets available to the NGINX… |
CVE-2022-31132 | High | 8.3 | 2022-08-04 | Nextcloud Mail is an email application for the nextcloud personal cloud product. Affected versions shipped with a CSS minifier on the path `./vendor/cerdic/css… |
CVE-2022-31120 | Low | 2.1 | 2022-08-04 | Nextcloud server is an open source personal cloud solution. The audit log is used to get a full trail of the actions which has been incompletely populated. In… |
CVE-2022-31118 | Medium | 6.5 | 2022-08-04 | Nextcloud server is an open source personal cloud solution. In affected versions an attacker could brute force to find if federated sharing is being used and p… |
CVE-2022-25168 | Critical | 9.8 | 2022-08-04 | Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands… |
CVE-2022-2656 | Medium | 6.3 | 2022-08-04 | A vulnerability classified as critical has been found in SourceCodester Multi Language Hotel Management Software. Affected is an unknown function. The manipula… |
CVE-2022-35216 | High | 7.5 | 2022-08-04 | OMICARD EDM’s mail image relay function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to by-pass authen… |
CVE-2022-32965 | Critical | 9.8 | 2022-08-04 | OMICARD EDM has a hard-coded machine key. An unauthenticated remote attacker can use the machine key to send serialized payload to the server to execute arbitr… |
CVE-2022-32964 | Critical | 9.8 | 2022-08-04 | OMICARD EDM’s API function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL commands to access, modify… |
CVE-2022-32963 | High | 7.5 | 2022-08-04 | OMICARD EDM’s mail file relay function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to by-pass authent… |
CVE-2022-2653 | Medium | 6.5 | 2022-08-04 | With this vulnerability an attacker can read many sensitive files like configuration files, or the /proc/self/environ file, that contains the environment varia… |
CVE-2022-2652 | Medium | 6.0 | 2022-08-04 | Depending on the way the format strings in the card label are crafted it's possible to leak kernel stack memory. There is also the possibility for DoS due to t… |
CVE-2022-2651 | Critical | 9.8 | 2022-08-04 | Authentication Bypass by Primary Weakness in GitHub repository bookwyrm-social/bookwyrm prior to 0.4.5. |
CVE-2022-2648 | Medium | 6.3 | 2022-08-04 | A vulnerability was found in SourceCodester Multi Language Hotel Management Software. It has been rated as critical. This issue affects some unknown processing… |
CVE-2022-2647 | High | 7.3 | 2022-08-04 | A vulnerability was found in jeecg-boot. It has been declared as critical. This vulnerability affects unknown code of the file /api/. The manipulation of the a… |
CVE-2022-2646 | Low | 3.5 | 2022-08-04 | A vulnerability, which was classified as problematic, was found in SourceCodester Online Admission System. Affected is an unknown function of the file index.ph… |
CVE-2022-2645 | Low | 3.5 | 2022-08-04 | A vulnerability has been found in SourceCodester Garage Management System and classified as problematic. Affected by this vulnerability is an unknown functiona… |
CVE-2022-2644 | Medium | 5.5 | 2022-08-04 | A vulnerability was found in SourceCodester Online Admission System and classified as critical. This issue affects some unknown processing of the component GET… |
CVE-2022-2643 | Medium | 6.3 | 2022-08-04 | A vulnerability has been found in SourceCodester Online Admission System and classified as critical. This vulnerability affects unknown code of the component P… |
CVE-2022-34158 | High | 8.8 | 2022-08-04 | A carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow a group privilege esc… |
CVE-2022-28732 | Medium | 6.1 | 2022-08-04 | A carefully crafted request on WeblogPlugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the v… |
CVE-2022-28731 | Medium | 6.5 | 2022-08-04 | A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modif… |
CVE-2022-28730 | Medium | 6.1 | 2022-08-04 | A carefully crafted request on AJAXPreview.jsp could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in th… |
CVE-2022-27166 | Medium | 6.1 | 2022-08-04 | A carefully crafted request on XHRHtml2Markup.jsp could trigger an XSS vulnerability on Apache JSPWiki up to and including 2.11.2, which could allow the attack… |
CVE-2022-35506 | High | 7.5 | 2022-08-03 | TripleCross v0.1.0 was discovered to contain a stack overflow which occurs because there is no limit to the length of program parameters. |
CVE-2022-35505 | High | 7.5 | 2022-08-03 | A segmentation fault in TripleCross v0.1.0 occurs when sending a control command from the client to the server. This occurs because there is no limit to the le… |
CVE-2022-35161 | Critical | 9.8 | 2022-08-03 | GVRET Stable Release as of Aug 15, 2015 was discovered to contain a buffer overflow via the handleConfigCmd function at SerialConsole.cpp. |
CVE-2022-35158 | High | 7.5 | 2022-08-03 | A vulnerability in the lua parser of TscanCode tsclua v2.15.01 allows attackers to cause a Denial of Service (DoS) via a crafted lua script. |
CVE-2022-35928 | High | 8.4 | 2022-08-03 | AES Crypt is a file encryption software for multiple platforms. AES Crypt for Linux built using the source on GitHub and having the version number 3.11 has a v… |
CVE-2022-27551 | Medium | 5.3 | 2022-08-03 | HCL Launch could allow an authenticated user to obtain sensitive information in some instances due to improper security checking. |
CVE-2022-31197 | High | 7.1 | 2022-08-03 | PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. The PGJDBC i… |
CVE-2022-31175 | Medium | 5.8 | 2022-08-03 | CKEditor 5 is a JavaScript rich text editor. A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages in version… |
CVE-2022-34992 | High | 7.8 | 2022-08-03 | Luadec v0.9.9 was discovered to contain a heap-buffer overflow via the function UnsetPending. |
CVE-2022-37396 | Medium | 4.1 | 2022-08-03 | In JetBrains Rider before 2022.2 Trust and Open Project dialog could be bypassed, leading to local code execution |
CVE-2022-35867 | Medium | 6.7 | 2022-08-03 | This vulnerability allows local attackers to escalate privileges on affected installations of xhyve. An attacker must first obtain the ability to execute high-… |
CVE-2022-35866 | Critical | 9.8 | 2022-08-03 | This vulnerability allows remote attackers to bypass authentication on affected installations of Vinchin Backup and Recovery 6.5.0.17561. Authentication is not… |
CVE-2022-35865 | Critical | 9.8 | 2022-08-03 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of BMC Track-It! 20.21.2.109. Authentication is not required to… |
CVE-2022-35864 | Medium | 6.5 | 2022-08-03 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of BMC Track-It! 20.21.02.109. Authentication is require… |
CVE-2022-34872 | Medium | 6.5 | 2022-08-03 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Centreon. Authentication is required to exploit this… |
CVE-2022-34871 | High | 7.2 | 2022-08-03 | This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerabili… |
CVE-2022-2272 | Critical | 9.8 | 2022-08-03 | This vulnerability allows remote attackers to bypass authentication on affected installations of Sante PACS Server 3.0.4. Authentication is not required to exp… |
CVE-2022-28684 | High | 8.8 | 2022-08-03 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of DevExpress. Authentication is required to exploit this vulner… |
CVE-2022-28668 | High | 7.8 | 2022-08-03 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 11.9.2. User interaction is required t… |
CVE-2022-35620 | Critical | 9.8 | 2022-08-03 | D-LINK DIR-818LW A1:DIR818L_FW105b01 was discovered to contain a remote code execution (RCE) vulnerability via the function binary.soapcgi_main. |
CVE-2022-35619 | Critical | 9.8 | 2022-08-03 | D-LINK DIR-818LW A1:DIR818L_FW105b01 was discovered to contain a remote code execution (RCE) vulnerability via the function ssdpcgi_main. |
CVE-2022-34974 | Critical | 9.8 | 2022-08-03 | D-Link DIR810LA1_FW102B22 was discovered to contain a command injection vulnerability via the Ping_addr function. |
CVE-2022-34973 | High | 7.5 | 2022-08-03 | D-Link DIR820LA1_FW106B02 was discovered to contain a buffer overflow via the nextPage parameter at ping.ccp. |
CVE-2022-36359 | High | 8.8 | 2022-08-03 | An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file downl… |
CVE-2022-32293 | High | 8.1 | 2022-08-03 | In ConnMan through 1.41, a man-in-the-middle attack against a WISPR HTTP query could be used to trigger a use-after-free in WISPR handling, leading to crashes… |
CVE-2022-32292 | Critical | 9.8 | 2022-08-03 | In ConnMan through 1.41, remote attackers able to send HTTP requests to the gweb component are able to exploit a heap-based buffer overflow in received_data to… |
CVE-2022-27484 | Medium | 5.4 | 2022-08-03 | A unverified password change in Fortinet FortiADC version 6.2.0 through 6.2.3, 6.1.x, 6.0.x, 5.x.x allows an authenticated attacker to bypass the Old Password… |
CVE-2022-23442 | Medium | 4.3 | 2022-08-03 | An improper access control vulnerability [CWE-284] in FortiOS versions 6.2.0 through 6.2.11, 6.4.0 through 6.4.8 and 7.0.0 through 7.0.5 may allow an authentic… |
CVE-2022-37394 | Low | 3.3 | 2022-08-03 | An issue was discovered in OpenStack Nova before 23.2.2, 24.x before 24.1.2, and 25.x before 25.0.2. By creating a neutron port with the direct vnic_type, crea… |
CVE-2022-35737 | High | 7.5 | 2022-08-03 | SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API. |