2022 CVEs (page 174)
Page 174 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-34539 | High | 8.8 | 2022-07-19 | Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 was discovered to contain a command injection vulnerability in the component /admin/curltest.cgi. This v… |
CVE-2022-34538 | High | 8.8 | 2022-07-19 | Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 was discovered to contain a command injection vulnerability in the component /admin/vca/bia/addacph.cgi… |
CVE-2022-34537 | Medium | 5.4 | 2022-07-19 | Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 was discovered to contain a cross-site scripting (XSS) vulnerability via the component bia_oneshot.cgi. |
CVE-2022-34536 | High | 7.5 | 2022-07-19 | Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 allows attackers to access the core log file and perform session hijacking via a crafted session token. |
CVE-2022-34535 | High | 7.5 | 2022-07-19 | Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 allows unauthenticated attackers to view internal paths and scripts via web files. |
CVE-2022-34534 | High | 7.5 | 2022-07-19 | Digital Watchdog DW Spectrum Server 4.2.0.32842 allows attackers to access sensitive infromation via a crafted API call. |
CVE-2022-34266 | Medium | 5.5 | 2022-07-19 | The libtiff-4.0.3-35.amzn2.0.1 package for LibTIFF on Amazon Linux 2 allows attackers to cause a denial of service (application crash), a different vulnerabili… |
CVE-2022-2476 | Medium | 5.5 | 2022-07-19 | A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ========================================… |
CVE-2022-2122 | High | 7.8 | 2022-07-19 | DOS / potential heap overwrite in qtdemux using zlib decompression. Integer overflow in qtdemux element in qtdemux_inflate function which causes a segfault, or… |
CVE-2022-1925 | High | 7.8 | 2022-07-19 | DOS / potential heap overwrite in mkv demuxing using HEADERSTRIP decompression. Integer overflow in matroskaparse element in gst_matroska_decompress_data funct… |
CVE-2022-1924 | High | 7.8 | 2022-07-19 | DOS / potential heap overwrite in mkv demuxing using lzo decompression. Integer overflow in matroskademux element in lzo decompression function which causes a… |
CVE-2022-1923 | High | 7.8 | 2022-07-19 | DOS / potential heap overwrite in mkv demuxing using bzip decompression. Integer overflow in matroskademux element in bzip decompression function which causes… |
CVE-2022-1922 | High | 7.8 | 2022-07-19 | DOS / potential heap overwrite in mkv demuxing using zlib decompression. Integer overflow in matroskademux element in gst_matroska_decompress_data function whi… |
CVE-2022-1921 | High | 7.8 | 2022-07-19 | Integer overflow in avidemux element in gst_avi_demux_invert function which allows a heap overwrite while parsing avi files. Potential for arbitrary code execu… |
CVE-2022-1920 | High | 7.8 | 2022-07-19 | Integer overflow in matroskademux element in gst_matroska_demux_add_wvpk_header function which allows a heap overwrite while parsing matroska files. Potential… |
CVE-2022-36305 | Medium | 6.1 | 2022-07-19 | Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the body function at /web/api/v1/upload/UploadHandler.php. |
CVE-2022-36304 | Medium | 6.1 | 2022-07-19 | Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the generate_response function at /web/api/v1/upload/UploadHandler.php. |
CVE-2022-36303 | Medium | 6.1 | 2022-07-19 | Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the handle_file_upload function at /web/api/v1/upload/UploadHandler.php. |
CVE-2022-34025 | Medium | 6.1 | 2022-07-19 | Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the post function at /web/api/v1/upload/UploadHandler.php. |
CVE-2022-34169 | High | 7.5 | 2022-07-19 | The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java cl… |
CVE-2022-34024 | High | 7.2 | 2022-07-19 | Barangay Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the resident module editing function at /bmis/pages/reside… |
CVE-2022-30570 | Medium | 6.5 | 2022-07-19 | The Column Based Security component of TIBCO Software Inc.'s TIBCO Data Virtualization and TIBCO Data Virtualization for AWS Marketplace contains an easily exp… |
CVE-2022-2394 | Medium | 4.1 | 2022-07-19 | Puppet Bolt prior to version 3.24.0 will print sensitive parameters when planning a run resulting in them potentially being logged when run programmatically, s… |
CVE-2022-27373 | High | 8.8 | 2022-07-19 | Shanghai Feixun Data Communication Technology Co., Ltd router fir302b A2 was discovered to contain a remote command execution (RCE) vulnerability via the Ping… |
CVE-2022-34023 | Critical | 9.8 | 2022-07-19 | Barangay Management System v1.0 was discovered to contain a SQL injection vulnerability via the hidden_id parameter at /officials/officials.php. |
CVE-2022-34001 | Medium | 6.5 | 2022-07-19 | Unit4 ERP through 7.9 allows XXE via ExecuteServerProcessAsynchronously. |
CVE-2022-22417 | Medium | 5.4 | 2022-07-19 | IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitra… |
CVE-2022-22416 | Medium | 5.4 | 2022-07-19 | IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated at… |
CVE-2022-22360 | High | 8.8 | 2022-07-19 | IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 could allow a remote authenticated attacker to conduct an LDAP injection. By using a sp… |
CVE-2022-22359 | Medium | 6.5 | 2022-07-19 | IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to cross-site request forgery which could allow an attacker to execute ma… |
CVE-2022-22358 | High | 7.1 | 2022-07-19 | IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data… |
CVE-2022-35912 | Critical | 9.8 | 2022-07-19 | In grails-databinding in Grails before 3.3.15, 4.x before 4.1.1, 5.x before 5.1.9, and 5.2.x before 5.2.1 (at least when certain Java 8 configurations are used… |
CVE-2022-2469 | Low | 3.8 | 2022-07-19 | GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API client |
CVE-2022-27580 | High | 7.8 | 2022-07-19 | A deserialization vulnerability in a .NET framework class used and not properly checked by Safety Designer all versions up to and including 1.11.0 allows an at… |
CVE-2022-27579 | High | 7.8 | 2022-07-19 | A deserialization vulnerability in a .NET framework class used and not properly checked by Flexi Soft Designer in all versions up to and including 1.9.4 SP1 al… |
CVE-2022-27545 | Medium | 4.6 | 2022-07-19 | BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page. |
CVE-2022-27544 | Medium | 5.0 | 2022-07-19 | BigFix Web Reports authorized users may see SMTP credentials in clear text. |
CVE-2022-35405 | Critical | 9.8 | 2022-07-19 | Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEn… |
CVE-2022-2193 | High | 7.5 | 2022-07-19 | Insecure Direct Object Reference vulnerability in HYPR Server before version 6.14.1 allows remote authenticated attackers to add a FIDO2 authenticator to arbit… |
CVE-2022-2192 | High | 7.5 | 2022-07-19 | Forced Browsing vulnerability in HYPR Server version 6.10 to 6.15.1 allows remote attackers with a valid one-time recovery token to elevate privileges via path… |
CVE-2022-24082 | Critical | 9.8 | 2022-07-19 | If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filtering is not properly… |
CVE-2022-1984 | Medium | 4.5 | 2022-07-19 | This issue affects: HYPR Windows WFA versions prior to 7.2; Unsafe Deserialization vulnerability in HYPR Workforce Access (WFA) before version 7.2 may allow lo… |
CVE-2022-30302 | Medium | 6.5 | 2022-07-19 | Multiple relative path traversal vulnerabilities [CWE-23] in FortiDeceptor management interface 1.0.0 through 3.2.x, 3.3.0 through 3.3.2, 4.0.0 through 4.0.1 m… |
CVE-2022-30301 | High | 7.8 | 2022-07-19 | A path traversal vulnerability [CWE-22] in FortiAP-U CLI 6.2.0 through 6.2.3, 6.0.0 through 6.0.4, 5.4.0 through 5.4.6 may allow an admin user to delete and ac… |
CVE-2022-2454 | High | 7.8 | 2022-07-19 | Integer Overflow or Wraparound in GitHub repository gpac/gpac prior to 2.1-DEV. |
CVE-2022-2453 | High | 7.8 | 2022-07-19 | Use After Free in GitHub repository gpac/gpac prior to 2.1-DEV. |
CVE-2022-29060 | High | 8.1 | 2022-07-19 | A use of hard-coded cryptographic key vulnerability [CWE-321] in FortiDDoS API 5.5.0 through 5.5.1, 5.4.0 through 5.4.2, 5.3.0 through 5.3.1, 5.2.0, 5.1.0 may… |
CVE-2022-29057 | Medium | 5.4 | 2022-07-19 | A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiEDR version 5.1.0, 5.0.0 through 5.0.3 Patch 6 and 4.0… |
CVE-2022-27483 | High | 7.2 | 2022-07-19 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiManager version 7.0.0 through 7.0.3, 6.4.0 throug… |
CVE-2022-26113 | High | 7.7 | 2022-07-19 | An execution with unnecessary privileges vulnerability [CWE-250] in FortiClientWindows 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2.0 through 6.2.9, 6.0.0 thr… |
CVE-2022-2468 | Medium | 6.3 | 2022-07-19 | A vulnerability was found in SourceCodester Garage Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /ed… |
CVE-2022-2467 | High | 7.3 | 2022-07-19 | A vulnerability has been found in SourceCodester Garage Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /… |
CVE-2022-30532 | Medium | 5.3 | 2022-07-19 | In affected versions of Octopus Deploy, there is no logging of changes to artifacts within Octopus Deploy. |
CVE-2022-30526 | High | 7.8 | 2022-07-19 | A privilege escalation vulnerability was identified in the CLI command of Zyxel USG FLEX 100(W) firmware versions 4.50 through 5.30, USG FLEX 200 firmware vers… |
CVE-2022-2030 | Medium | 6.5 | 2022-07-19 | A directory traversal vulnerability caused by specific character sequences within an improperly sanitized URL was identified in some CGI programs of Zyxel USG… |
CVE-2022-34643 | Medium | 5.5 | 2022-07-18 | RISCV ISA Sim commit ac466a21df442c59962589ba296c702631e041b5 implements the incorrect exception priotrity when accessing memory. |
CVE-2022-34642 | Medium | 5.5 | 2022-07-18 | The component mcontrol.action in RISCV ISA Sim commit ac466a21df442c59962589ba296c702631e041b5 contains the incorrect mask which can cause a Denial of Service… |
CVE-2022-34641 | Medium | 5.5 | 2022-07-18 | CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a and RISCV-Boom commit ad64c5419151e5e886daee7084d8399713b46b4b implements the incorrect exception type whe… |
CVE-2022-34640 | Medium | 5.5 | 2022-07-18 | The *tval of ecall/ebreak in CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a was discovered to be incorrect. |
CVE-2022-34639 | Medium | 5.5 | 2022-07-18 | CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a treats non-standard fence instructions as illegal which can affect the function of the application. |
CVE-2022-34637 | Medium | 5.5 | 2022-07-18 | CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a implements an incorrect exception type when an illegal virtual address is loaded. |
CVE-2022-34636 | Medium | 5.5 | 2022-07-18 | CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a and RISCV-Boom commit ad64c5419151e5e886daee7084d8399713b46b4b implements the incorrect exception type whe… |
CVE-2022-34635 | Critical | 9.8 | 2022-07-18 | The mstatus.sd field in CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a does not update when the mstatus.fs field is set to Dirty. |
CVE-2022-34634 | Medium | 5.5 | 2022-07-18 | CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a executes crafted or incorrectly formatted det instructions rather create an exception. |
CVE-2022-34633 | Medium | 5.5 | 2022-07-18 | CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a executes crafted or incorrectly formatted sfence.vma instructions rather create an exception. |
CVE-2022-34632 | Critical | 9.1 | 2022-07-18 | Rocket-Chip commit 4f8114374d8824dfdec03f576a8cd68bebce4e56 was discovered to contain insufficient cryptography via the component /rocket/RocketCore.scala. |
CVE-2022-34035 | High | 7.5 | 2022-07-18 | HTMLDoc v1.9.12 and below was discovered to contain a heap overflow via e_node htmldoc/htmldoc/html.cxx:588. |
CVE-2022-34033 | High | 7.5 | 2022-07-18 | HTMLDoc v1.9.15 was discovered to contain a heap overflow via (write_header) /htmldoc/htmldoc/html.cxx:273. |
CVE-2022-34032 | High | 7.5 | 2022-07-18 | Nginx NJS v0.7.5 was discovered to contain a segmentation violation in the function njs_value_own_enumerate at src/njs_value.c. |
CVE-2022-34031 | High | 7.5 | 2022-07-18 | Nginx NJS v0.7.5 was discovered to contain a segmentation violation via njs_value_to_number at src/njs_value_conversion.h. |
CVE-2022-34030 | High | 7.5 | 2022-07-18 | Nginx NJS v0.7.5 was discovered to contain a segmentation violation via njs_djb_hash at src/njs_djb_hash.c. |
CVE-2022-34029 | Critical | 9.1 | 2022-07-18 | Nginx NJS v0.7.4 was discovered to contain an out-of-bounds read via njs_scope_value at njs_scope.h. |
CVE-2022-34028 | High | 7.5 | 2022-07-18 | Nginx NJS v0.7.5 was discovered to contain a segmentation violation via njs_utf8_next at src/njs_utf8.h. |
CVE-2022-34027 | High | 7.5 | 2022-07-18 | Nginx NJS v0.7.4 was discovered to contain a segmentation violation via njs_value_property at njs_value.c. |
CVE-2022-34875 | Low | 3.3 | 2022-07-18 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is re… |
CVE-2022-34874 | Low | 3.3 | 2022-07-18 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 11.2.2.53575. User interaction is re… |
CVE-2022-34873 | Low | 3.3 | 2022-07-18 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is re… |
CVE-2022-28683 | High | 7.8 | 2022-07-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required t… |
CVE-2022-28682 | High | 7.8 | 2022-07-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required t… |
CVE-2022-28681 | Medium | 6.1 | 2022-07-18 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is re… |
CVE-2022-28680 | High | 7.8 | 2022-07-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required t… |
CVE-2022-28679 | High | 7.8 | 2022-07-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required t… |
CVE-2022-28678 | High | 7.8 | 2022-07-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required t… |
CVE-2022-28677 | High | 7.8 | 2022-07-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required t… |
CVE-2022-28676 | High | 7.8 | 2022-07-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required t… |
CVE-2022-28675 | High | 7.8 | 2022-07-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required t… |
CVE-2022-28674 | High | 7.8 | 2022-07-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required t… |
CVE-2022-28673 | High | 7.8 | 2022-07-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required t… |
CVE-2022-28672 | High | 7.8 | 2022-07-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required t… |
CVE-2022-28671 | High | 7.8 | 2022-07-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required t… |
CVE-2022-28670 | High | 7.8 | 2022-07-18 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is re… |
CVE-2022-28669 | High | 7.8 | 2022-07-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required t… |
CVE-2022-26120 | Medium | 5.4 | 2022-07-18 | Multiple improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerabilities [CWE-89] in FortiADC management interface 7.0.0 t… |
CVE-2022-26118 | Medium | 6.7 | 2022-07-18 | A privilege chaining vulnerability [CWE-268] in FortiManager and FortiAnalyzer 6.0.x, 6.2.x, 6.4.0 through 6.4.7, 7.0.0 through 7.0.3 may allow a local and aut… |
CVE-2022-26117 | High | 8.8 | 2022-07-18 | An empty password in configuration file vulnerability [CWE-258] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and… |
CVE-2022-23438 | Medium | 4.7 | 2022-07-18 | An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in FortiOS version 7.0.5 and prior and 6.4.9 and… |
CVE-2022-22445 | Medium | 6.5 | 2022-07-18 | An attacker that gains service access to the FSP (POWER9 only) or gains admin authority to a partition can compromise partition firmware. |
CVE-2022-32387 | High | 7.5 | 2022-07-18 | In Kentico before 13.0.66, attackers can achieve Denial of Service via a crafted request to the GetResource handler. |
CVE-2022-2444 | High | 8.8 | 2022-07-18 | The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to deserialization of untrusted input via the 'remote_data' paramete… |
CVE-2022-2443 | High | 8.8 | 2022-07-18 | The FreeMind WP Browser plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.2. This is due to missing nonce pro… |