2022 CVEs (page 198)
Page 198 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-30727 | Medium | 6.2 | 2022-06-07 | Improper handling of insufficient permissions vulnerability in addAppPackageNameToAllowList in PersonaManagerService prior to SMR Jun-2022 Release 1 allows loc… |
CVE-2022-30729 | Low | 3.3 | 2022-06-07 | Implicit Intent hijacking vulnerability in Settings prior to SMR Jun-2022 Release 1 allows attackers to get Wi-Fi SSID and password via a malicious QR code sca… |
CVE-2022-30726 | Medium | 6.2 | 2022-06-07 | Unprotected component vulnerability in DeviceSearchTrampoline in SecSettingsIntelligence prior to SMR Jun-2022 Release 1 allows local attackers to launch activ… |
CVE-2022-30725 | Medium | 4.0 | 2022-06-07 | Broadcasting Intent including the BluetoothDevice object without proper restriction of receivers in sendIntentSessionError function of Bluetooth prior to SMR J… |
CVE-2022-30724 | Medium | 4.0 | 2022-06-07 | Broadcasting Intent including the BluetoothDevice object without proper restriction of receivers in sendIntentSessionCompleted function of Bluetooth prior to S… |
CVE-2022-30723 | Medium | 4.0 | 2022-06-07 | Broadcasting Intent including the BluetoothDevice object without proper restriction of receivers in activateVoiceRecognitionWithDevice function of Bluetooth pr… |
CVE-2022-30722 | Medium | 6.2 | 2022-06-07 | Implicit Intent hijacking vulnerability in Samsung Account prior to SMR Jun-2022 Release 1 allows attackers to bypass user confirmation of Samsung Account. |
CVE-2022-30721 | Low | 2.5 | 2022-06-07 | Improper input validation check logic vulnerability in libsmkvextractor prior to SMR Jun-2022 Release 1 allows attackers to trigger crash. |
CVE-2022-30720 | Low | 2.5 | 2022-06-07 | Improper input validation check logic vulnerability in libsmkvextractor prior to SMR Jun-2022 Release 1 allows attackers to trigger crash. |
CVE-2022-30719 | Low | 2.5 | 2022-06-07 | Improper input validation check logic vulnerability in libsmkvextractor prior to SMR Jun-2022 Release 1 allows attackers to trigger crash. |
CVE-2022-30717 | Medium | 4.0 | 2022-06-07 | Improper caller check in AR Emoji prior to SMR Jun-2022 Release 1 allows untrusted applications to use some camera functions via deeplink. |
CVE-2022-30716 | Medium | 4.0 | 2022-06-07 | Unprotected broadcast in sendIntentForToastDumpLog in DisplayToast prior to SMR Jun-2022 Release 1 allows untrusted applications to access toast message inform… |
CVE-2022-30715 | Medium | 4.0 | 2022-06-07 | Improper access control vulnerability in DofViewer prior to SMR Jun-2022 Release 1 allows attackers to control floating system alert window. |
CVE-2022-30714 | Low | 1.9 | 2022-06-07 | Information exposure vulnerability in SemIWCMonitor prior to SMR Jun-2022 Release 1 allows local attackers to get MAC address information. |
CVE-2022-30713 | High | 8.5 | 2022-06-07 | Improper validation vulnerability in LSOItemData prior to SMR Jun-2022 Release 1 allows attackers to launch certain activities. |
CVE-2022-30712 | High | 8.5 | 2022-06-07 | Improper validation vulnerability in KfaOptions prior to SMR Jun-2022 Release 1 allows attackers to launch certain activities. |
CVE-2022-30711 | High | 8.5 | 2022-06-07 | Improper validation vulnerability in FeedsInfo prior to SMR Jun-2022 Release 1 allows attackers to launch certain activities. |
CVE-2022-30710 | High | 8.5 | 2022-06-07 | Improper validation vulnerability in RemoteViews prior to SMR Jun-2022 Release 1 allows attackers to launch certain activities. |
CVE-2022-30709 | Low | 2.5 | 2022-06-07 | Improper input validation check logic vulnerability in SECRIL prior to SMR Jun-2022 Release 1 allows attackers to trigger crash. |
CVE-2022-28794 | Low | 2.2 | 2022-06-07 | Sensitive information exposure in low-battery dumpstate log prior to SMR Jun-2022 Release 1 allows local attackers to get SIM card information. |
CVE-2022-1708 | High | 7.5 | 2022-06-07 | A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs co… |
CVE-2022-31028 | High | 7.5 | 2022-06-07 | MinIO is a multi-cloud object storage solution. Starting with version RELEASE.2019-09-25T18-25-51Z and ending with version RELEASE.2022-06-02T02-11-04Z, MinIO… |
CVE-2022-31495 | Medium | 6.1 | 2022-06-07 | LibreHealth EHR Base 2.0.0 allows gacl/admin/acl_admin.php return_page XSS. |
CVE-2022-31025 | Low | 2.6 | 2022-06-07 | Discourse is an open source platform for community discussion. Prior to version 2.8.4 on the `stable` branch and 2.9.0beta5 on the `beta` and `tests-passed` br… |
CVE-2022-29564 | High | 7.5 | 2022-06-07 | Jamf Private Access before 2022-05-16 has Incorrect Access Control, in which an unauthorized user can reach a system in the internal infrastructure, aka WND-44… |
CVE-2022-25361 | Critical | 9.1 | 2022-06-07 | WatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to delete arbitrary files from a limited set of directories on the system. This… |
CVE-2022-1991 | Low | 3.5 | 2022-06-07 | A vulnerability classified as problematic has been found in Fast Food Ordering System 1.0. Affected is the file Master.php of the Master List. The manipulation… |
CVE-2022-31494 | Medium | 6.1 | 2022-06-06 | LibreHealth EHR Base 2.0.0 allows gacl/admin/acl_admin.php action XSS. |
CVE-2022-30927 | Critical | 9.8 | 2022-06-06 | A SQL injection vulnerability exists in Simple Task Scheduling System 1.0 when MySQL is being used as the application database. An attacker can issue SQL comma… |
CVE-2022-29296 | Medium | 6.1 | 2022-06-06 | A reflected cross-site scripting (XSS) vulnerability in the login portal of Avantune Genialcloud ProJ - 10 allows attackers to execute arbitrary web scripts or… |
CVE-2022-28479 | Medium | 4.8 | 2022-06-06 | SeedDMS versions 6.0.18 and 5.1.25 and below are vulnerable to stored XSS. An attacker with admin privileges can inject the payload inside the "Role management… |
CVE-2022-28478 | Medium | 6.5 | 2022-06-06 | SeedDMS 6.0.17 and 5.1.24 are vulnerable to Directory Traversal. The "Remove file" functionality inside the "Log files management" menu does not sanitize user… |
CVE-2022-28051 | Medium | 5.4 | 2022-06-06 | The "Add category" functionality inside the "Global Keywords" menu in "SeedDMS" version 6.0.18 and 5.1.25, is prone to stored XSS which allows an attacker to i… |
CVE-2022-27438 | High | 8.1 | 2022-06-06 | Caphyon Ltd Advanced Installer 19.3 and earlier and many products that use the updater from Advanced Installer (Advanced Updater) are affected by a remote code… |
CVE-2022-32511 | Critical | 9.8 | 2022-06-06 | jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable. |
CVE-2022-31498 | Medium | 6.1 | 2022-06-06 | LibreHealth EHR Base 2.0.0 allows interface/orders/patient_match_dialog.php key XSS. |
CVE-2022-30469 | High | 8.8 | 2022-06-06 | In Afian Filerun 20220202, lack of sanitization of the POST parameter "metadata[]" in `/?module=fileman§ion=get&page=grid` leads to SQL injection. |
CVE-2022-29631 | High | 7.5 | 2022-06-06 | Jodd HTTP v6.0.9 was discovered to contain multiple CLRF injection vulnerabilities via the components jodd.http.HttpRequest#set and `jodd.http.HttpRequest#send… |
CVE-2022-31492 | Medium | 6.1 | 2022-06-06 | Cross Site scripting (XSS) vulnerability inLibreHealth EHR Base 2.0.0 via interface/usergroup/usergroup_admin_add.php Username. |
CVE-2022-30587 | High | 7.5 | 2022-06-06 | Gradle Enterprise through 2022.2.2 has Incorrect Access Control that leads to information disclosure. |
CVE-2022-29617 | Medium | 6.5 | 2022-06-06 | Due to improper error handling an authenticated user can crash CLA assistant instance. This could impact the availability of the application. |
CVE-2022-32275 | High | 7.5 | 2022-06-06 | Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. /.. /.. /.. /.. /.. /.. /.. /etc/passwd URI. NOTE… |
CVE-2022-31768 | Critical | 9.8 | 2022-06-06 | IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the att… |
CVE-2022-31493 | Medium | 6.1 | 2022-06-06 | LibreHealth EHR Base 2.0.0 allows gacl/admin/acl_admin.php acl_id XSS. |
CVE-2022-30586 | High | 7.2 | 2022-06-06 | Gradle Enterprise through 2022.2.2 has Incorrect Access Control that leads to code execution. |
CVE-2022-22396 | High | 7.5 | 2022-06-06 | Credentials are printed in clear text in the IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.3 virgo log file in certain cases. Credentials could be the remo… |
CVE-2022-28224 | Medium | 5.5 | 2022-06-06 | Clusters using Calico (version 3.22.1 and below), Calico Enterprise (version 3.12.0 and below), may be vulnerable to route hijacking with the floating IP featu… |
CVE-2022-23712 | High | 7.5 | 2022-06-06 | A Denial of Service flaw was discovered in Elasticsearch. Using this vulnerability, an unauthenticated attacker could forcibly shut down an Elasticsearch node… |
CVE-2022-21762 | Medium | 4.4 | 2022-06-06 | In apusys driver, there is a possible system crash due to an integer overflow. This could lead to local denial of service with System execution privileges need… |
CVE-2022-21761 | Medium | 4.4 | 2022-06-06 | In apusys driver, there is a possible system crash due to an integer overflow. This could lead to local denial of service with System execution privileges need… |
CVE-2022-21760 | Medium | 4.4 | 2022-06-06 | In apusys driver, there is a possible system crash due to an integer overflow. This could lead to local denial of service with System execution privileges need… |
CVE-2022-21759 | Medium | 6.7 | 2022-06-06 | In power service, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution… |
CVE-2022-21758 | Medium | 6.7 | 2022-06-06 | In ccu, there is a possible memory corruption due to a double free. This could lead to local escalation of privilege with System execution privileges needed. U… |
CVE-2022-21757 | High | 7.5 | 2022-06-06 | In WIFI Firmware, there is a possible system crash due to a missing count check. This could lead to remote denial of service with no additional execution privi… |
CVE-2022-21756 | Medium | 4.4 | 2022-06-06 | In WLAN driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution… |
CVE-2022-21755 | Medium | 4.4 | 2022-06-06 | In WLAN driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution… |
CVE-2022-21754 | Medium | 6.7 | 2022-06-06 | In WLAN driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2022-21753 | Medium | 6.7 | 2022-06-06 | In WLAN driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2022-21752 | Medium | 6.7 | 2022-06-06 | In WLAN driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2022-21751 | Medium | 6.7 | 2022-06-06 | In WLAN driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2022-21750 | Medium | 6.7 | 2022-06-06 | In WLAN driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2022-21749 | Medium | 5.5 | 2022-06-06 | In telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional… |
CVE-2022-21748 | Medium | 5.5 | 2022-06-06 | In telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with User execution… |
CVE-2022-21747 | Medium | 4.4 | 2022-06-06 | In imgsensor, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges… |
CVE-2022-21746 | Medium | 4.4 | 2022-06-06 | In imgsensor, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges… |
CVE-2022-21745 | High | 8.8 | 2022-06-06 | In WIFI Firmware, there is a possible memory corruption due to a use after free. This could lead to remote escalation of privilege, when devices are connecting… |
CVE-2022-1680 | Critical | 9.9 | 2022-06-06 | An account takeover issue has been discovered in GitLab EE affecting all versions starting from 11.10 before 14.9.5, all versions starting from 14.10 before 14… |
CVE-2022-31486 | High | 8.8 | 2022-06-06 | An authenticated attacker can send a specially crafted route to the “edit_route.cgi” binary and have it execute shell commands. This vulnerability impacts prod… |
CVE-2022-31485 | Medium | 5.3 | 2022-06-06 | An unauthenticated attacker can send a specially crafted packets to update the “notes” section of the home page of the web interface. This vulnerability impact… |
CVE-2022-31484 | High | 7.5 | 2022-06-06 | An unauthenticated attacker can send a specially crafted network packet to delete a user from the web interface. This vulnerability impacts products based on H… |
CVE-2022-31483 | Critical | 9.1 | 2022-06-06 | An authenticated attacker can upload a file with a filename including “..” and “/” to achieve the ability to upload the desired file anywhere on the filesystem… |
CVE-2022-31482 | High | 7.5 | 2022-06-06 | An unauthenticated attacker can send a specially crafted unauthenticated HTTP request to the device that can overflow a buffer. This vulnerability impacts prod… |
CVE-2022-31481 | Critical | 10.0 | 2022-06-06 | An unauthenticated attacker can send a specially crafted update file to the device that can overflow a buffer. This vulnerability impacts products based on HID… |
CVE-2022-31480 | High | 7.5 | 2022-06-06 | An unauthenticated attacker could arbitrarily upload firmware files to the target device, ultimately causing a Denial-of-Service (DoS). This vulnerability impa… |
CVE-2022-31479 | Critical | 9.6 | 2022-06-06 | An unauthenticated attacker can update the hostname with a specially crafted name that will allow for shell commands to be executed during the core collection… |
CVE-2022-1944 | Medium | 5.4 | 2022-06-06 | When the feature is configured, improper authorization in the Interactive Web Terminal in GitLab CE/EE affecting all versions from 11.3 prior to 14.9.5, 14.10… |
CVE-2022-1940 | High | 7.7 | 2022-06-06 | A Stored Cross-Site Scripting vulnerability in Jira integration in GitLab EE affecting all versions from 13.11 prior to 14.9.5, 14.10 prior to 14.10.4, and 15… |
CVE-2022-1936 | Medium | 6.5 | 2022-06-06 | Incorrect authorization in GitLab EE affecting all versions from 12.0 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting fro… |
CVE-2022-1935 | Medium | 6.5 | 2022-06-06 | Incorrect authorization in GitLab EE affecting all versions from 12.0 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting fro… |
CVE-2022-1821 | Medium | 4.3 | 2022-06-06 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.8 before 14.9.5, all versions starting from 14.10 before 14.10.4, all vers… |
CVE-2022-1783 | Low | 2.7 | 2022-06-06 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 14.9.5, all versions starting from 14.10 before 14.10.4, all vers… |
CVE-2022-30863 | Medium | 4.8 | 2022-06-06 | FUDForum 3.1.2 is vulnerable to Cross Site Scripting (XSS) via page_title param in Page Manager in the Admin Control Panel. |
CVE-2022-30861 | Medium | 4.8 | 2022-06-06 | FUDforum 3.1.2 is vulnerable to Stored XSS via Forum Name field in Forum Manager Feature. |
CVE-2022-30860 | High | 7.2 | 2022-06-06 | FUDforum 3.1.2 is vulnerable to Remote Code Execution through Upload File feature of File Administration System in Admin Control Panel. |
CVE-2022-32296 | Low | 3.3 | 2022-06-05 | The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are used. This occurs because of use of Algorithm 4 ("Doub… |
CVE-2022-32291 | High | 8.8 | 2022-06-05 | In Real Player through 20.1.0.312, attackers can execute arbitrary code by placing a UNC share pathname (for a DLL file) in a RAM file. |
CVE-2022-26134 | Critical | 9.8 | 2022-06-03 | In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbit… |
CVE-2022-29784 | Medium | 5.3 | 2022-06-03 | PublicCMS V4.0.202204.a and below contains an information leak via the component /views/directive/sys/SysConfigDataDirective.java. |
CVE-2022-29778 | High | 8.8 | 2022-06-03 | D-Link DIR-890L 1.20b01 allows attackers to execute arbitrary code due to the hardcoded option Wake-On-Lan for the parameter 'descriptor' at SetVirtualServerSe… |
CVE-2022-29773 | Medium | 6.5 | 2022-06-03 | An access control issue in aleksis/core/util/auth_helpers.py: ClientProtectedResourceMixin of AlekSIS-Core v2.8.1 and below allows attackers to access arbitrar… |
CVE-2022-29770 | Medium | 5.4 | 2022-06-03 | XXL-Job v2.3.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via /xxl-job-admin/jobinfo. |
CVE-2022-26493 | Critical | 9.8 | 2022-06-03 | Xecurify's miniOrange Premium, Standard, and Enterprise Drupal SAML SP modules possess an authentication and authorization bypass vulnerability. An attacker wi… |
CVE-2022-1988 | Medium | 6.1 | 2022-06-03 | Cross-site Scripting (XSS) - Generic in GitHub repository neorazorx/facturascripts prior to 2022.09. |
CVE-2022-1987 | High | 8.1 | 2022-06-03 | Buffer Over-read in GitHub repository bfabiszewski/libmobi prior to 0.11. |
CVE-2022-32271 | Critical | 9.6 | 2022-06-03 | In Real Player 20.0.8.310, there is a DCP:// URI Remote Arbitrary Code Execution Vulnerability. This is an internal URL Protocol used by Real Player to referen… |
CVE-2022-32270 | Critical | 9.8 | 2022-06-03 | In Real Player 20.0.7.309 and 20.0.8.310, external::Import() allows download of arbitrary file types and Directory Traversal, leading to Remote Code Execution… |
CVE-2022-32269 | Critical | 9.8 | 2022-06-03 | In Real Player 20.0.8.310, the G2 Control allows injection of unsafe javascript: URIs in local HTTP error pages (displayed by Internet Explorer core). This lea… |
CVE-2022-32268 | High | 8.8 | 2022-06-03 | StarWind SAN and NAS v0.2 build 1914 allow remote code execution. A flaw was found in REST API in StarWind Stack. REST command, which allows changing the hostn… |
CVE-2022-32265 | Medium | 5.3 | 2022-06-03 | qDecoder before 12.1.0 does not ensure that the percent character is followed by two hex digits for URL decoding. |
CVE-2022-29767 | Medium | 6.5 | 2022-06-03 | adbyby v2.7 allows external users to make connections via port 8118. This can cause a program logic error and lead to a Denial of Service (DoS) via high CPU us… |