2022 CVEs (page 215)
Page 215 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-28279 | High | 7.8 | 2022-05-06 | Adobe Photoshop versions 22.5.6 (and earlier)and 23.2.2 (and earlier) are affected by a use-after-free vulnerability that could result in arbitrary code execut… |
CVE-2022-28278 | High | 7.8 | 2022-05-06 | Adobe Photoshop versions 22.5.6 (and earlier) and 23.2.2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code… |
CVE-2022-28277 | High | 7.8 | 2022-05-06 | Adobe Photoshop versions 22.5.6 (and earlier) and 23.2.2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code… |
CVE-2022-28276 | High | 7.8 | 2022-05-06 | Adobe Photoshop versions 22.5.6 (and earlier) and 23.2.2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code… |
CVE-2022-28275 | High | 7.8 | 2022-05-06 | Adobe Photoshop versions 22.5.6 (and earlier) and 23.2.2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code… |
CVE-2022-28274 | High | 7.8 | 2022-05-06 | Adobe Photoshop versions 22.5.6 (and earlier) and 23.2.2 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which c… |
CVE-2022-28273 | High | 7.8 | 2022-05-06 | Adobe Photoshop versions 22.5.6 (and earlier) and 23.2.2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code… |
CVE-2022-28272 | High | 7.8 | 2022-05-06 | Adobe Photoshop versions 22.5.6 (and earlier) and 23.2.2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code… |
CVE-2022-28271 | High | 7.8 | 2022-05-06 | Adobe Photoshop versions 22.5.6 (and earlier)and 23.2.2 (and earlier) are affected by a use-after-free vulnerability that could result in arbitrary code execut… |
CVE-2022-28270 | High | 7.8 | 2022-05-06 | Adobe Photoshop versions 22.5.6 (and earlier) and 23.2.2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code… |
CVE-2022-27909 | Medium | 4.3 | 2022-05-06 | In Joomla component 'jDownloads 3.9.8.2 Stable' the remote user can change some parameters in the address bar and see the names of other users' files |
CVE-2022-27784 | High | 7.8 | 2022-05-06 | Adobe After Effects versions 22.2.1 (and earlier) and 18.4.5 (and earlier) are affected by a stack overflow vulnerability due to insecure handling of a crafted… |
CVE-2022-27783 | High | 7.8 | 2022-05-06 | Adobe After Effects versions 22.2.1 (and earlier) and 18.4.5 (and earlier) are affected by a stack overflow vulnerability due to insecure handling of a crafted… |
CVE-2022-24105 | High | 7.8 | 2022-05-06 | Adobe Photoshop versions 22.5.6 (and earlier)and 23.2.2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code… |
CVE-2022-24099 | Low | 3.3 | 2022-05-06 | Adobe Photoshop versions 22.5.6 (and earlier)and 23.2.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sens… |
CVE-2022-24098 | High | 7.8 | 2022-05-06 | Adobe Photoshop versions 22.5.6 (and earlier)and 23.2.2 (and earlier) are affected by an improper input validation vulnerability when parsing a PCX file that c… |
CVE-2022-23802 | High | 7.5 | 2022-05-06 | Joomla Guru extension 5.2.5 is affected by: Insecure Permissions. The impact is: obtain sensitive information (remote). The component is: Access to private inf… |
CVE-2022-23205 | High | 7.8 | 2022-05-06 | Adobe Photoshop versions 22.5.6 (and earlier)and 23.2.2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code… |
CVE-2022-29421 | Medium | 4.7 | 2022-05-06 | Reflected Cross-Site Scripting (XSS) vulnerability in Adam Skaat's Countdown & Clock plugin on WordPress via &ycd_type vulnerable parameter. |
CVE-2022-29420 | Medium | 5.9 | 2022-05-06 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Adam Skaat Countdown & Clock (WordPress plugin) co… |
CVE-2022-28545 | Medium | 5.4 | 2022-05-06 | FUDforum 3.1.1 is vulnerable to Stored XSS. |
CVE-2022-28507 | Medium | 4.8 | 2022-05-06 | Dragon Path Technologies Bharti Airtel Routers Hardware BDT-121 version 1.0 is vulnerable to Cross Site Scripting (XSS) via Dragon path router admin page. |
CVE-2022-28165 | High | 8.8 | 2022-05-06 | A vulnerability in the role-based access control (RBAC) functionality of the Brocade SANNav before 2.2.0 could allow an authenticated, remote attacker to acces… |
CVE-2022-27183 | High | 8.8 | 2022-05-06 | The Monitoring Console app configured in Distributed mode allows for a Reflected XSS in a query parameter in Splunk Enterprise versions before 8.1.4. The Monit… |
CVE-2022-26889 | High | 8.8 | 2022-05-06 | In Splunk Enterprise versions before 8.1.2, the uri path to load a relative resource within a web page is vulnerable to path traversal. It allows an attacker t… |
CVE-2022-26070 | Medium | 4.3 | 2022-05-06 | When handling a mismatched pre-authentication cookie, the application leaks the internal error message in the response, which contains the Splunk Enterprise lo… |
CVE-2022-1053 | Critical | 9.1 | 2022-05-06 | Keylime does not enforce that the agent registrar data is the same when the tenant uses it for validation of the EK and identity quote and the verifier for val… |
CVE-2022-28164 | Medium | 6.5 | 2022-05-06 | Brocade SANnav before SANnav 2.2.0 application uses the Blowfish symmetric encryption algorithm for the storage of passwords. This could allow an authenticated… |
CVE-2022-28163 | Critical | 9.8 | 2022-05-06 | In Brocade SANnav before Brocade SANnav 2.2.0, multiple endpoints associated with Zone management are susceptible to SQL injection, allowing an attacker to run… |
CVE-2022-21934 | High | 8.0 | 2022-05-06 | Under certain circumstances an authenticated user could lock other users out of the system or take over their accounts in Metasys ADS/ADX/OAS server 10 version… |
CVE-2022-28005 | Critical | 9.8 | 2022-05-06 | An issue was discovered in the 3CX Phone System Management Console prior to version 18 Update 3 FINAL. An unauthenticated attacker could abuse improperly secur… |
CVE-2022-28973 | High | 7.5 | 2022-05-06 | Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the wanMTU parameter in the function fromAdvSetMacMtuWan. This vulnerability allows attack… |
CVE-2022-28972 | High | 7.5 | 2022-05-06 | Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the timeZone parameter in the function form_fast_setting_wifi_set. This vulnerability allo… |
CVE-2022-28971 | High | 7.5 | 2022-05-06 | Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the list parameter in the function fromSetIpMacBind. This vulnerability allows attackers t… |
CVE-2022-28970 | High | 7.5 | 2022-05-06 | Tenda AX1806 v1.0.0.1 was discovered to contain a heap overflow via the mac parameter in the function GetParentControlInfo. This vulnerability allows attackers… |
CVE-2022-28969 | High | 7.5 | 2022-05-06 | Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the shareSpeed parameter in the function fromSetWifiGusetBasic. This vulnerability allows… |
CVE-2022-24823 | Medium | 5.5 | 2022-05-06 | Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contain… |
CVE-2022-30295 | Medium | 6.5 | 2022-05-06 | uClibc-ng through 1.0.40 and uClibc through 0.9.33.2 use predictable DNS transaction IDs that may lead to DNS cache poisoning. This is related to a reset of a… |
CVE-2022-30293 | High | 7.5 | 2022-05-06 | In WebKitGTK through 2.36.0 (and WPE WebKit), there is a heap-based buffer overflow in WebCore::TextureMapperLayer::setContentsLayer in WebCore/platform/graphi… |
CVE-2022-24878 | High | 7.7 | 2022-05-06 | Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious `kustomization.yaml` all… |
CVE-2022-24877 | Critical | 9.9 | 2022-05-06 | Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious `kustomization.yaml` all… |
CVE-2022-29171 | Medium | 6.6 | 2022-05-06 | Sourcegraph is a fast and featureful code search and navigation engine. Versions before 3.38.0 are vulnerable to Remote Code Execution in the gitserver service… |
CVE-2022-29164 | High | 7.1 | 2022-05-06 | Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. In affected versions an attacker can create a… |
CVE-2022-29161 | Medium | 5.4 | 2022-05-06 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The XWiki Crypto API will generate X509 certificates s… |
CVE-2022-24903 | High | 8.1 | 2022-05-06 | Rsyslog is a rocket-fast system for log processing. Modules for TCP syslog reception have a potential heap buffer overflow when octet-counted framing is used… |
CVE-2022-24902 | Low | 2.9 | 2022-05-06 | TkVideoplayer is a simple library to play video files in tkinter. Uncontrolled memory consumption in versions of TKVideoplayer prior to 2.0.0 can theoretically… |
CVE-2022-24899 | High | 7.2 | 2022-05-06 | Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. In versions of Contao prior to 4.13.3 it is… |
CVE-2022-24884 | Critical | 10.0 | 2022-05-06 | ecdsautils is a tiny collection of programs used for ECDSA (keygen, sign, verify). `ecdsa_verify_[prepare_]legacy()` does not check whether the signature value… |
CVE-2022-24817 | Critical | 9.9 | 2022-05-06 | Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and 0.29.0, helm-controller 0.1.0 to v0.19.0, and kus… |
CVE-2022-29535 | Critical | 9.8 | 2022-05-05 | Zoho ManageEngine OPManager through 125588 allows SQL Injection via a few default reports. |
CVE-2022-29173 | High | 8.0 | 2022-05-05 | go-tuf is a Go implementation of The Update Framework (TUF). go-tuf does not correctly implement the client workflow for updating the metadata files for roles… |
CVE-2022-29172 | Medium | 6.1 | 2022-05-05 | Auth0 is an authentication broker that supports both social and enterprise identity providers, including Active Directory, LDAP, Google Apps, and Salesforce. I… |
CVE-2022-29167 | High | 7.4 | 2022-05-05 | Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and re… |
CVE-2022-29166 | High | 8.0 | 2022-05-05 | matrix-appservice-irc is a Node.js IRC bridge for Matrix. The vulnerability in node-irc allows an attacker to manipulate a Matrix user into executing IRC comma… |
CVE-2022-29176 | Critical | 9.9 | 2022-05-05 | Rubygems is a package registry used to supply software for the Ruby language ecosystem. Due to a bug in the yank action, it was possible for any RubyGems.org u… |
CVE-2022-27411 | Critical | 9.8 | 2022-05-05 | TOTOLINK N600R v5.3c.5507_B20171031 was discovered to contain a command injection vulnerability via the QUERY_STRING parameter in the "Main" function. |
CVE-2022-27360 | Critical | 9.8 | 2022-05-05 | SpringBlade v3.2.0 and below was discovered to contain a SQL injection vulnerability via the component customSqlSegment. |
CVE-2022-27359 | Medium | 5.5 | 2022-05-05 | Foxit PDF Reader before 12.0.1 and PDF Editor before 12.0.1 allow a this.maildoc NULL pointer dereference. |
CVE-2022-27337 | Medium | 6.5 | 2022-05-05 | A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file. |
CVE-2022-28584 | Critical | 9.8 | 2022-05-05 | It is found that there is a command injection vulnerability in the setWiFiWpsStart interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows a… |
CVE-2022-28583 | Critical | 9.8 | 2022-05-05 | It is found that there is a command injection vulnerability in the setWiFiWpsCfg interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows an… |
CVE-2022-28582 | Critical | 9.8 | 2022-05-05 | It is found that there is a command injection vulnerability in the setWiFiSignalCfg interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows… |
CVE-2022-28581 | Critical | 9.8 | 2022-05-05 | It is found that there is a command injection vulnerability in the setWiFiAdvancedCfg interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allow… |
CVE-2022-28580 | Critical | 9.8 | 2022-05-05 | It is found that there is a command injection vulnerability in the setL2tpServerCfg interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows… |
CVE-2022-28579 | Critical | 9.8 | 2022-05-05 | It is found that there is a command injection vulnerability in the setParentalRules interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows… |
CVE-2022-28578 | Critical | 9.8 | 2022-05-05 | It is found that there is a command injection vulnerability in the setOpenVpnCfg interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows an… |
CVE-2022-28577 | Critical | 9.8 | 2022-05-05 | It is found that there is a command injection vulnerability in the delParentalRules interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows… |
CVE-2022-28575 | Critical | 9.8 | 2022-05-05 | It is found that there is a command injection vulnerability in the setopenvpnclientcfg interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allo… |
CVE-2022-26073 | Medium | 6.5 | 2022-05-05 | A denial of service vulnerability exists in the libxm_av.so DemuxCmdInBuffer functionality of Anker Eufy Homebase 2 2.1.8.5h. A specially-crafted set of networ… |
CVE-2022-25989 | High | 8.8 | 2022-05-05 | An authentication bypass vulnerability exists in the libxm_av.so getpeermac() functionality of Anker Eufy Homebase 2 2.1.8.5h. A specially-crafted DHCP packet… |
CVE-2022-29592 | Critical | 9.8 | 2022-05-05 | Tenda TX9 Pro 22.03.02.10 devices allow OS command injection via set_route (called by doSystemCmd_route). |
CVE-2022-29502 | Critical | 9.8 | 2022-05-05 | SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Escalation of Privileges. |
CVE-2022-29501 | High | 8.8 | 2022-05-05 | SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Escalation of Privileges and code execution. |
CVE-2022-29500 | High | 8.8 | 2022-05-05 | SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Information Disclosure. |
CVE-2022-29491 | High | 7.5 | 2022-05-05 | On F5 BIG-IP LTM, Advanced WAF, ASM, or APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and all vers… |
CVE-2022-29480 | Medium | 5.3 | 2022-05-05 | On F5 BIG-IP 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, when multiple route domains are configured, undisclosed requests to big3d… |
CVE-2022-29479 | Medium | 5.3 | 2022-05-05 | On F5 BIG-IP 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, and… |
CVE-2022-29474 | Medium | 4.3 | 2022-05-05 | On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all… |
CVE-2022-29473 | Medium | 5.9 | 2022-05-05 | On F5 BIG-IP 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when an IPSec ALG profile is configured… |
CVE-2022-29263 | High | 7.8 | 2022-05-05 | On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and… |
CVE-2022-28859 | Medium | 6.5 | 2022-05-05 | On F5 BIG-IP 15.1.x versions prior to 15.1.5.1 and 14.1.x versions prior to 14.1.4.6, when installing Net HSM, the scripts (nethsm-safenet-install.sh and neths… |
CVE-2022-28716 | High | 7.5 | 2022-05-05 | On 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions o… |
CVE-2022-28714 | High | 7.3 | 2022-05-05 | On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and… |
CVE-2022-28708 | Medium | 5.9 | 2022-05-05 | On F5 BIG-IP 16.1.x versions prior to 16.1.2.2 and 15.1.x versions prior to 15.1.5.1, when a BIG-IP DNS resolver-enabled, HTTP-Explicit or SOCKS profile is con… |
CVE-2022-28707 | High | 8.0 | 2022-05-05 | On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, a stored cross-site scripting (XSS) v… |
CVE-2022-28706 | Medium | 5.9 | 2022-05-05 | On F5 BIG-IP 16.1.x versions prior to 16.1.2 and 15.1.x versions prior to 15.1.5.1, when the DNS resolver configuration is used, undisclosed requests can cause… |
CVE-2022-28705 | High | 7.5 | 2022-05-05 | On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, on p… |
CVE-2022-28701 | High | 7.5 | 2022-05-05 | On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, when the stream profile is configured on a virtual server, undisclosed requests can cause an increase in memory… |
CVE-2022-28695 | High | 7.2 | 2022-05-05 | On F5 BIG-IP AFM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5… |
CVE-2022-28691 | High | 7.5 | 2022-05-05 | On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when a… |
CVE-2022-28606 | Critical | 9.8 | 2022-05-05 | An arbitrary file upload vulnerability exists in Wenzhou Huoyin Information Technology Co., Ltd. BossCMS 1.0, which can be exploited by an attacker to gain con… |
CVE-2022-28533 | Critical | 9.8 | 2022-05-05 | Sourcecodester Medical Hub Directory Site 1.0 is vulnerable to SQL Injection via /mhds/clinic/view_details.php. |
CVE-2022-28530 | Critical | 9.8 | 2022-05-05 | Sourcecodester Covid-19 Directory on Vaccination System 1.0 is vulnerable to SQL Injection via cmdcategory. |
CVE-2022-28120 | Critical | 9.8 | 2022-05-05 | Beijing Runnier Network Technology Co., Ltd Open virtual simulation experiment teaching management platform software 2.0 has a file upload vulnerability, which… |
CVE-2022-28080 | High | 8.8 | 2022-05-05 | Royal Event Management System v1.0 was discovered to contain a SQL injection vulnerability via the todate parameter. |
CVE-2022-28079 | High | 8.8 | 2022-05-05 | College Management System v1.0 was discovered to contain a SQL injection vulnerability via the course_code parameter. |
CVE-2022-27880 | Medium | 4.8 | 2022-05-05 | On F5 Traffix SDC 5.2.x versions prior to 5.2.2 and 5.1.x versions prior to 5.1.35, a stored Cross-Site Scripting (XSS) vulnerability exists in an undisclosed… |
CVE-2022-27878 | Medium | 6.8 | 2022-05-05 | On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP, and F5 BIG-IP Guided Configuration (GC) all versions prior to 9.0, a stored… |
CVE-2022-27875 | Medium | 5.5 | 2022-05-05 | On F5 Access for Android 3.x versions prior to 3.0.8, a Task Hijacking vulnerability exists in the F5 Access for Android application, which may allow an attack… |
CVE-2022-27806 | High | 8.7 | 2022-05-05 | On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP Guided Configuration (GC) all vers… |