2022 CVEs (page 190)
Page 190 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-21742 | Medium | 6.2 | 2022-06-20 | Realtek USB driver has a buffer overflow vulnerability due to insufficient parameter length verification in the API function. An unauthenticated LAN attacker c… |
CVE-2022-2023 | Critical | 9.8 | 2022-06-20 | Incorrect Use of Privileged APIs in GitHub repository polonel/trudesk prior to 1.2.4. |
CVE-2022-34006 | High | 7.8 | 2022-06-19 | An issue was discovered in TitanFTP (aka Titan FTP) NextGen before 1.2.1050. When installing, Microsoft SQL Express 2019 installs by default with an SQL instan… |
CVE-2022-34005 | Critical | 9.8 | 2022-06-19 | An issue was discovered in TitanFTP (aka Titan FTP) NextGen before 1.2.1050. There is Remote Code Execution due to a hardcoded password for the sa account on t… |
CVE-2022-34000 | Medium | 6.5 | 2022-06-19 | libjxl 0.6.1 has an assertion failure in LowMemoryRenderPipeline::Init() in render_pipeline/low_memory_render_pipeline.cc. |
CVE-2022-2129 | High | 7.8 | 2022-06-19 | Out-of-bounds Write in GitHub repository vim/vim prior to 8.2. |
CVE-2022-2126 | High | 7.8 | 2022-06-19 | Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. |
CVE-2022-2125 | High | 7.8 | 2022-06-19 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. |
CVE-2022-23071 | Medium | 6.5 | 2022-06-19 | In Recipes, versions 0.9.1 through 1.2.5 are vulnerable to Server Side Request Forgery (SSRF), in the “Import Recipe” functionality. When an attacker enters th… |
CVE-2022-2124 | High | 7.8 | 2022-06-19 | Buffer Over-read in GitHub repository vim/vim prior to 8.2. |
CVE-2022-33987 | Medium | 5.3 | 2022-06-18 | The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket. |
CVE-2022-33981 | Low | 3.3 | 2022-06-18 | drivers/block/floppy.c in the Linux kernel before 5.17.6 is vulnerable to a denial of service, because of a concurrency use-after-free flaw after deallocating… |
CVE-2022-21503 | Medium | 4.9 | 2022-06-17 | Vulnerability in the Oracle Cloud Infrastructure product of Oracle Cloud Services. Easily exploitable vulnerability allows high privileged attacker with networ… |
CVE-2022-31876 | Medium | 5.3 | 2022-06-17 | netgear wnap320 router WNAP320_V2.0.3_firmware is vulnerable to Incorrect Access Control via /recreate.php, which can leak all users cookies. |
CVE-2022-31875 | Medium | 6.1 | 2022-06-17 | Trendnet IP-110wn camera fw_tv-ip110wn_v2(1.2.2.68) has an xss vulnerability via the proname parameter in /admin/scheprofile.cgi |
CVE-2022-31874 | Critical | 9.8 | 2022-06-17 | ASUS RT-N53 3.0.0.4.376.3754 has a command injection vulnerability in the SystemCmd parameter of the apply.cgi interface. |
CVE-2022-31873 | Medium | 6.1 | 2022-06-17 | Trendnet IP-110wn camera fw_tv-ip110wn_v2(1.2.2.68) has an XSS vulnerability via the prefix parameter in /admin/general.cgi. |
CVE-2022-25872 | Medium | 5.3 | 2022-06-17 | All versions of package fast-string-search are vulnerable to Out-of-bounds Read due to incorrect memory freeing and length calculation for any non-string input… |
CVE-2022-25871 | Medium | 5.9 | 2022-06-17 | All versions of package querymen are vulnerable to Prototype Pollution if the parameters of exported function handler(type, name, fn) can be controlled by user… |
CVE-2022-25856 | High | 7.5 | 2022-06-17 | The package github.com/argoproj/argo-events/sensors/artifacts before 1.7.1 are vulnerable to Directory Traversal in the (g *GitArtifactReader).Read() API in gi… |
CVE-2022-25852 | High | 7.5 | 2022-06-17 | All versions of package pg-native; all versions of package libpq are vulnerable to Denial of Service (DoS) when the addons attempt to cast the second argument… |
CVE-2022-25345 | High | 7.5 | 2022-06-17 | All versions of package @discordjs/opus are vulnerable to Denial of Service (DoS) when trying to encode using an encoder with zero channels, or a non-initializ… |
CVE-2022-22138 | High | 7.5 | 2022-06-17 | All versions of package fast-string-search are vulnerable to Denial of Service (DoS) when computations are incorrect for non-string inputs. One can cause the V… |
CVE-2022-21213 | High | 7.5 | 2022-06-17 | This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn mixes objects into… |
CVE-2022-31941 | Critical | 9.8 | 2022-06-17 | Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via \rdms\admin?page=user\manage_user&id=. |
CVE-2022-31083 | High | 8.6 | 2022-06-17 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 4.10.11 and 5.2.2, the certificate in… |
CVE-2022-29496 | Critical | 9.8 | 2022-06-17 | A stack-based buffer overflow vulnerability exists in the BlynkConsole.h runCommand functionality of Blynk -Library v1.0.1. A specially-crafted network request… |
CVE-2022-21806 | Critical | 9.8 | 2022-06-17 | A use-after-free vulnerability exists in the mips_collector appsrv_server functionality of Anker Eufy Homebase 2 2.1.8.5h. A specially-crafted set of network p… |
CVE-2022-21184 | Medium | 5.9 | 2022-06-17 | An information disclosure vulnerability exists in the License registration functionality of Bachmann Visutec GmbH Atvise 3.5.4, 3.6 and 3.7. A plaintext HTTP r… |
CVE-2022-30422 | Critical | 9.8 | 2022-06-17 | Proietti Tech srl Planet Time Enterprise 4.2.0.1,4.2.0.0,4.1.0.0,4.0.0.0,3.3.1.0,3.3.0.0 is vulnerable to Remote code execution via the Viewstate parameter. |
CVE-2022-32444 | Medium | 6.1 | 2022-06-17 | An issue was discovered in u5cms verion 8.3.5 There is a URL redirection vulnerability that can cause a user's browser to be redirected to another site via /lo… |
CVE-2022-32442 | Medium | 6.1 | 2022-06-17 | u5cms version 8.3.5 is vulnerable to Cross Site Scripting (XSS). When a user accesses the default home page if the parameter passed in is http://127.0.0.1/? "O… |
CVE-2022-30607 | Medium | 6.5 | 2022-06-17 | IBM Robotic Process Automation 20.10.0, 20.12.5, 21.0.0, 21.0.1, and 21.0.2 contains a vulnerability that could allow a user to obtain sensitive information du… |
CVE-2022-22485 | Critical | 9.8 | 2022-06-17 | In some cases, an unsuccessful attempt to log into IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.14.000 does not cause the administrator's inval… |
CVE-2022-31357 | Critical | 9.8 | 2022-06-17 | Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/admin/inventory/index.php?view=edit&id=. |
CVE-2022-31356 | Critical | 9.8 | 2022-06-17 | Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/admin/store/index.php?view=edit&id=. |
CVE-2022-31355 | Critical | 9.8 | 2022-06-17 | Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/index.php?q=category&search=. |
CVE-2022-31246 | Medium | 5.5 | 2022-06-17 | paymentrequest.py in Electrum before 4.2.2 allows a file:// URL in the r parameter of a payment request (e.g., within QR code data). On Windows, this can lead… |
CVE-2022-33915 | High | 7.0 | 2022-06-17 | Versions of the Amazon AWS Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.3.5 are affected by a race condition that could lead to a local… |
CVE-2022-33912 | High | 7.8 | 2022-06-17 | A permission issue affects users that deployed the shipped version of the Checkmk Debian package. Packages created by the agent bakery (enterprise editions onl… |
CVE-2022-32276 | High | 7.5 | 2022-06-17 | Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/*?orgId=0 URI. NOTE: the vendor considers this a UI bug, not a vulnerability |
CVE-2022-31784 | Critical | 9.8 | 2022-06-17 | A vulnerability in the management interface of MiVoice Business through 9.3 PR1 and MiVoice Business Express through 8.0 SP3 PR3 could allow an unauthenticated… |
CVE-2022-31296 | Critical | 9.8 | 2022-06-17 | Online Discussion Forum Site 1 was discovered to contain a blind SQL injection vulnerability via the component /odfs/posts/view_post.php. |
CVE-2022-2113 | Medium | 5.4 | 2022-06-17 | Cross-site Scripting (XSS) - Stored in GitHub repository inventree/inventree prior to 0.7.2. |
CVE-2022-2112 | High | 8.8 | 2022-06-17 | Improper Neutralization of Formula Elements in a CSV File in GitHub repository inventree/inventree prior to 0.7.2. |
CVE-2022-2111 | High | 8.8 | 2022-06-17 | Unrestricted Upload of File with Dangerous Type in GitHub repository inventree/inventree prior to 0.7.2. |
CVE-2022-30329 | Critical | 9.8 | 2022-06-16 | An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. An OS injection vulnerability exists within the web interface, allowing an attacker with v… |
CVE-2022-30328 | Medium | 6.5 | 2022-06-16 | An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. The username and password setup for the web interface does not require entering the existi… |
CVE-2022-30327 | Medium | 6.5 | 2022-06-16 | An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. The web interface is vulnerable to CSRF. An attacker can change the pre-shared key of the… |
CVE-2022-30326 | Medium | 5.4 | 2022-06-16 | An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. The network pre-shared key field on the web interface is vulnerable to XSS. An attacker ca… |
CVE-2022-30325 | High | 8.8 | 2022-06-16 | An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. The default pre-shared key for the Wi-Fi networks is the same for every router except for… |
CVE-2022-33756 | High | 7.5 | 2022-06-16 | CA Automic Automation 12.2 and 12.3 contain an entropy weakness vulnerability in the Automic AutomationEngine that could allow a remote attacker to potentially… |
CVE-2022-33755 | Medium | 5.3 | 2022-06-16 | CA Automic Automation 12.2 and 12.3 contain an insecure input handling vulnerability in the Automic Agent that could allow a remote attacker to potentially enu… |
CVE-2022-33754 | Critical | 9.8 | 2022-06-16 | CA Automic Automation 12.2 and 12.3 contain an insufficient input validation vulnerability in the Automic agent that could allow a remote attacker to potential… |
CVE-2022-33753 | High | 8.8 | 2022-06-16 | CA Automic Automation 12.2 and 12.3 contain an insecure file creation and handling vulnerability in the Automic agent that could allow a user to potentially el… |
CVE-2022-33752 | Critical | 9.8 | 2022-06-16 | CA Automic Automation 12.2 and 12.3 contain an insufficient input validation vulnerability in the Automic agent that could allow a remote attacker to potential… |
CVE-2022-33751 | High | 7.5 | 2022-06-16 | CA Automic Automation 12.2 and 12.3 contain an insecure memory handling vulnerability in the Automic agent that could allow a remote attacker to potentially ac… |
CVE-2022-33750 | Critical | 9.8 | 2022-06-16 | CA Automic Automation 12.2 and 12.3 contain an authentication error vulnerability in the Automic agent that could allow a remote attacker to potentially execut… |
CVE-2022-33739 | High | 7.5 | 2022-06-16 | CA Clarity 15.8 and below and 15.9.0 contain an insecure XML parsing vulnerability that could allow a remote attacker to potentially view the contents of any f… |
CVE-2022-31299 | Medium | 6.1 | 2022-06-16 | Haraj v3.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the User Upgrade Form. |
CVE-2022-26173 | High | 8.8 | 2022-06-16 | JForum v2.8.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via http://target_host:port/jforum-2.8.0/jforum.page, which allows attackers to arb… |
CVE-2022-31295 | High | 7.5 | 2022-06-16 | An issue in the delete_post() function of Online Discussion Forum Site 1 allows unauthenticated attackers to arbitrarily delete posts. |
CVE-2022-31464 | High | 7.8 | 2022-06-16 | Insecure permissions configuration in Adaware Protect v1.2.439.4251 allows attackers to escalate privileges via changing the service binary path. |
CVE-2022-27512 | Medium | 5.3 | 2022-06-16 | Temporary disruption of the ADM license service. The impact of this includes preventing new licenses from being issued or renewed by Citrix ADM. |
CVE-2022-27511 | High | 8.1 | 2022-06-16 | Corruption of the system by a remote, unauthenticated user. The impact of this can include the reset of the administrator password at the next device reboot, a… |
CVE-2022-24562 | Critical | 9.8 | 2022-06-16 | In IOBit IOTransfer 4.3.1.1561, an unauthenticated attacker can send GET and POST requests to Airserv and gain arbitrary read/write access to the entire file-s… |
CVE-2022-32547 | High | 7.8 | 2022-06-16 | In ImageMagick, there is load of misaligned address for type 'double', which requires 8 byte alignment and for type 'float', which requires 4 byte alignment at… |
CVE-2022-32546 | High | 7.8 | 2022-06-16 | A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned long' at coders/pcl.c, when crafted or untrust… |
CVE-2022-32545 | High | 7.8 | 2022-06-16 | A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned char' at coders/psd.c, when crafted or untrust… |
CVE-2022-31301 | Medium | 5.4 | 2022-06-16 | Haraj v3.7 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Post Ads component. |
CVE-2022-31294 | Medium | 6.5 | 2022-06-16 | An issue in the save_users() function of Online Discussion Forum Site 1 allows unauthenticated attackers to arbitrarily create or update user accounts. |
CVE-2022-30664 | High | 7.8 | 2022-06-16 | Adobe Animate version 22.0.5 (and earlier) is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of… |
CVE-2022-30657 | High | 7.8 | 2022-06-16 | Adobe InCopy versions 17.2 (and earlier) and 16.4.1 (and earlier) are affected by a Use-After-Free vulnerability that could result in arbitrary code execution… |
CVE-2022-30656 | High | 7.8 | 2022-06-16 | Adobe InCopy versions 17.2 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code exec… |
CVE-2022-30655 | High | 7.8 | 2022-06-16 | Adobe InCopy versions 17.2 (and earlier) and 16.4.1 (and earlier) are affected by a Use-After-Free vulnerability that could result in arbitrary code execution… |
CVE-2022-30654 | High | 7.8 | 2022-06-16 | Adobe InCopy versions 17.2 (and earlier) and 16.4.1 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary cod… |
CVE-2022-30653 | High | 7.8 | 2022-06-16 | Adobe InCopy versions 17.2 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code exec… |
CVE-2022-30652 | High | 7.8 | 2022-06-16 | Adobe InCopy versions 17.2 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code exec… |
CVE-2022-30651 | High | 7.8 | 2022-06-16 | Adobe InCopy versions 17.2 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could… |
CVE-2022-30650 | High | 7.8 | 2022-06-16 | Adobe InCopy versions 17.2 (and earlier) and 16.4.1 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary cod… |
CVE-2022-2085 | Medium | 5.5 | 2022-06-16 | A NULL pointer dereference vulnerability was found in Ghostscript, which occurs when it tries to render a large number of bits in memory. When allocating a buf… |
CVE-2022-29866 | High | 7.5 | 2022-06-16 | OPC UA .NET Standard Stack 1.04.368 allows a remote attacker to exhaust the memory resources of a server via a crafted request that triggers Uncontrolled Resou… |
CVE-2022-29864 | High | 7.5 | 2022-06-16 | OPC UA .NET Standard Stack 1.04.368 allows a remote attacker to cause a server to crash via a large number of messages that trigger Uncontrolled Resource Consu… |
CVE-2022-29863 | High | 7.5 | 2022-06-16 | OPC UA .NET Standard Stack 1.04.368 allows remote attacker to cause a crash via a crafted message that triggers excessive memory allocation. |
CVE-2022-31384 | Critical | 9.8 | 2022-06-16 | Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the fullname parameter in add-directory.php. |
CVE-2022-31383 | Critical | 9.8 | 2022-06-16 | Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in view-directory.php. |
CVE-2022-31382 | Critical | 9.8 | 2022-06-16 | Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the searchdata parameter in search-dirctory.php. |
CVE-2022-31298 | Medium | 5.4 | 2022-06-16 | A cross-site scripting vulnerability in the ads comment section of Haraj v3.7 allows attackers to execute arbitrary web scripts or HTML via a crafted POST requ… |
CVE-2022-30670 | High | 8.8 | 2022-06-16 | RoboHelp Server earlier versions than RHS 11 Update 3 are affected by an Improper Authorization vulnerability which could lead to privilege escalation. An auth… |
CVE-2022-30665 | High | 7.8 | 2022-06-16 | Adobe InDesign versions 17.2.1 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code… |
CVE-2022-30663 | High | 7.8 | 2022-06-16 | Adobe InDesign versions 17.2.1 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code… |
CVE-2022-30662 | High | 7.8 | 2022-06-16 | Adobe InDesign versions 17.2.1 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code… |
CVE-2022-30661 | High | 7.8 | 2022-06-16 | Adobe InDesign versions 17.2.1 (and earlier) and 16.4.1 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary… |
CVE-2022-30660 | High | 7.8 | 2022-06-16 | Adobe InDesign versions 17.2.1 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code… |
CVE-2022-30659 | High | 7.8 | 2022-06-16 | Adobe InDesign versions 17.2.1 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code… |
CVE-2022-30658 | High | 7.8 | 2022-06-16 | Adobe InDesign versions 17.2.1 (and earlier) and 16.4.1 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary… |
CVE-2022-29865 | High | 7.5 | 2022-06-16 | OPC UA .NET Standard Stack allows a remote attacker to bypass the application authentication check via crafted fake credentials. |
CVE-2022-29862 | High | 7.5 | 2022-06-16 | An infinite loop in OPC UA .NET Standard Stack 1.04.368 allows a remote attackers to cause the application to hang via a crafted message. |
CVE-2022-1642 | High | 7.5 | 2022-06-16 | A program using swift-corelibs-foundation is vulnerable to a denial of service attack caused by a potentially malicious source producing a JSON document contai… |
CVE-2022-31914 | Medium | 5.4 | 2022-06-16 | Zoo Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via zms/admin/public_html/save_animal?an_id=24. |