2022 CVEs (page 196)
Page 196 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-2063 | High | 8.8 | 2022-06-13 | Improper Privilege Management in GitHub repository nocodb/nocodb prior to 0.91.7+. |
CVE-2022-2062 | High | 7.5 | 2022-06-13 | Generation of Error Message Containing Sensitive Information in GitHub repository nocodb/nocodb prior to 0.91.7+. |
CVE-2022-2061 | Low | 3.3 | 2022-06-13 | Heap-based Buffer Overflow in GitHub repository hpjansson/chafa prior to 1.12.0. |
CVE-2022-2060 | Medium | 5.4 | 2022-06-13 | Cross-site Scripting (XSS) - Stored in GitHub repository dolibarr/dolibarr prior to 16.0. |
CVE-2022-32741 | Medium | 5.3 | 2022-06-13 | Attacker is able to determine if the provided username exists (and it's valid) using Request New Password feature, based on the response time. |
CVE-2022-32740 | Low | 3.5 | 2022-06-13 | A reply to a forwarded email article by a 3rd party could unintensionally expose the email content to the ticket customer under certain circumstances. |
CVE-2022-32739 | Low | 3.5 | 2022-06-13 | When Secure::DisableBanner system configuration has been disabled and agent shares his calendar via public URL, received ICS file contains OTRS release number. |
CVE-2022-29894 | Medium | 4.8 | 2022-06-13 | Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function. By exploiting this vulnerability, an arbitrary… |
CVE-2022-29525 | Critical | 9.8 | 2022-06-13 | Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 uses a hard-coded credential which may allow a remote unauthenticated attacker to log in with the root privileg… |
CVE-2022-28704 | High | 7.2 | 2022-06-13 | Improper access control vulnerability in Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 allows a remote attacker to log in with the root privilege and perform… |
CVE-2022-27231 | Medium | 6.1 | 2022-06-13 | Cross-site scripting vulnerability exists in WP Statistics versions prior to 13.2.0 because it improperly processes a platform parameter. By exploiting this vu… |
CVE-2022-27174 | Medium | 4.3 | 2022-06-13 | Cross-site request forgery (CSRF) vulnerability in Easy Blog for EC-CUBE4 Ver.1.0.1 and earlier allows a remote unauthenticated attacker to hijack the authenti… |
CVE-2022-26834 | High | 7.5 | 2022-06-13 | Improper access control vulnerability in Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 allows a remote attacker to obtain the information stored in the produ… |
CVE-2022-26041 | Medium | 6.5 | 2022-06-13 | Directory traversal vulnerability in RCCMD 4.26 and earlier allows a remote authenticated attacker with an administrative privilege to read or alter an arbitra… |
CVE-2022-2013 | High | 7.5 | 2022-06-13 | In Octopus Server after version 2022.1.1495 and before 2022.1.2647 if private spaces were enabled via the experimental feature flag all new users would have ac… |
CVE-2022-2054 | High | 8.4 | 2022-06-12 | Code Injection in GitHub repository nuitka/nuitka prior to 0.9. |
CVE-2022-30780 | High | 7.5 | 2022-06-11 | Lighttpd 1.4.56 through 1.4.58 allows a remote attacker to cause a denial of service (CPU consumption from stuck connections) because connection_read_header_mo… |
CVE-2022-32981 | High | 7.8 | 2022-06-10 | An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR… |
CVE-2022-29095 | High | 8.3 | 2022-06-10 | Dell SupportAssist Client Consumer versions (3.10.4 and prior) and Dell SupportAssist Client Commercial versions (3.1.1 and prior) contain a cross-site scripti… |
CVE-2022-29094 | High | 7.1 | 2022-06-10 | Dell SupportAssist Client Consumer versions (3.10.4 and versions prior) and Dell SupportAssist Client Commercial versions (3.1.1 and versions prior) contain an… |
CVE-2022-29093 | High | 7.1 | 2022-06-10 | Dell SupportAssist Client Consumer versions (3.10.4 and versions prior) and Dell SupportAssist Client Commercial versions (3.1.1 and versions prior) contain an… |
CVE-2022-29092 | High | 7.8 | 2022-06-10 | Dell SupportAssist Client Consumer versions (3.11.0 and versions prior) and Dell SupportAssist Client Commercial versions (3.2.0 and versions prior) contain a… |
CVE-2022-25863 | High | 8.1 | 2022-06-10 | The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and before 3.15.2 are vulnerable to Deserialization of Untrusted Data when passing input through to the… |
CVE-2022-25851 | High | 7.5 | 2022-06-10 | The package jpeg-js before 0.4.4 are vulnerable to Denial of Service (DoS) where a particular piece of input will cause to enter an infinite loop and never ret… |
CVE-2022-25845 | High | 8.1 | 2022-06-10 | The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, whi… |
CVE-2022-24429 | High | 7.5 | 2022-06-10 | The package convert-svg-core before 0.6.3 are vulnerable to Arbitrary Code Injection when using a specially crafted SVG file. An attacker can read arbitrary fi… |
CVE-2022-24376 | High | 7.2 | 2022-06-10 | All versions of package git-promise are vulnerable to Command Injection due to an inappropriate fix of a prior [vulnerability](https://security.snyk.io/vuln/SN… |
CVE-2022-24278 | High | 7.5 | 2022-06-10 | The package convert-svg-core before 0.6.4 are vulnerable to Directory Traversal due to improper sanitization of SVG tags. Exploiting this vulnerability is poss… |
CVE-2022-21211 | Medium | 5.9 | 2022-06-10 | This affects all versions of package posix. When invoking the toString method, it will fallback to 0x0 value, as the value of toString is not invokable (not a… |
CVE-2022-2042 | High | 7.8 | 2022-06-10 | Use After Free in GitHub repository vim/vim prior to 8.2. |
CVE-2022-31287 | Medium | 5.5 | 2022-06-10 | An issue was discovered in Bento4 v1.2. There is an allocation size request error in /Ap4RtpAtom.cpp. |
CVE-2022-31285 | Medium | 5.5 | 2022-06-10 | An issue was discovered in Bento4 1.2. The allocator is out of memory in /Source/C++/Core/Ap4Array.h. |
CVE-2022-31282 | Medium | 5.5 | 2022-06-10 | Bento4 MP4Dump v1.2 was discovered to contain a segmentation violation via an unknown address at /Source/C++/Core/Ap4DataBuffer.cpp:175. |
CVE-2022-31402 | Medium | 6.1 | 2022-06-10 | ITOP v3.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via /itop/webservices/export-v2.php. |
CVE-2022-29948 | Medium | 4.6 | 2022-06-10 | Due to an insecure design, the Lepin EP-KP001 flash drive through KP001_V19 is vulnerable to an authentication bypass attack that enables an attacker to gain a… |
CVE-2022-31769 | Medium | 5.3 | 2022-06-10 | IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.15.0 could allow a remote attacker to view product configuration information stored in PostgreSQL, which… |
CVE-2022-30611 | Medium | 5.4 | 2022-06-10 | IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.15.0 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remot… |
CVE-2022-30610 | Medium | 4.5 | 2022-06-10 | IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.15.0 is vulnerable to reverse tabnabbing where it could allow a page linked to from within IBM Spectrum C… |
CVE-2022-22479 | High | 8.8 | 2022-06-10 | IBM Spectrum Copy Data Management 2.2.0.0through 2.2.15.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and un… |
CVE-2022-22426 | Low | 3.3 | 2022-06-10 | IBM Spectrum Copy Data Management Admin 2.2.0.0 through 2.2.15.0 could allow a local attacker to bypass authentication restrictions, caused by the lack of prop… |
CVE-2022-32978 | Medium | 6.5 | 2022-06-10 | There is an assertion failure in SingleComponentLSScan::ParseMCU in singlecomponentlsscan.cpp in libjpeg before 1.64 via an empty JPEG-LS scan. |
CVE-2022-31788 | Critical | 9.8 | 2022-06-10 | IdeaLMS 2022 allows SQL injection via the IdeaLMS/ChatRoom/ClassAccessControl/6?isBigBlueButton=0&ClassID= pathname. |
CVE-2022-27502 | High | 7.8 | 2022-06-10 | RealVNC VNC Server 6.9.0 through 5.1.0 for Windows allows local privilege escalation because an installer repair operation executes %TEMP% files as SYSTEM. |
CVE-2022-32563 | Critical | 9.8 | 2022-06-10 | An issue was discovered in Couchbase Sync Gateway 3.x before 3.0.2. Admin credentials are not verified when using X.509 client-certificate authentication from… |
CVE-2022-31043 | High | 7.5 | 2022-06-10 | Guzzle is an open source PHP HTTP client. In affected versions `Authorization` headers on requests are sensitive information. On making a request using the `ht… |
CVE-2022-31042 | High | 7.5 | 2022-06-10 | Guzzle is an open source PHP HTTP client. In affected versions the `Cookie` headers on requests are sensitive information. On making a request using the `https… |
CVE-2022-31045 | High | 7.0 | 2022-06-09 | Istio is an open platform to connect, manage, and secure microservices. In affected versions ill-formed headers sent to Envoy in certain configurations can lea… |
CVE-2022-30703 | High | 7.8 | 2022-06-09 | Trend Micro Security 2021 and 2022 (Consumer) is vulnerable to an exposed dangerous method vulnerability that could allow an attacker to obtain access to leake… |
CVE-2022-30702 | Medium | 5.5 | 2022-06-09 | Trend Micro Security 2022 and 2021 (Consumer) is vulnerable to an Out-Of-Bounds Read Information Disclosure vulnerability that could allow an attacker to discl… |
CVE-2022-21499 | Medium | 6.7 | 2022-06-09 | KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown. An attacker with access to a serial port could trigge… |
CVE-2022-31051 | Medium | 4.4 | 2022-06-09 | semantic-release is an open source npm package for automated version management and package publishing. In affected versions secrets that would normally be mas… |
CVE-2022-31033 | Medium | 5.9 | 2022-06-09 | The Mechanize library is used for automating interaction with websites. Mechanize automatically stores and sends cookies, follows redirects, and can follow lin… |
CVE-2022-29250 | High | 8.1 | 2022-06-09 | GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior t… |
CVE-2022-29228 | High | 7.5 | 2022-06-09 | Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter would try to invoke the remaining filters in the chain after emitt… |
CVE-2022-29227 | High | 7.5 | 2022-06-09 | Envoy is a cloud-native high-performance edge/middle/service proxy. In versions prior to 1.22.1 if Envoy attempts to send an internal redirect of an HTTP reque… |
CVE-2022-29226 | Critical | 10.0 | 2022-06-09 | Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter implementation does not include a mechanism for validating access… |
CVE-2022-29225 | High | 7.5 | 2022-06-09 | Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 secompressors accumulate decompressed data into an intermediate buffer before overw… |
CVE-2022-30898 | Medium | 6.5 | 2022-06-09 | A Cross-site request forgery (CSRF) vulnerability in Cscms music portal system v4.2 allows remote attackers to change the administrator's username and password. |
CVE-2022-29224 | Medium | 5.9 | 2022-06-09 | Envoy is a cloud-native high-performance proxy. Versions of envoy prior to 1.22.1 are subject to a segmentation fault in the GrpcHealthCheckerImpl. Envoy can p… |
CVE-2022-24876 | Medium | 5.4 | 2022-06-09 | GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Kanban is a GLPI vi… |
CVE-2022-31813 | Critical | 9.8 | 2022-06-09 | Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism… |
CVE-2022-31038 | Medium | 5.4 | 2022-06-09 | Gogs is an open source self-hosted Git service. In versions of gogs prior to 0.12.9 `DisplayName` does not filter characters input from users, which leads to a… |
CVE-2022-30556 | High | 7.5 | 2022-06-09 | Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer. |
CVE-2022-30522 | High | 7.5 | 2022-06-09 | If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excess… |
CVE-2022-2037 | High | 8.0 | 2022-06-09 | Excessive Attack Surface in GitHub repository tooljet/tooljet prior to v1.16.0. |
CVE-2022-2036 | Medium | 5.4 | 2022-06-09 | Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0.1. |
CVE-2022-2029 | Medium | 5.4 | 2022-06-09 | Cross-site Scripting (XSS) - DOM in GitHub repository kromitgmbh/titra prior to 0.77.0. |
CVE-2022-2028 | Medium | 5.4 | 2022-06-09 | Cross-site Scripting (XSS) - Generic in GitHub repository kromitgmbh/titra prior to 0.77.0. |
CVE-2022-2027 | High | 8.0 | 2022-06-09 | Improper Neutralization of Formula Elements in a CSV File in GitHub repository kromitgmbh/titra prior to 0.77.0. |
CVE-2022-2026 | Medium | 5.4 | 2022-06-09 | Cross-site Scripting (XSS) - Stored in GitHub repository kromitgmbh/titra prior to 0.77.0. |
CVE-2022-2015 | Medium | 5.4 | 2022-06-09 | Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 19.0.2. |
CVE-2022-2014 | Medium | 5.4 | 2022-06-09 | Code Injection in GitHub repository jgraph/drawio prior to 19.0.2. |
CVE-2022-29404 | High | 7.5 | 2022-06-09 | In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit o… |
CVE-2022-28615 | Critical | 9.1 | 2022-06-09 | Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large… |
CVE-2022-28614 | Medium | 5.3 | 2022-06-09 | The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input us… |
CVE-2022-28330 | Medium | 5.3 | 2022-06-09 | Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module. |
CVE-2022-26377 | High | 7.5 | 2022-06-09 | Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requ… |
CVE-2022-26364 | Medium | 6.7 | 2022-06-09 | x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cor… |
CVE-2022-26363 | Medium | 6.7 | 2022-06-09 | x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cor… |
CVE-2022-26362 | Medium | 6.4 | 2022-06-09 | x86 pv: Race condition in typeref acquisition Xen maintains a type reference count for pages, in addition to a regular reference count. This scheme is used to… |
CVE-2022-25153 | High | 7.8 | 2022-06-09 | The ITarian Endpoint Manage Communication Client, prior to version 6.43.41148.21120, is compiled using insecure OpenSSL settings. Due to this setting, a malici… |
CVE-2022-25152 | Critical | 9.9 | 2022-06-09 | The ITarian platform (SAAS / on-premise) offers the possibility to run code on agents via a function called procedures. It is possible to require a mandatory a… |
CVE-2022-25151 | High | 7.5 | 2022-06-09 | Within the Service Desk module of the ITarian platform (SAAS and on-premise), a remote attacker can obtain sensitive information, caused by the failure to set… |
CVE-2022-1993 | High | 8.1 | 2022-06-09 | Path Traversal in GitHub repository gogs/gogs prior to 0.12.9. |
CVE-2022-1992 | Critical | 9.1 | 2022-06-09 | Path Traversal in GitHub repository gogs/gogs prior to 0.12.9. |
CVE-2022-1986 | Critical | 9.8 | 2022-06-09 | OS Command Injection in GitHub repository gogs/gogs prior to 0.12.9. |
CVE-2022-31214 | High | 7.8 | 2022-06-09 | A Privilege Context Switching issue was discovered in join.c in Firejail 0.9.68. By crafting a bogus Firejail container that is accepted by the Firejail setuid… |
CVE-2022-31031 | Critical | 9.8 | 2022-06-09 | PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN… |
CVE-2022-30760 | Medium | 4.3 | 2022-06-09 | An Insecure Direct Object Reference (IDOR) issue in fn2Web in ihb eG FlexNow before 2.04.09.016 allows remote authenticated attackers to obtain sensitive stude… |
CVE-2022-2020 | Low | 2.4 | 2022-06-09 | A vulnerability, which was classified as problematic, has been found in SourceCodester Prison Management System 1.0. Affected by this issue is some unknown fun… |
CVE-2022-2019 | High | 7.3 | 2022-06-09 | A vulnerability classified as critical was found in SourceCodester Prison Management System 1.0. Affected by this vulnerability is an unknown functionality of… |
CVE-2022-2018 | Medium | 4.7 | 2022-06-09 | A vulnerability classified as critical has been found in SourceCodester Prison Management System 1.0. Affected is an unknown function of the file /admin/?page=… |
CVE-2022-2017 | Medium | 4.7 | 2022-06-09 | A vulnerability was found in SourceCodester Prison Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file… |
CVE-2022-2016 | Medium | 5.4 | 2022-06-09 | Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.1. |
CVE-2022-2000 | High | 7.8 | 2022-06-09 | Out-of-bounds Write in GitHub repository vim/vim prior to 8.2. |
CVE-2022-24969 | Medium | 6.1 | 2022-06-09 | bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host check which can caus… |
CVE-2022-0823 | Medium | 6.2 | 2022-06-09 | An improper control of interaction frequency vulnerability in Zyxel GS1200 series switches could allow a local attacker to guess the password by using a timing… |
CVE-2022-32272 | Critical | 9.8 | 2022-06-09 | OPSWAT MetaDefender Core before 5.1.2, MetaDefender ICAP before 4.12.1, and MetaDefender Email Gateway Security before 5.6.1 have incorrect access control, res… |
CVE-2022-2035 | Medium | 6.1 | 2022-06-09 | A reflected cross-site scripting (XSS) vulnerability exists in the playerConfUrl parameter in the /defaultui/player/modern.html file for SCORM Engine versions… |
CVE-2022-23138 | High | 7.5 | 2022-06-09 | ZTE's MF297D product has cryptographic issues vulnerability. Due to the use of weak random values, the security of the device is reduced, and it may face the r… |