2022 CVEs (page 165)
Page 165 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-27621 | Medium | 5.5 | 2022-08-03 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology USB Copy before 2.2.0-1086 allows… |
CVE-2022-36800 | Medium | 4.3 | 2022-08-03 | Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers without the "Browse Users" permission to view groups via a… |
CVE-2022-27620 | Medium | 6.8 | 2022-08-03 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology SSO Server before 2.2.3-0331 allow… |
CVE-2022-27619 | Medium | 6.8 | 2022-08-03 | Cleartext transmission of sensitive information vulnerability in authentication management in Synology Note Station Client before 2.2.2-609 allows man-in-the-m… |
CVE-2022-27618 | Medium | 6.8 | 2022-08-03 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Storage Analyzer before 2.1.0-0390… |
CVE-2022-27617 | Medium | 5.0 | 2022-08-03 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Calendar before 2.3.4-0631 allows… |
CVE-2022-34969 | High | 7.5 | 2022-08-03 | PingCAP TiDB v6.1.0 was discovered to contain a NULL pointer dereference. |
CVE-2022-34968 | High | 7.5 | 2022-08-03 | An issue in the fetch_step function in Percona Server for MySQL v8.0.28-19 allows attackers to cause a Denial of Service (DoS) via a SQL query. |
CVE-2022-34967 | High | 7.5 | 2022-08-03 | The assertion `stmt->Dbc->FirstStmt' failed in MonetDB Database Server v11.43.13. |
CVE-2022-27616 | High | 7.2 | 2022-08-03 | Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in webapi component in Synology DiskStation Manager (D… |
CVE-2022-36197 | Medium | 5.4 | 2022-08-03 | BigTree CMS 4.4.16 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted PDF file. |
CVE-2022-34937 | High | 8.8 | 2022-08-03 | Yuba u5cms v8.3.5 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component savepage.php. This vulnerability allows attackers to execute… |
CVE-2022-34928 | High | 8.8 | 2022-08-03 | JFinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via /system/user. |
CVE-2022-34927 | High | 7.8 | 2022-08-03 | MilkyTracker v1.03.00 was discovered to contain a stack overflow via the component LoaderXM::load. This vulnerability is triggered when the program is supplied… |
CVE-2022-37035 | High | 8.1 | 2022-08-02 | An issue was discovered in bgpd in FRRouting (FRR) 8.3. In bgp_notify_send_with_data() and bgp_process_packet() in bgp_packet.c, there is a possible use-after-… |
CVE-2022-33917 | Medium | 5.5 | 2022-08-02 | An issue was discovered in the Arm Mali GPU Kernel Driver (Valhall r29p0 through r38p0). A non-privileged user can make improper GPU processing operations to g… |
CVE-2022-36968 | Medium | 4.3 | 2022-08-02 | In Progress WS_FTP Server prior to version 8.7.3, forms within the administrative interface did not include a nonce to mitigate the risk of cross-site request… |
CVE-2022-36967 | Medium | 6.1 | 2022-08-02 | In Progress WS_FTP Server prior to version 8.7.3, multiple reflected cross-site scripting (XSS) vulnerabilities exist in the administrative web interface. It i… |
CVE-2022-34619 | Medium | 5.4 | 2022-08-02 | A stored cross-site scripting (XSS) vulnerability in Mealie v0.5.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected int… |
CVE-2022-30285 | Critical | 9.8 | 2022-08-02 | In Quest KACE Systems Management Appliance (SMA) through 12.0, a hash collision is possible during authentication. This may allow authentication with invalid c… |
CVE-2022-29808 | High | 7.5 | 2022-08-02 | In Quest KACE Systems Management Appliance (SMA) through 12.0, predictable token generation occurs when appliance linking is enabled. |
CVE-2022-29807 | Critical | 9.8 | 2022-08-02 | A SQL injection vulnerability exists within Quest KACE Systems Management Appliance (SMA) through 12.0 that can allow for remote code execution via download_ag… |
CVE-2022-35925 | Medium | 5.3 | 2022-08-02 | BookWyrm is a social network for tracking reading. Versions prior to 0.4.5 were found to lack rate limiting on authentication views which allows brute-force at… |
CVE-2022-35923 | High | 7.5 | 2022-08-02 | v8n is a javascript validation library. Versions of v8n prior to 1.5.1 were found to have an inefficient regular expression complexity in the `lowercase()` and… |
CVE-2022-34924 | High | 7.5 | 2022-08-02 | Lanling OA Landray Office Automation (OA) internal patch number #133383/#137780 contains an arbitrary file read vulnerability via the component /sys/ui/extend/… |
CVE-2022-35924 | Critical | 9.1 | 2022-08-02 | NextAuth.js is a complete open source authentication solution for Next.js applications. `next-auth` users who are using the `EmailProvider` either in versions… |
CVE-2022-30572 | Medium | 6.5 | 2022-08-02 | The iWay Service Manager Console component of TIBCO Software Inc.'s TIBCO iWay Service Manager contains an easily exploitable Directory Traversal vulnerability… |
CVE-2022-30571 | High | 8.1 | 2022-08-02 | The iWay Service Manager Console component of TIBCO Software Inc.'s TIBCO iWay Service Manager contains easily exploitable Reflected Cross Site Scripting (XSS)… |
CVE-2022-2631 | High | 8.8 | 2022-08-02 | Improper Access Control in GitHub repository tooljet/tooljet prior to v1.19.0. |
CVE-2022-35223 | Critical | 9.8 | 2022-08-02 | EasyUse MailHunter Ultimate’s cookie deserialization function has an inadequate validation vulnerability. Deserializing a cookie containing malicious payload w… |
CVE-2022-35222 | Medium | 6.8 | 2022-08-02 | HiCOS Citizen verification component has a stack-based buffer overflow vulnerability due to insufficient parameter length validation. An unauthenticated physic… |
CVE-2022-35221 | Medium | 5.4 | 2022-08-02 | Teamplus Pro community discussion has an ‘allocation of resource without limits or throttling’ vulnerability on thread subject field. A remote attacker with ge… |
CVE-2022-35220 | High | 7.7 | 2022-08-02 | Teamplus Pro community discussion function has an ‘allocation of resource without limits or throttling’ vulnerability. A remote attacker with general user priv… |
CVE-2022-35219 | Medium | 5.5 | 2022-08-02 | The NHI card’s web service component has a stack-based buffer overflow vulnerability due to insufficient validation for network packet key parameter. A LAN att… |
CVE-2022-35218 | Medium | 5.5 | 2022-08-02 | The NHI card’s web service component has a heap-based buffer overflow vulnerability due to insufficient validation for packet origin parameter length. A LAN at… |
CVE-2022-35217 | High | 7.8 | 2022-08-02 | The NHI card’s web service component has a stack-based buffer overflow vulnerability due to insufficient validation for network packet header length. A local a… |
CVE-2022-34625 | High | 7.2 | 2022-08-02 | Mealie1.0.0beta3 was discovered to contain a Server-Side Template Injection vulnerability, which allows attackers to execute arbitrary code via a crafted Jinja… |
CVE-2022-23733 | Medium | 5.4 | 2022-08-02 | A stored XSS vulnerability was identified in GitHub Enterprise Server that allowed the injection of arbitrary attributes. This injection was blocked by Github'… |
CVE-2022-1293 | Medium | 5.7 | 2022-08-02 | The embedded neutralization of Script-Related HTML Tag, was by-passed in the case of some extra conditions. |
CVE-2022-34618 | Medium | 5.4 | 2022-08-02 | A stored cross-site scripting (XSS) vulnerability in Mealie 1.0.0beta3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected… |
CVE-2022-34613 | Critical | 9.8 | 2022-08-02 | Mealie 1.0.0beta3 contains an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted file. |
CVE-2022-29154 | High | 7.4 | 2022-08-02 | An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The ser… |
CVE-2022-25867 | High | 7.5 | 2022-08-02 | The package io.socket:socket.io-client before 2.0.1 are vulnerable to NULL Pointer Dereference when parsing a packet with with invalid payload format. |
CVE-2022-35422 | Critical | 9.8 | 2022-08-02 | Web Based Quiz System v1.0 was discovered to contain a SQL injection vulnerability via the qid parameter at update.php. |
CVE-2022-35421 | High | 7.2 | 2022-08-02 | Online Tours And Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the pname parameter at /admin/operations/packages.p… |
CVE-2022-34956 | Critical | 9.8 | 2022-08-02 | Pligg CMS v2.0.2 was discovered to contain a time-based SQL injection vulnerability via the page_size parameter at load_data_for_groups.php. |
CVE-2022-34955 | Critical | 9.8 | 2022-08-02 | Pligg CMS v2.0.2 was discovered to contain a time-based SQL injection vulnerability via the page_size parameter at load_data_for_topusers.php. |
CVE-2022-34954 | Critical | 9.8 | 2022-08-02 | Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at invoiceprint.php. |
CVE-2022-34953 | Critical | 9.8 | 2022-08-02 | Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the startDate parameter at getOrderReport.php. |
CVE-2022-34952 | Critical | 9.8 | 2022-08-02 | Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at edituser.php. |
CVE-2022-34951 | Critical | 9.8 | 2022-08-02 | Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the startDate parameter at getsalereport.php. |
CVE-2022-34950 | Critical | 9.8 | 2022-08-02 | Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at editproduct.php. |
CVE-2022-34949 | Critical | 9.8 | 2022-08-02 | Pharmacy Management System v1.0 was discovered to contain multiple SQL injection vulnerabilities via the email or password parameter at login.php. |
CVE-2022-34948 | Critical | 9.8 | 2022-08-02 | Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at editbrand.php. |
CVE-2022-34947 | Critical | 9.8 | 2022-08-02 | Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at editcategory.php. |
CVE-2022-34946 | Critical | 9.8 | 2022-08-02 | Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the startDate parameter at getexpproduct.php. |
CVE-2022-34945 | Critical | 9.8 | 2022-08-02 | Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the startDate parameter at getproductreport.php. |
CVE-2022-37315 | High | 7.5 | 2022-08-01 | graphql-go (aka GraphQL for Go) through 0.8.0 has infinite recursion in the type definition parser. |
CVE-2022-35922 | High | 7.5 | 2022-08-01 | Rust-WebSocket is a WebSocket (RFC6455) library written in Rust. In versions prior to 0.26.5 untrusted websocket connections can cause an out-of-memory (OOM) p… |
CVE-2022-35921 | Low | 3.5 | 2022-08-01 | fof/byobu is a private discussions extension for Flarum forum. Affected versions were found to not respect private discussion disablement by users. Users of By… |
CVE-2022-35920 | High | 8.3 | 2022-08-01 | Sanic is an opensource python web server/framework. Affected versions of sanic allow access to lateral directories when using `app.static` if using encoded `%2… |
CVE-2022-35919 | High | 7.4 | 2022-08-01 | MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. In affected versions all 'admin' users authorized for `admin… |
CVE-2022-35918 | Medium | 6.5 | 2022-08-01 | Streamlit is a data oriented application development framework for python. Users hosting Streamlit app(s) that use custom components are vulnerable to a direct… |
CVE-2022-35917 | Medium | 5.3 | 2022-08-01 | Solana Pay is a protocol and set of reference implementations that enable developers to incorporate decentralized payments into their apps and services. When a… |
CVE-2022-35916 | Medium | 5.3 | 2022-08-01 | OpenZeppelin Contracts is a library for secure smart contract development. Contracts using the cross chain utilities for Arbitrum L2, `CrossChainEnabledArbitru… |
CVE-2022-35915 | Medium | 5.3 | 2022-08-01 | OpenZeppelin Contracts is a library for secure smart contract development. The target contract of an EIP-165 `supportsInterface` query can cause unbounded gas… |
CVE-2022-31198 | High | 7.5 | 2022-08-01 | OpenZeppelin Contracts is a library for secure smart contract development. This issue concerns instances of Governor that use the module `GovernorVotesQuorumFr… |
CVE-2022-31195 | High | 7.2 | 2022-08-01 | DSpace open source software is a repository application which provides durable access to digital resources. In affected versions the ItemImportServiceImpl is v… |
CVE-2022-31194 | High | 8.2 | 2022-08-01 | DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPU… |
CVE-2022-31193 | High | 7.1 | 2022-08-01 | DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPU… |
CVE-2022-31192 | High | 7.1 | 2022-08-01 | DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPU… |
CVE-2022-31191 | High | 7.1 | 2022-08-01 | DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPU… |
CVE-2022-31189 | Medium | 5.3 | 2022-08-01 | DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. When an… |
CVE-2022-35118 | Medium | 6.1 | 2022-08-01 | PyroCMS v3.9 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities. |
CVE-2022-34530 | Medium | 5.3 | 2022-08-01 | An issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows attackers to enumerate usernames via password reset requests and distinct… |
CVE-2022-31321 | Critical | 9.1 | 2022-08-01 | The foldername parameter in Bolt 5.1.7 was discovered to have incorrect input validation, allowing attackers to perform directory enumeration or cause a Denial… |
CVE-2022-31190 | Medium | 5.3 | 2022-08-01 | DSpace open source software is a repository application which provides durable access to digital resources. dspace-xmlui is a UI component for DSpace. In affec… |
CVE-2022-31188 | High | 8.6 | 2022-08-01 | CVAT is an opensource interactive video and image annotation tool for computer vision. Versions prior to 2.0.0 were found to be subject to a Server-side reques… |
CVE-2022-31186 | Low | 3.3 | 2022-08-01 | NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in `next-auth` before `v4.10.2`… |
CVE-2022-31185 | Medium | 5.3 | 2022-08-01 | mprweb is a hosting platform for the makedeb Package Repository. Email addresses were found to not have been hidden, even if a user had clicked the `Hide Email… |
CVE-2022-31184 | Medium | 6.5 | 2022-08-01 | Discourse is the an open source discussion platform. In affected versions an email activation route can be abused to send mass spam emails. A fix has been incl… |
CVE-2022-31183 | Critical | 9.1 | 2022-08-01 | fs2 is a compositional, streaming I/O library for Scala. When establishing a server-mode `TLSSocket` using `fs2-io` on Node.js, the parameter `requestCert = tr… |
CVE-2022-31182 | Medium | 5.3 | 2022-08-01 | Discourse is the an open source discussion platform. In affected versions a maliciously crafted request for static assets could cause error responses to be cac… |
CVE-2022-31181 | Critical | 9.8 | 2022-08-01 | PrestaShop is an Open Source e-commerce platform. In versions from 1.6.0.10 and before 1.7.8.7 PrestaShop is subject to an SQL injection vulnerability which ca… |
CVE-2022-31180 | Critical | 9.8 | 2022-08-01 | Shescape is a simple shell escape package for JavaScript. Affected versions were found to have insufficient escaping of white space when interpolating output… |
CVE-2022-31179 | High | 8.1 | 2022-08-01 | Shescape is a simple shell escape package for JavaScript. Versions prior to 1.5.8 were found to be subject to code injection on windows. This impacts users tha… |
CVE-2022-31178 | Medium | 4.3 | 2022-08-01 | eLabFTW is an electronic lab notebook manager for research teams. A vulnerability was discovered which allows a logged in user to read a template without being… |
CVE-2022-31177 | Low | 2.7 | 2022-08-01 | Flask-AppBuilder is an application development framework built on top of Flask python framework. In versions prior to 4.1.3 an authenticated Admin user could q… |
CVE-2022-31173 | High | 7.5 | 2022-08-01 | Juniper is a GraphQL server library for Rust. Affected versions of Juniper are vulnerable to uncontrolled recursion resulting in a program crash. This issue ha… |
CVE-2022-31155 | Medium | 4.3 | 2022-08-01 | Sourcegraph is an opensource code search and navigation engine. In Sourcegraph versions before 3.41.0, it is possible for an attacker to delete other users’ sa… |
CVE-2022-31154 | Medium | 6.4 | 2022-08-01 | Sourcegraph is an opensource code search and navigation engine. It is possible for an authenticated Sourcegraph user to edit the Code Monitors owned by any oth… |
CVE-2022-31148 | Medium | 5.4 | 2022-08-01 | Shopware is an open source e-commerce software. In versions from 5.7.0 a persistent cross site scripting (XSS) vulnerability exists in the customer module. Use… |
CVE-2022-31128 | Medium | 5.4 | 2022-08-01 | Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affected versions Tuleap does not properly verify per… |
CVE-2022-31109 | High | 7.2 | 2022-08-01 | laminas-diactoros is a PHP package containing implementations of the PSR-7 HTTP message interfaces and PSR-17 HTTP message factory interfaces. Applications tha… |
CVE-2022-34307 | Medium | 4.3 | 2022-08-01 | IBM CICS TX 11.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http… |
CVE-2022-34164 | Medium | 5.5 | 2022-08-01 | IBM CICS TX 11.1 could allow a local user to impersonate another legitimate user due to improper input validation. IBM X-Force ID: 229338. |
CVE-2022-34163 | Medium | 6.1 | 2022-08-01 | IBM CICS TX 11.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct va… |
CVE-2022-34162 | Medium | 6.1 | 2022-08-01 | IBM CICS TX 11.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote atta… |
CVE-2022-34161 | High | 8.8 | 2022-08-01 | IBM CICS TX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a use… |
CVE-2022-33955 | Medium | 6.8 | 2022-08-01 | IBM CICS TX 11.1 could allow allow an attacker with physical access to the system to execute code due using a back and refresh attack. IBM X-Force ID: 229312. |