2022 CVEs (page 177)
Page 177 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-28369 | Critical | 9.8 | 2022-07-14 | Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 does not validate the user-provided URL within the crtcmode function's enable_ssh sub-operation of the crtc… |
CVE-2022-2396 | Low | 3.5 | 2022-07-14 | A vulnerability classified as problematic was found in SourceCodester Simple e-Learning System 1.0. Affected by this vulnerability is an unknown functionality… |
CVE-2022-25803 | Medium | 6.1 | 2022-07-14 | Best Practical Request Tracker (RT) before 5.0.3 has an Open Redirect via a ticket search. |
CVE-2022-25802 | Medium | 6.1 | 2022-07-14 | Best Practical Request Tracker (RT) before 4.4.6 and 5.x before 5.0.3 allows XSS via a crafted content type for an attachment. |
CVE-2022-25801 | Critical | 9.1 | 2022-07-14 | Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via Scripted Action tools. |
CVE-2022-25800 | Critical | 9.1 | 2022-07-14 | Best Practical RT for Incident Response (RTIR) before 4.0.3 and 5.x before 5.0.3 allows SSRF via the whois lookup tool. |
CVE-2022-35857 | Critical | 9.8 | 2022-07-13 | kvf-admin through 2022-02-12 allows remote attackers to execute arbitrary code because deserialization is mishandled. The rememberMe parameter is encrypted wit… |
CVE-2022-34765 | Medium | 5.5 | 2022-07-13 | A CWE-73: External Control of File Name or Path vulnerability exists that could cause loading of unauthorized firmware images when user-controlled data is writ… |
CVE-2022-34764 | Medium | 5.9 | 2022-07-13 | A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause denial of service when parsing the URL… |
CVE-2022-34763 | Medium | 5.9 | 2022-07-13 | A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could cause loading of unauthorized firmware images due to improper verific… |
CVE-2022-34762 | Medium | 5.9 | 2022-07-13 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause unauthorized firmware image load… |
CVE-2022-34761 | High | 7.5 | 2022-07-13 | A CWE-476: NULL Pointer Dereference vulnerability exists that could cause a denial of service of the webserver when parsing JSON content type. Affected Product… |
CVE-2022-34760 | High | 7.5 | 2022-07-13 | A CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability exists that could cause a denial of service of the webserver due to improper ha… |
CVE-2022-34759 | High | 7.5 | 2022-07-13 | A CWE-787: Out-of-bounds Write vulnerability exists that could cause a denial of service of the webserver due to improper parsing of the HTTP Headers. Affected… |
CVE-2022-34758 | Medium | 5.1 | 2022-07-13 | A CWE-20: Improper Input Validation vulnerability exists that could cause the device watchdog function to be disabled if the attacker had access to privileged… |
CVE-2022-34757 | Medium | 6.7 | 2022-07-13 | A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists where weak cipher suites can be used for the SSH connection between Easergy Pr… |
CVE-2022-34756 | High | 8.8 | 2022-07-13 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in remote code execution or the crash of HTTPs stack which is used… |
CVE-2022-34754 | Medium | 6.8 | 2022-07-13 | A CWE-269: Improper Privilege Management vulnerability exists that could allow elevated functionality when guessing credentials. Affected Products: Acti9 Power… |
CVE-2022-34753 | High | 8.8 | 2022-07-13 | A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote root exploit… |
CVE-2022-32117 | High | 7.8 | 2022-07-13 | Jerryscript v2.4.0 was discovered to contain a stack buffer overflow via the function jerryx_print_unhandled_exception in /util/print.c. |
CVE-2022-32114 | High | 8.8 | 2022-07-13 | An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file. NOTE… |
CVE-2022-31145 | Medium | 6.5 | 2022-07-13 | FlyteAdmin is the control plane for Flyte responsible for managing entities and administering workflow executions. In versions 1.1.30 and prior, authenticated… |
CVE-2022-32308 | Medium | 6.1 | 2022-07-13 | Cross Site Scripting (XSS) vulnerability in uBlock Origin extension before 1.41.1 allows remote attackers to run arbitrary code via a spoofed 'MessageSender.ur… |
CVE-2022-2380 | Medium | 5.5 | 2022-07-13 | The Linux kernel was found vulnerable out of bounds memory access in the drivers/video/fbdev/sm712fb.c:smtcfb_read() function. The vulnerability could result i… |
CVE-2022-22982 | High | 7.5 | 2022-07-13 | The vCenter Server contains a server-side request forgery (SSRF) vulnerability. A malicious actor with network access to 443 on the vCenter Server may exploit… |
CVE-2022-20238 | Critical | 9.8 | 2022-07-13 | 'remap_pfn_range' here may map out of size kernel memory (for example, may map the kernel area), and because the 'vma->vm_page_prot' can also be controlled by… |
CVE-2022-20236 | High | 7.5 | 2022-07-13 | A drm driver have oob problem, could cause the system crash or EOPProduct: AndroidVersions: Android SoCAndroid ID: A-233124709 |
CVE-2022-20234 | High | 7.5 | 2022-07-13 | In Car Settings app, the NotificationAccessConfirmationActivity is exported. In NotificationAccessConfirmationActivity, it gets both 'mComponentName' and 'pkgT… |
CVE-2022-20230 | Medium | 5.5 | 2022-07-13 | In choosePrivateKeyAlias of KeyChain.java, there is a possible access to the user's certificate due to improper input validation. This could lead to local info… |
CVE-2022-20229 | Critical | 9.8 | 2022-07-13 | In bta_hf_client_handle_cind_list_item of bta_hf_client_at.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote… |
CVE-2022-20228 | Medium | 6.5 | 2022-07-13 | In various functions of C2DmaBufAllocator.cpp, there is a possible memory corruption due to a use after free. This could lead to remote information disclosure… |
CVE-2022-20227 | Medium | 5.5 | 2022-07-13 | In USB driver, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with User execution privil… |
CVE-2022-20226 | Low | 3.9 | 2022-07-13 | In finishDrawingWindow of WindowManagerService.java, there is a possible tapjacking due to improper input validation. This could lead to local escalation of pr… |
CVE-2022-20225 | Medium | 5.5 | 2022-07-13 | In getSubscriptionProperty of SubscriptionController.java, there is a possible read of a sensitive identifier due to a missing permission check. This could lea… |
CVE-2022-20224 | High | 7.5 | 2022-07-13 | In AT_SKIP_REST of bta_hf_client_at.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote information disclosu… |
CVE-2022-20223 | High | 7.8 | 2022-07-13 | In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible way to start a phone call without permissions due to a confused deputy… |
CVE-2022-20222 | Critical | 9.8 | 2022-07-13 | In read_attr_value of gatt_db.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no addit… |
CVE-2022-20221 | Medium | 6.5 | 2022-07-13 | In avrc_ctrl_pars_vendor_cmd of avrc_pars_ct.cc, there is a possible out of bounds read due to improper input validation. This could lead to remote information… |
CVE-2022-20220 | High | 7.8 | 2022-07-13 | In openFile of CallLogProvider.java, there is a possible permission bypass due to a path traversal error. This could lead to local escalation of privilege with… |
CVE-2022-20219 | Medium | 5.5 | 2022-07-13 | In multiple functions of StorageManagerService.java and UserManagerService.java, there is a possible way to leave user's directories unencrypted due to a logic… |
CVE-2022-20218 | High | 7.8 | 2022-07-13 | In PermissionController, there is a possible way to get and retain permissions without user's consent due to a logic error in the code. This could lead to loca… |
CVE-2022-20217 | Medium | 6.5 | 2022-07-13 | There is a unauthorized broadcast in the SprdContactsProvider. A third-party app could use this issue to delete Fdn contact.Product: AndroidVersions: Android S… |
CVE-2022-20216 | Critical | 9.8 | 2022-07-13 | android exported is used to set third-party app access permissions, and the default value of intent-filter is true. com.sprd.firewall has set exported as true… |
CVE-2022-20212 | High | 7.8 | 2022-07-13 | In wifi.RequestToggleWifiActivity of AndroidManifest.xml, there is a possible EoP due to a tapjacking/overlay attack. This could lead to local escalation of pr… |
CVE-2022-28888 | Critical | 9.8 | 2022-07-13 | Spryker Commerce OS 1.4.2 allows Remote Command Execution. |
CVE-2022-34358 | Medium | 5.4 | 2022-07-13 | IBM i 7.2, 7.3, 7.4, and 7.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alter… |
CVE-2022-32096 | High | 7.5 | 2022-07-13 | Rhonabwy before v1.1.5 was discovered to contain a buffer overflow via the component r_jwe_aesgcm_key_unwrap. This vulnerability allows attackers to cause a De… |
CVE-2022-32074 | Medium | 5.4 | 2022-07-13 | A stored cross-site scripting (XSS) vulnerability in the component audit/class.audit.php of osTicket-plugins - Storage-FS before commit a7842d494889fd5533d13de… |
CVE-2022-32073 | Critical | 9.8 | 2022-07-13 | WolfSSH v1.4.7 was discovered to contain an integer overflow via the function wolfSSH_SFTP_RecvRMDIR. |
CVE-2022-32065 | Medium | 5.4 | 2022-07-13 | An arbitrary file upload vulnerability in the background management module of RuoYi v4.7.3 and below allows attackers to execute arbitrary code via a crafted H… |
CVE-2022-32274 | Medium | 5.4 | 2022-07-13 | The Transition Scheduler add-on 6.5.0 for Atlassian Jira is prone to stored XSS via the project name to the creation function. |
CVE-2022-31781 | High | 7.5 | 2022-07-13 | Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles Content Types. Specially crafted Conten… |
CVE-2022-35628 | Critical | 9.8 | 2022-07-12 | A SQL injection issue was discovered in the lux extension before 17.6.1, and 18.x through 24.x before 24.0.2, for TYPO3. |
CVE-2022-33678 | High | 7.2 | 2022-07-12 | Azure Site Recovery Remote Code Execution Vulnerability |
CVE-2022-33677 | High | 7.2 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33676 | High | 7.2 | 2022-07-12 | Azure Site Recovery Remote Code Execution Vulnerability |
CVE-2022-33675 | High | 7.8 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33674 | High | 8.3 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33673 | Medium | 6.5 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33672 | Medium | 6.5 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33671 | Medium | 4.9 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33669 | Medium | 4.9 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33668 | Medium | 4.9 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33667 | Medium | 6.5 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33666 | Medium | 6.5 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33665 | Medium | 6.5 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33664 | Medium | 4.9 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33663 | Medium | 6.5 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33662 | Medium | 6.5 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33661 | Medium | 6.5 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33660 | Medium | 4.9 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33659 | Medium | 4.9 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33658 | Medium | 4.9 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33657 | Medium | 6.5 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33656 | Medium | 6.5 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33655 | Medium | 6.5 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33654 | Medium | 4.9 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33653 | Medium | 4.9 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33652 | Medium | 4.9 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33651 | Medium | 4.9 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33650 | Medium | 4.9 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33644 | High | 7.0 | 2022-07-12 | Xbox Live Save Service Elevation of Privilege Vulnerability |
CVE-2022-33643 | Medium | 6.5 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33642 | Medium | 4.9 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33641 | Medium | 6.5 | 2022-07-12 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-33637 | Medium | 6.5 | 2022-07-12 | Microsoft Defender for Endpoint Tampering Vulnerability |
CVE-2022-33633 | High | 7.2 | 2022-07-12 | Skype for Business and Lync Remote Code Execution Vulnerability |
CVE-2022-33632 | Medium | 4.7 | 2022-07-12 | Microsoft Office Security Feature Bypass Vulnerability |
CVE-2022-33157 | Medium | 6.1 | 2022-07-12 | The libconnect extension before 7.0.8 and 8.x before 8.1.0 for TYPO3 allows XSS. |
CVE-2022-33156 | Medium | 6.1 | 2022-07-12 | The matomo_integration (aka Matomo Integration) extension before 1.3.2 for TYPO3 allows XSS. |
CVE-2022-30517 | Medium | 6.1 | 2022-07-12 | Mogu blog 5.2 is vulnerable to Cross Site Scripting (XSS). |
CVE-2022-30226 | High | 7.1 | 2022-07-12 | Windows Print Spooler Elevation of Privilege Vulnerability |
CVE-2022-30225 | High | 7.1 | 2022-07-12 | Windows Media Player Network Sharing Service Elevation of Privilege Vulnerability |
CVE-2022-30224 | High | 7.0 | 2022-07-12 | Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability |
CVE-2022-30223 | Medium | 5.7 | 2022-07-12 | Windows Hyper-V Information Disclosure Vulnerability |
CVE-2022-30222 | High | 8.4 | 2022-07-12 | Windows Shell Remote Code Execution Vulnerability |
CVE-2022-30221 | High | 8.8 | 2022-07-12 | Windows Graphics Component Remote Code Execution Vulnerability |
CVE-2022-30220 | High | 7.8 | 2022-07-12 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
CVE-2022-30216 | High | 8.8 | 2022-07-12 | Windows Server Service Tampering Vulnerability |
CVE-2022-30215 | High | 7.5 | 2022-07-12 | Active Directory Federation Services Elevation of Privilege Vulnerability |