2022 CVEs (page 216)
Page 216 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-25946 | High | 8.7 | 2022-05-05 | On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP Guided Configuration (GC) all vers… |
CVE-2022-1468 | Medium | 4.3 | 2022-05-05 | On all versions of 17.0.x, 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x on F5 BIG-IP, an authenticated iControl REST user with at least guest role privil… |
CVE-2022-1389 | Low | 3.1 | 2022-05-05 | On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP (fixed in 17.0.0), a cross-site request forgery (CSRF) vulnerability exists… |
CVE-2022-1388 | Critical | 9.8 | 2022-05-05 | On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all… |
CVE-2022-22434 | Medium | 4.6 | 2022-05-05 | IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a user with physical access to create an API request modified to create additional object… |
CVE-2022-22433 | High | 7.5 | 2022-05-05 | IBM Robotic Process Automation 21.0.1 and 21.0.2 is vulnerable to External Service Interaction attack, caused by improper validation of user-supplied input. A… |
CVE-2022-22415 | Medium | 6.5 | 2022-05-05 | A vulnerability exists where an IBM Robotic Process Automation 21.0.1 regular user is able to obtain view-only access to some admin pages in the Control Center… |
CVE-2022-1516 | Medium | 5.5 | 2022-05-05 | A NULL pointer dereference flaw was found in the Linux kernel’s X.25 set of standardized network protocols functionality in the way a user terminates their ses… |
CVE-2022-1464 | Medium | 5.4 | 2022-05-05 | Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachment then xss is ex… |
CVE-2022-29340 | High | 7.5 | 2022-05-05 | GPAC 2.1-DEV-rev87-g053aae8-master. has a Null Pointer Dereference vulnerability in gf_isom_parse_movie_boxes_internal due to improper return value handling of… |
CVE-2022-29339 | High | 7.5 | 2022-05-05 | In GPAC 2.1-DEV-rev87-g053aae8-master, function BS_ReadByte() in utils/bitstream.c has a failed assertion, which causes a Denial of Service. This vulnerability… |
CVE-2022-28471 | Medium | 6.5 | 2022-05-05 | In ffjpeg (commit hash: caade60), the function bmp_load() in bmp.c contains an integer overflow vulnerability, which eventually results in the heap overflow in… |
CVE-2022-28462 | High | 7.5 | 2022-05-05 | novel-plus 3.6.0 suffers from an Arbitrary file reading vulnerability. |
CVE-2022-28461 | Critical | 9.8 | 2022-05-05 | mingyuefusu Library Management System all versions as of 03-27-2022 is vulnerable to SQL Injection. |
CVE-2022-29940 | Medium | 5.4 | 2022-05-05 | In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters formseq and formid in interface\orders\find_order_popup.php leads to multiple cross-site s… |
CVE-2022-29939 | Medium | 5.4 | 2022-05-05 | In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters debug and InsId in interface\billing\sl_eob_process.php leads to multiple cross-site scrip… |
CVE-2022-29938 | High | 8.8 | 2022-05-05 | In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameter payment_id in interface\billing\new_payment.php via interface\billing\payment_master.inc.ph… |
CVE-2022-1575 | Critical | 9.6 | 2022-05-05 | Arbitrary Code Execution through Sanitizer Bypass in GitHub repository jgraph/drawio prior to 18.0.0. - Arbitrary (remote) code execution in the desktop app. -… |
CVE-2022-1592 | High | 8.2 | 2022-05-05 | Server-Side Request Forgery in scout in GitHub repository clinical-genomics/scout prior to v4.42. An attacker could make the application perform arbitrary requ… |
CVE-2022-1411 | Medium | 6.1 | 2022-05-05 | Unrestructed file upload in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Attacker can send malicious files to the victims is able to retriev… |
CVE-2022-1590 | Low | 3.5 | 2022-05-05 | A vulnerability was found in Bludit 3.13.1. It has been declared as problematic. This vulnerability affects the endpoint /admin/new-content of the New Content… |
CVE-2022-28890 | Critical | 9.8 | 2022-05-05 | A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects Apache Jena version 4.4.0… |
CVE-2022-30292 | Critical | 10.0 | 2022-05-04 | Heap-based buffer overflow in sqbaselib.cpp in SQUIRREL 3.2 due to lack of a certain sq_reservestack call. |
CVE-2022-30288 | High | 7.5 | 2022-05-04 | Agoo before 2.14.3 does not reject GraphQL fragment spreads that form cycles, leading to an application crash. NOTE: the vendor has disputed this on the ground… |
CVE-2022-30284 | Critical | 9.0 | 2022-05-04 | In the python-libnmap package through 0.7.2 for Python, remote command execution can occur (if used in a client application that does not validate arguments)… |
CVE-2022-29155 | Critical | 9.8 | 2022-05-04 | In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement w… |
CVE-2022-30241 | Medium | 6.1 | 2022-05-04 | The jquery.json-viewer library through 1.4.0 for Node.js does not properly escape characters such as < in a JSON object, as demonstrated by a SCRIPT element. |
CVE-2022-29943 | Medium | 6.5 | 2022-05-04 | Talend Administration Center has a vulnerability that allows an authenticated user to use XML External Entity (XXE) processing to achieve read access as root o… |
CVE-2022-29942 | Medium | 6.5 | 2022-05-04 | Talend Administration Center has a vulnerability that allows an authenticated user to use the Service Registry 'Add' functionality to perform SSRF HTTP GET req… |
CVE-2022-25786 | Medium | 4.9 | 2022-05-04 | Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensitive information. This issue affects: Ga… |
CVE-2022-1584 | Medium | 6.1 | 2022-05-04 | Reflected XSS in GitHub repository microweber/microweber prior to 1.2.16. Executing JavaScript as the victim |
CVE-2022-23724 | Medium | 6.4 | 2022-05-04 | Use of static encryption key material allows forging an authentication token to other users within a tenant organization. MFA may be bypassed by redirecting an… |
CVE-2022-20801 | Medium | 4.7 | 2022-05-04 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340 and RV345 Routers could allow an authenticated, remote attacker to… |
CVE-2022-20799 | Medium | 4.7 | 2022-05-04 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340 and RV345 Routers could allow an authenticated, remote attacker to… |
CVE-2022-20796 | Medium | 6.5 | 2022-05-04 | On May 4, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability… |
CVE-2022-20794 | Medium | 6.5 | 2022-05-04 | Multiple vulnerabilities in the web engine of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow a remote attacker t… |
CVE-2022-20785 | High | 7.5 | 2022-05-04 | On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerabili… |
CVE-2022-20780 | Critical | 9.9 | 2022-05-04 | Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM) to the h… |
CVE-2022-20779 | Critical | 9.9 | 2022-05-04 | Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM) to the h… |
CVE-2022-20777 | Critical | 9.9 | 2022-05-04 | Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM) to the h… |
CVE-2022-20771 | High | 7.5 | 2022-05-04 | On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerabili… |
CVE-2022-20770 | High | 8.6 | 2022-05-04 | On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerabili… |
CVE-2022-20764 | Medium | 6.5 | 2022-05-04 | Multiple vulnerabilities in the web engine of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow a remote attacker t… |
CVE-2022-20753 | Medium | 4.7 | 2022-05-04 | A vulnerability in web-based management interface of Cisco Small Business RV340 and RV345 Routers could allow an authenticated, remote attacker to execute arbi… |
CVE-2022-20734 | Medium | 4.4 | 2022-05-04 | A vulnerability in Cisco SD-WAN vManage Software could allow an authenticated, local attacker to view sensitive information on an affected system. This vulnera… |
CVE-2022-28940 | High | 7.5 | 2022-05-04 | In H3C MagicR100 <=V100R005, the / Ajax / ajaxget interface can be accessed without authorization. It sends a large amount of data through ajaxmsg to carry out… |
CVE-2022-28557 | Critical | 9.8 | 2022-05-04 | There is a command injection vulnerability at the /goform/setsambacfg interface of Tenda AC15 US_AC15V1.0BR_V15.03.05.20_multi_TDE01.bin device web, which can… |
CVE-2022-28556 | High | 7.5 | 2022-05-04 | Tenda AC15 US_AC15V1.0BR_V15.03.05.20_multi_TDE01.bin is vulnerable to Buffer Overflow. The stack overflow vulnerability lies in the /goform/setpptpservercfg i… |
CVE-2022-23443 | High | 7.5 | 2022-05-04 | An improper access control in Fortinet FortiSOAR before 7.2.0 allows unauthenticated attackers to access gateway API data via crafted HTTP GET requests. |
CVE-2022-29950 | Medium | 4.3 | 2022-05-04 | Experian Hunter 1.16 allows remote authenticated users to modify assumed-immutable elements via the (1) rule name parameter to the Rules page or the (2) subrul… |
CVE-2022-29347 | Critical | 9.8 | 2022-05-04 | An arbitrary file upload vulnerability in Web@rchiv 1.0 allows attackers to execute arbitrary commands via a crafted PHP file. |
CVE-2022-28806 | High | 7.8 | 2022-05-04 | An issue was discovered on certain Fujitsu LIEFBOOK devices (A3510, U9310, U7511/U7411/U7311, U9311, E5510/E5410, U7510/U7410/U7310, E459/E449) with BIOS versi… |
CVE-2022-28568 | Critical | 9.8 | 2022-05-04 | Sourcecodester Doctor's Appointment System 1.0 is vulnerable to File Upload to RCE via Image upload from the administrator panel. An attacker can obtain remote… |
CVE-2022-28552 | High | 8.8 | 2022-05-04 | Cscms 4.1 is vulnerable to SQL Injection. Log into the background, open the song module, create a new song, delete it to the recycle bin, and SQL injection sec… |
CVE-2022-28512 | Critical | 9.8 | 2022-05-04 | A SQL injection vulnerability exists in Sourcecodester Fantastic Blog CMS 1.0 . An attacker can inject query in "/fantasticblog/single.php" via the "id=5" para… |
CVE-2022-28488 | High | 7.5 | 2022-05-04 | The function wav_format_write in libwav.c in libwav through 2017-04-20 has an Use of Uninitialized Variable vulnerability. |
CVE-2022-28487 | High | 7.5 | 2022-05-04 | Tcpreplay version 4.4.1 contains a memory leakage flaw in fix_ipv6_checksums() function. The highest threat from this vulnerability is to data confidentiality. |
CVE-2022-27461 | Medium | 6.1 | 2022-05-04 | In nopCommerce 4.50.1, an open redirect vulnerability can be triggered by luring a user to authenticate to a nopCommerce page by clicking on a crafted link. |
CVE-2022-28508 | Medium | 6.1 | 2022-05-04 | An XSS issue was discovered in browser_search_plugin.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code… |
CVE-2022-28099 | High | 8.8 | 2022-05-04 | Poultry Farm Management System v1.0 was discovered to contain a SQL injection vulnerability via the Item parameter at /farm/store.php. |
CVE-2022-28090 | Medium | 6.5 | 2022-05-04 | Jspxcms v10.2.0 allows attackers to execute a Server-Side Request Forgery (SSRF) via /cmscp/ext/collect/fetch_url.do?url=. |
CVE-2022-28082 | Critical | 9.8 | 2022-05-04 | Tenda AX12 v22.03.01.21_CN was discovered to contain a stack overflow via the list parameter at /goform/SetNetControlList. |
CVE-2022-28081 | Medium | 6.1 | 2022-05-04 | A reflected cross-site scripting (XSS) vulnerability in the component Query.php of arPHP v3.6.0 allows attackers to execute arbitrary web scripts. |
CVE-2022-28076 | High | 7.2 | 2022-05-04 | Seacms v11.6 was discovered to contain a remote command execution (RCE) vulnerability via the Mail Server Settings. |
CVE-2022-28067 | High | 8.6 | 2022-05-04 | An incorrect access control issue in Sandboxie Classic v5.55.13 allows attackers to cause a Denial of Service (DoS) in the Sandbox via a crafted executable. |
CVE-2022-27903 | High | 8.8 | 2022-05-04 | An OS Command Injection vulnerability in the configuration parser of Eve-NG Professional through 4.0.1-65 and Eve-NG Community through 2.0.3-112 allows a remot… |
CVE-2022-25787 | High | 7.5 | 2022-05-04 | Information Exposure Through Query Strings in GET Request vulnerability in LMM API of Secomea GateManager allows system administrator to hijack connection. Thi… |
CVE-2022-25785 | Medium | 6.6 | 2022-05-04 | Stack-based Buffer Overflow vulnerability in SiteManager allows logged-in or local user to cause arbitrary code execution. This issue affects: Secomea SiteMana… |
CVE-2022-25784 | Critical | 9.1 | 2022-05-04 | Cross-site Scripting (XSS) vulnerability in Web GUI of SiteManager allows logged-in user to inject scripting. This issue affects: Secomea SiteManager all versi… |
CVE-2022-25783 | Medium | 4.3 | 2022-05-04 | Insufficient Logging vulnerability in web server of Secomea GateManager allows logged in user to issue improper queries without logging. This issue affects: Se… |
CVE-2022-25782 | Medium | 5.4 | 2022-05-04 | Improper Handling of Insufficient Privileges vulnerability in Web UI of Secomea GateManager allows logged in user to access and update privileged information… |
CVE-2022-25781 | Medium | 4.2 | 2022-05-04 | Cross-site Scripting (XSS) vulnerability in Web UI of Secomea GateManager allows phishing attacker to inject javascript or html into logged in user session. |
CVE-2022-25780 | Medium | 4.3 | 2022-05-04 | Information Exposure vulnerability in web UI of Secomea GateManager allows logged in user to query devices outside own scope. |
CVE-2022-25779 | Medium | 4.3 | 2022-05-04 | Logging of Excessive Data vulnerability in audit log of Secomea GateManager allows logged in user to write text entries in audit log. This issue affects: Secom… |
CVE-2022-25778 | Medium | 4.2 | 2022-05-04 | Cross-Site Request Forgery (CSRF) vulnerability in Web UI of Secomea GateManager allows phishing attacker to issue get request in logged in user session. |
CVE-2022-28111 | Critical | 9.8 | 2022-05-04 | MyBatis PageHelper v1.x.x-v3.7.0 v4.0.0-v5.0.0,v5.1.0-v5.3.0 was discovered to contain a time-blind SQL injection vulnerability via the orderBy parameter. |
CVE-2022-28096 | High | 7.2 | 2022-05-04 | Skycaiji v2.4 was discovered to contain a remote code execution (RCE) vulnerability via /SkycaijiApp/admin/controller/Develop.php. |
CVE-2022-1571 | Medium | 6.1 | 2022-05-04 | Cross-site scripting - Reflected in Create Subaccount in GitHub repository neorazorx/facturascripts prior to 2022.07. This vulnerability can be arbitrarily exe… |
CVE-2022-1555 | Medium | 6.1 | 2022-05-04 | DOM XSS in microweber ver 1.2.15 in GitHub repository microweber/microweber prior to 1.2.16. inject arbitrary js code, deface website, steal cookie... |
CVE-2022-1502 | Medium | 4.3 | 2022-05-04 | Permissions were not properly verified in the API on projects using version control in Git. This allowed projects to be modified by users with only ProjectView… |
CVE-2022-28055 | Critical | 9.8 | 2022-05-04 | Fusionpbx v4.4 and below contains a command injection vulnerability via the download email logs function. |
CVE-2022-27470 | High | 7.8 | 2022-05-04 | SDL_ttf v2.0.18 and below was discovered to contain an arbitrary memory write via the function TTF_RenderText_Solid(). This vulnerability is triggered via a cr… |
CVE-2022-27431 | Critical | 9.8 | 2022-05-04 | Wuzhicms v4.1.0 was discovered to contain a SQL injection vulnerability via the groupid parameter at /coreframe/app/member/admin/group.php. |
CVE-2022-27420 | Critical | 9.8 | 2022-05-04 | Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the patient_contact parameter in patientsearch.php. |
CVE-2022-24901 | High | 7.5 | 2022-05-04 | Improper validation of the Apple certificate URL in the Apple Game Center authentication adapter allows attackers to bypass authentication, making the server v… |
CVE-2022-27413 | Critical | 9.8 | 2022-05-03 | Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the adminname parameter in admin.php. |
CVE-2022-21743 | High | 7.8 | 2022-05-03 | In ion, there is a possible use after free due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges… |
CVE-2022-20111 | High | 8.4 | 2022-05-03 | In ion, there is a possible use after free due to incorrect error handling. This could lead to local escalation of privilege with no additional execution privi… |
CVE-2022-20108 | Medium | 6.7 | 2022-05-03 | In voice service, there is a possible out of bounds write due to a stack-based buffer overflow. This could lead to local escalation of privilege with System ex… |
CVE-2022-20107 | Medium | 4.4 | 2022-05-03 | In subtitle service, there is a possible application crash due to an integer overflow. This could lead to local denial of service with System execution privile… |
CVE-2022-20106 | Medium | 6.7 | 2022-05-03 | In MM service, there is a possible out of bounds write due to a heap-based buffer overflow. This could lead to local escalation of privilege with System execut… |
CVE-2022-20105 | Medium | 6.7 | 2022-05-03 | In MM service, there is a possible out of bounds write due to a stack-based buffer overflow. This could lead to local escalation of privilege with System execu… |
CVE-2022-20104 | Medium | 5.5 | 2022-05-03 | In aee daemon, there is a possible information disclosure due to improper access control. This could lead to local information disclosure with no additional ex… |
CVE-2022-20103 | Medium | 4.4 | 2022-05-03 | In aee daemon, there is a possible information disclosure due to symbolic link following. This could lead to local information disclosure with System execution… |
CVE-2022-20102 | Medium | 4.4 | 2022-05-03 | In aee daemon, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with System execut… |
CVE-2022-20101 | Medium | 5.5 | 2022-05-03 | In aee daemon, there is a possible information disclosure due to a path traversal. This could lead to local information disclosure with no additional execution… |
CVE-2022-1548 | Low | 3.7 | 2022-05-03 | Mattermost Playbooks plugin 1.25 and earlier fails to properly restrict user-level permissions, which allows playbook members to escalate their membership priv… |
CVE-2022-28793 | Medium | 4.4 | 2022-05-03 | Given the TEE is compromised and controlled by the attacker, improper state maintenance in StrongBox allows attackers to change Android ROT during device boot… |
CVE-2022-28792 | Medium | 6.2 | 2022-05-03 | DLL hijacking vulnerability in Gear IconX PC Manager prior to version 2.1.220405.51 allows attacker to execute arbitrary code. The patch adds proper absolute p… |
CVE-2022-28791 | Medium | 6.2 | 2022-05-03 | Improper input validation vulnerability in InstallAgent in Galaxy Store prior to version 4.5.41.8 allows attacker to overwrite files stored in a specific path… |