2022 CVEs (page 169)
Page 169 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-2549 | Medium | 5.5 | 2022-07-27 | NULL Pointer Dereference in GitHub repository gpac/gpac prior to v2.1.0-DEV. |
CVE-2022-35291 | High | 8.1 | 2022-07-27 | Due to misconfigured application endpoints, SAP SuccessFactors attachment APIs allow attackers with user privileges to perform activities with admin privileges… |
CVE-2022-34551 | Medium | 6.5 | 2022-07-27 | Sims v1.0 was discovered to allow path traversal when downloading attachments. |
CVE-2022-34550 | Medium | 5.4 | 2022-07-27 | Sims v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /addNotifyServlet. This vulnerability allows attackers to exec… |
CVE-2022-34549 | High | 8.8 | 2022-07-27 | Sims v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /uploadServlet. This vulnerability allows attackers to escalate pr… |
CVE-2022-34529 | Medium | 5.5 | 2022-07-27 | WASM3 v0.5.0 was discovered to contain a segmentation fault via the component Compile_Memory_CopyFill. |
CVE-2022-33970 | High | 7.2 | 2022-07-27 | Authenticated WordPress Options Change vulnerability in Biplob018 Shortcode Addons plugin <= 3.1.2 at WordPress. |
CVE-2022-24406 | Medium | 6.5 | 2022-07-27 | OX App Suite through 7.10.6 allows SSRF because multipart/form-data boundaries are predictable, and this can lead to injection into internal Documentconverter… |
CVE-2022-24405 | Critical | 9.8 | 2022-07-27 | OX App Suite through 7.10.6 allows OS Command Injection via a serialized Java class to the Documentconverter API. |
CVE-2022-23101 | Medium | 6.1 | 2022-07-27 | OX App Suite through 7.10.6 allows XSS via appHandler in a deep link in an e-mail message. |
CVE-2022-23100 | Critical | 9.8 | 2022-07-27 | OX App Suite through 7.10.6 allows OS Command Injection via Documentconverter (e.g., through an email attachment). |
CVE-2022-23099 | Medium | 5.4 | 2022-07-27 | OX App Suite through 7.10.6 allows XSS by forcing block-wise read. |
CVE-2022-2313 | High | 8.2 | 2022-07-27 | A DLL hijacking vulnerability in the MA Smart Installer for Windows prior to 5.7.7, which allows local users to execute arbitrary code and obtain higher privil… |
CVE-2022-2310 | Critical | 10.0 | 2022-07-27 | An authentication bypass vulnerability in Skyhigh SWG in main releases 10.x prior to 10.2.12, 9.x prior to 9.2.23, 8.x prior to 8.2.28, and controlled release… |
CVE-2022-27610 | Medium | 6.5 | 2022-07-27 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6… |
CVE-2022-36880 | Medium | 6.1 | 2022-07-27 | The Read Mail module in Webmin 1.995 and Usermin through 1.850 allows XSS via a crafted HTML e-mail message. |
CVE-2022-36879 | Medium | 5.5 | 2022-07-27 | An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice. |
CVE-2022-34971 | High | 8.8 | 2022-07-27 | An arbitrary file upload vulnerability in the Advertising Management module of Feehi CMS v2.1.1 allows attackers to execute arbitrary code via a crafted PHP fi… |
CVE-2022-34612 | Medium | 5.5 | 2022-07-27 | Rizin v0.4.0 and below was discovered to contain an integer overflow via the function get_long_object(). This vulnerability allows attackers to cause a Denial… |
CVE-2022-34611 | Medium | 5.4 | 2022-07-27 | A cross-site scripting (XSS) vulnerability in /index.php/?p=report of Online Fire Reporting System v1.0 allows attackers to execute arbitrary web scripts or HT… |
CVE-2022-34594 | Medium | 4.8 | 2022-07-27 | Advanced School Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component ip/school/moudel/update_subject.p… |
CVE-2022-36129 | Critical | 9.1 | 2022-07-26 | HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using Integrated Storage expose an unauthenticated API endpoint that could be abuse… |
CVE-2022-30276 | High | 7.5 | 2022-07-26 | The Motorola MOSCAD and ACE line of RTUs through 2022-05-02 omit an authentication requirement. They feature IP Gateway modules which allow for interfacing bet… |
CVE-2022-30274 | Critical | 9.8 | 2022-07-26 | The Motorola ACE1000 RTU through 2022-05-02 uses ECB encryption unsafely. It can communicate with an XRT LAN-to-radio gateway by means of an embedded client. C… |
CVE-2022-30272 | High | 7.2 | 2022-07-26 | The Motorola ACE1000 RTU through 2022-05-02 mishandles firmware integrity. It utilizes either the STS software suite or ACE1000 Easy Configurator for performin… |
CVE-2022-30271 | Critical | 9.8 | 2022-07-26 | The Motorola ACE1000 RTU through 2022-05-02 ships with a hardcoded SSH private key and initialization scripts (such as /etc/init.d/sshd_service) only generate… |
CVE-2022-30270 | Critical | 9.8 | 2022-07-26 | The Motorola ACE1000 RTU through 2022-05-02 has default credentials. It exposes an SSH interface on port 22/TCP. This interface is used for remote maintenance… |
CVE-2022-30269 | High | 8.8 | 2022-07-26 | Motorola ACE1000 RTUs through 2022-05-02 mishandle application integrity. They allow for custom application installation via either STS software, the C toolkit… |
CVE-2022-31207 | Critical | 9.8 | 2022-07-26 | The Omron SYSMAC Cx product family PLCs (CS series, CJ series, and CP series) through 2022-05-18 lack cryptographic authentication. They utilize the Omron FINS… |
CVE-2022-31206 | Critical | 9.8 | 2022-07-26 | The Omron SYSMAC Nx product family PLCs (NJ series, NY series, NX series, and PMAC series) through 2022-005-18 lack cryptographic authentication. These PLCs ar… |
CVE-2022-31205 | High | 7.5 | 2022-07-26 | In Omron CS series, CJ series, and CP series PLCs through 2022-05-18, the password for access to the Web UI is stored in memory area D1449...D1452 and can be r… |
CVE-2022-31204 | High | 7.5 | 2022-07-26 | Omron CS series, CJ series, and CP series PLCs through 2022-05-18 use cleartext passwords. They feature a UM Protection setting that allows users or system int… |
CVE-2022-30275 | High | 7.5 | 2022-07-26 | The Motorola MOSCAD Toolbox software through 2022-05-02 relies on a cleartext password. It utilizes an MDLC driver to communicate with MOSCAD/ACE RTUs for engi… |
CVE-2022-30273 | Critical | 9.8 | 2022-07-26 | The Motorola MDLC protocol through 2022-05-02 mishandles message integrity. It supports three security modes: Plain, Legacy Encryption, and New Encryption. In… |
CVE-2022-29965 | Medium | 5.5 | 2022-07-26 | The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. Access to privileged operations on the mainte… |
CVE-2022-29964 | Medium | 5.5 | 2022-07-26 | The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. WIOC SSH provides access to a shell as root… |
CVE-2022-29963 | Medium | 5.5 | 2022-07-26 | The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. TELNET on port 18550 provides access to a roo… |
CVE-2022-29962 | Medium | 5.5 | 2022-07-26 | The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. FTP has hardcoded credentials (but may often… |
CVE-2022-29960 | Medium | 5.5 | 2022-07-26 | Emerson OpenBSI through 2022-04-29 uses weak cryptography. It is an engineering environment for the ControlWave and Bristol Babcock line of RTUs. DES with hard… |
CVE-2022-29958 | Critical | 9.8 | 2022-07-26 | JTEKT TOYOPUC PLCs through 2022-04-29 do not ensure data integrity. They utilize the unauthenticated CMPLink/TCP protocol for engineering purposes, including d… |
CVE-2022-29957 | High | 7.8 | 2022-07-26 | The Emerson DeltaV Distributed Control System (DCS) through 2022-04-29 mishandles authentication. It utilizes several proprietary protocols for a wide variety… |
CVE-2022-29953 | Critical | 9.8 | 2022-07-26 | The Bently Nevada 3700 series of condition monitoring equipment through 2022-04-29 has a maintenance interface on port 4001/TCP with undocumented, hardcoded cr… |
CVE-2022-29952 | Critical | 9.1 | 2022-07-26 | Bently Nevada condition monitoring equipment through 2022-04-29 mishandles authentication. It utilizes the TDI command and data protocols (60005/TCP, 60007/TCP… |
CVE-2022-29951 | Critical | 9.1 | 2022-07-26 | JTEKT TOYOPUC PLCs through 2022-04-29 mishandle authentication. They utilize the CMPLink/TCP protocol (configurable on ports 1024-65534 on either TCP or UDP) f… |
CVE-2022-27105 | Medium | 5.4 | 2022-07-26 | InMailX Outlook Plugin < 3.22.0101 is vulnerable to Cross Site Scripting (XSS). InMailX Connection names are not sanitzed in the Outlook tab, which allows a lo… |
CVE-2022-1641 | High | 8.8 | 2022-07-26 | Use after free in Web UI Diagnostics in Google Chrome on Chrome OS prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific… |
CVE-2022-1640 | High | 8.8 | 2022-07-26 | Use after free in Sharing in Google Chrome prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UI interactions to poten… |
CVE-2022-1639 | High | 8.8 | 2022-07-26 | Use after free in ANGLE in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-1638 | High | 8.8 | 2022-07-26 | Heap buffer overflow in V8 Internationalization in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to potentially exploit heap corruption via a… |
CVE-2022-1637 | Medium | 4.3 | 2022-07-26 | Inappropriate implementation in Web Contents in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to leak cross-origin data via a crafted HTML pag… |
CVE-2022-1636 | High | 8.8 | 2022-07-26 | Use after free in Performance APIs in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2022-1635 | High | 8.8 | 2022-07-26 | Use after free in Permission Prompts in Google Chrome prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UI interactio… |
CVE-2022-1634 | High | 8.8 | 2022-07-26 | Use after free in Browser UI in Google Chrome prior to 101.0.4951.64 allowed a remote attacker who had convinced a user to engage in specific UI interaction to… |
CVE-2022-1633 | High | 8.8 | 2022-07-26 | Use after free in Sharesheet in Google Chrome on Chrome OS prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UI inter… |
CVE-2022-1501 | Medium | 6.5 | 2022-07-26 | Inappropriate implementation in iframe in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2022-1500 | Medium | 6.5 | 2022-07-26 | Insufficient data validation in Dev Tools in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass content security policy via a crafted HTM… |
CVE-2022-1499 | Medium | 6.3 | 2022-07-26 | Inappropriate implementation in WebAuthentication in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass same origin policy via a crafted… |
CVE-2022-1498 | Medium | 4.3 | 2022-07-26 | Inappropriate implementation in HTML Parser in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2022-1497 | Medium | 6.5 | 2022-07-26 | Inappropriate implementation in Input in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to spoof the contents of cross-origin websites via a cr… |
CVE-2022-1496 | High | 8.8 | 2022-07-26 | Use after free in File Manager in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via specific and direct… |
CVE-2022-1495 | Medium | 4.3 | 2022-07-26 | Incorrect security UI in Downloads in Google Chrome on Android prior to 101.0.4951.41 allowed a remote attacker to spoof the APK downloads dialog via a crafted… |
CVE-2022-1494 | Medium | 6.1 | 2022-07-26 | Insufficient data validation in Trusted Types in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass trusted types policy via a crafted HT… |
CVE-2022-1493 | High | 8.8 | 2022-07-26 | Use after free in Dev Tools in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via specific and direct us… |
CVE-2022-1492 | Medium | 6.1 | 2022-07-26 | Insufficient data validation in Blink Editing in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to inject arbitrary scripts or HTML via a craft… |
CVE-2022-1491 | High | 8.8 | 2022-07-26 | Use after free in Bookmarks in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via specific and direct us… |
CVE-2022-1490 | High | 8.8 | 2022-07-26 | Use after free in Browser Switcher in Google Chrome prior to 101.0.4951.41 allowed a remote attacker who convinced a user to engage in specific user interactio… |
CVE-2022-1489 | High | 8.8 | 2022-07-26 | Out of bounds memory access in UI Shelf in Google Chrome on Chrome OS, Lacros prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corr… |
CVE-2022-1488 | Medium | 4.3 | 2022-07-26 | Inappropriate implementation in Extensions API in Google Chrome prior to 101.0.4951.41 allowed an attacker who convinced a user to install a malicious extensio… |
CVE-2022-1487 | High | 7.5 | 2022-07-26 | Use after free in Ozone in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via running a Wayland test. |
CVE-2022-1486 | High | 8.8 | 2022-07-26 | Type confusion in V8 in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to obtain potentially sensitive information from process memory via a cr… |
CVE-2022-1485 | High | 7.5 | 2022-07-26 | Use after free in File System API in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
CVE-2022-1484 | High | 8.8 | 2022-07-26 | Heap buffer overflow in Web UI Settings in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted… |
CVE-2022-1483 | High | 8.8 | 2022-07-26 | Heap buffer overflow in WebGPU in Google Chrome prior to 101.0.4951.41 allowed a remote attacker who had compromised the renderer process to potentially exploi… |
CVE-2022-1482 | Medium | 6.5 | 2022-07-26 | Inappropriate implementation in WebGL in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HT… |
CVE-2022-1481 | High | 8.8 | 2022-07-26 | Use after free in Sharing in Google Chrome on Mac prior to 101.0.4951.41 allowed a remote attacker who convinced a user to engage in specific user interaction… |
CVE-2022-1479 | High | 8.8 | 2022-07-26 | Use after free in ANGLE in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-1478 | High | 8.8 | 2022-07-26 | Use after free in SwiftShader in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-1477 | High | 8.8 | 2022-07-26 | Use after free in Vulkan in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-1364 | High | 8.8 | 2022-07-26 | Type confusion in V8 Turbofan in Google Chrome prior to 100.0.4896.127 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-1671 | High | 7.1 | 2022-07-26 | A NULL pointer dereference flaw was found in rxrpc_preparse_s in net/rxrpc/server_key.c in the Linux kernel. This flaw allows a local attacker to crash the sys… |
CVE-2022-1651 | High | 7.1 | 2022-07-26 | A memory leak flaw was found in the Linux kernel in acrn_dev_ioctl in the drivers/virt/acrn/hsm.c function in how the ACRN Device Model emulates virtual NICs i… |
CVE-2022-35639 | High | 7.5 | 2022-07-26 | IBM Sterling Partner Engagement Manager 6.1, 6.2, and Cloud 22.2 do not limit the length of a connection which could cause the server to become unresponsive. I… |
CVE-2022-35286 | High | 8.8 | 2022-07-26 | IBM Security Verify Information Queue 10.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized ac… |
CVE-2022-22412 | Medium | 4.6 | 2022-07-26 | IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a user with access to the local host (client machine) to obtain a login access token. IBM… |
CVE-2022-1648 | Medium | 5.7 | 2022-07-26 | Pandora FMS v7.0NG.760 and below allows a relative path traversal in File Manager where a privileged user could upload a .php file outside the intended images… |
CVE-2022-36412 | Critical | 9.8 | 2022-07-26 | In Zoho ManageEngine SupportCenter Plus before 11023, V3 API requests are vulnerable to authentication bypass. (An API request may, in effect, be executed with… |
CVE-2022-36161 | Critical | 9.8 | 2022-07-26 | Orange Station 1.0 was discovered to contain a SQL injection vulnerability via the username parameter. |
CVE-2022-34991 | Medium | 5.4 | 2022-07-26 | Paymoney v3.3 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities via the first_name and last_name parameters. |
CVE-2022-34989 | Critical | 9.8 | 2022-07-26 | Fruits Bazar v1.0 was discovered to contain a SQL injection vulnerability via the recover_email parameter at user_password_recover.php. |
CVE-2022-34988 | Medium | 5.4 | 2022-07-26 | Inout Blockchain AltExchanger v1.2.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/js. |
CVE-2022-34067 | High | 7.5 | 2022-07-26 | Warehouse Management System v1.0 was discovered to contain a SQL injection vulnerability via the cari parameter. |
CVE-2022-33745 | High | 8.8 | 2022-07-26 | insufficient TLB flush for x86 PV guests in shadow mode For migration as well as to work around kernels unaware of L1TF (see XSA-273), PV guests may be run in… |
CVE-2022-31879 | High | 8.8 | 2022-07-26 | Online Fire Reporting System 1.0 is vulnerable to SQL Injection via the date parameter. |
CVE-2022-2225 | High | 8.1 | 2022-07-26 | By using warp-cli subcommands (disable-ethernet, disable-wifi), it was possible for a user without admin privileges to bypass configured Zero Trust security po… |
CVE-2022-33977 | High | 7.5 | 2022-07-26 | untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts recursive entity references in DTD… |
CVE-2022-31471 | High | 7.5 | 2022-07-26 | untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts XML external entity references. By… |
CVE-2022-30706 | Medium | 6.1 | 2022-07-26 | Open redirect vulnerability in Booked versions prior to 3.3 allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a… |
CVE-2022-1042 | High | 8.2 | 2022-07-26 | In Zephyr bluetooth mesh core stack, an out-of-bound write vulnerability can be triggered during provisioning. |
CVE-2022-1041 | High | 8.2 | 2022-07-26 | In Zephyr bluetooth mesh core stack, an out-of-bound write vulnerability can be triggered during provisioning. |
CVE-2022-22686 | Medium | 6.5 | 2022-07-26 | Cross-Site Request Forgery (CSRF) vulnerability in webapi component in Synology Calendar before 2.3.4-0631 allows remote authenticated users to hijack the auth… |