2022 CVEs (page 174)
Page 174 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-34169 | High | 7.5 | 2022-07-19 | The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java cl… |
CVE-2022-34024 | High | 7.2 | 2022-07-19 | Barangay Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the resident module editing function at /bmis/pages/reside… |
CVE-2022-30570 | Medium | 6.5 | 2022-07-19 | The Column Based Security component of TIBCO Software Inc.'s TIBCO Data Virtualization and TIBCO Data Virtualization for AWS Marketplace contains an easily exp… |
CVE-2022-2394 | Medium | 4.1 | 2022-07-19 | Puppet Bolt prior to version 3.24.0 will print sensitive parameters when planning a run resulting in them potentially being logged when run programmatically, s… |
CVE-2022-27373 | High | 8.8 | 2022-07-19 | Shanghai Feixun Data Communication Technology Co., Ltd router fir302b A2 was discovered to contain a remote command execution (RCE) vulnerability via the Ping… |
CVE-2022-34023 | Critical | 9.8 | 2022-07-19 | Barangay Management System v1.0 was discovered to contain a SQL injection vulnerability via the hidden_id parameter at /officials/officials.php. |
CVE-2022-34001 | Medium | 6.5 | 2022-07-19 | Unit4 ERP through 7.9 allows XXE via ExecuteServerProcessAsynchronously. |
CVE-2022-22417 | Medium | 5.4 | 2022-07-19 | IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitra… |
CVE-2022-22416 | Medium | 5.4 | 2022-07-19 | IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated at… |
CVE-2022-22360 | High | 8.8 | 2022-07-19 | IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 could allow a remote authenticated attacker to conduct an LDAP injection. By using a sp… |
CVE-2022-22359 | Medium | 6.5 | 2022-07-19 | IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to cross-site request forgery which could allow an attacker to execute ma… |
CVE-2022-22358 | High | 7.1 | 2022-07-19 | IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data… |
CVE-2022-35912 | Critical | 9.8 | 2022-07-19 | In grails-databinding in Grails before 3.3.15, 4.x before 4.1.1, 5.x before 5.1.9, and 5.2.x before 5.2.1 (at least when certain Java 8 configurations are used… |
CVE-2022-2469 | Low | 3.8 | 2022-07-19 | GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API client |
CVE-2022-27580 | High | 7.8 | 2022-07-19 | A deserialization vulnerability in a .NET framework class used and not properly checked by Safety Designer all versions up to and including 1.11.0 allows an at… |
CVE-2022-27579 | High | 7.8 | 2022-07-19 | A deserialization vulnerability in a .NET framework class used and not properly checked by Flexi Soft Designer in all versions up to and including 1.9.4 SP1 al… |
CVE-2022-27545 | Medium | 4.6 | 2022-07-19 | BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page. |
CVE-2022-27544 | Medium | 5.0 | 2022-07-19 | BigFix Web Reports authorized users may see SMTP credentials in clear text. |
CVE-2022-35405 | Critical | 9.8 | 2022-07-19 | Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEn… |
CVE-2022-2193 | High | 7.5 | 2022-07-19 | Insecure Direct Object Reference vulnerability in HYPR Server before version 6.14.1 allows remote authenticated attackers to add a FIDO2 authenticator to arbit… |
CVE-2022-2192 | High | 7.5 | 2022-07-19 | Forced Browsing vulnerability in HYPR Server version 6.10 to 6.15.1 allows remote attackers with a valid one-time recovery token to elevate privileges via path… |
CVE-2022-24082 | Critical | 9.8 | 2022-07-19 | If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filtering is not properly… |
CVE-2022-1984 | Medium | 4.5 | 2022-07-19 | This issue affects: HYPR Windows WFA versions prior to 7.2; Unsafe Deserialization vulnerability in HYPR Workforce Access (WFA) before version 7.2 may allow lo… |
CVE-2022-30302 | Medium | 6.5 | 2022-07-19 | Multiple relative path traversal vulnerabilities [CWE-23] in FortiDeceptor management interface 1.0.0 through 3.2.x, 3.3.0 through 3.3.2, 4.0.0 through 4.0.1 m… |
CVE-2022-30301 | High | 7.8 | 2022-07-19 | A path traversal vulnerability [CWE-22] in FortiAP-U CLI 6.2.0 through 6.2.3, 6.0.0 through 6.0.4, 5.4.0 through 5.4.6 may allow an admin user to delete and ac… |
CVE-2022-2454 | High | 7.8 | 2022-07-19 | Integer Overflow or Wraparound in GitHub repository gpac/gpac prior to 2.1-DEV. |
CVE-2022-2453 | High | 7.8 | 2022-07-19 | Use After Free in GitHub repository gpac/gpac prior to 2.1-DEV. |
CVE-2022-29060 | High | 8.1 | 2022-07-19 | A use of hard-coded cryptographic key vulnerability [CWE-321] in FortiDDoS API 5.5.0 through 5.5.1, 5.4.0 through 5.4.2, 5.3.0 through 5.3.1, 5.2.0, 5.1.0 may… |
CVE-2022-29057 | Medium | 5.4 | 2022-07-19 | A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiEDR version 5.1.0, 5.0.0 through 5.0.3 Patch 6 and 4.0… |
CVE-2022-27483 | High | 7.2 | 2022-07-19 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiManager version 7.0.0 through 7.0.3, 6.4.0 throug… |
CVE-2022-26113 | High | 7.7 | 2022-07-19 | An execution with unnecessary privileges vulnerability [CWE-250] in FortiClientWindows 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2.0 through 6.2.9, 6.0.0 thr… |
CVE-2022-2468 | Medium | 6.3 | 2022-07-19 | A vulnerability was found in SourceCodester Garage Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /ed… |
CVE-2022-2467 | High | 7.3 | 2022-07-19 | A vulnerability has been found in SourceCodester Garage Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /… |
CVE-2022-30532 | Medium | 5.3 | 2022-07-19 | In affected versions of Octopus Deploy, there is no logging of changes to artifacts within Octopus Deploy. |
CVE-2022-30526 | High | 7.8 | 2022-07-19 | A privilege escalation vulnerability was identified in the CLI command of Zyxel USG FLEX 100(W) firmware versions 4.50 through 5.30, USG FLEX 200 firmware vers… |
CVE-2022-2030 | Medium | 6.5 | 2022-07-19 | A directory traversal vulnerability caused by specific character sequences within an improperly sanitized URL was identified in some CGI programs of Zyxel USG… |
CVE-2022-34643 | Medium | 5.5 | 2022-07-18 | RISCV ISA Sim commit ac466a21df442c59962589ba296c702631e041b5 implements the incorrect exception priotrity when accessing memory. |
CVE-2022-34642 | Medium | 5.5 | 2022-07-18 | The component mcontrol.action in RISCV ISA Sim commit ac466a21df442c59962589ba296c702631e041b5 contains the incorrect mask which can cause a Denial of Service… |
CVE-2022-34641 | Medium | 5.5 | 2022-07-18 | CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a and RISCV-Boom commit ad64c5419151e5e886daee7084d8399713b46b4b implements the incorrect exception type whe… |
CVE-2022-34640 | Medium | 5.5 | 2022-07-18 | The *tval of ecall/ebreak in CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a was discovered to be incorrect. |
CVE-2022-34639 | Medium | 5.5 | 2022-07-18 | CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a treats non-standard fence instructions as illegal which can affect the function of the application. |
CVE-2022-34637 | Medium | 5.5 | 2022-07-18 | CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a implements an incorrect exception type when an illegal virtual address is loaded. |
CVE-2022-34636 | Medium | 5.5 | 2022-07-18 | CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a and RISCV-Boom commit ad64c5419151e5e886daee7084d8399713b46b4b implements the incorrect exception type whe… |
CVE-2022-34635 | Critical | 9.8 | 2022-07-18 | The mstatus.sd field in CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a does not update when the mstatus.fs field is set to Dirty. |
CVE-2022-34634 | Medium | 5.5 | 2022-07-18 | CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a executes crafted or incorrectly formatted det instructions rather create an exception. |
CVE-2022-34633 | Medium | 5.5 | 2022-07-18 | CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a executes crafted or incorrectly formatted sfence.vma instructions rather create an exception. |
CVE-2022-34632 | Critical | 9.1 | 2022-07-18 | Rocket-Chip commit 4f8114374d8824dfdec03f576a8cd68bebce4e56 was discovered to contain insufficient cryptography via the component /rocket/RocketCore.scala. |
CVE-2022-34035 | High | 7.5 | 2022-07-18 | HTMLDoc v1.9.12 and below was discovered to contain a heap overflow via e_node htmldoc/htmldoc/html.cxx:588. |
CVE-2022-34033 | High | 7.5 | 2022-07-18 | HTMLDoc v1.9.15 was discovered to contain a heap overflow via (write_header) /htmldoc/htmldoc/html.cxx:273. |
CVE-2022-34032 | High | 7.5 | 2022-07-18 | Nginx NJS v0.7.5 was discovered to contain a segmentation violation in the function njs_value_own_enumerate at src/njs_value.c. |
CVE-2022-34031 | High | 7.5 | 2022-07-18 | Nginx NJS v0.7.5 was discovered to contain a segmentation violation via njs_value_to_number at src/njs_value_conversion.h. |
CVE-2022-34030 | High | 7.5 | 2022-07-18 | Nginx NJS v0.7.5 was discovered to contain a segmentation violation via njs_djb_hash at src/njs_djb_hash.c. |
CVE-2022-34029 | Critical | 9.1 | 2022-07-18 | Nginx NJS v0.7.4 was discovered to contain an out-of-bounds read via njs_scope_value at njs_scope.h. |
CVE-2022-34028 | High | 7.5 | 2022-07-18 | Nginx NJS v0.7.5 was discovered to contain a segmentation violation via njs_utf8_next at src/njs_utf8.h. |
CVE-2022-34027 | High | 7.5 | 2022-07-18 | Nginx NJS v0.7.4 was discovered to contain a segmentation violation via njs_value_property at njs_value.c. |
CVE-2022-34875 | Low | 3.3 | 2022-07-18 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is re… |
CVE-2022-34874 | Low | 3.3 | 2022-07-18 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 11.2.2.53575. User interaction is re… |
CVE-2022-34873 | Low | 3.3 | 2022-07-18 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is re… |
CVE-2022-28683 | High | 7.8 | 2022-07-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required t… |
CVE-2022-28682 | High | 7.8 | 2022-07-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required t… |
CVE-2022-28681 | Medium | 6.1 | 2022-07-18 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is re… |
CVE-2022-28680 | High | 7.8 | 2022-07-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required t… |
CVE-2022-28679 | High | 7.8 | 2022-07-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required t… |
CVE-2022-28678 | High | 7.8 | 2022-07-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required t… |
CVE-2022-28677 | High | 7.8 | 2022-07-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required t… |
CVE-2022-28676 | High | 7.8 | 2022-07-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required t… |
CVE-2022-28675 | High | 7.8 | 2022-07-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required t… |
CVE-2022-28674 | High | 7.8 | 2022-07-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required t… |
CVE-2022-28673 | High | 7.8 | 2022-07-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required t… |
CVE-2022-28672 | High | 7.8 | 2022-07-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required t… |
CVE-2022-28671 | High | 7.8 | 2022-07-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required t… |
CVE-2022-28670 | High | 7.8 | 2022-07-18 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is re… |
CVE-2022-28669 | High | 7.8 | 2022-07-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required t… |
CVE-2022-26120 | Medium | 5.4 | 2022-07-18 | Multiple improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerabilities [CWE-89] in FortiADC management interface 7.0.0 t… |
CVE-2022-26118 | Medium | 6.7 | 2022-07-18 | A privilege chaining vulnerability [CWE-268] in FortiManager and FortiAnalyzer 6.0.x, 6.2.x, 6.4.0 through 6.4.7, 7.0.0 through 7.0.3 may allow a local and aut… |
CVE-2022-26117 | High | 8.8 | 2022-07-18 | An empty password in configuration file vulnerability [CWE-258] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and… |
CVE-2022-23438 | Medium | 4.7 | 2022-07-18 | An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in FortiOS version 7.0.5 and prior and 6.4.9 and… |
CVE-2022-22445 | Medium | 6.5 | 2022-07-18 | An attacker that gains service access to the FSP (POWER9 only) or gains admin authority to a partition can compromise partition firmware. |
CVE-2022-32387 | High | 7.5 | 2022-07-18 | In Kentico before 13.0.66, attackers can achieve Denial of Service via a crafted request to the GetResource handler. |
CVE-2022-2444 | High | 8.8 | 2022-07-18 | The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to deserialization of untrusted input via the 'remote_data' paramete… |
CVE-2022-2443 | High | 8.8 | 2022-07-18 | The FreeMind WP Browser plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.2. This is due to missing nonce pro… |
CVE-2022-2437 | Critical | 9.8 | 2022-07-18 | The Feed Them Social – for Twitter feed, Youtube and more plugin for WordPress is vulnerable to deserialization of untrusted input via the 'fts_url' parameter… |
CVE-2022-2435 | High | 8.8 | 2022-07-18 | The AnyMind Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.1. This is due to missing nonce protecti… |
CVE-2022-2224 | Medium | 5.4 | 2022-07-18 | The WordPress plugin Gallery for Social Photo is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.0.0.27 due to failure to properly… |
CVE-2022-2223 | Medium | 5.4 | 2022-07-18 | The WordPress plugin Image Slider is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.1.121 due to failure to properly check for the… |
CVE-2022-2117 | Medium | 5.3 | 2022-07-18 | The GiveWP plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.20.2 via the /donor-wall REST-API endpoin… |
CVE-2022-2108 | Medium | 6.5 | 2022-07-18 | The plugin Wbcom Designs – BuddyPress Group Reviews for WordPress is vulnerable to unauthorized settings changes and review modification due to missing capabil… |
CVE-2022-2101 | Medium | 6.4 | 2022-07-18 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `file[files][]` parameter in versions up to, and including, 3.2… |
CVE-2022-2039 | High | 8.8 | 2022-07-18 | The Free Live Chat Support plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.0.11. This is due to missing non… |
CVE-2022-2001 | High | 8.8 | 2022-07-18 | The DX Share Selection plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.4. This is due to missing nonce prot… |
CVE-2022-23745 | High | 7.5 | 2022-07-18 | A potential memory corruption issue was found in Capsule Workspace Android app (running on GrapheneOS). This could result in application crashing but could not… |
CVE-2022-22304 | Medium | 6.1 | 2022-07-18 | An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiAuthenticator OWA Agent for Microsoft version 2.2 and 2.1 may all… |
CVE-2022-1912 | High | 8.8 | 2022-07-18 | The Button Widget Smartsoft plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. This is due to missing no… |
CVE-2022-1565 | High | 7.2 | 2022-07-18 | The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, a… |
CVE-2022-35741 | Critical | 9.8 | 2022-07-18 | Apache CloudStack version 4.5.0 and later has a SAML 2.0 authentication Service Provider plugin which is found to be vulnerable to XML external entity (XXE) in… |
CVE-2022-34902 | High | 7.8 | 2022-07-18 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 (39316) Agent. An attacker must first obta… |
CVE-2022-34901 | High | 7.8 | 2022-07-18 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 (39316) Agent. An attacker must first obta… |
CVE-2022-34900 | High | 7.8 | 2022-07-18 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.3 (39313) Agent. An attacker must first obta… |
CVE-2022-34899 | High | 7.8 | 2022-07-18 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 (39316) Agent. An attacker must first obta… |
CVE-2022-34892 | High | 7.8 | 2022-07-18 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop Parallels Desktop 17.1.1. An attacker must firs… |