2022 CVEs (page 184)
Page 184 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-31604 | Critical | 9.8 | 2022-07-01 | NVFLARE, versions prior to 2.1.2, contains a vulnerability in its PKI implementation module, where The CA credentials are transported via pickle and no safe de… |
CVE-2022-22373 | Medium | 5.4 | 2022-07-01 | An improper validation vulnerability in IBM InfoSphere Information Server 11.7 Pack for SAP Apps and BW Packs may lead to creation of directories and files on… |
CVE-2022-22367 | Medium | 5.5 | 2022-07-01 | IBM UrbanCode Deploy (UCD) 6.2.7.15, 7.0.5.10, 7.1.2.6, and 7.2.2.1 could disclose sensitive database information to a local user in plain text. IBM X-Force ID… |
CVE-2022-22366 | Medium | 4.4 | 2022-07-01 | IBM UrbanCode Deploy (UCD) 6.2.7.15, 7.0.5.10, 7.1.2.6, and 7.2.2.1 stores user credentials in plain clear text which can be read by a local user. IBM X-Force… |
CVE-2022-1954 | Medium | 4.3 | 2022-07-01 | A Regular Expression Denial of Service vulnerability in GitLab CE/EE affecting all versions from 1.0.2 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior t… |
CVE-2022-0167 | Low | 3.1 | 2022-07-01 | An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions s… |
CVE-2022-31113 | Medium | 6.3 | 2022-07-01 | Canarytokens is an open source tool which helps track activity and actions on your network. A Cross-Site Scripting vulnerability was identified in the history… |
CVE-2022-2270 | Low | 3.5 | 2022-07-01 | An issue has been discovered in GitLab affecting all versions starting from 12.4 before 14.10.5, all versions starting from 15.0 before 15.0.4, all versions st… |
CVE-2022-2229 | High | 7.5 | 2022-07-01 | An improper authorization issue in GitLab CE/EE affecting all versions from 13.7 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an att… |
CVE-2022-2228 | Medium | 5.3 | 2022-07-01 | Information exposure in GitLab EE affecting all versions from 12.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker with the… |
CVE-2022-1999 | Low | 3.1 | 2022-07-01 | An issue has been discovered in GitLab CE/EE affecting all versions from 8.13 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1. Under certain c… |
CVE-2022-1981 | Low | 2.7 | 2022-07-01 | An issue has been discovered in GitLab EE affecting all versions starting from 12.2 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1. In GitLab… |
CVE-2022-1963 | Medium | 5.3 | 2022-07-01 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 14.10.5, all versions starting from 15.0 before 15.0.4, all versi… |
CVE-2022-2281 | Low | 2.6 | 2022-07-01 | An information disclosure vulnerability in GitLab EE affecting all versions from 12.5 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows… |
CVE-2022-2254 | Medium | 6.2 | 2022-07-01 | A user with administrative privileges in Distributed Data Systems WebHMI 4.1.1.7662 can store a script that could impact other logged in users. |
CVE-2022-2250 | Medium | 4.7 | 2022-07-01 | An open redirect vulnerability in GitLab EE/CE affecting all versions from 11.1 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows an att… |
CVE-2022-2244 | Medium | 4.3 | 2022-07-01 | An improper authorization vulnerability in GitLab EE/CE affecting all versions from 14.8 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allo… |
CVE-2022-2243 | Medium | 5.0 | 2022-07-01 | An access control vulnerability in GitLab EE/CE affecting all versions from 14.8 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows authe… |
CVE-2022-2235 | High | 8.7 | 2022-07-01 | Insufficient sanitization in GitLab EE's external issue tracker affecting all versions from 14.5 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1… |
CVE-2022-2230 | High | 8.1 | 2022-07-01 | A Stored Cross-Site Scripting vulnerability in the project settings page in GitLab CE/EE affecting all versions from 14.4 prior to 14.10.5, 15.0 prior to 15.0… |
CVE-2022-2227 | Low | 3.1 | 2022-07-01 | Improper access control in the runner jobs API in GitLab CE/EE affecting all versions prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows a… |
CVE-2022-2185 | Critical | 9.9 | 2022-07-01 | A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 where… |
CVE-2022-1983 | Medium | 6.5 | 2022-07-01 | Incorrect authorization in GitLab EE affecting all versions from 10.7 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allowed an attacker alr… |
CVE-2022-2253 | Critical | 9.1 | 2022-07-01 | A user with administrative privileges in Distributed Data Systems WebHMI 4.1.1.7662 may send OS commands to execute on the host server. |
CVE-2022-33103 | High | 7.8 | 2022-07-01 | Das U-Boot from v2020.10 to v2022.07-rc3 was discovered to contain an out-of-bounds write via the function sqfs_readdir(). |
CVE-2022-33099 | High | 7.5 | 2022-07-01 | An issue in the component luaG_runerror of Lua v5.4.4 and below leads to a heap-buffer overflow when a recursive error occurs. |
CVE-2022-2264 | High | 7.8 | 2022-07-01 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0. |
CVE-2022-34894 | Low | 3.5 | 2022-07-01 | In JetBrains Hub before 2022.2.14799, insufficient access control allowed the hijacking of untrusted services |
CVE-2022-2280 | Medium | 5.4 | 2022-07-01 | Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.19. |
CVE-2022-2279 | Medium | 5.5 | 2022-07-01 | NULL Pointer Dereference in GitHub repository bfabiszewski/libmobi prior to 0.11. |
CVE-2022-2274 | Critical | 9.8 | 2022-07-01 | The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions. This issue makes the RSA i… |
CVE-2022-32988 | Medium | 5.4 | 2022-07-01 | Cross Site Scripting (XSS) vulnerability in router Asus DSL-N14U-B1 1.1.2.3_805 via the "*list" parameters (e.g. filter_lwlist, keyword_rulelist, etc) in every… |
CVE-2022-32295 | Critical | 9.8 | 2022-07-01 | On Ampere Altra and AltraMax devices before SRP 1.09, the Altra reference design of UEFI accesses allows insecure access to SPI-NOR by the OS/hypervisor compon… |
CVE-2022-27904 | High | 7.0 | 2022-07-01 | Automox Agent for macOS before version 39 was vulnerable to a time-of-check/time-of-use (TOCTOU) race-condition attack during the agent install process. |
CVE-2022-33087 | High | 7.5 | 2022-06-30 | A stack overflow in the function DM_ In fillobjbystr() of TP-Link Archer C50&A5(US)_V5_200407 allows attackers to cause a Denial of Service (DoS) via a crafted… |
CVE-2022-33085 | High | 7.2 | 2022-06-30 | ESPCMS P8 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the fetch_filename function at \espcms_public\espcms_templat… |
CVE-2022-33082 | High | 7.5 | 2022-06-30 | An issue in the AST parser (ast/compile.go) of Open Policy Agent v0.10.2 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
CVE-2022-31115 | High | 8.8 | 2022-06-30 | opensearch-ruby is a community-driven, open source fork of elasticsearch-ruby. In versions prior to 2.0.1 the ruby `YAML.load` function was used instead of `YA… |
CVE-2022-2257 | High | 7.8 | 2022-06-30 | Out-of-bounds Read in GitHub repository vim/vim prior to 9.0. |
CVE-2022-23725 | High | 7.7 | 2022-06-30 | PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstances. |
CVE-2022-23720 | High | 7.5 | 2022-06-30 | PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file. An IT administr… |
CVE-2022-23719 | High | 7.2 | 2022-06-30 | PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests. An attacker with the abi… |
CVE-2022-23718 | High | 7.6 | 2022-06-30 | PingID Windows Login prior to 2.8 uses known vulnerable components that can lead to remote code execution. An attacker capable of achieving a sophisticated man… |
CVE-2022-23717 | Medium | 5.0 | 2022-06-30 | PingID Windows Login prior to 2.8 is vulnerable to a denial of service condition on local machines when combined with using offline security keys as part of au… |
CVE-2022-33329 | Critical | 9.8 | 2022-06-30 | Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets… |
CVE-2022-33328 | Critical | 9.8 | 2022-06-30 | Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets… |
CVE-2022-33327 | Critical | 9.8 | 2022-06-30 | Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets… |
CVE-2022-33326 | Critical | 9.8 | 2022-06-30 | Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets… |
CVE-2022-33325 | Critical | 9.8 | 2022-06-30 | Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets… |
CVE-2022-33314 | Critical | 9.8 | 2022-06-30 | Multiple command injection vulnerabilities exist in the web_server action endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network reques… |
CVE-2022-33313 | Critical | 9.8 | 2022-06-30 | Multiple command injection vulnerabilities exist in the web_server action endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network reques… |
CVE-2022-33312 | Critical | 9.8 | 2022-06-30 | Multiple command injection vulnerabilities exist in the web_server action endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network reques… |
CVE-2022-32585 | Critical | 9.8 | 2022-06-30 | A command execution vulnerability exists in the clish art2 functionality of Robustel R1510 3.3.0. A specially-crafted network request can lead to arbitrary com… |
CVE-2022-2197 | Critical | 9.8 | 2022-06-30 | By using a specific credential string, an attacker with network access to the device’s web interface could circumvent the authentication scheme and perform adm… |
CVE-2022-28127 | Critical | 9.1 | 2022-06-30 | A data removal vulnerability exists in the web_server /action/remove/ API functionality of Robustel R1510 3.3.0. A specially-crafted network request can lead t… |
CVE-2022-34818 | Medium | 4.3 | 2022-06-30 | Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier does not perform permission checks in several views and HTTP endpoints, allowing attackers with Overall… |
CVE-2022-34817 | Medium | 4.3 | 2022-06-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier allows attackers to disable jobs. |
CVE-2022-34816 | Medium | 6.5 | 2022-06-30 | Jenkins HPE Network Virtualization Plugin 1.0 stores passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed… |
CVE-2022-34815 | Medium | 4.3 | 2022-06-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier allows attackers to accept pending requests, the… |
CVE-2022-34814 | Medium | 4.3 | 2022-06-30 | Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier does not correctly perform a permission check in an HTTP endpoint, allowing attackers with Overall/Re… |
CVE-2022-34813 | Medium | 4.3 | 2022-06-30 | A missing permission check in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to create and delete XP… |
CVE-2022-34812 | Medium | 4.3 | 2022-06-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers to create and delete XPath ex… |
CVE-2022-34811 | Medium | 4.3 | 2022-06-30 | A missing permission check in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to access the XPath Con… |
CVE-2022-34810 | Medium | 6.5 | 2022-06-30 | A missing check in Jenkins RQM Plugin 2.8 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenki… |
CVE-2022-34809 | Medium | 6.5 | 2022-06-30 | Jenkins RQM Plugin 2.8 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users wit… |
CVE-2022-34808 | Medium | 4.3 | 2022-06-30 | Jenkins Cisco Spark Plugin 1.1.1 and earlier stores bearer tokens unencrypted in its global configuration file on the Jenkins controller where they can be view… |
CVE-2022-34807 | Medium | 6.5 | 2022-06-30 | Jenkins Elasticsearch Query Plugin 1.2 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be vie… |
CVE-2022-34806 | Medium | 6.5 | 2022-06-30 | Jenkins Jigomerge Plugin 0.9 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with… |
CVE-2022-34805 | Medium | 6.5 | 2022-06-30 | Jenkins Skype notifier Plugin 1.1.0 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed… |
CVE-2022-34804 | Medium | 4.3 | 2022-06-30 | Jenkins OpsGenie Plugin 1.9 and earlier transmits API keys in plain text as part of the global Jenkins configuration form and job configuration forms, potentia… |
CVE-2022-34803 | Medium | 4.3 | 2022-06-30 | Jenkins OpsGenie Plugin 1.9 and earlier stores API keys unencrypted in its global configuration file and in job config.xml files on the Jenkins controller wher… |
CVE-2022-34802 | Medium | 4.3 | 2022-06-30 | Jenkins RocketChat Notifier Plugin 1.5.2 and earlier stores the login password and webhook token unencrypted in its global configuration file on the Jenkins co… |
CVE-2022-34801 | Medium | 4.3 | 2022-06-30 | Jenkins Build Notifications Plugin 1.5.0 and earlier transmits tokens in plain text as part of the global Jenkins configuration form, potentially resulting in… |
CVE-2022-34800 | Medium | 4.3 | 2022-06-30 | Jenkins Build Notifications Plugin 1.5.0 and earlier stores tokens unencrypted in its global configuration files on the Jenkins controller where they can be vi… |
CVE-2022-34799 | Medium | 4.3 | 2022-06-30 | Jenkins Deployment Dashboard Plugin 1.0.10 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be… |
CVE-2022-34798 | Medium | 4.3 | 2022-06-30 | Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read perm… |
CVE-2022-34797 | Medium | 4.3 | 2022-06-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to connect to an attacker-specifie… |
CVE-2022-34796 | Medium | 4.3 | 2022-06-30 | A missing permission check in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs… |
CVE-2022-34795 | Medium | 5.4 | 2022-06-30 | Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not escape environment names on its Deployment Dashboard view, resulting in a stored cross-site scr… |
CVE-2022-34794 | Medium | 6.5 | 2022-06-30 | Missing permission checks in Jenkins Recipe Plugin 1.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to an attacker-specifie… |
CVE-2022-34793 | High | 8.8 | 2022-06-30 | Jenkins Recipe Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-34792 | High | 8.0 | 2022-06-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins Recipe Plugin 1.2 and earlier allows attackers to send an HTTP request to an attacker-specified UR… |
CVE-2022-34791 | Medium | 5.4 | 2022-06-30 | Jenkins Validating Email Parameter Plugin 1.10 and earlier does not escape the name and description of its parameter type, resulting in a stored cross-site scr… |
CVE-2022-34790 | Medium | 5.4 | 2022-06-30 | Jenkins eXtreme Feedback Panel Plugin 2.0.1 and earlier does not escape the job names used in tooltips, resulting in a stored cross-site scripting (XSS) vulner… |
CVE-2022-34789 | Medium | 6.5 | 2022-06-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins Matrix Reloaded Plugin 1.1.3 and earlier allows attackers to rebuild previous matrix builds. |
CVE-2022-34788 | Medium | 5.4 | 2022-06-30 | Jenkins Matrix Reloaded Plugin 1.1.3 and earlier does not escape the agent name in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exp… |
CVE-2022-34787 | Medium | 5.4 | 2022-06-30 | Jenkins Project Inheritance Plugin 21.04.03 and earlier does not escape the reason a build is blocked in tooltips, resulting in a cross-site scripting (XSS) vu… |
CVE-2022-34786 | Medium | 5.4 | 2022-06-30 | Jenkins Rich Text Publisher Plugin 1.4 and earlier does not escape the HTML message set by its post-build step, resulting in a stored cross-site scripting (XSS… |
CVE-2022-34785 | Medium | 4.3 | 2022-06-30 | Jenkins build-metrics Plugin 1.3 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to… |
CVE-2022-34784 | Medium | 5.4 | 2022-06-30 | Jenkins build-metrics Plugin 1.3 does not escape the build description on one of its views, resulting in a stored cross-site scripting (XSS) vulnerability expl… |
CVE-2022-34783 | Medium | 5.4 | 2022-06-30 | Jenkins Plot Plugin 2.1.10 and earlier does not escape plot descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attacke… |
CVE-2022-34782 | Medium | 4.3 | 2022-06-30 | An incorrect permission check in Jenkins requests-plugin Plugin 2.2.16 and earlier allows attackers with Overall/Read permission to view the list of pending re… |
CVE-2022-34781 | Medium | 6.5 | 2022-06-30 | Missing permission checks in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allow attackers with Overall/Read permission to connect to an attacker-spec… |
CVE-2022-34780 | Medium | 6.5 | 2022-06-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allows attackers to connect to an attacker-specifie… |
CVE-2022-34779 | Medium | 4.3 | 2022-06-30 | A missing permission check in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs… |
CVE-2022-34778 | Medium | 5.4 | 2022-06-30 | Jenkins TestNG Results Plugin 554.va4a552116332 and earlier renders the unescaped test descriptions and exception messages provided in test results if certain… |
CVE-2022-34777 | Medium | 5.4 | 2022-06-30 | Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of webhook-triggered builds, resulting in a stored cross… |
CVE-2022-31112 | High | 8.2 | 2022-06-30 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions parse Server LiveQuery does not re… |
CVE-2022-22496 | Medium | 6.5 | 2022-06-30 | While a user account for the IBM Spectrum Protect Server 8.1.0.000 through 8.1.14 is being established, it may be configured to use SESSIONSECURITY=TRANSITIONA… |
CVE-2022-22494 | Medium | 5.3 | 2022-06-30 | IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.14 could allow a remote attacker to gain details of the database, such as type and version, by sen… |