2022 CVEs (page 190)
Page 190 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-25852 | High | 7.5 | 2022-06-17 | All versions of package pg-native; all versions of package libpq are vulnerable to Denial of Service (DoS) when the addons attempt to cast the second argument… |
CVE-2022-25345 | High | 7.5 | 2022-06-17 | All versions of package @discordjs/opus are vulnerable to Denial of Service (DoS) when trying to encode using an encoder with zero channels, or a non-initializ… |
CVE-2022-22138 | High | 7.5 | 2022-06-17 | All versions of package fast-string-search are vulnerable to Denial of Service (DoS) when computations are incorrect for non-string inputs. One can cause the V… |
CVE-2022-21213 | High | 7.5 | 2022-06-17 | This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn mixes objects into… |
CVE-2022-31941 | Critical | 9.8 | 2022-06-17 | Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via \rdms\admin?page=user\manage_user&id=. |
CVE-2022-31083 | High | 8.6 | 2022-06-17 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 4.10.11 and 5.2.2, the certificate in… |
CVE-2022-29496 | Critical | 9.8 | 2022-06-17 | A stack-based buffer overflow vulnerability exists in the BlynkConsole.h runCommand functionality of Blynk -Library v1.0.1. A specially-crafted network request… |
CVE-2022-21806 | Critical | 9.8 | 2022-06-17 | A use-after-free vulnerability exists in the mips_collector appsrv_server functionality of Anker Eufy Homebase 2 2.1.8.5h. A specially-crafted set of network p… |
CVE-2022-21184 | Medium | 5.9 | 2022-06-17 | An information disclosure vulnerability exists in the License registration functionality of Bachmann Visutec GmbH Atvise 3.5.4, 3.6 and 3.7. A plaintext HTTP r… |
CVE-2022-30422 | Critical | 9.8 | 2022-06-17 | Proietti Tech srl Planet Time Enterprise 4.2.0.1,4.2.0.0,4.1.0.0,4.0.0.0,3.3.1.0,3.3.0.0 is vulnerable to Remote code execution via the Viewstate parameter. |
CVE-2022-32444 | Medium | 6.1 | 2022-06-17 | An issue was discovered in u5cms verion 8.3.5 There is a URL redirection vulnerability that can cause a user's browser to be redirected to another site via /lo… |
CVE-2022-32442 | Medium | 6.1 | 2022-06-17 | u5cms version 8.3.5 is vulnerable to Cross Site Scripting (XSS). When a user accesses the default home page if the parameter passed in is http://127.0.0.1/? "O… |
CVE-2022-30607 | Medium | 6.5 | 2022-06-17 | IBM Robotic Process Automation 20.10.0, 20.12.5, 21.0.0, 21.0.1, and 21.0.2 contains a vulnerability that could allow a user to obtain sensitive information du… |
CVE-2022-22485 | Critical | 9.8 | 2022-06-17 | In some cases, an unsuccessful attempt to log into IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.14.000 does not cause the administrator's inval… |
CVE-2022-31357 | Critical | 9.8 | 2022-06-17 | Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/admin/inventory/index.php?view=edit&id=. |
CVE-2022-31356 | Critical | 9.8 | 2022-06-17 | Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/admin/store/index.php?view=edit&id=. |
CVE-2022-31355 | Critical | 9.8 | 2022-06-17 | Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/index.php?q=category&search=. |
CVE-2022-31246 | Medium | 5.5 | 2022-06-17 | paymentrequest.py in Electrum before 4.2.2 allows a file:// URL in the r parameter of a payment request (e.g., within QR code data). On Windows, this can lead… |
CVE-2022-33915 | High | 7.0 | 2022-06-17 | Versions of the Amazon AWS Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.3.5 are affected by a race condition that could lead to a local… |
CVE-2022-33912 | High | 7.8 | 2022-06-17 | A permission issue affects users that deployed the shipped version of the Checkmk Debian package. Packages created by the agent bakery (enterprise editions onl… |
CVE-2022-32276 | High | 7.5 | 2022-06-17 | Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/*?orgId=0 URI. NOTE: the vendor considers this a UI bug, not a vulnerability |
CVE-2022-31784 | Critical | 9.8 | 2022-06-17 | A vulnerability in the management interface of MiVoice Business through 9.3 PR1 and MiVoice Business Express through 8.0 SP3 PR3 could allow an unauthenticated… |
CVE-2022-31296 | Critical | 9.8 | 2022-06-17 | Online Discussion Forum Site 1 was discovered to contain a blind SQL injection vulnerability via the component /odfs/posts/view_post.php. |
CVE-2022-2113 | Medium | 5.4 | 2022-06-17 | Cross-site Scripting (XSS) - Stored in GitHub repository inventree/inventree prior to 0.7.2. |
CVE-2022-2112 | High | 8.8 | 2022-06-17 | Improper Neutralization of Formula Elements in a CSV File in GitHub repository inventree/inventree prior to 0.7.2. |
CVE-2022-2111 | High | 8.8 | 2022-06-17 | Unrestricted Upload of File with Dangerous Type in GitHub repository inventree/inventree prior to 0.7.2. |
CVE-2022-30329 | Critical | 9.8 | 2022-06-16 | An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. An OS injection vulnerability exists within the web interface, allowing an attacker with v… |
CVE-2022-30328 | Medium | 6.5 | 2022-06-16 | An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. The username and password setup for the web interface does not require entering the existi… |
CVE-2022-30327 | Medium | 6.5 | 2022-06-16 | An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. The web interface is vulnerable to CSRF. An attacker can change the pre-shared key of the… |
CVE-2022-30326 | Medium | 5.4 | 2022-06-16 | An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. The network pre-shared key field on the web interface is vulnerable to XSS. An attacker ca… |
CVE-2022-30325 | High | 8.8 | 2022-06-16 | An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. The default pre-shared key for the Wi-Fi networks is the same for every router except for… |
CVE-2022-33756 | High | 7.5 | 2022-06-16 | CA Automic Automation 12.2 and 12.3 contain an entropy weakness vulnerability in the Automic AutomationEngine that could allow a remote attacker to potentially… |
CVE-2022-33755 | Medium | 5.3 | 2022-06-16 | CA Automic Automation 12.2 and 12.3 contain an insecure input handling vulnerability in the Automic Agent that could allow a remote attacker to potentially enu… |
CVE-2022-33754 | Critical | 9.8 | 2022-06-16 | CA Automic Automation 12.2 and 12.3 contain an insufficient input validation vulnerability in the Automic agent that could allow a remote attacker to potential… |
CVE-2022-33753 | High | 8.8 | 2022-06-16 | CA Automic Automation 12.2 and 12.3 contain an insecure file creation and handling vulnerability in the Automic agent that could allow a user to potentially el… |
CVE-2022-33752 | Critical | 9.8 | 2022-06-16 | CA Automic Automation 12.2 and 12.3 contain an insufficient input validation vulnerability in the Automic agent that could allow a remote attacker to potential… |
CVE-2022-33751 | High | 7.5 | 2022-06-16 | CA Automic Automation 12.2 and 12.3 contain an insecure memory handling vulnerability in the Automic agent that could allow a remote attacker to potentially ac… |
CVE-2022-33750 | Critical | 9.8 | 2022-06-16 | CA Automic Automation 12.2 and 12.3 contain an authentication error vulnerability in the Automic agent that could allow a remote attacker to potentially execut… |
CVE-2022-33739 | High | 7.5 | 2022-06-16 | CA Clarity 15.8 and below and 15.9.0 contain an insecure XML parsing vulnerability that could allow a remote attacker to potentially view the contents of any f… |
CVE-2022-31299 | Medium | 6.1 | 2022-06-16 | Haraj v3.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the User Upgrade Form. |
CVE-2022-26173 | High | 8.8 | 2022-06-16 | JForum v2.8.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via http://target_host:port/jforum-2.8.0/jforum.page, which allows attackers to arb… |
CVE-2022-31295 | High | 7.5 | 2022-06-16 | An issue in the delete_post() function of Online Discussion Forum Site 1 allows unauthenticated attackers to arbitrarily delete posts. |
CVE-2022-31464 | High | 7.8 | 2022-06-16 | Insecure permissions configuration in Adaware Protect v1.2.439.4251 allows attackers to escalate privileges via changing the service binary path. |
CVE-2022-27512 | Medium | 5.3 | 2022-06-16 | Temporary disruption of the ADM license service. The impact of this includes preventing new licenses from being issued or renewed by Citrix ADM. |
CVE-2022-27511 | High | 8.1 | 2022-06-16 | Corruption of the system by a remote, unauthenticated user. The impact of this can include the reset of the administrator password at the next device reboot, a… |
CVE-2022-24562 | Critical | 9.8 | 2022-06-16 | In IOBit IOTransfer 4.3.1.1561, an unauthenticated attacker can send GET and POST requests to Airserv and gain arbitrary read/write access to the entire file-s… |
CVE-2022-32547 | High | 7.8 | 2022-06-16 | In ImageMagick, there is load of misaligned address for type 'double', which requires 8 byte alignment and for type 'float', which requires 4 byte alignment at… |
CVE-2022-32546 | High | 7.8 | 2022-06-16 | A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned long' at coders/pcl.c, when crafted or untrust… |
CVE-2022-32545 | High | 7.8 | 2022-06-16 | A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned char' at coders/psd.c, when crafted or untrust… |
CVE-2022-31301 | Medium | 5.4 | 2022-06-16 | Haraj v3.7 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Post Ads component. |
CVE-2022-31294 | Medium | 6.5 | 2022-06-16 | An issue in the save_users() function of Online Discussion Forum Site 1 allows unauthenticated attackers to arbitrarily create or update user accounts. |
CVE-2022-30664 | High | 7.8 | 2022-06-16 | Adobe Animate version 22.0.5 (and earlier) is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of… |
CVE-2022-30657 | High | 7.8 | 2022-06-16 | Adobe InCopy versions 17.2 (and earlier) and 16.4.1 (and earlier) are affected by a Use-After-Free vulnerability that could result in arbitrary code execution… |
CVE-2022-30656 | High | 7.8 | 2022-06-16 | Adobe InCopy versions 17.2 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code exec… |
CVE-2022-30655 | High | 7.8 | 2022-06-16 | Adobe InCopy versions 17.2 (and earlier) and 16.4.1 (and earlier) are affected by a Use-After-Free vulnerability that could result in arbitrary code execution… |
CVE-2022-30654 | High | 7.8 | 2022-06-16 | Adobe InCopy versions 17.2 (and earlier) and 16.4.1 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary cod… |
CVE-2022-30653 | High | 7.8 | 2022-06-16 | Adobe InCopy versions 17.2 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code exec… |
CVE-2022-30652 | High | 7.8 | 2022-06-16 | Adobe InCopy versions 17.2 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code exec… |
CVE-2022-30651 | High | 7.8 | 2022-06-16 | Adobe InCopy versions 17.2 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could… |
CVE-2022-30650 | High | 7.8 | 2022-06-16 | Adobe InCopy versions 17.2 (and earlier) and 16.4.1 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary cod… |
CVE-2022-2085 | Medium | 5.5 | 2022-06-16 | A NULL pointer dereference vulnerability was found in Ghostscript, which occurs when it tries to render a large number of bits in memory. When allocating a buf… |
CVE-2022-29866 | High | 7.5 | 2022-06-16 | OPC UA .NET Standard Stack 1.04.368 allows a remote attacker to exhaust the memory resources of a server via a crafted request that triggers Uncontrolled Resou… |
CVE-2022-29864 | High | 7.5 | 2022-06-16 | OPC UA .NET Standard Stack 1.04.368 allows a remote attacker to cause a server to crash via a large number of messages that trigger Uncontrolled Resource Consu… |
CVE-2022-29863 | High | 7.5 | 2022-06-16 | OPC UA .NET Standard Stack 1.04.368 allows remote attacker to cause a crash via a crafted message that triggers excessive memory allocation. |
CVE-2022-31384 | Critical | 9.8 | 2022-06-16 | Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the fullname parameter in add-directory.php. |
CVE-2022-31383 | Critical | 9.8 | 2022-06-16 | Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in view-directory.php. |
CVE-2022-31382 | Critical | 9.8 | 2022-06-16 | Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the searchdata parameter in search-dirctory.php. |
CVE-2022-31298 | Medium | 5.4 | 2022-06-16 | A cross-site scripting vulnerability in the ads comment section of Haraj v3.7 allows attackers to execute arbitrary web scripts or HTML via a crafted POST requ… |
CVE-2022-30670 | High | 8.8 | 2022-06-16 | RoboHelp Server earlier versions than RHS 11 Update 3 are affected by an Improper Authorization vulnerability which could lead to privilege escalation. An auth… |
CVE-2022-30665 | High | 7.8 | 2022-06-16 | Adobe InDesign versions 17.2.1 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code… |
CVE-2022-30663 | High | 7.8 | 2022-06-16 | Adobe InDesign versions 17.2.1 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code… |
CVE-2022-30662 | High | 7.8 | 2022-06-16 | Adobe InDesign versions 17.2.1 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code… |
CVE-2022-30661 | High | 7.8 | 2022-06-16 | Adobe InDesign versions 17.2.1 (and earlier) and 16.4.1 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary… |
CVE-2022-30660 | High | 7.8 | 2022-06-16 | Adobe InDesign versions 17.2.1 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code… |
CVE-2022-30659 | High | 7.8 | 2022-06-16 | Adobe InDesign versions 17.2.1 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code… |
CVE-2022-30658 | High | 7.8 | 2022-06-16 | Adobe InDesign versions 17.2.1 (and earlier) and 16.4.1 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary… |
CVE-2022-29865 | High | 7.5 | 2022-06-16 | OPC UA .NET Standard Stack allows a remote attacker to bypass the application authentication check via crafted fake credentials. |
CVE-2022-29862 | High | 7.5 | 2022-06-16 | An infinite loop in OPC UA .NET Standard Stack 1.04.368 allows a remote attackers to cause the application to hang via a crafted message. |
CVE-2022-1642 | High | 7.5 | 2022-06-16 | A program using swift-corelibs-foundation is vulnerable to a denial of service attack caused by a potentially malicious source producing a JSON document contai… |
CVE-2022-31914 | Medium | 5.4 | 2022-06-16 | Zoo Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via zms/admin/public_html/save_animal?an_id=24. |
CVE-2022-31291 | High | 7.5 | 2022-06-16 | An issue in dlt_config_file_parser.c of dlt-daemon v2.18.8 allows attackers to cause a double free via crafted TCP packets. |
CVE-2022-27532 | High | 7.8 | 2022-06-16 | A maliciously crafted TIF file in Autodesk 3ds Max 2022 and 2021 can be used to write beyond the allocated buffer while parsing TIF files. This vulnerability i… |
CVE-2022-27531 | High | 7.8 | 2022-06-16 | A maliciously crafted TIF file can be forced to read beyond allocated boundaries in Autodesk 3ds Max 2022, and 2021 when parsing the TIF files. This vulnerabil… |
CVE-2022-22953 | Medium | 6.5 | 2022-06-16 | VMware HCX update addresses an information disclosure vulnerability. A malicious actor with network user access to the VMware HCX appliance may be able to gain… |
CVE-2022-31913 | Medium | 4.8 | 2022-06-16 | Online Discussion Forum Site v1.0 is vulnerable to Cross Site Scripting (XSS) via /odfs/classes/Master.php?f=save_category, name. |
CVE-2022-31912 | High | 7.2 | 2022-06-16 | Online Tutor Portal Site v1.0 is vulnerable to SQL Injection via /otps/classes/Master.php?f=delete_team. |
CVE-2022-31911 | High | 7.2 | 2022-06-16 | Online Discussion Forum Site v1.0 is vulnerable to SQL Injection via /odfs/classes/Master.php?f=delete_team. |
CVE-2022-31910 | Medium | 4.8 | 2022-06-16 | Online Tutor Portal Site v1.0 is vulnerable to Cross Site Scripting (XSS). via /otps/classes/Master.php. |
CVE-2022-31908 | High | 7.2 | 2022-06-16 | Student Registration and Fee Payment System v1.0 is vulnerable to SQL Injection via /scms/student.php. |
CVE-2022-31906 | Medium | 4.8 | 2022-06-16 | Online Fire Reporting System v1.0 is vulnerable to Cross Site Scripting (XSS) via /ofrs/classes/Master.php. |
CVE-2022-31849 | High | 8.8 | 2022-06-16 | MERCURY MIPC451-4 1.0.22 Build 220105 Rel.55642n was discovered to contain a remote code execution (RCE) vulnerability which is exploitable via a crafted POST… |
CVE-2022-31300 | Medium | 5.4 | 2022-06-16 | A cross-site scripting vulnerability in the DM Section component of Haraj v3.7 allows attackers to execute arbitrary web scripts or HTML via a crafted POST req… |
CVE-2022-31277 | High | 8.8 | 2022-06-16 | Xiaomi Lamp 1 v2.0.4_0066 was discovered to be vulnerable to replay attacks. This allows attackers to to bypass the expected access restrictions and gain contr… |
CVE-2022-30023 | High | 8.8 | 2022-06-16 | Tenda ONT GPON AC1200 Dual band WiFi HG9 v1.0.1 is vulnerable to Command Injection via the Ping function. |
CVE-2022-31372 | High | 7.5 | 2022-06-16 | Wiris Mathtype v7.28.0 was discovered to contain a path traversal vulnerability in the resourceFile parameter. This vulnerability is exploited via a crafted re… |
CVE-2022-2098 | Critical | 9.8 | 2022-06-16 | Weak Password Requirements in GitHub repository kromitgmbh/titra prior to 0.78.1. |
CVE-2022-31626 | High | 7.5 | 2022-06-16 | In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension with mysqlnd driver, if the third party is allowed to s… |
CVE-2022-31625 | High | 8.1 | 2022-06-16 | In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the para… |
CVE-2022-30549 | High | 7.8 | 2022-06-16 | Out-of-bounds read vulnerability exists in V-Server v4.0.11.0 and earlier and V-Server Lite v4.0.13.0 and earlier, which may allow an attacker to obtain inform… |
CVE-2022-30546 | High | 7.8 | 2022-06-16 | Out-of-bounds read vulnerability exists in the simulator module contained in the graphic editor 'V-SFT' versions prior to v6.1.6.0, which may allow an attacker… |