2022 CVEs (page 204)
Page 204 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-31650 | Medium | 5.5 | 2022-05-25 | In SoX 14.4.2, there is a floating-point exception in lsx_aiffstartwrite in aiff.c in libsox.a. |
CVE-2022-29256 | Medium | 6.5 | 2022-05-25 | sharp is an application for Node.js image processing. Prior to version 0.30.5, there is a possible vulnerability in logic that is run only at `npm install` tim… |
CVE-2022-31624 | Medium | 5.5 | 2022-05-25 | MariaDB Server before 10.7 is vulnerable to Denial of Service. While executing the plugin/server_audit/server_audit.c method log_statement_ex, the held lock lo… |
CVE-2022-31623 | Medium | 5.5 | 2022-05-25 | MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_compress.cc, when an error occurs (i.e., going to the err label) while e… |
CVE-2022-31622 | Medium | 5.5 | 2022-05-25 | MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_compress.cc, when an error occurs (pthread_create returns a nonzero valu… |
CVE-2022-31621 | Medium | 5.5 | 2022-05-25 | MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_xbstream.cc, when an error occurs (stream_ctxt->dest_file == NULL) while… |
CVE-2022-31620 | Medium | 6.5 | 2022-05-25 | In libjpeg before 1.64, BitStream<false>::Get in bitstream.hpp has an assertion failure that may cause denial of service. This is related to out-of-bounds arra… |
CVE-2022-29253 | Low | 2.7 | 2022-05-25 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting with version 8.3-rc-1 and prior to versions 1… |
CVE-2022-29252 | High | 7.4 | 2022-05-25 | XWiki Platform Wiki UI Main Wiki is a package for managing subwikis. Starting with version 5.3-milestone-2, XWiki Platform Wiki UI Main Wiki contains a possibl… |
CVE-2022-29251 | High | 7.4 | 2022-05-25 | XWiki Platform Flamingo Theme UI is a tool that allows customization and preview of any Flamingo-based skin. Starting with versions 6.2.4 and 6.3-rc-1, a possi… |
CVE-2022-27169 | High | 7.5 | 2022-05-25 | An information disclosure vulnerability exists in the OAS Engine SecureBrowseFile functionality of Open Automation Software OAS Platform V16.00.0112. A special… |
CVE-2022-26833 | Critical | 9.4 | 2022-05-25 | An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V16.00.0121. A specially-crafted series… |
CVE-2022-26303 | High | 7.5 | 2022-05-25 | An external config control vulnerability exists in the OAS Engine SecureAddUser functionality of Open Automation Software OAS Platform V16.00.0112. A specially… |
CVE-2022-26082 | Critical | 9.1 | 2022-05-25 | A file write vulnerability exists in the OAS Engine SecureTransferFiles functionality of Open Automation Software OAS Platform V16.00.0112. A specially-crafted… |
CVE-2022-26077 | High | 7.5 | 2022-05-25 | A cleartext transmission of sensitive information vulnerability exists in the OAS Engine configuration communications functionality of Open Automation Software… |
CVE-2022-26067 | Medium | 4.9 | 2022-05-25 | An information disclosure vulnerability exists in the OAS Engine SecureTransferFiles functionality of Open Automation Software OAS Platform V16.00.0112. A spec… |
CVE-2022-26043 | High | 7.5 | 2022-05-25 | An external config control vulnerability exists in the OAS Engine SecureAddSecurity functionality of Open Automation Software OAS Platform V16.00.0112. A speci… |
CVE-2022-26026 | High | 7.5 | 2022-05-25 | A denial of service vulnerability exists in the OAS Engine SecureConfigValues functionality of Open Automation Software OAS Platform V16.00.0112. A specially-c… |
CVE-2022-29402 | Medium | 6.8 | 2022-05-25 | TP-Link TL-WR840N EU v6.20 was discovered to contain insecure protections for its UART console. This vulnerability allows attackers to connect to the UART port… |
CVE-2022-29248 | High | 8.0 | 2022-05-25 | Guzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 and 7.4.3 contains a vulnerability with the cookie middleware. The vulnerability is that it is not… |
CVE-2022-30428 | High | 7.5 | 2022-05-25 | In ginadmin through 05-10-2022, the incoming path value is not filtered, resulting in arbitrary file reading. |
CVE-2022-30427 | High | 7.5 | 2022-05-25 | In ginadmin through 05-10-2022 the incoming path value is not filtered, resulting in directory traversal. |
CVE-2022-29408 | Medium | 4.7 | 2022-05-25 | Persistent Cross-Site Scripting (XSS) vulnerability in Vsourz Digital's Advanced Contact form 7 DB plugin <= 1.8.7 at WordPress. |
CVE-2022-28875 | Medium | 4.3 | 2022-05-25 | A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant and in certain WithSecure products whereby the scanning the aemobile component can cr… |
CVE-2022-27305 | High | 8.8 | 2022-05-25 | Gibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to session fixation. |
CVE-2022-23775 | Critical | 9.8 | 2022-05-25 | TrueStack Direct Connect 1.4.7 has Incorrect Access Control. |
CVE-2022-1348 | Medium | 6.5 | 2022-05-25 | A vulnerability was found in logrotate in how the state file is created. The state file is used to prevent parallel executions of multiple instances of logrota… |
CVE-2022-1678 | Medium | 5.9 | 2022-05-25 | An issue was discovered in the Linux Kernel from 4.18 to 4.19, an improper update of sock reference in TCP pacing can lead to memory/netns leak, which can be u… |
CVE-2022-29380 | Medium | 4.8 | 2022-05-25 | Academy-LMS v4.3 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the SEO panel. |
CVE-2022-22127 | High | 7.2 | 2022-05-25 | Tableau is aware of a broken access control vulnerability present in Tableau Server affecting Tableau Server customers using Local Identity Store for managing… |
CVE-2022-29651 | High | 7.2 | 2022-05-25 | An arbitrary file upload vulnerability in the Select Image function of Online Food Ordering System v1.0 allows attackers to execute arbitrary code via a crafte… |
CVE-2022-29650 | Critical | 9.8 | 2022-05-25 | Online Food Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the Search parameter at /online-food-order/food-search.php. |
CVE-2022-29379 | Critical | 9.8 | 2022-05-25 | Nginx NJS v0.7.3 was discovered to contain a stack overflow in the function njs_default_module_loader at /src/njs/src/njs_module.c. NOTE: multiple third partie… |
CVE-2022-1851 | High | 7.8 | 2022-05-25 | Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. |
CVE-2022-30595 | Critical | 9.8 | 2022-05-25 | libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files. |
CVE-2022-30323 | High | 8.6 | 2022-05-25 | go-getter up to 1.5.11 and 2.0.2 panicked when processing password-protected ZIP files. Fixed in 1.6.1 and 2.1.0. |
CVE-2022-30322 | High | 8.6 | 2022-05-25 | go-getter up to 1.5.11 and 2.0.2 allowed asymmetric resource exhaustion when go-getter processed malicious HTTP responses. Fixed in 1.6.1 and 2.1.0. |
CVE-2022-30321 | High | 8.6 | 2022-05-25 | go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection flaws. Fixed in 1.6.1 an… |
CVE-2022-28862 | Critical | 9.8 | 2022-05-25 | In Archibus Web Central before 26.2, multiple SQL Injection vulnerabilities occur in dwr/call/plaincall/workflow.runWorkflowRule.dwr. Through the injection of… |
CVE-2022-26945 | Critical | 9.8 | 2022-05-25 | go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing. Fi… |
CVE-2022-21951 | Medium | 6.8 | 2022-05-25 | A Cleartext Transmission of Sensitive Information vulnerability in SUSE Rancher, Rancher allows attackers on the network to read and change network data due to… |
CVE-2022-1883 | High | 8.8 | 2022-05-25 | SQL Injection in GitHub repository camptocamp/terraboard prior to 2.2.0. |
CVE-2022-1815 | High | 7.5 | 2022-05-25 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.1.2. |
CVE-2022-29405 | Medium | 6.5 | 2022-05-25 | In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8 |
CVE-2022-29710 | Medium | 6.1 | 2022-05-25 | A cross-site scripting (XSS) vulnerability in uploadConfirm.php of LimeSurvey v5.3.9 and below allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2022-29362 | Medium | 5.4 | 2022-05-25 | A cross-site scripting (XSS) vulnerability in /navigation/create?ParentID=%23 of ZKEACMS v3.5.2 allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2022-29361 | Critical | 9.8 | 2022-05-25 | Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with mul… |
CVE-2022-29359 | Medium | 6.1 | 2022-05-25 | A stored cross-site scripting (XSS) vulnerability in /scas/?page=clubs/application_form&id=7 of School Club Application System v0.1 allows attackers to execute… |
CVE-2022-29358 | Medium | 5.5 | 2022-05-25 | epub2txt2 v2.04 was discovered to contain an integer overflow via the function bug in _parse_special_tag at sxmlc.c. This vulnerability allows attackers to cau… |
CVE-2022-29349 | Medium | 6.1 | 2022-05-25 | kkFileView v4.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /controller/OnlinePreviewController.java. |
CVE-2022-29337 | Critical | 9.8 | 2022-05-24 | C-DATA FD702XW-X-R430 v2.1.13_X001 was discovered to contain a command injection vulnerability via the va_cmd parameter in formlanipv6. This vulnerability allo… |
CVE-2022-29334 | Critical | 9.8 | 2022-05-24 | An issue in H v1.0 allows attackers to bypass authentication via a session replay attack. |
CVE-2022-22497 | High | 7.5 | 2022-05-24 | IBM Aspera Faspex 4.4.1 and 5.0.0 could allow unauthorized access due to an incorrectly computed security token. IBM X-Force ID: 226951. |
CVE-2022-29333 | High | 7.8 | 2022-05-24 | A vulnerability in CyberLink Power Director v14 allows attackers to escalate privileges via a crafted .exe file. |
CVE-2022-23050 | High | 7.2 | 2022-05-24 | ManageEngine AppManager15 (Build No:15510) allows an authenticated admin user to upload a DLL file to perform a DLL hijack attack inside the 'working' folder t… |
CVE-2022-22977 | High | 7.1 | 2022-05-24 | VMware Tools for Windows(12.0.0, 11.x.y and 10.x.y) contains an XML External Entity (XXE) vulnerability. A malicious actor with non-administrative local user p… |
CVE-2022-1669 | Medium | 6.8 | 2022-05-24 | A buffer overflow vulnerability has been detected in the firewall function of the device management web portal. The device runs a CGI binary (index.cgi) to off… |
CVE-2022-22495 | High | 8.8 | 2022-05-24 | IBM i 7.3, 7.4, and 7.5 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view… |
CVE-2022-22309 | Medium | 6.8 | 2022-05-24 | The POWER systems FSP is vulnerable to unauthenticated logins through the serial port/TTY interface. This vulnerability can be more critical if the serial port… |
CVE-2022-29249 | High | 7.5 | 2022-05-24 | JavaEZ is a library that adds new functions to make Java easier. A weakness in JavaEZ 1.6 allows force decryption of locked text by unauthorized actors. The is… |
CVE-2022-1849 | Medium | 5.4 | 2022-05-24 | Session Fixation in GitHub repository filegator/filegator prior to 7.8.0. |
CVE-2022-31261 | High | 7.5 | 2022-05-24 | An XXE issue was discovered in Morpheus through 5.2.16 and 5.4.x through 5.4.4. A successful attack requires a SAML identity provider to be configured. In orde… |
CVE-2022-30843 | High | 8.8 | 2022-05-24 | Room-rent-portal-site v1.0 is vulnerable to SQL Injection via /rrps/classes/Master.php?f=delete_category, id. |
CVE-2022-30842 | Medium | 5.4 | 2022-05-24 | Covid-19 Travel Pass Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via /ctpms/classes/Users.php?f=save, firstname. |
CVE-2022-30839 | Medium | 6.1 | 2022-05-24 | Room-rent-portal-site v1.0 is vulnerable to Cross Site Scripting (XSS) via /rrps/classes/Master.php?f=save_category, vehicle_name. |
CVE-2022-30838 | Critical | 9.8 | 2022-05-24 | Covid-19 Travel Pass Management System v1.0 is vulnerable to SQL Injection via /ctpms/classes/Master.php?f=update_application_status |
CVE-2022-29567 | Medium | 5.7 | 2022-05-24 | The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 2… |
CVE-2022-29246 | Critical | 9.8 | 2022-05-24 | Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack. Prior to version 6.1.11, he USBX DFU UPLOAD functionality may be utilized to introdu… |
CVE-2022-29242 | Medium | 5.9 | 2022-05-24 | GOST engine is a reference implementation of the Russian GOST crypto algorithms for OpenSSL. TLS clients using GOST engine when ciphersuite `TLS_GOSTR341112_25… |
CVE-2022-29237 | Medium | 5.4 | 2022-05-24 | Opencast is a free and open source solution for automated video capture and distribution at scale. Prior to Opencast 10.14 and 11.7, users could pass along URL… |
CVE-2022-29223 | High | 7.5 | 2022-05-24 | Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack. In versions prior to 6.1.10, an attacker can cause a buffer overflow by providing th… |
CVE-2022-29221 | High | 8.8 | 2022-05-24 | Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.45 and 4.1.1, templat… |
CVE-2022-29219 | High | 7.5 | 2022-05-24 | Lodestar is a TypeScript implementation of the Ethereum Consensus specification. Prior to version 0.36.0, there is a possible consensus split given maliciously… |
CVE-2022-29217 | High | 7.4 | 2022-05-24 | PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choo… |
CVE-2022-22306 | Medium | 5.4 | 2022-05-24 | An improper certificate validation vulnerability [CWE-295] in FortiOS 6.0.0 through 6.0.14, 6.2.0 through 6.2.10, 6.4.0 through 6.4.8, 7.0.0 may allow a networ… |
CVE-2022-1850 | High | 8.1 | 2022-05-24 | Path Traversal in GitHub repository filegator/filegator prior to 7.8.0. |
CVE-2022-30837 | Medium | 5.4 | 2022-05-24 | Toll-tax-management-system v1.0 is vulnerable to Cross Site Scripting (XSS) via /ttms/classes/Master.php?f=save_recipient, vehicle_name. |
CVE-2022-30464 | Medium | 5.4 | 2022-05-24 | ChatBot App with Suggestion in PHP/OOP v1.0 is vulnerable to Cross Site Scripting (XSS) via /simple_chat_bot/classes/Master.php?f=save_response. |
CVE-2022-30463 | High | 8.8 | 2022-05-24 | Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/classes/Master.php?f=delete_product. |
CVE-2022-30462 | Medium | 5.4 | 2022-05-24 | Water-billing-management-system v1.0 is affected by: Cross Site Scripting (XSS) via /wbms/classes/Users.php?f=save, firstname. |
CVE-2022-30461 | Critical | 9.8 | 2022-05-24 | Water-billing-management-system v1.0 is vulnerable to SQL Injection via /wbms/classes/Master.php?f=delete_client, id |
CVE-2022-30460 | Medium | 5.4 | 2022-05-24 | Simple Social Networking Site v1.0 is vulnerable to Cross Site Scripting (XSS) via /sns/classes/Users.php?f=save, firstname. |
CVE-2022-30459 | High | 8.8 | 2022-05-24 | ChatBot App with Suggestion in PHP/OOP v1.0 is vulnerable to SQL Injection via /simple_chat_bot/classes/Master.php?f=delete_response, id. |
CVE-2022-30458 | Medium | 5.4 | 2022-05-24 | Automotive Shop Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via /asms/classes/Master.php?f=save_product, name. |
CVE-2022-30456 | Medium | 5.4 | 2022-05-24 | Badminton Center Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via /bcms/classes/Master.php?f=save_court_rental. |
CVE-2022-30455 | Critical | 9.8 | 2022-05-24 | Badminton Center Management System 1.0 is vulnerable to SQL Injection via /bcms/classes/Master.php?f=delete_court_rental, id. |
CVE-2022-30454 | Critical | 9.8 | 2022-05-24 | Merchandise Online Store 1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_product. |
CVE-2022-1848 | Medium | 5.3 | 2022-05-24 | Business Logic Errors in GitHub repository erudika/para prior to 1.45.11. |
CVE-2022-26532 | High | 7.8 | 2022-05-24 | A argument injection vulnerability in the 'packet-trace' CLI command of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware v… |
CVE-2022-26531 | Medium | 6.1 | 2022-05-24 | Multiple improper input validation flaws were identified in some CLI commands of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series f… |
CVE-2022-1840 | Low | 2.4 | 2022-05-24 | A vulnerability, which was classified as problematic, has been found in Home Clean Services Management System 1.0. This issue affects register.php?link=registe… |
CVE-2022-1839 | Medium | 6.3 | 2022-05-24 | A vulnerability classified as critical was found in Home Clean Services Management System 1.0. This vulnerability affects the file login.php. The manipulation… |
CVE-2022-1838 | Medium | 4.7 | 2022-05-24 | A vulnerability classified as critical has been found in Home Clean Services Management System 1.0. This affects an unknown part of admin/login.php. The manipu… |
CVE-2022-1837 | Medium | 4.7 | 2022-05-24 | A vulnerability was found in Home Clean Services Management System 1.0. It has been rated as critical. Affected by this issue is register.php?link=registerand… |
CVE-2022-1819 | Low | 2.4 | 2022-05-24 | A vulnerability, which was classified as problematic, was found in Student Information System 1.0. Affected is admin/?page=students of the Student Roll module… |
CVE-2022-31263 | Medium | 5.3 | 2022-05-24 | app/models/user.rb in Mastodon before 3.5.0 allows a bypass of e-mail restrictions. |
CVE-2022-29309 | High | 7.5 | 2022-05-24 | mysiteforme v2.2.1 was discovered to contain a Server-Side Request Forgery. |
CVE-2022-29305 | High | 8.1 | 2022-05-24 | imgurl v2.31 was discovered to contain a Blind SQL injection vulnerability via /upload/localhost. |
CVE-2022-0910 | Medium | 6.5 | 2022-05-24 | A downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.32 thro… |
CVE-2022-0734 | Medium | 5.8 | 2022-05-24 | A cross-site scripting vulnerability was identified in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.35 through 4.70, USG FLEX series firmware… |