2022 CVEs (page 184)
Page 184 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-2227 | Low | 3.1 | 2022-07-01 | Improper access control in the runner jobs API in GitLab CE/EE affecting all versions prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows a… |
CVE-2022-2185 | Critical | 9.9 | 2022-07-01 | A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 where… |
CVE-2022-1983 | Medium | 6.5 | 2022-07-01 | Incorrect authorization in GitLab EE affecting all versions from 10.7 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allowed an attacker alr… |
CVE-2022-2253 | Critical | 9.1 | 2022-07-01 | A user with administrative privileges in Distributed Data Systems WebHMI 4.1.1.7662 may send OS commands to execute on the host server. |
CVE-2022-33103 | High | 7.8 | 2022-07-01 | Das U-Boot from v2020.10 to v2022.07-rc3 was discovered to contain an out-of-bounds write via the function sqfs_readdir(). |
CVE-2022-33099 | High | 7.5 | 2022-07-01 | An issue in the component luaG_runerror of Lua v5.4.4 and below leads to a heap-buffer overflow when a recursive error occurs. |
CVE-2022-2264 | High | 7.8 | 2022-07-01 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0. |
CVE-2022-34894 | Low | 3.5 | 2022-07-01 | In JetBrains Hub before 2022.2.14799, insufficient access control allowed the hijacking of untrusted services |
CVE-2022-2280 | Medium | 5.4 | 2022-07-01 | Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.19. |
CVE-2022-2279 | Medium | 5.5 | 2022-07-01 | NULL Pointer Dereference in GitHub repository bfabiszewski/libmobi prior to 0.11. |
CVE-2022-2274 | Critical | 9.8 | 2022-07-01 | The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions. This issue makes the RSA i… |
CVE-2022-32988 | Medium | 5.4 | 2022-07-01 | Cross Site Scripting (XSS) vulnerability in router Asus DSL-N14U-B1 1.1.2.3_805 via the "*list" parameters (e.g. filter_lwlist, keyword_rulelist, etc) in every… |
CVE-2022-32295 | Critical | 9.8 | 2022-07-01 | On Ampere Altra and AltraMax devices before SRP 1.09, the Altra reference design of UEFI accesses allows insecure access to SPI-NOR by the OS/hypervisor compon… |
CVE-2022-27904 | High | 7.0 | 2022-07-01 | Automox Agent for macOS before version 39 was vulnerable to a time-of-check/time-of-use (TOCTOU) race-condition attack during the agent install process. |
CVE-2022-33087 | High | 7.5 | 2022-06-30 | A stack overflow in the function DM_ In fillobjbystr() of TP-Link Archer C50&A5(US)_V5_200407 allows attackers to cause a Denial of Service (DoS) via a crafted… |
CVE-2022-33085 | High | 7.2 | 2022-06-30 | ESPCMS P8 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the fetch_filename function at \espcms_public\espcms_templat… |
CVE-2022-33082 | High | 7.5 | 2022-06-30 | An issue in the AST parser (ast/compile.go) of Open Policy Agent v0.10.2 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
CVE-2022-31115 | High | 8.8 | 2022-06-30 | opensearch-ruby is a community-driven, open source fork of elasticsearch-ruby. In versions prior to 2.0.1 the ruby `YAML.load` function was used instead of `YA… |
CVE-2022-2257 | High | 7.8 | 2022-06-30 | Out-of-bounds Read in GitHub repository vim/vim prior to 9.0. |
CVE-2022-23725 | High | 7.7 | 2022-06-30 | PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstances. |
CVE-2022-23720 | High | 7.5 | 2022-06-30 | PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file. An IT administr… |
CVE-2022-23719 | High | 7.2 | 2022-06-30 | PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests. An attacker with the abi… |
CVE-2022-23718 | High | 7.6 | 2022-06-30 | PingID Windows Login prior to 2.8 uses known vulnerable components that can lead to remote code execution. An attacker capable of achieving a sophisticated man… |
CVE-2022-23717 | Medium | 5.0 | 2022-06-30 | PingID Windows Login prior to 2.8 is vulnerable to a denial of service condition on local machines when combined with using offline security keys as part of au… |
CVE-2022-33329 | Critical | 9.8 | 2022-06-30 | Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets… |
CVE-2022-33328 | Critical | 9.8 | 2022-06-30 | Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets… |
CVE-2022-33327 | Critical | 9.8 | 2022-06-30 | Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets… |
CVE-2022-33326 | Critical | 9.8 | 2022-06-30 | Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets… |
CVE-2022-33325 | Critical | 9.8 | 2022-06-30 | Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets… |
CVE-2022-33314 | Critical | 9.8 | 2022-06-30 | Multiple command injection vulnerabilities exist in the web_server action endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network reques… |
CVE-2022-33313 | Critical | 9.8 | 2022-06-30 | Multiple command injection vulnerabilities exist in the web_server action endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network reques… |
CVE-2022-33312 | Critical | 9.8 | 2022-06-30 | Multiple command injection vulnerabilities exist in the web_server action endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network reques… |
CVE-2022-32585 | Critical | 9.8 | 2022-06-30 | A command execution vulnerability exists in the clish art2 functionality of Robustel R1510 3.3.0. A specially-crafted network request can lead to arbitrary com… |
CVE-2022-2197 | Critical | 9.8 | 2022-06-30 | By using a specific credential string, an attacker with network access to the device’s web interface could circumvent the authentication scheme and perform adm… |
CVE-2022-28127 | Critical | 9.1 | 2022-06-30 | A data removal vulnerability exists in the web_server /action/remove/ API functionality of Robustel R1510 3.3.0. A specially-crafted network request can lead t… |
CVE-2022-34818 | Medium | 4.3 | 2022-06-30 | Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier does not perform permission checks in several views and HTTP endpoints, allowing attackers with Overall… |
CVE-2022-34817 | Medium | 4.3 | 2022-06-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier allows attackers to disable jobs. |
CVE-2022-34816 | Medium | 6.5 | 2022-06-30 | Jenkins HPE Network Virtualization Plugin 1.0 stores passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed… |
CVE-2022-34815 | Medium | 4.3 | 2022-06-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier allows attackers to accept pending requests, the… |
CVE-2022-34814 | Medium | 4.3 | 2022-06-30 | Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier does not correctly perform a permission check in an HTTP endpoint, allowing attackers with Overall/Re… |
CVE-2022-34813 | Medium | 4.3 | 2022-06-30 | A missing permission check in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to create and delete XP… |
CVE-2022-34812 | Medium | 4.3 | 2022-06-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers to create and delete XPath ex… |
CVE-2022-34811 | Medium | 4.3 | 2022-06-30 | A missing permission check in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to access the XPath Con… |
CVE-2022-34810 | Medium | 6.5 | 2022-06-30 | A missing check in Jenkins RQM Plugin 2.8 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenki… |
CVE-2022-34809 | Medium | 6.5 | 2022-06-30 | Jenkins RQM Plugin 2.8 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users wit… |
CVE-2022-34808 | Medium | 4.3 | 2022-06-30 | Jenkins Cisco Spark Plugin 1.1.1 and earlier stores bearer tokens unencrypted in its global configuration file on the Jenkins controller where they can be view… |
CVE-2022-34807 | Medium | 6.5 | 2022-06-30 | Jenkins Elasticsearch Query Plugin 1.2 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be vie… |
CVE-2022-34806 | Medium | 6.5 | 2022-06-30 | Jenkins Jigomerge Plugin 0.9 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with… |
CVE-2022-34805 | Medium | 6.5 | 2022-06-30 | Jenkins Skype notifier Plugin 1.1.0 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed… |
CVE-2022-34804 | Medium | 4.3 | 2022-06-30 | Jenkins OpsGenie Plugin 1.9 and earlier transmits API keys in plain text as part of the global Jenkins configuration form and job configuration forms, potentia… |
CVE-2022-34803 | Medium | 4.3 | 2022-06-30 | Jenkins OpsGenie Plugin 1.9 and earlier stores API keys unencrypted in its global configuration file and in job config.xml files on the Jenkins controller wher… |
CVE-2022-34802 | Medium | 4.3 | 2022-06-30 | Jenkins RocketChat Notifier Plugin 1.5.2 and earlier stores the login password and webhook token unencrypted in its global configuration file on the Jenkins co… |
CVE-2022-34801 | Medium | 4.3 | 2022-06-30 | Jenkins Build Notifications Plugin 1.5.0 and earlier transmits tokens in plain text as part of the global Jenkins configuration form, potentially resulting in… |
CVE-2022-34800 | Medium | 4.3 | 2022-06-30 | Jenkins Build Notifications Plugin 1.5.0 and earlier stores tokens unencrypted in its global configuration files on the Jenkins controller where they can be vi… |
CVE-2022-34799 | Medium | 4.3 | 2022-06-30 | Jenkins Deployment Dashboard Plugin 1.0.10 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be… |
CVE-2022-34798 | Medium | 4.3 | 2022-06-30 | Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read perm… |
CVE-2022-34797 | Medium | 4.3 | 2022-06-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to connect to an attacker-specifie… |
CVE-2022-34796 | Medium | 4.3 | 2022-06-30 | A missing permission check in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs… |
CVE-2022-34795 | Medium | 5.4 | 2022-06-30 | Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not escape environment names on its Deployment Dashboard view, resulting in a stored cross-site scr… |
CVE-2022-34794 | Medium | 6.5 | 2022-06-30 | Missing permission checks in Jenkins Recipe Plugin 1.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to an attacker-specifie… |
CVE-2022-34793 | High | 8.8 | 2022-06-30 | Jenkins Recipe Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-34792 | High | 8.0 | 2022-06-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins Recipe Plugin 1.2 and earlier allows attackers to send an HTTP request to an attacker-specified UR… |
CVE-2022-34791 | Medium | 5.4 | 2022-06-30 | Jenkins Validating Email Parameter Plugin 1.10 and earlier does not escape the name and description of its parameter type, resulting in a stored cross-site scr… |
CVE-2022-34790 | Medium | 5.4 | 2022-06-30 | Jenkins eXtreme Feedback Panel Plugin 2.0.1 and earlier does not escape the job names used in tooltips, resulting in a stored cross-site scripting (XSS) vulner… |
CVE-2022-34789 | Medium | 6.5 | 2022-06-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins Matrix Reloaded Plugin 1.1.3 and earlier allows attackers to rebuild previous matrix builds. |
CVE-2022-34788 | Medium | 5.4 | 2022-06-30 | Jenkins Matrix Reloaded Plugin 1.1.3 and earlier does not escape the agent name in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exp… |
CVE-2022-34787 | Medium | 5.4 | 2022-06-30 | Jenkins Project Inheritance Plugin 21.04.03 and earlier does not escape the reason a build is blocked in tooltips, resulting in a cross-site scripting (XSS) vu… |
CVE-2022-34786 | Medium | 5.4 | 2022-06-30 | Jenkins Rich Text Publisher Plugin 1.4 and earlier does not escape the HTML message set by its post-build step, resulting in a stored cross-site scripting (XSS… |
CVE-2022-34785 | Medium | 4.3 | 2022-06-30 | Jenkins build-metrics Plugin 1.3 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to… |
CVE-2022-34784 | Medium | 5.4 | 2022-06-30 | Jenkins build-metrics Plugin 1.3 does not escape the build description on one of its views, resulting in a stored cross-site scripting (XSS) vulnerability expl… |
CVE-2022-34783 | Medium | 5.4 | 2022-06-30 | Jenkins Plot Plugin 2.1.10 and earlier does not escape plot descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attacke… |
CVE-2022-34782 | Medium | 4.3 | 2022-06-30 | An incorrect permission check in Jenkins requests-plugin Plugin 2.2.16 and earlier allows attackers with Overall/Read permission to view the list of pending re… |
CVE-2022-34781 | Medium | 6.5 | 2022-06-30 | Missing permission checks in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allow attackers with Overall/Read permission to connect to an attacker-spec… |
CVE-2022-34780 | Medium | 6.5 | 2022-06-30 | A cross-site request forgery (CSRF) vulnerability in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allows attackers to connect to an attacker-specifie… |
CVE-2022-34779 | Medium | 4.3 | 2022-06-30 | A missing permission check in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs… |
CVE-2022-34778 | Medium | 5.4 | 2022-06-30 | Jenkins TestNG Results Plugin 554.va4a552116332 and earlier renders the unescaped test descriptions and exception messages provided in test results if certain… |
CVE-2022-34777 | Medium | 5.4 | 2022-06-30 | Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of webhook-triggered builds, resulting in a stored cross… |
CVE-2022-31112 | High | 8.2 | 2022-06-30 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions parse Server LiveQuery does not re… |
CVE-2022-22496 | Medium | 6.5 | 2022-06-30 | While a user account for the IBM Spectrum Protect Server 8.1.0.000 through 8.1.14 is being established, it may be configured to use SESSIONSECURITY=TRANSITIONA… |
CVE-2022-22494 | Medium | 5.3 | 2022-06-30 | IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.14 could allow a remote attacker to gain details of the database, such as type and version, by sen… |
CVE-2022-22487 | Critical | 9.8 | 2022-06-30 | An IBM Spectrum Protect storage agent could allow a remote attacker to perform a brute force attack by allowing unlimited attempts to login to the storage agen… |
CVE-2022-22478 | Medium | 5.5 | 2022-06-30 | IBM Spectrum Protect Client 8.1.0.0 through 8.1.14.0 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 225886. |
CVE-2022-22474 | High | 7.5 | 2022-06-30 | IBM Spectrum Protect 8.1.0.0 through 8.1.14.0 dsmcad, dsmc, and dsmcsvc processes incorrectly handle certain read operations on TCP/IP sockets. This can result… |
CVE-2022-22472 | High | 8.8 | 2022-06-30 | IBM Spectrum Protect Plus Container Backup and Restore (10.1.5 through 10.1.10.2 for Kubernetes and 10.1.7 through 10.1.10.2 for Red Hat OpenShift) could allow… |
CVE-2022-2058 | Medium | 5.5 | 2022-06-30 | Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from so… |
CVE-2022-2057 | Medium | 5.5 | 2022-06-30 | Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from so… |
CVE-2022-2056 | Medium | 5.5 | 2022-06-30 | Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from so… |
CVE-2022-1955 | Medium | 4.6 | 2022-06-30 | Session 1.13.0 allows an attacker with physical access to the victim's device to bypass the application's password/pin lock to access user data. This is possib… |
CVE-2022-33043 | Medium | 5.4 | 2022-06-30 | A cross-site scripting (XSS) vulnerability in the batch add function of Urtracker Premium v4.0.1.1477 allows attackers to execute arbitrary web scripts or HTML… |
CVE-2022-2078 | Medium | 5.5 | 2022-06-30 | A vulnerability was found in the Linux kernel's nft_set_desc_concat_parse() function .This flaw allows an attacker to trigger a buffer overflow via nft_set_des… |
CVE-2022-1852 | Medium | 5.5 | 2022-06-30 | A NULL pointer dereference flaw was found in the Linux kernel’s KVM module, which can lead to a denial of service in the x86_emulate_insn in arch/x86/kvm/emula… |
CVE-2022-26135 | Medium | 6.5 | 2022-06-30 | A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to p… |
CVE-2022-34835 | Critical | 9.8 | 2022-06-30 | In Das U-Boot through 2022.07-rc5, an integer signedness error and resultant stack-based buffer overflow in the "i2c md" command enables the corruption of the… |
CVE-2022-30467 | Medium | 6.8 | 2022-06-29 | Joy ebike Wolf Manufacturing year 2022 is vulnerable to Denial of service, which allows remote attackers to jam the key fob request via RF. |
CVE-2022-33061 | High | 7.2 | 2022-06-29 | Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_service. |
CVE-2022-33060 | High | 7.2 | 2022-06-29 | Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_schedule. |
CVE-2022-33059 | High | 7.2 | 2022-06-29 | Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_train. |
CVE-2022-33058 | High | 7.2 | 2022-06-29 | Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_message. |
CVE-2022-33057 | High | 7.2 | 2022-06-29 | Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_reservation. |
CVE-2022-2073 | High | 7.2 | 2022-06-29 | Code Injection in GitHub repository getgrav/grav prior to 1.7.34. |