2022 CVEs (page 183)
Page 183 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-2097 | Medium | 5.3 | 2022-07-05 | AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. Th… |
CVE-2022-2309 | High | 7.5 | 2022-07-05 | NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10… |
CVE-2022-2306 | High | 7.5 | 2022-07-05 | Old session tokens can be used to authenticate to the application and send authenticated requests. |
CVE-2022-34918 | High | 7.8 | 2022-07-04 | An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init (leading to a buffer overflow) could be used by a local a… |
CVE-2022-34829 | High | 7.5 | 2022-07-04 | Zoho ManageEngine ADSelfService Plus before 6203 allows a denial of service (application restart) via a crafted payload to the Mobile App Deployment API. |
CVE-2022-31603 | Medium | 6.4 | 2022-07-04 | NVIDIA DGX A100 contains a vulnerability in SBIOS in the IpSecDxe, where a user with high privileges and preconditioned IpSecDxe global data can exploit improp… |
CVE-2022-31602 | Medium | 6.4 | 2022-07-04 | NVIDIA DGX A100 contains a vulnerability in SBIOS in the IpSecDxe, where a user with elevated privileges and a preconditioned heap can exploit an out-of-bounds… |
CVE-2022-31601 | Medium | 6.7 | 2022-07-04 | NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmbiosPei, which may allow a highly privileged local attacker to cause an out-of-bounds write, which m… |
CVE-2022-31600 | High | 7.5 | 2022-07-04 | NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmmCore, where a user with high privileges can chain another vulnerability to this vulnerability, caus… |
CVE-2022-31599 | High | 8.2 | 2022-07-04 | NVIDIA DGX A100 contains a vulnerability in SBIOS in the Ofbd, where a local user with elevated privileges can cause access to an uninitialized pointer, which… |
CVE-2022-34265 | Critical | 9.8 | 2022-07-04 | An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untruste… |
CVE-2022-33171 | Critical | 9.8 | 2022-07-04 | The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object. When input to the function is a user-controlled p… |
CVE-2022-2268 | High | 7.2 | 2022-07-04 | The Import any XML or CSV File to WordPress plugin before 3.6.8 accepts all zip files and automatically extracts the zip file without validating the extracted… |
CVE-2022-1967 | Medium | 6.5 | 2022-07-04 | The WP Championship WordPress plugin before 9.3 is lacking CSRF checks in various places, allowing attackers to make a logged in admin perform unwanted actions… |
CVE-2022-1946 | Medium | 6.1 | 2022-07-04 | The Gallery WordPress plugin before 2.0.0 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to bo… |
CVE-2022-1301 | Medium | 4.8 | 2022-07-04 | The WP Contact Slider WordPress plugin before 2.4.7 does not sanitize and escape the Text to Display settings of sliders, which could allow high privileged use… |
CVE-2022-0250 | Medium | 6.1 | 2022-07-04 | The Redirection for Contact Form 7 WordPress plugin before 2.5.0 does not escape a link generated before outputting it in an attribute, leading to a Reflected… |
CVE-2022-2301 | Medium | 5.5 | 2022-07-04 | Buffer Over-read in GitHub repository hpjansson/chafa prior to 1.10.3. |
CVE-2022-2300 | Medium | 5.4 | 2022-07-04 | Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.19. |
CVE-2022-29892 | Medium | 6.5 | 2022-07-04 | Improper input validation vulnerability in Space of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to repeatedly display errors in certain… |
CVE-2022-29513 | Medium | 4.8 | 2022-07-04 | Cross-site scripting vulnerability in Scheduler of Cybozu Garoon 4.10.0 to 5.5.1 allows a remote authenticated attacker with an administrative privilege to exe… |
CVE-2022-29484 | High | 8.1 | 2022-07-04 | Operation restriction bypass vulnerability in Space of Cybozu Garoon 4.0.0 to 5.9.0 allows a remote authenticated attacker to delete the data of Space. |
CVE-2022-29471 | Medium | 4.3 | 2022-07-04 | Browse restriction bypass vulnerability in Bulletin of Cybozu Garoon allows a remote authenticated attacker to obtain the data of Bulletin. |
CVE-2022-29467 | Medium | 4.3 | 2022-07-04 | Address information disclosure vulnerability in Cybozu Garoon 4.2.0 to 5.5.1 allows a remote authenticated attacker to obtain some data of Address. |
CVE-2022-28718 | Medium | 4.3 | 2022-07-04 | Operation restriction bypass vulnerability in Bulletin of Cybozu Garoon 4.0.0 to 5.5.1 allow a remote authenticated attacker to alter the data of Bulletin. |
CVE-2022-28713 | Medium | 5.3 | 2022-07-04 | Improper authentication vulnerability in Scheduler of Cybozu Garoon 4.10.0 to 5.5.1 allows a remote attacker to obtain some data of Facility Information withou… |
CVE-2022-28692 | Medium | 4.3 | 2022-07-04 | Improper input validation vulnerability in Scheduler of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of Scheduler. |
CVE-2022-27807 | Medium | 4.3 | 2022-07-04 | Improper input validation vulnerability in Link of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to disable to add Categories. |
CVE-2022-27803 | Medium | 4.3 | 2022-07-04 | Improper input validation vulnerability in Space of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of Space. |
CVE-2022-27661 | Medium | 4.3 | 2022-07-04 | Operation restriction bypass vulnerability in Workflow of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of Workflow. |
CVE-2022-27627 | Medium | 6.1 | 2022-07-04 | Cross-site scripting vulnerability in Organization's Information of Cybozu Garoon 4.10.2 to 5.5.1 allows a remote attacker to execute an arbitrary script on th… |
CVE-2022-26368 | Medium | 5.4 | 2022-07-04 | Browse restriction bypass and operation restriction bypass vulnerability in Cabinet of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to a… |
CVE-2022-26054 | Medium | 4.3 | 2022-07-04 | Operation restriction bypass vulnerability in Link of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of Link. |
CVE-2022-26051 | Medium | 4.3 | 2022-07-04 | Operation restriction bypass vulnerability in Portal of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of Portal. |
CVE-2022-34151 | High | 8.1 | 2022-07-04 | Use of hard-coded credentials vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7… |
CVE-2022-33971 | High | 7.5 | 2022-07-04 | Authentication bypass by capture-replay vulnerability exists in Machine automation controller NX7 series all models V1.28 and earlier, Machine automation contr… |
CVE-2022-33948 | High | 8.8 | 2022-07-04 | HOME SPOT CUBE2 V102 contains an OS command injection vulnerability due to improper processing of data received from DHCP server. An adjacent attacker may exec… |
CVE-2022-33208 | High | 8.1 | 2022-07-04 | Authentication bypass by capture-replay vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation contr… |
CVE-2022-32284 | High | 7.5 | 2022-07-04 | Use of insufficiently random values vulnerability exists in Vnet/IP communication module VI461 of YOKOGAWA Wide Area Communication Router (WAC Router) AW810D… |
CVE-2022-2289 | High | 7.8 | 2022-07-03 | Use After Free in GitHub repository vim/vim prior to 9.0. |
CVE-2022-2288 | High | 7.8 | 2022-07-03 | Out-of-bounds Write in GitHub repository vim/vim prior to 9.0. |
CVE-2022-2290 | Medium | 6.1 | 2022-07-03 | Cross-site Scripting (XSS) - Reflected in GitHub repository zadam/trilium prior to 0.52.4, 0.53.1-beta. |
CVE-2022-2287 | High | 7.1 | 2022-07-02 | Out-of-bounds Read in GitHub repository vim/vim prior to 9.0. |
CVE-2022-34913 | Critical | 9.8 | 2022-07-02 | md2roff 1.7 has a stack-based buffer overflow via a Markdown file containing a large number of consecutive characters to be processed. NOTE: the vendor's posit… |
CVE-2022-34912 | Medium | 6.1 | 2022-07-02 | An issue was discovered in MediaWiki before 1.37.3 and 1.38.x before 1.38.1. The contributions-title, used on Special:Contributions, is used as page title with… |
CVE-2022-34911 | Medium | 6.1 | 2022-07-02 | An issue was discovered in MediaWiki before 1.35.7, 1.36.x and 1.37.x before 1.37.3, and 1.38.x before 1.38.1. XSS can occur in configurations that allow a Jav… |
CVE-2022-2286 | High | 7.8 | 2022-07-02 | Out-of-bounds Read in GitHub repository vim/vim prior to 9.0. |
CVE-2022-2285 | High | 7.8 | 2022-07-02 | Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0. |
CVE-2022-2284 | High | 7.8 | 2022-07-02 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0. |
CVE-2022-28200 | High | 8.2 | 2022-07-02 | NVIDIA DGX A100 contains a vulnerability in SBIOS in the BiosCfgTool, where a local user with elevated privileges can read and write beyond intended bounds in… |
CVE-2022-32551 | High | 7.5 | 2022-07-02 | Zoho ManageEngine ServiceDesk Plus MSP before 10604 allows path traversal (to WEBINF/web.xml from sample/WEB-INF/web.xml or sample/META-INF/web.xml). |
CVE-2022-34903 | Medium | 6.5 | 2022-07-01 | GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of G… |
CVE-2022-32412 | High | 7.2 | 2022-07-01 | An issue in the /template/edit component of HongCMS v3.0 allows attackers to getshell. |
CVE-2022-32411 | High | 7.2 | 2022-07-01 | An issue in the languages config file of HongCMS v3.0 allows attackers to getshell. |
CVE-2022-32325 | Medium | 6.5 | 2022-07-01 | JPEGOPTIM v1.4.7 was discovered to contain a segmentation violation which is caused by a READ memory access at jpegoptim.c. |
CVE-2022-32324 | Critical | 9.8 | 2022-07-01 | PDFAlto v0.4 was discovered to contain a heap buffer overflow via the component /pdfalto/src/pdfalto.cc. |
CVE-2022-32420 | High | 8.8 | 2022-07-01 | College Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via /College/admin/teacher.php. This vulnerability is expl… |
CVE-2022-32384 | High | 8.8 | 2022-07-01 | Tenda AC23 v16.03.07.44 was discovered to contain a stack overflow via the security_5g parameter in the function formWifiBasicSet. |
CVE-2022-32095 | Critical | 9.8 | 2022-07-01 | Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter at orders.php. |
CVE-2022-32094 | Critical | 9.8 | 2022-07-01 | Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the loginid parameter at doctorlogin.php. |
CVE-2022-32093 | Critical | 9.8 | 2022-07-01 | Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the loginid parameter at adminlogin.php. |
CVE-2022-31943 | Critical | 9.8 | 2022-07-01 | MCMS v5.2.8 was discovered to contain an arbitrary file upload vulnerability. |
CVE-2022-32091 | High | 7.5 | 2022-07-01 | MariaDB v10.7 was discovered to contain an use-after-poison in in __interceptor_memset at /libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc. |
CVE-2022-32089 | High | 7.5 | 2022-07-01 | MariaDB v10.5 to v10.7 was discovered to contain a segmentation fault via the component st_select_lex_unit::exclude_level. |
CVE-2022-32088 | High | 7.5 | 2022-07-01 | MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Exec_time_tracker::get_loops/Filesort_tracker::report_use/filesort. |
CVE-2022-32087 | High | 7.5 | 2022-07-01 | MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_args::walk_args. |
CVE-2022-32086 | High | 7.5 | 2022-07-01 | MariaDB v10.4 to v10.8 was discovered to contain a segmentation fault via the component Item_field::fix_outer_field. |
CVE-2022-32085 | High | 7.5 | 2022-07-01 | MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_func_in::cleanup/Item::cleanup_processor. |
CVE-2022-32084 | High | 7.5 | 2022-07-01 | MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component sub_select. |
CVE-2022-32083 | High | 7.5 | 2022-07-01 | MariaDB v10.2 to v10.6.1 was discovered to contain a segmentation fault via the component Item_subselect::init_expr_cache_tracker. |
CVE-2022-32082 | High | 7.5 | 2022-07-01 | MariaDB v10.5 to v10.7 was discovered to contain an assertion failure at table->get_ref_count() == 0 in dict0dict.cc. |
CVE-2022-32081 | High | 7.5 | 2022-07-01 | MariaDB v10.4 to v10.7 was discovered to contain an use-after-poison in prepare_inplace_add_virtual at /storage/innobase/handler/handler0alter.cc. |
CVE-2022-25900 | High | 8.1 | 2022-07-01 | All versions of package git-clone are vulnerable to Command Injection due to insecure usage of the --upload-pack feature of git. |
CVE-2022-25898 | High | 7.7 | 2022-07-01 | The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT signature with non Base64URL encoding s… |
CVE-2022-25896 | Medium | 4.8 | 2022-07-01 | This affects the package passport before 0.6.0. When a user logs in or logs out, the session is regenerated instead of being closed. |
CVE-2022-25876 | Medium | 6.2 | 2022-07-01 | The package link-preview-js before 2.1.16 are vulnerable to Server-side Request Forgery (SSRF) which allows attackers to send arbitrary requests to the local n… |
CVE-2022-25758 | Medium | 5.3 | 2022-07-01 | All versions of package scss-tokenizer are vulnerable to Regular Expression Denial of Service (ReDoS) via the loadAnnotation() function, due to the usage of in… |
CVE-2022-32053 | High | 7.5 | 2022-07-01 | TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the cloneMac parameter in the function FUN_0041621c. |
CVE-2022-32052 | High | 7.5 | 2022-07-01 | TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN_004137a4. |
CVE-2022-32051 | High | 7.5 | 2022-07-01 | TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc, week, sTime, eTime parameters in the function FUN_004133c4. |
CVE-2022-32050 | High | 7.5 | 2022-07-01 | TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the cloneMac parameter in the function FUN_0041af40. |
CVE-2022-32049 | High | 7.5 | 2022-07-01 | TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the url parameter in the function FUN_00418540. |
CVE-2022-32048 | High | 7.5 | 2022-07-01 | TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the command parameter in the function FUN_0041cc88. |
CVE-2022-32047 | High | 7.5 | 2022-07-01 | TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN_00412ef4. |
CVE-2022-32046 | High | 7.5 | 2022-07-01 | TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN_0041880c. |
CVE-2022-32045 | High | 7.5 | 2022-07-01 | TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN_00413be4. |
CVE-2022-32044 | High | 7.5 | 2022-07-01 | TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the password parameter in the function FUN_00413f80. |
CVE-2022-32043 | High | 7.5 | 2022-07-01 | Tenda M3 V1.0.0.12 was discovered to contain a stack overflow via the function formSetAccessCodeInfo. |
CVE-2022-32041 | High | 7.5 | 2022-07-01 | Tenda M3 V1.0.0.12 was discovered to contain a stack overflow via the function formGetPassengerAnalyseData. |
CVE-2022-32040 | High | 7.5 | 2022-07-01 | Tenda M3 V1.0.0.12 was discovered to contain a stack overflow via the function formSetCfm. |
CVE-2022-32039 | High | 7.5 | 2022-07-01 | Tenda M3 V1.0.0.12 was discovered to contain a stack overflow via the listN parameter in the function fromDhcpListClient. |
CVE-2022-32037 | High | 7.5 | 2022-07-01 | Tenda M3 V1.0.0.12 was discovered to contain a stack overflow via the function formSetAPCfg. |
CVE-2022-32036 | High | 7.5 | 2022-07-01 | Tenda M3 V1.0.0.12 was discovered to contain multiple stack overflow vulnerabilities via the ssidList, storeName, and trademark parameters in the function form… |
CVE-2022-32035 | High | 7.5 | 2022-07-01 | Tenda M3 V1.0.0.12 was discovered to contain a stack overflow via the function formMasterMng. |
CVE-2022-32034 | High | 7.5 | 2022-07-01 | Tenda M3 V1.0.0.12 was discovered to contain a stack overflow via the items parameter in the function formdelMasteraclist. |
CVE-2022-32033 | High | 7.5 | 2022-07-01 | Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the function formSetVirtualSer. |
CVE-2022-32032 | Critical | 9.8 | 2022-07-01 | Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the deviceList parameter in the function formAddMacfilterRule. |
CVE-2022-32031 | High | 7.5 | 2022-07-01 | Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the list parameter in the function fromSetRouteStatic. |
CVE-2022-32030 | High | 7.5 | 2022-07-01 | Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the list parameter in the function formSetQosBand. |
CVE-2022-31605 | Critical | 9.8 | 2022-07-01 | NVFLARE, versions prior to 2.1.2, contains a vulnerability in its utils module, where YAML files are loaded via yaml.load() instead of yaml.safe_load(). The de… |