2022 CVEs (page 208)
Page 208 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-24388 | High | 8.8 | 2022-05-17 | Vulnerability in rconfig “date” enables an attacker with user level access to the CLI to inject root level commands into Fidelis Network and Deception CommandP… |
CVE-2022-23706 | Medium | 6.1 | 2022-05-17 | A remote cross-site scripting (xss) vulnerability was discovered in HPE OneView version(s): Prior to 7.0. HPE has provided a software update to resolve this vu… |
CVE-2022-1118 | High | 8.6 | 2022-05-17 | Connected Components Workbench (v13.00.00 and prior), ISaGRAF Workbench (v6.0 though v6.6.9), and Safety Instrumented System Workstation (v1.2 and prior (for T… |
CVE-2022-0997 | Low | 3.9 | 2022-05-17 | Improper file permissions in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables an attacker with local, administrative… |
CVE-2022-0486 | Medium | 4.4 | 2022-05-17 | Improper file permissions in the CommandPost, Collector, Sensor, and Sandbox components of Fidelis Network and Deception enables an attacker with local, admini… |
CVE-2022-30688 | High | 7.8 | 2022-05-17 | needrestart 0.8 through 3.5 before 3.6 is prone to local privilege escalation. Regexes to detect the Perl, Python, and Ruby interpreters are not anchored, allo… |
CVE-2022-29429 | High | 8.8 | 2022-05-17 | Remote Code Execution (RCE) in Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on WordPress via Cross-Site Request Forgery. |
CVE-2022-24890 | Low | 2.4 | 2022-05-17 | Nextcloud Talk is a video and audio conferencing app for Nextcloud. In versions prior to 13.0.5 and 14.0.0, a call moderator can indirectly enable user webcams… |
CVE-2022-23674 | Medium | 5.4 | 2022-05-17 | A remote authenticated stored cross-site scripting (xss) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and… |
CVE-2022-1735 | High | 7.8 | 2022-05-17 | Classic Buffer Overflow in GitHub repository vim/vim prior to 8.2.4969. |
CVE-2022-30689 | Medium | 5.3 | 2022-05-17 | HashiCorp Vault and Vault Enterprise from 1.10.0 to 1.10.2 did not correctly configure and enforce MFA on login after server restarts. This affects the Login M… |
CVE-2022-24611 | Medium | 6.5 | 2022-05-17 | Denial of Service (DoS) in the Z-Wave S0 NonceGet protocol specification in Silicon Labs Z-Wave 500 series allows local attackers to block S0/S2 protected Z-Wa… |
CVE-2022-23675 | Medium | 4.8 | 2022-05-17 | A remote authenticated stored cross-site scripting (xss) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and… |
CVE-2022-23673 | High | 7.2 | 2022-05-17 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF… |
CVE-2022-23672 | High | 7.2 | 2022-05-17 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF… |
CVE-2022-23671 | High | 7.5 | 2022-05-17 | A remote authenticated information disclosure vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8… |
CVE-2022-23669 | High | 8.8 | 2022-05-17 | A remote authorization bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below… |
CVE-2022-22775 | High | 8.1 | 2022-05-17 | The Workspace client component of TIBCO Software Inc.'s TIBCO BPM Enterprise and TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric contains difficult t… |
CVE-2022-22773 | High | 7.7 | 2022-05-17 | The REST API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Develo… |
CVE-2022-1706 | Medium | 6.5 | 2022-05-17 | A vulnerability was found in Ignition where ignition configs are accessible from unprivileged containers in VMs running on VMware products. This issue is only… |
CVE-2022-30072 | Medium | 5.4 | 2022-05-17 | WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via \admin\pages\sections_save.php namesection2 parameters. |
CVE-2022-30067 | Medium | 5.5 | 2022-05-17 | GIMP 2.10.30 and 2.99.10 are vulnerable to Buffer Overflow. Through a crafted XCF file, the program will allocate for a huge amount of memory, resulting in ins… |
CVE-2022-29581 | High | 7.8 | 2022-05-17 | Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege escalation to root. This issue affects… |
CVE-2022-22482 | Medium | 6.5 | 2022-05-17 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5 and 6.1.0.0 through 6.1.1.0 could allow an authenticated user to upload files that could f… |
CVE-2022-22475 | Medium | 6.5 | 2022-05-17 | IBM WebSphere Application Server Liberty and Open Liberty 17.0.0.3 through 22.0.0.5 are vulnerable to identity spoofing by an authenticated user. IBM X-Force I… |
CVE-2022-1769 | High | 7.8 | 2022-05-17 | Buffer Over-read in GitHub repository vim/vim prior to 8.2.4974. |
CVE-2022-1733 | High | 7.8 | 2022-05-17 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4968. |
CVE-2022-1116 | High | 7.8 | 2022-05-17 | Integer Overflow or Wraparound vulnerability in io_uring of Linux Kernel allows local attacker to cause memory corruption and escalate privileges to root. This… |
CVE-2022-30073 | Medium | 5.4 | 2022-05-17 | WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via /admin/users/save.php. |
CVE-2022-30007 | High | 7.2 | 2022-05-17 | GXCMS V1.5 has a file upload vulnerability in the background. The vulnerability is the template management page. You can edit any template content and then ren… |
CVE-2022-24856 | Critical | 9.1 | 2022-05-17 | FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to server-side request forgery (SSRF) when Fl… |
CVE-2022-24108 | Critical | 9.8 | 2022-05-17 | The Skyoftech So Listing Tabs module 2.2.0 for OpenCart allows a remote attacker to inject a serialized PHP object via the setting parameter, potentially resul… |
CVE-2022-22484 | Medium | 5.5 | 2022-05-17 | IBM Spectrum Protect Operations Center 8.1.12 and 8.1.13 could allow a local attacker to obtain sensitive information, caused by plain text user account passwo… |
CVE-2022-30972 | High | 8.8 | 2022-05-17 | A cross-site request forgery (CSRF) vulnerability in Jenkins Storable Configs Plugin 1.0 and earlier allows attackers to have Jenkins parse a local XML file (e… |
CVE-2022-30971 | High | 8.8 | 2022-05-17 | Jenkins Storable Configs Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-30970 | Medium | 5.4 | 2022-05-17 | Jenkins Autocomplete Parameter Plugin 1.1 and earlier references Dropdown Autocomplete parameter and Auto Complete String parameter names in an unsafe manner f… |
CVE-2022-30969 | High | 8.8 | 2022-05-17 | A cross-site request forgery (CSRF) vulnerability in Jenkins Autocomplete Parameter Plugin 1.1 and earlier allows attackers to execute arbitrary code without s… |
CVE-2022-30968 | Medium | 5.4 | 2022-05-17 | Jenkins vboxwrapper Plugin 1.3 and earlier does not escape the name and description of VBox node parameters on views displaying parameters, resulting in a stor… |
CVE-2022-30967 | Medium | 5.4 | 2022-05-17 | Jenkins Selection tasks Plugin 1.0 and earlier does not escape the name and description of Script Selection task variable parameters on views displaying parame… |
CVE-2022-30966 | Medium | 5.4 | 2022-05-17 | Jenkins Random String Parameter Plugin 1.0 and earlier does not escape the name and description of Random String parameters on views displaying parameters, res… |
CVE-2022-30965 | Medium | 5.4 | 2022-05-17 | Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name and description of Promotion Level parameters on views displaying parameters… |
CVE-2022-30964 | Medium | 5.4 | 2022-05-17 | Jenkins Multiselect parameter Plugin 1.3 and earlier does not escape the name and description of Multiselect parameters on views displaying parameters, resulti… |
CVE-2022-30963 | Medium | 5.4 | 2022-05-17 | Jenkins JDK Parameter Plugin 1.0 and earlier does not escape the name and description of JDK parameters on views displaying parameters, resulting in a stored c… |
CVE-2022-30962 | Medium | 5.4 | 2022-05-17 | Jenkins Global Variable String Parameter Plugin 1.2 and earlier does not escape the name and description of Global Variable String parameters on views displayi… |
CVE-2022-30961 | Medium | 5.4 | 2022-05-17 | Jenkins Autocomplete Parameter Plugin 1.1 and earlier does not escape the name of Dropdown Autocomplete and Auto Complete String parameters on views displaying… |
CVE-2022-30960 | Medium | 5.4 | 2022-05-17 | Jenkins Application Detector Plugin 1.0.8 and earlier does not escape the name of Chois Application Version parameters on views displaying parameters, resultin… |
CVE-2022-30959 | Medium | 6.5 | 2022-05-17 | A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server… |
CVE-2022-30958 | High | 8.8 | 2022-05-17 | A cross-site request forgery (CSRF) vulnerability in Jenkins SSH Plugin 2.6.1 and earlier allows attackers to connect to an attacker-specified SSH server using… |
CVE-2022-30957 | Medium | 4.3 | 2022-05-17 | A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials st… |
CVE-2022-30956 | Medium | 5.4 | 2022-05-17 | Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a stored cross-site scripting (XSS) vulner… |
CVE-2022-30955 | Medium | 6.5 | 2022-05-17 | Jenkins GitLab Plugin 1.5.31 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate… |
CVE-2022-30954 | Medium | 6.5 | 2022-05-17 | Jenkins Blue Ocean Plugin 1.25.3 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to… |
CVE-2022-30953 | Medium | 6.5 | 2022-05-17 | A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker-specified HTTP ser… |
CVE-2022-30952 | Medium | 6.5 | 2022-05-17 | Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials with attacker-specified… |
CVE-2022-30951 | High | 8.8 | 2022-05-17 | Jenkins WMI Windows Agents Plugin 1.8 and earlier includes the Windows Remote Command library does not implement access control, potentially allowing users to… |
CVE-2022-30950 | High | 8.8 | 2022-05-17 | Jenkins WMI Windows Agents Plugin 1.8 and earlier includes the Windows Remote Command library which has a buffer overflow vulnerability that may allow users ab… |
CVE-2022-30949 | Medium | 5.3 | 2022-05-17 | Jenkins REPO Plugin 1.14.0 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file… |
CVE-2022-30948 | High | 7.5 | 2022-05-17 | Jenkins Mercurial Plugin 2.16 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's fi… |
CVE-2022-30947 | High | 7.5 | 2022-05-17 | Jenkins Git Plugin 4.11.1 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file s… |
CVE-2022-30946 | Medium | 4.3 | 2022-05-17 | A cross-site request forgery (CSRF) vulnerability in Jenkins Script Security Plugin 1158.v7c1b_73a_69a_08 and earlier allows attackers to have Jenkins send an… |
CVE-2022-30945 | High | 8.5 | 2022-05-17 | Jenkins Pipeline: Groovy Plugin 2689.v434009a_31b_f1 and earlier allows loading any Groovy source files on the classpath of Jenkins and Jenkins plugins in sand… |
CVE-2022-30110 | Medium | 6.1 | 2022-05-17 | The file preview functionality in Jirafeau < 4.4.0, which is enabled by default, could be exploited for cross site scripting. An attacker could upload image/sv… |
CVE-2022-29332 | Medium | 6.5 | 2022-05-17 | D-LINK DIR-825 AC1200 R2 is vulnerable to Directory Traversal. An attacker could use the "../../../../" setting of the FTP server folder to set the router's ro… |
CVE-2022-1711 | High | 7.5 | 2022-05-17 | Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.5. |
CVE-2022-1723 | High | 7.5 | 2022-05-17 | Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.6. |
CVE-2022-26650 | High | 7.5 | 2022-05-17 | In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(), realData) to make judgments, where both param… |
CVE-2022-1753 | Medium | 5.4 | 2022-05-17 | A vulnerability, which was classified as critical, was found in WoWonder. Affected is the file /requests.php which is responsible to handle group messages. The… |
CVE-2022-23670 | Medium | 6.5 | 2022-05-16 | A remote authenticated information disclosure vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8… |
CVE-2022-23668 | Medium | 4.9 | 2022-05-16 | A remote authenticated server-side request forgery (ssrf) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 an… |
CVE-2022-23667 | High | 7.2 | 2022-05-16 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF… |
CVE-2022-1587 | Critical | 9.1 | 2022-05-16 | An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue a… |
CVE-2022-1586 | Critical | 9.1 | 2022-05-16 | An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This inv… |
CVE-2022-23666 | Critical | 9.1 | 2022-05-16 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF… |
CVE-2022-23665 | Critical | 9.1 | 2022-05-16 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF… |
CVE-2022-23664 | Critical | 9.1 | 2022-05-16 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF… |
CVE-2022-23663 | Critical | 9.1 | 2022-05-16 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF… |
CVE-2022-23662 | Critical | 9.1 | 2022-05-16 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF… |
CVE-2022-23661 | Critical | 9.1 | 2022-05-16 | A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF… |
CVE-2022-23660 | Critical | 10.0 | 2022-05-16 | A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and belo… |
CVE-2022-23659 | Medium | 6.1 | 2022-05-16 | A remote reflected cross site scripting (xss) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8… |
CVE-2022-23658 | Critical | 10.0 | 2022-05-16 | A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and belo… |
CVE-2022-23657 | Critical | 10.0 | 2022-05-16 | A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and belo… |
CVE-2022-1731 | Critical | 9.8 | 2022-05-16 | Metasonic Doc WebClient 7.0.14.0 / 7.0.12.0 / 7.0.3.0 is vulnerable to a SQL injection attack in the username field. SSO or System authentication are required… |
CVE-2022-30697 | High | 7.8 | 2022-05-16 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Snap Deploy (Windows) before build 3640 |
CVE-2022-30696 | High | 7.8 | 2022-05-16 | Local privilege escalation due to a DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy (Windows) before build 3640 |
CVE-2022-30695 | High | 7.8 | 2022-05-16 | Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis Snap Deploy (Windows) before… |
CVE-2022-1679 | High | 7.8 | 2022-05-16 | A use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target function to fail w… |
CVE-2022-30126 | Medium | 5.5 | 2022-05-16 | In Apache Tika, a regular expression in our StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by back… |
CVE-2022-30055 | Critical | 9.8 | 2022-05-16 | Prime95 30.7 build 9 suffers from a Buffer Overflow vulnerability that could lead to Remote Code Execution. |
CVE-2022-30050 | Medium | 6.1 | 2022-05-16 | Gnuboard 5.55 and 5.56 is vulnerable to Cross Site Scripting (XSS) via bbs/member_confirm.php. |
CVE-2022-25169 | Medium | 5.5 | 2022-05-16 | The BPG parser in versions of Apache Tika before 1.28.2 and 2.4.0 may allocate an unreasonable amount of memory on carefully crafted files. |
CVE-2022-30523 | High | 7.8 | 2022-05-16 | Trend Micro Password Manager (Consumer) version 5.0.0.1266 and below is vulnerable to a Link Following Privilege Escalation Vulnerability that could allow a lo… |
CVE-2022-1728 | Medium | 6.5 | 2022-05-16 | Allowing long password leads to denial of service in polonel/trudesk in GitHub repository polonel/trudesk prior to 1.2.2. This vulnerability can be abused by d… |
CVE-2022-1726 | Medium | 5.4 | 2022-05-16 | Bootstrap Tables XSS vulnerability with Table Export plug-in when exportOptions: htmlContent is true in GitHub repository wenzhixin/bootstrap-table prior to 1… |
CVE-2022-1722 | Low | 3.3 | 2022-05-16 | SSRF in editor's proxy via IPv6 link-local address in GitHub repository jgraph/drawio prior to 18.0.5. SSRF to internal link-local IPv6 addresses |
CVE-2022-1721 | High | 7.5 | 2022-05-16 | Path Traversal in WellKnownServlet in GitHub repository jgraph/drawio prior to 18.0.5. Read local files of the web application. |
CVE-2022-1713 | High | 7.5 | 2022-05-16 | SSRF on /proxy in GitHub repository jgraph/drawio prior to 18.0.4. An attacker can make a request as the server and read its contents. This can lead to a leak… |
CVE-2022-1560 | Medium | 6.5 | 2022-05-16 | The Amministrazione Aperta WordPress plugin before 3.8 does not validate the open parameter before using it in an include statement, leading to a Local File In… |
CVE-2022-1559 | Medium | 4.8 | 2022-05-16 | The Clipr WordPress plugin through 1.2.3 does not sanitise and escape its API Key settings before outputting it in an attribute, leading to a Stored Cross-Site… |
CVE-2022-1557 | Medium | 5.4 | 2022-05-16 | The ULeak Security & Monitoring WordPress plugin through 1.2.3 does not have authorisation and CSRF checks when updating its settings, and is also lacking sani… |