2022 CVEs (page 193)
Page 193 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-20156 | High | 7.8 | 2022-06-15 | In unflatten of GraphicBuffer.cpp, there is a possible arbitrary code execution due to improper input validation. This could lead to local escalation of privil… |
CVE-2022-20155 | High | 7.0 | 2022-06-15 | In ipu_core_jqs_msg_transport_kernel_write_sync of ipu-core-jqs-msg-transport.c, there is a possible use-after-free due to a race condition. This could lead to… |
CVE-2022-20154 | Medium | 6.4 | 2022-06-15 | In lock_sock_nested of sock.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System executi… |
CVE-2022-20153 | Medium | 6.7 | 2022-06-15 | In rcu_cblist_dequeue of rcu_segcblist.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the k… |
CVE-2022-20152 | Medium | 6.7 | 2022-06-15 | In the TitanM chip, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System executi… |
CVE-2022-20151 | High | 7.5 | 2022-06-15 | Product: AndroidVersions: Android kernelAndroid ID: A-210712565References: N/A |
CVE-2022-20149 | High | 7.5 | 2022-06-15 | Product: AndroidVersions: Android kernelAndroid ID: A-211685939References: N/A |
CVE-2022-20148 | Medium | 6.4 | 2022-06-15 | In TBD of TBD, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege in the kernel with System execution… |
CVE-2022-20147 | High | 7.8 | 2022-06-15 | In nfa_dm_check_set_config of nfa_dm_main.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of pri… |
CVE-2022-20146 | Medium | 5.5 | 2022-06-15 | In uploadFile of FileUploadServiceImpl.java, there is a possible incorrect file access due to a confused deputy. This could lead to local information disclosur… |
CVE-2022-20145 | Critical | 9.8 | 2022-06-15 | In startLegacyVpnPrivileged of Vpn.java, there is a possible way to retrieve VPN credentials due to a protocol downgrade attack. This could lead to remote esca… |
CVE-2022-20144 | High | 7.8 | 2022-06-15 | In multiple functions of AvatarPhotoController.java, there is a possible access to content owned by system content providers due to a confused deputy. This cou… |
CVE-2022-20143 | Medium | 5.5 | 2022-06-15 | In addAutomaticZenRule of ZenModeHelper.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of se… |
CVE-2022-20142 | High | 7.8 | 2022-06-15 | In createFromParcel of GeofenceHardwareRequestParcelable.java, there is a possible arbitrary code execution due to parcel mismatch. This could lead to local es… |
CVE-2022-20141 | High | 7.0 | 2022-06-15 | In ip_check_mc_rcu of igmp.c, there is a possible use after free due to improper locking. This could lead to local escalation of privilege when opening and clo… |
CVE-2022-20140 | Critical | 9.8 | 2022-06-15 | In read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege wi… |
CVE-2022-20138 | High | 7.8 | 2022-06-15 | In ACTION_MANAGED_PROFILE_PROVISIONED of DevicePolicyManagerService.java, there is a possible way for unprivileged app to send MANAGED_PROFILE_PROVISIONED inte… |
CVE-2022-2087 | Low | 3.5 | 2022-06-15 | A vulnerability, which was classified as problematic, was found in SourceCodester Bank Management System 1.0. This affects the file /mnotice.php?id=2. The mani… |
CVE-2022-2086 | Medium | 6.3 | 2022-06-15 | A vulnerability, which was classified as critical, has been found in SourceCodester Bank Management System 1.0. Affected by this issue is login.php. The manipu… |
CVE-2022-20137 | High | 7.3 | 2022-06-15 | In onCreateContextMenu of NetworkProviderSettings.java, there is a possible way for non-owner users to change WiFi settings due to a missing permission check… |
CVE-2022-20135 | High | 7.8 | 2022-06-15 | In writeToParcel of GateKeeperResponse.java, there is a possible parcel format mismatch. This could lead to local escalation of privilege with User execution p… |
CVE-2022-20134 | High | 7.8 | 2022-06-15 | In readArguments of CallSubjectDialog.java, there is a possible way to trick the user to call the wrong phone number due to improper input validation. This cou… |
CVE-2022-20133 | High | 7.8 | 2022-06-15 | In setDiscoverableTimeout of AdapterService.java, there is a possible bypass of user interaction due to a missing permission check. This could lead to local es… |
CVE-2022-20132 | Medium | 4.6 | 2022-06-15 | In lg_probe and related functions of hid-lg.c and other USB HID files, there is a possible out of bounds read due to improper input validation. This could lead… |
CVE-2022-20131 | High | 7.5 | 2022-06-15 | In nci_proc_rf_management_ntf of nci_hrcv.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information discl… |
CVE-2022-20130 | Critical | 9.8 | 2022-06-15 | In transportDec_OutOfBandConfig of tpdec_lib.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code executi… |
CVE-2022-20129 | Medium | 5.5 | 2022-06-15 | In registerPhoneAccount of PhoneAccountRegistrar.java, there is a possible way to prevent the user from selecting a phone account due to improper input validat… |
CVE-2022-20127 | Critical | 9.8 | 2022-06-15 | In ce_t4t_data_cback of ce_t4t.cc, there is a possible out of bounds write due to a double free. This could lead to remote code execution with no additional ex… |
CVE-2022-20126 | High | 7.3 | 2022-06-15 | In setScanMode of AdapterService.java, there is a possible way to enable Bluetooth discovery mode without user interaction due to a missing permission check. T… |
CVE-2022-20125 | Medium | 6.8 | 2022-06-15 | In GBoard, there is a possible way to bypass factory reset protections due to a sandbox escape. This could lead to local escalation of privilege if an attacker… |
CVE-2022-20124 | High | 7.8 | 2022-06-15 | In deletePackageX of DeletePackageHelper.java, there is a possible way for a Guest user to reset pre-loaded applications for other users due to a permissions b… |
CVE-2022-20123 | High | 7.5 | 2022-06-15 | In phNciNfc_RecvMfResp of phNxpExtns_MifareStd.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information… |
CVE-2022-1958 | Medium | 6.3 | 2022-06-15 | A vulnerability classified as critical has been found in FileCloud. Affected is an unknown function of the component NTFS Handler. The manipulation leads to im… |
CVE-2022-32243 | Medium | 5.5 | 2022-06-14 | When a user opens manipulated Scalable Vector Graphics (.svg, svg.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the applicatio… |
CVE-2022-32242 | Medium | 5.5 | 2022-06-14 | When a user opens manipulated Radiance Picture (.hdr, hdr.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashe… |
CVE-2022-32241 | Medium | 5.5 | 2022-06-14 | When a user opens manipulated Portable Document Format (.pdf, PDFView.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the applic… |
CVE-2022-32240 | Medium | 5.5 | 2022-06-14 | When a user opens manipulated Jupiter Tesselation (.jt, JTReader.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application… |
CVE-2022-32230 | High | 7.5 | 2022-06-14 | Microsoft Windows SMBv3 suffers from a null pointer dereference in versions of Windows prior to the April, 2022 patch set. By sending a malformed FileNormalize… |
CVE-2022-31066 | Medium | 5.9 | 2022-06-14 | EdgeX Foundry is an open source project for building a common open framework for Internet of Things edge computing. Prior to version 2.1.1, the /api/v2/config… |
CVE-2022-32363 | High | 7.2 | 2022-06-14 | Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/categories/view_category.php?id=. |
CVE-2022-32362 | High | 7.2 | 2022-06-14 | Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/categories/manage_category.php?id=. |
CVE-2022-32359 | High | 7.2 | 2022-06-14 | Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/classes/Master.php?f=delete_category. |
CVE-2022-32358 | High | 7.2 | 2022-06-14 | Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/classes/Master.php?f=delete_inquiry. |
CVE-2022-32355 | High | 7.2 | 2022-06-14 | Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/?page=products/view_product&id=. |
CVE-2022-32354 | High | 7.2 | 2022-06-14 | Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/?page=user/manage_user&id=. |
CVE-2022-32353 | High | 7.2 | 2022-06-14 | Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/categories/manage_field_order.php?id=. |
CVE-2022-31060 | Medium | 5.3 | 2022-06-14 | Discourse is an open-source discussion platform. Prior to version 2.8.4 in the `stable` branch and version `2.9.0.beta5` in the `beta` and `tests-passed` branc… |
CVE-2022-31050 | Medium | 6.0 | 2022-06-14 | TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, Admin Tool sessions initiated via the TYPO3 backend… |
CVE-2022-31049 | Medium | 5.4 | 2022-06-14 | TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, user submitted content was used without being prope… |
CVE-2022-31048 | Medium | 5.4 | 2022-06-14 | TYPO3 is an open source web content management system. Prior to versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the Form Designer backend module of th… |
CVE-2022-31047 | Medium | 5.3 | 2022-06-14 | TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, system internal credentia… |
CVE-2022-31046 | Medium | 4.3 | 2022-06-14 | TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the export functionality… |
CVE-2022-29241 | High | 7.1 | 2022-06-14 | Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter Notebook. Prior to version 1.1… |
CVE-2022-32239 | Medium | 5.5 | 2022-06-14 | When a user opens manipulated JPEG 2000 (.jp2, jp2k.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and… |
CVE-2022-32238 | Medium | 5.5 | 2022-06-14 | When a user opens manipulated Encapsulated Post Script (.eps, ai.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application… |
CVE-2022-32237 | Medium | 5.5 | 2022-06-14 | When a user opens manipulated Computer Graphics Metafile (.cgm, CgmCore.dll) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the appl… |
CVE-2022-32236 | Medium | 5.5 | 2022-06-14 | When a user opens manipulated Windows Bitmap (.bmp, 2d.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes a… |
CVE-2022-31059 | Medium | 6.5 | 2022-06-14 | Discourse Calendar is a calendar plugin for Discourse, an open-source messaging app. Prior to version 1.0.1, parsing and rendering of Event names can be suscep… |
CVE-2022-32235 | Medium | 5.5 | 2022-06-14 | When a user opens manipulated AutoCAD (.dwg, TeighaTranslator.exe) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application cr… |
CVE-2022-31595 | High | 8.8 | 2022-06-14 | SAP Financial Consolidation - version 1010,�does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. |
CVE-2022-31594 | Medium | 6.7 | 2022-06-14 | A highly privileged user can exploit SUID-root program to escalate his privileges to root on a local Unix system. |
CVE-2022-31590 | High | 7.8 | 2022-06-14 | SAP PowerDesigner Proxy - version 16.7, allows an attacker with low privileges and has local access, with the ability to work around system’s root disk access… |
CVE-2022-31589 | Medium | 6.5 | 2022-06-14 | Due to improper authorization check, business users who are using Israeli File from SHAAM program (/ATL/VQ23 transaction), are granted more than needed authori… |
CVE-2022-29618 | Medium | 6.1 | 2022-06-14 | Due to insufficient input validation, SAP NetWeaver Development Infrastructure (Design Time Repository) - versions 7.30, 7.31, 7.40, 7.50, allows an unauthenti… |
CVE-2022-29615 | Low | 3.4 | 2022-06-14 | SAP NetWeaver Developer Studio (NWDS) - version 7.50, is based on Eclipse, which contains the logging framework log4j in version 1.x. The application's confide… |
CVE-2022-29614 | Medium | 5.0 | 2022-06-14 | SAP startservice - of SAP NetWeaver Application Server ABAP, Application Server Java, ABAP Platform and HANA Database - versions KERNEL 7.22, 7.49, 7.53, 7.77… |
CVE-2022-32367 | High | 7.2 | 2022-06-14 | Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/?page=inquiries/view_inquiry&id=. |
CVE-2022-32366 | High | 7.2 | 2022-06-14 | Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/fields/view_field.php?id=. |
CVE-2022-32365 | High | 7.2 | 2022-06-14 | Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/fields/manage_field.php?id=. |
CVE-2022-32364 | High | 7.2 | 2022-06-14 | Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/?page=products/manage_product&id=. |
CVE-2022-30903 | Medium | 4.8 | 2022-06-14 | Nokia "G-2425G-A" Bharti Airtel Routers Hardware version "3FE48299DEAA" Software Version "3FE49362IJHK42" is vulnerable to Cross-Site Scripting (XSS) via the a… |
CVE-2022-29238 | Medium | 4.3 | 2022-06-14 | Jupyter Notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.12, authenticated requests to the notebook server with `Co… |
CVE-2022-21504 | Medium | 5.5 | 2022-06-14 | The code in UEK6 U3 was missing an appropiate file descriptor count to be missing. This resulted in a use count error that allowed a file descriptor to a socke… |
CVE-2022-32561 | Medium | 4.9 | 2022-06-14 | An issue was discovered in Couchbase Server before 6.6.5 and 7.x before 7.0.4. Previous mitigations for CVE-2018-15728 were found to be insufficient when it wa… |
CVE-2022-32559 | Critical | 9.1 | 2022-06-14 | An issue was discovered in Couchbase Server before 7.0.4. Random HTTP requests lead to leaked metrics. |
CVE-2022-32557 | High | 7.5 | 2022-06-14 | An issue was discovered in Couchbase Server before 7.0.4. The Index Service does not enforce authentication for TCP/TLS servers. |
CVE-2022-32337 | Critical | 9.8 | 2022-06-14 | Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/patients/manage_patient.php?id=. |
CVE-2022-31403 | Medium | 6.1 | 2022-06-14 | ITOP v3.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via /itop/pages/ajax.render.php. |
CVE-2022-30930 | Medium | 4.3 | 2022-06-14 | Tourism Management System Version: V 3.2 is affected by: Cross Site Request Forgery (CSRF). |
CVE-2022-29612 | Medium | 4.3 | 2022-06-14 | SAP NetWeaver, ABAP Platform and SAP Host Agent - versions KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, 7.88, 8.04, KRNL64NUC 7.22, 7.22EXT, 7.49, KR… |
CVE-2022-27668 | Critical | 9.8 | 2022-06-14 | Depending on the configuration of the route permission table in file 'saprouttab', it is possible for an unauthenticated attacker to execute SAProuter administ… |
CVE-2022-32352 | Critical | 9.8 | 2022-06-14 | Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/classes/Master.php?f=delete_patient_admission. |
CVE-2022-32351 | High | 7.2 | 2022-06-14 | Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/classes/Master.php?f=delete_message. |
CVE-2022-32350 | High | 7.2 | 2022-06-14 | Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/classes/Master.php?f=delete_room_type. |
CVE-2022-32349 | High | 7.2 | 2022-06-14 | Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/classes/Master.php?f=delete_patient_history. |
CVE-2022-32348 | High | 7.2 | 2022-06-14 | Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/classes/Master.php?f=delete_doctor. |
CVE-2022-32347 | High | 7.2 | 2022-06-14 | Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/classes/Master.php?f=delete_room. |
CVE-2022-32346 | High | 7.2 | 2022-06-14 | Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/rooms/view_room.php?id=. |
CVE-2022-32345 | High | 7.2 | 2022-06-14 | Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/rooms/manage_room.php?id=. |
CVE-2022-32344 | High | 7.2 | 2022-06-14 | Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/classes/Master.php?f=delete_patient. |
CVE-2022-32343 | High | 7.2 | 2022-06-14 | Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via hprms/admin/room_types/manage_room_type.php?id=. |
CVE-2022-32342 | High | 7.2 | 2022-06-14 | Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/room_types/view_room_type.php?id=. |
CVE-2022-32341 | High | 7.2 | 2022-06-14 | Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/?page=user/manage_user&id=. |
CVE-2022-32340 | High | 7.2 | 2022-06-14 | Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/?page=patients/view_patient&id=. |
CVE-2022-32339 | High | 7.2 | 2022-06-14 | Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/doctors/view_doctor.php?id=. |
CVE-2022-32338 | High | 7.2 | 2022-06-14 | Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/doctors/manage_doctor.php?id=. |
CVE-2022-32335 | High | 7.2 | 2022-06-14 | Fast Food Ordering System v1.0 is vulnerable to SQL Injection via /ffos/admin/menus/manage_menu.php?id=. |
CVE-2022-32334 | High | 7.2 | 2022-06-14 | Fast Food Ordering System v1.0 is vulnerable to SQL Injection via /ffos/admin/categories/manage_category.php?id=. |
CVE-2022-32333 | High | 7.2 | 2022-06-14 | Fast Food Ordering System v1.0 is vulnerable to SQL Injection via /ffos/admin/sales/receipt.php?id=. |
CVE-2022-32332 | High | 7.2 | 2022-06-14 | Fast Food Ordering System v1.0 is vulnerable to SQL Injection via /ffos/classes/Master.php?f=delete_category. |