2022 CVEs (page 214)
Page 214 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-29325 | Critical | 9.8 | 2022-05-10 | D-Link DIR-816 A2_v1.10CNB04 was discovered to contain a stack overflow via the addurlfilter parameter in /goform/websURLFilter. |
CVE-2022-29324 | Critical | 9.8 | 2022-05-10 | D-Link DIR-816 A2_v1.10CNB04 was discovered to contain a stack overflow via the proto parameter in /goform/form2IPQoSTcAdd. |
CVE-2022-29323 | Critical | 9.8 | 2022-05-10 | D-Link DIR-816 A2_v1.10CNB04 was discovered to contain a stack overflow via the MAC parameter in /goform/editassignment. |
CVE-2022-29322 | Critical | 9.8 | 2022-05-10 | D-Link DIR-816 A2_v1.10CNB04 was discovered to contain a stack overflow via the IPADDR and nvmacaddr parameters in /goform/form2Dhcpip. |
CVE-2022-29321 | Critical | 9.8 | 2022-05-10 | D-Link DIR-816 A2_v1.10CNB04 was discovered to contain a stack overflow via the lanip parameter in /goform/setNetworkLan. |
CVE-2022-28915 | Critical | 9.8 | 2022-05-10 | D-Link DIR-816 A2_v1.10CNB04 was discovered to contain a command injection vulnerability via the admuser and admpass parameters in /goform/setSysAdm. |
CVE-2022-28913 | Critical | 9.8 | 2022-05-10 | TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/setUploadSetting. |
CVE-2022-28912 | Critical | 9.8 | 2022-05-10 | TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/setUpgradeFW. |
CVE-2022-28911 | Critical | 9.8 | 2022-05-10 | TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/CloudACMunualUpdate. |
CVE-2022-28910 | Critical | 9.8 | 2022-05-10 | TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the devicename parameter in /setting/setDeviceName. |
CVE-2022-28909 | Critical | 9.8 | 2022-05-10 | TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the webwlanidx parameter in /setting/setWebWlanIdx. |
CVE-2022-28908 | Critical | 9.8 | 2022-05-10 | TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the ipdoamin parameter in /setting/setDiagnosisCfg. |
CVE-2022-28907 | Critical | 9.8 | 2022-05-10 | TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the hosttime function in /setting/NTPSyncWithHost. |
CVE-2022-28906 | Critical | 9.8 | 2022-05-10 | TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the langtype parameter in /setting/setLanguageCfg. |
CVE-2022-28905 | Critical | 9.8 | 2022-05-10 | TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the devicemac parameter in /setting/setDeviceName. |
CVE-2022-28901 | Critical | 9.8 | 2022-05-10 | A command injection vulnerability in the component /SetTriggerLEDBlink/Blink of D-Link DIR882 DIR882A1_FW130B06 allows attackers to escalate privileges to root… |
CVE-2022-28896 | Critical | 9.8 | 2022-05-10 | A command injection vulnerability in the component /setnetworksettings/SubnetMask of D-Link DIR882 DIR882A1_FW130B06 allows attackers to escalate privileges to… |
CVE-2022-28895 | Critical | 9.8 | 2022-05-10 | A command injection vulnerability in the component /setnetworksettings/IPAddress of D-Link DIR882 DIR882A1_FW130B06 allows attackers to escalate privileges to… |
CVE-2022-1629 | High | 7.8 | 2022-05-10 | Buffer Over-read in function find_next_quote in GitHub repository vim/vim prior to 8.2.4925. This vulnerabilities are capable of crashing software, Modify Memo… |
CVE-2022-1621 | High | 7.8 | 2022-05-10 | Heap buffer overflow in vim_strncpy find_word in GitHub repository vim/vim prior to 8.2.4919. This vulnerability is capable of crashing software, Bypass Protec… |
CVE-2022-1537 | High | 7.0 | 2022-05-10 | file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. Th… |
CVE-2022-1397 | High | 8.8 | 2022-05-10 | API Privilege Escalation in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Full system takeover. |
CVE-2022-29591 | Critical | 9.8 | 2022-05-10 | Tenda TX9 Pro 22.03.02.10 devices have a SetNetControlList buffer overflow. |
CVE-2022-28110 | Critical | 9.8 | 2022-05-10 | Hotel Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at the login page. |
CVE-2022-24042 | Critical | 9.1 | 2022-05-10 | A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions <… |
CVE-2022-24041 | Medium | 6.5 | 2022-05-10 | A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions <… |
CVE-2022-24040 | Medium | 6.5 | 2022-05-10 | A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions <… |
CVE-2022-24039 | Critical | 9.0 | 2022-05-10 | A vulnerability has been identified in Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The “addCell” JavaSc… |
CVE-2022-23705 | High | 7.5 | 2022-05-09 | A security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays, HPE Nimble Storage All Flash Arrays, and HPE Nimble Storage Secondary F… |
CVE-2022-23704 | High | 7.5 | 2022-05-09 | A potential security vulnerability has been identified in Integrated Lights-Out 4 (iLO 4). The vulnerability could allow remote Denial of Service. The vulnerab… |
CVE-2022-30335 | Critical | 9.8 | 2022-05-09 | Bonanza Wealth Management System (BWM) 7.3.2 allows SQL injection via the login form. Users who supply the application with a SQL injection payload in the User… |
CVE-2022-29868 | Medium | 5.5 | 2022-05-09 | 1Password for Mac 7.2.4 through 7.9.x before 7.9.3 is vulnerable to a process validation bypass. Malicious software running on the same computer can exfiltrate… |
CVE-2022-30524 | High | 7.8 | 2022-05-09 | There is an invalid memory access in the TextLine class in TextOutputDev.cc in Xpdf 4.0.4 because the text extractor mishandles characters at large y coordinat… |
CVE-2022-30240 | High | 7.8 | 2022-05-09 | An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Redshift JDBC Driver 1.2.40 through 1.2.55 may… |
CVE-2022-30239 | High | 7.8 | 2022-05-09 | An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Athena JDBC Driver 2.0.25 through 2.0.28 may al… |
CVE-2022-29972 | High | 7.8 | 2022-05-09 | An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Redshift ODBC Driver (1.4.14 through 1.4.21.100… |
CVE-2022-29971 | High | 7.8 | 2022-05-09 | An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Athena ODBC Driver 1.1.1 through 1.1.x before 1… |
CVE-2022-29933 | High | 8.8 | 2022-05-09 | Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the acc… |
CVE-2022-28739 | High | 7.5 | 2022-05-09 | There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, inclu… |
CVE-2022-28738 | Critical | 9.8 | 2022-05-09 | A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. If a victim attempts to create a Regexp from untrusted user inp… |
CVE-2022-27412 | Critical | 9.8 | 2022-05-09 | Explore CMS v1.0 was discovered to contain a SQL injection vulnerability via a /page.php?id= request. |
CVE-2022-27308 | Medium | 5.4 | 2022-05-09 | A stored cross-site scripting (XSS) vulnerability in PHProjekt PhpSimplyGest v1.3.0 allows attackers to execute arbitrary web scripts or HTML via a project tit… |
CVE-2022-28162 | Low | 3.3 | 2022-05-09 | Brocade SANnav before version SANnav 2.2.0 logs the REST API Authentication token in plain text. |
CVE-2022-28161 | Medium | 5.5 | 2022-05-09 | An information exposure through log file vulnerability in Brocade SANNav versions before Brocade SANnav 2.2.0 could allow an authenticated, local attacker to v… |
CVE-2022-27114 | Medium | 5.5 | 2022-05-09 | There is a vulnerability in htmldoc 1.9.16. In image_load_jpeg function image.cxx when it calls malloc,'img->width' and 'img->height' they are large enough to… |
CVE-2022-22481 | Medium | 5.3 | 2022-05-09 | IBM Navigator for i 7.2, 7.3, and 7.4 (heritage version) could allow a remote attacker to obtain access to the web interface without valid credentials. By modi… |
CVE-2022-22319 | Medium | 5.4 | 2022-05-09 | IBM Robotic Process Automation 21.0.1 could allow a register user on the system to physically delete a queue that could cause disruption for any scripts depend… |
CVE-2022-1338 | Medium | 4.8 | 2022-05-09 | The Easily Generate Rest API Url WordPress plugin through 1.0.0 does not escape some of its settings, allowing high privilege users such as admin to perform Cr… |
CVE-2022-1303 | Medium | 4.8 | 2022-05-09 | The Slide Anything WordPress plugin before 2.3.44 does not sanitize and escape sliders' description, which could allow high privilege users such as editor and… |
CVE-2022-1171 | Medium | 6.1 | 2022-05-09 | The Vertical scroll recent post WordPress plugin before 14.0 does not sanitise and escape a parameter before outputting it back in an attribute, leading to a R… |
CVE-2022-1104 | Medium | 4.8 | 2022-05-09 | The Popup Maker WordPress plugin before 1.16.5 does not sanitise and escape some of its Popup settings, which could allow high privilege users such as admin to… |
CVE-2022-1047 | Medium | 6.1 | 2022-05-09 | The Themify Post Type Builder Search Addon WordPress plugin before 1.4.0 does not properly escape the current page URL before reusing it in a HTML attribute, l… |
CVE-2022-1013 | Critical | 9.8 | 2022-05-09 | The Personal Dictionary WordPress plugin before 1.3.4 fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement an… |
CVE-2022-0948 | Critical | 9.8 | 2022-05-09 | The Order Listener for WooCommerce WordPress plugin before 3.2.2 does not sanitise and escape the id parameter before using it in a SQL statement via a REST ro… |
CVE-2022-0898 | Medium | 5.4 | 2022-05-09 | The IgniteUp WordPress plugin through 3.4.1 does not sanitise and escape some fields when high privilege users don't have the unfiltered_html capability, which… |
CVE-2022-0874 | Medium | 4.8 | 2022-05-09 | The WP Social Buttons WordPress plugin through 2.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site… |
CVE-2022-0836 | Critical | 9.8 | 2022-05-09 | The SEMA API WordPress plugin before 4.02 does not properly sanitise and escape some parameters before using them in SQL statements via an AJAX action, leading… |
CVE-2022-0826 | Critical | 9.8 | 2022-05-09 | The WP Video Gallery WordPress plugin through 1.7.1 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action, leading to… |
CVE-2022-0817 | Critical | 9.8 | 2022-05-09 | The BadgeOS WordPress plugin through 3.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action, leading to an SQL In… |
CVE-2022-0814 | Critical | 9.8 | 2022-05-09 | The Ubigeo de Perú para Woocommerce WordPress plugin before 3.6.4 does not properly sanitise and escape some parameters before using them in SQL statements via… |
CVE-2022-0625 | Medium | 6.1 | 2022-05-09 | The Admin Menu Editor WordPress plugin through 1.0.4 does not sanitize and escape a parameter before outputting it back in an admin page, leading to a Reflecte… |
CVE-2022-0592 | Critical | 9.8 | 2022-05-09 | The MapSVG WordPress plugin before 6.2.20 does not validate and escape a parameter via a REST endpoint before using it in a SQL statement, leading to a SQL Inj… |
CVE-2022-0424 | Medium | 5.3 | 2022-05-09 | The Popup by Supsystic WordPress plugin before 1.10.9 does not have any authentication and authorisation in an AJAX action, allowing unauthenticated attackers… |
CVE-2022-27224 | High | 7.2 | 2022-05-09 | An issue was discovered in Galleon NTS-6002-GPS 4.14.103-Galleon-NTS-6002.V12 4. An authenticated attacker can perform command injection as root via shell meta… |
CVE-2022-23332 | High | 8.8 | 2022-05-09 | Command injection vulnerability in Manual Ping Form (Web UI) in Shenzhen Ejoin Information Technology Co., Ltd. ACOM508/ACOM516/ACOM532 609-915-041-100-020 all… |
CVE-2022-1631 | High | 8.8 | 2022-05-09 | Users Account Pre-Takeover or Users Account Takeover. in GitHub repository microweber/microweber prior to 1.2.15. Victim Account Take Over. Since, there is no… |
CVE-2022-30286 | High | 7.5 | 2022-05-09 | pyscriptjs (aka PyScript Demonstrator) in PyScript through 2022-05-04 allows a remote user to read Python source code. |
CVE-2022-30333 | High | 7.5 | 2022-05-09 | RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a… |
CVE-2022-23066 | Critical | 9.1 | 2022-05-09 | In Solana rBPF versions 0.2.26 and 0.2.27 are affected by Incorrect Calculation which is caused by improper implementation of sdiv instruction. This can lead t… |
CVE-2022-28463 | High | 7.8 | 2022-05-08 | ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow. |
CVE-2022-28470 | Critical | 9.8 | 2022-05-08 | marcador package in PyPI 0.1 through 0.13 included a code-execution backdoor. |
CVE-2022-1620 | High | 7.5 | 2022-05-08 | NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 in GitHub repository vim/vim prior to 8.2.4901. NULL Pointer Dereference in function v… |
CVE-2022-1619 | High | 7.8 | 2022-05-08 | Heap-based Buffer Overflow in function cmdline_erase_chars in GitHub repository vim/vim prior to 8.2.4899. This vulnerabilities are capable of crashing softwar… |
CVE-2022-1616 | High | 7.8 | 2022-05-07 | Use after free in append_command in GitHub repository vim/vim prior to 8.2.4895. This vulnerability is capable of crashing software, Bypass Protection Mechanis… |
CVE-2022-30334 | Medium | 5.3 | 2022-05-07 | Brave before 1.34, when a Private Window with Tor Connectivity is used, leaks .onion URLs in Referer and Origin headers. NOTE: although this was fixed by Brave… |
CVE-2022-30330 | Medium | 6.6 | 2022-05-07 | In the KeepKey firmware before 7.3.2,Flaws in the supervisor interface can be exploited to bypass important security restrictions on firmware operations. Using… |
CVE-2022-29180 | Medium | 5.9 | 2022-05-07 | A vulnerability in which attackers could forge HTTP requests to manipulate the `charm` data directory to access or delete anything on the server. This has been… |
CVE-2022-25324 | High | 7.5 | 2022-05-06 | All versions of package bignum are vulnerable to Denial of Service (DoS) due to a type-check exception in V8, when verifying the type of the second argument to… |
CVE-2022-29423 | Low | 3.8 | 2022-05-06 | Pro Features Lock Bypass vulnerability in Countdown & Clock plugin <= 2.3.2 at WordPress. |
CVE-2022-29422 | Medium | 4.8 | 2022-05-06 | Multiple Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerabilities in Adam Skaat's Countdown & Clock plugin <= 2.3.2 at WordPress via &ycd-c… |
CVE-2022-28279 | High | 7.8 | 2022-05-06 | Adobe Photoshop versions 22.5.6 (and earlier)and 23.2.2 (and earlier) are affected by a use-after-free vulnerability that could result in arbitrary code execut… |
CVE-2022-28278 | High | 7.8 | 2022-05-06 | Adobe Photoshop versions 22.5.6 (and earlier) and 23.2.2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code… |
CVE-2022-28277 | High | 7.8 | 2022-05-06 | Adobe Photoshop versions 22.5.6 (and earlier) and 23.2.2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code… |
CVE-2022-28276 | High | 7.8 | 2022-05-06 | Adobe Photoshop versions 22.5.6 (and earlier) and 23.2.2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code… |
CVE-2022-28275 | High | 7.8 | 2022-05-06 | Adobe Photoshop versions 22.5.6 (and earlier) and 23.2.2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code… |
CVE-2022-28274 | High | 7.8 | 2022-05-06 | Adobe Photoshop versions 22.5.6 (and earlier) and 23.2.2 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which c… |
CVE-2022-28273 | High | 7.8 | 2022-05-06 | Adobe Photoshop versions 22.5.6 (and earlier) and 23.2.2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code… |
CVE-2022-28272 | High | 7.8 | 2022-05-06 | Adobe Photoshop versions 22.5.6 (and earlier) and 23.2.2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code… |
CVE-2022-28271 | High | 7.8 | 2022-05-06 | Adobe Photoshop versions 22.5.6 (and earlier)and 23.2.2 (and earlier) are affected by a use-after-free vulnerability that could result in arbitrary code execut… |
CVE-2022-28270 | High | 7.8 | 2022-05-06 | Adobe Photoshop versions 22.5.6 (and earlier) and 23.2.2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code… |
CVE-2022-27909 | Medium | 4.3 | 2022-05-06 | In Joomla component 'jDownloads 3.9.8.2 Stable' the remote user can change some parameters in the address bar and see the names of other users' files |
CVE-2022-27784 | High | 7.8 | 2022-05-06 | Adobe After Effects versions 22.2.1 (and earlier) and 18.4.5 (and earlier) are affected by a stack overflow vulnerability due to insecure handling of a crafted… |
CVE-2022-27783 | High | 7.8 | 2022-05-06 | Adobe After Effects versions 22.2.1 (and earlier) and 18.4.5 (and earlier) are affected by a stack overflow vulnerability due to insecure handling of a crafted… |
CVE-2022-24105 | High | 7.8 | 2022-05-06 | Adobe Photoshop versions 22.5.6 (and earlier)and 23.2.2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code… |
CVE-2022-24099 | Low | 3.3 | 2022-05-06 | Adobe Photoshop versions 22.5.6 (and earlier)and 23.2.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sens… |
CVE-2022-24098 | High | 7.8 | 2022-05-06 | Adobe Photoshop versions 22.5.6 (and earlier)and 23.2.2 (and earlier) are affected by an improper input validation vulnerability when parsing a PCX file that c… |
CVE-2022-23802 | High | 7.5 | 2022-05-06 | Joomla Guru extension 5.2.5 is affected by: Insecure Permissions. The impact is: obtain sensitive information (remote). The component is: Access to private inf… |
CVE-2022-23205 | High | 7.8 | 2022-05-06 | Adobe Photoshop versions 22.5.6 (and earlier)and 23.2.2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code… |
CVE-2022-29421 | Medium | 4.7 | 2022-05-06 | Reflected Cross-Site Scripting (XSS) vulnerability in Adam Skaat's Countdown & Clock plugin on WordPress via &ycd_type vulnerable parameter. |
CVE-2022-29420 | Medium | 5.9 | 2022-05-06 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Adam Skaat Countdown & Clock (WordPress plugin) co… |