2022 CVEs (page 225)
Page 225 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-24494 | High | 7.8 | 2022-04-15 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability |
CVE-2022-24493 | Medium | 5.5 | 2022-04-15 | Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability |
CVE-2022-24492 | High | 8.8 | 2022-04-15 | Remote Procedure Call Runtime Remote Code Execution Vulnerability |
CVE-2022-24491 | Critical | 9.8 | 2022-04-15 | Windows Network File System Remote Code Execution Vulnerability |
CVE-2022-24490 | High | 8.1 | 2022-04-15 | Windows Hyper-V Shared Virtual Hard Disks Information Disclosure Vulnerability |
CVE-2022-24489 | High | 7.8 | 2022-04-15 | Cluster Client Failover (CCF) Elevation of Privilege Vulnerability |
CVE-2022-24488 | High | 7.8 | 2022-04-15 | Windows Desktop Bridge Elevation of Privilege Vulnerability |
CVE-2022-24487 | High | 8.8 | 2022-04-15 | Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability |
CVE-2022-24486 | High | 7.8 | 2022-04-15 | Windows Kerberos Elevation of Privilege Vulnerability |
CVE-2022-24485 | High | 7.5 | 2022-04-15 | Win32 File Enumeration Remote Code Execution Vulnerability |
CVE-2022-24484 | Medium | 5.5 | 2022-04-15 | Windows Cluster Shared Volume (CSV) Denial of Service Vulnerability |
CVE-2022-24483 | Medium | 5.5 | 2022-04-15 | Windows Kernel Information Disclosure Vulnerability |
CVE-2022-24482 | High | 7.0 | 2022-04-15 | Windows ALPC Elevation of Privilege Vulnerability |
CVE-2022-24481 | High | 7.8 | 2022-04-15 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
CVE-2022-24479 | High | 7.8 | 2022-04-15 | Connected User Experiences and Telemetry Elevation of Privilege Vulnerability |
CVE-2022-24474 | High | 7.8 | 2022-04-15 | Windows Win32k Elevation of Privilege Vulnerability |
CVE-2022-24473 | High | 7.8 | 2022-04-15 | Microsoft Excel Remote Code Execution Vulnerability |
CVE-2022-24472 | High | 8.0 | 2022-04-15 | Microsoft SharePoint Server Spoofing Vulnerability |
CVE-2022-23292 | Low | 3.7 | 2022-04-15 | Microsoft Power BI Spoofing Vulnerability |
CVE-2022-23268 | Medium | 6.5 | 2022-04-15 | Windows Hyper-V Denial of Service Vulnerability |
CVE-2022-23259 | High | 8.8 | 2022-04-15 | Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability |
CVE-2022-23257 | High | 8.8 | 2022-04-15 | Windows Hyper-V Remote Code Execution Vulnerability |
CVE-2022-22009 | High | 7.8 | 2022-04-15 | Windows Hyper-V Remote Code Execution Vulnerability |
CVE-2022-22008 | High | 7.8 | 2022-04-15 | Windows Hyper-V Remote Code Execution Vulnerability |
CVE-2022-21983 | High | 7.5 | 2022-04-15 | Win32 Stream Enumeration Remote Code Execution Vulnerability |
CVE-2022-27369 | High | 7.2 | 2022-04-15 | Cscms Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the component news_News.php_hy. |
CVE-2022-27368 | High | 7.2 | 2022-04-15 | Cscms Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the component dance_Lists.php_zhuan. |
CVE-2022-27367 | High | 7.2 | 2022-04-15 | Cscms Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the component dance_Topic.php_del. |
CVE-2022-27366 | High | 7.2 | 2022-04-15 | Cscms Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the component dance_Dance.php_hy. |
CVE-2022-27365 | High | 7.2 | 2022-04-15 | Cscms Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the component dance_Dance.php_del. |
CVE-2022-27257 | High | 7.5 | 2022-04-15 | A PHP Local File Inclusion vulneraility in the default Redbasic theme for Hubzilla before version 7.2 allows remote attackers to include arbitrary php files vi… |
CVE-2022-27158 | Critical | 9.8 | 2022-04-15 | pearweb < 1.32 suffers from Deserialization of Untrusted Data. |
CVE-2022-27157 | Critical | 9.8 | 2022-04-15 | pearweb < 1.32 is suffers from a Weak Password Recovery Mechanism via include/users/passwordmanage.php. |
CVE-2022-27852 | Medium | 6.1 | 2022-04-15 | Multiple Unauthenticated Stored Cross-Site Scripting (XSS) vulnerabilities in KB Support (WordPress plugin) <= 1.5.5 versions. |
CVE-2022-27851 | Medium | 5.4 | 2022-04-15 | Cross-Site Request Forgery (CSRF) in Use Any Font (WordPress plugin) <= 6.1.7 allows an attacker to deactivate the API key. |
CVE-2022-27850 | Medium | 5.4 | 2022-04-15 | Cross-Site Request Forgery (CSRF) in Simple Ajax Chat (WordPress plugin) <= 20220115 allows an attacker to clear the chat log or delete a chat message. |
CVE-2022-27849 | Medium | 5.3 | 2022-04-15 | Sensitive Information Disclosure (sac-export.csv) in Simple Ajax Chat (WordPress plugin) <= 20220115 |
CVE-2022-28109 | High | 8.8 | 2022-04-15 | Selenium Selenium Grid (formerly Selenium Standalone Server) Fixed in 4.0.0-alpha-7 is affected by: DNS rebinding. The impact is: execute arbitrary code (remot… |
CVE-2022-27258 | Medium | 6.1 | 2022-04-15 | Multiple Cross-Site Scripting (XSS) vulnerabilities in Hubzilla 7.0.3 and earlier allows remote attacker to include arbitrary web script or HTML via the rpath… |
CVE-2022-26594 | Medium | 6.1 | 2022-04-15 | Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.5 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allow remote attackers to… |
CVE-2022-23865 | Critical | 9.8 | 2022-04-15 | Nyron 1.0 is affected by a SQL injection vulnerability through Nyron/Library/Catalog/winlibsrch.aspx. To exploit this vulnerability, an attacker must inject '"… |
CVE-2022-21159 | High | 7.5 | 2022-04-15 | A denial of service vulnerability exists in the parseNormalModeParameters functionality of MZ Automation GmbH libiec61850 1.5.0. A specially-crafted series of… |
CVE-2022-27043 | High | 7.5 | 2022-04-15 | Yearning versions 2.3.1 and 2.3.2 Interstellar GA and 2.3.4 - 2.3.6 Neptune is vulnerable to Directory Traversal. |
CVE-2022-20761 | High | 7.4 | 2022-04-15 | A vulnerability in the integrated wireless access point (AP) packet processing of the Cisco 1000 Series Connected Grid Router (CGR1K) could allow an unauthenti… |
CVE-2022-20758 | Medium | 6.8 | 2022-04-15 | A vulnerability in the implementation of the Border Gateway Protocol (BGP) Ethernet VPN (EVPN) functionality in Cisco IOS XR Software could allow an unauthenti… |
CVE-2022-20747 | Medium | 6.5 | 2022-04-15 | A vulnerability in the History API of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain access to sensitive information on an… |
CVE-2022-20739 | High | 7.3 | 2022-04-15 | A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operat… |
CVE-2022-20735 | Medium | 6.5 | 2022-04-15 | A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to conduct a cross-site… |
CVE-2022-20731 | Medium | 4.6 | 2022-04-15 | Multiple vulnerabilities that affect Cisco Catalyst Digital Building Series Switches and Cisco Catalyst Micro Switches could allow an attacker to execute persi… |
CVE-2022-20727 | Medium | 5.5 | 2022-04-15 | Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into… |
CVE-2022-20726 | Medium | 5.5 | 2022-04-15 | Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into… |
CVE-2022-20725 | Medium | 5.5 | 2022-04-15 | Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into… |
CVE-2022-20724 | Medium | 5.5 | 2022-04-15 | Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into… |
CVE-2022-20723 | Medium | 5.5 | 2022-04-15 | Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into… |
CVE-2022-20722 | Medium | 5.5 | 2022-04-15 | Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into… |
CVE-2022-20721 | Medium | 5.5 | 2022-04-15 | Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into… |
CVE-2022-20720 | Medium | 5.5 | 2022-04-15 | Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into… |
CVE-2022-20719 | Medium | 5.5 | 2022-04-15 | Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into… |
CVE-2022-20718 | Medium | 5.5 | 2022-04-15 | Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into… |
CVE-2022-20717 | Medium | 5.5 | 2022-04-15 | A vulnerability in the NETCONF process of Cisco SD-WAN vEdge Routers could allow an authenticated, local attacker to cause an affected device to run out of mem… |
CVE-2022-20716 | High | 7.8 | 2022-04-15 | A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain escalated privileges. This vulnerability is due to imp… |
CVE-2022-20714 | High | 8.6 | 2022-04-15 | A vulnerability in the data plane microcode of Lightspeed-Plus line cards for Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated… |
CVE-2022-20697 | High | 8.6 | 2022-04-15 | A vulnerability in the web services interface of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a denial o… |
CVE-2022-20695 | Critical | 10.0 | 2022-04-15 | A vulnerability in the authentication functionality of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to bypass a… |
CVE-2022-20694 | Medium | 6.8 | 2022-04-15 | A vulnerability in the implementation of the Resource Public Key Infrastructure (RPKI) feature of Cisco IOS XE Software could allow an unauthenticated, remote… |
CVE-2022-20693 | Medium | 4.7 | 2022-04-15 | A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to perform an injection attack against an affected… |
CVE-2022-20692 | High | 7.7 | 2022-04-15 | A vulnerability in the NETCONF over SSH feature of Cisco IOS XE Software could allow a low-privileged, authenticated, remote attacker to cause a denial of serv… |
CVE-2022-20684 | High | 7.4 | 2022-04-15 | A vulnerability in Simple Network Management Protocol (SNMP) trap generation for wireless clients of Cisco IOS XE Wireless Controller Software for the Catalyst… |
CVE-2022-20683 | High | 8.6 | 2022-04-15 | A vulnerability in the Application Visibility and Control (AVC-FNF) feature of Cisco IOS XE Software for Cisco Catalyst 9800 Series Wireless Controllers could… |
CVE-2022-20682 | High | 8.6 | 2022-04-15 | A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Wireless Controller Software for the Cat… |
CVE-2022-20681 | High | 7.8 | 2022-04-15 | A vulnerability in the CLI of Cisco IOS XE Software for Cisco Catalyst 9000 Family Switches and Cisco Catalyst 9000 Family Wireless Controllers could allow an… |
CVE-2022-20679 | Medium | 6.8 | 2022-04-15 | A vulnerability in the IPSec decryption routine of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload… |
CVE-2022-20678 | High | 8.6 | 2022-04-15 | A vulnerability in the AppNav-XE feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, result… |
CVE-2022-20677 | Medium | 5.5 | 2022-04-15 | Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into… |
CVE-2022-20676 | Medium | 5.1 | 2022-04-15 | A vulnerability in the Tool Command Language (Tcl) interpreter of Cisco IOS XE Software could allow an authenticated, local attacker to escalate from privilege… |
CVE-2022-20661 | Medium | 4.6 | 2022-04-15 | Multiple vulnerabilities that affect Cisco Catalyst Digital Building Series Switches and Cisco Catalyst Micro Switches could allow an attacker to execute persi… |
CVE-2022-20622 | High | 8.6 | 2022-04-15 | A vulnerability in IP ingress packet processing of the Cisco Embedded Wireless Controller with Catalyst Access Points Software could allow an unauthenticated… |
CVE-2022-1231 | Medium | 6.1 | 2022-04-15 | XSS via Embedded SVG in SVG Diagram Format in GitHub repository plantuml/plantuml prior to 1.2022.4. Stored XSS in the context of the diagram embedder. Dependi… |
CVE-2022-28049 | Medium | 5.5 | 2022-04-15 | NGINX NJS 0.7.2 was discovered to contain a NULL pointer dereference via the component njs_vmcode_array at /src/njs_vmcode.c. |
CVE-2022-28048 | High | 8.8 | 2022-04-15 | STB v2.27 was discovered to contain an integer shift of invalid size in the component stbi__jpeg_decode_block_prog_ac. |
CVE-2022-28044 | Critical | 9.8 | 2022-04-15 | Irzip v0.640 was discovered to contain a heap memory corruption via the component lrzip.c:initialise_control. |
CVE-2022-28042 | High | 8.8 | 2022-04-15 | stb_image.h v2.27 was discovered to contain an heap-based use-after-free via the function stbi__jpeg_huff_decode. |
CVE-2022-28041 | Medium | 6.5 | 2022-04-15 | stb_image.h v2.27 was discovered to contain an integer overflow via the function stbi__jpeg_decode_block_prog_dc. This vulnerability allows attackers to cause… |
CVE-2022-27474 | High | 7.2 | 2022-04-15 | SuiteCRM v7.11.23 was discovered to allow remote code execution via a crafted payload injected into the FirstName text field. |
CVE-2022-28870 | Medium | 4.3 | 2022-04-15 | A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website could make a phishing attack with address bar spoofing as the add… |
CVE-2022-28869 | Medium | 4.3 | 2022-04-15 | A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website could make a phishing attack with address bar spoofing as the bro… |
CVE-2022-28868 | Medium | 4.3 | 2022-04-15 | An Address bar spoofing vulnerability was discovered in Safe Browser for Android. When user clicks on a specially crafted malicious webpage/URL, user may be tr… |
CVE-2022-28345 | High | 7.5 | 2022-04-15 | The Signal app before 5.34 for iOS allows URI spoofing via RTLO injection. It incorrectly renders RTLO encoded URLs beginning with a non-breaking space, when t… |
CVE-2022-26651 | Critical | 9.8 | 2022-04-15 | An issue was discovered in Asterisk through 19.x and Certified Asterisk through 16.8-cert13. The func_odbc module provides possibly inadequate escaping functio… |
CVE-2022-26499 | Critical | 9.1 | 2022-04-15 | An SSRF issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it's possible to send arbitrary requests (such as GET) to interfaces such as loc… |
CVE-2022-26498 | High | 7.5 | 2022-04-15 | An issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it is possible to download files that are not certificates. These files could be much… |
CVE-2022-27188 | High | 7.8 | 2022-04-15 | OS command injection vulnerability exists in CENTUM VP R4.01.00 to R4.03.00, CENTUM VP Small R4.01.00 to R4.03.00, CENTUM VP Basic R4.01.00 to R4.03.00, and B/… |
CVE-2022-26034 | Critical | 9.1 | 2022-04-15 | Improper authentication vulnerability in the communication protocol provided by AD (Automation Design) server of CENTUM VP R6.01.10 to R6.09.00, CENTUM VP Smal… |
CVE-2022-24855 | High | 8.7 | 2022-04-14 | Metabase is an open source business intelligence and analytics application. In affected versions Metabase ships with an internal development endpoint `/_intern… |
CVE-2022-24854 | High | 8.0 | 2022-04-14 | Metabase is an open source business intelligence and analytics application. SQLite has an FDW-like feature called `ATTACH DATABASE`, which allows connecting mu… |
CVE-2022-24853 | Medium | 5.9 | 2022-04-14 | Metabase is an open source business intelligence and analytics application. Metabase has a proxy to load arbitrary URLs for JSON maps as part of our GeoJSON su… |
CVE-2022-24850 | Medium | 5.3 | 2022-04-14 | Discourse is an open source platform for community discussion. A category's group permissions settings can be viewed by anyone that has access to the category… |
CVE-2022-24849 | Medium | 6.5 | 2022-04-14 | DisCatSharp is a Discord API wrapper for .NET. Users of versions 9.8.5, 9.8.6, 9.9.0 and previously published prereleases of 10.0.0 who have used either one of… |
CVE-2022-24846 | Critical | 9.1 | 2022-04-14 | GeoWebCache is a tile caching server implemented in Java. The GeoWebCache disk quota mechanism can perform an unchecked JNDI lookup, which in turn can be used… |
CVE-2022-24824 | Medium | 5.3 | 2022-04-14 | Discourse is an open source platform for community discussion. In affected versions an attacker can poison the cache for anonymous (i.e. not logged in) users… |