2022 CVEs (page 221)
Page 221 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-29577 | Medium | 6.1 | 2022-04-21 | OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed… |
CVE-2022-28367 | Medium | 6.1 | 2022-04-21 | OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed… |
CVE-2022-28366 | High | 7.5 | 2022-04-21 | Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption. In par… |
CVE-2022-26856 | High | 8.2 | 2022-04-21 | Dell EMC Repository Manager version 3.4.0 contains a plain-text password storage vulnerability. A local attacker could potentially exploit this vulnerability… |
CVE-2022-24424 | High | 7.5 | 2022-04-21 | Dell EMC AppSync versions from 3.9 to 4.3 contain a path traversal vulnerability in AppSync server. A remote unauthenticated attacker may potentially exploit t… |
CVE-2022-24423 | Medium | 5.3 | 2022-04-21 | Dell iDRAC8 versions prior to 2.83.83.83 contain a denial of service vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerabil… |
CVE-2022-22558 | Medium | 5.7 | 2022-04-21 | Dell PowerEdge Server BIOS and Dell Precision Workstation 7910 and 7920 Rack BIOS contain an Improper SMM communication buffer verification vulnerability. A Lo… |
CVE-2022-28445 | Medium | 6.5 | 2022-04-21 | KiteCMS v1.1.1 was discovered to contain an arbitrary file read vulnerability via the background management module. |
CVE-2022-28444 | High | 7.5 | 2022-04-21 | UCMS v1.6 was discovered to contain an arbitrary file read vulnerability. |
CVE-2022-28443 | Critical | 9.1 | 2022-04-21 | UCMS v1.6 was discovered to contain an arbitrary file deletion vulnerability. |
CVE-2022-28440 | High | 8.8 | 2022-04-21 | An arbitrary file upload vulnerability in UCMS v1.6 allows attackers to execute arbitrary code via a crafted PHP file. |
CVE-2022-28439 | Critical | 9.8 | 2022-04-21 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/uesrs.php&&action=delete&userid=4. |
CVE-2022-28438 | Critical | 9.8 | 2022-04-21 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/uesrs.php&action=type&userrole=User&userid=. |
CVE-2022-28437 | Critical | 9.8 | 2022-04-21 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/uesrs.php&action=type&userrole=Admin&userid=3. |
CVE-2022-28436 | Critical | 9.8 | 2022-04-21 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/uesrs.php&action=display&value=Hide&userid=. |
CVE-2022-28435 | Critical | 9.8 | 2022-04-21 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/siteoptions.php&action=displaygoal&value=1&roleid=1. |
CVE-2022-28434 | Critical | 9.8 | 2022-04-21 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin.php?id=siteoptions&social=edit&sid=2. |
CVE-2022-28433 | Critical | 9.8 | 2022-04-21 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/uesrs.php&action=display&value=Show&userid=. |
CVE-2022-28432 | Critical | 9.8 | 2022-04-21 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin.php?id=siteoptions&social=display&value=0&sid=2. |
CVE-2022-28431 | Critical | 9.8 | 2022-04-21 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/siteoptions.php&social=remove&sid=2. |
CVE-2022-28429 | Critical | 9.8 | 2022-04-21 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/inbox.php&action=delete&msgid=. |
CVE-2022-28427 | Critical | 9.8 | 2022-04-21 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/inbox.php&action=read&msgid=. |
CVE-2022-28426 | Critical | 9.8 | 2022-04-21 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/pagerole.php&action=edit&roleid=. |
CVE-2022-28425 | Critical | 9.8 | 2022-04-21 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/pagerole.php&action=display&value=1&roleid=. |
CVE-2022-28424 | Critical | 9.8 | 2022-04-21 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/posts.php&find=. |
CVE-2022-28423 | Critical | 9.8 | 2022-04-21 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/posts.php&action=delete. |
CVE-2022-28422 | Critical | 9.8 | 2022-04-21 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/posts.php&action=edit. |
CVE-2022-28421 | Critical | 9.8 | 2022-04-21 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin.php?id=posts&action=display&value=1&postid=. |
CVE-2022-28420 | Critical | 9.8 | 2022-04-21 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via BabyCare/admin.php?id=theme&setid=. |
CVE-2022-28417 | Critical | 9.8 | 2022-04-21 | Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via /hocms/classes/Master.php?f=delete_phase. |
CVE-2022-28416 | Critical | 9.8 | 2022-04-21 | Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via /hocms/classes/Master.php?f=delete_phase. |
CVE-2022-28415 | Critical | 9.8 | 2022-04-21 | Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via /hocms/classes/Master.php?f=delete_collection. |
CVE-2022-28414 | Critical | 9.8 | 2022-04-21 | Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via /hocms/classes/Master.php?f=delete_member. |
CVE-2022-28413 | Critical | 9.8 | 2022-04-21 | Car Driving School Management System v1.0 was discovered to contain a SQL injection vulnerability via /cdsms/classes/Master.php?f=delete_enrollment. |
CVE-2022-28412 | Critical | 9.8 | 2022-04-21 | Car Driving School Managment System v1.0 was discovered to contain a SQL injection vulnerability via /cdsms/classes/Master.php?f=delete_package. |
CVE-2022-28411 | Critical | 9.8 | 2022-04-21 | Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via /reps/admin/?page=agents/manage_agent. |
CVE-2022-28410 | Critical | 9.8 | 2022-04-21 | Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via /reps/classes/Users.php?f=delete_agent. |
CVE-2022-28030 | Critical | 9.8 | 2022-04-21 | Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via /reps/classes/Master.php?f=delete_estate. |
CVE-2022-28029 | Critical | 9.8 | 2022-04-21 | Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via /reps/classes/Master.php?f=delete_type. |
CVE-2022-28028 | Critical | 9.8 | 2022-04-21 | Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via /reps/classes/Master.php?f=delete_amenity. |
CVE-2022-28026 | Critical | 9.8 | 2022-04-21 | Student Grading System v1.0 was discovered to contain a SQL injection vulnerability via /student-grading-system/rms.php?page=student_p&id=. |
CVE-2022-28025 | Critical | 9.8 | 2022-04-21 | Student Grading System v1.0 was discovered to contain a SQL injection vulnerability via /student-grading-system/rms.php?page=school_year. |
CVE-2022-28024 | Critical | 9.8 | 2022-04-21 | Student Grading System v1.0 was discovered to contain a SQL injection vulnerability via /student-grading-system/rms.php?page=grade. |
CVE-2022-28023 | Critical | 9.8 | 2022-04-21 | Purchase Order Management System v1.0 was discovered to contain a SQL injection vulnerability via /purchase_order/classes/Master.php?f=delete_supplier. |
CVE-2022-28022 | Critical | 9.8 | 2022-04-21 | Purchase Order Management System v1.0 was discovered to contain a SQL injection vulnerability via /purchase_order/classes/Master.php?f=delete_item. |
CVE-2022-28021 | Critical | 9.8 | 2022-04-21 | Purchase Order Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via /purchase_order/admin/?page=user. |
CVE-2022-28020 | High | 8.8 | 2022-04-21 | Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\position_edit.php. |
CVE-2022-28019 | High | 8.8 | 2022-04-21 | Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\employee_edit.php. |
CVE-2022-28018 | High | 8.8 | 2022-04-21 | Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\schedule_edit.php. |
CVE-2022-28017 | High | 8.8 | 2022-04-21 | Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\overtime_edit.php. |
CVE-2022-28016 | High | 8.8 | 2022-04-21 | Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\deduction_edit.php. |
CVE-2022-28015 | High | 8.8 | 2022-04-21 | Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\cashadvance_edit.php. |
CVE-2022-28014 | High | 8.8 | 2022-04-21 | Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\attendance_edit.php. |
CVE-2022-28013 | High | 8.8 | 2022-04-21 | Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\schedule_employee_edit.php. |
CVE-2022-28012 | High | 8.8 | 2022-04-21 | Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\position_delete.php. |
CVE-2022-28011 | High | 8.8 | 2022-04-21 | Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\schedule_delete.php. |
CVE-2022-28010 | High | 8.8 | 2022-04-21 | Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\overtime_delete.php. |
CVE-2022-28009 | High | 8.8 | 2022-04-21 | Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\attendance_delete.php. |
CVE-2022-28008 | High | 8.8 | 2022-04-21 | Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\attendance_delete.php. |
CVE-2022-28007 | High | 8.8 | 2022-04-21 | Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\cashadvance_delete.php. |
CVE-2022-28006 | High | 8.8 | 2022-04-21 | Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\employee_delete.php. |
CVE-2022-27478 | High | 8.8 | 2022-04-21 | Victor v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component admin/profile.php?section=admin. |
CVE-2022-29566 | High | 8.1 | 2022-04-21 | The Bulletproofs 2017/1066 paper mishandles Fiat-Shamir generation because the hash computation fails to include all of the public values from the Zero Knowled… |
CVE-2022-28820 | Medium | 6.1 | 2022-04-21 | ACS Commons version 5.1.x (and earlier) suffers from a Reflected Cross-site Scripting (XSS) vulnerability in /apps/acs-commons/content/page-compare.html endpoi… |
CVE-2022-28743 | Critical | 9.1 | 2022-04-21 | Time-of-check Time-of-use (TOCTOU) Race Condition vulerability in Foscam R2C IP camera running System FW <= 1.13.1.6, and Application FW <= 2.91.2.66, allows a… |
CVE-2022-23711 | Medium | 5.3 | 2022-04-21 | A vulnerability in Kibana could expose sensitive information related to Elastic Stack monitoring in the Kibana page source. Elastic Stack monitoring features p… |
CVE-2022-22969 | Medium | 6.5 | 2022-04-21 | <Issue Description> Spring Security OAuth versions 2.5.x prior to 2.5.2 and older unsupported versions are susceptible to a Denial-of-Service (DoS) attack via… |
CVE-2022-20805 | Medium | 4.1 | 2022-04-21 | A vulnerability in the automatic decryption process in Cisco Umbrella Secure Web Gateway (SWG) could allow an authenticated, adjacent attacker to bypass the SS… |
CVE-2022-20804 | Medium | 5.3 | 2022-04-21 | A vulnerability in the Cisco Discovery Protocol of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Managemen… |
CVE-2022-20795 | Medium | 5.8 | 2022-04-21 | A vulnerability in the implementation of the Datagram TLS (DTLS) protocol in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defens… |
CVE-2022-20790 | Medium | 6.5 | 2022-04-21 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Man… |
CVE-2022-20789 | Medium | 4.9 | 2022-04-21 | A vulnerability in the software upgrade process of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Managemen… |
CVE-2022-20788 | Medium | 6.1 | 2022-04-21 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified CM Session Management Edition (Unifie… |
CVE-2022-20787 | Medium | 5.7 | 2022-04-21 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) Software and Cisco Unified CM Session Management Edi… |
CVE-2022-20786 | Medium | 5.4 | 2022-04-21 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an au… |
CVE-2022-20783 | High | 7.5 | 2022-04-21 | A vulnerability in the packet processing functionality of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an unau… |
CVE-2022-20778 | Medium | 6.1 | 2022-04-21 | A vulnerability in the authentication component of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS)… |
CVE-2022-20773 | High | 7.5 | 2022-04-21 | A vulnerability in the key-based SSH authentication mechanism of Cisco Umbrella Virtual Appliance (VA) could allow an unauthenticated, remote attacker to imper… |
CVE-2022-20732 | High | 7.8 | 2022-04-21 | A vulnerability in the configuration file protections of Cisco Virtualized Infrastructure Manager (VIM) could allow an authenticated, local attacker to access… |
CVE-2022-24875 | Medium | 5.3 | 2022-04-21 | The CVEProject/cve-services is an open source project used to operate the CVE services api. In versions up to and including 1.1.1 the `org.conroller.js` code w… |
CVE-2022-24870 | High | 8.7 | 2022-04-21 | Combodo iTop is a web based IT Service Management tool. In 3.0.0 beta releases prior to 3.0.0 beta3 a malicious script can be injected in tooltips using iTop c… |
CVE-2022-24869 | Medium | 4.6 | 2022-04-21 | GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior t… |
CVE-2022-24868 | High | 7.3 | 2022-04-21 | GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior t… |
CVE-2022-24867 | High | 7.5 | 2022-04-21 | GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. When you pass the c… |
CVE-2022-22436 | Medium | 5.4 | 2022-04-21 | IBM Maximo Asset Management 7.6.1.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thu… |
CVE-2022-22435 | Medium | 5.4 | 2022-04-21 | IBM Maximo Asset Management 7.6.1.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thu… |
CVE-2022-0272 | Critical | 9.8 | 2022-04-21 | Improper Restriction of XML External Entity Reference in GitHub repository detekt/detekt prior to 1.20.0. |
CVE-2022-1022 | Medium | 5.4 | 2022-04-21 | Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.5.0. |
CVE-2022-24272 | Medium | 6.5 | 2022-04-21 | An authenticated user may trigger an invariant assertion during command dispatch due to incorrect validation on the $external database. This may result in mong… |
CVE-2022-1420 | Medium | 5.5 | 2022-04-21 | Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4774. |
CVE-2022-29498 | High | 7.5 | 2022-04-21 | Blazer before 2.6.0 allows SQL Injection. In certain circumstances, an attacker could get a user to run a query they would not have normally run. |
CVE-2022-27237 | Medium | 6.1 | 2022-04-21 | There is a cross-site scripting (XSS) vulnerability in an NI Web Server component installed with several NI products. Depending on the product(s) in use, remed… |
CVE-2022-29548 | Medium | 4.6 | 2022-04-21 | A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0… |
CVE-2022-29547 | High | 7.5 | 2022-04-21 | The CreateRedirect extension before 2022-04-14 for MediaWiki does not properly check whether the user has permissions to edit the target page. This could lead… |
CVE-2022-27926 | Medium | 6.1 | 2022-04-21 | A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated… |
CVE-2022-27925 | High | 7.2 | 2022-04-21 | Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with a… |
CVE-2022-27924 | High | 7.5 | 2022-04-21 | Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache… |
CVE-2022-29537 | Medium | 5.5 | 2022-04-20 | gp_rtp_builder_do_hevc in ietf/rtp_pck_mpeg4.c in GPAC 2.0.0 has a heap-based buffer over-read, as demonstrated by MP4Box. |
CVE-2022-29536 | High | 7.5 | 2022-04-20 | In GNOME Epiphany before 41.4 and 42.x before 42.2, an HTML document can trigger a client buffer overflow (in ephy_string_shorten in the UI process) via a long… |
CVE-2022-29534 | High | 7.5 | 2022-04-20 | An issue was discovered in MISP before 2.4.158. In UsersController.php, password confirmation can be bypassed via vectors involving an "Accept: application/jso… |