2022 CVEs (page 192)
Page 192 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-32433 | High | 7.2 | 2022-06-15 | itsourcecode Advanced School Management System v1.0 is vulnerable to Arbitrary code execution via ip/school/view/all_teacher.php. |
CVE-2022-32381 | High | 7.2 | 2022-06-15 | itsourcecode Advanced School Management System v1.0 is vulnerable to SQL Injection via /school/model/get_admin_profile.php?my_index=. |
CVE-2022-32380 | High | 7.2 | 2022-06-15 | itsourcecode Advanced School Management System v1.0 is vulnerable to SQL Injection via /school/model/get_student_subject.php?index=. |
CVE-2022-32379 | High | 7.2 | 2022-06-15 | itsourcecode Advanced School Management System v1.0 is vulnerable to SQL Injection via /school/model/get_parents_profile.php?my_index=. |
CVE-2022-32378 | High | 7.2 | 2022-06-15 | itsourcecode Advanced School Management System v1.0 is vulnerable to SQL Injection via /school/model/get_teacher_profile.php?my_index=. |
CVE-2022-32377 | High | 7.2 | 2022-06-15 | itsourcecode Advanced School Management System v1.0 is vulnerable to SQL Injection via /school/model/get_exam_timetable.php?id=. |
CVE-2022-32376 | High | 7.2 | 2022-06-15 | itsourcecode Advanced School Management System v1.0 is vulnerable to SQL Injection via /school/model/get_events.php?event_id=. |
CVE-2022-32375 | High | 7.2 | 2022-06-15 | itsourcecode Advanced School Management System v1.0 is vulnerable to SQL Injection via /school/model/get_timetable.php?id=. |
CVE-2022-31219 | High | 7.3 | 2022-06-15 | Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary conten… |
CVE-2022-31218 | High | 7.8 | 2022-06-15 | Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary conten… |
CVE-2022-31217 | High | 7.8 | 2022-06-15 | Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary conten… |
CVE-2022-31216 | High | 7.8 | 2022-06-15 | Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary conten… |
CVE-2022-31070 | Medium | 5.8 | 2022-06-15 | NestJS Proxy is a NestJS module to decorate and proxy calls. Prior to version 0.7.0, the nestjs-proxy library did not have a way to block sensitive cookies (e… |
CVE-2022-31069 | Medium | 5.8 | 2022-06-15 | NestJS Proxy is a NestJS module to decorate and proxy calls. Prior to version 0.7.0, the nestjs-proxy library did not have a way to control when Authorization… |
CVE-2022-31044 | High | 7.5 | 2022-06-15 | Rundeck is an open source automation service with a web console, command line tools and a WebAPI. The Key Storage converter plugin mechanism was not enabled co… |
CVE-2022-29450 | Medium | 5.4 | 2022-06-15 | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Admin Management Xtended plugin <= 2.4.4 at WordPress. |
CVE-2022-29443 | Medium | 4.1 | 2022-06-15 | Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Nicdark's Hotel Booking plugin <= 3.0 at WordPres… |
CVE-2022-26057 | Medium | 6.7 | 2022-06-15 | Vulnerabilities in the Mint WorkBench allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary conten… |
CVE-2022-24127 | Medium | 5.4 | 2022-06-15 | A Stored Cross-Site Scripting (XSS) vulnerability was discovered in ProjectGeneral/edit_project_settings.php in REDCap 12.0.11. This issue allows any user with… |
CVE-2022-24004 | Medium | 5.4 | 2022-06-15 | A Stored Cross-Site Scripting (XSS) vulnerability was discovered in Messenger/messenger_ajax.php in REDCap 12.0.11. This issue allows any authenticated user to… |
CVE-2022-20825 | Critical | 9.8 | 2022-06-15 | A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthenticated, remote… |
CVE-2022-20819 | Medium | 6.5 | 2022-06-15 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive… |
CVE-2022-20817 | High | 7.4 | 2022-06-15 | A vulnerability in Cisco Unified IP Phones could allow an unauthenticated, remote attacker to impersonate another user's phone if the Cisco Unified Communicati… |
CVE-2022-20798 | Critical | 9.8 | 2022-06-15 | A vulnerability in the external authentication functionality of Cisco Secure Email and Web Manager, formerly known as Cisco Security Management Appliance (SMA)… |
CVE-2022-20736 | Medium | 5.3 | 2022-06-15 | A vulnerability in the web-based management interface of Cisco AppDynamics Controller Software could allow an unauthenticated, remote attacker to access a conf… |
CVE-2022-20733 | Medium | 5.3 | 2022-06-15 | A vulnerability in the login page of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to log in without credentials and acc… |
CVE-2022-20664 | High | 7.7 | 2022-06-15 | A vulnerability in the web management interface of Cisco Secure Email and Web Manager, formerly Cisco Security Management Appliance (SMA), and Cisco Email Secu… |
CVE-2022-32992 | High | 7.2 | 2022-06-15 | Online Tours And Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the tname parameter at /admin/operations/tax.php. |
CVE-2022-32991 | High | 8.8 | 2022-06-15 | Web Based Quiz System v1.0 was discovered to contain a SQL injection vulnerability via the eid parameter at welcome.php. |
CVE-2022-32302 | High | 8.8 | 2022-06-15 | Theme Park Ticketing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at edit_ticket.php. |
CVE-2022-32301 | Critical | 9.8 | 2022-06-15 | YoudianCMS v9.5.0 was discovered to contain a SQL injection vulnerability via the IdList parameter at /App/Lib/Action/Home/ApiAction.class.php. |
CVE-2022-32300 | High | 8.8 | 2022-06-15 | YoudianCMS v9.5.0 was discovered to contain a SQL injection vulnerability via the MailSendID parameter at /App/Lib/Action/Admin/MailAction.class.php. |
CVE-2022-32299 | High | 8.8 | 2022-06-15 | YoudianCMS v9.5.0 was discovered to contain a SQL injection vulnerability via the id parameter at /App/Lib/Action/Admin/SiteAction.class.php. |
CVE-2022-32158 | Critical | 9.0 | 2022-06-15 | Splunk Enterprise deployment servers in versions before 8.1.10.1, 8.2.6.1, and 9.0 let clients deploy forwarder bundles to other deployment clients through the… |
CVE-2022-32157 | High | 7.5 | 2022-06-15 | Splunk Enterprise deployment servers in versions before 9.0 allow unauthenticated downloading of forwarder bundles. Remediation requires you to update the depl… |
CVE-2022-32156 | High | 8.1 | 2022-06-15 | In Splunk Enterprise and Universal Forwarder versions before 9.0, the Splunk command-line interface (CLI) did not validate TLS certificates while connecting to… |
CVE-2022-32155 | High | 7.5 | 2022-06-15 | In universal forwarder versions before 9.0, management services are available remotely by default. When not required, it introduces a potential exposure, but i… |
CVE-2022-32154 | Medium | 6.8 | 2022-06-15 | Dashboards in Splunk Enterprise versions before 9.0 might let an attacker inject risky search commands into a form token when the token is used in a query in a… |
CVE-2022-32153 | High | 8.1 | 2022-06-15 | Splunk Enterprise peers in Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203 did not validate the TLS certificates durin… |
CVE-2022-32152 | High | 8.1 | 2022-06-15 | Splunk Enterprise peers in Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203 did not validate the TLS certificates durin… |
CVE-2022-32151 | High | 7.4 | 2022-06-15 | The httplib and urllib Python libraries that Splunk shipped with Splunk Enterprise did not validate certificates using the certificate authority (CA) certifica… |
CVE-2022-32101 | Critical | 9.8 | 2022-06-15 | kkcms v1.3.7 was discovered to contain a SQL injection vulnerability via the cid parameter at /template/wapian/vlist.php. |
CVE-2022-1342 | Medium | 4.6 | 2022-06-15 | A lack of password masking in Devolutions Remote Desktop Manager allows physically proximate attackers to observe sensitive data. A caching issue can cause sen… |
CVE-2022-29453 | Medium | 5.4 | 2022-06-15 | Cross-Site Request Forgery (CSRF) vulnerability in API KEY for Google Maps plugin <= 1.2.1 at WordPress leading to Google Maps API key update. |
CVE-2022-29442 | Medium | 5.4 | 2022-06-15 | Authenticated (subscriber or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Messages For WordPress <= 2.1.10 at WordPress. |
CVE-2022-29441 | Medium | 4.3 | 2022-06-15 | Cross-Site Request Forgery (CSRF) vulnerability in Private Messages For WordPress plugin <= 2.1.10 at WordPress allows attackers to send messages. |
CVE-2022-29440 | Medium | 5.4 | 2022-06-15 | Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Promotion Slider plugin <= 3.3.4 at WordPress. |
CVE-2022-29439 | Medium | 5.4 | 2022-06-15 | Cross-Site Request Forgery (CSRF) vulnerability in Image Slider by NextCode plugin <= 1.1.2 at WordPress allows deleting slides. |
CVE-2022-29438 | Medium | 4.8 | 2022-06-15 | Authenticated (author or higher user role) Persistent Cross-Site Scripting (XSS) vulnerability in Image Slider by NextCode plugin <= 1.1.2 at WordPress. |
CVE-2022-29437 | Medium | 5.4 | 2022-06-15 | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Image Slider by NextCode plugin <= 1.1.2 at WordPress. |
CVE-2022-22444 | Medium | 5.5 | 2022-06-15 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a local user to exploit a vulnerability in the lpd daemon to cause a denial of service. IBM X-Force ID: 224444. |
CVE-2022-33140 | High | 8.8 | 2022-06-15 | The optional ShellUserGroupProvider in Apache NiFi 1.10.0 to 1.16.2 and Apache NiFi Registry 0.6.0 to 1.16.2 does not neutralize arguments for group resolution… |
CVE-2022-29406 | Medium | 4.1 | 2022-06-15 | Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in DynamicWebLab's WordPress Team Manager plugin <=… |
CVE-2022-27859 | Medium | 4.1 | 2022-06-15 | Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Nicdark d.o.o. Travel Management plugin <= 2.0 at… |
CVE-2022-20233 | Medium | 6.7 | 2022-06-15 | In param_find_digests_internal and related functions of the Titan-M source, there is a possible out of bounds write due to an incorrect bounds check. This coul… |
CVE-2022-20210 | Critical | 9.8 | 2022-06-15 | The UE and the EMM communicate with each other using NAS messages. When a new NAS message arrives from the EMM, the modem parses it and fills in internal objec… |
CVE-2022-20209 | High | 7.5 | 2022-06-15 | In hme_add_new_node_to_a_sorted_array of hme_utils.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote informati… |
CVE-2022-20208 | Medium | 4.4 | 2022-06-15 | In parseRecursively of cppbor_parse.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosu… |
CVE-2022-20207 | High | 7.8 | 2022-06-15 | In static definitions of GattServiceConfig.java, there is a possible permission bypass due to an insecure default value. This could lead to local escalation of… |
CVE-2022-20206 | Medium | 5.5 | 2022-06-15 | In setPackageOrComponentEnabled of NotificationManagerService.java, there is a missing permission check. This could lead to local information disclosure about… |
CVE-2022-20205 | Medium | 5.5 | 2022-06-15 | In isFileUri of FileUtil.java, there is a possible way to bypass the check for a file:// scheme due to improper input validation. This could lead to local info… |
CVE-2022-20204 | High | 7.8 | 2022-06-15 | In registerRemoteBugreportReceivers of DevicePolicyManagerService.java, there is a possible reporting of falsified bug reports due to a missing permission chec… |
CVE-2022-20202 | Medium | 6.5 | 2022-06-15 | In ih264_resi_trans_quant_4x4_sse42 of ih264_resi_trans_quant_sse42.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to… |
CVE-2022-20201 | Medium | 6.7 | 2022-06-15 | In getAppSize of InstalldNativeService.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privil… |
CVE-2022-20200 | Medium | 5.5 | 2022-06-15 | In updateApState of SoftApManager.java, there is a possible leak of hotspot state due to a missing permission check. This could lead to local information discl… |
CVE-2022-20198 | Medium | 4.4 | 2022-06-15 | In llcp_dlc_proc_connect_pdu of llcp_dlc.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclos… |
CVE-2022-20197 | High | 7.8 | 2022-06-15 | In recycle of Parcel.java, there is a possible way to start foreground activity from background due to a permissions bypass. This could lead to local escalatio… |
CVE-2022-20196 | Medium | 5.0 | 2022-06-15 | In gallery3d and photos, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional exe… |
CVE-2022-20195 | Medium | 5.0 | 2022-06-15 | In the keystore library, there is a possible prevention of access to system Settings due to unsafe deserialization. This could lead to local denial of service… |
CVE-2022-20194 | High | 7.8 | 2022-06-15 | In onCreate of ChooseLockGeneric.java, there is a possible permission bypass. This could lead to local escalation of privilege with no additional execution pri… |
CVE-2022-20193 | High | 7.3 | 2022-06-15 | In getUniqueUsagesWithLabels of PermissionUsageHelper.java, there is a possible incorrect permission attribution due to a logic error in the code. This could l… |
CVE-2022-20192 | High | 7.8 | 2022-06-15 | In grantEmbeddedWindowFocus of WindowManagerService.java, there is a possible way to change an input channel for embedded hierarchy due to a permissions bypass… |
CVE-2022-20191 | Critical | 9.8 | 2022-06-15 | Product: AndroidVersions: Android kernelAndroid ID: A-209324757References: N/A |
CVE-2022-20190 | High | 7.5 | 2022-06-15 | Product: AndroidVersions: Android kernelAndroid ID: A-208744915References: N/A |
CVE-2022-20188 | High | 7.5 | 2022-06-15 | Product: AndroidVersions: Android kernelAndroid ID: A-207254598References: N/A |
CVE-2022-20186 | High | 7.8 | 2022-06-15 | In kbase_mem_alias of mali_kbase_mem_linux.c, there is a possible arbitrary code execution due to improper input validation. This could lead to local escalatio… |
CVE-2022-20185 | Medium | 6.7 | 2022-06-15 | In TBD of TBD, there is a possible use after free bug. This could lead to local escalation of privilege with System execution privileges needed. User interacti… |
CVE-2022-20184 | High | 7.5 | 2022-06-15 | Product: AndroidVersions: Android kernelAndroid ID: A-209153114References: N/A |
CVE-2022-20183 | Medium | 6.7 | 2022-06-15 | In hypx_create_blob_dmabuf of faceauth_hypx.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of pr… |
CVE-2022-20182 | Medium | 4.4 | 2022-06-15 | In handle_ramdump of pixel_loader.c, there is a possible way to create a ramdump of non-secure memory due to a missing permission check. This could lead to loc… |
CVE-2022-20181 | High | 7.5 | 2022-06-15 | Product: AndroidVersions: Android kernelAndroid ID: A-210936609References: N/A |
CVE-2022-20179 | High | 7.5 | 2022-06-15 | Product: AndroidVersions: Android kernelAndroid ID: A-211683760References: N/A |
CVE-2022-20178 | Medium | 6.7 | 2022-06-15 | In ioctl_dpm_qos_update and ioctl_event_control_set of (TBD), there is a possible out of bounds write due to an integer overflow. This could lead to local esca… |
CVE-2022-20177 | High | 7.5 | 2022-06-15 | Product: AndroidVersions: Android kernelAndroid ID: A-209906686References: N/A |
CVE-2022-20176 | Medium | 4.4 | 2022-06-15 | In auth_store of sjtag-driver.c, there is a possible read of uninitialized memory due to a missing bounds check. This could lead to local information disclosur… |
CVE-2022-20175 | High | 7.5 | 2022-06-15 | Product: AndroidVersions: Android kernelAndroid ID: A-209252491References: N/A |
CVE-2022-20174 | Medium | 4.4 | 2022-06-15 | In exynos_secEnv_init of mach-gs101.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure… |
CVE-2022-20173 | Critical | 9.8 | 2022-06-15 | Product: AndroidVersions: Android kernelAndroid ID: A-207116951References: N/A |
CVE-2022-20172 | Medium | 5.5 | 2022-06-15 | In onbind of ShannonRcsService.java, there is a possible access to protect data due to a missing permission check. This could lead to local information disclos… |
CVE-2022-20171 | Critical | 9.8 | 2022-06-15 | Product: AndroidVersions: Android kernelAndroid ID: A-215565667References: N/A |
CVE-2022-20170 | Critical | 9.8 | 2022-06-15 | Product: AndroidVersions: Android kernelAndroid ID: A-209421931References: N/A |
CVE-2022-20169 | High | 7.5 | 2022-06-15 | Product: AndroidVersions: Android kernelAndroid ID: A-211162353References: N/A |
CVE-2022-20168 | High | 7.5 | 2022-06-15 | Product: AndroidVersions: Android kernelAndroid ID: A-210594998References: N/A |
CVE-2022-20167 | Critical | 9.8 | 2022-06-15 | Product: AndroidVersions: Android kernelAndroid ID: A-204956204References: N/A |
CVE-2022-20166 | Medium | 6.7 | 2022-06-15 | In various methods of kernel base drivers, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privil… |
CVE-2022-20165 | Medium | 4.4 | 2022-06-15 | In asn1_parse of asn1.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System e… |
CVE-2022-20164 | Critical | 9.8 | 2022-06-15 | Product: AndroidVersions: Android kernelAndroid ID: A-204891956References: N/A |
CVE-2022-20162 | Medium | 4.4 | 2022-06-15 | In asn1_p256_int of crypto/asn1.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure wit… |
CVE-2022-20160 | Critical | 9.8 | 2022-06-15 | Product: AndroidVersions: Android kernelAndroid ID: A-210083655References: N/A |
CVE-2022-20159 | Medium | 4.4 | 2022-06-15 | In asn1_ec_pkey_parse of acropora/crypto/asn1_common.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local infor… |