2022 CVEs (page 165)
Page 165 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-35866 | Critical | 9.8 | 2022-08-03 | This vulnerability allows remote attackers to bypass authentication on affected installations of Vinchin Backup and Recovery 6.5.0.17561. Authentication is not… |
CVE-2022-35865 | Critical | 9.8 | 2022-08-03 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of BMC Track-It! 20.21.2.109. Authentication is not required to… |
CVE-2022-35864 | Medium | 6.5 | 2022-08-03 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of BMC Track-It! 20.21.02.109. Authentication is require… |
CVE-2022-34872 | Medium | 6.5 | 2022-08-03 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Centreon. Authentication is required to exploit this… |
CVE-2022-34871 | High | 7.2 | 2022-08-03 | This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerabili… |
CVE-2022-2272 | Critical | 9.8 | 2022-08-03 | This vulnerability allows remote attackers to bypass authentication on affected installations of Sante PACS Server 3.0.4. Authentication is not required to exp… |
CVE-2022-28684 | High | 8.8 | 2022-08-03 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of DevExpress. Authentication is required to exploit this vulner… |
CVE-2022-28668 | High | 7.8 | 2022-08-03 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 11.9.2. User interaction is required t… |
CVE-2022-35620 | Critical | 9.8 | 2022-08-03 | D-LINK DIR-818LW A1:DIR818L_FW105b01 was discovered to contain a remote code execution (RCE) vulnerability via the function binary.soapcgi_main. |
CVE-2022-35619 | Critical | 9.8 | 2022-08-03 | D-LINK DIR-818LW A1:DIR818L_FW105b01 was discovered to contain a remote code execution (RCE) vulnerability via the function ssdpcgi_main. |
CVE-2022-34974 | Critical | 9.8 | 2022-08-03 | D-Link DIR810LA1_FW102B22 was discovered to contain a command injection vulnerability via the Ping_addr function. |
CVE-2022-34973 | High | 7.5 | 2022-08-03 | D-Link DIR820LA1_FW106B02 was discovered to contain a buffer overflow via the nextPage parameter at ping.ccp. |
CVE-2022-36359 | High | 8.8 | 2022-08-03 | An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file downl… |
CVE-2022-32293 | High | 8.1 | 2022-08-03 | In ConnMan through 1.41, a man-in-the-middle attack against a WISPR HTTP query could be used to trigger a use-after-free in WISPR handling, leading to crashes… |
CVE-2022-32292 | Critical | 9.8 | 2022-08-03 | In ConnMan through 1.41, remote attackers able to send HTTP requests to the gweb component are able to exploit a heap-based buffer overflow in received_data to… |
CVE-2022-27484 | Medium | 5.4 | 2022-08-03 | A unverified password change in Fortinet FortiADC version 6.2.0 through 6.2.3, 6.1.x, 6.0.x, 5.x.x allows an authenticated attacker to bypass the Old Password… |
CVE-2022-23442 | Medium | 4.3 | 2022-08-03 | An improper access control vulnerability [CWE-284] in FortiOS versions 6.2.0 through 6.2.11, 6.4.0 through 6.4.8 and 7.0.0 through 7.0.5 may allow an authentic… |
CVE-2022-37394 | Low | 3.3 | 2022-08-03 | An issue was discovered in OpenStack Nova before 23.2.2, 24.x before 24.1.2, and 25.x before 25.0.2. By creating a neutron port with the direct vnic_type, crea… |
CVE-2022-35737 | High | 7.5 | 2022-08-03 | SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API. |
CVE-2022-27621 | Medium | 5.5 | 2022-08-03 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology USB Copy before 2.2.0-1086 allows… |
CVE-2022-36800 | Medium | 4.3 | 2022-08-03 | Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers without the "Browse Users" permission to view groups via a… |
CVE-2022-27620 | Medium | 6.8 | 2022-08-03 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology SSO Server before 2.2.3-0331 allow… |
CVE-2022-27619 | Medium | 6.8 | 2022-08-03 | Cleartext transmission of sensitive information vulnerability in authentication management in Synology Note Station Client before 2.2.2-609 allows man-in-the-m… |
CVE-2022-27618 | Medium | 6.8 | 2022-08-03 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Storage Analyzer before 2.1.0-0390… |
CVE-2022-27617 | Medium | 5.0 | 2022-08-03 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Calendar before 2.3.4-0631 allows… |
CVE-2022-34969 | High | 7.5 | 2022-08-03 | PingCAP TiDB v6.1.0 was discovered to contain a NULL pointer dereference. |
CVE-2022-34968 | High | 7.5 | 2022-08-03 | An issue in the fetch_step function in Percona Server for MySQL v8.0.28-19 allows attackers to cause a Denial of Service (DoS) via a SQL query. |
CVE-2022-34967 | High | 7.5 | 2022-08-03 | The assertion `stmt->Dbc->FirstStmt' failed in MonetDB Database Server v11.43.13. |
CVE-2022-27616 | High | 7.2 | 2022-08-03 | Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in webapi component in Synology DiskStation Manager (D… |
CVE-2022-36197 | Medium | 5.4 | 2022-08-03 | BigTree CMS 4.4.16 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted PDF file. |
CVE-2022-34937 | High | 8.8 | 2022-08-03 | Yuba u5cms v8.3.5 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component savepage.php. This vulnerability allows attackers to execute… |
CVE-2022-34928 | High | 8.8 | 2022-08-03 | JFinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via /system/user. |
CVE-2022-34927 | High | 7.8 | 2022-08-03 | MilkyTracker v1.03.00 was discovered to contain a stack overflow via the component LoaderXM::load. This vulnerability is triggered when the program is supplied… |
CVE-2022-37035 | High | 8.1 | 2022-08-02 | An issue was discovered in bgpd in FRRouting (FRR) 8.3. In bgp_notify_send_with_data() and bgp_process_packet() in bgp_packet.c, there is a possible use-after-… |
CVE-2022-33917 | Medium | 5.5 | 2022-08-02 | An issue was discovered in the Arm Mali GPU Kernel Driver (Valhall r29p0 through r38p0). A non-privileged user can make improper GPU processing operations to g… |
CVE-2022-36968 | Medium | 4.3 | 2022-08-02 | In Progress WS_FTP Server prior to version 8.7.3, forms within the administrative interface did not include a nonce to mitigate the risk of cross-site request… |
CVE-2022-36967 | Medium | 6.1 | 2022-08-02 | In Progress WS_FTP Server prior to version 8.7.3, multiple reflected cross-site scripting (XSS) vulnerabilities exist in the administrative web interface. It i… |
CVE-2022-34619 | Medium | 5.4 | 2022-08-02 | A stored cross-site scripting (XSS) vulnerability in Mealie v0.5.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected int… |
CVE-2022-30285 | Critical | 9.8 | 2022-08-02 | In Quest KACE Systems Management Appliance (SMA) through 12.0, a hash collision is possible during authentication. This may allow authentication with invalid c… |
CVE-2022-29808 | High | 7.5 | 2022-08-02 | In Quest KACE Systems Management Appliance (SMA) through 12.0, predictable token generation occurs when appliance linking is enabled. |
CVE-2022-29807 | Critical | 9.8 | 2022-08-02 | A SQL injection vulnerability exists within Quest KACE Systems Management Appliance (SMA) through 12.0 that can allow for remote code execution via download_ag… |
CVE-2022-35925 | Medium | 5.3 | 2022-08-02 | BookWyrm is a social network for tracking reading. Versions prior to 0.4.5 were found to lack rate limiting on authentication views which allows brute-force at… |
CVE-2022-35923 | High | 7.5 | 2022-08-02 | v8n is a javascript validation library. Versions of v8n prior to 1.5.1 were found to have an inefficient regular expression complexity in the `lowercase()` and… |
CVE-2022-34924 | High | 7.5 | 2022-08-02 | Lanling OA Landray Office Automation (OA) internal patch number #133383/#137780 contains an arbitrary file read vulnerability via the component /sys/ui/extend/… |
CVE-2022-35924 | Critical | 9.1 | 2022-08-02 | NextAuth.js is a complete open source authentication solution for Next.js applications. `next-auth` users who are using the `EmailProvider` either in versions… |
CVE-2022-30572 | Medium | 6.5 | 2022-08-02 | The iWay Service Manager Console component of TIBCO Software Inc.'s TIBCO iWay Service Manager contains an easily exploitable Directory Traversal vulnerability… |
CVE-2022-30571 | High | 8.1 | 2022-08-02 | The iWay Service Manager Console component of TIBCO Software Inc.'s TIBCO iWay Service Manager contains easily exploitable Reflected Cross Site Scripting (XSS)… |
CVE-2022-2631 | High | 8.8 | 2022-08-02 | Improper Access Control in GitHub repository tooljet/tooljet prior to v1.19.0. |
CVE-2022-35223 | Critical | 9.8 | 2022-08-02 | EasyUse MailHunter Ultimate’s cookie deserialization function has an inadequate validation vulnerability. Deserializing a cookie containing malicious payload w… |
CVE-2022-35222 | Medium | 6.8 | 2022-08-02 | HiCOS Citizen verification component has a stack-based buffer overflow vulnerability due to insufficient parameter length validation. An unauthenticated physic… |
CVE-2022-35221 | Medium | 5.4 | 2022-08-02 | Teamplus Pro community discussion has an ‘allocation of resource without limits or throttling’ vulnerability on thread subject field. A remote attacker with ge… |
CVE-2022-35220 | High | 7.7 | 2022-08-02 | Teamplus Pro community discussion function has an ‘allocation of resource without limits or throttling’ vulnerability. A remote attacker with general user priv… |
CVE-2022-35219 | Medium | 5.5 | 2022-08-02 | The NHI card’s web service component has a stack-based buffer overflow vulnerability due to insufficient validation for network packet key parameter. A LAN att… |
CVE-2022-35218 | Medium | 5.5 | 2022-08-02 | The NHI card’s web service component has a heap-based buffer overflow vulnerability due to insufficient validation for packet origin parameter length. A LAN at… |
CVE-2022-35217 | High | 7.8 | 2022-08-02 | The NHI card’s web service component has a stack-based buffer overflow vulnerability due to insufficient validation for network packet header length. A local a… |
CVE-2022-34625 | High | 7.2 | 2022-08-02 | Mealie1.0.0beta3 was discovered to contain a Server-Side Template Injection vulnerability, which allows attackers to execute arbitrary code via a crafted Jinja… |
CVE-2022-23733 | Medium | 5.4 | 2022-08-02 | A stored XSS vulnerability was identified in GitHub Enterprise Server that allowed the injection of arbitrary attributes. This injection was blocked by Github'… |
CVE-2022-1293 | Medium | 5.7 | 2022-08-02 | The embedded neutralization of Script-Related HTML Tag, was by-passed in the case of some extra conditions. |
CVE-2022-34618 | Medium | 5.4 | 2022-08-02 | A stored cross-site scripting (XSS) vulnerability in Mealie 1.0.0beta3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected… |
CVE-2022-34613 | Critical | 9.8 | 2022-08-02 | Mealie 1.0.0beta3 contains an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted file. |
CVE-2022-29154 | High | 7.4 | 2022-08-02 | An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The ser… |
CVE-2022-25867 | High | 7.5 | 2022-08-02 | The package io.socket:socket.io-client before 2.0.1 are vulnerable to NULL Pointer Dereference when parsing a packet with with invalid payload format. |
CVE-2022-35422 | Critical | 9.8 | 2022-08-02 | Web Based Quiz System v1.0 was discovered to contain a SQL injection vulnerability via the qid parameter at update.php. |
CVE-2022-35421 | High | 7.2 | 2022-08-02 | Online Tours And Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the pname parameter at /admin/operations/packages.p… |
CVE-2022-34956 | Critical | 9.8 | 2022-08-02 | Pligg CMS v2.0.2 was discovered to contain a time-based SQL injection vulnerability via the page_size parameter at load_data_for_groups.php. |
CVE-2022-34955 | Critical | 9.8 | 2022-08-02 | Pligg CMS v2.0.2 was discovered to contain a time-based SQL injection vulnerability via the page_size parameter at load_data_for_topusers.php. |
CVE-2022-34954 | Critical | 9.8 | 2022-08-02 | Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at invoiceprint.php. |
CVE-2022-34953 | Critical | 9.8 | 2022-08-02 | Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the startDate parameter at getOrderReport.php. |
CVE-2022-34952 | Critical | 9.8 | 2022-08-02 | Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at edituser.php. |
CVE-2022-34951 | Critical | 9.8 | 2022-08-02 | Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the startDate parameter at getsalereport.php. |
CVE-2022-34950 | Critical | 9.8 | 2022-08-02 | Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at editproduct.php. |
CVE-2022-34949 | Critical | 9.8 | 2022-08-02 | Pharmacy Management System v1.0 was discovered to contain multiple SQL injection vulnerabilities via the email or password parameter at login.php. |
CVE-2022-34948 | Critical | 9.8 | 2022-08-02 | Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at editbrand.php. |
CVE-2022-34947 | Critical | 9.8 | 2022-08-02 | Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at editcategory.php. |
CVE-2022-34946 | Critical | 9.8 | 2022-08-02 | Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the startDate parameter at getexpproduct.php. |
CVE-2022-34945 | Critical | 9.8 | 2022-08-02 | Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the startDate parameter at getproductreport.php. |
CVE-2022-37315 | High | 7.5 | 2022-08-01 | graphql-go (aka GraphQL for Go) through 0.8.0 has infinite recursion in the type definition parser. |
CVE-2022-35922 | High | 7.5 | 2022-08-01 | Rust-WebSocket is a WebSocket (RFC6455) library written in Rust. In versions prior to 0.26.5 untrusted websocket connections can cause an out-of-memory (OOM) p… |
CVE-2022-35921 | Low | 3.5 | 2022-08-01 | fof/byobu is a private discussions extension for Flarum forum. Affected versions were found to not respect private discussion disablement by users. Users of By… |
CVE-2022-35920 | High | 8.3 | 2022-08-01 | Sanic is an opensource python web server/framework. Affected versions of sanic allow access to lateral directories when using `app.static` if using encoded `%2… |
CVE-2022-35919 | High | 7.4 | 2022-08-01 | MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. In affected versions all 'admin' users authorized for `admin… |
CVE-2022-35918 | Medium | 6.5 | 2022-08-01 | Streamlit is a data oriented application development framework for python. Users hosting Streamlit app(s) that use custom components are vulnerable to a direct… |
CVE-2022-35917 | Medium | 5.3 | 2022-08-01 | Solana Pay is a protocol and set of reference implementations that enable developers to incorporate decentralized payments into their apps and services. When a… |
CVE-2022-35916 | Medium | 5.3 | 2022-08-01 | OpenZeppelin Contracts is a library for secure smart contract development. Contracts using the cross chain utilities for Arbitrum L2, `CrossChainEnabledArbitru… |
CVE-2022-35915 | Medium | 5.3 | 2022-08-01 | OpenZeppelin Contracts is a library for secure smart contract development. The target contract of an EIP-165 `supportsInterface` query can cause unbounded gas… |
CVE-2022-31198 | High | 7.5 | 2022-08-01 | OpenZeppelin Contracts is a library for secure smart contract development. This issue concerns instances of Governor that use the module `GovernorVotesQuorumFr… |
CVE-2022-31195 | High | 7.2 | 2022-08-01 | DSpace open source software is a repository application which provides durable access to digital resources. In affected versions the ItemImportServiceImpl is v… |
CVE-2022-31194 | High | 8.2 | 2022-08-01 | DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPU… |
CVE-2022-31193 | High | 7.1 | 2022-08-01 | DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPU… |
CVE-2022-31192 | High | 7.1 | 2022-08-01 | DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPU… |
CVE-2022-31191 | High | 7.1 | 2022-08-01 | DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPU… |
CVE-2022-31189 | Medium | 5.3 | 2022-08-01 | DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. When an… |
CVE-2022-35118 | Medium | 6.1 | 2022-08-01 | PyroCMS v3.9 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities. |
CVE-2022-34530 | Medium | 5.3 | 2022-08-01 | An issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows attackers to enumerate usernames via password reset requests and distinct… |
CVE-2022-31321 | Critical | 9.1 | 2022-08-01 | The foldername parameter in Bolt 5.1.7 was discovered to have incorrect input validation, allowing attackers to perform directory enumeration or cause a Denial… |
CVE-2022-31190 | Medium | 5.3 | 2022-08-01 | DSpace open source software is a repository application which provides durable access to digital resources. dspace-xmlui is a UI component for DSpace. In affec… |
CVE-2022-31188 | High | 8.6 | 2022-08-01 | CVAT is an opensource interactive video and image annotation tool for computer vision. Versions prior to 2.0.0 were found to be subject to a Server-side reques… |
CVE-2022-31186 | Low | 3.3 | 2022-08-01 | NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in `next-auth` before `v4.10.2`… |
CVE-2022-31185 | Medium | 5.3 | 2022-08-01 | mprweb is a hosting platform for the makedeb Package Repository. Email addresses were found to not have been hidden, even if a user had clicked the `Hide Email… |
CVE-2022-31184 | Medium | 6.5 | 2022-08-01 | Discourse is the an open source discussion platform. In affected versions an email activation route can be abused to send mass spam emails. A fix has been incl… |