2022 CVEs (page 222)
Page 222 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-24870 | High | 8.7 | 2022-04-21 | Combodo iTop is a web based IT Service Management tool. In 3.0.0 beta releases prior to 3.0.0 beta3 a malicious script can be injected in tooltips using iTop c… |
CVE-2022-24869 | Medium | 4.6 | 2022-04-21 | GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior t… |
CVE-2022-24868 | High | 7.3 | 2022-04-21 | GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior t… |
CVE-2022-24867 | High | 7.5 | 2022-04-21 | GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. When you pass the c… |
CVE-2022-22436 | Medium | 5.4 | 2022-04-21 | IBM Maximo Asset Management 7.6.1.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thu… |
CVE-2022-22435 | Medium | 5.4 | 2022-04-21 | IBM Maximo Asset Management 7.6.1.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thu… |
CVE-2022-0272 | Critical | 9.8 | 2022-04-21 | Improper Restriction of XML External Entity Reference in GitHub repository detekt/detekt prior to 1.20.0. |
CVE-2022-1022 | Medium | 5.4 | 2022-04-21 | Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.5.0. |
CVE-2022-24272 | Medium | 6.5 | 2022-04-21 | An authenticated user may trigger an invariant assertion during command dispatch due to incorrect validation on the $external database. This may result in mong… |
CVE-2022-1420 | Medium | 5.5 | 2022-04-21 | Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4774. |
CVE-2022-29498 | High | 7.5 | 2022-04-21 | Blazer before 2.6.0 allows SQL Injection. In certain circumstances, an attacker could get a user to run a query they would not have normally run. |
CVE-2022-27237 | Medium | 6.1 | 2022-04-21 | There is a cross-site scripting (XSS) vulnerability in an NI Web Server component installed with several NI products. Depending on the product(s) in use, remed… |
CVE-2022-29548 | Medium | 4.6 | 2022-04-21 | A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0… |
CVE-2022-29547 | High | 7.5 | 2022-04-21 | The CreateRedirect extension before 2022-04-14 for MediaWiki does not properly check whether the user has permissions to edit the target page. This could lead… |
CVE-2022-27926 | Medium | 6.1 | 2022-04-21 | A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated… |
CVE-2022-27925 | High | 7.2 | 2022-04-21 | Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with a… |
CVE-2022-27924 | High | 7.5 | 2022-04-21 | Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache… |
CVE-2022-29537 | Medium | 5.5 | 2022-04-20 | gp_rtp_builder_do_hevc in ietf/rtp_pck_mpeg4.c in GPAC 2.0.0 has a heap-based buffer over-read, as demonstrated by MP4Box. |
CVE-2022-29536 | High | 7.5 | 2022-04-20 | In GNOME Epiphany before 41.4 and 42.x before 42.2, an HTML document can trigger a client buffer overflow (in ephy_string_shorten in the UI process) via a long… |
CVE-2022-29534 | High | 7.5 | 2022-04-20 | An issue was discovered in MISP before 2.4.158. In UsersController.php, password confirmation can be bypassed via vectors involving an "Accept: application/jso… |
CVE-2022-29533 | Medium | 6.1 | 2022-04-20 | An issue was discovered in MISP before 2.4.158. There is XSS in app/Controller/OrganisationsController.php in a situation with a "weird single checkbox page." |
CVE-2022-29532 | Medium | 4.8 | 2022-04-20 | An issue was discovered in MISP before 2.4.158. There is XSS in the cerebrate view if one administrator puts a javascript: URL in the URL field, and another ad… |
CVE-2022-29531 | Medium | 5.4 | 2022-04-20 | An issue was discovered in MISP before 2.4.158. There is stored XSS in the event graph via a tag name. |
CVE-2022-29530 | Medium | 5.4 | 2022-04-20 | An issue was discovered in MISP before 2.4.158. There is stored XSS in the galaxy clusters. |
CVE-2022-29529 | Medium | 5.4 | 2022-04-20 | An issue was discovered in MISP before 2.4.158. There is stored XSS via the LinOTP login field. |
CVE-2022-29528 | Critical | 9.8 | 2022-04-20 | An issue was discovered in MISP before 2.4.158. PHAR deserialization can occur. |
CVE-2022-24872 | High | 8.1 | 2022-04-20 | Shopware is an open commerce platform based on Symfony Framework and Vue. Permissions set to sales channel context by admin-api are still usable within normal… |
CVE-2022-24865 | Medium | 6.5 | 2022-04-20 | HumHub is an Open Source Enterprise Social Network. In affected versions users who are forced to change their password by an administrator may retrieve other u… |
CVE-2022-26133 | Critical | 9.8 | 2022-04-20 | SharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14, 7.7.0 and later prior to 7.17.6, 7.18.0 and later… |
CVE-2022-24871 | High | 7.2 | 2022-04-20 | Shopware is an open commerce platform based on Symfony Framework and Vue. In affected versions an attacker can abuse the Admin SDK functionality on the server… |
CVE-2022-24864 | Medium | 4.1 | 2022-04-20 | Origin Protocol is a blockchain based project. The Origin Protocol project website allows for malicious users to inject malicious Javascript via a POST request… |
CVE-2022-24862 | High | 7.7 | 2022-04-20 | Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has Server-Side Request Forgery vulnerability. During the d… |
CVE-2022-24861 | Critical | 9.9 | 2022-04-20 | Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has remote code execution vulnerability. JDBC drivers are n… |
CVE-2022-0540 | Critical | 9.8 | 2022-04-20 | A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atl… |
CVE-2022-24799 | Critical | 9.6 | 2022-04-20 | wire-webapp is the web application interface for the wire messaging service. Insufficient escaping in markdown “code highlighting” in the wire-webapp resulted… |
CVE-2022-27179 | Medium | 4.6 | 2022-04-20 | A malicious actor having access to the exported configuration file may obtain the stored credentials and thereby gain access to the protected resource. If the… |
CVE-2022-26519 | Medium | 5.5 | 2022-04-20 | There is no limit to the number of attempts to authenticate for the local configuration pages for the Hills ComNav Version 3002-19 interface, which allows loca… |
CVE-2022-26516 | High | 8.4 | 2022-04-20 | Authorized users may install a maliciously modified package file when updating the device via the web user interface. The user may inadvertently use a package… |
CVE-2022-1318 | Medium | 6.2 | 2022-04-20 | Hills ComNav version 3002-19 suffers from a weak communication channel. Traffic across the local network for the configuration pages can be viewed by a malicio… |
CVE-2022-1039 | Critical | 9.6 | 2022-04-20 | The weak password on the web user interface can be exploited via HTTP or HTTPS. Once such access has been obtained, the other passwords can be changed. The wea… |
CVE-2022-0567 | Critical | 9.1 | 2022-04-20 | A flaw was found in ovn-kubernetes. This flaw allows a system administrator or privileged attacker to create an egress network policy that bypasses existing in… |
CVE-2022-25344 | Medium | 6.1 | 2022-04-20 | An XSS issue was discovered on Olivetti d-COLOR MF3555 2XD_S000.002.271 devices. The Web Application doesn't properly check parameters, sent in a /dvcset/sysse… |
CVE-2022-25343 | High | 7.5 | 2022-04-20 | An issue was discovered on Olivetti d-COLOR MF3555 2XD_S000.002.271 devices. The Web Application is affected by Denial of Service. An unauthenticated attacker… |
CVE-2022-25342 | High | 8.1 | 2022-04-20 | An issue was discovered on Olivetti d-COLOR MF3555 2XD_S000.002.271 devices. The Web Application is affected by Broken Access Control. It does not properly val… |
CVE-2022-1254 | Medium | 6.1 | 2022-04-20 | A URL redirection vulnerability in Skyhigh SWG in main releases 10.x prior to 10.2.9, 9.x prior to 9.2.20, 8.x prior to 8.2.27, and 7.x prior to 7.8.2.31, and… |
CVE-2022-29527 | High | 7.0 | 2022-04-20 | Amazon AWS amazon-ssm-agent before 3.1.1208.0 creates a world-writable sudoers file, which allows local attackers to inject Sudo rules and escalate privileges… |
CVE-2022-28327 | High | 7.5 | 2022-04-20 | The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input. |
CVE-2022-27536 | High | 7.5 | 2022-04-20 | Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificates. This allows a… |
CVE-2022-24675 | High | 7.5 | 2022-04-20 | encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data. |
CVE-2022-29266 | High | 7.5 | 2022-04-20 | In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the error message returned from the dependenc… |
CVE-2022-27629 | High | 8.8 | 2022-04-20 | Cross-site request forgery (CSRF) vulnerability in 'MicroPayments - Paid Author Subscriptions, Content, Downloads, Membership' versions prior to 1.9.6 allows a… |
CVE-2022-24860 | High | 7.4 | 2022-04-20 | Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has Use of Hard-coded Cryptographic Key vulnerability. An a… |
CVE-2022-24826 | Critical | 9.8 | 2022-04-20 | On Windows, if Git LFS operates on a malicious repository with a `..exe` file as well as a file named `git.exe`, and `git.exe` is not found in `PATH`, the `..e… |
CVE-2022-24858 | Medium | 6.1 | 2022-04-19 | next-auth v3 users before version 3.29.2 are impacted. next-auth version 4 users before version 4.3.2 are also impacted. Upgrading to 3.29.2 or 4.3.2 will patc… |
CVE-2022-0071 | High | 8.8 | 2022-04-19 | Incomplete fix for CVE-2021-3101. Hotdog, prior to v1.0.2, did not mimic the resource limits, device restrictions, or syscall filters of the target JVM process… |
CVE-2022-0070 | High | 8.8 | 2022-04-19 | Incomplete fix for CVE-2021-3100. The Apache Log4j hotpatch package starting with log4j-cve-2021-44228-hotpatch-1.1-16 will now explicitly mimic the Linux capa… |
CVE-2022-28222 | Medium | 6.1 | 2022-04-19 | The CleanTalk AntiSpam plugin <= 5.173 for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) via the $_REQUEST['page'] parameter in`/lib/Cleantal… |
CVE-2022-28221 | Medium | 6.1 | 2022-04-19 | The CleanTalk AntiSpam plugin <= 5.173 for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) via the $_REQUEST['page'] parameter in`/lib/Cleantal… |
CVE-2022-27863 | Medium | 5.3 | 2022-04-19 | Sensitive Information Exposure in E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 on WordPress allows attackers to get the booking data by gue… |
CVE-2022-27862 | Critical | 9.8 | 2022-04-19 | Arbitrary File Upload leading to RCE in E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 on WordPress allows attackers to upload and execute da… |
CVE-2022-27527 | High | 7.8 | 2022-04-19 | A Memory Corruption vulnerability may lead to code execution through maliciously crafted DLL files. It was fixed in PDFTron earlier than 9.0.7 version in Autod… |
CVE-2022-25788 | High | 7.8 | 2022-04-19 | A maliciously crafted JT file in Autodesk AutoCAD 2022 may be used to write beyond the allocated buffer while parsing JT files. This vulnerability can be explo… |
CVE-2022-21498 | Medium | 6.5 | 2022-04-19 | Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 19c and 21c. Easily exploitable vulnerabil… |
CVE-2022-21497 | High | 8.1 | 2022-04-19 | Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). Supported versions that are affected a… |
CVE-2022-21496 | Medium | 5.3 | 2022-04-19 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JNDI). Supported versions that are affected are Or… |
CVE-2022-21494 | Medium | 4.0 | 2022-04-19 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11. Difficult to exploit vulnerabi… |
CVE-2022-21493 | Medium | 5.9 | 2022-04-19 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11. Easily exploitable vulnerabili… |
CVE-2022-21492 | Medium | 6.1 | 2022-04-19 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Server). The supported version t… |
CVE-2022-21491 | High | 7.8 | 2022-04-19 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.34. Easily… |
CVE-2022-21490 | Medium | 6.3 | 2022-04-19 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.35 and prior, 7.5.25 and… |
CVE-2022-21489 | Medium | 6.3 | 2022-04-19 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.35 and prior, 7.5.25 and… |
CVE-2022-21488 | Low | 3.8 | 2022-04-19 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.34. Easily… |
CVE-2022-21487 | Low | 3.8 | 2022-04-19 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.34. Easily… |
CVE-2022-21486 | Low | 2.9 | 2022-04-19 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.35 and prior, 7.5.25 and… |
CVE-2022-21485 | Low | 2.9 | 2022-04-19 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.35 and prior, 7.5.25 and… |
CVE-2022-21484 | Low | 2.9 | 2022-04-19 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.35 and prior, 7.5.25 and… |
CVE-2022-21483 | Medium | 6.3 | 2022-04-19 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.35 and prior, 7.5.25 and… |
CVE-2022-21482 | Medium | 6.3 | 2022-04-19 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 8.0.28 and prior. Difficult… |
CVE-2022-21481 | Medium | 5.4 | 2022-04-19 | Vulnerability in the PeopleSoft Enterprise FIN Cash Management product of Oracle PeopleSoft (component: Financial Gateway). The supported version that is affec… |
CVE-2022-21480 | Medium | 6.1 | 2022-04-19 | Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: User Interface). Supported versions that are affected are 6.4… |
CVE-2022-21479 | Medium | 5.5 | 2022-04-19 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.28 and prior. Easily exp… |
CVE-2022-21478 | Medium | 5.5 | 2022-04-19 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.28 and prior. Easily exp… |
CVE-2022-21477 | Medium | 5.4 | 2022-04-19 | Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Attachments, File Upload). Supported versions that are affect… |
CVE-2022-21476 | High | 7.5 | 2022-04-19 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected a… |
CVE-2022-21475 | Medium | 5.9 | 2022-04-19 | Vulnerability in the Oracle Banking Payments product of Oracle Financial Services Applications (component: Infrastructure). The supported version that is affec… |
CVE-2022-21474 | Medium | 5.9 | 2022-04-19 | Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). The supported version that is… |
CVE-2022-21473 | Medium | 5.9 | 2022-04-19 | Vulnerability in the Oracle Banking Treasury Management product of Oracle Financial Services Applications (component: Infrastructure). The supported version th… |
CVE-2022-21472 | Medium | 5.9 | 2022-04-19 | Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure). Supported versions that a… |
CVE-2022-21471 | Medium | 6.5 | 2022-04-19 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.34. Easily… |
CVE-2022-21470 | Medium | 6.1 | 2022-04-19 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Process Scheduler). Supported versions that are affected are 8… |
CVE-2022-21469 | Medium | 4.7 | 2022-04-19 | Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: UI Framework). Supported versions that are affected are… |
CVE-2022-21468 | Medium | 6.1 | 2022-04-19 | Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Popups). Supported versions that are affected are 12.2.4-12.2… |
CVE-2022-21467 | Medium | 6.5 | 2022-04-19 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Attachments). The supported version that is affected is 9.3.6. Easily exploita… |
CVE-2022-21466 | High | 7.5 | 2022-04-19 | Vulnerability in the Oracle Commerce Guided Search product of Oracle Commerce (component: Tools and Frameworks). The supported version that is affected is 11.3… |
CVE-2022-21465 | Medium | 6.7 | 2022-04-19 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.34. Easily… |
CVE-2022-21464 | High | 8.2 | 2022-04-19 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC). The supported version that is affected… |
CVE-2022-21463 | Medium | 5.5 | 2022-04-19 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11. Easily exploitable vulnerabili… |
CVE-2022-21462 | Medium | 4.9 | 2022-04-19 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.28 and prior. Easily exp… |
CVE-2022-21461 | Medium | 5.5 | 2022-04-19 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11. Easily exploitable vulnerabili… |
CVE-2022-21460 | Medium | 4.4 | 2022-04-19 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Logging). Supported versions that are affected are 5.7.37 and prior and 8.0.28 an… |