2022 CVEs (page 185)
Page 185 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-31110 | Medium | 5.3 | 2022-06-29 | RSSHub is an open source, extensible RSS feed generator. In commits prior to 5c4177441417 passing some special values to the `filter` and `filterout` parameter… |
CVE-2022-31063 | Medium | 6.5 | 2022-06-29 | Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions prior to 13.9.99.111 the title of a document… |
CVE-2022-31058 | High | 7.2 | 2022-06-29 | Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions prior to 13.9.99.95 Tuleap does not sanitize… |
CVE-2022-31032 | Medium | 4.3 | 2022-06-29 | Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions prior to 13.9.99.58 authorizations are not p… |
CVE-2022-33639 | High | 8.3 | 2022-06-29 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2022-33638 | High | 8.3 | 2022-06-29 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2022-33042 | High | 7.2 | 2022-06-29 | Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/inquiries/view_details.php. |
CVE-2022-30192 | High | 8.3 | 2022-06-29 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2022-2252 | Medium | 6.1 | 2022-06-29 | Open Redirect in GitHub repository microweber/microweber prior to 1.2.19. |
CVE-2022-32969 | Medium | 5.9 | 2022-06-29 | MetaMask before 10.11.3 might allow an attacker to access a user's secret recovery phrase because an input field is used for a BIP39 mnemonic, and Firefox and… |
CVE-2022-34043 | High | 7.3 | 2022-06-29 | Incorrect permissions for the folder C:\ProgramData\NoMachine\var\uninstall of Nomachine v7.9.2 allows attackers to perform a DLL hijacking attack and execute… |
CVE-2022-33037 | High | 7.8 | 2022-06-29 | A binary hijack in Orwell-Dev-Cpp v5.11 allows attackers to execute arbitrary code via a crafted .exe file. |
CVE-2022-33036 | High | 7.8 | 2022-06-29 | A binary hijack in Embarcadero Dev-CPP v6.3 allows attackers to execute arbitrary code via a crafted .exe file. |
CVE-2022-33035 | High | 7.8 | 2022-06-29 | XLPD v7.0.0094 and below contains an unquoted service path vulnerability which allows local users to launch processes with elevated privileges. |
CVE-2022-33107 | Critical | 9.8 | 2022-06-29 | ThinkPHP v6.0.12 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\AbstractCache.p… |
CVE-2022-33023 | High | 7.5 | 2022-06-29 | CVA6 commit 909d85a gives incorrect permission to use special multiplication units when the format of instructions is wrong. |
CVE-2022-33021 | High | 7.5 | 2022-06-29 | CVA6 commit 909d85a accesses invalid memory when reading the value of MHPMCOUNTER30. |
CVE-2022-31897 | Medium | 6.1 | 2022-06-29 | SourceCodester Zoo Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via public_html/register_visitor?msg=. |
CVE-2022-31266 | Medium | 4.3 | 2022-06-29 | In ILIAS through 7.10, lack of verification when changing an email address (on the Profile Page) allows remote attackers to take over accounts. |
CVE-2022-29272 | Medium | 6.1 | 2022-06-29 | In Nagios XI through 5.8.5, an open redirect vulnerability exists in the login function that could lead to spoofing. |
CVE-2022-29271 | Medium | 6.5 | 2022-06-29 | In Nagios XI through 5.8.5, a read-only Nagios user (due to an incorrect permission check) is able to schedule downtime for any host/services. This allows an a… |
CVE-2022-29270 | Medium | 4.3 | 2022-06-29 | In Nagios XI through 5.8.5, it is possible for a user without password verification to change his e-mail address. |
CVE-2022-29269 | Medium | 6.5 | 2022-06-29 | In Nagios XI through 5.8.5, in the schedule report function, an authenticated attacker is able to inject HTML tags that lead to the reformatting/editing of ema… |
CVE-2022-28803 | Medium | 5.4 | 2022-06-29 | In SilverStripe Framework through 2022-04-07, Stored XSS can occur in javascript link tags added via XMLHttpRequest (XHR). |
CVE-2022-32532 | Critical | 9.8 | 2022-06-29 | Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPatternMatcher with `… |
CVE-2022-31887 | Critical | 9.8 | 2022-06-28 | Marval MSM v14.19.0.12476 has a 0-Click Account Takeover vulnerability which allows an attacker to change any user's password in the organization, this means t… |
CVE-2022-31884 | Medium | 6.5 | 2022-06-28 | Marval MSM v14.19.0.12476 has an Improper Access Control vulnerability which allows a low privilege user to delete other users API Keys including high privileg… |
CVE-2022-29858 | Medium | 4.3 | 2022-06-28 | Silverstripe silverstripe/assets through 1.10 is vulnerable to improper access control that allows protected images to be published by changing an existing ima… |
CVE-2022-25238 | Medium | 5.4 | 2022-06-28 | Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS u… |
CVE-2022-24444 | Medium | 6.5 | 2022-06-28 | Silverstripe silverstripe/framework through 4.10 allows Session Fixation. |
CVE-2022-31886 | Medium | 6.5 | 2022-06-28 | Marval MSM v14.19.0.12476 is vulnerable to Cross Site Request Forgery (CSRF). An attacker can disable the 2FA by sending the user a malicious form. |
CVE-2022-31885 | Critical | 9.8 | 2022-06-28 | Marval MSM v14.19.0.12476 is vulnerable to OS Command Injection due to the insecure handling of VBScripts. |
CVE-2022-31883 | High | 8.8 | 2022-06-28 | Marval MSM v14.19.0.12476 is has an Insecure Direct Object Reference (IDOR) vulnerability. A low privilege user is able to see other users API Keys including t… |
CVE-2022-2231 | Medium | 5.5 | 2022-06-28 | NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2. |
CVE-2022-31230 | High | 8.1 | 2022-06-28 | Dell PowerScale OneFS, versions 8.2.x-9.2.x, contain broken or risky cryptographic algorithm. A remote unprivileged malicious attacker could potentially exploi… |
CVE-2022-31229 | Critical | 9.6 | 2022-06-28 | Dell PowerScale OneFS, 8.2.x through 9.3.0.x, contain an error message with sensitive information. An administrator could potentially exploit this vulnerabilit… |
CVE-2022-31108 | Medium | 4.1 | 2022-06-28 | Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams… |
CVE-2022-31106 | High | 8.3 | 2022-06-28 | Underscore.deep is a collection of Underscore mixins that operate on nested objects. Versions of `underscore.deep` prior to version 0.5.3 are vulnerable to a p… |
CVE-2022-31068 | Medium | 5.3 | 2022-06-28 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versio… |
CVE-2022-31061 | Critical | 9.8 | 2022-06-28 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versio… |
CVE-2022-31056 | Critical | 9.8 | 2022-06-28 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versio… |
CVE-2022-2145 | Medium | 5.8 | 2022-06-28 | Cloudflare WARP client for Windows (up to v. 2022.5.309.0) allowed creation of mount points from its ProgramData folder. During installation of the WARP client… |
CVE-2022-28621 | High | 7.5 | 2022-06-28 | A remote disclosure of sensitive information vulnerability was discovered in HPE NonStop DSM/SCM version: T6031H03^ADP. HPE has provided a software update to r… |
CVE-2022-33108 | High | 7.8 | 2022-06-28 | XPDF v4.04 was discovered to contain a stack overflow vulnerability via the Object::Copy class of object.cc files. |
CVE-2022-31052 | Medium | 6.5 | 2022-06-28 | Synapse is an open source home server implementation for the Matrix chat network. In versions prior to 1.61.1 URL previews of some web pages can exhaust the av… |
CVE-2022-0987 | Low | 3.3 | 2022-06-28 | A flaw was found in PackageKit in the way some of the methods exposed by the Transaction interface examines files. This issue allows a local user to measure th… |
CVE-2022-0085 | Medium | 5.3 | 2022-06-28 | Server-Side Request Forgery (SSRF) in GitHub repository dompdf/dompdf prior to 2.0.0. |
CVE-2022-30563 | High | 7.4 | 2022-06-28 | When an attacker uses a man-in-the-middle attack to sniff the request packets with success logging in through ONVIF, he can log in to the device by replaying t… |
CVE-2022-30562 | Medium | 4.7 | 2022-06-28 | If the user enables the https function on the device, an attacker can modify the user’s request data packet through a man-in-the-middle attack ,Injection of a… |
CVE-2022-30561 | Medium | 5.9 | 2022-06-28 | When an attacker uses a man-in-the-middle attack to sniff the request packets with success logging in, the attacker could log in to the device by replaying the… |
CVE-2022-30560 | High | 7.4 | 2022-06-28 | When an attacker obtaining the administrative account and password, or through a man-in-the-middle attack, the attacker could send a specified crafted packet t… |
CVE-2022-23763 | High | 7.8 | 2022-06-28 | Origin validation error vulnerability in NeoRS’s ActiveX moudle allows attackers to download and execute arbitrary files. Remote attackers can use this vulerab… |
CVE-2022-34750 | High | 7.5 | 2022-06-28 | An issue was discovered in MediaWiki through 1.38.1. The lemma length of a Wikibase lexeme is currently capped at a thousand characters. Unfortunately, this le… |
CVE-2022-30997 | High | 7.2 | 2022-06-28 | Use of hard-coded credentials vulnerability exists in STARDOM FCN Controller and FCJ Controller R4.10 to R4.31, which may allow an attacker with an administrat… |
CVE-2022-30707 | High | 8.8 | 2022-06-28 | Violation of secure design principles exists in the communication of CAMS for HIS. Affected products and versions are CENTUM series where LHS4800 is installed… |
CVE-2022-29519 | High | 7.5 | 2022-06-28 | Cleartext transmission of sensitive information vulnerability exists in STARDOM FCN Controller and FCJ Controller R1.01 to R4.31, which may allow an adjacent a… |
CVE-2022-23896 | Medium | 5.4 | 2022-06-28 | Admidio 4.1.2 version is affected by stored cross-site scripting (XSS). |
CVE-2022-0624 | High | 7.3 | 2022-06-28 | Authorization Bypass Through User-Controlled Key in GitHub repository ionicabizau/parse-path prior to 5.0.0. |
CVE-2022-34134 | High | 8.8 | 2022-06-28 | Jorani v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /application/controllers/Users.php. |
CVE-2022-34133 | Medium | 6.1 | 2022-06-28 | Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Comment parameter at application/controllers/Leaves.php. |
CVE-2022-34132 | Critical | 9.8 | 2022-06-28 | Jorani v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at application/controllers/Leaves.php. |
CVE-2022-31104 | Medium | 4.8 | 2022-06-28 | Wasmtime is a standalone runtime for WebAssembly. In affected versions wasmtime's implementation of the SIMD proposal for WebAssembly on x86_64 contained two d… |
CVE-2022-33009 | Medium | 4.8 | 2022-06-27 | A stored cross-site scripting (XSS) vulnerability in LightCMS v1.3.11 allows attackers to execute arbitrary web scripts or HTML via uploading a crafted PDF fil… |
CVE-2022-32995 | Critical | 9.8 | 2022-06-27 | Halo CMS v1.5.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the template remote download function. |
CVE-2022-32994 | Critical | 9.8 | 2022-06-27 | Halo CMS v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the component /api/admin/attachments/upload. |
CVE-2022-31103 | High | 7.5 | 2022-06-27 | lettersanitizer is a DOM-based HTML email sanitizer for in-browser email rendering. All versions of lettersanitizer below 1.0.2 are affected by a denial of ser… |
CVE-2022-31101 | High | 8.1 | 2022-06-27 | prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. In affected versions an authenticated customer can p… |
CVE-2022-31099 | Medium | 6.5 | 2022-06-27 | rulex is a new, portable, regular expression language. When parsing untrusted rulex expressions, the stack may overflow, possibly enabling a Denial of Service… |
CVE-2022-33879 | Low | 3.3 | 2022-06-27 | The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate, new reg… |
CVE-2022-33007 | High | 8.8 | 2022-06-27 | TRENDnet Wi-Fi routers TEW751DR v1.03 and TEW-752DRU v1.03 were discovered to contain a stack overflow via the function genacgi_main. |
CVE-2022-32092 | Critical | 9.8 | 2022-06-27 | D-Link DIR-645 v1.03 was discovered to contain a command injection vulnerability via the QUERY_STRING parameter at __ajax_explorer.sgi. |
CVE-2022-31100 | Medium | 6.5 | 2022-06-27 | rulex is a new, portable, regular expression language. When parsing untrusted rulex expressions, rulex may crash, possibly enabling a Denial of Service attack… |
CVE-2022-31098 | Critical | 9.0 | 2022-06-27 | Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. A vulnerability in… |
CVE-2022-31096 | Medium | 5.7 | 2022-06-27 | Discourse is an open source discussion platform. Under certain conditions, a logged in user can redeem an invite with an email that either doesn't match the in… |
CVE-2022-31093 | High | 7.5 | 2022-06-27 | NextAuth.js is a complete open source authentication solution for Next.js applications. In affected versions an attacker can send a request to an app using Nex… |
CVE-2022-31092 | High | 7.5 | 2022-06-27 | Pimcore is an Open Source Data & Experience Management Platform. Pimcore offers developers listing classes to make querying data easier. This listing classes a… |
CVE-2022-31091 | High | 7.7 | 2022-06-27 | Guzzle, an extensible PHP HTTP client. `Authorization` and `Cookie` headers on requests are sensitive information. In affected versions on making a request whi… |
CVE-2022-31090 | High | 7.7 | 2022-06-27 | Guzzle, an extensible PHP HTTP client. `Authorization` headers on requests are sensitive information. In affected versions when using our Curl handler, it is p… |
CVE-2022-33116 | Medium | 6.5 | 2022-06-27 | An issue in the jmpath variable in /modules/mindmap/index.php of GUnet Open eClass Platform (aka openeclass) v3.12.4 and below allows attackers to read arbitra… |
CVE-2022-33005 | Medium | 6.1 | 2022-06-27 | A cross-site scripting (XSS) vulnerability in the System Settings/IOT Settings module of Delta Electronics DIAEnergie v1.08.00 allows attackers to execute arbi… |
CVE-2022-31094 | High | 7.1 | 2022-06-27 | ScratchTools is a web extension designed to make interacting with the Scratch programming language community (Scratching) easier. In affected versions anybody… |
CVE-2022-31089 | High | 7.5 | 2022-06-27 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions certain types of invalid files req… |
CVE-2022-31088 | Medium | 5.3 | 2022-06-27 | LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the… |
CVE-2022-31087 | High | 7.8 | 2022-06-27 | LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the… |
CVE-2022-31086 | High | 8.8 | 2022-06-27 | LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 inco… |
CVE-2022-31085 | Medium | 6.1 | 2022-06-27 | LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the… |
CVE-2022-31084 | High | 8.1 | 2022-06-27 | LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 Ther… |
CVE-2022-31082 | Medium | 5.8 | 2022-06-27 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. glpi-inventory-plu… |
CVE-2022-31081 | High | 7.3 | 2022-06-27 | HTTP::Daemon is a simple http server class written in perl. Versions prior to 6.15 are subject to a vulnerability which could potentially be exploited to gain… |
CVE-2022-31077 | Medium | 4.0 | 2022-06-27 | KubeEdge is built upon Kubernetes and extends native containerized application orchestration and device management to hosts at the Edge. In affected versions a… |
CVE-2022-31076 | Medium | 4.2 | 2022-06-27 | KubeEdge is built upon Kubernetes and extends native containerized application orchestration and device management to hosts at the Edge. In affected versions a… |
CVE-2022-31065 | Medium | 6.5 | 2022-06-27 | BigBlueButton is an open source web conferencing system. In affected versions an attacker can embed malicious JS in their username and have it executed on the… |
CVE-2022-31064 | Medium | 6.5 | 2022-06-27 | BigBlueButton is an open source web conferencing system. Users in meetings with private chat enabled are vulnerable to a cross site scripting attack in affecte… |
CVE-2022-31057 | Medium | 6.5 | 2022-06-27 | Shopware is an open source e-commerce software made in Germany. Versions of Shopware 5 prior to version 5.7.12 are subject to an authenticated Stored XSS in Ad… |
CVE-2022-31039 | Medium | 4.3 | 2022-06-27 | Greenlight is a simple front-end interface for your BigBlueButton server. In affected versions an attacker can view any room's settings even though they are no… |
CVE-2022-31036 | Medium | 4.3 | 2022-06-27 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v1.3.0 are vulnerable to a symlink following bu… |
CVE-2022-31035 | Critical | 9.0 | 2022-06-27 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v1.0.0 are vulnerable to a cross-site scripting… |
CVE-2022-31034 | High | 8.3 | 2022-06-27 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v0.11.0 are vulnerable to a variety of attacks… |
CVE-2022-2221 | Medium | 6.5 | 2022-06-27 | Information Exposure vulnerability in My Account Settings of Devolutions Remote Desktop Manager before 2022.1.8 allows authenticated users to access credential… |
CVE-2022-28622 | High | 7.5 | 2022-06-27 | A potential security vulnerability has been identified in HPE StoreOnce Software. The SSH server supports weak key exchange algorithms which could lead to remo… |