2022 CVEs (page 206)
Page 206 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-29181 | High | 8.2 | 2022-05-20 | Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, a… |
CVE-2022-29179 | High | 7.5 | 2022-05-20 | Cilium is open source software for providing and securing network connectivity and loadbalancing between application workloads. Prior to versions 1.9.16, 1.10… |
CVE-2022-29178 | High | 8.8 | 2022-05-20 | Cilium is open source software for providing and securing network connectivity and loadbalancing between application workloads. Cilium prior to versions 1.9.16… |
CVE-2022-28995 | Critical | 9.8 | 2022-05-20 | Rengine v1.0.2 was discovered to contain a remote code execution (RCE) vulnerability via the yaml configuration function. |
CVE-2022-28990 | High | 7.8 | 2022-05-20 | WASM3 v0.5.0 was discovered to contain a heap overflow via the component /wabt/bin/poc.wasm. |
CVE-2022-28531 | Critical | 9.8 | 2022-05-20 | Sourcecodester Covid-19 Directory on Vaccination System1.0 is vulnerable to SQL Injection via the admin/login.php txtusername (aka Username) field. |
CVE-2022-1770 | High | 8.8 | 2022-05-20 | Improper Privilege Management in GitHub repository polonel/trudesk prior to 1.2.2. |
CVE-2022-29177 | Medium | 5.9 | 2022-05-20 | Go Ethereum is the official Golang implementation of the Ethereum protocol. Prior to version 1.10.17, a vulnerable node, if configured to use high verbosity lo… |
CVE-2022-22365 | Medium | 5.9 | 2022-05-20 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0, with the Ajax Proxy Web Application (AjaxProxy.war) deployed, is vulnerable to spoofing by allowing a… |
CVE-2022-29170 | Medium | 6.6 | 2022-05-20 | Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, the Request security feature allows list allows to configure Grafan… |
CVE-2022-29163 | Low | 3.5 | 2022-05-20 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.6 and 23.0.3, a user can create a link… |
CVE-2022-29160 | Low | 2.8 | 2022-05-20 | Nextcloud Android is the Android client for Nextcloud, a self-hosted productivity platform. Prior to version 3.19.0, sensitive tokens, images, and user related… |
CVE-2022-29159 | Medium | 5.0 | 2022-05-20 | Nextcloud Deck is a Kanban-style project & personal management tool for Nextcloud. In versions prior to 1.4.8, 1.5.6, and 1.6.1, an authenticated user can move… |
CVE-2022-24906 | Low | 3.5 | 2022-05-20 | Nextcloud Deck is a Kanban-style project & personal management tool for Nextcloud, similar to Trello. The full path of the application is exposed to unauthoriz… |
CVE-2022-31245 | High | 8.8 | 2022-05-20 | mailcow before 2022-05d allows a remote authenticated user to inject OS commands and escalate privileges to domain admin via the --debug option in conjunction… |
CVE-2022-29165 | Critical | 10.0 | 2022-05-20 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A critical vulnerability has been discovered in Argo CD starting with version 1.4.0 a… |
CVE-2022-28660 | Critical | 9.8 | 2022-05-20 | The querier component in Grafana Enterprise Logs 1.1.x through 1.3.x before 1.4.0 does not require authentication when X-Scope-OrgID is used. Versions 1.2.1, 1… |
CVE-2022-24905 | Medium | 4.3 | 2022-05-20 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was found in Argo CD prior to versions 2.3.4, 2.2.9, and 2.1.15 that… |
CVE-2022-24904 | Medium | 4.3 | 2022-05-20 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.7.0 and prior to versions 2.1.15m 2.2.9, and 2.3.4 is… |
CVE-2022-30887 | Critical | 9.8 | 2022-05-20 | Pharmacy Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /php_action/editProductImage.php. This… |
CVE-2022-30886 | Critical | 9.8 | 2022-05-20 | School Dormitory Management System v1.0 was discovered to contain a SQL injection vulnerability via the month parameter at /dms/admin/reports/daily_collection_… |
CVE-2022-30518 | Critical | 9.8 | 2022-05-20 | ChatBot Application with a Suggestion Feature 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /simple_chat_bot/admin/respon… |
CVE-2022-29883 | Medium | 5.3 | 2022-05-20 | A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not restrict unauthenticated access to certain pages of the web inter… |
CVE-2022-29882 | High | 7.1 | 2022-05-20 | A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not handle uploaded files correctly. An unauthenticated attacker coul… |
CVE-2022-29881 | Medium | 5.3 | 2022-05-20 | A vulnerability has been identified in SICAM T (All versions < V3.0). The web based management interface of affected devices does not employ special access pro… |
CVE-2022-29880 | Medium | 6.5 | 2022-05-20 | A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly validate input in the configuration interface. This coul… |
CVE-2022-29879 | Medium | 4.3 | 2022-05-20 | A vulnerability has been identified in SICAM T (All versions < V3.0). The web based management interface of affected devices does not employ special access pro… |
CVE-2022-29878 | High | 7.5 | 2022-05-20 | A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices use a limited range for challenges that are sent during the unencrypted… |
CVE-2022-29877 | Medium | 6.5 | 2022-05-20 | A vulnerability has been identified in SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All… |
CVE-2022-29876 | High | 7.1 | 2022-05-20 | A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly handle the input of a GET request parameter. The provide… |
CVE-2022-29874 | High | 8.8 | 2022-05-20 | A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not encrypt web traffic with clients but communicate in cleartext via… |
CVE-2022-29873 | Critical | 9.8 | 2022-05-20 | A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly validate parameters of certain GET and POST requests. Th… |
CVE-2022-29872 | High | 8.8 | 2022-05-20 | A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly validate parameters of POST requests. This could allow a… |
CVE-2022-29801 | High | 7.5 | 2022-05-20 | A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.13), Teamcenter V13.0 (All versions < V13.0.0.9). The application contains a XM… |
CVE-2022-29320 | High | 7.8 | 2022-05-20 | MiniTool Partition Wizard v12.0 contains an unquoted service path which allows attackers to escalate privileges to the system level. |
CVE-2022-29033 | High | 7.8 | 2022-05-20 | A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), Teamcenter Visualization V1… |
CVE-2022-29032 | High | 7.8 | 2022-05-20 | A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), Teamcenter Visualization V1… |
CVE-2022-29031 | Medium | 5.5 | 2022-05-20 | A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), Teamcenter Visualization V1… |
CVE-2022-29030 | Medium | 5.5 | 2022-05-20 | A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), Teamcenter Visualization V1… |
CVE-2022-29029 | Medium | 5.5 | 2022-05-20 | A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), Teamcenter Visualization V1… |
CVE-2022-29028 | Medium | 5.5 | 2022-05-20 | A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), Teamcenter Visualization V1… |
CVE-2022-29023 | Critical | 9.8 | 2022-05-20 | A buffer overflow vulnerability exists in the razermouse driver of OpenRazer up to version v3.3.0 allows attackers to cause a Denial of Service (DoS) and possi… |
CVE-2022-29022 | Critical | 9.8 | 2022-05-20 | A buffer overflow vulnerability exists in the razeraccessory driver of OpenRazer up to version v3.3.0 allows attackers to cause a Denial of Service (DoS) and p… |
CVE-2022-29021 | Critical | 9.8 | 2022-05-20 | A buffer overflow vulnerability exists in the razerkbd driver of OpenRazer up to version v3.3.0 allows attackers to cause a Denial of Service (DoS) and possibl… |
CVE-2022-28993 | Critical | 9.8 | 2022-05-20 | Multi Store Inventory Management System v1.0 allows attackers to perform an account takeover via a crafted POST request. |
CVE-2022-28992 | High | 8.8 | 2022-05-20 | A Cross-Site Request Forgery (CSRF) in Online Banquet Booking System v1.0 allows attackers to change admin credentials via a crafted POST request. |
CVE-2022-28991 | High | 7.5 | 2022-05-20 | Multi Store Inventory Management System v1.0 was discovered to contain an information disclosure vulnerability which allows attackers to access sensitive files. |
CVE-2022-28106 | Critical | 9.8 | 2022-05-20 | Online Sports Complex Booking System v1.0 was discovered to allow attackers to take over user accounts via a crafted POST request. |
CVE-2022-28105 | Critical | 9.8 | 2022-05-20 | Online Sports Complex Booking System v1.0 was discovered to contain a blind SQL injection vulnerability via the id parameter in /scbs/view_facility.php. |
CVE-2022-28104 | Critical | 9.8 | 2022-05-20 | Foxit PDF Editor v11.3.1 was discovered to contain an arbitrary file upload vulnerability. |
CVE-2022-27653 | High | 7.8 | 2022-05-20 | A vulnerability has been identified in Simcenter Femap (All versions < V2022.2). The affected application contains an out of bounds write past the end of an al… |
CVE-2022-27640 | Medium | 6.5 | 2022-05-20 | A vulnerability has been identified in SIMATIC CP 442-1 RNA (All versions < V1.5.18), SIMATIC CP 443-1 RNA (All versions < V1.5.18). The affected devices impro… |
CVE-2022-27242 | Medium | 5.5 | 2022-05-20 | A vulnerability has been identified in OpenV2G (V0.9.4). The OpenV2G EXI parsing feature is missing a length check when parsing X509 serial numbers. Thus, an a… |
CVE-2022-27095 | High | 7.8 | 2022-05-20 | BattlEye v0.9 contains an unquoted service path which allows attackers to escalate privileges to the system level. |
CVE-2022-27094 | Medium | 6.7 | 2022-05-20 | Sony PlayMemories Home v6.0 contains an unquoted service path which allows attackers to escalate privileges to the system level. |
CVE-2022-26634 | High | 7.8 | 2022-05-20 | HMA VPN v5.3.5913.0 contains an unquoted service path which allows attackers to escalate privileges to the system level. |
CVE-2022-26633 | Critical | 9.8 | 2022-05-20 | Simple Student Quarterly Result/Grade System v1.0 was discovered to contain a SQL injection vulnerability via /sqgs/Actions.php. |
CVE-2022-26632 | Critical | 9.8 | 2022-05-20 | Multi-Vendor Online Groceries Management System v1.0 was discovered to contain a blind SQL injection vulnerability via the id parameter in /products/view_produ… |
CVE-2022-24290 | High | 7.5 | 2022-05-20 | A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.13), Teamcenter V13.0 (All versions < V13.0.0.9), Teamcenter V13.1 (All version… |
CVE-2022-24287 | High | 7.8 | 2022-05-20 | A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC06), SIMATIC PCS 7 V9.1 (All versions <… |
CVE-2022-24045 | Medium | 6.5 | 2022-05-20 | A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions <… |
CVE-2022-24044 | High | 7.5 | 2022-05-20 | A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions <… |
CVE-2022-24043 | Medium | 5.3 | 2022-05-20 | A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions <… |
CVE-2022-1784 | High | 7.5 | 2022-05-20 | Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.8. |
CVE-2022-31215 | Medium | 6.5 | 2022-05-20 | In certain Goverlan products, the Windows Firewall is temporarily turned off upon a Goverlan agent update operation. This allows remote attackers to bypass fir… |
CVE-2022-30551 | High | 7.5 | 2022-05-20 | OPC UA Legacy Java Stack 2022-04-01 allows a remote attacker to cause a server to stop processing messages by sending crafted messages that exhaust available r… |
CVE-2022-25227 | High | 8.8 | 2022-05-20 | Thinfinity VNC v4.0.0.1 contains a Cross-Origin Resource Sharing (CORS) vulnerability which can allow an unprivileged remote attacker, if they can trick a user… |
CVE-2022-25224 | Medium | 5.4 | 2022-05-20 | Proton v0.2.0 allows an attacker to create a malicious link inside a markdown file. When the victim clicks the link, the application opens the site in the curr… |
CVE-2022-25229 | Medium | 5.4 | 2022-05-20 | Popcorn Time 0.4.7 has a Stored XSS in the 'Movies API Server(s)' field via the 'settings' page. The 'nodeIntegration' configuration is set to on which allows… |
CVE-2022-1806 | Medium | 6.1 | 2022-05-20 | Cross-site Scripting (XSS) - Reflected in GitHub repository rtxteam/rtx prior to checkpoint_2022-05-18. |
CVE-2022-1754 | Medium | 6.5 | 2022-05-20 | Integer Overflow or Wraparound in GitHub repository polonel/trudesk prior to 1.2.2. |
CVE-2022-28987 | Medium | 5.3 | 2022-05-20 | Zoho ManageEngine ADSelfService Plus before 6202 allows attackers to perform username enumeration via a crafted POST request to /ServletAPI/accounts/login. |
CVE-2022-28985 | Medium | 6.3 | 2022-05-20 | A stored cross-site scripting (XSS) vulnerability in the addNewPost component of OrangeHRM v4.10.1 allows attackers to execute arbitrary web scripts or HTML vi… |
CVE-2022-28965 | Medium | 6.5 | 2022-05-20 | Multiple DLL hijacking vulnerabilities via the components instup.exe and wsc_proxy.exe in Avast Premium Security before v21.11.2500 allows attackers to execute… |
CVE-2022-28964 | High | 7.1 | 2022-05-20 | An arbitrary file write vulnerability in Avast Premium Security before v21.11.2500 (build 21.11.6809.528) allows attackers to cause a Denial of Service (DoS) v… |
CVE-2022-21500 | High | 7.5 | 2022-05-20 | Vulnerability in Oracle E-Business Suite (component: Manage Proxies). The supported version that is affected is 12.2. Easily exploitable vulnerability allows u… |
CVE-2022-29652 | Medium | 6.1 | 2022-05-19 | Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/classes/Users.php?f=save_client. |
CVE-2022-29304 | High | 8.8 | 2022-05-19 | Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /classes/master.php?f=delete_ Facility. |
CVE-2022-28962 | Critical | 9.8 | 2022-05-19 | Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/classes/Users.php?f=delete_client. |
CVE-2022-28961 | High | 8.8 | 2022-05-19 | Spip Web Framework v3.1.13 and below was discovered to contain multiple SQL injection vulnerabilities at /ecrire via the lier_trad and where parameters. |
CVE-2022-28960 | High | 8.8 | 2022-05-19 | A PHP injection vulnerability in Spip before v3.2.8 allows attackers to execute arbitrary PHP code via the _oups parameter at /ecrire. |
CVE-2022-28959 | Medium | 6.1 | 2022-05-19 | Multiple cross-site scripting (XSS) vulnerabilities in the component /spip.php of Spip Web Framework v3.1.13 and below allows attackers to execute arbitrary we… |
CVE-2022-28948 | High | 7.5 | 2022-05-19 | An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input. |
CVE-2022-28946 | High | 7.5 | 2022-05-19 | An issue in the component ast/parser.go of Open Policy Agent v0.39.0 causes the application to incorrectly interpret every expression, causing a Denial of Serv… |
CVE-2022-30618 | High | 7.5 | 2022-05-19 | An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API users if cont… |
CVE-2022-30617 | High | 8.8 | 2022-05-19 | An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel… |
CVE-2022-1423 | High | 7.1 | 2022-05-19 | Improper access control in the CI/CD cache mechanism in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before… |
CVE-2022-1416 | Medium | 4.3 | 2022-05-19 | Missing sanitization of data in Pipeline error messages in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 befo… |
CVE-2022-1413 | Medium | 5.4 | 2022-05-19 | Missing input masking in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 1… |
CVE-2022-29449 | Medium | 4.1 | 2022-05-19 | Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Opal Hotel Room Booking plugin <= 1.2.7 at WordPress. |
CVE-2022-29446 | Medium | 6.8 | 2022-05-19 | Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Counter Box plugin <= 1.1.1 at WordPress. |
CVE-2022-28927 | Critical | 9.8 | 2022-05-19 | A remote code execution (RCE) vulnerability in Subconverter v0.7.2 allows attackers to execute arbitrary code via crafted config and url parameters. |
CVE-2022-1796 | High | 7.8 | 2022-05-19 | Use After Free in GitHub repository vim/vim prior to 8.2.4979. |
CVE-2022-22978 | Critical | 9.8 | 2022-05-19 | In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on… |
CVE-2022-22976 | Medium | 5.3 | 2022-05-19 | Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the… |
CVE-2022-30018 | High | 8.8 | 2022-05-19 | Mobotix Control Center (MxCC) through 2.5.4.5 has Insufficiently Protected Credentials, Storing Passwords in a Recoverable Format via the MxCC.ini config file… |
CVE-2022-1730 | Medium | 4.6 | 2022-05-19 | Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 18.0.4. |
CVE-2022-1785 | High | 7.8 | 2022-05-19 | Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.4977. |
CVE-2022-1183 | High | 7.5 | 2022-05-19 | On vulnerable configurations, the named daemon may, in some circumstances, terminate with an assertion failure. Vulnerable configurations are those that includ… |
CVE-2022-1670 | High | 7.5 | 2022-05-19 | When generating a user invitation code in Octopus Server, the validity of this code can be set for a specific number of users. It was possible to bypass this r… |