2022 CVEs (page 226)
Page 226 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-28044 | Critical | 9.8 | 2022-04-15 | Irzip v0.640 was discovered to contain a heap memory corruption via the component lrzip.c:initialise_control. |
CVE-2022-28042 | High | 8.8 | 2022-04-15 | stb_image.h v2.27 was discovered to contain an heap-based use-after-free via the function stbi__jpeg_huff_decode. |
CVE-2022-28041 | Medium | 6.5 | 2022-04-15 | stb_image.h v2.27 was discovered to contain an integer overflow via the function stbi__jpeg_decode_block_prog_dc. This vulnerability allows attackers to cause… |
CVE-2022-27474 | High | 7.2 | 2022-04-15 | SuiteCRM v7.11.23 was discovered to allow remote code execution via a crafted payload injected into the FirstName text field. |
CVE-2022-28870 | Medium | 4.3 | 2022-04-15 | A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website could make a phishing attack with address bar spoofing as the add… |
CVE-2022-28869 | Medium | 4.3 | 2022-04-15 | A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website could make a phishing attack with address bar spoofing as the bro… |
CVE-2022-28868 | Medium | 4.3 | 2022-04-15 | An Address bar spoofing vulnerability was discovered in Safe Browser for Android. When user clicks on a specially crafted malicious webpage/URL, user may be tr… |
CVE-2022-28345 | High | 7.5 | 2022-04-15 | The Signal app before 5.34 for iOS allows URI spoofing via RTLO injection. It incorrectly renders RTLO encoded URLs beginning with a non-breaking space, when t… |
CVE-2022-26651 | Critical | 9.8 | 2022-04-15 | An issue was discovered in Asterisk through 19.x and Certified Asterisk through 16.8-cert13. The func_odbc module provides possibly inadequate escaping functio… |
CVE-2022-26499 | Critical | 9.1 | 2022-04-15 | An SSRF issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it's possible to send arbitrary requests (such as GET) to interfaces such as loc… |
CVE-2022-26498 | High | 7.5 | 2022-04-15 | An issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it is possible to download files that are not certificates. These files could be much… |
CVE-2022-27188 | High | 7.8 | 2022-04-15 | OS command injection vulnerability exists in CENTUM VP R4.01.00 to R4.03.00, CENTUM VP Small R4.01.00 to R4.03.00, CENTUM VP Basic R4.01.00 to R4.03.00, and B/… |
CVE-2022-26034 | Critical | 9.1 | 2022-04-15 | Improper authentication vulnerability in the communication protocol provided by AD (Automation Design) server of CENTUM VP R6.01.10 to R6.09.00, CENTUM VP Smal… |
CVE-2022-24855 | High | 8.7 | 2022-04-14 | Metabase is an open source business intelligence and analytics application. In affected versions Metabase ships with an internal development endpoint `/_intern… |
CVE-2022-24854 | High | 8.0 | 2022-04-14 | Metabase is an open source business intelligence and analytics application. SQLite has an FDW-like feature called `ATTACH DATABASE`, which allows connecting mu… |
CVE-2022-24853 | Medium | 5.9 | 2022-04-14 | Metabase is an open source business intelligence and analytics application. Metabase has a proxy to load arbitrary URLs for JSON maps as part of our GeoJSON su… |
CVE-2022-24850 | Medium | 5.3 | 2022-04-14 | Discourse is an open source platform for community discussion. A category's group permissions settings can be viewed by anyone that has access to the category… |
CVE-2022-24849 | Medium | 6.5 | 2022-04-14 | DisCatSharp is a Discord API wrapper for .NET. Users of versions 9.8.5, 9.8.6, 9.9.0 and previously published prereleases of 10.0.0 who have used either one of… |
CVE-2022-24846 | Critical | 9.1 | 2022-04-14 | GeoWebCache is a tile caching server implemented in Java. The GeoWebCache disk quota mechanism can perform an unchecked JNDI lookup, which in turn can be used… |
CVE-2022-24824 | Medium | 5.3 | 2022-04-14 | Discourse is an open source platform for community discussion. In affected versions an attacker can poison the cache for anonymous (i.e. not logged in) users… |
CVE-2022-27848 | Low | 3.4 | 2022-04-14 | Authenticated (admin+ user) Stored Cross-Site Scripting (XSS) in Modern Events Calendar Lite (WordPress plugin) <= 6.5.1 |
CVE-2022-22968 | Medium | 5.3 | 2022-04-14 | In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensiti… |
CVE-2022-22966 | High | 7.2 | 2022-04-14 | An authenticated, high privileged malicious actor with network access to the VMware Cloud Director tenant or provider may be able to exploit a remote code exec… |
CVE-2022-1328 | Medium | 4.3 | 2022-04-14 | Buffer Overflow in uudecoder in Mutt affecting all versions starting from 0.94.13 before 2.2.3 allows read past end of input line |
CVE-2022-1304 | High | 7.8 | 2022-04-14 | An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a s… |
CVE-2022-28711 | Critical | 9.8 | 2022-04-14 | A memory corruption vulnerability exists in the cgi.c unescape functionality of ArduPilot APWeb master branch 50b6b7ac - master branch 46177cb9. A specially-cr… |
CVE-2022-22149 | High | 8.8 | 2022-04-14 | A SQL injection vulnerability exists in the HelpdeskEmailActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. A specially-crafted HTTP request can cau… |
CVE-2022-21234 | High | 8.8 | 2022-04-14 | An SQL injection vulnerability exists in the EchoAssets.aspx functionality of Lansweeper lansweeper 9.1.20.2. A specially-crafted HTTP request can cause SQL in… |
CVE-2022-21210 | High | 8.8 | 2022-04-14 | An SQL injection vulnerability exists in the AssetActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. A specially-crafted HTTP request can cause SQL… |
CVE-2022-21154 | High | 7.8 | 2022-04-14 | An integer overflow vulnerability exists in the fltSaveCMP functionality of Leadtools 22. A specially-crafted BMP file can lead to an integer overflow, that in… |
CVE-2022-21145 | Medium | 4.8 | 2022-04-14 | A stored cross-site scripting vulnerability exists in the WebUserActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. A specially-crafted HTTP request… |
CVE-2022-22391 | Medium | 4.3 | 2022-04-14 | IBM Aspera High-Speed Transfer 4.3.1 and earlier could allow an authenticated user to obtain information from non sensitive operating system files that they sh… |
CVE-2022-27817 | Medium | 4.4 | 2022-04-14 | SWHKD 1.1.5 consumes the keyboard events of unintended users. This could potentially cause an information leak, but is usually a denial of functionality. |
CVE-2022-27814 | Low | 3.3 | 2022-04-14 | SWHKD 1.1.5 allows arbitrary file-existence tests via the -c option. |
CVE-2022-25166 | Medium | 5.0 | 2022-04-14 | An issue was discovered in Amazon AWS VPN Client 2.0.0. It is possible to include a UNC path in the OpenVPN configuration file when referencing file paths for… |
CVE-2022-25165 | High | 7.0 | 2022-04-14 | An issue was discovered in Amazon AWS VPN Client 2.0.0. A TOCTOU race condition exists during the validation of VPN configuration files. This allows parameters… |
CVE-2022-22198 | High | 7.5 | 2022-04-14 | An Access of Uninitialized Pointer vulnerability in the SIP ALG of Juniper Networks Junos OS allows an unauthenticated network-based attacker to cause a Denial… |
CVE-2022-22197 | High | 7.5 | 2022-04-14 | An Operation on a Resource after Expiration or Release vulnerability in the Routing Protocol Daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved all… |
CVE-2022-22196 | Medium | 6.5 | 2022-04-14 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved al… |
CVE-2022-22195 | High | 7.5 | 2022-04-14 | An Improper Update of Reference Count vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to tri… |
CVE-2022-22194 | High | 7.5 | 2022-04-14 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the packetIO daemon of Juniper Networks Junos OS Evolved on PTX10003, PTX10004, and PT… |
CVE-2022-22193 | Medium | 5.5 | 2022-04-14 | An Improper Handling of Unexpected Data Type vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a loca… |
CVE-2022-22191 | Medium | 6.5 | 2022-04-14 | A Denial of Service (DoS) vulnerability in the processing of a flood of specific ARP traffic in Juniper Networks Junos OS on the EX4300 switch, sent from the l… |
CVE-2022-22190 | High | 7.4 | 2022-04-14 | An Improper Access Control vulnerability in the Juniper Networks Paragon Active Assurance Control Center allows an unauthenticated attacker to leverage a craft… |
CVE-2022-22189 | High | 7.3 | 2022-04-14 | An Incorrect Ownership Assignment vulnerability in Juniper Networks Contrail Service Orchestration (CSO) allows a locally authenticated user to have their perm… |
CVE-2022-22188 | High | 7.5 | 2022-04-14 | An Uncontrolled Memory Allocation vulnerability leading to a Heap-based Buffer Overflow in the packet forwarding engine (PFE) of Juniper Networks Junos OS allo… |
CVE-2022-22187 | High | 7.8 | 2022-04-14 | An Improper Privilege Management vulnerability in the Windows Installer framework used in the Juniper Networks Juniper Identity Management Service (JIMS) allow… |
CVE-2022-22186 | High | 7.2 | 2022-04-14 | Due to an Improper Initialization vulnerability in Juniper Networks Junos OS on EX4650 devices, packets received on the management interface (em0) but not dest… |
CVE-2022-22185 | High | 7.5 | 2022-04-14 | A vulnerability in Juniper Networks Junos OS on SRX Series, allows a network-based unauthenticated attacker to cause a Denial of Service (DoS) by sending a spe… |
CVE-2022-22183 | High | 7.5 | 2022-04-14 | An Improper Access Control vulnerability in Juniper Networks Junos OS Evolved allows a network-based unauthenticated attacker who is able to connect to a speci… |
CVE-2022-22182 | High | 8.8 | 2022-04-14 | A Cross-site Scripting (XSS) vulnerability in Juniper Networks Junos OS J-Web allows an attacker to construct a URL that when visited by another user enables t… |
CVE-2022-22181 | High | 8.0 | 2022-04-14 | A reflected Cross-site Scripting (XSS) vulnerability in J-Web of Juniper Networks Junos OS allows a network-based authenticated attacker to run malicious scrip… |
CVE-2022-27008 | High | 7.5 | 2022-04-14 | nginx njs 0.7.2 is vulnerable to Buffer Overflow. Type confused in Array.prototype.concat() when a slow array appended element is fast array. |
CVE-2022-27007 | Critical | 9.8 | 2022-04-14 | nginx njs 0.7.2 is affected suffers from Use-after-free in njs_function_frame_alloc() when it try to invoke from a restored frame saved with njs_function_frame… |
CVE-2022-1258 | High | 8.4 | 2022-04-14 | A blind SQL injection vulnerability in the ePolicy Orchestrator (ePO) extension of MA prior to 5.7.6 can be exploited by an authenticated administrator on ePO… |
CVE-2022-1257 | Medium | 6.1 | 2022-04-14 | Insecure storage of sensitive information vulnerability in MA for Linux, macOS, and Windows prior to 5.7.6 allows a local user to gain access to sensitive info… |
CVE-2022-1256 | High | 7.8 | 2022-04-14 | A local privilege escalation vulnerability in MA for Windows prior to 5.7.6 allows a local low privileged user to gain system privileges through running the re… |
CVE-2022-27457 | High | 7.5 | 2022-04-14 | MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component my_mb_wc_latin1 at /strings/ctype-latin1.c. |
CVE-2022-27456 | High | 7.5 | 2022-04-14 | MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component VDec::VDec at /sql/sql_type.cc. |
CVE-2022-27455 | High | 7.5 | 2022-04-14 | MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component my_wildcmp_8bit_impl at /strings/ctype-simple.c. |
CVE-2022-27452 | High | 7.5 | 2022-04-14 | MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_cmpfunc.cc. |
CVE-2022-27451 | High | 7.5 | 2022-04-14 | MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/field_conv.cc. |
CVE-2022-27449 | High | 7.5 | 2022-04-14 | MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_func.cc:148. |
CVE-2022-27448 | High | 7.5 | 2022-04-14 | There is an Assertion failure in MariaDB Server v10.9 and below via 'node->pcur->rel_pos == BTR_PCUR_ON' at /row/row0mysql.cc. |
CVE-2022-27447 | High | 7.5 | 2022-04-14 | MariaDB Server v10.9 and below was discovered to contain a use-after-free via the component Binary_string::free_buffer() at /sql/sql_string.h. |
CVE-2022-27446 | High | 7.5 | 2022-04-14 | MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_cmpfunc.h. |
CVE-2022-27445 | High | 7.5 | 2022-04-14 | MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/sql_window.cc. |
CVE-2022-27444 | High | 7.5 | 2022-04-14 | MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_subselect.cc. |
CVE-2022-26507 | Critical | 9.8 | 2022-04-14 | A heap-based buffer overflow exists in XML Decompression DecodeTreeBlock in AT&T Labs Xmill 0.7. A crafted input file can lead to remote code execution. This i… |
CVE-2022-1351 | Medium | 5.4 | 2022-04-14 | Stored XSS in Tooltip in GitHub repository pimcore/pimcore prior to 10.4. |
CVE-2022-1279 | Medium | 6.5 | 2022-04-14 | A vulnerability in the encryption implementation of EBICS messages in the open source librairy ebics-java/ebics-java-client allows an attacker sniffing network… |
CVE-2022-1350 | Medium | 4.3 | 2022-04-14 | A vulnerability classified as problematic was found in GhostPCL 9.55.0. This vulnerability affects the function chunk_free_object of the file gsmchunk.c. The m… |
CVE-2022-24847 | High | 7.2 | 2022-04-13 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The GeoServer security mechanism can perform a… |
CVE-2022-24845 | High | 8.8 | 2022-04-13 | Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In affected versions, the return of `<iface>.returns_int128()` is not validated t… |
CVE-2022-24843 | High | 7.5 | 2022-04-13 | Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin 2.50 has arbitrary fil… |
CVE-2022-24844 | High | 8.1 | 2022-04-13 | Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. The problem occurs in the following… |
CVE-2022-24828 | High | 8.3 | 2022-04-13 | Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call `VcsDriver::getFileContent` can have a code injectio… |
CVE-2022-24818 | High | 8.2 | 2022-04-13 | GeoTools is an open source Java library that provides tools for geospatial data. The GeoTools library has a number of data sources that can perform unchecked J… |
CVE-2022-24816 | Critical | 10.0 | 2022-04-13 | JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request… |
CVE-2022-27479 | Critical | 9.8 | 2022-04-13 | Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests. Users should update to 1.4.2 or higher which addresses this issue. |
CVE-2022-24788 | High | 7.1 | 2022-04-13 | Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Versions of vyper prior to 0.3.2 suffer from a potential buffer overrun. Importin… |
CVE-2022-1347 | High | 8.4 | 2022-04-13 | Stored XSS in the "Username" & "Email" input fields leads to account takeover of Admin & Co-admin users in GitHub repository causefx/organizr prior to 2.1.1810… |
CVE-2022-1345 | Critical | 9.0 | 2022-04-13 | Stored XSS viva .svg file upload in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's brow… |
CVE-2022-0023 | Medium | 5.9 | 2022-04-13 | An improper handling of exceptional conditions vulnerability exists in the DNS proxy feature of Palo Alto Networks PAN-OS software that enables a meddler-in-th… |
CVE-2022-27847 | Medium | 4.3 | 2022-04-13 | Cross-Site Request Forgery (CSRF) vulnerability in Yooslider Yoo Slider <= 2.0.0 on WordPress allows attackers to import templates. |
CVE-2022-27846 | Medium | 4.3 | 2022-04-13 | Cross-Site Request Forgery (CSRF) vulnerability in Yooslider Yoo Slider <= 2.0.0 on WordPress allows attackers to create or modify slider. |
CVE-2022-27524 | High | 7.1 | 2022-04-13 | An out-of-bounds read can be exploited in Autodesk TrueView 2022 may lead to an exposure of sensitive information or a crash through using a maliciously crafte… |
CVE-2022-27523 | High | 7.1 | 2022-04-13 | A buffer over-read can be exploited in Autodesk TrueView 2022 may lead to an exposure of sensitive information or a crash through using a maliciously crafted D… |
CVE-2022-27506 | Low | 2.7 | 2022-04-13 | Hard-coded credentials allow administrators to access the shell via the SD-WAN CLI |
CVE-2022-27505 | Medium | 6.1 | 2022-04-13 | Reflected cross site scripting (XSS) |
CVE-2022-27503 | Medium | 6.1 | 2022-04-13 | Cross-site Scripting (XSS) vulnerability in Citrix StoreFront affects version 1912 before CU5 and version 3.12 before CU9 |
CVE-2022-25797 | High | 7.8 | 2022-04-13 | A maliciously crafted PDF file in Autodesk AutoCAD 2022, 2021, 2020, 2019 can be used to dereference for a write beyond the allocated buffer while parsing PDF… |
CVE-2022-25795 | High | 7.8 | 2022-04-13 | A Memory Corruption Vulnerability in Autodesk TrueView 2022 and 2021 may lead to remote code execution through maliciously crafted DWG files. |
CVE-2022-22961 | Medium | 5.3 | 2022-04-13 | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an information disclosure vulnerability due to returning excess information. A ma… |
CVE-2022-22960 | High | 7.8 | 2022-04-13 | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scrip… |
CVE-2022-22959 | Medium | 4.3 | 2022-04-13 | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a cross site request forgery vulnerability. A malicious actor can trick a user th… |
CVE-2022-22958 | High | 7.2 | 2022-04-13 | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A ma… |
CVE-2022-22957 | High | 7.2 | 2022-04-13 | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A ma… |
CVE-2022-22956 | Critical | 9.8 | 2022-04-13 | VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. A malicious actor may… |
CVE-2022-22955 | Critical | 9.8 | 2022-04-13 | VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. A malicious actor may… |