2022 CVEs (page 181)
Page 181 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-31528 | Critical | 9.3 | 2022-07-11 | The bonn-activity-maps/bam_annotation_tool repository through 2021-08-31 on GitHub allows absolute path traversal because the Flask send_file function is used… |
CVE-2022-31527 | Critical | 9.3 | 2022-07-11 | The Wildog/flask-file-server repository through 2020-02-20 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31526 | Critical | 9.3 | 2022-07-11 | The ThundeRatz/ThunderDocs repository through 2020-05-01 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31525 | Critical | 9.3 | 2022-07-11 | The SummaLabs/DLS repository through 0.1.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31524 | Critical | 9.3 | 2022-07-11 | The PureStorage-OpenConnect/swagger repository through 1.1.5 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31523 | Critical | 9.3 | 2022-07-11 | The PaddlePaddle/Anakin repository through 0.1.1 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31522 | Critical | 9.3 | 2022-07-11 | The NotVinay/karaokey repository through 2019-12-11 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31521 | Critical | 9.3 | 2022-07-11 | The Niyaz-Mohamed/mosaic repository through 1.0.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31520 | Critical | 9.3 | 2022-07-11 | The Luxas98/logstash-management-api repository through 2020-05-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafel… |
CVE-2022-31519 | Critical | 9.3 | 2022-07-11 | The Lukasavicus/WindMill repository through 1.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31518 | Critical | 9.3 | 2022-07-11 | The JustAnotherSoftwareDeveloper/Python-Recipe-Database repository through 2021-03-31 on GitHub allows absolute path traversal because the Flask send_file func… |
CVE-2022-31517 | Critical | 9.3 | 2022-07-11 | The HolgerGraef/MSM repository through 2021-04-20 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31516 | Critical | 9.3 | 2022-07-11 | The Harveyzyh/Python repository through 2022-05-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31515 | Critical | 9.3 | 2022-07-11 | The Delor4/CarceresBE repository through 1.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31514 | Critical | 9.3 | 2022-07-11 | The Caoyongqi912/Fan_Platform repository through 2021-04-20 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31513 | Critical | 9.3 | 2022-07-11 | The BolunHan/Krypton repository through 2021-06-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31512 | Critical | 9.3 | 2022-07-11 | The Atom02/flask-mvc repository through 2020-09-14 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31511 | Critical | 9.3 | 2022-07-11 | The AFDudley/equanimity repository through 2014-04-23 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31510 | Critical | 9.3 | 2022-07-11 | The sergeKashkin/Simple-RAT repository before 2022-05-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31509 | Critical | 9.3 | 2022-07-11 | The iedadata/usap-dc-website repository through 1.0.1 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31508 | Critical | 9.3 | 2022-07-11 | The idayrus/evoting repository before 2022-05-08 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31507 | Critical | 9.3 | 2022-07-11 | The ganga-devs/ganga repository before 8.5.10 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31506 | Critical | 9.3 | 2022-07-11 | The cmusatyalab/opendiamond repository through 10.1.1 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31505 | Critical | 9.3 | 2022-07-11 | The cheo0/MercadoEnLineaBack repository through 2022-05-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31504 | Critical | 9.3 | 2022-07-11 | The ChangeWeDer/BaiduWenkuSpider_flaskWeb repository before 2021-11-29 on GitHub allows absolute path traversal because the Flask send_file function is used un… |
CVE-2022-31503 | Critical | 9.3 | 2022-07-11 | The orchest/orchest repository before 2022.05.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31502 | Critical | 9.3 | 2022-07-11 | The operatorequals/wormnest repository through 0.4.7 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31501 | Critical | 9.3 | 2022-07-11 | The ChaoticOnyx/OnyxForum repository before 2022-05-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31472 | Medium | 4.3 | 2022-07-11 | Browse restriction bypass vulnerability in Cabinet of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to obtain the data of Cabinet. |
CVE-2022-30943 | Medium | 4.3 | 2022-07-11 | Browsing restriction bypass vulnerability in Bulletin of Cybozu Garoon 4.0.0 to 5.9.1 allows a remote authenticated attacker to obtain the data of Bulletin. |
CVE-2022-30602 | High | 8.1 | 2022-07-11 | Operation restriction bypass in multiple applications of Cybozu Garoon 4.0.0 to 5.9.1 allows a remote authenticated attacker to alter the file information and/… |
CVE-2022-29512 | Medium | 6.5 | 2022-07-11 | Exposure of sensitive information to an unauthorized actor issue in multiple applications of Cybozu Garoon 4.0.0 to 5.9.1 allows a remote authenticated attacke… |
CVE-2022-27168 | Medium | 6.1 | 2022-07-11 | Cross-site scripting vulnerability in LiteCart versions prior to 2.4.2 allows a remote attacker to inject an arbitrary script via unspecified vectors. |
CVE-2022-2365 | Medium | 5.4 | 2022-07-10 | Cross-site Scripting (XSS) - Stored in GitHub repository zadam/trilium prior to 0.53.3. |
CVE-2022-27910 | Medium | 6.1 | 2022-07-10 | In Joomla component 'Joomlatools - DOCman 3.5.13 (and likely most versions below)' are affected to an reflected Cross-Site Scripting (XSS) in an image upload f… |
CVE-2022-2353 | Medium | 6.1 | 2022-07-09 | Prior to microweber/microweber v1.2.20, due to improper neutralization of input, an attacker can steal tokens to perform cross-site request forgery, fetch cont… |
CVE-2022-2345 | High | 7.8 | 2022-07-08 | Use After Free in GitHub repository vim/vim prior to 9.0.0046. |
CVE-2022-35412 | Medium | 5.1 | 2022-07-08 | Digital Guardian Agent 7.7.4.0042 allows an administrator (who ordinarily does not have a supported way to uninstall the product) to disable some of the agent… |
CVE-2022-31137 | Critical | 10.0 | 2022-07-08 | Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 6.1.1.0 are subject to a remote code execution vulnera… |
CVE-2022-35411 | Critical | 9.8 | 2022-07-08 | rpc.py through 0.6.0 allows Remote Code Execution because an unpickle occurs when the "serializer: pickle" HTTP header is sent. In other words, although JSON (… |
CVE-2022-34914 | Critical | 9.8 | 2022-07-08 | Webswing before 22.1.3 allows X-Forwarded-For header injection. The client IP address is associated with a variable in the configuration page. The {clientIp} v… |
CVE-2022-2344 | High | 7.8 | 2022-07-08 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0045. |
CVE-2022-35410 | High | 7.5 | 2022-07-08 | mat2 (aka metadata anonymisation toolkit) before 0.13.0 allows ../ directory traversal during the ZIP archive cleaning process. This primarily affects mat2 web… |
CVE-2022-2343 | High | 7.8 | 2022-07-08 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0044. |
CVE-2022-22476 | High | 8.8 | 2022-07-08 | IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.7 and Open Liberty are vulnerable to identity spoofing by an authenticated user using a specia… |
CVE-2022-22465 | High | 7.8 | 2022-07-08 | IBM Security Access Manager Appliance 10.0.0.0, 10.0.1.0, 10.0.2.0, and 10.0.3.0 could allow a local user to obtain elevated privileges due to improper access… |
CVE-2022-22464 | High | 7.5 | 2022-07-08 | IBM Security Access Manager Appliance 10.0.0.0, 10.0.1.0, 10.0.2.0, and 10.0.3.0 uses weaker than expected cryptographic algorithms that could allow an attacke… |
CVE-2022-22463 | Medium | 6.5 | 2022-07-08 | IBM Security Access Manager Appliance 10.0.0.0, 10.0.1.0, 10.0.2.0, and 10.0.3.0 is vulnerable to SQL injection. A remote attacker could send specially crafted… |
CVE-2022-22370 | Medium | 5.4 | 2022-07-08 | IBM Security Verify Access 10.0.0.0, 10.0.1.0, 10.0.2.0, and 10.0.3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary… |
CVE-2022-34306 | Medium | 5.4 | 2022-07-08 | IBM CICS TX Standard and Advanced 11.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an… |
CVE-2022-34167 | Medium | 5.4 | 2022-07-08 | IBM CICS TX Standard and Advanced 11.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the… |
CVE-2022-34166 | Medium | 5.4 | 2022-07-08 | IBM CICS TX Standard and Advanced 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2022-34160 | Medium | 5.4 | 2022-07-08 | IBM CICS TX Standard and Advanced 11.1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be execute… |
CVE-2022-35406 | Medium | 4.3 | 2022-07-08 | A URL disclosure issue was discovered in Burp Suite before 2022.6. If a user views a crafted response in the Repeater or Intruder, it may be incorrectly interp… |
CVE-2022-28624 | Medium | 4.8 | 2022-07-08 | A potential security vulnerability has been identified in certain HPE FlexNetwork and FlexFabric switch products. The vulnerability could be remotely exploited… |
CVE-2022-28623 | Critical | 9.8 | 2022-07-08 | Security vulnerabilities in HPE IceWall SSO 10.0 certd could be exploited remotely to allow SQL injection or unauthorized data injection. HPE has provided the… |
CVE-2022-33011 | High | 8.8 | 2022-07-08 | Known v1.3.1+2020120201 was discovered to allow attackers to perform an account takeover via a host header injection attack. |
CVE-2022-32115 | Medium | 6.1 | 2022-07-08 | An issue in the isSVG() function of Known v1.2.2+2020061101 allows attackers to execute arbitrary code via a crafted SVG file. |
CVE-2022-31290 | Medium | 5.4 | 2022-07-08 | A cross-site scripting (XSS) vulnerability in Known v1.2.2+2020061101 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted pay… |
CVE-2022-30852 | Medium | 4.3 | 2022-07-08 | Known v1.3.1 was discovered to contain an Insecure Direct Object Reference (IDOR). |
CVE-2022-1245 | Critical | 9.8 | 2022-07-08 | A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client application holding a valid access token… |
CVE-2022-32061 | Medium | 4.8 | 2022-07-07 | An arbitrary file upload vulnerability in the Select User function under the People Menu component of Snipe-IT v6.0.2 allows attackers to execute arbitrary cod… |
CVE-2022-32060 | Medium | 4.8 | 2022-07-07 | An arbitrary file upload vulnerability in the Update Branding Settings component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted fi… |
CVE-2022-33936 | High | 8.0 | 2022-07-07 | Cloud Mobility for Dell EMC Storage, 1.3.0.XXX contains a RCE vulnerability. A non-privileged user could potentially exploit this vulnerability, leading to ach… |
CVE-2022-32481 | High | 7.8 | 2022-07-07 | Dell PowerProtect Cyber Recovery, versions prior to 19.11, contain a privilege escalation vulnerability on virtual appliance deployments. A lower-privileged au… |
CVE-2022-31029 | Medium | 5.9 | 2022-07-07 | AdminLTE is a Pi-hole Dashboard for stats and configuration. In affected versions inserting code like `<script>alert("XSS")</script>` in the field marked with… |
CVE-2022-2191 | High | 7.5 | 2022-07-07 | In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByteBufferPool in cas… |
CVE-2022-2048 | High | 7.5 | 2022-07-07 | In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning… |
CVE-2022-2047 | Low | 2.7 | 2022-07-07 | In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme UR… |
CVE-2022-33680 | High | 8.3 | 2022-07-07 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2022-34592 | Critical | 9.8 | 2022-07-07 | Wavlink WL-WN575A3 RPT75A3.V4300.201217 was discovered to contain a command injection vulnerability via the function obtw. This vulnerability allows attackers… |
CVE-2022-33098 | Medium | 6.1 | 2022-07-07 | Magnolia CMS v6.2.19 was discovered to contain a cross-site scripting (XSS) vulnerability via the Edit Contact function. This vulnerability allows attackers to… |
CVE-2022-32449 | Critical | 9.8 | 2022-07-07 | TOTOLINK EX300_V2 V4.0.3c.7484 was discovered to contain a command injection vulnerability via the langType parameter in the setLanguageCfg function. This vuln… |
CVE-2022-32058 | High | 7.5 | 2022-07-07 | An infinite loop in the function httpRpmPass of TP-Link TL-WR741N/TL-WR742N V1/V2/V3_130415 allows attackers to cause a Denial of Service (DoS) via a crafted p… |
CVE-2022-32056 | Critical | 9.8 | 2022-07-07 | Online Accreditation Management v1.0 was discovered to contain a SQL injection vulnerability via the USERNAME parameter at process.php. |
CVE-2022-32055 | High | 7.5 | 2022-07-07 | Inout Homestay v2.2 was discovered to contain a SQL injection vulnerability via the guests parameter at /index.php?page=search/rentals. |
CVE-2022-32054 | Critical | 9.8 | 2022-07-07 | Tenda AC10 US_AC10V1.0RTL_V15.03.06.26_multi_TD01 was discovered to contain a remote code execution (RCE) vulnerability via the lanIp parameter. |
CVE-2022-28889 | Medium | 4.3 | 2022-07-07 | In Apache Druid 0.22.1 and earlier, the server did not set appropriate headers to prevent clickjacking. Druid 0.23.0 and later prevent clickjacking using the C… |
CVE-2022-31136 | Medium | 6.3 | 2022-07-07 | Bookwyrm is an open source social reading and reviewing program. Versions of Bookwyrm prior to 0.4.1 did not properly sanitize html being rendered to users. Un… |
CVE-2022-31135 | Medium | 6.5 | 2022-07-07 | Akashi is an open source server implementation of the Attorney Online video game based on the Ace Attorney universe. Affected versions of Akashi are subject to… |
CVE-2022-31133 | Medium | 5.9 | 2022-07-07 | HumHub is an Open Source Enterprise Social Network. Affected versions of HumHub are vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. For exploi… |
CVE-2022-31121 | High | 7.5 | 2022-07-07 | Hyperledger Fabric is a permissioned distributed ledger framework. In affected versions if a consensus client sends a malformed consensus request to an orderer… |
CVE-2022-23744 | Low | 2.3 | 2022-07-07 | Check Point Endpoint before version E86.50 failed to protect against specific registry change which allowed to disable endpoint protection by a local administr… |
CVE-2022-32441 | Medium | 5.5 | 2022-07-07 | A memory corruption in Hex Rays Ida Pro v6.6 allows attackers to cause a Denial of Service (DoS) via a crafted file. Related to Data from Faulting Address cont… |
CVE-2022-32208 | Medium | 5.9 | 2022-07-07 | When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle at… |
CVE-2022-32207 | Critical | 9.8 | 2022-07-07 | When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporar… |
CVE-2022-32206 | Medium | 6.5 | 2022-07-07 | curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different alg… |
CVE-2022-32205 | Medium | 4.3 | 2022-07-07 | A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large a… |
CVE-2022-31854 | High | 7.2 | 2022-07-07 | Codoforum v5.1 was discovered to contain an arbitrary file upload vulnerability via the logo change option in the admin panel. |
CVE-2022-34007 | Medium | 6.1 | 2022-07-07 | EQS Integrity Line Professional through 2022-07-01 allows a stored XSS via a crafted whistleblower entry. |
CVE-2022-33996 | High | 8.8 | 2022-07-07 | Incorrect permission management in Devolutions Server before 2022.2 allows a new user with a preexisting username to inherit the permissions of that previous u… |
CVE-2022-25048 | High | 8.8 | 2022-07-07 | Command injection vulnerability in CWP v0.9.8.1126 that allows normal users to run commands as the root user. |
CVE-2022-25047 | Medium | 5.9 | 2022-07-07 | The password reset token in CWP v0.9.8.1126 is generated using known or predictable values. |
CVE-2022-25046 | Critical | 9.8 | 2022-07-07 | A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted POST request. |
CVE-2022-32567 | Medium | 5.4 | 2022-07-07 | The Appfire Jira Misc Custom Fields (JMCF) app 2.4.6 for Atlassian Jira allows XSS via a crafted project name to the Add Auto Indexing Rule function. |
CVE-2022-2342 | Medium | 5.4 | 2022-07-07 | Cross-site Scripting (XSS) - Stored in GitHub repository outline/outline prior to v0.64.4. |
CVE-2022-2339 | High | 7.5 | 2022-07-07 | With this SSRF vulnerability, an attacker can reach internal addresses to make a request as the server and read it's contents. This attack can lead to leak of… |
CVE-2022-27549 | Medium | 4.0 | 2022-07-06 | HCL Launch may store certain data for recurring activities in a plain text format. |
CVE-2022-27548 | Medium | 4.9 | 2022-07-06 | HCL Launch stores user credentials in plain clear text which can be read by a local user. |
CVE-2022-20862 | Medium | 4.3 | 2022-07-06 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Man… |