2022 CVEs (page 187)
Page 187 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-34054 | Critical | 9.8 | 2022-06-24 | The Perdido package in PyPI v0.0.1 to v0.0.2 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers t… |
CVE-2022-34053 | Critical | 9.8 | 2022-06-24 | The DR-Web-Engine package in PyPI v0.2.0b0 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to… |
CVE-2022-33122 | Medium | 4.8 | 2022-06-24 | A stored cross-site scripting (XSS) vulnerability in eyoucms v1.5.6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected in… |
CVE-2022-33121 | High | 8.1 | 2022-06-24 | A Cross-Site Request Forgery (CSRF) in MiniCMS v1.11 allows attackers to arbitrarily delete local .dat files via clicking on a malicious link. |
CVE-2022-33004 | Critical | 9.8 | 2022-06-24 | The Beginner package in PyPI v0.0.2 to v0.0.4 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers… |
CVE-2022-33003 | Critical | 9.8 | 2022-06-24 | The watools package in PyPI v0.0.1 to v0.0.8 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers t… |
CVE-2022-33002 | Critical | 9.8 | 2022-06-24 | The KGExplore package in PyPI v0.1.1 to v0.1.2 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers… |
CVE-2022-33001 | Critical | 9.8 | 2022-06-24 | The AAmiles package in PyPI v0.1.0 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access s… |
CVE-2022-33000 | Critical | 9.8 | 2022-06-24 | The ML-Scanner package in PyPI v0.1.0 to v0.1.5 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attacker… |
CVE-2022-32999 | Critical | 9.8 | 2022-06-24 | The cloudlabeling package in PyPI v0.0.1 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to ac… |
CVE-2022-32998 | Critical | 9.8 | 2022-06-24 | The cryptoasset-data-downloader package in PyPI v1.0.0 to v1.0.1 was discovered to contain a code execution backdoor via the request package. This vulnerabilit… |
CVE-2022-32997 | Critical | 9.8 | 2022-06-24 | The RootInteractive package in PyPI v0.0.5 to v0.0.19b0 was discovered to contain a code execution backdoor via the request package. This vulnerability allows… |
CVE-2022-32996 | Critical | 9.8 | 2022-06-24 | The django-navbar-client package of v0.9.50 to v1.0.1 was discovered to contain a code execution backdoor via the request package. This vulnerability allows at… |
CVE-2022-30885 | Critical | 9.8 | 2022-06-24 | The pyesasky for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1… |
CVE-2022-21231 | High | 7.5 | 2022-06-24 | All versions of package deep-get-set are vulnerable to Prototype Pollution via the 'deep' function. **Note:** This vulnerability derives from an incomplete fix… |
CVE-2022-33910 | Medium | 5.4 | 2022-06-24 | An XSS vulnerability in MantisBT before 2.25.5 allows remote attackers to attach crafted SVG documents to issue reports or bugnotes. When a user or an admin cl… |
CVE-2022-30028 | Medium | 5.9 | 2022-06-24 | Dradis Professional Edition before 4.3.0 allows attackers to change an account password via reusing a password reset token. |
CVE-2022-29578 | Medium | 5.3 | 2022-06-24 | Meridian Cooperative Utility Software versions 22.02 and 22.03 allows remote attackers to obtain sensitive information such as name, address, and daily energy… |
CVE-2022-29097 | Medium | 4.9 | 2022-06-24 | Dell WMS 3.6.1 and below contains a Path Traversal vulnerability in Device API. A remote attacker could potentially exploit this vulnerability, to gain unautho… |
CVE-2022-29096 | Medium | 6.1 | 2022-06-24 | Dell Wyse Management Suite 3.6.1 and below contains a Reflected Cross-Site Scripting Vulnerability in saveGroupConfigurations page. An authenticated attacker c… |
CVE-2022-22390 | High | 7.5 | 2022-06-24 | IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 may be vulnerable to an information disclosure caused by improper privilege management when… |
CVE-2022-22389 | Medium | 6.5 | 2022-06-24 | IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may terminate abnormally when executing… |
CVE-2022-33953 | Medium | 4.6 | 2022-06-24 | IBM Robotic Process Automation 21.0.1 and 21.0.2 could allow a user with psychical access to the system to obtain sensitive information due to insufficiently p… |
CVE-2022-31767 | Critical | 9.8 | 2022-06-24 | IBM CICS TX Standard and Advanced 11.1 could allow a remote attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-… |
CVE-2022-29330 | Medium | 4.9 | 2022-06-24 | Missing access control in the backup system of Telesoft VitalPBX before 3.2.1 allows attackers to access the PJSIP and SIP extension credentials, cryptographic… |
CVE-2022-27238 | Medium | 5.4 | 2022-06-24 | BigBlueButton version 2.4.7 (or earlier) is vulnerable to stored Cross-Site Scripting (XSS) in the private chat functionality. A threat actor could inject Java… |
CVE-2022-22502 | Medium | 5.4 | 2022-06-24 | IBM Robotic Process Automation 21.0.1 and 21.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in t… |
CVE-2022-20829 | Critical | 9.1 | 2022-06-24 | A vulnerability in the packaging of Cisco Adaptive Security Device Manager (ASDM) images and the validation of those images by Cisco Adaptive Security Applianc… |
CVE-2022-20828 | Medium | 6.5 | 2022-06-24 | A vulnerability in the CLI parser of Cisco FirePOWER Software for Adaptive Security Appliance (ASA) FirePOWER module could allow an authenticated, remote attac… |
CVE-2022-32209 | Medium | 6.1 | 2022-06-24 | # Possible XSS Vulnerability in Rails::Html::SanitizerThere is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.This vulnerab… |
CVE-2022-30120 | Medium | 6.1 | 2022-06-24 | XSS in /dashboard/blocks/stacks/view_details/ - old browsers only. When using an older browser with built-in XSS protection disabled, insufficient sanitation w… |
CVE-2022-30119 | Medium | 6.1 | 2022-06-24 | XSS in /dashboard/reports/logs/view - old browsers only. When using Internet Explorer with the XSS protection disabled, insufficient sanitation where built url… |
CVE-2022-30118 | Medium | 6.1 | 2022-06-24 | Title for CVE: XSS in /dashboard/system/express/entities/forms/save_control/[GUID]: old browsers only.Description: When using Internet Explorer with the XSS pr… |
CVE-2022-30117 | Critical | 9.1 | 2022-06-24 | Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload which could result in an Arbitrary File Del… |
CVE-2022-2121 | High | 7.5 | 2022-06-24 | OFFIS DCMTK's (All versions prior to 3.6.7) has a NULL pointer dereference vulnerability while processing DICOM files, which may result in a denial-of-service… |
CVE-2022-2120 | High | 7.5 | 2022-06-24 | OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing an attacker to write DICOM files into a… |
CVE-2022-2119 | High | 7.5 | 2022-06-24 | OFFIS DCMTK's (All versions prior to 3.6.7) service class provider (SCP) is vulnerable to path traversal, allowing an attacker to write DICOM files into arbitr… |
CVE-2022-2105 | Critical | 9.4 | 2022-06-24 | Client-side JavaScript controls may be bypassed to change user credentials and permissions without authentication, including a “root” user level meant only for… |
CVE-2022-2104 | Critical | 9.9 | 2022-06-24 | The www-data (Apache web server) account is configured to run sudo with no password for many commands (including /bin/sh and /bin/bash). |
CVE-2022-2103 | Critical | 9.8 | 2022-06-24 | An attacker with weak credentials could access the TCP port via an open FTP port, allowing an attacker to read sensitive files and write to remotely executable… |
CVE-2022-2102 | Critical | 9.4 | 2022-06-24 | Controls limiting uploads to certain file extensions may be bypassed. This could allow an attacker to intercept the initial file upload page response and modif… |
CVE-2022-28620 | Critical | 9.8 | 2022-06-24 | A remote authentication bypass vulnerability was discovered in HPE Cray Legacy Shasta System Solutions; HPE Slingshot; and HPE Cray EX supercomputers versions… |
CVE-2022-28619 | High | 7.8 | 2022-06-24 | A potential security vulnerability has been identified in the installer of HPE Version Control Repository Manager. The vulnerability could allow local escalati… |
CVE-2022-23170 | Medium | 5.9 | 2022-06-24 | SysAid - Okta SSO integration - was found vulnerable to XML External Entity Injection vulnerability. Any SysAid environment that uses the Okta SSO integration… |
CVE-2022-21829 | Critical | 9.8 | 2022-06-24 | Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which could lead to an RCE… |
CVE-2022-1747 | Medium | 4.6 | 2022-06-24 | The authentication mechanism used by voters to activate a voting session on the tested version of Dominion Voting Systems ImageCast X is susceptible to forgery… |
CVE-2022-1746 | High | 7.6 | 2022-06-24 | The authentication mechanism used by poll workers to administer voting using the tested version of Dominion Voting Systems ImageCast X can expose cryptographic… |
CVE-2022-1745 | Medium | 6.8 | 2022-06-24 | The authentication mechanism used by technicians on the tested version of Dominion Voting Systems ImageCast X is susceptible to forgery. An attacker with physi… |
CVE-2022-1744 | Medium | 6.8 | 2022-06-24 | Applications on the tested version of Dominion Voting Systems ImageCast X can execute code with elevated privileges by exploiting a system level service. An at… |
CVE-2022-1743 | Medium | 6.8 | 2022-06-24 | The tested version of Dominion Voting System ImageCast X can be manipulated to cause arbitrary code execution by specially crafted election definition files. A… |
CVE-2022-1742 | Medium | 6.8 | 2022-06-24 | The tested version of Dominion Voting Systems ImageCast X allows for rebooting into Android Safe Mode, which allows an attacker to directly access the operatin… |
CVE-2022-1741 | Medium | 6.8 | 2022-06-24 | The tested version of Dominion Voting Systems ImageCast X has a Terminal Emulator application which could be leveraged by an attacker to gain elevated privileg… |
CVE-2022-1740 | Medium | 4.6 | 2022-06-24 | The tested version of Dominion Voting Systems ImageCast X’s on-screen application hash display feature, audit log export, and application export functionality… |
CVE-2022-1739 | Medium | 6.8 | 2022-06-24 | The tested version of Dominion Voting Systems ImageCast X does not validate application signatures to a trusted root certificate. Use of a trusted root certifi… |
CVE-2022-1668 | Critical | 9.8 | 2022-06-24 | Weak default root user credentials allow remote attackers to easily obtain OS superuser privileges over the open TCP port for SSH. |
CVE-2022-1667 | High | 7.5 | 2022-06-24 | Client-side JavaScript controls may be bypassed by directly running a JS function to reboot the PLC (e.g., from the browser console) or by loading the correspo… |
CVE-2022-1666 | Medium | 6.5 | 2022-06-24 | The default password for the web application’s root user (the vendor’s private account) was weak and the MD5 hash was used to crack the password using a widely… |
CVE-2022-1524 | High | 7.4 | 2022-06-24 | LRM version 2.4 and lower does not implement TLS encryption. A malicious actor can MITM attack sensitive data in-transit, including credentials. |
CVE-2022-1521 | Critical | 9.1 | 2022-06-24 | LRM does not implement authentication or authorization by default. A malicious actor can inject, replay, modify, and/or intercept sensitive data. |
CVE-2022-1519 | Critical | 10.0 | 2022-06-24 | LRM does not restrict the types of files that can be uploaded to the affected product. A malicious actor can upload any file type, including executable code th… |
CVE-2022-1518 | Critical | 10.0 | 2022-06-24 | LRM contains a directory traversal vulnerability that can allow a malicious actor to upload outside the intended directory structure. |
CVE-2022-1517 | Critical | 10.0 | 2022-06-24 | LRM utilizes elevated privileges. An unauthenticated malicious actor can upload and execute code remotely at the operating system level, which can allow an att… |
CVE-2022-32990 | Medium | 5.5 | 2022-06-24 | An issue in gimp_layer_invalidate_boundary of GNOME GIMP 2.10.30 allows attackers to trigger an unhandled exception via a crafted XCF file, causing a Denial of… |
CVE-2022-32530 | Medium | 4.8 | 2022-06-24 | A CWE-668 Exposure of Resource to Wrong Sphere vulnerability exists that could cause users to be misled, hiding alarms, showing the wrong server connection opt… |
CVE-2022-32143 | High | 8.8 | 2022-06-24 | In multiple CODESYS products, file download and upload function allows access to internal files in the working directory e.g. firmware files of the PLC. All re… |
CVE-2022-32142 | High | 8.1 | 2022-06-24 | Multiple CODESYS Products are prone to a out-of bounds read or write access. A low privileged remote attacker may craft a request with invalid offset, which ca… |
CVE-2022-32141 | Medium | 6.5 | 2022-06-24 | Multiple CODESYS Products are prone to a buffer over read. A low privileged remote attacker may craft a request with an invalid offset, which can cause an inte… |
CVE-2022-32140 | Medium | 6.5 | 2022-06-24 | Multiple CODESYS products are affected to a buffer overflow.A low privileged remote attacker may craft a request, which can cause a buffer copy without checkin… |
CVE-2022-32139 | Medium | 6.5 | 2022-06-24 | In multiple CODESYS products, a low privileged remote attacker may craft a request, which cause an out-of-bounds read, resulting in a denial-of-service conditi… |
CVE-2022-32138 | High | 8.8 | 2022-06-24 | In multiple CODESYS products, a remote attacker may craft a request which may cause an unexpected sign extension, resulting in a denial-of-service condition or… |
CVE-2022-32137 | High | 8.8 | 2022-06-24 | In multiple CODESYS products, a low privileged remote attacker may craft a request, which may cause a heap-based buffer overflow, resulting in a denial-of-serv… |
CVE-2022-32136 | Medium | 6.5 | 2022-06-24 | In multiple CODESYS products, a low privileged remote attacker may craft a request that cause a read access to an uninitialized pointer, resulting in a denial-… |
CVE-2022-31806 | Critical | 9.8 | 2022-06-24 | In CODESYS V2 PLCWinNT and Runtime Toolkit 32 in versions prior to V2.4.7.57 password protection is not enabled by default and there is no information or promp… |
CVE-2022-31805 | High | 7.5 | 2022-06-24 | In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected. |
CVE-2022-31804 | High | 7.5 | 2022-06-24 | The CODESYS Gateway Server V2 does not verifiy that the size of a request is within expected limits. An unauthenticated attacker may allocate an arbitrary amou… |
CVE-2022-31803 | Medium | 5.3 | 2022-06-24 | In CODESYS Gateway Server V2 an insufficient check for the activity of TCP client connections allows an unauthenticated attacker to consume all available TCP c… |
CVE-2022-31802 | Critical | 9.8 | 2022-06-24 | In CODESYS Gateway Server V2 for versions prior to V2.3.9.38 only a part of the the specified password is been compared to the real CODESYS Gateway password. A… |
CVE-2022-1965 | High | 8.1 | 2022-06-24 | Multiple products of CODESYS implement a improper error handling. A low privilege remote attacker may craft a request, which is not properly processed by the e… |
CVE-2022-32405 | High | 8.8 | 2022-06-24 | Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/prisons/view_prison.php:4 |
CVE-2022-32404 | High | 8.8 | 2022-06-24 | Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/inmates/manage_inmate.php:3 |
CVE-2022-32403 | High | 8.8 | 2022-06-24 | Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/inmates/manage_record.php:4 |
CVE-2022-32402 | High | 8.8 | 2022-06-24 | Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/prisons/manage_prison.php:4 |
CVE-2022-32401 | High | 8.8 | 2022-06-24 | Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/inmates/manage_privilege.php:4 |
CVE-2022-32400 | High | 7.2 | 2022-06-24 | Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/user/manage_user.php:4. |
CVE-2022-32399 | High | 8.8 | 2022-06-24 | Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/crimes/view_crime.php:4 |
CVE-2022-32398 | High | 8.8 | 2022-06-24 | Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/cells/manage_cell.php:4 |
CVE-2022-32397 | High | 8.8 | 2022-06-24 | Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/visits/view_visit.php:4 |
CVE-2022-32396 | High | 8.8 | 2022-06-24 | Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/visits/manage_visit.php:4 |
CVE-2022-32395 | High | 8.8 | 2022-06-24 | Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/crimes/manage_crime.php:4 |
CVE-2022-32394 | High | 8.8 | 2022-06-24 | Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/inmates/view_inmate.php:3 |
CVE-2022-32393 | High | 8.8 | 2022-06-24 | Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/cells/view_cell.php:4 |
CVE-2022-32392 | High | 8.8 | 2022-06-24 | Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/actions/manage_action.php:4 |
CVE-2022-32391 | High | 8.8 | 2022-06-24 | Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/actions/view_action.php:4 |
CVE-2022-2147 | Medium | 6.5 | 2022-06-23 | Cloudflare Warp for Windows from version 2022.2.95.0 contained an unquoted service path which enables arbitrary code execution leading to privilege escalation… |
CVE-2022-32987 | Medium | 4.8 | 2022-06-23 | Multiple cross-site scripting (XSS) vulnerabilities in /bsms/?page=manage_account of Simple Bakery Shop Management System v1.0 allows attackers to execute arbi… |
CVE-2022-2183 | High | 7.8 | 2022-06-23 | Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. |
CVE-2022-2182 | High | 7.8 | 2022-06-23 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. |
CVE-2022-26864 | Medium | 6.3 | 2022-06-23 | Prior Dell BIOS versions contain an Input Validation vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by send… |
CVE-2022-26863 | Medium | 6.3 | 2022-06-23 | Prior Dell BIOS versions contain an Input Validation vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by send… |
CVE-2022-26862 | Medium | 6.3 | 2022-06-23 | Prior Dell BIOS versions contain an Input Validation vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by send… |