2022 CVEs (page 177)
Page 177 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-32222 | Medium | 5.3 | 2022-07-14 | A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be access… |
CVE-2022-32215 | Medium | 6.5 | 2022-07-14 | The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead… |
CVE-2022-32214 | Medium | 6.5 | 2022-07-14 | The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can le… |
CVE-2022-32213 | Medium | 6.5 | 2022-07-14 | The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead… |
CVE-2022-32212 | High | 8.1 | 2022-07-14 | A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypas… |
CVE-2022-32210 | Medium | 6.5 | 2022-07-14 | `Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that p… |
CVE-2022-2393 | Medium | 5.7 | 2022-07-14 | A flaw was found in pki-core, which could allow a user to get a certificate for another user identity when directory-based authentication is enabled. This flaw… |
CVE-2022-29593 | Medium | 5.9 | 2022-07-14 | relay_cgi.cgi on Dingtian DT-R002 2CH relay devices with firmware 3.1.276A allows an attacker to replay HTTP post requests without the need for authentication… |
CVE-2022-28876 | Medium | 4.3 | 2022-07-14 | A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant and in certain WithSecure products whereby the scanning the aeheur.dll component can… |
CVE-2022-1662 | Medium | 5.5 | 2022-07-14 | In convert2rhel, there's an ansible playbook named ansible/run-convert2rhel.yml which passes the Red Hat Subscription Manager user password via the CLI to conv… |
CVE-2022-30024 | High | 8.8 | 2022-07-14 | A buffer overflow in the httpd daemon on TP-Link TL-WR841N V12 (firmware version 3.16.9) devices allows an authenticated remote attacker to execute arbitrary c… |
CVE-2022-30113 | Critical | 9.8 | 2022-07-14 | Electronic mall system 1.0_build20200203 is affected vulnerable to SQL Injection. |
CVE-2022-28377 | High | 7.5 | 2022-07-14 | On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static account userna… |
CVE-2022-28375 | Critical | 9.8 | 2022-07-14 | Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 does not property sanitize user-controlled parameters within the crtcswitchsimprofile function of the crtc… |
CVE-2022-28374 | High | 8.8 | 2022-07-14 | Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 does not property sanitize user-controlled parameters within the DMACC URLs on the Settings page of the En… |
CVE-2022-28373 | Critical | 9.8 | 2022-07-14 | Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 does not properly sanitize user-controlled parameters within the crtcreadpartition function of the crtcrpc… |
CVE-2022-28372 | High | 7.5 | 2022-07-14 | On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints provide a means of provisioning… |
CVE-2022-28371 | High | 7.5 | 2022-07-14 | On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static certificate fo… |
CVE-2022-28370 | High | 7.5 | 2022-07-14 | On Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 devices, the RPC endpoint crtc_fw_upgrade provides a means of provisioning a firmware update for the de… |
CVE-2022-28369 | Critical | 9.8 | 2022-07-14 | Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 does not validate the user-provided URL within the crtcmode function's enable_ssh sub-operation of the crtc… |
CVE-2022-2396 | Low | 3.5 | 2022-07-14 | A vulnerability classified as problematic was found in SourceCodester Simple e-Learning System 1.0. Affected by this vulnerability is an unknown functionality… |
CVE-2022-25803 | Medium | 6.1 | 2022-07-14 | Best Practical Request Tracker (RT) before 5.0.3 has an Open Redirect via a ticket search. |
CVE-2022-25802 | Medium | 6.1 | 2022-07-14 | Best Practical Request Tracker (RT) before 4.4.6 and 5.x before 5.0.3 allows XSS via a crafted content type for an attachment. |
CVE-2022-25801 | Critical | 9.1 | 2022-07-14 | Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via Scripted Action tools. |
CVE-2022-25800 | Critical | 9.1 | 2022-07-14 | Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via the whois lookup tool. |
CVE-2022-35857 | Critical | 9.8 | 2022-07-13 | kvf-admin through 2022-02-12 allows remote attackers to execute arbitrary code because deserialization is mishandled. The rememberMe parameter is encrypted wit… |
CVE-2022-34765 | Medium | 5.5 | 2022-07-13 | A CWE-73: External Control of File Name or Path vulnerability exists that could cause loading of unauthorized firmware images when user-controlled data is writ… |
CVE-2022-34764 | Medium | 5.9 | 2022-07-13 | A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause denial of service when parsing the URL… |
CVE-2022-34763 | Medium | 5.9 | 2022-07-13 | A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could cause loading of unauthorized firmware images due to improper verific… |
CVE-2022-34762 | Medium | 5.9 | 2022-07-13 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause unauthorized firmware image load… |
CVE-2022-34761 | High | 7.5 | 2022-07-13 | A CWE-476: NULL Pointer Dereference vulnerability exists that could cause a denial of service of the webserver when parsing JSON content type. Affected Product… |
CVE-2022-34760 | High | 7.5 | 2022-07-13 | A CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability exists that could cause a denial of service of the webserver due to improper ha… |
CVE-2022-34759 | High | 7.5 | 2022-07-13 | A CWE-787: Out-of-bounds Write vulnerability exists that could cause a denial of service of the webserver due to improper parsing of the HTTP Headers. Affected… |
CVE-2022-34758 | Medium | 5.1 | 2022-07-13 | A CWE-20: Improper Input Validation vulnerability exists that could cause the device watchdog function to be disabled if the attacker had access to privileged… |
CVE-2022-34757 | Medium | 6.7 | 2022-07-13 | A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists where weak cipher suites can be used for the SSH connection between Easergy Pr… |
CVE-2022-34756 | High | 8.8 | 2022-07-13 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in remote code execution or the crash of HTTPs stack which is used… |
CVE-2022-34754 | Medium | 6.8 | 2022-07-13 | A CWE-269: Improper Privilege Management vulnerability exists that could allow elevated functionality when guessing credentials. Affected Products: Acti9 Power… |
CVE-2022-34753 | High | 8.8 | 2022-07-13 | A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote root exploit… |
CVE-2022-32117 | High | 7.8 | 2022-07-13 | Jerryscript v2.4.0 was discovered to contain a stack buffer overflow via the function jerryx_print_unhandled_exception in /util/print.c. |
CVE-2022-32114 | High | 8.8 | 2022-07-13 | An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file. NOTE… |
CVE-2022-31145 | Medium | 6.5 | 2022-07-13 | FlyteAdmin is the control plane for Flyte responsible for managing entities and administering workflow executions. In versions 1.1.30 and prior, authenticated… |
CVE-2022-32308 | Medium | 6.1 | 2022-07-13 | Cross Site Scripting (XSS) vulnerability in uBlock Origin extension before 1.41.1 allows remote attackers to run arbitrary code via a spoofed 'MessageSender.ur… |
CVE-2022-2380 | Medium | 5.5 | 2022-07-13 | The Linux kernel was found vulnerable out of bounds memory access in the drivers/video/fbdev/sm712fb.c:smtcfb_read() function. The vulnerability could result i… |
CVE-2022-22982 | High | 7.5 | 2022-07-13 | The vCenter Server contains a server-side request forgery (SSRF) vulnerability. A malicious actor with network access to 443 on the vCenter Server may exploit… |
CVE-2022-20238 | Critical | 9.8 | 2022-07-13 | 'remap_pfn_range' here may map out of size kernel memory (for example, may map the kernel area), and because the 'vma->vm_page_prot' can also be controlled by… |
CVE-2022-20236 | High | 7.5 | 2022-07-13 | A drm driver have oob problem, could cause the system crash or EOPProduct: AndroidVersions: Android SoCAndroid ID: A-233124709 |
CVE-2022-20234 | High | 7.5 | 2022-07-13 | In Car Settings app, the NotificationAccessConfirmationActivity is exported. In NotificationAccessConfirmationActivity, it gets both 'mComponentName' and 'pkgT… |
CVE-2022-20230 | Medium | 5.5 | 2022-07-13 | In choosePrivateKeyAlias of KeyChain.java, there is a possible access to the user's certificate due to improper input validation. This could lead to local info… |
CVE-2022-20229 | Critical | 9.8 | 2022-07-13 | In bta_hf_client_handle_cind_list_item of bta_hf_client_at.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote… |
CVE-2022-20228 | Medium | 6.5 | 2022-07-13 | In various functions of C2DmaBufAllocator.cpp, there is a possible memory corruption due to a use after free. This could lead to remote information disclosure… |
CVE-2022-20227 | Medium | 5.5 | 2022-07-13 | In USB driver, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with User execution privil… |
CVE-2022-20226 | Low | 3.9 | 2022-07-13 | In finishDrawingWindow of WindowManagerService.java, there is a possible tapjacking due to improper input validation. This could lead to local escalation of pr… |
CVE-2022-20225 | Medium | 5.5 | 2022-07-13 | In getSubscriptionProperty of SubscriptionController.java, there is a possible read of a sensitive identifier due to a missing permission check. This could lea… |
CVE-2022-20224 | High | 7.5 | 2022-07-13 | In AT_SKIP_REST of bta_hf_client_at.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote information disclosu… |
CVE-2022-20223 | High | 7.8 | 2022-07-13 | In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible way to start a phone call without permissions due to a confused deputy… |
CVE-2022-20222 | Critical | 9.8 | 2022-07-13 | In read_attr_value of gatt_db.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no addit… |
CVE-2022-20221 | Medium | 6.5 | 2022-07-13 | In avrc_ctrl_pars_vendor_cmd of avrc_pars_ct.cc, there is a possible out of bounds read due to improper input validation. This could lead to remote information… |
CVE-2022-20220 | High | 7.8 | 2022-07-13 | In openFile of CallLogProvider.java, there is a possible permission bypass due to a path traversal error. This could lead to local escalation of privilege with… |
CVE-2022-20219 | Medium | 5.5 | 2022-07-13 | In multiple functions of StorageManagerService.java and UserManagerService.java, there is a possible way to leave user's directories unencrypted due to a logic… |
CVE-2022-20218 | High | 7.8 | 2022-07-13 | In PermissionController, there is a possible way to get and retain permissions without user's consent due to a logic error in the code. This could lead to loca… |
CVE-2022-20217 | Medium | 6.5 | 2022-07-13 | There is a unauthorized broadcast in the SprdContactsProvider. A third-party app could use this issue to delete Fdn contact.Product: AndroidVersions: Android S… |
CVE-2022-20216 | Critical | 9.8 | 2022-07-13 | android exported is used to set third-party app access permissions, and the default value of intent-filter is true. com.sprd.firewall has set exported as true… |
CVE-2022-20212 | High | 7.8 | 2022-07-13 | In wifi.RequestToggleWifiActivity of AndroidManifest.xml, there is a possible EoP due to a tapjacking/overlay attack. This could lead to local escalation of pr… |
CVE-2022-28888 | Critical | 9.8 | 2022-07-13 | Spryker Commerce OS 1.4.2 allows Remote Command Execution. |
CVE-2022-34358 | Medium | 5.4 | 2022-07-13 | IBM i 7.2, 7.3, 7.4, and 7.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alter… |
CVE-2022-32096 | High | 7.5 | 2022-07-13 | Rhonabwy before v1.1.5 was discovered to contain a buffer overflow via the component r_jwe_aesgcm_key_unwrap. This vulnerability allows attackers to cause a De… |
CVE-2022-32074 | Medium | 5.4 | 2022-07-13 | A stored cross-site scripting (XSS) vulnerability in the component audit/class.audit.php of osTicket-plugins - Storage-FS before commit a7842d494889fd5533d13de… |
CVE-2022-32073 | Critical | 9.8 | 2022-07-13 | WolfSSH v1.4.7 was discovered to contain an integer overflow via the function wolfSSH_SFTP_RecvRMDIR. |
CVE-2022-32065 | Medium | 5.4 | 2022-07-13 | An arbitrary file upload vulnerability in the background management module of RuoYi v4.7.3 and below allows attackers to execute arbitrary code via a crafted H… |
CVE-2022-32274 | Medium | 5.4 | 2022-07-13 | The Transition Scheduler add-on 6.5.0 for Atlassian Jira is prone to stored XSS via the project name to the creation function. |
CVE-2022-31781 | High | 7.5 | 2022-07-13 | Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles Content Types. Specially crafted Conten… |
CVE-2022-35628 | Critical | 9.8 | 2022-07-12 | A SQL injection issue was discovered in the lux extension before 17.6.1, and 18.x through 24.x before 24.0.2, for TYPO3. |
CVE-2022-33678 | High | 7.2 | 2022-07-12 | Azure Site Recovery Remote Code Execution Vulnerability |
CVE-2022-33677 | High | 7.2 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33676 | High | 7.2 | 2022-07-12 | Azure Site Recovery Remote Code Execution Vulnerability |
CVE-2022-33675 | High | 7.8 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33674 | High | 8.3 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33673 | Medium | 6.5 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33672 | Medium | 6.5 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33671 | Medium | 4.9 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33669 | Medium | 4.9 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33668 | Medium | 4.9 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33667 | Medium | 6.5 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33666 | Medium | 6.5 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33665 | Medium | 6.5 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33664 | Medium | 4.9 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33663 | Medium | 6.5 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33662 | Medium | 6.5 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33661 | Medium | 6.5 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33660 | Medium | 4.9 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33659 | Medium | 4.9 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33658 | Medium | 4.9 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33657 | Medium | 6.5 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33656 | Medium | 6.5 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33655 | Medium | 6.5 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33654 | Medium | 4.9 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33653 | Medium | 4.9 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33652 | Medium | 4.9 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33651 | Medium | 4.9 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33650 | Medium | 4.9 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |