2022 CVEs (page 217)
Page 217 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-28790 | Medium | 4.0 | 2022-05-03 | Improper authentication in Link to Windows Service prior to version 2.3.04.1 allows attacker to lock the device. The patch adds proper caller signature check l… |
CVE-2022-28789 | Medium | 6.2 | 2022-05-03 | Unprotected activities in Voice Note prior to version 21.3.51.11 allows attackers to record voice without user interaction. The patch adds proper permission fo… |
CVE-2022-28788 | Medium | 4.0 | 2022-05-03 | Improper buffer size check logic in aviextractor library prior to SMR May-2022 Release 1 allows out of bounds read leading to possible temporary denial of serv… |
CVE-2022-28787 | Medium | 4.0 | 2022-05-03 | Improper buffer size check logic in wmfextractor library prior to SMR May-2022 Release 1 allows out of bounds read leading to possible temporary denial of serv… |
CVE-2022-28786 | Medium | 4.0 | 2022-05-03 | Improper buffer size check logic in aviextractor library prior to SMR May-2022 Release 1 allows out of bounds read leading to possible temporary denial of serv… |
CVE-2022-28785 | Medium | 4.0 | 2022-05-03 | Improper buffer size check logic in aviextractor library prior to SMR May-2022 Release 1 allows out of bounds read leading to possible temporary denial of serv… |
CVE-2022-28784 | Medium | 4.0 | 2022-05-03 | Path traversal vulnerability in Galaxy Themes prior to SMR May-2022 Release 1 allows attackers to list file names in arbitrary directory as system user. The pa… |
CVE-2022-28783 | Medium | 6.2 | 2022-05-03 | Improper validation of removing package name in Galaxy Themes prior to SMR May-2022 Release 1 allows attackers to uninstall arbitrary packages without permissi… |
CVE-2022-28782 | Medium | 4.6 | 2022-05-03 | Improper access control vulnerability in Contents To Window prior to SMR May-2022 Release 1 allows physical attacker to install package before completion of Se… |
CVE-2022-28781 | High | 7.7 | 2022-05-03 | Improper input validation in Settings prior to SMR-May-2022 Release 1 allows attackers to launch arbitrary activity with system privilege. The patch adds prope… |
CVE-2022-28780 | Medium | 5.0 | 2022-05-03 | Improper access control vulnerability in Weather prior to SMR May-2022 Release 1 allows that attackers can access location information that set in Weather with… |
CVE-2022-27330 | Medium | 5.4 | 2022-05-03 | A cross-site scripting (XSS) vulnerability in /public/admin/index.php?add_product of E-Commerce Website v1.0 allows attackers to execute arbitrary web scripts… |
CVE-2022-27313 | High | 7.5 | 2022-05-03 | An arbitrary file deletion vulnerability in Gitea v1.16.3 allows attackers to cause a Denial of Service (DoS) via deleting the configuration file. |
CVE-2022-20110 | High | 7.0 | 2022-05-03 | In ion, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges ne… |
CVE-2022-20109 | High | 7.8 | 2022-05-03 | In ion, there is a possible use after free due to improper update of reference count. This could lead to local escalation of privilege with no additional execu… |
CVE-2022-20100 | Medium | 4.4 | 2022-05-03 | In aee daemon, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with System execut… |
CVE-2022-20099 | High | 7.8 | 2022-05-03 | In aee daemon, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution… |
CVE-2022-20098 | Medium | 4.4 | 2022-05-03 | In aee daemon, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with System execut… |
CVE-2022-20097 | Medium | 4.7 | 2022-05-03 | In aee daemon, there is a possible information disclosure due to a race condition. This could lead to local information disclosure with no additional execution… |
CVE-2022-20096 | Medium | 4.4 | 2022-05-03 | In camera, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with System execution privileg… |
CVE-2022-20095 | Medium | 6.7 | 2022-05-03 | In imgsensor, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution pri… |
CVE-2022-20094 | Medium | 6.7 | 2022-05-03 | In imgsensor, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution… |
CVE-2022-20093 | High | 7.8 | 2022-05-03 | In telephony, there is a possible way to disable receiving SMS messages due to a missing permission check. This could lead to local escalation of privilege wit… |
CVE-2022-20092 | Medium | 5.5 | 2022-05-03 | In alac decoder, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execu… |
CVE-2022-20091 | Medium | 6.4 | 2022-05-03 | In aee driver, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges ne… |
CVE-2022-20090 | Medium | 6.4 | 2022-05-03 | In aee driver, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges ne… |
CVE-2022-20089 | Medium | 6.7 | 2022-05-03 | In aee driver, there is a possible memory corruption due to active debug code. This could lead to local escalation of privilege with System execution privilege… |
CVE-2022-20088 | High | 7.8 | 2022-05-03 | In aee driver, there is a possible reference count mistake due to incorrect error handling. This could lead to local escalation of privilege with System execut… |
CVE-2022-20087 | Medium | 6.7 | 2022-05-03 | In ccu, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2022-20085 | Medium | 6.7 | 2022-05-03 | In netdiag, there is a possible symbolic link following due to an improper link resolution. This could lead to local escalation of privilege with System execut… |
CVE-2022-20084 | High | 7.8 | 2022-05-03 | In telephony, there is a possible way to disable receiving emergency broadcasts due to a missing permission check. This could lead to local escalation of privi… |
CVE-2022-22368 | High | 7.5 | 2022-05-03 | IBM Spectrum Scale 5.1.0 through 5.1.3.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive informatio… |
CVE-2022-1331 | Medium | 5.5 | 2022-05-03 | In four instances DMARS (All versions prior to v2.1.10.24) does not properly restrict references of XML external entities while processing specific project fil… |
CVE-2022-29001 | High | 7.2 | 2022-05-03 | In SpringBootMovie <=1.2, the uploaded file suffix parameter is not filtered, resulting in arbitrary file upload vulnerability |
CVE-2022-28599 | Medium | 5.4 | 2022-05-03 | A stored cross-site scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 that allows an authenticated user to upload a malicious .pdf file which acts as a st… |
CVE-2022-28588 | Medium | 5.4 | 2022-05-03 | In SpringBootMovie <=1.2 when adding movie names, malicious code can be stored because there are no filtering parameters, resulting in stored XSS. |
CVE-2022-28585 | Critical | 9.8 | 2022-05-03 | EmpireCMS 7.5 has a SQL injection vulnerability in AdClass.php |
CVE-2022-28505 | High | 7.2 | 2022-05-03 | Jfinal_cms 5.1.0 is vulnerable to SQL Injection via com.jflyfox.system.log.LogController.java. |
CVE-2022-27962 | Critical | 9.8 | 2022-05-03 | Bluecms 1.6 has a SQL injection vulnerability at cooike. |
CVE-2022-28561 | Critical | 9.8 | 2022-05-03 | There is a stack overflow vulnerability in the /goform/setMacFilterCfg function in the httpd service of Tenda ax12 22.03.01.21_cn router. An attacker can obtai… |
CVE-2022-28560 | Critical | 9.8 | 2022-05-03 | There is a stack overflow vulnerability in the goform/fast_setting_wifi_set function in the httpd service of Tenda ac9 15.03.2.21_cn router. An attacker can ob… |
CVE-2022-23400 | High | 7.1 | 2022-05-03 | A stack-based buffer overflow vulnerability exists in the IGXMPXMLParser::parseDelimiter functionality of Accusoft ImageGear 19.10. A specially-crafted PSD fil… |
CVE-2022-22137 | Medium | 6.5 | 2022-05-03 | A memory corruption vulnerability exists in the ioca_mys_rgb_allocate functionality of Accusoft ImageGear 19.10. A specially-crafted malformed file can lead to… |
CVE-2022-1473 | High | 7.5 | 2022-05-03 | The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This f… |
CVE-2022-1434 | Medium | 5.9 | 2022-05-03 | The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses the AAD data as the MAC key. This makes the MAC key trivially predictable. An attack… |
CVE-2022-1343 | Medium | 5.3 | 2022-05-03 | The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the r… |
CVE-2022-1292 | High | 7.3 | 2022-05-03 | The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a man… |
CVE-2022-0882 | Medium | 5.3 | 2022-05-03 | A bug exists where an attacker can read the kernel log through exposed Zircon kernel addresses without the required capability ZX_RSRC_KIND_ROOT. It is recomme… |
CVE-2022-28590 | High | 7.2 | 2022-05-03 | A Remote Code Execution (RCE) vulnerability exists in Pixelimity 1.0 via admin/admin-ajax.php?action=install_theme. |
CVE-2022-28589 | Medium | 4.8 | 2022-05-03 | A stored cross-site scripting (XSS) vulnerability in Pixelimity 1.0 allows attackers to execute arbitrary web scripts or HTML via the Title field in admin/page… |
CVE-2022-0916 | High | 8.4 | 2022-05-03 | An issue was discovered in Logitech Options. The OAuth 2.0 state parameter was not properly validated. This leaves applications vulnerable to CSRF attacks duri… |
CVE-2022-23063 | High | 8.8 | 2022-05-03 | In Shopizer versions 2.3.0 to 3.0.1 are vulnerable to Insufficient Session Expiration. When a password has been changed by the user or by an administrator, a u… |
CVE-2022-1554 | High | 7.5 | 2022-05-03 | Path Traversal due to `send_file` call in GitHub repository clinical-genomics/scout prior to 4.52. |
CVE-2022-21949 | High | 8.8 | 2022-05-03 | A Improper Restriction of XML External Entity Reference vulnerability in SUSE Open Build Service allows remote attackers to reference external entities in cert… |
CVE-2022-20767 | High | 8.6 | 2022-05-03 | A vulnerability in the Snort rule evaluation function of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause… |
CVE-2022-20760 | High | 8.6 | 2022-05-03 | A vulnerability in the DNS inspection handler of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an un… |
CVE-2022-20759 | High | 8.8 | 2022-05-03 | A vulnerability in the web services interface for remote access VPN features of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Def… |
CVE-2022-20757 | High | 8.6 | 2022-05-03 | A vulnerability in the connection handling function in Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a… |
CVE-2022-20751 | High | 8.6 | 2022-05-03 | A vulnerability in the Snort detection engine integration for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to… |
CVE-2022-20748 | Medium | 5.3 | 2022-05-03 | A vulnerability in the local malware analysis process of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause… |
CVE-2022-20746 | High | 8.6 | 2022-05-03 | A vulnerability in the TCP proxy functionality of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a de… |
CVE-2022-20745 | High | 8.6 | 2022-05-03 | A vulnerability in the web services interface for remote access VPN features of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Def… |
CVE-2022-20744 | Medium | 6.5 | 2022-05-03 | A vulnerability in the input protection mechanisms of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to view da… |
CVE-2022-20743 | Medium | 6.5 | 2022-05-03 | A vulnerability in the web management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to bypass sec… |
CVE-2022-20742 | High | 7.4 | 2022-05-03 | A vulnerability in an IPsec VPN library of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an un… |
CVE-2022-20740 | Medium | 6.1 | 2022-05-03 | A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to co… |
CVE-2022-20737 | High | 8.5 | 2022-05-03 | A vulnerability in the handler for HTTP authentication for resources accessed through the Clientless SSL VPN portal of Cisco Adaptive Security Appliance (ASA)… |
CVE-2022-20730 | Medium | 4.0 | 2022-05-03 | A vulnerability in the Security Intelligence feed feature of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to b… |
CVE-2022-20729 | Medium | 4.4 | 2022-05-03 | A vulnerability in CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to inject XML into the command parser. Thi… |
CVE-2022-20715 | High | 8.6 | 2022-05-03 | A vulnerability in the remote access SSL VPN features of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software cou… |
CVE-2022-20629 | Medium | 5.4 | 2022-05-03 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacke… |
CVE-2022-20628 | Medium | 5.4 | 2022-05-03 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacke… |
CVE-2022-20627 | Medium | 5.4 | 2022-05-03 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacke… |
CVE-2022-29824 | Medium | 6.5 | 2022-05-03 | In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in ou… |
CVE-2022-28118 | Critical | 9.8 | 2022-05-03 | SiteServer CMS v7.x allows attackers to execute arbitrary code via a crafted plug-in. |
CVE-2022-24974 | Medium | 5.3 | 2022-05-02 | Links may not be rewritten according to policy in some specially formatted emails. |
CVE-2022-24897 | High | 7.5 | 2022-05-02 | APIs to evaluate content with Velocity is a package for APIs to evaluate content with Velocity. Starting with version 2.3 and prior to 12.6.7, 12.10.3, and 13… |
CVE-2022-23723 | High | 7.7 | 2022-05-02 | An MFA bypass vulnerability exists in the PingFederate PingOne MFA Integration Kit when adapter HTML templates are used as part of an authentication flow. |
CVE-2022-23722 | Medium | 6.5 | 2022-05-02 | When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID or SMS authenticatio… |
CVE-2022-29444 | Medium | 6.5 | 2022-05-02 | Plugin Settings Change leading to Cross-Site Scripting (XSS) vulnerability in Cloudways Breeze plugin <= 2.0.2 on WordPress allows users with a subscriber or h… |
CVE-2022-28613 | High | 7.5 | 2022-05-02 | A vulnerability exists in the HCI Modbus TCP function included in the product versions listed above. If the HCI Modbus TCP is en-abled and configured, an attac… |
CVE-2022-26326 | Medium | 4.0 | 2022-05-02 | Potential open redirection vulnerability when URL is crafted in specific format in NetIQ Access Manager prior to 5.0.2 |
CVE-2022-26325 | Low | 2.9 | 2022-05-02 | Reflected Cross Site Scripting (XSS) vulnerability in NetIQ Access Manager prior to 5.0.2 |
CVE-2022-1515 | Medium | 5.5 | 2022-05-02 | A memory leak was discovered in matio 1.5.21 and earlier in Mat_VarReadNextInfo5() in mat5.c via a crafted file. This issue can potentially result in DoS. |
CVE-2022-1475 | Medium | 5.5 | 2022-05-02 | An integer overflow vulnerability was found in FFmpeg versions before 4.4.2 and before 5.0.1 in g729_parse() in llibavcodec/g729_parser.c when processing a spe… |
CVE-2022-1378 | Critical | 9.8 | 2022-05-02 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_pgHandler.ashx. This allows an attacker… |
CVE-2022-1377 | Critical | 9.8 | 2022-05-02 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_rltHandler.ashx. This allows an attacker… |
CVE-2022-1376 | Critical | 9.8 | 2022-05-02 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_privgrpHandler.ashx. This allows an atta… |
CVE-2022-1375 | Critical | 9.8 | 2022-05-02 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_slogHandler.ashx. This allows an attacke… |
CVE-2022-1374 | Critical | 9.8 | 2022-05-02 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_unHandler.ashx. This allows an attacker… |
CVE-2022-1372 | Critical | 9.8 | 2022-05-02 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in dlSlog.aspx. This allows an attacker to injec… |
CVE-2022-1371 | Critical | 9.8 | 2022-05-02 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in ReadRegf. This allows an attacker to inject a… |
CVE-2022-1370 | Critical | 9.8 | 2022-05-02 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in ReadREGbyID. This allows an attacker to injec… |
CVE-2022-1369 | Critical | 9.8 | 2022-05-02 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in ReadRegIND. This allows an attacker to inject… |
CVE-2022-1367 | Critical | 9.8 | 2022-05-02 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in Handler_TCV.ashx. This allows an attacker to… |
CVE-2022-1366 | Critical | 9.8 | 2022-05-02 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerChart.ashx. This allows an attacker to… |
CVE-2022-1282 | Medium | 6.1 | 2022-05-02 | The Photo Gallery by 10Web WordPress plugin before 1.6.3 does not properly sanitize the $_GET['image_url'] variable, which is reflected back to the users when… |
CVE-2022-1281 | Critical | 9.8 | 2022-05-02 | The Photo Gallery WordPress plugin through 1.6.3 does not properly escape the $_POST['filter_tag'] parameter, which is appended to an SQL query, making SQL Inj… |
CVE-2022-1273 | High | 7.2 | 2022-05-02 | The Import WP WordPress plugin before 2.4.6 does not validate the imported file in some cases, allowing high privilege users such as admin to upload arbitrary… |
CVE-2022-1269 | Medium | 6.1 | 2022-05-02 | The Fast Flow WordPress plugin before 1.2.12 does not sanitise and escape the page parameter before outputting back in an attribute in an admin dashboard, lead… |