2022 CVEs (page 164)
Page 164 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-2512 | Medium | 6.5 | 2022-08-05 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.0 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versio… |
CVE-2022-2501 | Medium | 5.9 | 2022-08-05 | An improper access control issue in GitLab EE affecting all versions from 12.0 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 allows an attack… |
CVE-2022-2500 | Medium | 4.4 | 2022-08-05 | A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1. A stored… |
CVE-2022-2499 | Low | 3.5 | 2022-08-05 | An issue has been discovered in GitLab EE affecting all versions starting from 13.10 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions… |
CVE-2022-2498 | Medium | 6.4 | 2022-08-05 | An issue in pipeline subscriptions in GitLab EE affecting all versions from 12.8 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 triggered new… |
CVE-2022-2497 | High | 8.5 | 2022-08-05 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versio… |
CVE-2022-2459 | Low | 2.7 | 2022-08-05 | An issue has been discovered in GitLab EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2… |
CVE-2022-2456 | Medium | 4.9 | 2022-08-05 | An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15… |
CVE-2022-2417 | Medium | 6.2 | 2022-08-05 | Insufficient validation in GitLab CE/EE affecting all versions from 12.10 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 allows an authenticat… |
CVE-2022-2326 | Medium | 6.4 | 2022-08-05 | An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15… |
CVE-2022-2307 | Low | 3.5 | 2022-08-05 | A lack of cascading deletes in GitLab CE/EE affecting all versions starting from 13.0 before 15.0.5, all versions starting from 15.1 before 15.1.4, all version… |
CVE-2022-2303 | Medium | 4.3 | 2022-08-05 | An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15… |
CVE-2022-2095 | Medium | 4.3 | 2022-08-05 | An improper access control check in GitLab CE/EE affecting all versions starting from 13.7 before 15.0.5, all versions starting from 15.1 before 15.1.4, all ve… |
CVE-2022-2053 | High | 7.5 | 2022-08-05 | When a POST request comes through AJP and the request exceeds the max-post-size limit (maxEntitySize), Undertow's AjpServerRequestConduit implementation closes… |
CVE-2022-25649 | Medium | 5.0 | 2022-08-05 | Multiple Improper Access Control vulnerabilities in StoreApps Affiliate For WooCommerce premium plugin <= 4.7.0 at WordPress. |
CVE-2022-1704 | High | 7.6 | 2022-08-05 | Due to an XML external entity reference, the software parses XML in the backup/restore functionality without XML security flags, which may lead to a XXE attack… |
CVE-2022-1012 | High | 8.2 | 2022-08-05 | A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the small table perturb size. This flaw may allow an attac… |
CVE-2022-35936 | High | 8.2 | 2022-08-05 | Ethermint is an Ethereum library. In Ethermint running versions before `v0.17.2`, the contract `selfdestruct` invocation permanently removes the corresponding… |
CVE-2022-2674 | High | 7.3 | 2022-08-05 | A vulnerability was found in SourceCodester Best Fee Management System. It has been rated as critical. Affected by this issue is the function login of the file… |
CVE-2022-2673 | Medium | 6.3 | 2022-08-05 | A vulnerability was found in Rigatur Online Booking and Hotel Management System aff6409. It has been declared as critical. Affected by this vulnerability is an… |
CVE-2022-2672 | Medium | 6.3 | 2022-08-05 | A vulnerability was found in SourceCodester Garage Management System. It has been classified as critical. Affected is an unknown function of the file createUse… |
CVE-2022-2671 | Medium | 6.3 | 2022-08-05 | A vulnerability was found in SourceCodester Garage Management System and classified as critical. This issue affects some unknown processing of the file removeU… |
CVE-2022-2667 | Medium | 6.3 | 2022-08-05 | A vulnerability was found in SourceCodester Loan Management System and classified as critical. This issue affects some unknown processing of the file delete_lp… |
CVE-2022-2665 | Medium | 6.3 | 2022-08-05 | A vulnerability classified as critical was found in SourceCodester Simple E-Learning System. Affected by this vulnerability is an unknown functionality of the… |
CVE-2022-2664 | High | 7.3 | 2022-08-05 | A vulnerability classified as critical has been found in Private Cloud Management Platform. Affected is an unknown function of the file /management/api/rcx_man… |
CVE-2022-2636 | High | 8.5 | 2022-08-05 | Improper Control of Generation of Code ('Code Injection') in GitHub repository hestiacp/hestiacp prior to 1.6.6. |
CVE-2022-2626 | High | 7.2 | 2022-08-05 | Incorrect Privilege Assignment in GitHub repository hestiacp/hestiacp prior to 1.6.6. |
CVE-2022-37434 | Critical | 9.8 | 2022-08-05 | zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications t… |
CVE-2022-37431 | Medium | 6.1 | 2022-08-05 | A Reflected Cross-site scripting (XSS) issue was discovered in dotCMS Core through 22.06. This occurs in the admin portal when the configuration has XSS_PROTEC… |
CVE-2022-37416 | Medium | 6.5 | 2022-08-05 | Ittiam libmpeg2 before 2022-07-27 uses memcpy with overlapping memory blocks in impeg2_mc_fullx_fully_8x8. |
CVE-2022-21186 | Critical | 9.8 | 2022-08-05 | The package @acrontum/filesystem-template before 0.0.2 are vulnerable to Arbitrary Command Injection due to the fetchRepo API missing sanitization of the href… |
CVE-2022-37415 | High | 7.8 | 2022-08-05 | The Uniwill SparkIO.sys driver 1.0 is vulnerable to a stack-based buffer overflow via IOCTL 0x40002008. |
CVE-2022-37030 | High | 7.8 | 2022-08-04 | Weak permissions on the configuration file in the PAM module in Grommunio Gromox 0.5 through 1.x before 1.28 allow a local unprivileged user in the gromox grou… |
CVE-2022-35930 | High | 7.1 | 2022-08-04 | PolicyController is a utility used to enforce supply chain policy in Kubernetes clusters. In versions prior to 0.2.1 PolicyController will report a false posit… |
CVE-2022-31793 | High | 7.5 | 2022-08-04 | do_request in request.c in muhttpd before 1.1.7 allows remote attackers to read arbitrary files by constructing a URL with a single character before a desired… |
CVE-2022-35927 | High | 8.1 | 2022-08-04 | Contiki-NG is an open-source, cross-platform operating system for IoT devices. In the RPL-Classic routing protocol implementation in the Contiki-NG operating s… |
CVE-2022-35926 | Medium | 5.9 | 2022-08-04 | Contiki-NG is an open-source, cross-platform operating system for IoT devices. Because of insufficient validation of IPv6 neighbor discovery options in Contiki… |
CVE-2022-35858 | High | 7.8 | 2022-08-04 | The TEE_PopulateTransientObject and __utee_from_attr functions in Samsung mTower 0.3.0 allow a trusted application to trigger a memory overwrite, denial of ser… |
CVE-2022-35144 | Medium | 4.8 | 2022-08-04 | Renato v0.17.0 was discovered to contain a cross-site scripting (XSS) vulnerability. |
CVE-2022-35143 | Critical | 9.8 | 2022-08-04 | Renato v0.17.0 employs weak password complexity requirements, allowing attackers to crack user passwords via brute-force attacks. |
CVE-2022-35142 | High | 7.5 | 2022-08-04 | An issue in Renato v0.17.0 allows attackers to cause a Denial of Service (DoS) via a crafted payload injected into the Search parameter. |
CVE-2022-35929 | High | 7.1 | 2022-08-04 | cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. `cosign verif… |
CVE-2022-34993 | Critical | 9.8 | 2022-08-04 | Totolink A3600R_Firmware V4.1.2cu.5182_B20201102 contains a hard code password for root in /etc/shadow.sample. |
CVE-2022-34970 | Critical | 9.8 | 2022-08-04 | Crow before 1.0+4 has a heap-based buffer overflow via the function qs_parse in query_string.h. On successful exploitation this vulnerability allows attackers… |
CVE-2022-35735 | High | 7.2 | 2022-08-04 | In BIG-IP Versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, an authenticated attacker with Resource… |
CVE-2022-35728 | High | 8.1 | 2022-08-04 | In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, and BIG-IQ versi… |
CVE-2022-35272 | High | 7.5 | 2022-08-04 | In BIG-IP Versions 17.0.x before 17.0.0.1 and 16.1.x before 16.1.3.1, when source-port preserve-strict is configured on an HTTP Message Routing Framework (MRF)… |
CVE-2022-35245 | High | 7.5 | 2022-08-04 | In BIG-IP Versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5.1, when a BIG-IP APM access policy is configured on a virtual serve… |
CVE-2022-35243 | High | 8.7 | 2022-08-04 | In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.5.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when running in Appliance mode, an authentic… |
CVE-2022-35241 | Medium | 6.5 | 2022-08-04 | In versions 2.x before 2.3.1 and all versions of 1.x, when NGINX Instance Manager is in use, undisclosed requests can cause an increase in disk resource utiliz… |
CVE-2022-35240 | High | 7.5 | 2022-08-04 | In BIG-IP Versions 16.1.x before 16.1.2.2, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when the Message Routing (MR) Message Queuing Telemetry Transport… |
CVE-2022-35236 | High | 7.5 | 2022-08-04 | In BIG-IP Versions 16.1.x before 16.1.2.2, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when an HTTP2 profile is configured on a virtual server, undisclos… |
CVE-2022-34865 | Medium | 4.8 | 2022-08-04 | In BIG-IP Versions 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, Traffic Intelligence feeds, which use HTTPS, do not verify the rem… |
CVE-2022-34862 | High | 7.5 | 2022-08-04 | In BIG-IP Versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when an LTM virtual server is configured t… |
CVE-2022-34851 | Medium | 4.3 | 2022-08-04 | In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, and BIG-IQ Centr… |
CVE-2022-34844 | Medium | 5.9 | 2022-08-04 | In BIG-IP Versions 16.1.x before 16.1.3.1 and 15.1.x before 15.1.6.1, and all versions of BIG-IQ 8.x, when the Data Plane Development Kit (DPDK)/Elastic Networ… |
CVE-2022-34655 | High | 7.5 | 2022-08-04 | In BIG-IP Versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when an iRule containing the HTTP::payload command is configured o… |
CVE-2022-34651 | High | 7.5 | 2022-08-04 | In BIG-IP Versions 16.1.x before 16.1.3.1 and 15.1.x before 15.1.6.1, when an LTM Client or Server SSL profile with TLS 1.3 enabled is configured on a virtual… |
CVE-2022-33968 | Low | 3.7 | 2022-08-04 | In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, when an LTM moni… |
CVE-2022-33962 | Medium | 6.7 | 2022-08-04 | In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, certain iRules c… |
CVE-2022-33947 | Medium | 5.4 | 2022-08-04 | In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, a vulnerability exists in undisclosed pages… |
CVE-2022-33203 | High | 7.5 | 2022-08-04 | In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when a BIG-IP APM access policy with Service Connect agent is config… |
CVE-2022-32455 | High | 7.5 | 2022-08-04 | In BIG-IP Versions 16.1.x before 16.1.2.2, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when a BIG-IP LTM Client SSL profile is co… |
CVE-2022-31473 | Medium | 6.8 | 2022-08-04 | In BIG-IP Versions 16.1.x before 16.1.1 and 15.1.x before 15.1.4, when running in Appliance mode, an authenticated attacker may be able to bypass Appliance mod… |
CVE-2022-31119 | Low | 3.1 | 2022-08-04 | Nextcloud Mail is an email application for the nextcloud personal cloud product. Affected versions of Nextcloud mail would log user passwords to disk in the ev… |
CVE-2022-30535 | Medium | 6.5 | 2022-08-04 | In versions 2.x before 2.3.0 and all versions of 1.x, An attacker authorized to create or update ingress objects can obtain the secrets available to the NGINX… |
CVE-2022-31132 | High | 8.3 | 2022-08-04 | Nextcloud Mail is an email application for the nextcloud personal cloud product. Affected versions shipped with a CSS minifier on the path `./vendor/cerdic/css… |
CVE-2022-31120 | Low | 2.1 | 2022-08-04 | Nextcloud server is an open source personal cloud solution. The audit log is used to get a full trail of the actions which has been incompletely populated. In… |
CVE-2022-31118 | Medium | 6.5 | 2022-08-04 | Nextcloud server is an open source personal cloud solution. In affected versions an attacker could brute force to find if federated sharing is being used and p… |
CVE-2022-25168 | Critical | 9.8 | 2022-08-04 | Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands… |
CVE-2022-2656 | Medium | 6.3 | 2022-08-04 | A vulnerability classified as critical has been found in SourceCodester Multi Language Hotel Management Software. Affected is an unknown function. The manipula… |
CVE-2022-35216 | High | 7.5 | 2022-08-04 | OMICARD EDM’s mail image relay function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to by-pass authen… |
CVE-2022-32965 | Critical | 9.8 | 2022-08-04 | OMICARD EDM has a hard-coded machine key. An unauthenticated remote attacker can use the machine key to send serialized payload to the server to execute arbitr… |
CVE-2022-32964 | Critical | 9.8 | 2022-08-04 | OMICARD EDM’s API function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL commands to access, modify… |
CVE-2022-32963 | High | 7.5 | 2022-08-04 | OMICARD EDM’s mail file relay function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to by-pass authent… |
CVE-2022-2653 | Medium | 6.5 | 2022-08-04 | With this vulnerability an attacker can read many sensitive files like configuration files, or the /proc/self/environ file, that contains the environment varia… |
CVE-2022-2652 | Medium | 6.0 | 2022-08-04 | Depending on the way the format strings in the card label are crafted it's possible to leak kernel stack memory. There is also the possibility for DoS due to t… |
CVE-2022-2651 | Critical | 9.8 | 2022-08-04 | Authentication Bypass by Primary Weakness in GitHub repository bookwyrm-social/bookwyrm prior to 0.4.5. |
CVE-2022-2648 | Medium | 6.3 | 2022-08-04 | A vulnerability was found in SourceCodester Multi Language Hotel Management Software. It has been rated as critical. This issue affects some unknown processing… |
CVE-2022-2647 | High | 7.3 | 2022-08-04 | A vulnerability was found in jeecg-boot. It has been declared as critical. This vulnerability affects unknown code of the file /api/. The manipulation of the a… |
CVE-2022-2646 | Low | 3.5 | 2022-08-04 | A vulnerability, which was classified as problematic, was found in SourceCodester Online Admission System. Affected is an unknown function of the file index.ph… |
CVE-2022-2645 | Low | 3.5 | 2022-08-04 | A vulnerability has been found in SourceCodester Garage Management System and classified as problematic. Affected by this vulnerability is an unknown functiona… |
CVE-2022-2644 | Medium | 5.5 | 2022-08-04 | A vulnerability was found in SourceCodester Online Admission System and classified as critical. This issue affects some unknown processing of the component GET… |
CVE-2022-2643 | Medium | 6.3 | 2022-08-04 | A vulnerability has been found in SourceCodester Online Admission System and classified as critical. This vulnerability affects unknown code of the component P… |
CVE-2022-34158 | High | 8.8 | 2022-08-04 | A carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow a group privilege esc… |
CVE-2022-28732 | Medium | 6.1 | 2022-08-04 | A carefully crafted request on WeblogPlugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the v… |
CVE-2022-28731 | Medium | 6.5 | 2022-08-04 | A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modif… |
CVE-2022-28730 | Medium | 6.1 | 2022-08-04 | A carefully crafted request on AJAXPreview.jsp could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in th… |
CVE-2022-27166 | Medium | 6.1 | 2022-08-04 | A carefully crafted request on XHRHtml2Markup.jsp could trigger an XSS vulnerability on Apache JSPWiki up to and including 2.11.2, which could allow the attack… |
CVE-2022-35506 | High | 7.5 | 2022-08-03 | TripleCross v0.1.0 was discovered to contain a stack overflow which occurs because there is no limit to the length of program parameters. |
CVE-2022-35505 | High | 7.5 | 2022-08-03 | A segmentation fault in TripleCross v0.1.0 occurs when sending a control command from the client to the server. This occurs because there is no limit to the le… |
CVE-2022-35161 | Critical | 9.8 | 2022-08-03 | GVRET Stable Release as of Aug 15, 2015 was discovered to contain a buffer overflow via the handleConfigCmd function at SerialConsole.cpp. |
CVE-2022-35158 | High | 7.5 | 2022-08-03 | A vulnerability in the lua parser of TscanCode tsclua v2.15.01 allows attackers to cause a Denial of Service (DoS) via a crafted lua script. |
CVE-2022-35928 | High | 8.4 | 2022-08-03 | AES Crypt is a file encryption software for multiple platforms. AES Crypt for Linux built using the source on GitHub and having the version number 3.11 has a v… |
CVE-2022-27551 | Medium | 5.3 | 2022-08-03 | HCL Launch could allow an authenticated user to obtain sensitive information in some instances due to improper security checking. |
CVE-2022-31197 | High | 7.1 | 2022-08-03 | PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. The PGJDBC i… |
CVE-2022-31175 | Medium | 5.8 | 2022-08-03 | CKEditor 5 is a JavaScript rich text editor. A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages in version… |
CVE-2022-34992 | High | 7.8 | 2022-08-03 | Luadec v0.9.9 was discovered to contain a heap-buffer overflow via the function UnsetPending. |
CVE-2022-37396 | Medium | 4.1 | 2022-08-03 | In JetBrains Rider before 2022.2 Trust and Open Project dialog could be bypassed, leading to local code execution |
CVE-2022-35867 | Medium | 6.7 | 2022-08-03 | This vulnerability allows local attackers to escalate privileges on affected installations of xhyve. An attacker must first obtain the ability to execute high-… |