2022 CVEs (page 194)
Page 194 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-32331 | High | 7.2 | 2022-06-14 | Fast Food Ordering System v1.0 is vulnerable to SQL Injection via /ffos/admin/categories/view_category.php?id=. |
CVE-2022-32330 | High | 7.2 | 2022-06-14 | Fast Food Ordering System v1.0 is vulnerable to SQL Injection via /ffos/classes/Master.php?f=delete_menu. |
CVE-2022-32328 | Critical | 9.1 | 2022-06-14 | Fast Food Ordering System v1.0 is vulnerable to Delete any file. via /ffos/classes/Master.php?f=delete_img. |
CVE-2022-30931 | Medium | 6.5 | 2022-06-14 | Employee Leaves Management System (ELMS) V 2.1 is vulnerable to Cross Site Request Forgery (CSRF) via /myprofile.php. |
CVE-2022-32336 | Critical | 9.8 | 2022-06-14 | Fast Food Ordering System v1.0 is vulnerable to SQL Injection via /ffos/admin/menus/view_menu.php?id=. |
CVE-2022-31847 | High | 7.5 | 2022-06-14 | A vulnerability in /cgi-bin/ExportAllSettings.sh of WAVLINK WN579 X3 M79X3.V5030.180719 allows attackers to obtain sensitive router information via a crafted P… |
CVE-2022-31846 | High | 7.5 | 2022-06-14 | A vulnerability in live_mfg.shtml of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to obtain sensitive router information via execution of the exec cmd… |
CVE-2022-31845 | High | 7.5 | 2022-06-14 | A vulnerability in live_check.shtml of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to obtain sensitive router information via execution of the exec c… |
CVE-2022-31311 | Critical | 9.8 | 2022-06-14 | An issue in adm.cgi of WAVLINK AERIAL X 1200M M79X3.V5030.180719 allows attackers to execute arbitrary commands via a crafted POST request. |
CVE-2022-31309 | High | 7.5 | 2022-06-14 | A vulnerability in live_check.shtml of WAVLINK AERIAL X 1200M M79X3.V5030.180719 allows attackers to obtain sensitive router information via execution of the e… |
CVE-2022-31308 | High | 7.5 | 2022-06-14 | A vulnerability in live_mfg.shtml of WAVLINK AERIAL X 1200M M79X3.V5030.191012 allows attackers to obtain sensitive router information via execution of the exe… |
CVE-2022-27889 | Medium | 5.3 | 2022-06-14 | The Multipass service was found to have code paths that could be abused to cause a denial of service for authentication or authorization operations. A maliciou… |
CVE-2022-31273 | Critical | 9.8 | 2022-06-14 | An issue in TopIDP3000 Topsec Operating System tos_3.3.005.665b.15_smpidp allows attackers to perform a brute-force attack via a crafted session_id cookie. |
CVE-2022-32286 | Medium | 6.1 | 2022-06-14 | A vulnerability has been identified in Mendix SAML Module (Mendix 7 compatible) (All versions < V1.16.6), Mendix SAML Module (Mendix 8 compatible) (All version… |
CVE-2022-32285 | High | 7.5 | 2022-06-14 | A vulnerability has been identified in Mendix SAML Module (Mendix 7 compatible) (All versions < V1.16.6), Mendix SAML Module (Mendix 8 compatible) (All version… |
CVE-2022-32262 | High | 8.8 | 2022-06-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application contains a file upload server that is vulne… |
CVE-2022-32261 | Medium | 5.3 | 2022-06-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application contains a misconfiguration in the APT upda… |
CVE-2022-32260 | Medium | 6.5 | 2022-06-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application creates temporary user credentials for… |
CVE-2022-32259 | Medium | 6.5 | 2022-06-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The system images for installation or update of the affected applica… |
CVE-2022-32258 | Medium | 5.3 | 2022-06-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application contains an older feature that allows to im… |
CVE-2022-32256 | Medium | 4.3 | 2022-06-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application consists of a web service that lacks proper… |
CVE-2022-32255 | Medium | 5.3 | 2022-06-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application consists of a web service that lacks proper… |
CVE-2022-32254 | Medium | 4.3 | 2022-06-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). A customized HTTP POST request could force the application to write… |
CVE-2022-32253 | Medium | 4.9 | 2022-06-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). Due to improper input validation, the OpenSSL certificate's password… |
CVE-2022-32252 | Medium | 6.5 | 2022-06-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The application does not perform the integrity check of the update p… |
CVE-2022-32251 | High | 8.8 | 2022-06-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). There is a missing authentication verification for a resource used t… |
CVE-2022-32145 | Medium | 6.1 | 2022-06-14 | A vulnerability has been identified in Teamcenter Active Workspace V5.2 (All versions < V5.2.9), Teamcenter Active Workspace V6.0 (All versions < V6.0.3). A re… |
CVE-2022-31619 | High | 8.8 | 2022-06-14 | A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.13), Teamcenter V13.0 (All versions < V13.0.0.9), Teamcenter V13.1 (All version… |
CVE-2022-31465 | High | 7.8 | 2022-06-14 | A vulnerability has been identified in Xpedition Designer VX.2.10 (All versions < VX.2.10 Update 13), Xpedition Designer VX.2.11 (All versions < VX.2.11 Update… |
CVE-2022-30937 | High | 7.5 | 2022-06-14 | A vulnerability has been identified in EN100 Ethernet module DNP3 IP variant (All versions), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethern… |
CVE-2022-30231 | Medium | 4.9 | 2022-06-14 | A vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.6.6). The affected application discloses password hashes of other users upon… |
CVE-2022-30230 | Critical | 9.8 | 2022-06-14 | A vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.6.6). The affected application does not require authenticated access for pri… |
CVE-2022-30229 | High | 7.2 | 2022-06-14 | A vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.6.6). The affected application does not require authenticated access for pri… |
CVE-2022-30228 | High | 8.8 | 2022-06-14 | A vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.6.6). The affected software does not apply cross-origin resource sharing (CO… |
CVE-2022-29034 | Medium | 6.1 | 2022-06-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). An error message pop up window in the web interface of the affected… |
CVE-2022-27221 | Medium | 5.9 | 2022-06-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). An attacker in machine-in-the-middle could obtain plaintext secret v… |
CVE-2022-27220 | Medium | 4.3 | 2022-06-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). Affected application is missing general HTTP security headers in… |
CVE-2022-27219 | Medium | 4.3 | 2022-06-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). Affected application is missing general HTTP security headers in… |
CVE-2022-26476 | High | 8.8 | 2022-06-14 | A vulnerability has been identified in Spectrum Power 4 (All versions using Shared HIS), Spectrum Power 7 (All versions using Shared HIS), Spectrum Power MGMS… |
CVE-2022-25651 | Critical | 9.8 | 2022-06-14 | Memory corruption in bluetooth host due to integer overflow while processing BT HFP-UNIT profile in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Indust… |
CVE-2022-22103 | High | 7.8 | 2022-06-14 | Memory corruption in multimedia driver due to double free while processing data from user in Snapdragon Auto |
CVE-2022-22090 | High | 8.4 | 2022-06-14 | Memory corruption in audio due to use after free while managing buffers from internal cache in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile |
CVE-2022-22087 | High | 7.3 | 2022-06-14 | memory corruption in video due to buffer overflow while parsing mkv clip with no codechecker in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, S… |
CVE-2022-22086 | High | 7.3 | 2022-06-14 | Memory corruption in video due to double free while parsing 3gp clip with invalid meta data atoms in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivi… |
CVE-2022-22085 | High | 8.4 | 2022-06-14 | Memory corruption in video due to buffer overflow while reading the dts file in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consum… |
CVE-2022-22084 | High | 8.4 | 2022-06-14 | Memory corruption when extracting qcp audio file due to lack of check on data length in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdrago… |
CVE-2022-22083 | High | 7.5 | 2022-06-14 | Denial of service due to memory corruption while extracting ape header from clips in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon C… |
CVE-2022-22082 | High | 8.4 | 2022-06-14 | Memory corruption due to possible buffer overflow while parsing DSF header with corrupted channel count in Snapdragon Auto, Snapdragon Compute, Snapdragon Conn… |
CVE-2022-22072 | High | 7.8 | 2022-06-14 | Buffer overflow can occur due to improper validation of NDP application information length in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electron… |
CVE-2022-22071 | High | 8.4 | 2022-06-14 | Possible use after free when process shell memory is freed using IOCTL munmap call and process initialization is in progress in Snapdragon Auto, Snapdragon Com… |
CVE-2022-22068 | High | 8.4 | 2022-06-14 | kernel event may contain unexpected content which is not generated by NPU software in asynchronous execution mode in Snapdragon Auto, Snapdragon Compute, Snapd… |
CVE-2022-22065 | High | 7.5 | 2022-06-14 | Out of bound read in WLAN HOST due to improper length check can lead to DOS in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consume… |
CVE-2022-22064 | High | 7.5 | 2022-06-14 | Possible buffer over read due to lack of size validation while unpacking frame in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Cons… |
CVE-2022-22057 | High | 8.4 | 2022-06-14 | Use after free in graphics fence due to a race condition while closing fence file descriptor and destroy graphics timeline simultaneously in Snapdragon Auto, S… |
CVE-2022-2079 | Medium | 5.4 | 2022-06-14 | Cross-site Scripting (XSS) - Stored in GitHub repository nocodb/nocodb prior to 0.91.7+. |
CVE-2022-29925 | High | 7.8 | 2022-06-14 | Access of uninitialized pointer vulnerability exists in the simulator module contained in the graphic editor 'V-SFT' versions prior to v6.1.6.0, which may allo… |
CVE-2022-29524 | High | 7.8 | 2022-06-14 | Out-of-bounds write vulnerability exists in V-Server v4.0.11.0 and earlier and V-Server Lite v4.0.13.0 and earlier, which may allow an attacker to obtain infor… |
CVE-2022-29522 | High | 7.8 | 2022-06-14 | Use after free vulnerability exists in the simulator module contained in the graphic editor 'V-SFT' versions prior to v6.1.6.0, which may allow an attacker to… |
CVE-2022-29509 | High | 7.5 | 2022-06-14 | Directory traversal vulnerability in T&D Data Server (Japanese Edition) Ver.2.22 and earlier, T&D Data Server (English Edition) Ver.2.30 and earlier, THERMO RE… |
CVE-2022-29506 | High | 7.8 | 2022-06-14 | Out-of-bounds read vulnerability exist in the simulator module contained in the graphic editor 'V-SFT' v6.1.3.0 and earlier, which may allow an attacker to obt… |
CVE-2022-29485 | Medium | 6.1 | 2022-06-14 | Cross-site scripting vulnerability in SHIRASAGI v1.0.0 to v1.14.2, and v1.15.0 allows a remote attacker to inject an arbitrary script via unspecified vectors. |
CVE-2022-29482 | Low | 3.7 | 2022-06-14 | 'Mobaoku-Auction&Flea Market' App for iOS versions prior to 5.5.16 improperly verifies server certificates, which may allow an attacker to eavesdrop on an encr… |
CVE-2022-27176 | High | 7.8 | 2022-06-14 | Incomplete filtering of special elements vulnerability exists in RevoWorks SCVX using 'File Sanitization Library' 1.043 and prior versions, RevoWorks Browser 2… |
CVE-2022-26302 | High | 7.8 | 2022-06-14 | Heap-based buffer overflow exists in the simulator module contained in the graphic editor 'V-SFT' versions prior to v6.1.6.0, which may allow an attacker to ob… |
CVE-2022-25167 | Critical | 9.8 | 2022-06-14 | Apache Flume versions 1.4.0 through 1.9.0 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with a JNDI LDAP data s… |
CVE-2022-31447 | High | 7.5 | 2022-06-14 | An XML external entity (XXE) injection vulnerability in Magicpin v3.4 allows attackers to access sensitive database information via a crafted SVG file. |
CVE-2022-31446 | Critical | 9.8 | 2022-06-14 | Tenda AC18 router V15.03.05.19 and V15.03.05.05 was discovered to contain a remote code execution (RCE) vulnerability via the Mac parameter at ip/goform/WriteF… |
CVE-2022-31415 | Medium | 6.5 | 2022-06-14 | Online Fire Reporting System v1.0 was discovered to contain a SQL injection vulnerability via the GET parameter in /report/list.php. |
CVE-2022-32565 | High | 7.5 | 2022-06-13 | An issue was discovered in Couchbase Server before 7.0.4. The Backup Service log leaks unredacted usernames and document ids. |
CVE-2022-32562 | High | 8.8 | 2022-06-13 | An issue was discovered in Couchbase Server before 7.0.4. Operations may succeed on a collection using stale RBAC permission. |
CVE-2022-32192 | High | 7.5 | 2022-06-13 | Couchbase Server 5.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor. |
CVE-2022-32278 | High | 8.8 | 2022-06-13 | XFCE 4.16 allows attackers to execute arbitrary code because xdg-open can execute a .desktop file on an attacker-controlled FTP server. |
CVE-2022-29257 | Medium | 6.6 | 2022-06-13 | Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta… |
CVE-2022-32564 | High | 7.5 | 2022-06-13 | An issue was discovered in Couchbase Server before 7.0.4. In couchbase-cli, server-eshell leaks the Cluster Manager cookie. |
CVE-2022-32560 | High | 7.5 | 2022-06-13 | An issue was discovered in Couchbase Server before 7.0.4. XDCR lacks role checking when changing internal settings. |
CVE-2022-32558 | High | 7.5 | 2022-06-13 | An issue was discovered in Couchbase Server before 7.0.4. Sample bucket loading may leak internal user passwords during a failure. |
CVE-2022-32193 | Medium | 6.5 | 2022-06-13 | Couchbase Server 6.6.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor. |
CVE-2022-29247 | Low | 2.2 | 2022-06-13 | Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta… |
CVE-2022-31054 | High | 7.5 | 2022-06-13 | Argo Events is an event-driven workflow automation framework for Kubernetes. Prior to version 1.7.1, several `HandleRoute` endpoints make use of the deprecated… |
CVE-2022-31053 | Critical | 9.8 | 2022-06-13 | Biscuit is an authentication and authorization token for microservices architectures. The Biscuit specification version 1 contains a vulnerable algorithm that… |
CVE-2022-29798 | High | 7.5 | 2022-06-13 | There is a denial of service vulnerability in CV81-WDM FW versions 01.70.49.29.46. Successful exploitation could cause denial of service. |
CVE-2022-29797 | Critical | 9.8 | 2022-06-13 | There is a buffer overflow vulnerability in CV81-WDM FW 01.70.49.29.46. Successful exploitation of this vulnerability may lead to privilege escalation. |
CVE-2022-22259 | Medium | 6.8 | 2022-06-13 | There is an improper authentication vulnerability in FLMG-10 10.0.1.0(H100SP22C00). Successful exploitation of this vulnerability may lead to a control of the… |
CVE-2022-33175 | Critical | 9.8 | 2022-06-13 | Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 have an insecure permissions setting on the user.token field that is acc… |
CVE-2022-33174 | Critical | 9.8 | 2022-06-13 | Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 allows remote authorization bypass in the web interface. To exploit the… |
CVE-2022-29455 | Medium | 4.7 | 2022-06-13 | DOM-based Reflected Cross-Site Scripting (XSS) vulnerability in Elementor's Elementor Website Builder plugin <= 3.5.5 versions. |
CVE-2022-28217 | Medium | 6.5 | 2022-06-13 | Some part of SAP NetWeaver (EP Web Page Composer) does not sufficiently validate an XML document accepted from an untrusted source, which allows an adversary t… |
CVE-2022-23169 | Medium | 5.9 | 2022-06-13 | attacker needs to craft a SQL payload. the vulnerable parameter is "agentid" must be authenticated to the admin panel. |
CVE-2022-23168 | Medium | 5.9 | 2022-06-13 | The attacker could get access to the database. The SQL injection is in the username parameter at the login panel: username: admin'-- |
CVE-2022-23167 | Medium | 5.3 | 2022-06-13 | Attacker crafts a GET request to: /mobile/downloadfile.aspx? Filename =../.. /windows/boot.ini the LFI is UNAUTHENTICATED. |
CVE-2022-31761 | High | 7.5 | 2022-06-13 | Configuration defects in the secure OS module. Successful exploitation of this vulnerability will affect confidentiality. |
CVE-2022-31760 | Critical | 9.1 | 2022-06-13 | Dialog boxes can still be displayed even if the screen is locked in carrier-customized USSD services. Successful exploitation of this vulnerability may affect… |
CVE-2022-31757 | High | 7.5 | 2022-06-13 | The setting module has a vulnerability of improper use of APIs. Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2022-31754 | High | 7.5 | 2022-06-13 | Logical defects in code implementation in some products. Successful exploitation of this vulnerability may affect the availability of some features. |
CVE-2022-31753 | High | 7.5 | 2022-06-13 | The voice wakeup module has a vulnerability of using externally-controlled format strings. Successful exploitation of this vulnerability may affect system avai… |
CVE-2022-31752 | Medium | 5.5 | 2022-06-13 | Missing authorization vulnerability in the system components. Successful exploitation of this vulnerability will affect confidentiality. |
CVE-2022-31055 | High | 7.5 | 2022-06-13 | kCTF is a Kubernetes-based infrastructure for capture the flag (CTF) competitions. Prior to version 1.6.0, the kctf cluster set-src-ip-ranges was broken and al… |
CVE-2022-31763 | Medium | 5.5 | 2022-06-13 | The kernel module has the null pointer and out-of-bounds array vulnerabilities. Successful exploitation of this vulnerability may affect system availability. |
CVE-2022-31762 | High | 7.8 | 2022-06-13 | The AMS module has a vulnerability in input validation. Successful exploitation of this vulnerability may cause privilege escalation. |
CVE-2022-31759 | Medium | 5.5 | 2022-06-13 | AppLink has a vulnerability of accessing uninitialized pointers. Successful exploitation of this vulnerability may affect system availability. |