2022 CVEs (page 172)
Page 172 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-22555 | Medium | 6.0 | 2022-07-21 | Dell EMC PowerStore, contains an OS command injection Vulnerability. A locally authenticated attacker could potentially exploit this vulnerability, leading to… |
CVE-2022-20880 | Medium | 4.7 | 2022-07-21 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-20879 | Medium | 4.7 | 2022-07-21 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-20878 | Medium | 4.7 | 2022-07-21 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-20877 | Medium | 4.7 | 2022-07-21 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-20876 | Medium | 4.7 | 2022-07-21 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-20875 | Medium | 4.7 | 2022-07-21 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-20874 | Medium | 4.7 | 2022-07-21 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-20873 | Medium | 4.7 | 2022-07-21 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-20861 | Critical | 9.8 | 2022-07-21 | Multiple vulnerabilities in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to execute arbitrary commands, read or upload container image… |
CVE-2022-20860 | High | 7.4 | 2022-07-21 | A vulnerability in the SSL/TLS implementation of Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to alter communications with associated… |
CVE-2022-20858 | Critical | 9.8 | 2022-07-21 | Multiple vulnerabilities in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to execute arbitrary commands, read or upload container image… |
CVE-2022-20857 | Critical | 9.8 | 2022-07-21 | Multiple vulnerabilities in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to execute arbitrary commands, read or upload container image… |
CVE-2022-34590 | High | 7.2 | 2022-07-20 | Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in /HMS/admin.php. |
CVE-2022-34588 | High | 8.8 | 2022-07-20 | itsourcecode Advanced School Management System v1.0 is vulnerable to SQL Injection via the grade parameter at /school/view/timetable_insert_form.php. |
CVE-2022-34586 | High | 8.8 | 2022-07-20 | itsourcecode Advanced School Management System v1.0 is vulnerable to SQL Injection via the grade parameter at /school/view/student_grade_wise.php. |
CVE-2022-31160 | Medium | 6.1 | 2022-07-20 | jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulner… |
CVE-2022-29923 | Medium | 5.9 | 2022-07-20 | Cross-site Scripting (XSS) vulnerability in ThingsForRestaurants Quick Restaurant Reservations (WordPress plugin) allows Reflected XSS.This issue affects Quick… |
CVE-2022-29454 | Low | 3.1 | 2022-07-20 | Cross-Site Request Forgery (CSRF) vulnerability in WordPlus Better Messages plugin <= 1.9.9.148 at WordPress allows attackers to upload files. File attachment… |
CVE-2022-35569 | Medium | 4.8 | 2022-07-20 | Blogifier v3.0 was discovered to contain an arbitrary file upload vulnerability at /api/storage/upload/PostImage. This vulnerability allows attackers to execut… |
CVE-2022-26138 | Critical | 9.8 | 2022-07-20 | The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the usern… |
CVE-2022-26137 | High | 8.8 | 2022-07-20 | A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application… |
CVE-2022-26136 | Critical | 9.8 | 2022-07-20 | A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impa… |
CVE-2022-22424 | Medium | 5.5 | 2022-07-20 | IBM QRadar SIEM 7.3, 7.4, and 7.5 could allow a local user to obtain sensitive information from the TLS key file due to incorrect file permissions. IBM X-Force… |
CVE-2022-34049 | Medium | 5.3 | 2022-07-20 | An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows unauthenticated attackers to download log files and configuration data. |
CVE-2022-34048 | Medium | 6.1 | 2022-07-20 | Wavlink WN533A8 M33A8.V5030.190716 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the login_page parameter. |
CVE-2022-34047 | High | 7.5 | 2022-07-20 | An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/set_safety… |
CVE-2022-34046 | High | 7.5 | 2022-07-20 | An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/sysinit.shtm… |
CVE-2022-34045 | Critical | 9.8 | 2022-07-20 | Wavlink WN530HG4 M30HG4.V5030.191116 was discovered to contain a hardcoded encryption/decryption key for its configuration files at /etc_ro/lighttpd/www/cgi-bi… |
CVE-2022-34042 | High | 7.2 | 2022-07-20 | Barangay Management System v1.0 was discovered to contain a SQL injection vulnerability via the hidden_id parameter at /pages/household/household.php. |
CVE-2022-33320 | High | 7.8 | 2022-07-20 | Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENES… |
CVE-2022-33319 | High | 8.2 | 2022-07-20 | Out-of-bounds Read vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 1… |
CVE-2022-33318 | Critical | 9.8 | 2022-07-20 | Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENES… |
CVE-2022-33317 | High | 7.8 | 2022-07-20 | Inclusion of Functionality from Untrusted Control Sphere vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics… |
CVE-2022-33316 | High | 7.8 | 2022-07-20 | Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENES… |
CVE-2022-33315 | High | 7.8 | 2022-07-20 | Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENES… |
CVE-2022-29834 | High | 7.5 | 2022-07-20 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsub… |
CVE-2022-34150 | High | 7.1 | 2022-07-20 | The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object reference vulnerability on endpoint and parameter device IDs, which a… |
CVE-2022-33944 | Medium | 6.5 | 2022-07-20 | The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object references vulnerability on endpoint and POST parameter “Device ID,”… |
CVE-2022-2199 | High | 7.5 | 2022-07-20 | The main MiCODUS MV720 GPS tracker web server has a reflected cross-site scripting vulnerability that could allow an attacker to gain control by tricking a use… |
CVE-2022-2179 | Medium | 6.5 | 2022-07-20 | The X-Frame-Options header in Rockwell Automation MicroLogix 1100/1400 Versions 21.007 and prior is not configured in the HTTP response, which could allow clic… |
CVE-2022-2141 | Critical | 9.8 | 2022-07-20 | SMS-based GPS commands can be executed by MiCODUS MV720 GPS tracker without authentication. |
CVE-2022-2107 | Critical | 9.8 | 2022-07-20 | The MiCODUS MV720 GPS tracker API server has an authentication mechanism that allows devices to use a hard-coded master password. This may allow an attacker to… |
CVE-2022-1766 | High | 7.5 | 2022-07-20 | Anchore Enterprise anchorectl version 0.1.4 improperly stored credentials when generating a Software Bill of Materials. anchorectl will add the credentials use… |
CVE-2022-1264 | Medium | 6.8 | 2022-07-20 | The affected product may allow an attacker with access to the Ignition web configuration to run arbitrary code. |
CVE-2022-22221 | High | 7.8 | 2022-07-20 | An Improper Neutralization of Special Elements vulnerability in the download manager of Juniper Networks Junos OS on SRX Series and EX Series allows a locally… |
CVE-2022-22217 | Medium | 6.1 | 2022-07-20 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows an adjacent una… |
CVE-2022-22216 | Medium | 4.3 | 2022-07-20 | An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the PFE of Juniper Networks Junos OS on PTX Series and QFX10k Series allows an a… |
CVE-2022-22215 | Medium | 6.5 | 2022-07-20 | A Missing Release of File Descriptor or Handle after Effective Lifetime vulnerability in plugable authentication module (PAM) of Juniper Networks Junos OS and… |
CVE-2022-22214 | Medium | 6.5 | 2022-07-20 | An Improper Input Validation vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker… |
CVE-2022-22213 | Medium | 5.9 | 2022-07-20 | A vulnerability in Handling of Undefined Values in the routing protocol daemon (RPD) process of Juniper Networks Junos OS and Junos OS Evolved may allow an una… |
CVE-2022-22212 | High | 7.5 | 2022-07-20 | An Allocation of Resources Without Limits or Throttling vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved allows unauthe… |
CVE-2022-22210 | Medium | 6.5 | 2022-07-20 | A NULL Pointer Dereference vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on QFX5000 Series and MX Series allows an unauthent… |
CVE-2022-22209 | High | 7.5 | 2022-07-20 | A Missing Release of Memory after Effective Lifetime vulnerability in the kernel of Juniper Networks Junos OS allows an unauthenticated network based attacker… |
CVE-2022-22207 | High | 7.5 | 2022-07-20 | A Use After Free vulnerability in the Advanced Forwarding Toolkit (AFT) manager process (aftmand) of Juniper Networks Junos OS allows an unauthenticated networ… |
CVE-2022-22206 | High | 7.5 | 2022-07-20 | A Buffer Overflow vulnerability in the PFE of Juniper Networks Junos OS on SRX series allows an unauthenticated network based attacker to cause a Denial of Ser… |
CVE-2022-22205 | High | 7.5 | 2022-07-20 | A Missing Release of Memory after Effective Lifetime vulnerability in the Application Quality of Experience (appqoe) subsystem of the PFE of Juniper Networks J… |
CVE-2022-22204 | Medium | 5.3 | 2022-07-20 | An Improper Release of Memory Before Removing Last Reference vulnerability in the Session Initiation Protocol (SIP) Application Layer Gateway (ALG) of Juniper… |
CVE-2022-22203 | Medium | 6.5 | 2022-07-20 | An Incorrect Comparison vulnerability in PFE of Juniper Networks Junos OS allows an adjacent unauthenticated attacker to cause a Denial of Service (DoS). On QF… |
CVE-2022-22202 | Medium | 6.5 | 2022-07-20 | An Improper Handling of Exceptional Conditions vulnerability on specific PTX Series devices, including the PTX1000, PTX3000 (NextGen), PTX5000, PTX10002-60C, P… |
CVE-2022-34610 | Critical | 9.8 | 2022-07-20 | H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the URL /ihomers/app. |
CVE-2022-34609 | Critical | 9.8 | 2022-07-20 | H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the INTF parameter at /doping.asp. |
CVE-2022-34608 | Critical | 9.8 | 2022-07-20 | H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the ajaxmsg parameter at /AJAX/ajaxget. |
CVE-2022-34607 | Critical | 9.8 | 2022-07-20 | H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the HOST parameter at /doping.asp. |
CVE-2022-34606 | Critical | 9.8 | 2022-07-20 | H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the EditvsList parameter at /dotrace.asp. |
CVE-2022-34605 | Critical | 9.8 | 2022-07-20 | H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the HOST parameter at /dotrace.asp. |
CVE-2022-34604 | Critical | 9.8 | 2022-07-20 | H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the INTF parameter at /dotrace.asp. |
CVE-2022-34603 | Critical | 9.8 | 2022-07-20 | H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the DelDNSHnList interface at /goform/aspForm. |
CVE-2022-34602 | Critical | 9.8 | 2022-07-20 | H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the ipqos_lanip_editlist interface at /goform/aspForm. |
CVE-2022-34601 | Critical | 9.8 | 2022-07-20 | H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the Delstlist interface at /goform/aspForm. |
CVE-2022-34600 | Critical | 9.8 | 2022-07-20 | H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the EditSTList interface at /goform/aspForm. |
CVE-2022-34599 | Critical | 9.8 | 2022-07-20 | H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the EdittriggerList interface at /goform/aspForm. |
CVE-2022-36322 | Medium | 5.4 | 2022-07-20 | In JetBrains TeamCity before 2022.04.2 build parameter injection was possible |
CVE-2022-36321 | Medium | 4.1 | 2022-07-20 | In JetBrains TeamCity before 2022.04.2 the private SSH key could be written to the build log in some cases |
CVE-2022-24660 | High | 7.5 | 2022-07-20 | The debug interface of Goldshell ASIC Miners v2.2.1 and below was discovered to be exposed publicly on the web interface, allowing attackers to access password… |
CVE-2022-24659 | High | 7.5 | 2022-07-20 | Goldshell ASIC Miners v2.2.1 and below was discovered to contain a path traversal vulnerability which allows unauthenticated attackers to retrieve arbitrary fi… |
CVE-2022-24657 | Critical | 9.8 | 2022-07-20 | Goldshell ASIC Miners v2.1.x was discovered to contain hardcoded credentials which allow attackers to remotely connect via the SSH protocol (port 22). |
CVE-2022-2492 | Medium | 6.3 | 2022-07-20 | A vulnerability was found in SourceCodester Library Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /i… |
CVE-2022-2491 | Medium | 6.3 | 2022-07-20 | A vulnerability has been found in SourceCodester Library Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file… |
CVE-2022-2490 | Medium | 6.3 | 2022-07-20 | A vulnerability classified as critical has been found in SourceCodester Simple E-Learning System 1.0. Affected is an unknown function of the file search.php. T… |
CVE-2022-2489 | Medium | 6.3 | 2022-07-20 | A vulnerability was found in SourceCodester Simple E-Learning System 1.0. It has been rated as critical. This issue affects some unknown processing of the file… |
CVE-2022-2488 | High | 8.0 | 2022-07-20 | A vulnerability was found in WAVLINK WN535K2 and WN535K3 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/touchlist_… |
CVE-2022-2487 | High | 8.0 | 2022-07-20 | A vulnerability has been found in WAVLINK WN535K2 and WN535K3 and classified as critical. This vulnerability affects unknown code of the file /cgi-bin/nightled… |
CVE-2022-2486 | High | 8.0 | 2022-07-20 | A vulnerability, which was classified as critical, was found in WAVLINK WN535K2 and WN535K3. This affects an unknown part of the file /cgi-bin/mesh.cgi?page=up… |
CVE-2022-31250 | High | 7.1 | 2022-07-20 | A UNIX Symbolic Link (Symlink) Following vulnerability in keylime of openSUSE Tumbleweed allows local attackers to escalate from the keylime user to root. This… |
CVE-2022-34866 | High | 7.8 | 2022-07-20 | Passage Drive versions v1.4.0 to v1.5.1.0 and Passage Drive for Box version v1.0.0 contain an insufficient data verification vulnerability for interprocess com… |
CVE-2022-33967 | High | 7.8 | 2022-07-20 | squashfs filesystem implementation of U-Boot versions from v2020.10-rc2 to v2022.07-rc5 contains a heap-based buffer overflow vulnerability due to a defect in… |
CVE-2022-32962 | Medium | 6.8 | 2022-07-20 | HiCOS’ client-side citizen certificate component has a double free vulnerability. An unauthenticated physical attacker can exploit this vulnerability to corrup… |
CVE-2022-32961 | Medium | 6.8 | 2022-07-20 | HICOS’ client-side citizen digital certificate component has a stack-based buffer overflow vulnerability when reading IC card due to insufficient parameter len… |
CVE-2022-32960 | Medium | 6.8 | 2022-07-20 | HiCOS’ client-side citizen digital certificate component has a stack-based buffer overflow vulnerability when reading IC card due to insufficient parameter len… |
CVE-2022-32959 | Medium | 6.8 | 2022-07-20 | HiCOS’ client-side citizen digital certificate component has a stack-based buffer overflow vulnerability when reading IC card due to insufficient parameter len… |
CVE-2022-32958 | High | 7.7 | 2022-07-20 | A remote attacker with general user privilege can send a message to Teamplus Pro’s chat group that exceeds message size limit, to terminate other recipients’ T… |
CVE-2022-32458 | High | 7.5 | 2022-07-20 | Digiwin BPM has a XML External Entity Injection (XXE) vulnerability due to insufficient validation for user input. An unauthenticated remote attacker can perfo… |
CVE-2022-32457 | Medium | 5.3 | 2022-07-20 | Digiwin BPM has inadequate filtering for URL parameter. An unauthenticated remote attacker can perform Blind SSRF attack to discover internal network topology… |
CVE-2022-32456 | Critical | 9.8 | 2022-07-20 | Digiwin BPM’s function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL command to access, modify, delet… |
CVE-2022-21586 | Medium | 6.4 | 2022-07-19 | Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). The supported version that is… |
CVE-2022-21585 | Medium | 6.7 | 2022-07-19 | Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). The supported version that is… |
CVE-2022-21584 | Medium | 6.4 | 2022-07-19 | Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). The supported version that is… |
CVE-2022-21583 | Medium | 6.4 | 2022-07-19 | Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). The supported version that is… |
CVE-2022-21582 | Medium | 6.7 | 2022-07-19 | Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). The supported version that is… |