2022 CVEs (page 188)
Page 188 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-34328 | Medium | 6.1 | 2022-06-23 | PMB 7.3.10 allows reflected XSS via the id parameter in an lvl=author_see request to index.php. |
CVE-2022-34300 | High | 8.8 | 2022-06-23 | In tinyexr 1.0.1, there is a heap-based buffer over-read in tinyexr::DecodePixelData. |
CVE-2022-34299 | High | 8.1 | 2022-06-23 | There is a heap-based buffer over-read in libdwarf 0.4.0. This issue is related to dwarf_global_formref_b. |
CVE-2022-34298 | Medium | 5.3 | 2022-06-23 | The NT auth module in OpenAM before 14.6.6 allows a "replace Samba username attack." |
CVE-2022-34296 | High | 7.5 | 2022-06-23 | In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request. |
CVE-2022-34295 | Medium | 6.5 | 2022-06-23 | totd before 1.5.3 does not properly randomize mesg IDs. |
CVE-2022-34213 | Medium | 6.5 | 2022-06-23 | Jenkins Squash TM Publisher (Squash4Jenkins) Plugin 1.0.0 and earlier stores passwords unencrypted in its global configuration file on the Jenkins controller w… |
CVE-2022-34212 | Medium | 5.7 | 2022-06-23 | A missing permission check in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST request t… |
CVE-2022-34211 | Medium | 6.5 | 2022-06-23 | A cross-site request forgery (CSRF) vulnerability in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers to send an HTTP POST request to an a… |
CVE-2022-34210 | Medium | 6.5 | 2022-06-23 | A missing permission check in Jenkins ThreadFix Plugin 1.5.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL. |
CVE-2022-34209 | Medium | 6.5 | 2022-06-23 | A cross-site request forgery (CSRF) vulnerability in Jenkins ThreadFix Plugin 1.5.4 and earlier allows attackers to connect to an attacker-specified URL. |
CVE-2022-34208 | Medium | 4.3 | 2022-06-23 | A missing permission check in Jenkins Beaker builder Plugin 1.10 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified… |
CVE-2022-34207 | Medium | 6.5 | 2022-06-23 | A cross-site request forgery (CSRF) vulnerability in Jenkins Beaker builder Plugin 1.10 and earlier allows attackers to connect to an attacker-specified URL. |
CVE-2022-34206 | Medium | 4.3 | 2022-06-23 | A missing permission check in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers with Overall/Read permission to send HTTP POST requests to… |
CVE-2022-34205 | Medium | 6.5 | 2022-06-23 | A cross-site request forgery (CSRF) vulnerability in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers to send HTTP POST requests to an att… |
CVE-2022-34204 | Medium | 4.3 | 2022-06-23 | A missing permission check in Jenkins EasyQA Plugin 1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP serv… |
CVE-2022-34203 | High | 8.8 | 2022-06-23 | A cross-site request forgery (CSRF) vulnerability in Jenkins EasyQA Plugin 1.0 and earlier allows attackers to connect to an attacker-specified HTTP server. |
CVE-2022-34202 | Medium | 6.5 | 2022-06-23 | Jenkins EasyQA Plugin 1.0 and earlier stores user passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by… |
CVE-2022-34201 | Medium | 6.5 | 2022-06-23 | A missing permission check in Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier allows attackers with Overall/Read permission to connect to an attacker… |
CVE-2022-34200 | High | 8.8 | 2022-06-23 | A cross-site request forgery (CSRF) vulnerability in Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier allows attackers to connect to an attacker-speci… |
CVE-2022-34199 | Medium | 6.5 | 2022-06-23 | Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be view… |
CVE-2022-34198 | Medium | 5.4 | 2022-06-23 | Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier does not escape the name and description of Stash Branch parameters on views displaying parameters, res… |
CVE-2022-34197 | Medium | 5.4 | 2022-06-23 | Jenkins Sauce OnDemand Plugin 1.204 and earlier does not escape the name and description of Sauce Labs Browsers parameters on views displaying parameters, resu… |
CVE-2022-34196 | Medium | 5.4 | 2022-06-23 | Jenkins REST List Parameter Plugin 1.5.2 and earlier does not escape the name and description of REST list parameters on views displaying parameters, resulting… |
CVE-2022-34195 | Medium | 5.4 | 2022-06-23 | Jenkins Repository Connector Plugin 2.2.0 and earlier does not escape the name and description of Maven Repository Artifact parameters on views displaying para… |
CVE-2022-34194 | Medium | 5.4 | 2022-06-23 | Jenkins Readonly Parameter Plugin 1.0.0 and earlier does not escape the name and description of Readonly String and Readonly Text parameters on views displayin… |
CVE-2022-34193 | Medium | 5.4 | 2022-06-23 | Jenkins Package Version Plugin 1.0.1 and earlier does not escape the name of Package version parameters on views displaying parameters, resulting in a stored c… |
CVE-2022-34192 | Medium | 5.4 | 2022-06-23 | Jenkins ontrack Jenkins Plugin 4.0.0 and earlier does not escape the name of Ontrack: Multi Parameter choice, Ontrack: Parameter choice, and Ontrack: SinglePar… |
CVE-2022-34191 | Medium | 5.4 | 2022-06-23 | Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.77 and earlier does not escape the name of NetStorm Test parameters on views displaying parameters… |
CVE-2022-34190 | Medium | 5.4 | 2022-06-23 | Jenkins Maven Metadata Plugin for Jenkins CI server Plugin 2.1 and earlier does not escape the name and description of List maven artifact versions parameters… |
CVE-2022-34189 | Medium | 5.4 | 2022-06-23 | Jenkins Image Tag Parameter Plugin 1.10 and earlier does not escape the name and description of Image Tag parameters on views displaying parameters, resulting… |
CVE-2022-34188 | Medium | 5.4 | 2022-06-23 | Jenkins Hidden Parameter Plugin 0.0.4 and earlier does not escape the name and description of Hidden Parameter parameters on views displaying parameters, resul… |
CVE-2022-34187 | Medium | 5.4 | 2022-06-23 | Jenkins Filesystem List Parameter Plugin 0.0.7 and earlier does not escape the name and description of File system objects list parameters on views displaying… |
CVE-2022-34186 | Medium | 5.4 | 2022-06-23 | Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape the name and description of Moded Extended Choice parameters on views displa… |
CVE-2022-34185 | Medium | 5.4 | 2022-06-23 | Jenkins Date Parameter Plugin 0.0.4 and earlier does not escape the name and description of Date parameters on views displaying parameters, resulting in a stor… |
CVE-2022-34184 | Medium | 5.4 | 2022-06-23 | Jenkins CRX Content Package Deployer Plugin 1.9 and earlier does not escape the name and description of CRX Content Package Choice parameters on views displayi… |
CVE-2022-34183 | Medium | 5.4 | 2022-06-23 | Jenkins Agent Server Parameter Plugin 1.1 and earlier does not escape the name and description of Agent Server parameters on views displaying parameters, resul… |
CVE-2022-34182 | Medium | 6.1 | 2022-06-23 | Jenkins Nested View Plugin 1.20 through 1.25 (both inclusive) does not escape search parameters, resulting in a reflected cross-site scripting (XSS) vulnerabil… |
CVE-2022-34181 | Critical | 9.1 | 2022-06-23 | Jenkins xUnit Plugin 3.0.8 and earlier implements an agent-to-controller message that creates a user-specified directory if it doesn't exist, and parsing files… |
CVE-2022-34180 | High | 7.5 | 2022-06-23 | Jenkins Embeddable Build Status Plugin 2.0.3 and earlier does not correctly perform the ViewStatus permission check in the HTTP endpoint it provides for "unpro… |
CVE-2022-34179 | High | 7.5 | 2022-06-23 | Jenkins Embeddable Build Status Plugin 2.0.3 and earlier allows specifying a `style` query parameter that is used to choose a different SVG image style without… |
CVE-2022-34178 | Medium | 6.1 | 2022-06-23 | Jenkins Embeddable Build Status Plugin 2.0.3 allows specifying a 'link' query parameter that build status badges will link to, without restricting possible val… |
CVE-2022-34177 | High | 7.5 | 2022-06-23 | Jenkins Pipeline: Input Step Plugin 448.v37cea_9a_10a_70 and earlier archives files uploaded for `file` parameters for Pipeline `input` steps on the controller… |
CVE-2022-34176 | Medium | 5.4 | 2022-06-23 | Jenkins JUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results, resulting in a stored cross-site scripting (XSS) vulnerabi… |
CVE-2022-34175 | High | 7.5 | 2022-06-23 | Jenkins 2.335 through 2.355 (both inclusive) allows attackers in some cases to bypass a protection mechanism, thereby directly accessing some view fragments co… |
CVE-2022-34174 | High | 7.5 | 2022-06-23 | In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an… |
CVE-2022-34173 | Medium | 5.4 | 2022-06-23 | In Jenkins 2.340 through 2.355 (both inclusive) the tooltip of the build button in list views supports HTML without escaping the job display name, resulting in… |
CVE-2022-34172 | Medium | 5.4 | 2022-06-23 | In Jenkins 2.340 through 2.355 (both inclusive) symbol-based icons unescape previously escaped values of 'tooltip' parameters, resulting in a cross-site script… |
CVE-2022-34171 | Medium | 5.4 | 2022-06-23 | In Jenkins 2.321 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the HTML output generated for new symbol-based SVG icons i… |
CVE-2022-34170 | Medium | 5.4 | 2022-06-23 | In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the feature name that is par… |
CVE-2022-34013 | Medium | 4.3 | 2022-06-23 | OneBlog v2.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Logo parameter under the Link module. |
CVE-2022-34012 | Medium | 6.5 | 2022-06-23 | Insecure permissions in OneBlog v2.3.4 allows low-level administrators to reset the passwords of high-level administrators who hold greater privileges. |
CVE-2022-34011 | Medium | 4.3 | 2022-06-23 | OneBlog v2.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the parameter entryUrls. |
CVE-2022-33127 | Critical | 9.8 | 2022-06-23 | The function that calls the diff tool in Diffy 3.4.1 does not properly handle double quotes in a filename when run in a windows environment. This allows attack… |
CVE-2022-33124 | Medium | 5.5 | 2022-06-23 | AIOHTTP 3.8.1 can report a "ValueError: Invalid IPv6 URL" outcome, which can lead to a Denial of Service (DoS). NOTE: multiple third parties dispute this issue… |
CVE-2022-33114 | High | 7.2 | 2022-06-23 | Jfinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via the attrVal parameter at /jfinal_cms/system/dict/list. |
CVE-2022-33113 | Medium | 5.4 | 2022-06-23 | Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the keyword text field under the publish blog m… |
CVE-2022-33105 | High | 7.5 | 2022-06-23 | Redis v7.0 was discovered to contain a memory leak via the component streamGetEdgeID. |
CVE-2022-33097 | High | 7.5 | 2022-06-23 | 74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/campus/campus_job. |
CVE-2022-33096 | High | 7.5 | 2022-06-23 | 74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/resume/index. |
CVE-2022-33095 | High | 7.5 | 2022-06-23 | 74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/jobfairol/resumelist. |
CVE-2022-33094 | High | 7.5 | 2022-06-23 | 74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/job/map. |
CVE-2022-33093 | High | 7.5 | 2022-06-23 | 74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the key parameter at /freelance/resume_list. |
CVE-2022-33092 | High | 7.5 | 2022-06-23 | 74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/job/index. |
CVE-2022-33070 | Medium | 5.5 | 2022-06-23 | Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability… |
CVE-2022-33069 | Medium | 5.5 | 2022-06-23 | Ethereum Solidity v0.8.14 contains an assertion failure via SMTEncoder::indexOrMemberAssignment() at SMTEncoder.cpp. |
CVE-2022-33068 | Medium | 5.5 | 2022-06-23 | An integer overflow in the component hb-ot-shape-fallback.cc of Harfbuzz v4.3.0 allows attackers to cause a Denial of Service (DoS) via unspecified vectors. |
CVE-2022-33067 | Medium | 5.5 | 2022-06-23 | Lrzip v0.651 was discovered to contain multiple invalid arithmetic shifts via the functions get_magic in lrzip.c and Predictor::init in libzpaq/libzpaq.cpp. Th… |
CVE-2022-33034 | High | 7.8 | 2022-06-23 | LibreDWG v0.12.4.4608 was discovered to contain a stack overflow via the function copy_bytes at decode_r2007.c. |
CVE-2022-33033 | High | 7.8 | 2022-06-23 | LibreDWG v0.12.4.4608 was discovered to contain a double-free via the function dwg_read_file at dwg.c. |
CVE-2022-33032 | High | 7.8 | 2022-06-23 | LibreDWG v0.12.4.4608 was discovered to contain a heap-buffer-overflow via the function decode_preR13_section_hdr at decode_r11.c. |
CVE-2022-33028 | High | 7.8 | 2022-06-23 | LibreDWG v0.12.4.4608 was discovered to contain a heap buffer overflow via the function dwg_add_object at decode.c. |
CVE-2022-33027 | High | 7.8 | 2022-06-23 | LibreDWG v0.12.4.4608 was discovered to contain a heap-use-after-free via the function dwg_add_handleref at dwg.c. |
CVE-2022-33026 | High | 7.8 | 2022-06-23 | LibreDWG v0.12.4.4608 was discovered to contain a heap buffer overflow via the function bit_calc_CRC at bits.c. |
CVE-2022-33025 | High | 7.8 | 2022-06-23 | LibreDWG v0.12.4.4608 was discovered to contain a heap-use-after-free via the function decode_preR13_section at decode_r11.c. |
CVE-2022-33024 | High | 7.5 | 2022-06-23 | There is an Assertion `int decode_preR13_entities(BITCODE_RL, BITCODE_RL, unsigned int, BITCODE_RL, BITCODE_RL, Bit_Chain *, Dwg_Data *' failed at dwg2dxf: dec… |
CVE-2022-32554 | Critical | 9.8 | 2022-06-23 | Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FA releases, and Pure… |
CVE-2022-32553 | High | 8.8 | 2022-06-23 | Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FA releases, and Pure… |
CVE-2022-32552 | High | 8.8 | 2022-06-23 | Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FA releases, and Pure… |
CVE-2022-32536 | High | 8.8 | 2022-06-23 | The user access rights validation in the web server of the Bosch Ethernet switch PRA-ES8P2S with software version 1.01.05 was insufficient. This would allow a… |
CVE-2022-32535 | Medium | 4.8 | 2022-06-23 | The Bosch Ethernet switch PRA-ES8P2S with software version 1.01.05 runs its web server with root privilege. In combination with CVE-2022-23534 this could give… |
CVE-2022-32534 | High | 8.8 | 2022-06-23 | The Bosch Ethernet switch PRA-ES8P2S with software version 1.01.05 and earlier was found to be vulnerable to command injection through its diagnostics web inte… |
CVE-2022-32131 | Medium | 6.1 | 2022-06-23 | 74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /index/notice/show. |
CVE-2022-32130 | Medium | 6.1 | 2022-06-23 | 74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company/down_resume/total/nature. |
CVE-2022-32129 | Medium | 6.1 | 2022-06-23 | 74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company/account/safety/trade. |
CVE-2022-32128 | Medium | 6.1 | 2022-06-23 | 74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company/service/increment/add/im. |
CVE-2022-32127 | Medium | 6.1 | 2022-06-23 | 74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company/view_be_browsed/total. |
CVE-2022-32126 | Medium | 6.1 | 2022-06-23 | 74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company. |
CVE-2022-32125 | Medium | 6.1 | 2022-06-23 | 74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /job. |
CVE-2022-32124 | Medium | 6.1 | 2022-06-23 | 74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component /index/jobfairol/show/. |
CVE-2022-31787 | Critical | 9.8 | 2022-06-23 | IdeaTMS 2022 is vulnerable to SQL Injection via the PATH_INFO |
CVE-2022-31395 | High | 8.8 | 2022-06-23 | Algo Communication Products Ltd. 8373 IP Zone Paging Adapter Firmware 1.7.6 allows attackers to perform a directory traversal via a web request sent to /fm-dat… |
CVE-2022-31362 | High | 8.8 | 2022-06-23 | Docebo Community Edition v4.0.5 and below was discovered to contain an arbitrary file upload vulnerability. NOTE: This vulnerability only affects products that… |
CVE-2022-31361 | Critical | 9.8 | 2022-06-23 | Docebo Community Edition v4.0.5 and below was discovered to contain a SQL injection vulnerability. NOTE: This vulnerability only affects products that are no l… |
CVE-2022-29526 | Medium | 5.3 | 2022-06-23 | Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorr… |
CVE-2022-22980 | Critical | 9.8 | 2022-06-23 | A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain… |
CVE-2022-22967 | High | 8.8 | 2022-06-23 | An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked accounts, which allows a previously author… |
CVE-2022-2175 | High | 7.8 | 2022-06-23 | Buffer Over-read in GitHub repository vim/vim prior to 8.2. |
CVE-2022-34305 | Medium | 6.1 | 2022-06-23 | In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web appli… |
CVE-2022-31009 | Medium | 5.7 | 2022-06-23 | wire-ios is an iOS client for the Wire secure messaging application. Invalid accent colors of Wire communication partners may render the iOS Wire Client partia… |