2022 CVEs (page 208)
Page 208 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-29435 | Medium | 5.4 | 2022-05-17 | Cross-Site Request Forgery (CSRF) vulnerability in Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on WordPress allows an attacker to delete or to… |
CVE-2022-28617 | Critical | 9.8 | 2022-05-17 | A remote bypass security restrictions vulnerability was discovered in HPE OneView version(s): Prior to 7.0. HPE has provided a software update to resolve this… |
CVE-2022-28192 | Medium | 4.1 | 2022-05-17 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko), where it may lead to a use-after-free, which in turn may cause denial of… |
CVE-2022-28191 | Medium | 5.5 | 2022-05-17 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko), where uncontrolled resource consumption can be triggered by an unprivileg… |
CVE-2022-28190 | Medium | 5.5 | 2022-05-17 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where improper input validati… |
CVE-2022-28189 | Medium | 5.5 | 2022-05-17 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where a NULL pointer derefere… |
CVE-2022-28188 | Medium | 5.5 | 2022-05-17 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where the product receives in… |
CVE-2022-28187 | Medium | 5.5 | 2022-05-17 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where the memory management software does not release a… |
CVE-2022-28186 | Medium | 6.1 | 2022-05-17 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where the product receives in… |
CVE-2022-28185 | Medium | 6.8 | 2022-05-17 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the ECC layer, where an unprivileged regular user can cause an out-of-bounds write… |
CVE-2022-28184 | High | 7.1 | 2022-05-17 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where an unprivileg… |
CVE-2022-28183 | High | 7.7 | 2022-05-17 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause an out-of-bound… |
CVE-2022-28182 | High | 8.5 | 2022-05-17 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the DirectX11 user mode driver (nvwgf2um/x.dll), where an unauthorized attacker on the networ… |
CVE-2022-28181 | High | 8.5 | 2022-05-17 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user on the network can cause… |
CVE-2022-24394 | High | 8.8 | 2022-05-17 | Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “update_checkfile” value… |
CVE-2022-24393 | High | 8.8 | 2022-05-17 | Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “check_vertica_upgrade”… |
CVE-2022-24392 | High | 8.8 | 2022-05-17 | Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “feed_comm_test” value f… |
CVE-2022-24391 | High | 8.8 | 2022-05-17 | Vulnerability in Fidelis Network and Deception CommandPost enables SQL injection through the web interface by an attacker with user level access. The vulnerabi… |
CVE-2022-24390 | High | 8.8 | 2022-05-17 | Vulnerability in rconfig “remote_text_file” enables an attacker with user level access to the CLI to inject user level commands into Fidelis Network and Decept… |
CVE-2022-24389 | High | 8.8 | 2022-05-17 | Vulnerability in rconfig “cert_utils” enables an attacker with user level access to the CLI to inject root level commands into Fidelis Network and Deception Co… |
CVE-2022-24388 | High | 8.8 | 2022-05-17 | Vulnerability in rconfig “date” enables an attacker with user level access to the CLI to inject root level commands into Fidelis Network and Deception CommandP… |
CVE-2022-23706 | Medium | 6.1 | 2022-05-17 | A remote cross-site scripting (xss) vulnerability was discovered in HPE OneView version(s): Prior to 7.0. HPE has provided a software update to resolve this vu… |
CVE-2022-1118 | High | 8.6 | 2022-05-17 | Connected Components Workbench (v13.00.00 and prior), ISaGRAF Workbench (v6.0 though v6.6.9), and Safety Instrumented System Workstation (v1.2 and prior (for T… |
CVE-2022-0997 | Low | 3.9 | 2022-05-17 | Improper file permissions in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables an attacker with local, administrative… |
CVE-2022-0486 | Medium | 4.4 | 2022-05-17 | Improper file permissions in the CommandPost, Collector, Sensor, and Sandbox components of Fidelis Network and Deception enables an attacker with local, admini… |
CVE-2022-30688 | High | 7.8 | 2022-05-17 | needrestart 0.8 through 3.5 before 3.6 is prone to local privilege escalation. Regexes to detect the Perl, Python, and Ruby interpreters are not anchored, allo… |
CVE-2022-29429 | High | 8.8 | 2022-05-17 | Remote Code Execution (RCE) in Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on WordPress via Cross-Site Request Forgery. |
CVE-2022-24890 | Low | 2.4 | 2022-05-17 | Nextcloud Talk is a video and audio conferencing app for Nextcloud. In versions prior to 13.0.5 and 14.0.0, a call moderator can indirectly enable user webcams… |
CVE-2022-23674 | Medium | 5.4 | 2022-05-17 | A remote authenticated stored cross-site scripting (xss) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and… |
CVE-2022-1735 | High | 7.8 | 2022-05-17 | Classic Buffer Overflow in GitHub repository vim/vim prior to 8.2.4969. |
CVE-2022-30689 | Medium | 5.3 | 2022-05-17 | HashiCorp Vault and Vault Enterprise from 1.10.0 to 1.10.2 did not correctly configure and enforce MFA on login after server restarts. This affects the Login M… |
CVE-2022-24611 | Medium | 6.5 | 2022-05-17 | Denial of Service (DoS) in the Z-Wave S0 NonceGet protocol specification in Silicon Labs Z-Wave 500 series allows local attackers to block S0/S2 protected Z-Wa… |
CVE-2022-23675 | Medium | 4.8 | 2022-05-17 | A remote authenticated stored cross-site scripting (xss) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and… |
CVE-2022-23673 | High | 7.2 | 2022-05-17 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF… |
CVE-2022-23672 | High | 7.2 | 2022-05-17 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF… |
CVE-2022-23671 | High | 7.5 | 2022-05-17 | A remote authenticated information disclosure vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8… |
CVE-2022-23669 | High | 8.8 | 2022-05-17 | A remote authorization bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below… |
CVE-2022-22775 | High | 8.1 | 2022-05-17 | The Workspace client component of TIBCO Software Inc.'s TIBCO BPM Enterprise and TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric contains difficult t… |
CVE-2022-22773 | High | 7.7 | 2022-05-17 | The REST API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Develo… |
CVE-2022-1706 | Medium | 6.5 | 2022-05-17 | A vulnerability was found in Ignition where ignition configs are accessible from unprivileged containers in VMs running on VMware products. This issue is only… |
CVE-2022-30072 | Medium | 5.4 | 2022-05-17 | WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via \admin\pages\sections_save.php namesection2 parameters. |
CVE-2022-30067 | Medium | 5.5 | 2022-05-17 | GIMP 2.10.30 and 2.99.10 are vulnerable to Buffer Overflow. Through a crafted XCF file, the program will allocate for a huge amount of memory, resulting in ins… |
CVE-2022-29581 | High | 7.8 | 2022-05-17 | Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege escalation to root. This issue affects… |
CVE-2022-22482 | Medium | 6.5 | 2022-05-17 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5 and 6.1.0.0 through 6.1.1.0 could allow an authenticated user to upload files that could f… |
CVE-2022-22475 | Medium | 6.5 | 2022-05-17 | IBM WebSphere Application Server Liberty and Open Liberty 17.0.0.3 through 22.0.0.5 are vulnerable to identity spoofing by an authenticated user. IBM X-Force I… |
CVE-2022-1769 | High | 7.8 | 2022-05-17 | Buffer Over-read in GitHub repository vim/vim prior to 8.2.4974. |
CVE-2022-1733 | High | 7.8 | 2022-05-17 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4968. |
CVE-2022-1116 | High | 7.8 | 2022-05-17 | Integer Overflow or Wraparound vulnerability in io_uring of Linux Kernel allows local attacker to cause memory corruption and escalate privileges to root. This… |
CVE-2022-30073 | Medium | 5.4 | 2022-05-17 | WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via /admin/users/save.php. |
CVE-2022-30007 | High | 7.2 | 2022-05-17 | GXCMS V1.5 has a file upload vulnerability in the background. The vulnerability is the template management page. You can edit any template content and then ren… |
CVE-2022-24856 | Critical | 9.1 | 2022-05-17 | FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to server-side request forgery (SSRF) when Fl… |
CVE-2022-24108 | Critical | 9.8 | 2022-05-17 | The Skyoftech So Listing Tabs module 2.2.0 for OpenCart allows a remote attacker to inject a serialized PHP object via the setting parameter, potentially resul… |
CVE-2022-22484 | Medium | 5.5 | 2022-05-17 | IBM Spectrum Protect Operations Center 8.1.12 and 8.1.13 could allow a local attacker to obtain sensitive information, caused by plain text user account passwo… |
CVE-2022-30972 | High | 8.8 | 2022-05-17 | A cross-site request forgery (CSRF) vulnerability in Jenkins Storable Configs Plugin 1.0 and earlier allows attackers to have Jenkins parse a local XML file (e… |
CVE-2022-30971 | High | 8.8 | 2022-05-17 | Jenkins Storable Configs Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-30970 | Medium | 5.4 | 2022-05-17 | Jenkins Autocomplete Parameter Plugin 1.1 and earlier references Dropdown Autocomplete parameter and Auto Complete String parameter names in an unsafe manner f… |
CVE-2022-30969 | High | 8.8 | 2022-05-17 | A cross-site request forgery (CSRF) vulnerability in Jenkins Autocomplete Parameter Plugin 1.1 and earlier allows attackers to execute arbitrary code without s… |
CVE-2022-30968 | Medium | 5.4 | 2022-05-17 | Jenkins vboxwrapper Plugin 1.3 and earlier does not escape the name and description of VBox node parameters on views displaying parameters, resulting in a stor… |
CVE-2022-30967 | Medium | 5.4 | 2022-05-17 | Jenkins Selection tasks Plugin 1.0 and earlier does not escape the name and description of Script Selection task variable parameters on views displaying parame… |
CVE-2022-30966 | Medium | 5.4 | 2022-05-17 | Jenkins Random String Parameter Plugin 1.0 and earlier does not escape the name and description of Random String parameters on views displaying parameters, res… |
CVE-2022-30965 | Medium | 5.4 | 2022-05-17 | Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name and description of Promotion Level parameters on views displaying parameters… |
CVE-2022-30964 | Medium | 5.4 | 2022-05-17 | Jenkins Multiselect parameter Plugin 1.3 and earlier does not escape the name and description of Multiselect parameters on views displaying parameters, resulti… |
CVE-2022-30963 | Medium | 5.4 | 2022-05-17 | Jenkins JDK Parameter Plugin 1.0 and earlier does not escape the name and description of JDK parameters on views displaying parameters, resulting in a stored c… |
CVE-2022-30962 | Medium | 5.4 | 2022-05-17 | Jenkins Global Variable String Parameter Plugin 1.2 and earlier does not escape the name and description of Global Variable String parameters on views displayi… |
CVE-2022-30961 | Medium | 5.4 | 2022-05-17 | Jenkins Autocomplete Parameter Plugin 1.1 and earlier does not escape the name of Dropdown Autocomplete and Auto Complete String parameters on views displaying… |
CVE-2022-30960 | Medium | 5.4 | 2022-05-17 | Jenkins Application Detector Plugin 1.0.8 and earlier does not escape the name of Chois Application Version parameters on views displaying parameters, resultin… |
CVE-2022-30959 | Medium | 6.5 | 2022-05-17 | A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server… |
CVE-2022-30958 | High | 8.8 | 2022-05-17 | A cross-site request forgery (CSRF) vulnerability in Jenkins SSH Plugin 2.6.1 and earlier allows attackers to connect to an attacker-specified SSH server using… |
CVE-2022-30957 | Medium | 4.3 | 2022-05-17 | A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials st… |
CVE-2022-30956 | Medium | 5.4 | 2022-05-17 | Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a stored cross-site scripting (XSS) vulner… |
CVE-2022-30955 | Medium | 6.5 | 2022-05-17 | Jenkins GitLab Plugin 1.5.31 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate… |
CVE-2022-30954 | Medium | 6.5 | 2022-05-17 | Jenkins Blue Ocean Plugin 1.25.3 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to… |
CVE-2022-30953 | Medium | 6.5 | 2022-05-17 | A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker-specified HTTP ser… |
CVE-2022-30952 | Medium | 6.5 | 2022-05-17 | Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials with attacker-specified… |
CVE-2022-30951 | High | 8.8 | 2022-05-17 | Jenkins WMI Windows Agents Plugin 1.8 and earlier includes the Windows Remote Command library does not implement access control, potentially allowing users to… |
CVE-2022-30950 | High | 8.8 | 2022-05-17 | Jenkins WMI Windows Agents Plugin 1.8 and earlier includes the Windows Remote Command library which has a buffer overflow vulnerability that may allow users ab… |
CVE-2022-30949 | Medium | 5.3 | 2022-05-17 | Jenkins REPO Plugin 1.14.0 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file… |
CVE-2022-30948 | High | 7.5 | 2022-05-17 | Jenkins Mercurial Plugin 2.16 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's fi… |
CVE-2022-30947 | High | 7.5 | 2022-05-17 | Jenkins Git Plugin 4.11.1 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file s… |
CVE-2022-30946 | Medium | 4.3 | 2022-05-17 | A cross-site request forgery (CSRF) vulnerability in Jenkins Script Security Plugin 1158.v7c1b_73a_69a_08 and earlier allows attackers to have Jenkins send an… |
CVE-2022-30945 | High | 8.5 | 2022-05-17 | Jenkins Pipeline: Groovy Plugin 2689.v434009a_31b_f1 and earlier allows loading any Groovy source files on the classpath of Jenkins and Jenkins plugins in sand… |
CVE-2022-30110 | Medium | 6.1 | 2022-05-17 | The file preview functionality in Jirafeau < 4.4.0, which is enabled by default, could be exploited for cross site scripting. An attacker could upload image/sv… |
CVE-2022-29332 | Medium | 6.5 | 2022-05-17 | D-LINK DIR-825 AC1200 R2 is vulnerable to Directory Traversal. An attacker could use the "../../../../" setting of the FTP server folder to set the router's ro… |
CVE-2022-1711 | High | 7.5 | 2022-05-17 | Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.5. |
CVE-2022-1723 | High | 7.5 | 2022-05-17 | Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.6. |
CVE-2022-26650 | High | 7.5 | 2022-05-17 | In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(), realData) to make judgments, where both param… |
CVE-2022-1753 | Medium | 5.4 | 2022-05-17 | A vulnerability, which was classified as critical, was found in WoWonder. Affected is the file /requests.php which is responsible to handle group messages. The… |
CVE-2022-23670 | Medium | 6.5 | 2022-05-16 | A remote authenticated information disclosure vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8… |
CVE-2022-23668 | Medium | 4.9 | 2022-05-16 | A remote authenticated server-side request forgery (ssrf) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 an… |
CVE-2022-23667 | High | 7.2 | 2022-05-16 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF… |
CVE-2022-1587 | Critical | 9.1 | 2022-05-16 | An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue a… |
CVE-2022-1586 | Critical | 9.1 | 2022-05-16 | An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This inv… |
CVE-2022-23666 | Critical | 9.1 | 2022-05-16 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF… |
CVE-2022-23665 | Critical | 9.1 | 2022-05-16 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF… |
CVE-2022-23664 | Critical | 9.1 | 2022-05-16 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF… |
CVE-2022-23663 | Critical | 9.1 | 2022-05-16 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF… |
CVE-2022-23662 | Critical | 9.1 | 2022-05-16 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF… |
CVE-2022-23661 | Critical | 9.1 | 2022-05-16 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF… |
CVE-2022-23660 | Critical | 10.0 | 2022-05-16 | A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and belo… |
CVE-2022-23659 | Medium | 6.1 | 2022-05-16 | A remote reflected cross site scripting (xss) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8… |