2022 CVEs (page 196)
Page 196 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-29093 | High | 7.1 | 2022-06-10 | Dell SupportAssist Client Consumer versions (3.10.4 and versions prior) and Dell SupportAssist Client Commercial versions (3.1.1 and versions prior) contain an… |
CVE-2022-29092 | High | 7.8 | 2022-06-10 | Dell SupportAssist Client Consumer versions (3.11.0 and versions prior) and Dell SupportAssist Client Commercial versions (3.2.0 and versions prior) contain a… |
CVE-2022-25863 | High | 8.1 | 2022-06-10 | The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and before 3.15.2 are vulnerable to Deserialization of Untrusted Data when passing input through to the… |
CVE-2022-25851 | High | 7.5 | 2022-06-10 | The package jpeg-js before 0.4.4 are vulnerable to Denial of Service (DoS) where a particular piece of input will cause to enter an infinite loop and never ret… |
CVE-2022-25845 | High | 8.1 | 2022-06-10 | The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, whi… |
CVE-2022-24429 | High | 7.5 | 2022-06-10 | The package convert-svg-core before 0.6.3 are vulnerable to Arbitrary Code Injection when using a specially crafted SVG file. An attacker can read arbitrary fi… |
CVE-2022-24376 | High | 7.2 | 2022-06-10 | All versions of package git-promise are vulnerable to Command Injection due to an inappropriate fix of a prior [vulnerability](https://security.snyk.io/vuln/SN… |
CVE-2022-24278 | High | 7.5 | 2022-06-10 | The package convert-svg-core before 0.6.4 are vulnerable to Directory Traversal due to improper sanitization of SVG tags. Exploiting this vulnerability is poss… |
CVE-2022-21211 | Medium | 5.9 | 2022-06-10 | This affects all versions of package posix. When invoking the toString method, it will fallback to 0x0 value, as the value of toString is not invokable (not a… |
CVE-2022-2042 | High | 7.8 | 2022-06-10 | Use After Free in GitHub repository vim/vim prior to 8.2. |
CVE-2022-31287 | Medium | 5.5 | 2022-06-10 | An issue was discovered in Bento4 v1.2. There is an allocation size request error in /Ap4RtpAtom.cpp. |
CVE-2022-31285 | Medium | 5.5 | 2022-06-10 | An issue was discovered in Bento4 1.2. The allocator is out of memory in /Source/C++/Core/Ap4Array.h. |
CVE-2022-31282 | Medium | 5.5 | 2022-06-10 | Bento4 MP4Dump v1.2 was discovered to contain a segmentation violation via an unknown address at /Source/C++/Core/Ap4DataBuffer.cpp:175. |
CVE-2022-31402 | Medium | 6.1 | 2022-06-10 | ITOP v3.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via /itop/webservices/export-v2.php. |
CVE-2022-29948 | Medium | 4.6 | 2022-06-10 | Due to an insecure design, the Lepin EP-KP001 flash drive through KP001_V19 is vulnerable to an authentication bypass attack that enables an attacker to gain a… |
CVE-2022-31769 | Medium | 5.3 | 2022-06-10 | IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.15.0 could allow a remote attacker to view product configuration information stored in PostgreSQL, which… |
CVE-2022-30611 | Medium | 5.4 | 2022-06-10 | IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.15.0 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remot… |
CVE-2022-30610 | Medium | 4.5 | 2022-06-10 | IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.15.0 is vulnerable to reverse tabnabbing where it could allow a page linked to from within IBM Spectrum C… |
CVE-2022-22479 | High | 8.8 | 2022-06-10 | IBM Spectrum Copy Data Management 2.2.0.0through 2.2.15.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and un… |
CVE-2022-22426 | Low | 3.3 | 2022-06-10 | IBM Spectrum Copy Data Management Admin 2.2.0.0 through 2.2.15.0 could allow a local attacker to bypass authentication restrictions, caused by the lack of prop… |
CVE-2022-32978 | Medium | 6.5 | 2022-06-10 | There is an assertion failure in SingleComponentLSScan::ParseMCU in singlecomponentlsscan.cpp in libjpeg before 1.64 via an empty JPEG-LS scan. |
CVE-2022-31788 | Critical | 9.8 | 2022-06-10 | IdeaLMS 2022 allows SQL injection via the IdeaLMS/ChatRoom/ClassAccessControl/6?isBigBlueButton=0&ClassID= pathname. |
CVE-2022-27502 | High | 7.8 | 2022-06-10 | RealVNC VNC Server 6.9.0 through 5.1.0 for Windows allows local privilege escalation because an installer repair operation executes %TEMP% files as SYSTEM. |
CVE-2022-32563 | Critical | 9.8 | 2022-06-10 | An issue was discovered in Couchbase Sync Gateway 3.x before 3.0.2. Admin credentials are not verified when using X.509 client-certificate authentication from… |
CVE-2022-31043 | High | 7.5 | 2022-06-10 | Guzzle is an open source PHP HTTP client. In affected versions `Authorization` headers on requests are sensitive information. On making a request using the `ht… |
CVE-2022-31042 | High | 7.5 | 2022-06-10 | Guzzle is an open source PHP HTTP client. In affected versions the `Cookie` headers on requests are sensitive information. On making a request using the `https… |
CVE-2022-31045 | High | 7.0 | 2022-06-09 | Istio is an open platform to connect, manage, and secure microservices. In affected versions ill-formed headers sent to Envoy in certain configurations can lea… |
CVE-2022-30703 | High | 7.8 | 2022-06-09 | Trend Micro Security 2021 and 2022 (Consumer) is vulnerable to an exposed dangerous method vulnerability that could allow an attacker to obtain access to leake… |
CVE-2022-30702 | Medium | 5.5 | 2022-06-09 | Trend Micro Security 2022 and 2021 (Consumer) is vulnerable to an Out-Of-Bounds Read Information Disclosure vulnerability that could allow an attacker to discl… |
CVE-2022-21499 | Medium | 6.7 | 2022-06-09 | KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown. An attacker with access to a serial port could trigge… |
CVE-2022-31051 | Medium | 4.4 | 2022-06-09 | semantic-release is an open source npm package for automated version management and package publishing. In affected versions secrets that would normally be mas… |
CVE-2022-31033 | Medium | 5.9 | 2022-06-09 | The Mechanize library is used for automating interaction with websites. Mechanize automatically stores and sends cookies, follows redirects, and can follow lin… |
CVE-2022-29250 | High | 8.1 | 2022-06-09 | GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior t… |
CVE-2022-29228 | High | 7.5 | 2022-06-09 | Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter would try to invoke the remaining filters in the chain after emitt… |
CVE-2022-29227 | High | 7.5 | 2022-06-09 | Envoy is a cloud-native high-performance edge/middle/service proxy. In versions prior to 1.22.1 if Envoy attempts to send an internal redirect of an HTTP reque… |
CVE-2022-29226 | Critical | 10.0 | 2022-06-09 | Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter implementation does not include a mechanism for validating access… |
CVE-2022-29225 | High | 7.5 | 2022-06-09 | Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 secompressors accumulate decompressed data into an intermediate buffer before overw… |
CVE-2022-30898 | Medium | 6.5 | 2022-06-09 | A Cross-site request forgery (CSRF) vulnerability in Cscms music portal system v4.2 allows remote attackers to change the administrator's username and password. |
CVE-2022-29224 | Medium | 5.9 | 2022-06-09 | Envoy is a cloud-native high-performance proxy. Versions of envoy prior to 1.22.1 are subject to a segmentation fault in the GrpcHealthCheckerImpl. Envoy can p… |
CVE-2022-24876 | Medium | 5.4 | 2022-06-09 | GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Kanban is a GLPI vi… |
CVE-2022-31813 | Critical | 9.8 | 2022-06-09 | Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism… |
CVE-2022-31038 | Medium | 5.4 | 2022-06-09 | Gogs is an open source self-hosted Git service. In versions of gogs prior to 0.12.9 `DisplayName` does not filter characters input from users, which leads to a… |
CVE-2022-30556 | High | 7.5 | 2022-06-09 | Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer. |
CVE-2022-30522 | High | 7.5 | 2022-06-09 | If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excess… |
CVE-2022-2037 | High | 8.0 | 2022-06-09 | Excessive Attack Surface in GitHub repository tooljet/tooljet prior to v1.16.0. |
CVE-2022-2036 | Medium | 5.4 | 2022-06-09 | Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0.1. |
CVE-2022-2029 | Medium | 5.4 | 2022-06-09 | Cross-site Scripting (XSS) - DOM in GitHub repository kromitgmbh/titra prior to 0.77.0. |
CVE-2022-2028 | Medium | 5.4 | 2022-06-09 | Cross-site Scripting (XSS) - Generic in GitHub repository kromitgmbh/titra prior to 0.77.0. |
CVE-2022-2027 | High | 8.0 | 2022-06-09 | Improper Neutralization of Formula Elements in a CSV File in GitHub repository kromitgmbh/titra prior to 0.77.0. |
CVE-2022-2026 | Medium | 5.4 | 2022-06-09 | Cross-site Scripting (XSS) - Stored in GitHub repository kromitgmbh/titra prior to 0.77.0. |
CVE-2022-2015 | Medium | 5.4 | 2022-06-09 | Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 19.0.2. |
CVE-2022-2014 | Medium | 5.4 | 2022-06-09 | Code Injection in GitHub repository jgraph/drawio prior to 19.0.2. |
CVE-2022-29404 | High | 7.5 | 2022-06-09 | In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit o… |
CVE-2022-28615 | Critical | 9.1 | 2022-06-09 | Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large… |
CVE-2022-28614 | Medium | 5.3 | 2022-06-09 | The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input us… |
CVE-2022-28330 | Medium | 5.3 | 2022-06-09 | Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module. |
CVE-2022-26377 | High | 7.5 | 2022-06-09 | Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requ… |
CVE-2022-26364 | Medium | 6.7 | 2022-06-09 | x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cor… |
CVE-2022-26363 | Medium | 6.7 | 2022-06-09 | x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cor… |
CVE-2022-26362 | Medium | 6.4 | 2022-06-09 | x86 pv: Race condition in typeref acquisition Xen maintains a type reference count for pages, in addition to a regular reference count. This scheme is used to… |
CVE-2022-25153 | High | 7.8 | 2022-06-09 | The ITarian Endpoint Manage Communication Client, prior to version 6.43.41148.21120, is compiled using insecure OpenSSL settings. Due to this setting, a malici… |
CVE-2022-25152 | Critical | 9.9 | 2022-06-09 | The ITarian platform (SAAS / on-premise) offers the possibility to run code on agents via a function called procedures. It is possible to require a mandatory a… |
CVE-2022-25151 | High | 7.5 | 2022-06-09 | Within the Service Desk module of the ITarian platform (SAAS and on-premise), a remote attacker can obtain sensitive information, caused by the failure to set… |
CVE-2022-1993 | High | 8.1 | 2022-06-09 | Path Traversal in GitHub repository gogs/gogs prior to 0.12.9. |
CVE-2022-1992 | Critical | 9.1 | 2022-06-09 | Path Traversal in GitHub repository gogs/gogs prior to 0.12.9. |
CVE-2022-1986 | Critical | 9.8 | 2022-06-09 | OS Command Injection in GitHub repository gogs/gogs prior to 0.12.9. |
CVE-2022-31214 | High | 7.8 | 2022-06-09 | A Privilege Context Switching issue was discovered in join.c in Firejail 0.9.68. By crafting a bogus Firejail container that is accepted by the Firejail setuid… |
CVE-2022-31031 | Critical | 9.8 | 2022-06-09 | PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN… |
CVE-2022-30760 | Medium | 4.3 | 2022-06-09 | An Insecure Direct Object Reference (IDOR) issue in fn2Web in ihb eG FlexNow before 2.04.09.016 allows remote authenticated attackers to obtain sensitive stude… |
CVE-2022-2020 | Low | 2.4 | 2022-06-09 | A vulnerability, which was classified as problematic, has been found in SourceCodester Prison Management System 1.0. Affected by this issue is some unknown fun… |
CVE-2022-2019 | High | 7.3 | 2022-06-09 | A vulnerability classified as critical was found in SourceCodester Prison Management System 1.0. Affected by this vulnerability is an unknown functionality of… |
CVE-2022-2018 | Medium | 4.7 | 2022-06-09 | A vulnerability classified as critical has been found in SourceCodester Prison Management System 1.0. Affected is an unknown function of the file /admin/?page=… |
CVE-2022-2017 | Medium | 4.7 | 2022-06-09 | A vulnerability was found in SourceCodester Prison Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file… |
CVE-2022-2016 | Medium | 5.4 | 2022-06-09 | Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.1. |
CVE-2022-2000 | High | 7.8 | 2022-06-09 | Out-of-bounds Write in GitHub repository vim/vim prior to 8.2. |
CVE-2022-24969 | Medium | 6.1 | 2022-06-09 | bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host check which can caus… |
CVE-2022-0823 | Medium | 6.2 | 2022-06-09 | An improper control of interaction frequency vulnerability in Zyxel GS1200 series switches could allow a local attacker to guess the password by using a timing… |
CVE-2022-32272 | Critical | 9.8 | 2022-06-09 | OPSWAT MetaDefender Core before 5.1.2, MetaDefender ICAP before 4.12.1, and MetaDefender Email Gateway Security before 5.6.1 have incorrect access control, res… |
CVE-2022-2035 | Medium | 6.1 | 2022-06-09 | A reflected cross-site scripting (XSS) vulnerability exists in the playerConfUrl parameter in the /defaultui/player/modern.html file for SCORM Engine versions… |
CVE-2022-23138 | High | 7.5 | 2022-06-09 | ZTE's MF297D product has cryptographic issues vulnerability. Due to the use of weak random values, the security of the device is reduced, and it may face the r… |
CVE-2022-1998 | High | 7.8 | 2022-06-09 | A use after free in the Linux kernel File System notify functionality was found in the way user triggers copy_info_records_to_user() call to fail in copy_event… |
CVE-2022-31830 | Critical | 9.1 | 2022-06-09 | Kity Minder v1.3.5 was discovered to contain a Server-Side Request Forgery (SSRF) via the init function at ImageCapture.class.php. |
CVE-2022-31827 | Critical | 9.1 | 2022-06-09 | MonstaFTP v2.10.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the function performFetchRequest at HTTPFetcher.php. |
CVE-2022-31393 | Critical | 9.1 | 2022-06-09 | Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Index function in app/admin/c/PluginsController.php. |
CVE-2022-31390 | Critical | 9.1 | 2022-06-09 | Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Update function in app/admin/c/TemplateController.php. |
CVE-2022-31386 | Critical | 9.1 | 2022-06-09 | A Server-Side Request Forgery (SSRF) in the getFileBinary function of nbnbk cms 3 allows attackers to force the application to make arbitrary requests via inje… |
CVE-2022-31030 | Medium | 5.5 | 2022-06-09 | containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containe… |
CVE-2022-31027 | Medium | 4.2 | 2022-06-09 | OAuthenticator is an OAuth token library for the JupyerHub login handler. CILogonOAuthenticator is provided by the OAuthenticator package, and lets users log i… |
CVE-2022-31026 | Medium | 5.9 | 2022-06-09 | Trilogy is a client library for MySQL. When authenticating, a malicious server could return a specially crafted authentication packet, causing the client to re… |
CVE-2022-31019 | High | 7.5 | 2022-06-09 | Vapor is a server-side Swift HTTP web framework. When using automatic content decoding an attacker can craft a request body that can make the server crash with… |
CVE-2022-29255 | High | 8.2 | 2022-06-09 | Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions prior to 0.3.4 when a calling an external contract with no return val… |
CVE-2022-29254 | Low | 3.7 | 2022-06-09 | silverstripe-omnipay is a SilverStripe integration with Omnipay PHP payments library. For a subset of Omnipay gateways (those that use intermediary states like… |
CVE-2022-24896 | Medium | 4.3 | 2022-06-09 | Tuleap is a Free & Open Source Suite to manage software developments and collaboration. In versions prior to 13.7.99.239 Tuleap does not properly verify author… |
CVE-2022-32195 | Medium | 6.1 | 2022-06-09 | Open edX platform before 2022-06-06 allows XSS via the "next" parameter in the logout URL. |
CVE-2022-31649 | High | 7.5 | 2022-06-09 | ownCloud owncloud/core before 10.10.0 Improperly Removes Sensitive Information Before Storage or Transfer. |
CVE-2022-30075 | High | 8.8 | 2022-06-09 | In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to remote code execution due to improper validat… |
CVE-2022-25807 | Medium | 5.5 | 2022-06-09 | An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. A hardcoded DES key in the LDAPDesPWEncrypter class allows an attacker, who has… |
CVE-2022-25806 | High | 8.8 | 2022-06-09 | An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. A hardcoded DES key in the PrefDBCredentials class allows an attacker, who has d… |
CVE-2022-25805 | Medium | 6.5 | 2022-06-09 | An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. The transmission of cleartext LDAP bind credentials by the cmd_mgt_load_mgt_tree… |
CVE-2022-25804 | Medium | 5.5 | 2022-06-09 | An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. Insecure permissions for the serverconfig registry key (under JavaSoft\Prefs\de\… |