2022 CVEs (page 182)
Page 182 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-20859 | Medium | 6.5 | 2022-07-06 | A vulnerability in the Disaster Recovery framework of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence… |
CVE-2022-20815 | Medium | 6.1 | 2022-07-06 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified CM Session Management Edition (Unifie… |
CVE-2022-20813 | Critical | 9.0 | 2022-07-06 | Multiple vulnerabilities in the API and in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS… |
CVE-2022-20812 | Critical | 9.0 | 2022-07-06 | Multiple vulnerabilities in the API and in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS… |
CVE-2022-20808 | High | 7.7 | 2022-07-06 | A vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to cause a denial of service (DoS) conditio… |
CVE-2022-20800 | Medium | 6.1 | 2022-07-06 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Manage… |
CVE-2022-20791 | Medium | 6.5 | 2022-07-06 | A vulnerability in the database user privileges of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management E… |
CVE-2022-20768 | Medium | 4.9 | 2022-07-06 | A vulnerability in the logging component of Cisco TelePresence Collaboration Endpoint (CE) and RoomOS Software could allow an authenticated, remote attacker to… |
CVE-2022-20752 | Medium | 5.3 | 2022-07-06 | A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cis… |
CVE-2022-33047 | Critical | 9.8 | 2022-07-06 | OTFCC v0.10.4 was discovered to contain a heap buffer overflow after free via otfccbuild.c. |
CVE-2022-2318 | Medium | 5.5 | 2022-07-06 | There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that allow attackers to crash linux kernel without any privi… |
CVE-2022-2316 | Medium | 5.4 | 2022-07-06 | HTML injection vulnerability in secure messages of Devolutions Server before 2022.2 allows attackers to alter the rendering of the page or redirect a user to a… |
CVE-2022-31131 | Medium | 5.4 | 2022-07-06 | Nextcloud mail is a Mail app for the Nextcloud home server product. Versions of Nextcloud mail prior to 1.12.2 were found to be missing user account ownership… |
CVE-2022-31129 | High | 7.5 | 2022-07-06 | moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient p… |
CVE-2022-31127 | High | 7.1 | 2022-07-06 | NextAuth.js is a complete open source authentication solution for Next.js applications. An attacker can pass a compromised input to the e-mail [signin endpoint… |
CVE-2022-31126 | Critical | 10.0 | 2022-07-06 | Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remote, unauthenticated… |
CVE-2022-31125 | Critical | 10.0 | 2022-07-06 | Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remote, unauthenticated… |
CVE-2022-31124 | High | 7.7 | 2022-07-06 | openssh_key_parser is an open source Python package providing utilities to parse and pack OpenSSH private and public key files. In versions prior to 0.0.6 if a… |
CVE-2022-31111 | Medium | 5.3 | 2022-07-06 | Frontier is Substrate's Ethereum compatibility layer. In affected versions the truncation done when converting between EVM balance type and Substrate balance t… |
CVE-2022-34598 | Critical | 9.8 | 2022-07-06 | The udpserver in H3C Magic R100 V200R004 and V100R005 has the 9034 port opened, allowing attackers to execute arbitrary commands. |
CVE-2022-34597 | Critical | 9.8 | 2022-07-06 | Tenda AX1806 v1.0.0.1 was discovered to contain a command injection vulnerability via the function WanParameterSetting. |
CVE-2022-34596 | Critical | 9.8 | 2022-07-06 | Tenda AX1803 v1.0.0.1_2890 was discovered to contain a command injection vulnerability via the function WanParameterSetting. |
CVE-2022-34595 | Critical | 9.8 | 2022-07-06 | Tenda AX1803 v1.0.0.1_2890 was discovered to contain a command injection vulnerability via the function setipv6status. |
CVE-2022-26348 | High | 8.2 | 2022-07-06 | Command Centre Server is vulnerable to SQL Injection via Windows Registry settings for date fields on the server. The Windows Registry setting allows an attack… |
CVE-2022-26078 | High | 7.5 | 2022-07-06 | Gallagher Controller 6000 is vulnerable to a Denial of Service attack via conflicting ARP packets with a duplicate IP address. This issue affects: Gallagher Ga… |
CVE-2022-33738 | High | 7.5 | 2022-07-06 | OpenVPN Access Server before 2.11 uses a weak random generator used to create user session token for the web portal |
CVE-2022-33737 | High | 7.5 | 2022-07-06 | The OpenVPN Access Server installer creates a log file readable for everyone, which from version 2.10.0 and before 2.11.0 may contain a random generated admin… |
CVE-2022-30929 | High | 8.8 | 2022-07-06 | Mini-Tmall v1.0 is vulnerable to Insecure Permissions via tomcat-embed-jasper. |
CVE-2022-30619 | Medium | 5.9 | 2022-07-06 | Editable SQL Queries behind Base64 encoding sending from the Client-Side to The Server-Side for a particular API used in legacy Work Center module. He attack i… |
CVE-2022-23714 | High | 7.8 | 2022-07-06 | A local privilege escalation (LPE) issue was discovered in the ransomware canaries features of Elastic Endpoint Security for Windows, which could allow unprivi… |
CVE-2022-23713 | Medium | 6.1 | 2022-07-06 | A cross-site-scripting (XSS) vulnerability was discovered in the Vega Charts Kibana integration which could allow arbitrary JavaScript to be executed in a vict… |
CVE-2022-23173 | Medium | 5.5 | 2022-07-06 | this vulnerability affect user that even not allowed to access via the web interface. First of all, the attacker needs to access the "Login menu - demo site" t… |
CVE-2022-23172 | Medium | 5.5 | 2022-07-06 | An attacker can access to "Forgot my password" button, as soon as he puts users is valid in the system, the system would issue a message that a password reset… |
CVE-2022-21787 | Medium | 6.7 | 2022-07-06 | In audio DSP, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution pri… |
CVE-2022-21786 | Medium | 6.7 | 2022-07-06 | In audio DSP, there is a possible memory corruption due to improper casting. This could lead to local escalation of privilege with System execution privileges… |
CVE-2022-21785 | Medium | 6.7 | 2022-07-06 | In WLAN driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2022-21784 | Medium | 6.7 | 2022-07-06 | In WLAN driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2022-21783 | Medium | 6.7 | 2022-07-06 | In WLAN driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2022-21782 | Medium | 6.7 | 2022-07-06 | In WLAN driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2022-21781 | Medium | 6.7 | 2022-07-06 | In WLAN driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2022-21780 | Medium | 6.7 | 2022-07-06 | In WLAN driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2022-21779 | Medium | 6.7 | 2022-07-06 | In WLAN driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2022-21777 | High | 7.8 | 2022-07-06 | In Autoboot, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execu… |
CVE-2022-21776 | Medium | 6.4 | 2022-07-06 | In MDP, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. U… |
CVE-2022-21775 | Medium | 6.7 | 2022-07-06 | In sched driver, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution privileges… |
CVE-2022-21774 | Medium | 6.7 | 2022-07-06 | In TEEI driver, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges n… |
CVE-2022-21773 | Medium | 6.7 | 2022-07-06 | In TEEI driver, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges n… |
CVE-2022-21772 | Medium | 6.7 | 2022-07-06 | In TEEI driver, there is a possible type confusion due to a race condition. This could lead to local escalation of privilege with System execution privileges n… |
CVE-2022-21771 | Medium | 6.7 | 2022-07-06 | In GED driver, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges ne… |
CVE-2022-21770 | Medium | 6.7 | 2022-07-06 | In sound driver, there is a possible information disclosure due to symlink following. This could lead to local information disclosure with System execution pri… |
CVE-2022-21769 | Medium | 4.4 | 2022-07-06 | In CCCI, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges… |
CVE-2022-21768 | High | 8.8 | 2022-07-06 | In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execut… |
CVE-2022-21767 | High | 8.8 | 2022-07-06 | In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execut… |
CVE-2022-21766 | Medium | 6.7 | 2022-07-06 | In CCCI, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileg… |
CVE-2022-21765 | Medium | 6.7 | 2022-07-06 | In CCCI, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileg… |
CVE-2022-21764 | Medium | 5.5 | 2022-07-06 | In telecom service, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no addit… |
CVE-2022-21763 | Medium | 5.5 | 2022-07-06 | In telecom service, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no addit… |
CVE-2022-21744 | Critical | 9.8 | 2022-07-06 | In Modem 2G RR, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution when decoding GPRS Packet Neigh… |
CVE-2022-20083 | Critical | 9.8 | 2022-07-06 | In Modem 2G/3G CC, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution when decoding combined FACIL… |
CVE-2022-20082 | High | 7.0 | 2022-07-06 | In GPU, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges ne… |
CVE-2022-33980 | Critical | 9.8 | 2022-07-06 | Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolati… |
CVE-2022-28935 | High | 7.2 | 2022-07-06 | Totolink A830R V5.9c.4729_B20191112, Totolink A3100R V4.1.2cu.5050_B20200504, Totolink A950RG V4.1.2cu.5161_B20200903, Totolink A800R V4.1.2cu.5137_B20200730… |
CVE-2022-24141 | Medium | 5.4 | 2022-07-06 | The iTopVPNmini.exe component of iTop VPN 3.2 will try to connect to datastate_iTopVPN_Pipe_Server on a loop. An attacker that opened a named pipe with the sam… |
CVE-2022-24140 | Medium | 6.6 | 2022-07-06 | IOBit Advanced System Care 15, iTop Screen Recorder 2.1, iTop VPN 3.2, Driver Booster 9, and iTop Screenshot sends HTTP requests in their update procedure in o… |
CVE-2022-24139 | High | 7.8 | 2022-07-06 | In IOBit Advanced System Care (AscService.exe) 15, an attacker with SEImpersonatePrivilege can create a named pipe with the same name as one of ASCService's na… |
CVE-2022-24138 | High | 7.8 | 2022-07-06 | IOBit Advanced System Care (Asc.exe) 15 and Action Download Center both download components of IOBit suite into ProgramData folder, ProgramData folder has "rwx… |
CVE-2022-32386 | Critical | 9.8 | 2022-07-06 | Tenda AC23 v16.03.07.44 was discovered to contain a buffer overflow via fromAdvSetMacMtuWan. |
CVE-2022-32385 | Critical | 9.8 | 2022-07-06 | Tenda AC23 v16.03.07.44 is vulnerable to Stack Overflow that will allow for the execution of arbitrary code (remote). |
CVE-2022-32383 | Critical | 9.8 | 2022-07-06 | Tenda AC23 v16.03.07.44 was discovered to contain a stack overflow via the AdvSetMacMtuWan function. |
CVE-2022-32290 | Medium | 4.3 | 2022-07-06 | The client in Northern.tech Mender 3.2.0, 3.2.1, and 3.2.2 has Incorrect Access Control. It listens on a random, unprivileged TCP port and exposes an HTTP prox… |
CVE-2022-30591 | High | 7.5 | 2022-07-06 | quic-go through 0.27.0 allows remote attackers to cause a denial of service (CPU consumption) via a Slowloris variant in which incomplete QUIC or HTTP/3 reques… |
CVE-2022-35230 | Low | 3.7 | 2022-07-06 | An authenticated user can create a link with reflected Javascript code inside it for the graphs page and send it to other users. The payload can be executed on… |
CVE-2022-35229 | Low | 3.7 | 2022-07-06 | An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users. The payload can be executed… |
CVE-2022-32533 | Critical | 9.8 | 2022-07-06 | Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and SSRF. Setting the co… |
CVE-2022-22681 | High | 8.1 | 2022-07-06 | Session fixation vulnerability in access control management in Synology Photo Station before 6.8.16-3506 allows remote attackers to bypass security constraint… |
CVE-2022-34972 | Critical | 9.8 | 2022-07-05 | So Filter Shop v3.x was discovered to contain multiple blind SQL injection vulnerabilities via the att_value_id , manu_value_id , opt_value_id , and subcate_va… |
CVE-2022-32413 | Critical | 9.8 | 2022-07-05 | An arbitrary file upload vulnerability in Dice v4.2.0 allows attackers to execute arbitrary code via a crafted file. |
CVE-2022-32311 | Critical | 9.8 | 2022-07-05 | Ingredient Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /isms/admin/stocks/view_stock.php. |
CVE-2022-32310 | Critical | 9.8 | 2022-07-05 | An access control issue in Ingredient Stock Management System v1.0 allows attackers to take over user accounts via a crafted POST request to /isms/classes/User… |
CVE-2022-31856 | Critical | 9.8 | 2022-07-05 | Newsletter Module v3.x was discovered to contain a SQL injection vulnerability via the zemez_newsletter_email parameter at /index.php. |
CVE-2022-2321 | Critical | 9.8 | 2022-07-05 | Improper Restriction of Excessive Authentication Attempts in GitHub repository heroiclabs/nakama prior to 3.13.0. This results in login brute-force attacks. |
CVE-2022-33075 | Medium | 5.4 | 2022-07-05 | A stored cross-site scripting (XSS) vulnerability in the Add Classification function of Zoo Management System v1.0 allows attackers to execute arbitrary web sc… |
CVE-2022-31117 | Medium | 5.9 | 2022-07-05 | UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. In versions prior to 5.4.0 an error occurring while reallocating… |
CVE-2022-31116 | High | 7.5 | 2022-07-05 | UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were found to improperly decode certain charact… |
CVE-2022-31014 | Medium | 5.4 | 2022-07-05 | Nextcloud server is an open source personal cloud server. Affected versions were found to be vulnerable to SMTP command injection. The impact varies based on w… |
CVE-2022-34879 | Medium | 6.5 | 2022-07-05 | Reflected Cross Site Scripting (XSS) vulnerabilities in AST Agent Time Sheet interface (/vicidial/AST_agent_time_sheet.php) of VICIdial via agent, and search_a… |
CVE-2022-34878 | Medium | 5.5 | 2022-07-05 | SQL Injection vulnerability in User Stats interface (/vicidial/user_stats.php) of VICIdial via the file_download parameter allows attacker to spoof identity, t… |
CVE-2022-34877 | Medium | 6.4 | 2022-07-05 | SQL Injection vulnerability in AST Agent Time Sheet interface ((/vicidial/AST_agent_time_sheet.php) of VICIdial via the agent parameter allows attacker to spoo… |
CVE-2022-34876 | Medium | 5.5 | 2022-07-05 | SQL Injection vulnerability in admin interface (/vicidial/admin.php) of VICIdial via modify_email_accounts, access_recordings, and agentcall_email parameters a… |
CVE-2022-31770 | Medium | 4.9 | 2022-07-05 | IBM App Connect Enterprise Certified Container 4.2 could allow a user from the administration console to cause a denial of service by creating a specially craf… |
CVE-2022-31836 | Critical | 9.8 | 2022-07-05 | The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to cross directory risk. |
CVE-2022-33744 | Medium | 4.7 | 2022-07-05 | Arm guests can cause Dom0 DoS via PV devices When mapping pages of guests on Arm, dom0 is using an rbtree to keep track of the foreign mappings. Updating of th… |
CVE-2022-33743 | High | 7.8 | 2022-07-05 | network backend may cause Linux netfront to use freed SKBs While adding logic to support XDP (eXpress Data Path), a code label was moved in a way allowing for… |
CVE-2022-33742 | High | 7.1 | 2022-07-05 | Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which… |
CVE-2022-33741 | High | 7.1 | 2022-07-05 | Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which… |
CVE-2022-33740 | High | 7.1 | 2022-07-05 | Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which… |
CVE-2022-30290 | High | 7.5 | 2022-07-05 | In OpenCTI through 5.2.4, a broken access control vulnerability has been identified in the profile endpoint. An attacker can abuse the identified vulnerability… |
CVE-2022-2304 | High | 7.8 | 2022-07-05 | Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0. |
CVE-2022-26365 | High | 7.1 | 2022-07-05 | Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which… |
CVE-2022-30289 | Medium | 5.4 | 2022-07-05 | A stored Cross-site Scripting (XSS) vulnerability was identified in the Data Import functionality of OpenCTI through 5.2.4. An attacker can abuse the vulnerabi… |