2022 CVEs (page 207)
Page 207 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-28960 | High | 8.8 | 2022-05-19 | A PHP injection vulnerability in Spip before v3.2.8 allows attackers to execute arbitrary PHP code via the _oups parameter at /ecrire. |
CVE-2022-28959 | Medium | 6.1 | 2022-05-19 | Multiple cross-site scripting (XSS) vulnerabilities in the component /spip.php of Spip Web Framework v3.1.13 and below allows attackers to execute arbitrary we… |
CVE-2022-28948 | High | 7.5 | 2022-05-19 | An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input. |
CVE-2022-28946 | High | 7.5 | 2022-05-19 | An issue in the component ast/parser.go of Open Policy Agent v0.39.0 causes the application to incorrectly interpret every expression, causing a Denial of Serv… |
CVE-2022-30618 | High | 7.5 | 2022-05-19 | An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API users if cont… |
CVE-2022-30617 | High | 8.8 | 2022-05-19 | An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel… |
CVE-2022-1423 | High | 7.1 | 2022-05-19 | Improper access control in the CI/CD cache mechanism in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before… |
CVE-2022-1416 | Medium | 4.3 | 2022-05-19 | Missing sanitization of data in Pipeline error messages in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 befo… |
CVE-2022-1413 | Medium | 5.4 | 2022-05-19 | Missing input masking in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 1… |
CVE-2022-29449 | Medium | 4.1 | 2022-05-19 | Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Opal Hotel Room Booking plugin <= 1.2.7 at WordPress. |
CVE-2022-29446 | Medium | 6.8 | 2022-05-19 | Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Counter Box plugin <= 1.1.1 at WordPress. |
CVE-2022-28927 | Critical | 9.8 | 2022-05-19 | A remote code execution (RCE) vulnerability in Subconverter v0.7.2 allows attackers to execute arbitrary code via crafted config and url parameters. |
CVE-2022-1796 | High | 7.8 | 2022-05-19 | Use After Free in GitHub repository vim/vim prior to 8.2.4979. |
CVE-2022-22978 | Critical | 9.8 | 2022-05-19 | In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on… |
CVE-2022-22976 | Medium | 5.3 | 2022-05-19 | Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the… |
CVE-2022-30018 | High | 8.8 | 2022-05-19 | Mobotix Control Center (MxCC) through 2.5.4.5 has Insufficiently Protected Credentials, Storing Passwords in a Recoverable Format via the MxCC.ini config file… |
CVE-2022-1730 | Medium | 4.6 | 2022-05-19 | Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 18.0.4. |
CVE-2022-1785 | High | 7.8 | 2022-05-19 | Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.4977. |
CVE-2022-1183 | High | 7.5 | 2022-05-19 | On vulnerable configurations, the named daemon may, in some circumstances, terminate with an assertion failure. Vulnerable configurations are those that includ… |
CVE-2022-1670 | High | 7.5 | 2022-05-19 | When generating a user invitation code in Octopus Server, the validity of this code can be set for a specific number of users. It was possible to bypass this r… |
CVE-2022-28350 | Critical | 9.8 | 2022-05-19 | Arm Mali GPU Kernel Driver allows improper GPU operations in Valhall r29p0 through r36p0 before r37p0 to reach a use-after-free situation. |
CVE-2022-28349 | Critical | 9.8 | 2022-05-19 | Arm Mali GPU Kernel Driver has a use-after-free: Midgard r28p0 through r29p0 before r30p0, Bifrost r17p0 through r23p0 before r24p0, and Valhall r19p0 through… |
CVE-2022-28348 | Critical | 9.8 | 2022-05-19 | Arm Mali GPU Kernel Driver (Midgard r4p0 through r31p0, Bifrost r0p0 through r36p0 before r37p0, and Valhall r19p0 through r36p0 before r37p0) allows improper… |
CVE-2022-30138 | High | 7.8 | 2022-05-18 | Windows Print Spooler Elevation of Privilege Vulnerability |
CVE-2022-29230 | Medium | 6.3 | 2022-05-18 | Hydrogen is a React-based framework for building dynamic, Shopify-powered custom storefronts. There is a potential Cross-Site Scripting (XSS) vulnerability whe… |
CVE-2022-29229 | Medium | 6.3 | 2022-05-18 | CaSS is a Competency and Skills System. CaSS Library, (npm:cassproject) has a missing cryptographic step when storing cryptographic keys that can allow a serve… |
CVE-2022-1774 | Medium | 6.1 | 2022-05-18 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.0.7. |
CVE-2022-30994 | High | 7.5 | 2022-05-18 | Cleartext transmission of sensitive information. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 29240 |
CVE-2022-30993 | High | 7.5 | 2022-05-18 | Cleartext transmission of sensitive information. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 29240 |
CVE-2022-30992 | Medium | 6.1 | 2022-05-18 | Open redirect via user-controlled query parameter. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 29240 |
CVE-2022-30991 | Medium | 6.1 | 2022-05-18 | HTML injection via report name. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 29240 |
CVE-2022-30990 | High | 7.5 | 2022-05-18 | Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 15 (Linux) before build 29240… |
CVE-2022-30033 | High | 7.5 | 2022-05-18 | Tenda TX9 Pro V22.03.02.10 is vulnerable to Buffer Overflow via the functtion setIPv6Status() in httpd module. |
CVE-2022-1771 | Medium | 5.5 | 2022-05-18 | Uncontrolled Recursion in GitHub repository vim/vim prior to 8.2.4975. |
CVE-2022-30600 | Critical | 9.8 | 2022-05-18 | A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed. |
CVE-2022-30599 | Critical | 9.8 | 2022-05-18 | A flaw was found in moodle where an SQL injection risk was identified in Badges code relating to configuring criteria. |
CVE-2022-30598 | Medium | 4.3 | 2022-05-18 | A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise have access to it. |
CVE-2022-30597 | Medium | 5.3 | 2022-05-18 | A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field. |
CVE-2022-30111 | Medium | 6.8 | 2022-05-18 | Due to the use of an insecure algorithm for rolling codes in MCK Smartlock 1.0, allows attackers to unlock the mechanism via replay attacks. |
CVE-2022-28921 | Medium | 6.5 | 2022-05-18 | A Cross-Site Request Forgery (CSRF) vulnerability discovered in BlogEngine.Net v3.3.8.0 allows unauthenticated attackers to read arbitrary files on the hosting… |
CVE-2022-25617 | Medium | 4.7 | 2022-05-18 | Reflected Cross-Site Scripting (XSS) vulnerability in Code Snippets plugin <= 2.14.3 at WordPress via &orderby vulnerable parameter. |
CVE-2022-30596 | Medium | 5.4 | 2022-05-18 | A flaw was found in moodle where ID numbers displayed when bulk allocating markers to assignments required additional sanitizing to prevent a stored XSS risk. |
CVE-2022-29445 | Medium | 6.8 | 2022-05-18 | Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Popup Box plugin <= 2.1.2 at WordPress. |
CVE-2022-28924 | Medium | 6.5 | 2022-05-18 | An information disclosure vulnerability in UniverSIS-Students before v1.5.0 allows attackers to obtain sensitive information via a crafted GET request to the e… |
CVE-2022-25162 | Medium | 5.3 | 2022-05-18 | Improper Input Validation vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U-xMy/z(x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serial number 17X**** or… |
CVE-2022-25161 | High | 8.6 | 2022-05-18 | Improper Input Validation vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U-xMy/z(x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serial number 17X**** or… |
CVE-2022-22787 | Medium | 5.9 | 2022-05-18 | The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.10.0 fails to properly validate the hostname during a server switch… |
CVE-2022-22778 | High | 8.8 | 2022-05-18 | The Web Server component of TIBCO Software Inc.'s TIBCO BusinessConnect Trading Community Management contains an easily exploitable vulnerability that allows a… |
CVE-2022-22777 | Medium | 6.1 | 2022-05-18 | The Web Server component of TIBCO Software Inc.'s TIBCO BusinessConnect Trading Community Management contains easily exploitable Reflected Cross Site Scripting… |
CVE-2022-22776 | High | 8.0 | 2022-05-18 | The Web Server component of TIBCO Software Inc.'s TIBCO BusinessConnect Trading Community Management contains easily exploitable vulnerabilities that allows a… |
CVE-2022-1734 | High | 7.0 | 2022-05-18 | A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use after free both read or write when non synchronized… |
CVE-2022-0883 | High | 7.3 | 2022-05-18 | SLM has an issue with Windows Unquoted/Trusted Service Paths Security Issue. All installations version 9.x.x prior to 9.20.1 should be patched. |
CVE-2022-30105 | Critical | 9.8 | 2022-05-18 | In Belkin N300 Firmware 1.00.08, the script located at /setting_hidden.asp, which is accessible before and after configuring the device, exhibits multiple remo… |
CVE-2022-28917 | High | 7.5 | 2022-05-18 | Tenda AX12 v22.03.01.21_cn was discovered to contain a stack overflow via the lanIp parameter in /goform/AdvSetLanIp. |
CVE-2022-22786 | High | 7.5 | 2022-05-18 | The Zoom Client for Meetings for Windows before version 5.10.0 and Zoom Rooms for Conference Room for Windows before version 5.10.0, fails to properly check th… |
CVE-2022-22785 | Medium | 5.9 | 2022-05-18 | The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly constrain client session cookies to Zoom do… |
CVE-2022-22784 | High | 8.1 | 2022-05-18 | The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly parse XML stanzas in XMPP messages. This ca… |
CVE-2022-1767 | High | 7.5 | 2022-05-18 | Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.7. |
CVE-2022-1110 | Medium | 5.5 | 2022-05-18 | A buffer overflow vulnerability in Lenovo Smart Standby Driver prior to version 4.1.50.0 could allow a local attacker to cause denial of service. |
CVE-2022-30065 | High | 7.8 | 2022-05-18 | A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar fun… |
CVE-2022-29518 | High | 7.0 | 2022-05-18 | Screen Creator Advance2, HMI GC-A2 series, and Real time remote monitoring and control tool Screen Creator Advance2 versions prior to Ver.0.1.1.3 Build01, HMI… |
CVE-2022-29516 | Critical | 9.8 | 2022-05-18 | The web console of FUJITSU Network IPCOM series (IPCOM EX2 IN(3200, 3500), IPCOM EX2 LB(1100, 3200, 3500), IPCOM EX2 SC(1100, 3200, 3500), IPCOM EX2 NW(1100, 3… |
CVE-2022-28717 | Medium | 4.8 | 2022-05-18 | Cross-site scripting vulnerability in Rebooter(WATCH BOOT nino RPC-M2C [End of Sale] all firmware versions, WATCH BOOT light RPC-M5C [End of Sale] all firmware… |
CVE-2022-27632 | High | 8.8 | 2022-05-18 | Cross-site request forgery (CSRF) vulnerability in Rebooter(WATCH BOOT nino RPC-M2C [End of Sale] all firmware versions, WATCH BOOT light RPC-M5C [End of Sale]… |
CVE-2022-1795 | Critical | 9.8 | 2022-05-18 | Use After Free in GitHub repository gpac/gpac prior to v2.1.0-DEV. |
CVE-2022-1782 | Medium | 6.1 | 2022-05-18 | Cross-site Scripting (XSS) - Generic in GitHub repository erudika/para prior to v1.45.11. |
CVE-2022-23068 | Medium | 5.4 | 2022-05-18 | ToolJet versions v0.6.0 to v1.10.2 are vulnerable to HTML injection where an attacker can inject malicious code inside the first name and last name field while… |
CVE-2022-23067 | High | 8.8 | 2022-05-18 | ToolJet versions v0.5.0 to v1.2.2 are vulnerable to token leakage via Referer header that leads to account takeover . If the user opens the invite link/signup… |
CVE-2022-1727 | High | 8.8 | 2022-05-18 | Improper Input Validation in GitHub repository jgraph/drawio prior to 18.0.6. |
CVE-2022-1432 | Medium | 6.4 | 2022-05-18 | Cross-site Scripting (XSS) - Generic in GitHub repository octoprint/octoprint prior to 1.8.0. |
CVE-2022-1430 | High | 7.5 | 2022-05-18 | Cross-site Scripting (XSS) - DOM in GitHub repository octoprint/octoprint prior to 1.8.0. |
CVE-2022-29646 | Medium | 5.3 | 2022-05-18 | An access control issue in TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 allows attackers to obtain sensitive information via a crafted w… |
CVE-2022-29645 | Critical | 9.8 | 2022-05-18 | TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a hard coded password for root stored in the component /etc/shad… |
CVE-2022-29644 | Critical | 9.8 | 2022-05-18 | TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a hard coded password for the telnet service stored in the compo… |
CVE-2022-29643 | High | 7.5 | 2022-05-18 | TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the macAddress parameter in the function se… |
CVE-2022-29642 | High | 7.5 | 2022-05-18 | TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the url parameter in the function setUrlFil… |
CVE-2022-29641 | High | 7.5 | 2022-05-18 | TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the startTime and endTime parameters in the… |
CVE-2022-29640 | High | 7.5 | 2022-05-18 | TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the comment parameter in the function setPo… |
CVE-2022-29639 | High | 8.1 | 2022-05-18 | TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a command injection vulnerability via the magicid parameter in t… |
CVE-2022-29638 | High | 7.5 | 2022-05-18 | TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the comment parameter in the function setIp… |
CVE-2022-28956 | Critical | 9.8 | 2022-05-18 | An issue in the getcfg.php component of D-Link DIR816L_FW206b01 allows attackers to access the device via a crafted payload. |
CVE-2022-28955 | High | 7.5 | 2022-05-18 | An access control issue in D-Link DIR816L_FW206b01 allows unauthenticated attackers to access folders folder_view.php and category_view.php. |
CVE-2022-30976 | High | 7.1 | 2022-05-18 | GPAC 2.0.0 misuses a certain Unicode utf8_wcslen (renamed gf_utf8_wcslen) function in utils/utf.c, resulting in a heap-based buffer over-read, as demonstrated… |
CVE-2022-30975 | Medium | 5.5 | 2022-05-18 | In Artifex MuJS through 1.2.0, jsP_dumpsyntax in jsdump.c has a NULL pointer dereference, as demonstrated by mujs-pp. |
CVE-2022-30974 | Medium | 5.5 | 2022-05-18 | compile in regexp.c in Artifex MuJS through 1.2.0 results in stack consumption because of unlimited recursion, a different issue than CVE-2019-11413. |
CVE-2022-29174 | High | 8.1 | 2022-05-17 | countly-server is the server-side part of Countly, a product analytics solution. Prior to versions 22.03.7 and 21.11.4, a malicious actor who knows an account… |
CVE-2022-29162 | Medium | 5.9 | 2022-05-17 | runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where `runc… |
CVE-2022-28616 | Critical | 9.8 | 2022-05-17 | A remote server-side request forgery (ssrf) vulnerability was discovered in HPE OneView version(s): Prior to 7.0. HPE has provided a software update to resolve… |
CVE-2022-1362 | Medium | 5.0 | 2022-05-17 | The affected On-Premise cnMaestro is vulnerable inside a specific route where a user can upload a crafted package to the system. An attacker could abuse this u… |
CVE-2022-1361 | High | 7.4 | 2022-05-17 | The affected On-Premise cnMaestro is vulnerable to a pre-auth data exfiltration through improper neutralization of special elements used in an SQL command. Thi… |
CVE-2022-1360 | High | 8.2 | 2022-05-17 | The affected On-Premise cnMaestro is vulnerable to execution of code on the cnMaestro hosting server. This could allow a remote attacker to change server confi… |
CVE-2022-1359 | Medium | 5.7 | 2022-05-17 | The affected On-Premise cnMaestro is vulnerable to an arbitrary file-write through improper limitation of a pathname to a restricted directory inside a specifi… |
CVE-2022-1358 | Medium | 5.9 | 2022-05-17 | The affected On-Premise is vulnerable to data exfiltration through improper neutralization of special elements used in an SQL command. This could allow an atta… |
CVE-2022-1357 | Critical | 9.8 | 2022-05-17 | The affected On-Premise cnMaestro allows an unauthenticated attacker to access the cnMaestro server and execute arbitrary code in the privileges of the web ser… |
CVE-2022-1356 | High | 7.1 | 2022-05-17 | cnMaestro is vulnerable to a local privilege escalation. By default, a user does not have root privileges. However, a user can run scripts as sudo, which could… |
CVE-2022-30054 | Critical | 9.8 | 2022-05-17 | In Covid 19 Travel Pass Management 1.0, the code parameter is vulnerable to SQL injection attacks. |
CVE-2022-30053 | Critical | 9.8 | 2022-05-17 | In Toll Tax Management System 1.0, the id parameter appears to be vulnerable to SQL injection attacks. |
CVE-2022-30052 | Critical | 9.8 | 2022-05-17 | In Home Clean Service System 1.0, the password parameter is vulnerable to SQL injection attacks. |
CVE-2022-30045 | Medium | 6.5 | 2022-05-17 | An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_decode() performs incorrect memory handling while parsing crafted XML files, leading t… |
CVE-2022-29436 | Medium | 4.7 | 2022-05-17 | Persistent Cross-Site Scripting (XSS) vulnerability in Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on WordPress via Cross-Site Request Forgery… |