2022 CVEs (page 188)
Page 188 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-34199 | Medium | 6.5 | 2022-06-23 | Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be view… |
CVE-2022-34198 | Medium | 5.4 | 2022-06-23 | Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier does not escape the name and description of Stash Branch parameters on views displaying parameters, res… |
CVE-2022-34197 | Medium | 5.4 | 2022-06-23 | Jenkins Sauce OnDemand Plugin 1.204 and earlier does not escape the name and description of Sauce Labs Browsers parameters on views displaying parameters, resu… |
CVE-2022-34196 | Medium | 5.4 | 2022-06-23 | Jenkins REST List Parameter Plugin 1.5.2 and earlier does not escape the name and description of REST list parameters on views displaying parameters, resulting… |
CVE-2022-34195 | Medium | 5.4 | 2022-06-23 | Jenkins Repository Connector Plugin 2.2.0 and earlier does not escape the name and description of Maven Repository Artifact parameters on views displaying para… |
CVE-2022-34194 | Medium | 5.4 | 2022-06-23 | Jenkins Readonly Parameter Plugin 1.0.0 and earlier does not escape the name and description of Readonly String and Readonly Text parameters on views displayin… |
CVE-2022-34193 | Medium | 5.4 | 2022-06-23 | Jenkins Package Version Plugin 1.0.1 and earlier does not escape the name of Package version parameters on views displaying parameters, resulting in a stored c… |
CVE-2022-34192 | Medium | 5.4 | 2022-06-23 | Jenkins ontrack Jenkins Plugin 4.0.0 and earlier does not escape the name of Ontrack: Multi Parameter choice, Ontrack: Parameter choice, and Ontrack: SinglePar… |
CVE-2022-34191 | Medium | 5.4 | 2022-06-23 | Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.77 and earlier does not escape the name of NetStorm Test parameters on views displaying parameters… |
CVE-2022-34190 | Medium | 5.4 | 2022-06-23 | Jenkins Maven Metadata Plugin for Jenkins CI server Plugin 2.1 and earlier does not escape the name and description of List maven artifact versions parameters… |
CVE-2022-34189 | Medium | 5.4 | 2022-06-23 | Jenkins Image Tag Parameter Plugin 1.10 and earlier does not escape the name and description of Image Tag parameters on views displaying parameters, resulting… |
CVE-2022-34188 | Medium | 5.4 | 2022-06-23 | Jenkins Hidden Parameter Plugin 0.0.4 and earlier does not escape the name and description of Hidden Parameter parameters on views displaying parameters, resul… |
CVE-2022-34187 | Medium | 5.4 | 2022-06-23 | Jenkins Filesystem List Parameter Plugin 0.0.7 and earlier does not escape the name and description of File system objects list parameters on views displaying… |
CVE-2022-34186 | Medium | 5.4 | 2022-06-23 | Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape the name and description of Moded Extended Choice parameters on views displa… |
CVE-2022-34185 | Medium | 5.4 | 2022-06-23 | Jenkins Date Parameter Plugin 0.0.4 and earlier does not escape the name and description of Date parameters on views displaying parameters, resulting in a stor… |
CVE-2022-34184 | Medium | 5.4 | 2022-06-23 | Jenkins CRX Content Package Deployer Plugin 1.9 and earlier does not escape the name and description of CRX Content Package Choice parameters on views displayi… |
CVE-2022-34183 | Medium | 5.4 | 2022-06-23 | Jenkins Agent Server Parameter Plugin 1.1 and earlier does not escape the name and description of Agent Server parameters on views displaying parameters, resul… |
CVE-2022-34182 | Medium | 6.1 | 2022-06-23 | Jenkins Nested View Plugin 1.20 through 1.25 (both inclusive) does not escape search parameters, resulting in a reflected cross-site scripting (XSS) vulnerabil… |
CVE-2022-34181 | Critical | 9.1 | 2022-06-23 | Jenkins xUnit Plugin 3.0.8 and earlier implements an agent-to-controller message that creates a user-specified directory if it doesn't exist, and parsing files… |
CVE-2022-34180 | High | 7.5 | 2022-06-23 | Jenkins Embeddable Build Status Plugin 2.0.3 and earlier does not correctly perform the ViewStatus permission check in the HTTP endpoint it provides for "unpro… |
CVE-2022-34179 | High | 7.5 | 2022-06-23 | Jenkins Embeddable Build Status Plugin 2.0.3 and earlier allows specifying a `style` query parameter that is used to choose a different SVG image style without… |
CVE-2022-34178 | Medium | 6.1 | 2022-06-23 | Jenkins Embeddable Build Status Plugin 2.0.3 allows specifying a 'link' query parameter that build status badges will link to, without restricting possible val… |
CVE-2022-34177 | High | 7.5 | 2022-06-23 | Jenkins Pipeline: Input Step Plugin 448.v37cea_9a_10a_70 and earlier archives files uploaded for `file` parameters for Pipeline `input` steps on the controller… |
CVE-2022-34176 | Medium | 5.4 | 2022-06-23 | Jenkins JUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results, resulting in a stored cross-site scripting (XSS) vulnerabi… |
CVE-2022-34175 | High | 7.5 | 2022-06-23 | Jenkins 2.335 through 2.355 (both inclusive) allows attackers in some cases to bypass a protection mechanism, thereby directly accessing some view fragments co… |
CVE-2022-34174 | High | 7.5 | 2022-06-23 | In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an… |
CVE-2022-34173 | Medium | 5.4 | 2022-06-23 | In Jenkins 2.340 through 2.355 (both inclusive) the tooltip of the build button in list views supports HTML without escaping the job display name, resulting in… |
CVE-2022-34172 | Medium | 5.4 | 2022-06-23 | In Jenkins 2.340 through 2.355 (both inclusive) symbol-based icons unescape previously escaped values of 'tooltip' parameters, resulting in a cross-site script… |
CVE-2022-34171 | Medium | 5.4 | 2022-06-23 | In Jenkins 2.321 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the HTML output generated for new symbol-based SVG icons i… |
CVE-2022-34170 | Medium | 5.4 | 2022-06-23 | In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the feature name that is par… |
CVE-2022-34013 | Medium | 4.3 | 2022-06-23 | OneBlog v2.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Logo parameter under the Link module. |
CVE-2022-34012 | Medium | 6.5 | 2022-06-23 | Insecure permissions in OneBlog v2.3.4 allows low-level administrators to reset the passwords of high-level administrators who hold greater privileges. |
CVE-2022-34011 | Medium | 4.3 | 2022-06-23 | OneBlog v2.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the parameter entryUrls. |
CVE-2022-33127 | Critical | 9.8 | 2022-06-23 | The function that calls the diff tool in Diffy 3.4.1 does not properly handle double quotes in a filename when run in a windows environment. This allows attack… |
CVE-2022-33124 | Medium | 5.5 | 2022-06-23 | AIOHTTP 3.8.1 can report a "ValueError: Invalid IPv6 URL" outcome, which can lead to a Denial of Service (DoS). NOTE: multiple third parties dispute this issue… |
CVE-2022-33114 | High | 7.2 | 2022-06-23 | Jfinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via the attrVal parameter at /jfinal_cms/system/dict/list. |
CVE-2022-33113 | Medium | 5.4 | 2022-06-23 | Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the keyword text field under the publish blog m… |
CVE-2022-33105 | High | 7.5 | 2022-06-23 | Redis v7.0 was discovered to contain a memory leak via the component streamGetEdgeID. |
CVE-2022-33097 | High | 7.5 | 2022-06-23 | 74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/campus/campus_job. |
CVE-2022-33096 | High | 7.5 | 2022-06-23 | 74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/resume/index. |
CVE-2022-33095 | High | 7.5 | 2022-06-23 | 74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/jobfairol/resumelist. |
CVE-2022-33094 | High | 7.5 | 2022-06-23 | 74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/job/map. |
CVE-2022-33093 | High | 7.5 | 2022-06-23 | 74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the key parameter at /freelance/resume_list. |
CVE-2022-33092 | High | 7.5 | 2022-06-23 | 74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/job/index. |
CVE-2022-33070 | Medium | 5.5 | 2022-06-23 | Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability… |
CVE-2022-33069 | Medium | 5.5 | 2022-06-23 | Ethereum Solidity v0.8.14 contains an assertion failure via SMTEncoder::indexOrMemberAssignment() at SMTEncoder.cpp. |
CVE-2022-33068 | Medium | 5.5 | 2022-06-23 | An integer overflow in the component hb-ot-shape-fallback.cc of Harfbuzz v4.3.0 allows attackers to cause a Denial of Service (DoS) via unspecified vectors. |
CVE-2022-33067 | Medium | 5.5 | 2022-06-23 | Lrzip v0.651 was discovered to contain multiple invalid arithmetic shifts via the functions get_magic in lrzip.c and Predictor::init in libzpaq/libzpaq.cpp. Th… |
CVE-2022-33034 | High | 7.8 | 2022-06-23 | LibreDWG v0.12.4.4608 was discovered to contain a stack overflow via the function copy_bytes at decode_r2007.c. |
CVE-2022-33033 | High | 7.8 | 2022-06-23 | LibreDWG v0.12.4.4608 was discovered to contain a double-free via the function dwg_read_file at dwg.c. |
CVE-2022-33032 | High | 7.8 | 2022-06-23 | LibreDWG v0.12.4.4608 was discovered to contain a heap-buffer-overflow via the function decode_preR13_section_hdr at decode_r11.c. |
CVE-2022-33028 | High | 7.8 | 2022-06-23 | LibreDWG v0.12.4.4608 was discovered to contain a heap buffer overflow via the function dwg_add_object at decode.c. |
CVE-2022-33027 | High | 7.8 | 2022-06-23 | LibreDWG v0.12.4.4608 was discovered to contain a heap-use-after-free via the function dwg_add_handleref at dwg.c. |
CVE-2022-33026 | High | 7.8 | 2022-06-23 | LibreDWG v0.12.4.4608 was discovered to contain a heap buffer overflow via the function bit_calc_CRC at bits.c. |
CVE-2022-33025 | High | 7.8 | 2022-06-23 | LibreDWG v0.12.4.4608 was discovered to contain a heap-use-after-free via the function decode_preR13_section at decode_r11.c. |
CVE-2022-33024 | High | 7.5 | 2022-06-23 | There is an Assertion `int decode_preR13_entities(BITCODE_RL, BITCODE_RL, unsigned int, BITCODE_RL, BITCODE_RL, Bit_Chain *, Dwg_Data *' failed at dwg2dxf: dec… |
CVE-2022-32554 | Critical | 9.8 | 2022-06-23 | Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FA releases, and Pure… |
CVE-2022-32553 | High | 8.8 | 2022-06-23 | Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FA releases, and Pure… |
CVE-2022-32552 | High | 8.8 | 2022-06-23 | Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FA releases, and Pure… |
CVE-2022-32536 | High | 8.8 | 2022-06-23 | The user access rights validation in the web server of the Bosch Ethernet switch PRA-ES8P2S with software version 1.01.05 was insufficient. This would allow a… |
CVE-2022-32535 | Medium | 4.8 | 2022-06-23 | The Bosch Ethernet switch PRA-ES8P2S with software version 1.01.05 runs its web server with root privilege. In combination with CVE-2022-23534 this could give… |
CVE-2022-32534 | High | 8.8 | 2022-06-23 | The Bosch Ethernet switch PRA-ES8P2S with software version 1.01.05 and earlier was found to be vulnerable to command injection through its diagnostics web inte… |
CVE-2022-32131 | Medium | 6.1 | 2022-06-23 | 74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /index/notice/show. |
CVE-2022-32130 | Medium | 6.1 | 2022-06-23 | 74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company/down_resume/total/nature. |
CVE-2022-32129 | Medium | 6.1 | 2022-06-23 | 74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company/account/safety/trade. |
CVE-2022-32128 | Medium | 6.1 | 2022-06-23 | 74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company/service/increment/add/im. |
CVE-2022-32127 | Medium | 6.1 | 2022-06-23 | 74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company/view_be_browsed/total. |
CVE-2022-32126 | Medium | 6.1 | 2022-06-23 | 74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company. |
CVE-2022-32125 | Medium | 6.1 | 2022-06-23 | 74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /job. |
CVE-2022-32124 | Medium | 6.1 | 2022-06-23 | 74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component /index/jobfairol/show/. |
CVE-2022-31787 | Critical | 9.8 | 2022-06-23 | IdeaTMS 2022 is vulnerable to SQL Injection via the PATH_INFO |
CVE-2022-31395 | High | 8.8 | 2022-06-23 | Algo Communication Products Ltd. 8373 IP Zone Paging Adapter Firmware 1.7.6 allows attackers to perform a directory traversal via a web request sent to /fm-dat… |
CVE-2022-31362 | High | 8.8 | 2022-06-23 | Docebo Community Edition v4.0.5 and below was discovered to contain an arbitrary file upload vulnerability. NOTE: This vulnerability only affects products that… |
CVE-2022-31361 | Critical | 9.8 | 2022-06-23 | Docebo Community Edition v4.0.5 and below was discovered to contain a SQL injection vulnerability. NOTE: This vulnerability only affects products that are no l… |
CVE-2022-29526 | Medium | 5.3 | 2022-06-23 | Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorr… |
CVE-2022-22980 | Critical | 9.8 | 2022-06-23 | A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain… |
CVE-2022-22967 | High | 8.8 | 2022-06-23 | An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked accounts, which allows a previously author… |
CVE-2022-2175 | High | 7.8 | 2022-06-23 | Buffer Over-read in GitHub repository vim/vim prior to 8.2. |
CVE-2022-34305 | Medium | 6.1 | 2022-06-23 | In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web appli… |
CVE-2022-31009 | Medium | 5.7 | 2022-06-23 | wire-ios is an iOS client for the Wire secure messaging application. Invalid accent colors of Wire communication partners may render the iOS Wire Client partia… |
CVE-2022-32159 | | 2022-06-22 | In openlibrary versions deploy-2016-07-0 through deploy-2021-12-22 are vulnerable to Stored XSS. | |
CVE-2022-23081 | | 2022-06-22 | In openlibrary versions deploy-2016-07-0 through deploy-2021-12-22 are vulnerable to Reflected XSS. | |
CVE-2022-23080 | Medium | 5.0 | 2022-06-22 | In directus versions v9.0.0-beta.2 through 9.6.0 are vulnerable to server-side request forgery (SSRF) in the media upload functionality which allows a low priv… |
CVE-2022-32549 | Medium | 5.3 | 2022-06-22 | Apache Sling Commons Log <= 5.4.0 and Apache Sling API <= 2.25.0 are vulnerable to log injection. The ability to forge logs may allow an attacker to cover trac… |
CVE-2022-20651 | Medium | 5.5 | 2022-06-22 | A vulnerability in the logging component of Cisco Adaptive Security Device Manager (ASDM) could allow an authenticated, local attacker to view sensitive inform… |
CVE-2022-23079 | | 2022-06-22 | In motor-admin versions 0.0.1 through 0.2.56 are vulnerable to host header injection in the password reset functionality where malicious actor can send fake pa… | |
CVE-2022-2174 | Medium | 6.1 | 2022-06-22 | Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.18. |
CVE-2022-23078 | | 2022-06-22 | In habitica versions v4.119.0 through v4.232.2 are vulnerable to open redirect via the login page. | |
CVE-2022-23077 | Medium | 6.1 | 2022-06-22 | In habitica versions v4.119.0 through v4.232.2 are vulnerable to DOM XSS via the login page. |
CVE-2022-31248 | Medium | 5.3 | 2022-06-22 | A Observable Response Discrepancy vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to discover valid… |
CVE-2022-21952 | High | 7.5 | 2022-06-22 | A Missing Authentication for Critical Function vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to e… |
CVE-2022-23055 | | 2022-06-22 | In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker can send… | |
CVE-2022-23058 | | 2022-06-22 | ERPNext in versions v12.0.9-v13.0.3 are affected by a stored XSS vulnerability that allows low privileged users to store malicious scripts in the ‘username’ fi… | |
CVE-2022-23057 | Medium | 5.4 | 2022-06-22 | In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting (XSS), due to user input not being validated properly. A low privileged att… |
CVE-2022-23056 | | 2022-06-22 | In ERPNext, versions v13.0.0-beta.13 through v13.30.0 are vulnerable to Stored XSS at the Patient History page which allows a low privilege user to conduct an… | |
CVE-2022-31095 | Medium | 4.3 | 2022-06-21 | discourse-chat is a chat plugin for the Discourse application. Versions prior to 0.4 are vulnerable to an exposure of sensitive information, where an attacker… |
CVE-2022-34008 | High | 7.8 | 2022-06-21 | Comodo Antivirus 12.2.2.8012 has a quarantine flaw that allows privilege escalation. To escalate privilege, a low-privileged attacker can use an NTFS directory… |
CVE-2022-33995 | High | 7.5 | 2022-06-21 | A path traversal issue in entry attachments in Devolutions Remote Desktop Manager before 2022.2 allows attackers to create or overwrite files in an arbitrary l… |
CVE-2022-32974 | Medium | 6.5 | 2022-06-21 | An authenticated attacker could read arbitrary files from the underlying operating system of the scanner using a custom crafted compliance audit file without p… |
CVE-2022-32973 | High | 8.8 | 2022-06-21 | An authenticated attacker could create an audit file that bypasses PowerShell cmdlet checks and executes commands with administrator privileges. |