2022 CVEs (page 207)
Page 207 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-28350 | Critical | 9.8 | 2022-05-19 | Arm Mali GPU Kernel Driver allows improper GPU operations in Valhall r29p0 through r36p0 before r37p0 to reach a use-after-free situation. |
CVE-2022-28349 | Critical | 9.8 | 2022-05-19 | Arm Mali GPU Kernel Driver has a use-after-free: Midgard r28p0 through r29p0 before r30p0, Bifrost r17p0 through r23p0 before r24p0, and Valhall r19p0 through… |
CVE-2022-28348 | Critical | 9.8 | 2022-05-19 | Arm Mali GPU Kernel Driver (Midgard r4p0 through r31p0, Bifrost r0p0 through r36p0 before r37p0, and Valhall r19p0 through r36p0 before r37p0) allows improper… |
CVE-2022-30138 | High | 7.8 | 2022-05-18 | Windows Print Spooler Elevation of Privilege Vulnerability |
CVE-2022-29230 | Medium | 6.3 | 2022-05-18 | Hydrogen is a React-based framework for building dynamic, Shopify-powered custom storefronts. There is a potential Cross-Site Scripting (XSS) vulnerability whe… |
CVE-2022-29229 | Medium | 6.3 | 2022-05-18 | CaSS is a Competency and Skills System. CaSS Library, (npm:cassproject) has a missing cryptographic step when storing cryptographic keys that can allow a serve… |
CVE-2022-1774 | Medium | 6.1 | 2022-05-18 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.0.7. |
CVE-2022-30994 | High | 7.5 | 2022-05-18 | Cleartext transmission of sensitive information. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 29240 |
CVE-2022-30993 | High | 7.5 | 2022-05-18 | Cleartext transmission of sensitive information. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 29240 |
CVE-2022-30992 | Medium | 6.1 | 2022-05-18 | Open redirect via user-controlled query parameter. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 29240 |
CVE-2022-30991 | Medium | 6.1 | 2022-05-18 | HTML injection via report name. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 29240 |
CVE-2022-30990 | High | 7.5 | 2022-05-18 | Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 15 (Linux) before build 29240… |
CVE-2022-30033 | High | 7.5 | 2022-05-18 | Tenda TX9 Pro V22.03.02.10 is vulnerable to Buffer Overflow via the functtion setIPv6Status() in httpd module. |
CVE-2022-1771 | Medium | 5.5 | 2022-05-18 | Uncontrolled Recursion in GitHub repository vim/vim prior to 8.2.4975. |
CVE-2022-30600 | Critical | 9.8 | 2022-05-18 | A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed. |
CVE-2022-30599 | Critical | 9.8 | 2022-05-18 | A flaw was found in moodle where an SQL injection risk was identified in Badges code relating to configuring criteria. |
CVE-2022-30598 | Medium | 4.3 | 2022-05-18 | A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise have access to it. |
CVE-2022-30597 | Medium | 5.3 | 2022-05-18 | A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field. |
CVE-2022-30111 | Medium | 6.8 | 2022-05-18 | Due to the use of an insecure algorithm for rolling codes in MCK Smartlock 1.0, allows attackers to unlock the mechanism via replay attacks. |
CVE-2022-28921 | Medium | 6.5 | 2022-05-18 | A Cross-Site Request Forgery (CSRF) vulnerability discovered in BlogEngine.Net v3.3.8.0 allows unauthenticated attackers to read arbitrary files on the hosting… |
CVE-2022-25617 | Medium | 4.7 | 2022-05-18 | Reflected Cross-Site Scripting (XSS) vulnerability in Code Snippets plugin <= 2.14.3 at WordPress via &orderby vulnerable parameter. |
CVE-2022-30596 | Medium | 5.4 | 2022-05-18 | A flaw was found in moodle where ID numbers displayed when bulk allocating markers to assignments required additional sanitizing to prevent a stored XSS risk. |
CVE-2022-29445 | Medium | 6.8 | 2022-05-18 | Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Popup Box plugin <= 2.1.2 at WordPress. |
CVE-2022-28924 | Medium | 6.5 | 2022-05-18 | An information disclosure vulnerability in UniverSIS-Students before v1.5.0 allows attackers to obtain sensitive information via a crafted GET request to the e… |
CVE-2022-25162 | Medium | 5.3 | 2022-05-18 | Improper Input Validation vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U-xMy/z(x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serial number 17X**** or… |
CVE-2022-25161 | High | 8.6 | 2022-05-18 | Improper Input Validation vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U-xMy/z(x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serial number 17X**** or… |
CVE-2022-22787 | Medium | 5.9 | 2022-05-18 | The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.10.0 fails to properly validate the hostname during a server switch… |
CVE-2022-22778 | High | 8.8 | 2022-05-18 | The Web Server component of TIBCO Software Inc.'s TIBCO BusinessConnect Trading Community Management contains an easily exploitable vulnerability that allows a… |
CVE-2022-22777 | Medium | 6.1 | 2022-05-18 | The Web Server component of TIBCO Software Inc.'s TIBCO BusinessConnect Trading Community Management contains easily exploitable Reflected Cross Site Scripting… |
CVE-2022-22776 | High | 8.0 | 2022-05-18 | The Web Server component of TIBCO Software Inc.'s TIBCO BusinessConnect Trading Community Management contains easily exploitable vulnerabilities that allows a… |
CVE-2022-1734 | High | 7.0 | 2022-05-18 | A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use after free both read or write when non synchronized… |
CVE-2022-0883 | High | 7.3 | 2022-05-18 | SLM has an issue with Windows Unquoted/Trusted Service Paths Security Issue. All installations version 9.x.x prior to 9.20.1 should be patched. |
CVE-2022-30105 | Critical | 9.8 | 2022-05-18 | In Belkin N300 Firmware 1.00.08, the script located at /setting_hidden.asp, which is accessible before and after configuring the device, exhibits multiple remo… |
CVE-2022-28917 | High | 7.5 | 2022-05-18 | Tenda AX12 v22.03.01.21_cn was discovered to contain a stack overflow via the lanIp parameter in /goform/AdvSetLanIp. |
CVE-2022-22786 | High | 7.5 | 2022-05-18 | The Zoom Client for Meetings for Windows before version 5.10.0 and Zoom Rooms for Conference Room for Windows before version 5.10.0, fails to properly check th… |
CVE-2022-22785 | Medium | 5.9 | 2022-05-18 | The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly constrain client session cookies to Zoom do… |
CVE-2022-22784 | High | 8.1 | 2022-05-18 | The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly parse XML stanzas in XMPP messages. This ca… |
CVE-2022-1767 | High | 7.5 | 2022-05-18 | Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.7. |
CVE-2022-1110 | Medium | 5.5 | 2022-05-18 | A buffer overflow vulnerability in Lenovo Smart Standby Driver prior to version 4.1.50.0 could allow a local attacker to cause denial of service. |
CVE-2022-30065 | High | 7.8 | 2022-05-18 | A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar fun… |
CVE-2022-29518 | High | 7.0 | 2022-05-18 | Screen Creator Advance2, HMI GC-A2 series, and Real time remote monitoring and control tool Screen Creator Advance2 versions prior to Ver.0.1.1.3 Build01, HMI… |
CVE-2022-29516 | Critical | 9.8 | 2022-05-18 | The web console of FUJITSU Network IPCOM series (IPCOM EX2 IN(3200, 3500), IPCOM EX2 LB(1100, 3200, 3500), IPCOM EX2 SC(1100, 3200, 3500), IPCOM EX2 NW(1100, 3… |
CVE-2022-28717 | Medium | 4.8 | 2022-05-18 | Cross-site scripting vulnerability in Rebooter(WATCH BOOT nino RPC-M2C [End of Sale] all firmware versions, WATCH BOOT light RPC-M5C [End of Sale] all firmware… |
CVE-2022-27632 | High | 8.8 | 2022-05-18 | Cross-site request forgery (CSRF) vulnerability in Rebooter(WATCH BOOT nino RPC-M2C [End of Sale] all firmware versions, WATCH BOOT light RPC-M5C [End of Sale]… |
CVE-2022-1795 | Critical | 9.8 | 2022-05-18 | Use After Free in GitHub repository gpac/gpac prior to v2.1.0-DEV. |
CVE-2022-1782 | Medium | 6.1 | 2022-05-18 | Cross-site Scripting (XSS) - Generic in GitHub repository erudika/para prior to v1.45.11. |
CVE-2022-23068 | Medium | 5.4 | 2022-05-18 | ToolJet versions v0.6.0 to v1.10.2 are vulnerable to HTML injection where an attacker can inject malicious code inside the first name and last name field while… |
CVE-2022-23067 | High | 8.8 | 2022-05-18 | ToolJet versions v0.5.0 to v1.2.2 are vulnerable to token leakage via Referer header that leads to account takeover . If the user opens the invite link/signup… |
CVE-2022-1727 | High | 8.8 | 2022-05-18 | Improper Input Validation in GitHub repository jgraph/drawio prior to 18.0.6. |
CVE-2022-1432 | Medium | 6.4 | 2022-05-18 | Cross-site Scripting (XSS) - Generic in GitHub repository octoprint/octoprint prior to 1.8.0. |
CVE-2022-1430 | High | 7.5 | 2022-05-18 | Cross-site Scripting (XSS) - DOM in GitHub repository octoprint/octoprint prior to 1.8.0. |
CVE-2022-29646 | Medium | 5.3 | 2022-05-18 | An access control issue in TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 allows attackers to obtain sensitive information via a crafted w… |
CVE-2022-29645 | Critical | 9.8 | 2022-05-18 | TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a hard coded password for root stored in the component /etc/shad… |
CVE-2022-29644 | Critical | 9.8 | 2022-05-18 | TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a hard coded password for the telnet service stored in the compo… |
CVE-2022-29643 | High | 7.5 | 2022-05-18 | TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the macAddress parameter in the function se… |
CVE-2022-29642 | High | 7.5 | 2022-05-18 | TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the url parameter in the function setUrlFil… |
CVE-2022-29641 | High | 7.5 | 2022-05-18 | TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the startTime and endTime parameters in the… |
CVE-2022-29640 | High | 7.5 | 2022-05-18 | TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the comment parameter in the function setPo… |
CVE-2022-29639 | High | 8.1 | 2022-05-18 | TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a command injection vulnerability via the magicid parameter in t… |
CVE-2022-29638 | High | 7.5 | 2022-05-18 | TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the comment parameter in the function setIp… |
CVE-2022-28956 | Critical | 9.8 | 2022-05-18 | An issue in the getcfg.php component of D-Link DIR816L_FW206b01 allows attackers to access the device via a crafted payload. |
CVE-2022-28955 | High | 7.5 | 2022-05-18 | An access control issue in D-Link DIR816L_FW206b01 allows unauthenticated attackers to access folders folder_view.php and category_view.php. |
CVE-2022-30976 | High | 7.1 | 2022-05-18 | GPAC 2.0.0 misuses a certain Unicode utf8_wcslen (renamed gf_utf8_wcslen) function in utils/utf.c, resulting in a heap-based buffer over-read, as demonstrated… |
CVE-2022-30975 | Medium | 5.5 | 2022-05-18 | In Artifex MuJS through 1.2.0, jsP_dumpsyntax in jsdump.c has a NULL pointer dereference, as demonstrated by mujs-pp. |
CVE-2022-30974 | Medium | 5.5 | 2022-05-18 | compile in regexp.c in Artifex MuJS through 1.2.0 results in stack consumption because of unlimited recursion, a different issue than CVE-2019-11413. |
CVE-2022-29174 | High | 8.1 | 2022-05-17 | countly-server is the server-side part of Countly, a product analytics solution. Prior to versions 22.03.7 and 21.11.4, a malicious actor who knows an account… |
CVE-2022-29162 | Medium | 5.9 | 2022-05-17 | runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where `runc… |
CVE-2022-28616 | Critical | 9.8 | 2022-05-17 | A remote server-side request forgery (ssrf) vulnerability was discovered in HPE OneView version(s): Prior to 7.0. HPE has provided a software update to resolve… |
CVE-2022-1362 | Medium | 5.0 | 2022-05-17 | The affected On-Premise cnMaestro is vulnerable inside a specific route where a user can upload a crafted package to the system. An attacker could abuse this u… |
CVE-2022-1361 | High | 7.4 | 2022-05-17 | The affected On-Premise cnMaestro is vulnerable to a pre-auth data exfiltration through improper neutralization of special elements used in an SQL command. Thi… |
CVE-2022-1360 | High | 8.2 | 2022-05-17 | The affected On-Premise cnMaestro is vulnerable to execution of code on the cnMaestro hosting server. This could allow a remote attacker to change server confi… |
CVE-2022-1359 | Medium | 5.7 | 2022-05-17 | The affected On-Premise cnMaestro is vulnerable to an arbitrary file-write through improper limitation of a pathname to a restricted directory inside a specifi… |
CVE-2022-1358 | Medium | 5.9 | 2022-05-17 | The affected On-Premise is vulnerable to data exfiltration through improper neutralization of special elements used in an SQL command. This could allow an atta… |
CVE-2022-1357 | Critical | 9.8 | 2022-05-17 | The affected On-Premise cnMaestro allows an unauthenticated attacker to access the cnMaestro server and execute arbitrary code in the privileges of the web ser… |
CVE-2022-1356 | High | 7.1 | 2022-05-17 | cnMaestro is vulnerable to a local privilege escalation. By default, a user does not have root privileges. However, a user can run scripts as sudo, which could… |
CVE-2022-30054 | Critical | 9.8 | 2022-05-17 | In Covid 19 Travel Pass Management 1.0, the code parameter is vulnerable to SQL injection attacks. |
CVE-2022-30053 | Critical | 9.8 | 2022-05-17 | In Toll Tax Management System 1.0, the id parameter appears to be vulnerable to SQL injection attacks. |
CVE-2022-30052 | Critical | 9.8 | 2022-05-17 | In Home Clean Service System 1.0, the password parameter is vulnerable to SQL injection attacks. |
CVE-2022-30045 | Medium | 6.5 | 2022-05-17 | An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_decode() performs incorrect memory handling while parsing crafted XML files, leading t… |
CVE-2022-29436 | Medium | 4.7 | 2022-05-17 | Persistent Cross-Site Scripting (XSS) vulnerability in Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on WordPress via Cross-Site Request Forgery… |
CVE-2022-29435 | Medium | 5.4 | 2022-05-17 | Cross-Site Request Forgery (CSRF) vulnerability in Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on WordPress allows an attacker to delete or to… |
CVE-2022-28617 | Critical | 9.8 | 2022-05-17 | A remote bypass security restrictions vulnerability was discovered in HPE OneView version(s): Prior to 7.0. HPE has provided a software update to resolve this… |
CVE-2022-28192 | Medium | 4.1 | 2022-05-17 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko), where it may lead to a use-after-free, which in turn may cause denial of… |
CVE-2022-28191 | Medium | 5.5 | 2022-05-17 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko), where uncontrolled resource consumption can be triggered by an unprivileg… |
CVE-2022-28190 | Medium | 5.5 | 2022-05-17 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where improper input validati… |
CVE-2022-28189 | Medium | 5.5 | 2022-05-17 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where a NULL pointer derefere… |
CVE-2022-28188 | Medium | 5.5 | 2022-05-17 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where the product receives in… |
CVE-2022-28187 | Medium | 5.5 | 2022-05-17 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where the memory management software does not release a… |
CVE-2022-28186 | Medium | 6.1 | 2022-05-17 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where the product receives in… |
CVE-2022-28185 | Medium | 6.8 | 2022-05-17 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the ECC layer, where an unprivileged regular user can cause an out-of-bounds write… |
CVE-2022-28184 | High | 7.1 | 2022-05-17 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where an unprivileg… |
CVE-2022-28183 | High | 7.7 | 2022-05-17 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause an out-of-bound… |
CVE-2022-28182 | High | 8.5 | 2022-05-17 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the DirectX11 user mode driver (nvwgf2um/x.dll), where an unauthorized attacker on the networ… |
CVE-2022-28181 | High | 8.5 | 2022-05-17 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user on the network can cause… |
CVE-2022-24394 | High | 8.8 | 2022-05-17 | Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “update_checkfile” value… |
CVE-2022-24393 | High | 8.8 | 2022-05-17 | Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “check_vertica_upgrade”… |
CVE-2022-24392 | High | 8.8 | 2022-05-17 | Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “feed_comm_test” value f… |
CVE-2022-24391 | High | 8.8 | 2022-05-17 | Vulnerability in Fidelis Network and Deception CommandPost enables SQL injection through the web interface by an attacker with user level access. The vulnerabi… |
CVE-2022-24390 | High | 8.8 | 2022-05-17 | Vulnerability in rconfig “remote_text_file” enables an attacker with user level access to the CLI to inject user level commands into Fidelis Network and Decept… |
CVE-2022-24389 | High | 8.8 | 2022-05-17 | Vulnerability in rconfig “cert_utils” enables an attacker with user level access to the CLI to inject root level commands into Fidelis Network and Deception Co… |