2022 CVEs (page 169)
Page 169 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-34611 | Medium | 5.4 | 2022-07-27 | A cross-site scripting (XSS) vulnerability in /index.php/?p=report of Online Fire Reporting System v1.0 allows attackers to execute arbitrary web scripts or HT… |
CVE-2022-34594 | Medium | 4.8 | 2022-07-27 | Advanced School Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component ip/school/moudel/update_subject.p… |
CVE-2022-36129 | Critical | 9.1 | 2022-07-26 | HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using Integrated Storage expose an unauthenticated API endpoint that could be abuse… |
CVE-2022-30276 | High | 7.5 | 2022-07-26 | The Motorola MOSCAD and ACE line of RTUs through 2022-05-02 omit an authentication requirement. They feature IP Gateway modules which allow for interfacing bet… |
CVE-2022-30274 | Critical | 9.8 | 2022-07-26 | The Motorola ACE1000 RTU through 2022-05-02 uses ECB encryption unsafely. It can communicate with an XRT LAN-to-radio gateway by means of an embedded client. C… |
CVE-2022-30272 | High | 7.2 | 2022-07-26 | The Motorola ACE1000 RTU through 2022-05-02 mishandles firmware integrity. It utilizes either the STS software suite or ACE1000 Easy Configurator for performin… |
CVE-2022-30271 | Critical | 9.8 | 2022-07-26 | The Motorola ACE1000 RTU through 2022-05-02 ships with a hardcoded SSH private key and initialization scripts (such as /etc/init.d/sshd_service) only generate… |
CVE-2022-30270 | Critical | 9.8 | 2022-07-26 | The Motorola ACE1000 RTU through 2022-05-02 has default credentials. It exposes an SSH interface on port 22/TCP. This interface is used for remote maintenance… |
CVE-2022-30269 | High | 8.8 | 2022-07-26 | Motorola ACE1000 RTUs through 2022-05-02 mishandle application integrity. They allow for custom application installation via either STS software, the C toolkit… |
CVE-2022-31207 | Critical | 9.8 | 2022-07-26 | The Omron SYSMAC Cx product family PLCs (CS series, CJ series, and CP series) through 2022-05-18 lack cryptographic authentication. They utilize the Omron FINS… |
CVE-2022-31206 | Critical | 9.8 | 2022-07-26 | The Omron SYSMAC Nx product family PLCs (NJ series, NY series, NX series, and PMAC series) through 2022-005-18 lack cryptographic authentication. These PLCs ar… |
CVE-2022-31205 | High | 7.5 | 2022-07-26 | In Omron CS series, CJ series, and CP series PLCs through 2022-05-18, the password for access to the Web UI is stored in memory area D1449...D1452 and can be r… |
CVE-2022-31204 | High | 7.5 | 2022-07-26 | Omron CS series, CJ series, and CP series PLCs through 2022-05-18 use cleartext passwords. They feature a UM Protection setting that allows users or system int… |
CVE-2022-30275 | High | 7.5 | 2022-07-26 | The Motorola MOSCAD Toolbox software through 2022-05-02 relies on a cleartext password. It utilizes an MDLC driver to communicate with MOSCAD/ACE RTUs for engi… |
CVE-2022-30273 | Critical | 9.8 | 2022-07-26 | The Motorola MDLC protocol through 2022-05-02 mishandles message integrity. It supports three security modes: Plain, Legacy Encryption, and New Encryption. In… |
CVE-2022-29965 | Medium | 5.5 | 2022-07-26 | The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. Access to privileged operations on the mainte… |
CVE-2022-29964 | Medium | 5.5 | 2022-07-26 | The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. WIOC SSH provides access to a shell as root… |
CVE-2022-29963 | Medium | 5.5 | 2022-07-26 | The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. TELNET on port 18550 provides access to a roo… |
CVE-2022-29962 | Medium | 5.5 | 2022-07-26 | The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. FTP has hardcoded credentials (but may often… |
CVE-2022-29960 | Medium | 5.5 | 2022-07-26 | Emerson OpenBSI through 2022-04-29 uses weak cryptography. It is an engineering environment for the ControlWave and Bristol Babcock line of RTUs. DES with hard… |
CVE-2022-29958 | Critical | 9.8 | 2022-07-26 | JTEKT TOYOPUC PLCs through 2022-04-29 do not ensure data integrity. They utilize the unauthenticated CMPLink/TCP protocol for engineering purposes, including d… |
CVE-2022-29957 | High | 7.8 | 2022-07-26 | The Emerson DeltaV Distributed Control System (DCS) through 2022-04-29 mishandles authentication. It utilizes several proprietary protocols for a wide variety… |
CVE-2022-29953 | Critical | 9.8 | 2022-07-26 | The Bently Nevada 3700 series of condition monitoring equipment through 2022-04-29 has a maintenance interface on port 4001/TCP with undocumented, hardcoded cr… |
CVE-2022-29952 | Critical | 9.1 | 2022-07-26 | Bently Nevada condition monitoring equipment through 2022-04-29 mishandles authentication. It utilizes the TDI command and data protocols (60005/TCP, 60007/TCP… |
CVE-2022-29951 | Critical | 9.1 | 2022-07-26 | JTEKT TOYOPUC PLCs through 2022-04-29 mishandle authentication. They utilize the CMPLink/TCP protocol (configurable on ports 1024-65534 on either TCP or UDP) f… |
CVE-2022-27105 | Medium | 5.4 | 2022-07-26 | InMailX Outlook Plugin < 3.22.0101 is vulnerable to Cross Site Scripting (XSS). InMailX Connection names are not sanitzed in the Outlook tab, which allows a lo… |
CVE-2022-1641 | High | 8.8 | 2022-07-26 | Use after free in Web UI Diagnostics in Google Chrome on Chrome OS prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific… |
CVE-2022-1640 | High | 8.8 | 2022-07-26 | Use after free in Sharing in Google Chrome prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UI interactions to poten… |
CVE-2022-1639 | High | 8.8 | 2022-07-26 | Use after free in ANGLE in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-1638 | High | 8.8 | 2022-07-26 | Heap buffer overflow in V8 Internationalization in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to potentially exploit heap corruption via a… |
CVE-2022-1637 | Medium | 4.3 | 2022-07-26 | Inappropriate implementation in Web Contents in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to leak cross-origin data via a crafted HTML pag… |
CVE-2022-1636 | High | 8.8 | 2022-07-26 | Use after free in Performance APIs in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2022-1635 | High | 8.8 | 2022-07-26 | Use after free in Permission Prompts in Google Chrome prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UI interactio… |
CVE-2022-1634 | High | 8.8 | 2022-07-26 | Use after free in Browser UI in Google Chrome prior to 101.0.4951.64 allowed a remote attacker who had convinced a user to engage in specific UI interaction to… |
CVE-2022-1633 | High | 8.8 | 2022-07-26 | Use after free in Sharesheet in Google Chrome on Chrome OS prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UI inter… |
CVE-2022-1501 | Medium | 6.5 | 2022-07-26 | Inappropriate implementation in iframe in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2022-1500 | Medium | 6.5 | 2022-07-26 | Insufficient data validation in Dev Tools in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass content security policy via a crafted HTM… |
CVE-2022-1499 | Medium | 6.3 | 2022-07-26 | Inappropriate implementation in WebAuthentication in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass same origin policy via a crafted… |
CVE-2022-1498 | Medium | 4.3 | 2022-07-26 | Inappropriate implementation in HTML Parser in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2022-1497 | Medium | 6.5 | 2022-07-26 | Inappropriate implementation in Input in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to spoof the contents of cross-origin websites via a cr… |
CVE-2022-1496 | High | 8.8 | 2022-07-26 | Use after free in File Manager in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via specific and direct… |
CVE-2022-1495 | Medium | 4.3 | 2022-07-26 | Incorrect security UI in Downloads in Google Chrome on Android prior to 101.0.4951.41 allowed a remote attacker to spoof the APK downloads dialog via a crafted… |
CVE-2022-1494 | Medium | 6.1 | 2022-07-26 | Insufficient data validation in Trusted Types in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass trusted types policy via a crafted HT… |
CVE-2022-1493 | High | 8.8 | 2022-07-26 | Use after free in Dev Tools in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via specific and direct us… |
CVE-2022-1492 | Medium | 6.1 | 2022-07-26 | Insufficient data validation in Blink Editing in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to inject arbitrary scripts or HTML via a craft… |
CVE-2022-1491 | High | 8.8 | 2022-07-26 | Use after free in Bookmarks in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via specific and direct us… |
CVE-2022-1490 | High | 8.8 | 2022-07-26 | Use after free in Browser Switcher in Google Chrome prior to 101.0.4951.41 allowed a remote attacker who convinced a user to engage in specific user interactio… |
CVE-2022-1489 | High | 8.8 | 2022-07-26 | Out of bounds memory access in UI Shelf in Google Chrome on Chrome OS, Lacros prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corr… |
CVE-2022-1488 | Medium | 4.3 | 2022-07-26 | Inappropriate implementation in Extensions API in Google Chrome prior to 101.0.4951.41 allowed an attacker who convinced a user to install a malicious extensio… |
CVE-2022-1487 | High | 7.5 | 2022-07-26 | Use after free in Ozone in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via running a Wayland test. |
CVE-2022-1486 | High | 8.8 | 2022-07-26 | Type confusion in V8 in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to obtain potentially sensitive information from process memory via a cr… |
CVE-2022-1485 | High | 7.5 | 2022-07-26 | Use after free in File System API in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
CVE-2022-1484 | High | 8.8 | 2022-07-26 | Heap buffer overflow in Web UI Settings in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted… |
CVE-2022-1483 | High | 8.8 | 2022-07-26 | Heap buffer overflow in WebGPU in Google Chrome prior to 101.0.4951.41 allowed a remote attacker who had compromised the renderer process to potentially exploi… |
CVE-2022-1482 | Medium | 6.5 | 2022-07-26 | Inappropriate implementation in WebGL in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HT… |
CVE-2022-1481 | High | 8.8 | 2022-07-26 | Use after free in Sharing in Google Chrome on Mac prior to 101.0.4951.41 allowed a remote attacker who convinced a user to engage in specific user interaction… |
CVE-2022-1479 | High | 8.8 | 2022-07-26 | Use after free in ANGLE in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-1478 | High | 8.8 | 2022-07-26 | Use after free in SwiftShader in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-1477 | High | 8.8 | 2022-07-26 | Use after free in Vulkan in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-1364 | High | 8.8 | 2022-07-26 | Type confusion in V8 Turbofan in Google Chrome prior to 100.0.4896.127 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-1671 | High | 7.1 | 2022-07-26 | A NULL pointer dereference flaw was found in rxrpc_preparse_s in net/rxrpc/server_key.c in the Linux kernel. This flaw allows a local attacker to crash the sys… |
CVE-2022-1651 | High | 7.1 | 2022-07-26 | A memory leak flaw was found in the Linux kernel in acrn_dev_ioctl in the drivers/virt/acrn/hsm.c function in how the ACRN Device Model emulates virtual NICs i… |
CVE-2022-35639 | High | 7.5 | 2022-07-26 | IBM Sterling Partner Engagement Manager 6.1, 6.2, and Cloud 22.2 do not limit the length of a connection which could cause the server to become unresponsive. I… |
CVE-2022-35286 | High | 8.8 | 2022-07-26 | IBM Security Verify Information Queue 10.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized ac… |
CVE-2022-22412 | Medium | 4.6 | 2022-07-26 | IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a user with access to the local host (client machine) to obtain a login access token. IBM… |
CVE-2022-1648 | Medium | 5.7 | 2022-07-26 | Pandora FMS v7.0NG.760 and below allows a relative path traversal in File Manager where a privileged user could upload a .php file outside the intended images… |
CVE-2022-36412 | Critical | 9.8 | 2022-07-26 | In Zoho ManageEngine SupportCenter Plus before 11023, V3 API requests are vulnerable to authentication bypass. (An API request may, in effect, be executed with… |
CVE-2022-36161 | Critical | 9.8 | 2022-07-26 | Orange Station 1.0 was discovered to contain a SQL injection vulnerability via the username parameter. |
CVE-2022-34991 | Medium | 5.4 | 2022-07-26 | Paymoney v3.3 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities via the first_name and last_name parameters. |
CVE-2022-34989 | Critical | 9.8 | 2022-07-26 | Fruits Bazar v1.0 was discovered to contain a SQL injection vulnerability via the recover_email parameter at user_password_recover.php. |
CVE-2022-34988 | Medium | 5.4 | 2022-07-26 | Inout Blockchain AltExchanger v1.2.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/js. |
CVE-2022-34067 | High | 7.5 | 2022-07-26 | Warehouse Management System v1.0 was discovered to contain a SQL injection vulnerability via the cari parameter. |
CVE-2022-33745 | High | 8.8 | 2022-07-26 | insufficient TLB flush for x86 PV guests in shadow mode For migration as well as to work around kernels unaware of L1TF (see XSA-273), PV guests may be run in… |
CVE-2022-31879 | High | 8.8 | 2022-07-26 | Online Fire Reporting System 1.0 is vulnerable to SQL Injection via the date parameter. |
CVE-2022-2225 | High | 8.1 | 2022-07-26 | By using warp-cli subcommands (disable-ethernet, disable-wifi), it was possible for a user without admin privileges to bypass configured Zero Trust security po… |
CVE-2022-33977 | High | 7.5 | 2022-07-26 | untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts recursive entity references in DTD… |
CVE-2022-31471 | High | 7.5 | 2022-07-26 | untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts XML external entity references. By… |
CVE-2022-30706 | Medium | 6.1 | 2022-07-26 | Open redirect vulnerability in Booked versions prior to 3.3 allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a… |
CVE-2022-1042 | High | 8.2 | 2022-07-26 | In Zephyr bluetooth mesh core stack, an out-of-bound write vulnerability can be triggered during provisioning. |
CVE-2022-1041 | High | 8.2 | 2022-07-26 | In Zephyr bluetooth mesh core stack, an out-of-bound write vulnerability can be triggered during provisioning. |
CVE-2022-22686 | Medium | 6.5 | 2022-07-26 | Cross-Site Request Forgery (CSRF) vulnerability in webapi component in Synology Calendar before 2.3.4-0631 allows remote authenticated users to hijack the auth… |
CVE-2022-34749 | High | 7.5 | 2022-07-25 | In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge c… |
CVE-2022-34577 | Critical | 9.8 | 2022-07-25 | A vulnerability in adm.cgi of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to execute arbitrary code via a crafted POST request. |
CVE-2022-34576 | High | 7.5 | 2022-07-25 | A vulnerability in /cgi-bin/ExportAllSettings.sh of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to execute arbitrary code via a crafted POST request. |
CVE-2022-34575 | Medium | 5.7 | 2022-07-25 | An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the key information of the device via accessing fct… |
CVE-2022-34574 | Medium | 5.7 | 2022-07-25 | An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the key information of the device via accessing Tft… |
CVE-2022-34573 | Medium | 6.3 | 2022-07-25 | An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to arbitrarily configure device settings via accessing the pa… |
CVE-2022-34572 | Medium | 5.7 | 2022-07-25 | An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the telnet password via accessing the page tftp.txt. |
CVE-2022-34571 | High | 8.0 | 2022-07-25 | An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the system key information and execute arbitrary co… |
CVE-2022-34570 | High | 7.5 | 2022-07-25 | WAVLINK WN579 X3 M79X3.V5030.191012/M79X3.V5030.191012 contains an information leak which allows attackers to obtain the key information via accessing the mess… |
CVE-2022-35131 | Critical | 9.0 | 2022-07-25 | Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles. |
CVE-2022-34907 | Critical | 9.8 | 2022-07-25 | An authentication bypass vulnerability exists in FileWave before 14.6.3 and 14.7.x before 14.7.2. Exploitation could allow an unauthenticated actor to gain acc… |
CVE-2022-34906 | High | 7.5 | 2022-07-25 | A hard-coded cryptographic key is used in FileWave before 14.6.3 and 14.7.x before 14.7.2. Exploitation could allow an unauthenticated actor to decrypt sensiti… |
CVE-2022-36375 | High | 7.2 | 2022-07-25 | Authenticated (high role user) WordPress Options Change vulnerability in Biplob Adhikari's Tabs plugin <= 3.6.0 at WordPress. |
CVE-2022-35873 | High | 7.8 | 2022-07-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). User inte… |
CVE-2022-35872 | High | 7.8 | 2022-07-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). User inte… |
CVE-2022-35871 | High | 7.8 | 2022-07-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). Authentic… |
CVE-2022-35870 | High | 7.8 | 2022-07-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). Although… |
CVE-2022-35869 | Critical | 9.8 | 2022-07-25 | This vulnerability allows remote attackers to bypass authentication on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). Authentica… |
CVE-2022-34966 | High | 7.5 | 2022-07-25 | OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain an HTML injection vulnerability via the location parameter at http://ip_addre… |