2022 CVEs (page 168)
Page 168 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-1874 | High | 8.8 | 2022-07-27 | Insufficient policy enforcement in Safe Browsing in Google Chrome on Mac prior to 102.0.5005.61 allowed a remote attacker to bypass downloads protection policy… |
CVE-2022-1873 | Medium | 6.5 | 2022-07-27 | Insufficient policy enforcement in COOP in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2022-1872 | Medium | 4.3 | 2022-07-27 | Insufficient policy enforcement in Extensions API in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious exten… |
CVE-2022-1871 | Medium | 4.3 | 2022-07-27 | Insufficient policy enforcement in File System API in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious exte… |
CVE-2022-1870 | High | 8.8 | 2022-07-27 | Use after free in App Service in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially… |
CVE-2022-1869 | Medium | 6.5 | 2022-07-27 | Type Confusion in V8 in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-1868 | Medium | 6.5 | 2022-07-27 | Inappropriate implementation in Extensions API in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extensio… |
CVE-2022-1867 | Medium | 6.5 | 2022-07-27 | Insufficient validation of untrusted input in Data Transfer in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to bypass same origin policy via… |
CVE-2022-1866 | High | 8.8 | 2022-07-27 | Use after free in Tablet Mode in Google Chrome on Chrome OS prior to 102.0.5005.61 allowed a remote attacker who convinced a user to engage in specific user in… |
CVE-2022-1865 | High | 8.8 | 2022-07-27 | Use after free in Bookmarks in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially ex… |
CVE-2022-1864 | High | 8.8 | 2022-07-27 | Use after free in WebApp Installs in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentia… |
CVE-2022-1863 | High | 8.8 | 2022-07-27 | Use after free in Tab Groups in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially e… |
CVE-2022-1862 | Medium | 6.5 | 2022-07-27 | Inappropriate implementation in Extensions in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to… |
CVE-2022-1861 | High | 8.8 | 2022-07-27 | Use after free in Sharing in Google Chrome on Chrome OS prior to 102.0.5005.61 allowed a remote attacker who convinced a user to enage in specific user interac… |
CVE-2022-1860 | High | 8.8 | 2022-07-27 | Use after free in UI Foundations in Google Chrome on Chrome OS prior to 102.0.5005.61 allowed a remote attacker who convinced a user to engage in specific user… |
CVE-2022-1859 | High | 8.8 | 2022-07-27 | Use after free in Performance Manager in Google Chrome prior to 102.0.5005.61 allowed a remote attacker who convinced a user to engage in specific user interac… |
CVE-2022-1858 | Medium | 6.5 | 2022-07-27 | Out of bounds read in DevTools in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to perform an out of bounds memory read via specific user inte… |
CVE-2022-1857 | High | 8.8 | 2022-07-27 | Insufficient policy enforcement in File System API in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to bypass file system restrictions via a c… |
CVE-2022-1856 | High | 8.8 | 2022-07-27 | Use after free in User Education in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potential… |
CVE-2022-1855 | High | 8.8 | 2022-07-27 | Use after free in Messaging in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-1854 | High | 8.8 | 2022-07-27 | Use after free in ANGLE in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-1853 | Critical | 9.6 | 2022-07-27 | Use after free in Indexed DB in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. |
CVE-2022-36956 | Critical | 9.0 | 2022-07-27 | In Veritas NetBackup, the NetBackup Client allows arbitrary command execution from any remote host that has access to a valid host-id NetBackup certificate/pri… |
CVE-2022-36955 | High | 7.8 | 2022-07-27 | In Veritas NetBackup, an attacker with unprivileged local access to a NetBackup Client may send specific commands to escalate their privileges. This affects 8… |
CVE-2022-36954 | Critical | 9.9 | 2022-07-27 | In Veritas NetBackup OpsCenter, under specific conditions, an authenticated remote attacker may be able to create or modify OpsCenter user accounts. This affec… |
CVE-2022-36953 | Medium | 4.3 | 2022-07-27 | In Veritas NetBackup OpsCenter, certain endpoints could allow an unauthenticated remote attacker to gain sensitive information. This affects 8.x through 8.3.0… |
CVE-2022-36952 | High | 8.4 | 2022-07-27 | In Veritas NetBackup OpsCenter, a hard-coded credential exists that could be used to exploit the underlying VxSS subsystem. This affects 8.x through 8.3.0.2, 9… |
CVE-2022-36951 | Critical | 9.8 | 2022-07-27 | In Veritas NetBackup OpsCenter, an unauthenticated remote attacker may compromise the host by exploiting an incorrectly patched vulnerability. This affects 8.x… |
CVE-2022-36950 | Critical | 9.8 | 2022-07-27 | In Veritas NetBackup OpsCenter, an unauthenticated remote attacker may be able to perform remote command execution through a Java classloader manipulation. Thi… |
CVE-2022-36949 | Critical | 9.3 | 2022-07-27 | In Veritas NetBackup OpsCenter, an attacker with local access to a NetBackup OpsCenter server could potentially escalate their privileges. This affects 8.x thr… |
CVE-2022-36948 | Medium | 5.4 | 2022-07-27 | In Veritas NetBackup OpsCenter, a DOM XSS attack can occur. This affects 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10. |
CVE-2022-35911 | High | 7.5 | 2022-07-27 | On Patlite NH-FB series devices through 1.46, remote attackers can cause a denial of service by omitting the query string. NOTE: the vendor's perspective is th… |
CVE-2022-36946 | High | 7.5 | 2022-07-27 | nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in th… |
CVE-2022-34121 | High | 7.5 | 2022-07-27 | Cuppa CMS v1.0 was discovered to contain a local file inclusion (LFI) vulnerability via the component /templates/default/html/windows/right.php. |
CVE-2022-34120 | High | 7.2 | 2022-07-27 | Barangay Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the module editing function at /pages/activity/activi… |
CVE-2022-35672 | High | 7.8 | 2022-07-27 | Adobe Acrobat Reader version 22.001.20085 (and earlier), 20.005.30314 (and earlier) and 17.012.30205 (and earlier) are affected by an out-of-bounds read vulner… |
CVE-2022-35669 | Medium | 5.5 | 2022-07-27 | Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 20.005.30334 (and earlier) are affected by an out-of-bounds read vulnerabili… |
CVE-2022-33943 | Medium | 5.4 | 2022-07-27 | Authenticated (contributor or higher user role) Cross-Site Scripting (XSS) vulnerability in Nico Amarilla's BxSlider WP plugin <= 2.0.0 at WordPress. |
CVE-2022-36922 | Medium | 6.1 | 2022-07-27 | Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not escape the search query parameter displayed on the 'search' result page, resulting in a ref… |
CVE-2022-36921 | High | 8.1 | 2022-07-27 | A missing permission check in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL… |
CVE-2022-36920 | High | 8.8 | 2022-07-27 | A cross-site request forgery (CSRF) vulnerability in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers to connect to an attacker-specified URL using… |
CVE-2022-36919 | Medium | 4.3 | 2022-07-27 | A missing permission check in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credenti… |
CVE-2022-36918 | Medium | 4.3 | 2022-07-27 | Jenkins Buckminster Plugin 1.1.1 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read… |
CVE-2022-36917 | Medium | 4.3 | 2022-07-27 | A missing permission check in Jenkins Google Cloud Backup Plugin 0.6 and earlier allows attackers with Overall/Read permission to request a manual backup. |
CVE-2022-36916 | High | 8.0 | 2022-07-27 | A cross-site request forgery (CSRF) vulnerability in Jenkins Google Cloud Backup Plugin 0.6 and earlier allows attackers to request a manual backup. |
CVE-2022-36915 | Medium | 4.3 | 2022-07-27 | Jenkins Android Signing Plugin 2.2.5 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Item/Rea… |
CVE-2022-36914 | Medium | 4.3 | 2022-07-27 | Jenkins Files Found Trigger Plugin 1.5 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overal… |
CVE-2022-36913 | Medium | 4.3 | 2022-07-27 | Jenkins Openstack Heat Plugin 1.5 and earlier does not perform permission checks in methods implementing form validation, allowing attackers with Overall/Read… |
CVE-2022-36912 | Medium | 4.3 | 2022-07-27 | A missing permission check in Jenkins Openstack Heat Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified U… |
CVE-2022-36911 | Medium | 6.5 | 2022-07-27 | A cross-site request forgery (CSRF) vulnerability in Jenkins Openstack Heat Plugin 1.5 and earlier allows attackers to connect to an attacker-specified URL. |
CVE-2022-36910 | Medium | 5.4 | 2022-07-27 | Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read… |
CVE-2022-36909 | Medium | 6.5 | 2022-07-27 | A missing permission check in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers with Overall/Read permission to check for the existence of a… |
CVE-2022-36908 | Medium | 6.5 | 2022-07-27 | A cross-site request forgery (CSRF) vulnerability in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers to check for the existence of an atta… |
CVE-2022-36907 | Medium | 6.5 | 2022-07-27 | A missing permission check in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-speci… |
CVE-2022-36906 | Medium | 6.5 | 2022-07-27 | A cross-site request forgery (CSRF) vulnerability in Jenkins OpenShift Deployer Plugin 1.2.0 and earlier allows attackers to connect to an attacker-specified U… |
CVE-2022-36905 | Medium | 5.4 | 2022-07-27 | Jenkins Maven Metadata Plugin for Jenkins CI server Plugin 2.2 and earlier does not perform URL validation for the Repository Base URL of List maven artifact v… |
CVE-2022-36904 | Medium | 4.3 | 2022-07-27 | Jenkins Repository Connector Plugin 2.2.0 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Ove… |
CVE-2022-36903 | Medium | 4.3 | 2022-07-27 | A missing permission check in Jenkins Repository Connector Plugin 2.2.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs… |
CVE-2022-36902 | Medium | 5.4 | 2022-07-27 | Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape several fields of Moded Extended Choice parameters, resulting in a stored cr… |
CVE-2022-36901 | Medium | 6.5 | 2022-07-27 | Jenkins HTTP Request Plugin 1.15 and earlier stores HTTP Request passwords unencrypted in its global configuration file on the Jenkins controller where they ca… |
CVE-2022-36900 | High | 8.2 | 2022-07-27 | Jenkins Compuware zAdviser API Plugin 1.0.3 and earlier does not restrict execution of a controller/agent message to agents, allowing attackers able to control… |
CVE-2022-36899 | High | 8.2 | 2022-07-27 | Jenkins Compuware ISPW Operations Plugin 1.0.8 and earlier does not restrict execution of a controller/agent message to agents, allowing attackers able to cont… |
CVE-2022-36898 | Medium | 4.3 | 2022-07-27 | A missing permission check in Jenkins Compuware ISPW Operations Plugin 1.0.8 and earlier allows attackers with Overall/Read permission to enumerate hosts and p… |
CVE-2022-36897 | Medium | 4.3 | 2022-07-27 | A missing permission check in Jenkins Compuware Xpediter Code Coverage Plugin 1.0.7 and earlier allows attackers with Overall/Read permission to enumerate host… |
CVE-2022-36896 | Medium | 6.5 | 2022-07-27 | A missing permission check in Jenkins Compuware Source Code Download for Endevor, PDS, and ISPW Plugin 2.0.12 and earlier allows attackers with Overall/Read pe… |
CVE-2022-36895 | Medium | 4.3 | 2022-07-27 | A missing permission check in Jenkins Compuware Topaz Utilities Plugin 1.0.8 and earlier allows attackers with Overall/Read permission to enumerate hosts and p… |
CVE-2022-36894 | Medium | 6.5 | 2022-07-27 | An arbitrary file write vulnerability in Jenkins CLIF Performance Testing Plugin 64.vc0d66de1dfb_f and earlier allows attackers with Overall/Read permission to… |
CVE-2022-36893 | Medium | 4.3 | 2022-07-27 | Jenkins rpmsign-plugin Plugin 0.5.0 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Item/Read… |
CVE-2022-36892 | Medium | 4.3 | 2022-07-27 | Jenkins rhnpush-plugin Plugin 0.5.1 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Item/Read… |
CVE-2022-36891 | Medium | 4.3 | 2022-07-27 | A missing permission check in Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier allows attackers with Item/Read permission but without Deploy Now/… |
CVE-2022-36890 | Medium | 4.3 | 2022-07-27 | Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the name of files in methods implementing form validation, allowing attackers… |
CVE-2022-36889 | High | 8.8 | 2022-07-27 | Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the application path of the applications when configuring a deployment, allowi… |
CVE-2022-36888 | Medium | 6.5 | 2022-07-27 | A missing permission check in Jenkins HashiCorp Vault Plugin 354.vdb_858fd6b_f48 and earlier allows attackers with Overall/Read permission to obtain credential… |
CVE-2022-36887 | Medium | 4.3 | 2022-07-27 | A cross-site request forgery (CSRF) vulnerability in Jenkins Job Configuration History Plugin 1155.v28a_46a_cc06a_5 and earlier allows attackers to delete entr… |
CVE-2022-36886 | Medium | 4.3 | 2022-07-27 | A cross-site request forgery (CSRF) vulnerability in Jenkins External Monitor Job Type Plugin 191.v363d0d1efdf8 and earlier allows attackers to create runs of… |
CVE-2022-36885 | Medium | 5.3 | 2022-07-27 | Jenkins GitHub Plugin 1.34.4 and earlier uses a non-constant time comparison function when checking whether the provided and computed webhook signatures are eq… |
CVE-2022-36884 | Medium | 5.3 | 2022-07-27 | The webhook endpoint in Jenkins Git Plugin 4.11.3 and earlier provide unauthenticated attackers information about the existence of jobs configured to use an at… |
CVE-2022-36883 | High | 7.5 | 2022-07-27 | A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-sp… |
CVE-2022-36882 | High | 8.8 | 2022-07-27 | A cross-site request forgery (CSRF) vulnerability in Jenkins Git Plugin 4.11.3 and earlier allows attackers to trigger builds of jobs configured to use an atta… |
CVE-2022-36881 | High | 8.1 | 2022-07-27 | Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle… |
CVE-2022-2550 | High | 8.8 | 2022-07-27 | OS Command Injection in GitHub repository hestiacp/hestiacp prior to 1.6.5. |
CVE-2022-2549 | Medium | 5.5 | 2022-07-27 | NULL Pointer Dereference in GitHub repository gpac/gpac prior to v2.1.0-DEV. |
CVE-2022-35291 | High | 8.1 | 2022-07-27 | Due to misconfigured application endpoints, SAP SuccessFactors attachment APIs allow attackers with user privileges to perform activities with admin privileges… |
CVE-2022-34551 | Medium | 6.5 | 2022-07-27 | Sims v1.0 was discovered to allow path traversal when downloading attachments. |
CVE-2022-34550 | Medium | 5.4 | 2022-07-27 | Sims v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /addNotifyServlet. This vulnerability allows attackers to exec… |
CVE-2022-34549 | High | 8.8 | 2022-07-27 | Sims v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /uploadServlet. This vulnerability allows attackers to escalate pr… |
CVE-2022-34529 | Medium | 5.5 | 2022-07-27 | WASM3 v0.5.0 was discovered to contain a segmentation fault via the component Compile_Memory_CopyFill. |
CVE-2022-33970 | High | 7.2 | 2022-07-27 | Authenticated WordPress Options Change vulnerability in Biplob018 Shortcode Addons plugin <= 3.1.2 at WordPress. |
CVE-2022-24406 | Medium | 6.5 | 2022-07-27 | OX App Suite through 7.10.6 allows SSRF because multipart/form-data boundaries are predictable, and this can lead to injection into internal Documentconverter… |
CVE-2022-24405 | Critical | 9.8 | 2022-07-27 | OX App Suite through 7.10.6 allows OS Command Injection via a serialized Java class to the Documentconverter API. |
CVE-2022-23101 | Medium | 6.1 | 2022-07-27 | OX App Suite through 7.10.6 allows XSS via appHandler in a deep link in an e-mail message. |
CVE-2022-23100 | Critical | 9.8 | 2022-07-27 | OX App Suite through 7.10.6 allows OS Command Injection via Documentconverter (e.g., through an email attachment). |
CVE-2022-23099 | Medium | 5.4 | 2022-07-27 | OX App Suite through 7.10.6 allows XSS by forcing block-wise read. |
CVE-2022-2313 | High | 8.2 | 2022-07-27 | A DLL hijacking vulnerability in the MA Smart Installer for Windows prior to 5.7.7, which allows local users to execute arbitrary code and obtain higher privil… |
CVE-2022-2310 | Critical | 10.0 | 2022-07-27 | An authentication bypass vulnerability in Skyhigh SWG in main releases 10.x prior to 10.2.12, 9.x prior to 9.2.23, 8.x prior to 8.2.28, and controlled release… |
CVE-2022-27610 | Medium | 6.5 | 2022-07-27 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6… |
CVE-2022-36880 | Medium | 6.1 | 2022-07-27 | The Read Mail module in Webmin 1.995 and Usermin through 1.850 allows XSS via a crafted HTML e-mail message. |
CVE-2022-36879 | Medium | 5.5 | 2022-07-27 | An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice. |
CVE-2022-34971 | High | 8.8 | 2022-07-27 | An arbitrary file upload vulnerability in the Advertising Management module of Feehi CMS v2.1.1 allows attackers to execute arbitrary code via a crafted PHP fi… |
CVE-2022-34612 | Medium | 5.5 | 2022-07-27 | Rizin v0.4.0 and below was discovered to contain an integer overflow via the function get_long_object(). This vulnerability allows attackers to cause a Denial… |