2022 CVEs (page 176)
Page 176 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-1933 | Medium | 6.1 | 2022-07-17 | The CDI WordPress plugin before 5.1.9 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both u… |
CVE-2022-1672 | High | 8.8 | 2022-07-17 | The Insights from Google PageSpeed WordPress plugin before 4.0.7 does not verify for CSRF before doing various actions such as deleting Custom URLs, which coul… |
CVE-2022-36126 | High | 7.2 | 2022-07-16 | An issue was discovered in Inductive Automation Ignition before 7.9.20 and 8.x before 8.1.17. The ScriptInvoke function allows remote attackers to execute arbi… |
CVE-2022-35906 | Low | 3.3 | 2022-07-15 | An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected version of MicroStation or MicroStation-b… |
CVE-2022-35905 | Low | 3.3 | 2022-07-15 | An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected version of MicroStation or MicroStation-b… |
CVE-2022-35904 | Low | 3.3 | 2022-07-15 | An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected version of MicroStation or MicroStation-b… |
CVE-2022-35903 | Low | 3.3 | 2022-07-15 | An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected version of MicroStation or MicroStation-b… |
CVE-2022-35902 | Low | 3.3 | 2022-07-15 | An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected version of MicroStation or MicroStation-b… |
CVE-2022-35901 | Low | 3.3 | 2022-07-15 | An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected version of MicroStation or MicroStation-b… |
CVE-2022-35900 | Low | 3.3 | 2022-07-15 | An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected version of MicroStation or MicroStation-b… |
CVE-2022-35890 | Critical | 9.8 | 2022-07-15 | An issue was discovered in Inductive Automation Ignition before 7.9.20 and 8.x before 8.1.17. Designer and Vision Client Session IDs are mishandled. An attacke… |
CVE-2022-32434 | High | 7.8 | 2022-07-15 | EIPStackGroup OpENer v2.3.0 was discovered to contain a stack overflow via /bin/posix/src/ports/POSIX/OpENer+0x56073d. |
CVE-2022-31161 | Critical | 10.0 | 2022-07-15 | Roxy-WI is a Web interface for managing HAProxy, Nginx and Keepalived servers. Prior to version 6.1.1.0, the system command can be run remotely via the subproc… |
CVE-2022-30634 | High | 7.5 | 2022-07-15 | Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 <… |
CVE-2022-25891 | High | 7.5 | 2022-07-15 | The package github.com/containrrr/shoutrrr/pkg/util before 0.6.0 are vulnerable to Denial of Service (DoS) via the util.PartitionMessage function. Exploiting t… |
CVE-2022-25869 | Medium | 4.2 | 2022-07-15 | All versions of the package angular; all versions of the package angularjs.core; all versions of the package angularjs are vulnerable to Cross-site Scripting (… |
CVE-2022-25858 | Medium | 5.3 | 2022-07-15 | The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular e… |
CVE-2022-31159 | High | 7.9 | 2022-07-15 | The AWS SDK for Java enables Java developers to work with Amazon Web Services. A partial-path traversal issue exists within the `downloadDirectory` method in t… |
CVE-2022-31158 | High | 7.5 | 2022-07-15 | LTI 1.3 Tool Library is a library used for building IMS-certified LTI 1.3 tool providers in PHP. Prior to version 5.0, the Nonce Claim Value was not being vali… |
CVE-2022-31157 | High | 7.5 | 2022-07-15 | LTI 1.3 Tool Library is a library used for building IMS-certified LTI 1.3 tool providers in PHP. Prior to version 5.0, the function used to generate random non… |
CVE-2022-31153 | Medium | 6.5 | 2022-07-15 | OpenZeppelin Contracts for Cairo is a library for contract development written in Cairo for StarkNet, a decentralized ZK Rollup. Version 0.2.0 is vulnerable to… |
CVE-2022-34252 | Medium | 5.5 | 2022-07-15 | Adobe InCopy versions 17.2 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitiv… |
CVE-2022-34251 | High | 7.8 | 2022-07-15 | Adobe InCopy versions 17.2 (and earlier) and 16.4.1 (and earlier) are affected by an Out-Of-Bounds Write vulnerability that could result in arbitrary code exec… |
CVE-2022-34250 | High | 7.8 | 2022-07-15 | Adobe InCopy versions 17.2 (and earlier) and 16.4.1 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary cod… |
CVE-2022-34249 | High | 7.8 | 2022-07-15 | Adobe InCopy versions 17.2 (and earlier) and 16.4.1 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary cod… |
CVE-2022-34248 | Medium | 5.5 | 2022-07-15 | Adobe InDesign versions 17.2.1 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which co… |
CVE-2022-34247 | High | 7.8 | 2022-07-15 | Adobe InDesign versions 17.2.1 (and earlier) and 16.4.1 (and earlier) are affected by an Out-Of-Bounds Write vulnerability that could result in arbitrary code… |
CVE-2022-34246 | High | 7.8 | 2022-07-15 | Adobe InDesign versions 17.2.1 (and earlier) and 16.4.1 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary… |
CVE-2022-34245 | High | 7.8 | 2022-07-15 | Adobe InDesign versions 17.2.1 (and earlier) and 16.4.1 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary… |
CVE-2022-34244 | Medium | 5.5 | 2022-07-15 | Adobe Photoshop versions 22.5.7 (and earlier) and 23.3.2 (and earlier) are affected by an Access of Uninitialized Pointer vulnerability that could lead to disc… |
CVE-2022-34243 | High | 7.8 | 2022-07-15 | Adobe Photoshop versions 22.5.7 (and earlier) and 23.3.2 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execu… |
CVE-2022-34242 | High | 7.8 | 2022-07-15 | Adobe Character Animator version 4.4.7 (and earlier) and 22.4 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, wh… |
CVE-2022-34241 | High | 7.8 | 2022-07-15 | Adobe Character Animator version 4.4.7 (and earlier) and 22.4 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arb… |
CVE-2022-34239 | Medium | 5.5 | 2022-07-15 | Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by an out-of-bounds read vulne… |
CVE-2022-34237 | Medium | 5.5 | 2022-07-15 | Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by a Use After Free vulnerabil… |
CVE-2022-34236 | Medium | 5.5 | 2022-07-15 | Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by an out-of-bounds read vulne… |
CVE-2022-34234 | Medium | 5.5 | 2022-07-15 | Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by a Use After Free vulnerabil… |
CVE-2022-34233 | Medium | 5.5 | 2022-07-15 | Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by a Use After Free vulnerabil… |
CVE-2022-34232 | Medium | 5.5 | 2022-07-15 | Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by a Use After Free vulnerabil… |
CVE-2022-34230 | High | 7.8 | 2022-07-15 | Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by a Use After Free vulnerabil… |
CVE-2022-34229 | High | 7.8 | 2022-07-15 | Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by a Use After Free vulnerabil… |
CVE-2022-34228 | High | 7.8 | 2022-07-15 | Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by an Access of Uninitialized… |
CVE-2022-34226 | High | 7.8 | 2022-07-15 | Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by an out-of-bounds read vulne… |
CVE-2022-34225 | High | 7.8 | 2022-07-15 | Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by a Use After Free vulnerabil… |
CVE-2022-34223 | High | 7.8 | 2022-07-15 | Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by a Use After Free vulnerabil… |
CVE-2022-34222 | High | 7.8 | 2022-07-15 | Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by an out-of-bounds read vulne… |
CVE-2022-34221 | High | 7.8 | 2022-07-15 | Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by an Access of Resource Using… |
CVE-2022-34220 | High | 7.8 | 2022-07-15 | Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by a Use After Free vulnerabil… |
CVE-2022-34219 | High | 7.8 | 2022-07-15 | Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by a Use After Free vulnerabil… |
CVE-2022-34217 | High | 7.8 | 2022-07-15 | Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by an Out-Of-Bounds Write vuln… |
CVE-2022-34216 | High | 7.8 | 2022-07-15 | Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by a Use After Free vulnerabil… |
CVE-2022-34215 | High | 7.8 | 2022-07-15 | Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by an out-of-bounds read vulne… |
CVE-2022-23201 | Medium | 6.1 | 2022-07-15 | Adobe RoboHelp versions 2020.0.7 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim… |
CVE-2022-23141 | High | 7.5 | 2022-07-15 | ZXMP M721 has an information leak vulnerability. Since the serial port authentication on the ZBOOT interface is not effective although it is enabled, an attack… |
CVE-2022-35409 | Critical | 9.1 | 2022-07-15 | An issue was discovered in Mbed TLS before 2.28.1 and 3.x before 3.2.0. In some configurations, an unauthenticated attacker can send an invalid ClientHello mes… |
CVE-2022-31107 | High | 7.1 | 2022-07-15 | Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9, 8.4.10, and 8.3.10, it is possible for a malicious use… |
CVE-2022-34826 | Medium | 5.9 | 2022-07-15 | In Couchbase Server 7.1.x before 7.1.1, an encrypted Private Key passphrase may be leaked in the logs. |
CVE-2022-32119 | High | 8.8 | 2022-07-15 | Arox School ERP Pro v1.0 was discovered to contain multiple arbitrary file upload vulnerabilities via the Add Photo function at photogalleries.inc.php and the… |
CVE-2022-32118 | Medium | 6.1 | 2022-07-15 | Arox School ERP Pro v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the dispatchcategory parameter in backoffice.inc.php. |
CVE-2022-31097 | High | 7.3 | 2022-07-15 | Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerabl… |
CVE-2022-30245 | Medium | 6.5 | 2022-07-15 | Honeywell Alerton Compass Software 1.6.5 allows unauthenticated configuration changes from remote users. This enables configuration data to be stored on the co… |
CVE-2022-30244 | High | 8.0 | 2022-07-15 | Honeywell Alerton Ascent Control Module (ACM) through 2022-05-04 allows unauthenticated programming writes from remote users. This enables code to be store on… |
CVE-2022-30243 | High | 8.8 | 2022-07-15 | Honeywell Alerton Visual Logic through 2022-05-04 allows unauthenticated programming writes from remote users. This enables code to be stored on the controller… |
CVE-2022-30242 | Medium | 6.8 | 2022-07-15 | Honeywell Alerton Ascent Control Module (ACM) through 2022-05-04 allows unauthenticated configuration changes from remote users. This enables configuration dat… |
CVE-2022-29890 | Medium | 6.1 | 2022-07-15 | In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link. |
CVE-2022-1881 | Medium | 5.3 | 2022-07-15 | In affected versions of Octopus Server an Insecure Direct Object Reference vulnerability exists where it is possible for a user to download Project Exports fro… |
CVE-2022-2420 | High | 8.0 | 2022-07-15 | A vulnerability was found in URVE Web Manager. It has been rated as critical. This issue affects some unknown processing of the file _internal/uploader.php. Th… |
CVE-2022-2419 | High | 8.0 | 2022-07-15 | A vulnerability was found in URVE Web Manager. It has been declared as critical. This vulnerability affects unknown code of the file _internal/collector/upload… |
CVE-2022-2418 | High | 8.0 | 2022-07-15 | A vulnerability was found in URVE Web Manager. It has been classified as critical. This affects an unknown part of the file kreator.html5/img_upload.php. The m… |
CVE-2022-34094 | Medium | 6.1 | 2022-07-14 | Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability via request_token.php. |
CVE-2022-34093 | Medium | 6.1 | 2022-07-14 | Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability via access_token.php. |
CVE-2022-34092 | Medium | 6.1 | 2022-07-14 | Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability via svg2img.php. |
CVE-2022-32425 | Medium | 5.3 | 2022-07-14 | The login function of Mealie v1.0.0beta-2 allows attackers to enumerate existing usernames by timing the server's response time. |
CVE-2022-32417 | Critical | 9.8 | 2022-07-14 | PbootCMS v3.1.2 was discovered to contain a remote code execution (RCE) vulnerability via the function parserIfLabel at function.php. |
CVE-2022-32416 | High | 7.2 | 2022-07-14 | Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/classes/Master.php?f=delete_product. |
CVE-2022-32415 | High | 8.8 | 2022-07-14 | Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/?p=products/view_product&id=. |
CVE-2022-32409 | Critical | 9.8 | 2022-07-14 | A local file inclusion (LFI) vulnerability in the component codemirror.php of Portal do Software Publico Brasileiro i3geo v7.0.5 allows attackers to execute ar… |
CVE-2022-32406 | Medium | 5.5 | 2022-07-14 | GtkRadiant v1.6.6 was discovered to contain a buffer overflow via the component q3map2. This vulnerability can cause a Denial of Service (DoS) via a crafted MA… |
CVE-2022-32389 | High | 7.5 | 2022-07-14 | Isode SWIFT v4.0.2 was discovered to contain hard-coded credentials in the Registry Editor. This allows attackers to access sensitive information such as user… |
CVE-2022-32323 | High | 7.3 | 2022-07-14 | AutoTrace v0.40.0 was discovered to contain a heap overflow via the ReadImage function at input-bmp.c:660. |
CVE-2022-32318 | Medium | 5.4 | 2022-07-14 | Fast Food Ordering System v1.0 was discovered to contain a persistent cross-site scripting (XSS) vulnerability via the component /ffos/classes/Master.php?f=sav… |
CVE-2022-32317 | Medium | 5.5 | 2022-07-14 | The MPlayer Project v1.5 was discovered to contain a heap use-after-free resulting in a double free in the preinit function at libvo/vo_v4l2.c. This vulnerabil… |
CVE-2022-32298 | High | 7.5 | 2022-07-14 | Toybox v0.8.7 was discovered to contain a NULL pointer dereference via the component httpd.c. This vulnerability can lead to a Denial of Service (DoS) via unsp… |
CVE-2022-32297 | High | 7.5 | 2022-07-14 | Piwigo v12.2.0 was discovered to contain SQL injection vulnerability via the Search function. |
CVE-2022-31156 | Medium | 6.6 | 2022-07-14 | Gradle is a build tool. Dependency verification is a security feature in Gradle Build Tool that was introduced to allow validation of external dependencies eit… |
CVE-2022-31147 | High | 7.5 | 2022-07-14 | The jQuery Validation Plugin (jquery-validation) provides drop-in validation for forms. Versions of jquery-validation prior to 1.19.5 are vulnerable to regular… |
CVE-2022-23825 | Medium | 6.5 | 2022-07-14 | Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially leading to information disclosure. |
CVE-2022-31142 | High | 7.5 | 2022-07-14 | @fastify/bearer-auth is a Fastify plugin to require bearer Authorization headers. @fastify/bearer-auth prior to versions 7.0.2 and 8.0.1 does not securely use… |
CVE-2022-2408 | Medium | 4.3 | 2022-07-14 | The Guest account feature in Mattermost version 6.7.0 and earlier fails to properly restrict the permissions, which allows a guest user to fetch a list of all… |
CVE-2022-2406 | Medium | 4.3 | 2022-07-14 | The legacy Slack import feature in Mattermost version 6.7.0 and earlier fails to properly limit the sizes of imported files, which allows an authenticated atta… |
CVE-2022-2401 | Medium | 6.5 | 2022-07-14 | Unrestricted information disclosure of all users in Mattermost version 6.7.0 and earlier allows team members to access some sensitive information by directly a… |
CVE-2022-22460 | High | 7.5 | 2022-07-14 | IBM Security Verify Identity Manager 10.0 contains sensitive information in the source code repository that could be used in further attacks against the system… |
CVE-2022-22453 | High | 7.5 | 2022-07-14 | IBM Security Verify Identity Manager 10.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive informati… |
CVE-2022-22452 | High | 7.5 | 2022-07-14 | IBM Security Verify Identity Manager 10.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM… |
CVE-2022-22450 | Low | 3.8 | 2022-07-14 | IBM Security Verify Identity Manager 10.0 could allow a privileged user to upload a malicious file by bypassing extension security in an HTTP request. IBM X-Fo… |
CVE-2022-35283 | Medium | 6.5 | 2022-07-14 | IBM Security Verify Information Queue 10.0.2 could allow an authenticated user to cause a denial of service with a specially crafted HTTP request. |
CVE-2022-22477 | Medium | 6.1 | 2022-07-14 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the W… |
CVE-2022-22473 | Medium | 5.3 | 2022-07-14 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper handling of Administra… |
CVE-2022-32225 | Medium | 6.1 | 2022-07-14 | A reflected DOM-Based XSS vulnerability has been discovered in the Help directory of Veeam Management Pack for Microsoft System Center 8.0. This vulnerability… |
CVE-2022-32223 | High | 7.3 | 2022-07-14 | Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim h… |