2022 CVEs (page 199)
Page 199 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-30237 | High | 8.2 | 2022-06-02 | A CWE-311: Missing Encryption of Sensitive Data vulnerability exists that could allow authentication credentials to be recovered when an attacker breaks the en… |
CVE-2022-30236 | High | 8.2 | 2022-06-02 | A CWE-669: Incorrect Resource Transfer Between Spheres vulnerability exists that could allow unauthorized access when an attacker uses cross-domain attacks. Af… |
CVE-2022-30235 | High | 8.6 | 2022-06-02 | A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow unauthorized access when an attacker uses brute forc… |
CVE-2022-30234 | Critical | 9.4 | 2022-06-02 | A CWE-798: Use of Hard-coded Credentials vulnerability exists that could allow arbitrary code to be executed when root level access is obtained. Affected Produ… |
CVE-2022-30233 | Medium | 6.5 | 2022-06-02 | A CWE-20: Improper Input Validation vulnerability exists that could allow the product to be maliciously manipulated when the user is tricked into performing ce… |
CVE-2022-30232 | High | 8.0 | 2022-06-02 | A CWE-20: Improper Input Validation vulnerability exists that could cause potential remote code execution when an attacker is able to intercept and modify a re… |
CVE-2022-29594 | High | 7.8 | 2022-06-02 | eG Agent before 7.2 has weak file permissions that enable escalation of privileges to SYSTEM. |
CVE-2022-31463 | High | 8.2 | 2022-06-02 | Owl Labs Meeting Owl 5.2.0.15 does not require a password for Bluetooth commands, because only client-side authentication is used. |
CVE-2022-31462 | Critical | 9.3 | 2022-06-02 | Owl Labs Meeting Owl 5.2.0.15 allows attackers to control the device via a backdoor password (derived from the serial number) that can be found in Bluetooth br… |
CVE-2022-31461 | High | 7.4 | 2022-06-02 | Owl Labs Meeting Owl 5.2.0.15 allows attackers to deactivate the passcode protection mechanism via a certain c 11 message. |
CVE-2022-31460 | High | 7.4 | 2022-06-02 | Owl Labs Meeting Owl 5.2.0.15 allows attackers to activate Tethering Mode with hard-coded hoothoot credentials via a certain c 150 value. |
CVE-2022-31459 | High | 7.4 | 2022-06-02 | Owl Labs Meeting Owl 5.2.0.15 allows attackers to retrieve the passcode hash via a certain c 10 value over Bluetooth. |
CVE-2022-32250 | High | 7.8 | 2022-06-02 | net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root becaus… |
CVE-2022-29718 | Medium | 6.1 | 2022-06-02 | Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbi… |
CVE-2022-29085 | Medium | 6.4 | 2022-06-02 | Dell Unity, Dell UnityVSA, and Dell Unity XT versions prior to 5.2.0.0.5.173 contain a plain-text password storage vulnerability when certain off-array tools a… |
CVE-2022-29084 | High | 8.1 | 2022-06-02 | Dell Unity, Dell UnityVSA, and Dell Unity XT versions before 5.2.0.0.5.173 do not restrict excessive authentication attempts in Unisphere GUI. A remote unauthe… |
CVE-2022-26869 | Critical | 9.8 | 2022-06-02 | Dell PowerStore versions 2.0.0.x, 2.0.1.x and 2.1.0.x contains an open port vulnerability. A remote unauthenticated attacker could potentially exploit this vul… |
CVE-2022-26868 | Medium | 6.4 | 2022-06-02 | Dell EMC PowerStore versions 2.0.0.x, 2.0.1.x, and 2.1.0.x are vulnerable to a command injection flaw. An authenticated attacker could potentially exploit this… |
CVE-2022-26867 | Medium | 5.9 | 2022-06-02 | PowerStore SW v2.1.1.0 supports the option to export data to either a CSV or an XLSX file. The data is taken as is, without any validation or sanitization. It… |
CVE-2022-26866 | Medium | 5.5 | 2022-06-02 | Dell PowerStore Versions before v2.1.1.0. contains a Stored Cross-Site Scripting vulnerability. A high privileged network attacker could potentially exploit th… |
CVE-2022-22557 | High | 7.5 | 2022-06-02 | PowerStore contains Plain-Text Password Storage Vulnerability in PowerStore X & T environments running versions 2.0.0.x and 2.0.1.x A locally authenticated att… |
CVE-2022-22556 | Low | 3.7 | 2022-06-02 | Dell PowerStore contains an Uncontrolled Resource Consumption Vulnerability in PowerStore User Interface. A remote unauthenticated attacker could potentially e… |
CVE-2022-31024 | Medium | 6.5 | 2022-06-02 | richdocuments is the repository for NextCloud Collabra, the app for Nextcloud Office collaboration. Prior to versions 6.0.0, 5.0.4, and 4.2.6, a user could be… |
CVE-2022-32019 | Critical | 9.8 | 2022-06-02 | Car Rental Management System v1.0 is vulnerable to Arbitrary code execution via car-rental-management-system/admin/ajax.php?action=save_car. |
CVE-2022-31023 | Medium | 5.9 | 2022-06-02 | Play Framework is a web framework for Java and Scala. Verions prior to 2.8.16 are vulnerable to generation of error messages containing sensitive information… |
CVE-2022-30429 | Medium | 5.4 | 2022-06-02 | Multiple cross-site scripting (XSS) vulnerabilities in Neos CMS allow attackers with the editor role or higher to inject arbitrary script or HTML code using th… |
CVE-2022-29704 | Critical | 9.8 | 2022-06-02 | BrowsBox CMS v4.0 was discovered to contain a SQL injection vulnerability. |
CVE-2022-29597 | Medium | 6.5 | 2022-06-02 | Solutions Atlantic Regulatory Reporting System (RRS) v500 is vulnerable to Local File Inclusion (LFI). Any authenticated user has the ability to reference inte… |
CVE-2022-26944 | Medium | 6.5 | 2022-06-02 | Percona XtraBackup 2.4.20 unintentionally writes the command line to any resulting backup file output. This may include sensitive arguments passed at run time… |
CVE-2022-26497 | Medium | 5.4 | 2022-06-02 | BigBlueButton Greenlight 2.11.1 allows XSS. A threat actor could have a username containing a JavaScript payload. The payload gets executed in the browser of t… |
CVE-2022-25163 | Critical | 9.8 | 2022-06-02 | Improper Input Validation vulnerability in Mitsubishi Electric MELSEC-Q Series QJ71E71-100 first 5 digits of serial number "24061" or prior, Mitsubishi Electri… |
CVE-2022-1982 | Medium | 4.3 | 2022-06-02 | Uncontrolled resource consumption in Mattermost version 6.6.0 and earlier allows an authenticated attacker to crash the server via a crafted SVG attachment on… |
CVE-2022-1980 | Low | 2.4 | 2022-06-02 | A vulnerability was found in SourceCodester Product Show Room Site 1.0. It has been rated as problematic. This issue affects the file /admin/?page=system_info/… |
CVE-2022-1979 | Low | 3.5 | 2022-06-02 | A vulnerability was found in SourceCodester Product Show Room Site 1.0. It has been declared as problematic. This vulnerability affects p=contact. The manipula… |
CVE-2022-1716 | Medium | 4.6 | 2022-06-02 | Keep My Notes v1.80.147 allows an attacker with physical access to the victim's device to bypass the application's password/pin lock to access user data. This… |
CVE-2022-31018 | High | 7.5 | 2022-06-02 | Play Framework is a web framework for Java and Scala. A denial of service vulnerability has been discovered in verions 2.8.3 through 2.8.15 of Play's forms lib… |
CVE-2022-32028 | High | 7.2 | 2022-06-02 | Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/manage_user.php?id=. |
CVE-2022-32027 | High | 7.2 | 2022-06-02 | Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/index.php?page=manage_car&id=. |
CVE-2022-32026 | High | 7.2 | 2022-06-02 | Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/manage_booking.php?id=. |
CVE-2022-32025 | High | 7.2 | 2022-06-02 | Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/view_car.php?id=. |
CVE-2022-32024 | High | 7.2 | 2022-06-02 | Car Rental Management System v1.0 is vulnerable to SQL Injection via car-rental-management-system/booking.php?car_id=. |
CVE-2022-32022 | High | 7.2 | 2022-06-02 | Car Rental Management System v1.0 is vulnerable to SQL Injection via /ip/car-rental-management-system/admin/ajax.php?action=login. |
CVE-2022-32021 | High | 7.2 | 2022-06-02 | Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/manage_movement.php?id=. |
CVE-2022-32020 | Critical | 9.8 | 2022-06-02 | Car Rental Management System v1.0 is vulnerable to Arbitrary code execution via ip/car-rental-management-system/admin/ajax.php?action=save_settings. |
CVE-2022-32018 | High | 7.2 | 2022-06-02 | Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/index.php?q=hiring&search=. |
CVE-2022-32017 | High | 7.2 | 2022-06-02 | Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/index.php?q=result&searchfor=bytitle. |
CVE-2022-32016 | High | 7.2 | 2022-06-02 | Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/index.php?q=result&searchfor=bycompany. |
CVE-2022-32015 | High | 7.2 | 2022-06-02 | Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/index.php?q=category&search=. |
CVE-2022-32014 | High | 7.2 | 2022-06-02 | Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/index.php?q=result&searchfor=byfunction. |
CVE-2022-32013 | High | 7.2 | 2022-06-02 | Complete Online Job Search System v1.0 is vulnerable to SQL Injection via eris/admin/category/index.php?view=edit&id=. |
CVE-2022-32012 | High | 7.2 | 2022-06-02 | Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/admin/employee/index.php?view=edit&id=. |
CVE-2022-32011 | High | 7.2 | 2022-06-02 | Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/admin/applicants/index.php?view=view&id=. |
CVE-2022-32010 | High | 7.2 | 2022-06-02 | Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/admin/user/index.php?view=edit&id=. |
CVE-2022-32008 | High | 7.2 | 2022-06-02 | Complete Online Job Search System v1.0 is vulnerable to SQL Injection via eris/admin/vacancy/index.php?view=edit&id=. |
CVE-2022-32007 | High | 7.2 | 2022-06-02 | Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/admin/company/index.php?view=edit&id=. |
CVE-2022-31994 | High | 7.2 | 2022-06-02 | Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/?page=sales/view_details&id. |
CVE-2022-31993 | Critical | 9.8 | 2022-06-02 | Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/classes/Master.php?f=delete_service. |
CVE-2022-31992 | High | 7.2 | 2022-06-02 | Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/?page=court_rentals/view_court_rental&id=. |
CVE-2022-31991 | Critical | 9.8 | 2022-06-02 | Badminton Center Management System v1.0 is vulnerable to SQL Injection via bcms/classes/Master.php?f=delete_court. |
CVE-2022-31990 | Critical | 9.8 | 2022-06-02 | Badminton Center Management System v1.0 is vulnerable to SQL Injection via bcms/classes/Master.php?f=delete_product. |
CVE-2022-31989 | Critical | 9.8 | 2022-06-02 | Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/?page=user/manage_user&id=. |
CVE-2022-31988 | High | 7.2 | 2022-06-02 | Badminton Center Management System v1.0 is vulnerable to SQL Injection via bcms/admin/?page=reports/daily_services_report&date=. |
CVE-2022-31986 | High | 7.2 | 2022-06-02 | Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/?page=reports/daily_court_rental_report&date=. |
CVE-2022-31985 | High | 7.2 | 2022-06-02 | Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/?page=reports/daily_sales_report&date=. |
CVE-2022-32006 | High | 7.2 | 2022-06-02 | Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/services/view_service.php?id=. |
CVE-2022-32005 | High | 7.2 | 2022-06-02 | Badminton Center Management System v1.0 is vulnerable to SQL Injection via bcms/admin/services/manage_service.php?id=. |
CVE-2022-32004 | High | 7.2 | 2022-06-02 | Badminton Center Management System v1.0 is vulnerable to SQL Injection via bcms/admin/products/manage_product.php?id=. |
CVE-2022-32003 | High | 7.2 | 2022-06-02 | Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/courts/view_court.php?id=. |
CVE-2022-32002 | Critical | 9.8 | 2022-06-02 | Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/courts/manage_court.php?id=. |
CVE-2022-32001 | High | 7.2 | 2022-06-02 | Badminton Center Management System v1.0 is vulnerable to SQL Injection via bcms/admin/products/view_product.php?id=. |
CVE-2022-32000 | High | 7.2 | 2022-06-02 | Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/?page=service_transactions/manage_service_transaction&id=. |
CVE-2022-31998 | High | 7.2 | 2022-06-02 | Badminton Center Management System v1.0 is vulnerable to SQL Injection via /bcms/admin/?page=service_transactions/view_details&id=. |
CVE-2022-31996 | High | 7.2 | 2022-06-02 | Badminton Center Management System v1.0 is vulnerable to SQL Injection via bcms/admin/?page=sales/manage_sale&id=. |
CVE-2022-32202 | Medium | 5.5 | 2022-06-02 | In libjpeg 1.63, there is a NULL pointer dereference in LineBuffer::FetchRegion in linebuffer.cpp. |
CVE-2022-32201 | Medium | 5.5 | 2022-06-02 | In libjpeg 1.63, there is a NULL pointer dereference in Component::SubXOf in component.hpp. |
CVE-2022-32200 | High | 7.8 | 2022-06-02 | libdwarf 0.4.0 has a heap-based buffer over-read in _dwarf_check_string_valid in dwarf_util.c. |
CVE-2022-31984 | High | 7.2 | 2022-06-02 | Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/requests/take_action.php?id=. |
CVE-2022-31983 | High | 7.2 | 2022-06-02 | Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=requests/manage_request&id=. |
CVE-2022-31982 | High | 7.2 | 2022-06-02 | Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=requests/view_request&id=. |
CVE-2022-31981 | High | 7.2 | 2022-06-02 | Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=teams/view_team&id=. |
CVE-2022-31980 | High | 7.2 | 2022-06-02 | Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=teams/manage_team&id=. |
CVE-2022-31978 | Critical | 9.8 | 2022-06-02 | Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/classes/Master.php?f=delete_inquiry. |
CVE-2022-31977 | Critical | 9.8 | 2022-06-02 | Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/classes/Master.php?f=delete_team. |
CVE-2022-31976 | Critical | 9.8 | 2022-06-02 | Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/classes/Master.php?f=delete_request. |
CVE-2022-31975 | High | 7.2 | 2022-06-02 | Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=user/manage_user&id=. |
CVE-2022-31974 | High | 7.2 | 2022-06-02 | Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=reports&date=. |
CVE-2022-31973 | Medium | 6.5 | 2022-06-02 | Online Fire Reporting System v1.0 is vulnerable to Delete any file via /ofrs/classes/Master.php?f=delete_img. |
CVE-2022-31971 | High | 7.2 | 2022-06-02 | ChatBot App with Suggestion v1.0 is vulnerable to SQL Injection via /simple_chat_bot/admin/?page=responses/view_response&id=. |
CVE-2022-31970 | High | 7.2 | 2022-06-02 | ChatBot App with Suggestion v1.0 is vulnerable to SQL Injection via /simple_chat_bot/admin/?page=responses/manage_response&id=. |
CVE-2022-31969 | Critical | 9.8 | 2022-06-02 | ChatBot App with Suggestion v1.0 is vulnerable to SQL Injection via /simple_chat_bot/admin/?page=user/manage_user&id=. |
CVE-2022-31966 | Medium | 6.5 | 2022-06-02 | ChatBot App with Suggestion v1.0 is vulnerable to Delete any file via /simple_chat_bot/classes/Master.php?f=delete_img. |
CVE-2022-31965 | Critical | 9.8 | 2022-06-02 | Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/respondent_types/manage_respondent_type.php?id=. |
CVE-2022-31964 | Critical | 9.8 | 2022-06-02 | Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via rdms/admin/respondent_types/view_respondent_type.php?id=. |
CVE-2022-31962 | Critical | 9.8 | 2022-06-02 | Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/incidents/view_incident.php?id=. |
CVE-2022-31961 | Critical | 9.8 | 2022-06-02 | Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/incidents/manage_incident.php?id=. |
CVE-2022-31959 | Critical | 9.8 | 2022-06-02 | Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/teams/manage_team.php?id=. |
CVE-2022-31957 | Critical | 9.8 | 2022-06-02 | Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via rdms/admin/teams/view_team.php?id=. |
CVE-2022-31956 | Critical | 9.8 | 2022-06-02 | Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/incident_reports/manage_report.php?id=. |
CVE-2022-31953 | Critical | 9.8 | 2022-06-02 | Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/admin/incident_reports/view_report.php?id=. |
CVE-2022-31952 | Critical | 9.8 | 2022-06-02 | Rescue Dispatch Management System v1.0 is vulnerable to SQL injection via /rdms/classes/Master.php?f=delete_incident. |