2022 CVEs (page 221)
Page 221 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-0636 | Medium | 5.0 | 2022-04-22 | A denial of service vulnerability was reported in Lenovo Thin Installer prior to version 1.3.0039 that could trigger a system crash. |
CVE-2022-0354 | High | 7.3 | 2022-04-22 | A vulnerability was reported in Lenovo System Update that could allow a local user with interactive system access the ability to execute code with elevated pri… |
CVE-2022-0192 | High | 7.3 | 2022-04-22 | A DLL search path vulnerability was reported in Lenovo PCManager prior to version 4.0.40.2175 that could allow privilege escalation. |
CVE-2022-27342 | Critical | 9.8 | 2022-04-22 | Link-Admin v0.0.1 was discovered to contain a SQL injection vulnerability via DictRest.ResponseResult(). |
CVE-2022-27341 | Critical | 9.8 | 2022-04-22 | JFinalCMS v2.0 was discovered to contain a SQL injection vulnerability via the Article Management function. |
CVE-2022-27340 | High | 8.8 | 2022-04-22 | MCMS v5.2.7 contains a Cross-Site Request Forgery (CSRF) via /role/saveOrUpdateRole.do. This vulnerability allows attackers to escalate privileges and modify d… |
CVE-2022-1440 | Critical | 9.8 | 2022-04-22 | Command Injection vulnerability in git-interface@2.1.1 in GitHub repository yarkeev/git-interface prior to 2.1.2. If both are provided by user input, then the… |
CVE-2022-29589 | Medium | 6.1 | 2022-04-22 | Crypt Server before 3.3.0 allows XSS in the index view. This is related to serial, computername, and username. |
CVE-2022-1439 | Medium | 6.1 | 2022-04-22 | Reflected XSS on demo.microweber.org/demo/module/ in GitHub repository microweber/microweber prior to 1.2.15. Execute Arbitrary JavaScript as the attacked user… |
CVE-2022-29583 | High | 7.8 | 2022-04-22 | service_windows.go in the kardianos service package for Go omits quoting that is sometimes needed for execution of a Windows service executable from the intend… |
CVE-2022-29582 | High | 7.0 | 2022-04-22 | In the Linux kernel before 5.17.3, fs/io_uring.c has a use-after-free due to a race condition in io_uring timeouts. This can be triggered by a local user who h… |
CVE-2022-1437 | High | 7.1 | 2022-04-22 | Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the intented buffer. Ty… |
CVE-2022-28074 | Medium | 4.8 | 2022-04-22 | Halo-1.5.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via \admin\index.html#/system/tools. |
CVE-2022-27406 | High | 7.5 | 2022-04-22 | FreeType commit 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 was discovered to contain a segmentation violation via the function FT_Request_Size. |
CVE-2022-27405 | High | 7.5 | 2022-04-22 | FreeType commit 53dfdcd8198d2b3201a23c4bad9190519ba918db was discovered to contain a segmentation violation via the function FNT_Size_Request. |
CVE-2022-27404 | Critical | 9.8 | 2022-04-22 | FreeType commit 1e2eb65048f75c64b68708efed6ce904c31f3b2f was discovered to contain a heap buffer overflow via the function sfnt_init_face. |
CVE-2022-1429 | High | 7.5 | 2022-04-22 | SQL injection in GridHelperService.php in GitHub repository pimcore/pimcore prior to 10.3.6. This vulnerability is capable of steal the data |
CVE-2022-26674 | Critical | 9.8 | 2022-04-22 | ASUS RT-AX88U has a Format String vulnerability, which allows an unauthenticated remote attacker to write to arbitrary memory address and perform remote arbitr… |
CVE-2022-26673 | Medium | 5.4 | 2022-04-22 | ASUS RT-AX88U has insufficient filtering for special characters in the HTTP header parameter. A remote attacker with general user privilege can exploit this vu… |
CVE-2022-26672 | High | 7.3 | 2022-04-22 | ASUS WebStorage has a hardcoded API Token in the APP source code. An unauthenticated remote attacker can use this token to establish connections with the serve… |
CVE-2022-29577 | Medium | 6.1 | 2022-04-21 | OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed… |
CVE-2022-28367 | Medium | 6.1 | 2022-04-21 | OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed… |
CVE-2022-28366 | High | 7.5 | 2022-04-21 | Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption. In par… |
CVE-2022-26856 | High | 8.2 | 2022-04-21 | Dell EMC Repository Manager version 3.4.0 contains a plain-text password storage vulnerability. A local attacker could potentially exploit this vulnerability… |
CVE-2022-24424 | High | 7.5 | 2022-04-21 | Dell EMC AppSync versions from 3.9 to 4.3 contain a path traversal vulnerability in AppSync server. A remote unauthenticated attacker may potentially exploit t… |
CVE-2022-24423 | Medium | 5.3 | 2022-04-21 | Dell iDRAC8 versions prior to 2.83.83.83 contain a denial of service vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerabil… |
CVE-2022-22558 | Medium | 5.7 | 2022-04-21 | Dell PowerEdge Server BIOS and Dell Precision Workstation 7910 and 7920 Rack BIOS contain an Improper SMM communication buffer verification vulnerability. A Lo… |
CVE-2022-28445 | Medium | 6.5 | 2022-04-21 | KiteCMS v1.1.1 was discovered to contain an arbitrary file read vulnerability via the background management module. |
CVE-2022-28444 | High | 7.5 | 2022-04-21 | UCMS v1.6 was discovered to contain an arbitrary file read vulnerability. |
CVE-2022-28443 | Critical | 9.1 | 2022-04-21 | UCMS v1.6 was discovered to contain an arbitrary file deletion vulnerability. |
CVE-2022-28440 | High | 8.8 | 2022-04-21 | An arbitrary file upload vulnerability in UCMS v1.6 allows attackers to execute arbitrary code via a crafted PHP file. |
CVE-2022-28439 | Critical | 9.8 | 2022-04-21 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/uesrs.php&&action=delete&userid=4. |
CVE-2022-28438 | Critical | 9.8 | 2022-04-21 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/uesrs.php&action=type&userrole=User&userid=. |
CVE-2022-28437 | Critical | 9.8 | 2022-04-21 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/uesrs.php&action=type&userrole=Admin&userid=3. |
CVE-2022-28436 | Critical | 9.8 | 2022-04-21 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/uesrs.php&action=display&value=Hide&userid=. |
CVE-2022-28435 | Critical | 9.8 | 2022-04-21 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/siteoptions.php&action=displaygoal&value=1&roleid=1. |
CVE-2022-28434 | Critical | 9.8 | 2022-04-21 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin.php?id=siteoptions&social=edit&sid=2. |
CVE-2022-28433 | Critical | 9.8 | 2022-04-21 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/uesrs.php&action=display&value=Show&userid=. |
CVE-2022-28432 | Critical | 9.8 | 2022-04-21 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin.php?id=siteoptions&social=display&value=0&sid=2. |
CVE-2022-28431 | Critical | 9.8 | 2022-04-21 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/siteoptions.php&social=remove&sid=2. |
CVE-2022-28429 | Critical | 9.8 | 2022-04-21 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/inbox.php&action=delete&msgid=. |
CVE-2022-28427 | Critical | 9.8 | 2022-04-21 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/inbox.php&action=read&msgid=. |
CVE-2022-28426 | Critical | 9.8 | 2022-04-21 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/pagerole.php&action=edit&roleid=. |
CVE-2022-28425 | Critical | 9.8 | 2022-04-21 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/pagerole.php&action=display&value=1&roleid=. |
CVE-2022-28424 | Critical | 9.8 | 2022-04-21 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/posts.php&find=. |
CVE-2022-28423 | Critical | 9.8 | 2022-04-21 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/posts.php&action=delete. |
CVE-2022-28422 | Critical | 9.8 | 2022-04-21 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/posts.php&action=edit. |
CVE-2022-28421 | Critical | 9.8 | 2022-04-21 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin.php?id=posts&action=display&value=1&postid=. |
CVE-2022-28420 | Critical | 9.8 | 2022-04-21 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via BabyCare/admin.php?id=theme&setid=. |
CVE-2022-28417 | Critical | 9.8 | 2022-04-21 | Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via /hocms/classes/Master.php?f=delete_phase. |
CVE-2022-28416 | Critical | 9.8 | 2022-04-21 | Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via /hocms/classes/Master.php?f=delete_phase. |
CVE-2022-28415 | Critical | 9.8 | 2022-04-21 | Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via /hocms/classes/Master.php?f=delete_collection. |
CVE-2022-28414 | Critical | 9.8 | 2022-04-21 | Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via /hocms/classes/Master.php?f=delete_member. |
CVE-2022-28413 | Critical | 9.8 | 2022-04-21 | Car Driving School Management System v1.0 was discovered to contain a SQL injection vulnerability via /cdsms/classes/Master.php?f=delete_enrollment. |
CVE-2022-28412 | Critical | 9.8 | 2022-04-21 | Car Driving School Managment System v1.0 was discovered to contain a SQL injection vulnerability via /cdsms/classes/Master.php?f=delete_package. |
CVE-2022-28411 | Critical | 9.8 | 2022-04-21 | Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via /reps/admin/?page=agents/manage_agent. |
CVE-2022-28410 | Critical | 9.8 | 2022-04-21 | Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via /reps/classes/Users.php?f=delete_agent. |
CVE-2022-28030 | Critical | 9.8 | 2022-04-21 | Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via /reps/classes/Master.php?f=delete_estate. |
CVE-2022-28029 | Critical | 9.8 | 2022-04-21 | Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via /reps/classes/Master.php?f=delete_type. |
CVE-2022-28028 | Critical | 9.8 | 2022-04-21 | Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via /reps/classes/Master.php?f=delete_amenity. |
CVE-2022-28026 | Critical | 9.8 | 2022-04-21 | Student Grading System v1.0 was discovered to contain a SQL injection vulnerability via /student-grading-system/rms.php?page=student_p&id=. |
CVE-2022-28025 | Critical | 9.8 | 2022-04-21 | Student Grading System v1.0 was discovered to contain a SQL injection vulnerability via /student-grading-system/rms.php?page=school_year. |
CVE-2022-28024 | Critical | 9.8 | 2022-04-21 | Student Grading System v1.0 was discovered to contain a SQL injection vulnerability via /student-grading-system/rms.php?page=grade. |
CVE-2022-28023 | Critical | 9.8 | 2022-04-21 | Purchase Order Management System v1.0 was discovered to contain a SQL injection vulnerability via /purchase_order/classes/Master.php?f=delete_supplier. |
CVE-2022-28022 | Critical | 9.8 | 2022-04-21 | Purchase Order Management System v1.0 was discovered to contain a SQL injection vulnerability via /purchase_order/classes/Master.php?f=delete_item. |
CVE-2022-28021 | Critical | 9.8 | 2022-04-21 | Purchase Order Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via /purchase_order/admin/?page=user. |
CVE-2022-28020 | High | 8.8 | 2022-04-21 | Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\position_edit.php. |
CVE-2022-28019 | High | 8.8 | 2022-04-21 | Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\employee_edit.php. |
CVE-2022-28018 | High | 8.8 | 2022-04-21 | Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\schedule_edit.php. |
CVE-2022-28017 | High | 8.8 | 2022-04-21 | Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\overtime_edit.php. |
CVE-2022-28016 | High | 8.8 | 2022-04-21 | Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\deduction_edit.php. |
CVE-2022-28015 | High | 8.8 | 2022-04-21 | Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\cashadvance_edit.php. |
CVE-2022-28014 | High | 8.8 | 2022-04-21 | Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\attendance_edit.php. |
CVE-2022-28013 | High | 8.8 | 2022-04-21 | Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\schedule_employee_edit.php. |
CVE-2022-28012 | High | 8.8 | 2022-04-21 | Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\position_delete.php. |
CVE-2022-28011 | High | 8.8 | 2022-04-21 | Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\schedule_delete.php. |
CVE-2022-28010 | High | 8.8 | 2022-04-21 | Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\overtime_delete.php. |
CVE-2022-28009 | High | 8.8 | 2022-04-21 | Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\attendance_delete.php. |
CVE-2022-28008 | High | 8.8 | 2022-04-21 | Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\attendance_delete.php. |
CVE-2022-28007 | High | 8.8 | 2022-04-21 | Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\cashadvance_delete.php. |
CVE-2022-28006 | High | 8.8 | 2022-04-21 | Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\employee_delete.php. |
CVE-2022-27478 | High | 8.8 | 2022-04-21 | Victor v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component admin/profile.php?section=admin. |
CVE-2022-29566 | High | 8.1 | 2022-04-21 | The Bulletproofs 2017/1066 paper mishandles Fiat-Shamir generation because the hash computation fails to include all of the public values from the Zero Knowled… |
CVE-2022-28820 | Medium | 6.1 | 2022-04-21 | ACS Commons version 5.1.x (and earlier) suffers from a Reflected Cross-site Scripting (XSS) vulnerability in /apps/acs-commons/content/page-compare.html endpoi… |
CVE-2022-28743 | Critical | 9.1 | 2022-04-21 | Time-of-check Time-of-use (TOCTOU) Race Condition vulerability in Foscam R2C IP camera running System FW <= 1.13.1.6, and Application FW <= 2.91.2.66, allows a… |
CVE-2022-23711 | Medium | 5.3 | 2022-04-21 | A vulnerability in Kibana could expose sensitive information related to Elastic Stack monitoring in the Kibana page source. Elastic Stack monitoring features p… |
CVE-2022-22969 | Medium | 6.5 | 2022-04-21 | <Issue Description> Spring Security OAuth versions 2.5.x prior to 2.5.2 and older unsupported versions are susceptible to a Denial-of-Service (DoS) attack via… |
CVE-2022-20805 | Medium | 4.1 | 2022-04-21 | A vulnerability in the automatic decryption process in Cisco Umbrella Secure Web Gateway (SWG) could allow an authenticated, adjacent attacker to bypass the SS… |
CVE-2022-20804 | Medium | 5.3 | 2022-04-21 | A vulnerability in the Cisco Discovery Protocol of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Managemen… |
CVE-2022-20795 | Medium | 5.8 | 2022-04-21 | A vulnerability in the implementation of the Datagram TLS (DTLS) protocol in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defens… |
CVE-2022-20790 | Medium | 6.5 | 2022-04-21 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Man… |
CVE-2022-20789 | Medium | 4.9 | 2022-04-21 | A vulnerability in the software upgrade process of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Managemen… |
CVE-2022-20788 | Medium | 6.1 | 2022-04-21 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified CM Session Management Edition (Unifie… |
CVE-2022-20787 | Medium | 5.7 | 2022-04-21 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) Software and Cisco Unified CM Session Management Edi… |
CVE-2022-20786 | Medium | 5.4 | 2022-04-21 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an au… |
CVE-2022-20783 | High | 7.5 | 2022-04-21 | A vulnerability in the packet processing functionality of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an unau… |
CVE-2022-20778 | Medium | 6.1 | 2022-04-21 | A vulnerability in the authentication component of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS)… |
CVE-2022-20773 | High | 7.5 | 2022-04-21 | A vulnerability in the key-based SSH authentication mechanism of Cisco Umbrella Virtual Appliance (VA) could allow an unauthenticated, remote attacker to imper… |
CVE-2022-20732 | High | 7.8 | 2022-04-21 | A vulnerability in the configuration file protections of Cisco Virtualized Infrastructure Manager (VIM) could allow an authenticated, local attacker to access… |
CVE-2022-24875 | Medium | 5.3 | 2022-04-21 | The CVEProject/cve-services is an open source project used to operate the CVE services api. In versions up to and including 1.1.1 the `org.conroller.js` code w… |