2022 CVEs (page 187)
Page 187 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-22390 | High | 7.5 | 2022-06-24 | IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 may be vulnerable to an information disclosure caused by improper privilege management when… |
CVE-2022-22389 | Medium | 6.5 | 2022-06-24 | IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may terminate abnormally when executing… |
CVE-2022-33953 | Medium | 4.6 | 2022-06-24 | IBM Robotic Process Automation 21.0.1 and 21.0.2 could allow a user with psychical access to the system to obtain sensitive information due to insufficiently p… |
CVE-2022-31767 | Critical | 9.8 | 2022-06-24 | IBM CICS TX Standard and Advanced 11.1 could allow a remote attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-… |
CVE-2022-29330 | Medium | 4.9 | 2022-06-24 | Missing access control in the backup system of Telesoft VitalPBX before 3.2.1 allows attackers to access the PJSIP and SIP extension credentials, cryptographic… |
CVE-2022-27238 | Medium | 5.4 | 2022-06-24 | BigBlueButton version 2.4.7 (or earlier) is vulnerable to stored Cross-Site Scripting (XSS) in the private chat functionality. A threat actor could inject Java… |
CVE-2022-22502 | Medium | 5.4 | 2022-06-24 | IBM Robotic Process Automation 21.0.1 and 21.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in t… |
CVE-2022-20829 | Critical | 9.1 | 2022-06-24 | A vulnerability in the packaging of Cisco Adaptive Security Device Manager (ASDM) images and the validation of those images by Cisco Adaptive Security Applianc… |
CVE-2022-20828 | Medium | 6.5 | 2022-06-24 | A vulnerability in the CLI parser of Cisco FirePOWER Software for Adaptive Security Appliance (ASA) FirePOWER module could allow an authenticated, remote attac… |
CVE-2022-32209 | Medium | 6.1 | 2022-06-24 | # Possible XSS Vulnerability in Rails::Html::SanitizerThere is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.This vulnerab… |
CVE-2022-30120 | Medium | 6.1 | 2022-06-24 | XSS in /dashboard/blocks/stacks/view_details/ - old browsers only. When using an older browser with built-in XSS protection disabled, insufficient sanitation w… |
CVE-2022-30119 | Medium | 6.1 | 2022-06-24 | XSS in /dashboard/reports/logs/view - old browsers only. When using Internet Explorer with the XSS protection disabled, insufficient sanitation where built url… |
CVE-2022-30118 | Medium | 6.1 | 2022-06-24 | Title for CVE: XSS in /dashboard/system/express/entities/forms/save_control/[GUID]: old browsers only.Description: When using Internet Explorer with the XSS pr… |
CVE-2022-30117 | Critical | 9.1 | 2022-06-24 | Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload which could result in an Arbitrary File Del… |
CVE-2022-2121 | High | 7.5 | 2022-06-24 | OFFIS DCMTK's (All versions prior to 3.6.7) has a NULL pointer dereference vulnerability while processing DICOM files, which may result in a denial-of-service… |
CVE-2022-2120 | High | 7.5 | 2022-06-24 | OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing an attacker to write DICOM files into a… |
CVE-2022-2119 | High | 7.5 | 2022-06-24 | OFFIS DCMTK's (All versions prior to 3.6.7) service class provider (SCP) is vulnerable to path traversal, allowing an attacker to write DICOM files into arbitr… |
CVE-2022-2105 | Critical | 9.4 | 2022-06-24 | Client-side JavaScript controls may be bypassed to change user credentials and permissions without authentication, including a “root” user level meant only for… |
CVE-2022-2104 | Critical | 9.9 | 2022-06-24 | The www-data (Apache web server) account is configured to run sudo with no password for many commands (including /bin/sh and /bin/bash). |
CVE-2022-2103 | Critical | 9.8 | 2022-06-24 | An attacker with weak credentials could access the TCP port via an open FTP port, allowing an attacker to read sensitive files and write to remotely executable… |
CVE-2022-2102 | Critical | 9.4 | 2022-06-24 | Controls limiting uploads to certain file extensions may be bypassed. This could allow an attacker to intercept the initial file upload page response and modif… |
CVE-2022-28620 | Critical | 9.8 | 2022-06-24 | A remote authentication bypass vulnerability was discovered in HPE Cray Legacy Shasta System Solutions; HPE Slingshot; and HPE Cray EX supercomputers versions… |
CVE-2022-28619 | High | 7.8 | 2022-06-24 | A potential security vulnerability has been identified in the installer of HPE Version Control Repository Manager. The vulnerability could allow local escalati… |
CVE-2022-23170 | Medium | 5.9 | 2022-06-24 | SysAid - Okta SSO integration - was found vulnerable to XML External Entity Injection vulnerability. Any SysAid environment that uses the Okta SSO integration… |
CVE-2022-21829 | Critical | 9.8 | 2022-06-24 | Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which could lead to an RCE… |
CVE-2022-1747 | Medium | 4.6 | 2022-06-24 | The authentication mechanism used by voters to activate a voting session on the tested version of Dominion Voting Systems ImageCast X is susceptible to forgery… |
CVE-2022-1746 | High | 7.6 | 2022-06-24 | The authentication mechanism used by poll workers to administer voting using the tested version of Dominion Voting Systems ImageCast X can expose cryptographic… |
CVE-2022-1745 | Medium | 6.8 | 2022-06-24 | The authentication mechanism used by technicians on the tested version of Dominion Voting Systems ImageCast X is susceptible to forgery. An attacker with physi… |
CVE-2022-1744 | Medium | 6.8 | 2022-06-24 | Applications on the tested version of Dominion Voting Systems ImageCast X can execute code with elevated privileges by exploiting a system level service. An at… |
CVE-2022-1743 | Medium | 6.8 | 2022-06-24 | The tested version of Dominion Voting System ImageCast X can be manipulated to cause arbitrary code execution by specially crafted election definition files. A… |
CVE-2022-1742 | Medium | 6.8 | 2022-06-24 | The tested version of Dominion Voting Systems ImageCast X allows for rebooting into Android Safe Mode, which allows an attacker to directly access the operatin… |
CVE-2022-1741 | Medium | 6.8 | 2022-06-24 | The tested version of Dominion Voting Systems ImageCast X has a Terminal Emulator application which could be leveraged by an attacker to gain elevated privileg… |
CVE-2022-1740 | Medium | 4.6 | 2022-06-24 | The tested version of Dominion Voting Systems ImageCast X’s on-screen application hash display feature, audit log export, and application export functionality… |
CVE-2022-1739 | Medium | 6.8 | 2022-06-24 | The tested version of Dominion Voting Systems ImageCast X does not validate application signatures to a trusted root certificate. Use of a trusted root certifi… |
CVE-2022-1668 | Critical | 9.8 | 2022-06-24 | Weak default root user credentials allow remote attackers to easily obtain OS superuser privileges over the open TCP port for SSH. |
CVE-2022-1667 | High | 7.5 | 2022-06-24 | Client-side JavaScript controls may be bypassed by directly running a JS function to reboot the PLC (e.g., from the browser console) or by loading the correspo… |
CVE-2022-1666 | Medium | 6.5 | 2022-06-24 | The default password for the web application’s root user (the vendor’s private account) was weak and the MD5 hash was used to crack the password using a widely… |
CVE-2022-1524 | High | 7.4 | 2022-06-24 | LRM version 2.4 and lower does not implement TLS encryption. A malicious actor can MITM attack sensitive data in-transit, including credentials. |
CVE-2022-1521 | Critical | 9.1 | 2022-06-24 | LRM does not implement authentication or authorization by default. A malicious actor can inject, replay, modify, and/or intercept sensitive data. |
CVE-2022-1519 | Critical | 10.0 | 2022-06-24 | LRM does not restrict the types of files that can be uploaded to the affected product. A malicious actor can upload any file type, including executable code th… |
CVE-2022-1518 | Critical | 10.0 | 2022-06-24 | LRM contains a directory traversal vulnerability that can allow a malicious actor to upload outside the intended directory structure. |
CVE-2022-1517 | Critical | 10.0 | 2022-06-24 | LRM utilizes elevated privileges. An unauthenticated malicious actor can upload and execute code remotely at the operating system level, which can allow an att… |
CVE-2022-32990 | Medium | 5.5 | 2022-06-24 | An issue in gimp_layer_invalidate_boundary of GNOME GIMP 2.10.30 allows attackers to trigger an unhandled exception via a crafted XCF file, causing a Denial of… |
CVE-2022-32530 | Medium | 4.8 | 2022-06-24 | A CWE-668 Exposure of Resource to Wrong Sphere vulnerability exists that could cause users to be misled, hiding alarms, showing the wrong server connection opt… |
CVE-2022-32143 | High | 8.8 | 2022-06-24 | In multiple CODESYS products, file download and upload function allows access to internal files in the working directory e.g. firmware files of the PLC. All re… |
CVE-2022-32142 | High | 8.1 | 2022-06-24 | Multiple CODESYS Products are prone to a out-of bounds read or write access. A low privileged remote attacker may craft a request with invalid offset, which ca… |
CVE-2022-32141 | Medium | 6.5 | 2022-06-24 | Multiple CODESYS Products are prone to a buffer over read. A low privileged remote attacker may craft a request with an invalid offset, which can cause an inte… |
CVE-2022-32140 | Medium | 6.5 | 2022-06-24 | Multiple CODESYS products are affected to a buffer overflow.A low privileged remote attacker may craft a request, which can cause a buffer copy without checkin… |
CVE-2022-32139 | Medium | 6.5 | 2022-06-24 | In multiple CODESYS products, a low privileged remote attacker may craft a request, which cause an out-of-bounds read, resulting in a denial-of-service conditi… |
CVE-2022-32138 | High | 8.8 | 2022-06-24 | In multiple CODESYS products, a remote attacker may craft a request which may cause an unexpected sign extension, resulting in a denial-of-service condition or… |
CVE-2022-32137 | High | 8.8 | 2022-06-24 | In multiple CODESYS products, a low privileged remote attacker may craft a request, which may cause a heap-based buffer overflow, resulting in a denial-of-serv… |
CVE-2022-32136 | Medium | 6.5 | 2022-06-24 | In multiple CODESYS products, a low privileged remote attacker may craft a request that cause a read access to an uninitialized pointer, resulting in a denial-… |
CVE-2022-31806 | Critical | 9.8 | 2022-06-24 | In CODESYS V2 PLCWinNT and Runtime Toolkit 32 in versions prior to V2.4.7.57 password protection is not enabled by default and there is no information or promp… |
CVE-2022-31805 | High | 7.5 | 2022-06-24 | In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected. |
CVE-2022-31804 | High | 7.5 | 2022-06-24 | The CODESYS Gateway Server V2 does not verifiy that the size of a request is within expected limits. An unauthenticated attacker may allocate an arbitrary amou… |
CVE-2022-31803 | Medium | 5.3 | 2022-06-24 | In CODESYS Gateway Server V2 an insufficient check for the activity of TCP client connections allows an unauthenticated attacker to consume all available TCP c… |
CVE-2022-31802 | Critical | 9.8 | 2022-06-24 | In CODESYS Gateway Server V2 for versions prior to V2.3.9.38 only a part of the the specified password is been compared to the real CODESYS Gateway password. A… |
CVE-2022-1965 | High | 8.1 | 2022-06-24 | Multiple products of CODESYS implement a improper error handling. A low privilege remote attacker may craft a request, which is not properly processed by the e… |
CVE-2022-32405 | High | 8.8 | 2022-06-24 | Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/prisons/view_prison.php:4 |
CVE-2022-32404 | High | 8.8 | 2022-06-24 | Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/inmates/manage_inmate.php:3 |
CVE-2022-32403 | High | 8.8 | 2022-06-24 | Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/inmates/manage_record.php:4 |
CVE-2022-32402 | High | 8.8 | 2022-06-24 | Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/prisons/manage_prison.php:4 |
CVE-2022-32401 | High | 8.8 | 2022-06-24 | Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/inmates/manage_privilege.php:4 |
CVE-2022-32400 | High | 7.2 | 2022-06-24 | Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/user/manage_user.php:4. |
CVE-2022-32399 | High | 8.8 | 2022-06-24 | Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/crimes/view_crime.php:4 |
CVE-2022-32398 | High | 8.8 | 2022-06-24 | Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/cells/manage_cell.php:4 |
CVE-2022-32397 | High | 8.8 | 2022-06-24 | Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/visits/view_visit.php:4 |
CVE-2022-32396 | High | 8.8 | 2022-06-24 | Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/visits/manage_visit.php:4 |
CVE-2022-32395 | High | 8.8 | 2022-06-24 | Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/crimes/manage_crime.php:4 |
CVE-2022-32394 | High | 8.8 | 2022-06-24 | Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/inmates/view_inmate.php:3 |
CVE-2022-32393 | High | 8.8 | 2022-06-24 | Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/cells/view_cell.php:4 |
CVE-2022-32392 | High | 8.8 | 2022-06-24 | Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/actions/manage_action.php:4 |
CVE-2022-32391 | High | 8.8 | 2022-06-24 | Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/actions/view_action.php:4 |
CVE-2022-2147 | Medium | 6.5 | 2022-06-23 | Cloudflare Warp for Windows from version 2022.2.95.0 contained an unquoted service path which enables arbitrary code execution leading to privilege escalation… |
CVE-2022-32987 | Medium | 4.8 | 2022-06-23 | Multiple cross-site scripting (XSS) vulnerabilities in /bsms/?page=manage_account of Simple Bakery Shop Management System v1.0 allows attackers to execute arbi… |
CVE-2022-2183 | High | 7.8 | 2022-06-23 | Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. |
CVE-2022-2182 | High | 7.8 | 2022-06-23 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. |
CVE-2022-26864 | Medium | 6.3 | 2022-06-23 | Prior Dell BIOS versions contain an Input Validation vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by send… |
CVE-2022-26863 | Medium | 6.3 | 2022-06-23 | Prior Dell BIOS versions contain an Input Validation vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by send… |
CVE-2022-26862 | Medium | 6.3 | 2022-06-23 | Prior Dell BIOS versions contain an Input Validation vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by send… |
CVE-2022-34328 | Medium | 6.1 | 2022-06-23 | PMB 7.3.10 allows reflected XSS via the id parameter in an lvl=author_see request to index.php. |
CVE-2022-34300 | High | 8.8 | 2022-06-23 | In tinyexr 1.0.1, there is a heap-based buffer over-read in tinyexr::DecodePixelData. |
CVE-2022-34299 | High | 8.1 | 2022-06-23 | There is a heap-based buffer over-read in libdwarf 0.4.0. This issue is related to dwarf_global_formref_b. |
CVE-2022-34298 | Medium | 5.3 | 2022-06-23 | The NT auth module in OpenAM before 14.6.6 allows a "replace Samba username attack." |
CVE-2022-34296 | High | 7.5 | 2022-06-23 | In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request. |
CVE-2022-34295 | Medium | 6.5 | 2022-06-23 | totd before 1.5.3 does not properly randomize mesg IDs. |
CVE-2022-34213 | Medium | 6.5 | 2022-06-23 | Jenkins Squash TM Publisher (Squash4Jenkins) Plugin 1.0.0 and earlier stores passwords unencrypted in its global configuration file on the Jenkins controller w… |
CVE-2022-34212 | Medium | 5.7 | 2022-06-23 | A missing permission check in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST request t… |
CVE-2022-34211 | Medium | 6.5 | 2022-06-23 | A cross-site request forgery (CSRF) vulnerability in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers to send an HTTP POST request to an a… |
CVE-2022-34210 | Medium | 6.5 | 2022-06-23 | A missing permission check in Jenkins ThreadFix Plugin 1.5.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL. |
CVE-2022-34209 | Medium | 6.5 | 2022-06-23 | A cross-site request forgery (CSRF) vulnerability in Jenkins ThreadFix Plugin 1.5.4 and earlier allows attackers to connect to an attacker-specified URL. |
CVE-2022-34208 | Medium | 4.3 | 2022-06-23 | A missing permission check in Jenkins Beaker builder Plugin 1.10 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified… |
CVE-2022-34207 | Medium | 6.5 | 2022-06-23 | A cross-site request forgery (CSRF) vulnerability in Jenkins Beaker builder Plugin 1.10 and earlier allows attackers to connect to an attacker-specified URL. |
CVE-2022-34206 | Medium | 4.3 | 2022-06-23 | A missing permission check in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers with Overall/Read permission to send HTTP POST requests to… |
CVE-2022-34205 | Medium | 6.5 | 2022-06-23 | A cross-site request forgery (CSRF) vulnerability in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers to send HTTP POST requests to an att… |
CVE-2022-34204 | Medium | 4.3 | 2022-06-23 | A missing permission check in Jenkins EasyQA Plugin 1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP serv… |
CVE-2022-34203 | High | 8.8 | 2022-06-23 | A cross-site request forgery (CSRF) vulnerability in Jenkins EasyQA Plugin 1.0 and earlier allows attackers to connect to an attacker-specified HTTP server. |
CVE-2022-34202 | Medium | 6.5 | 2022-06-23 | Jenkins EasyQA Plugin 1.0 and earlier stores user passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by… |
CVE-2022-34201 | Medium | 6.5 | 2022-06-23 | A missing permission check in Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier allows attackers with Overall/Read permission to connect to an attacker… |
CVE-2022-34200 | High | 8.8 | 2022-06-23 | A cross-site request forgery (CSRF) vulnerability in Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier allows attackers to connect to an attacker-speci… |