2022 CVEs (page 226)
Page 226 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-27848 | Low | 3.4 | 2022-04-14 | Authenticated (admin+ user) Stored Cross-Site Scripting (XSS) in Modern Events Calendar Lite (WordPress plugin) <= 6.5.1 |
CVE-2022-22968 | Medium | 5.3 | 2022-04-14 | In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensiti… |
CVE-2022-22966 | High | 7.2 | 2022-04-14 | An authenticated, high privileged malicious actor with network access to the VMware Cloud Director tenant or provider may be able to exploit a remote code exec… |
CVE-2022-1328 | Medium | 4.3 | 2022-04-14 | Buffer Overflow in uudecoder in Mutt affecting all versions starting from 0.94.13 before 2.2.3 allows read past end of input line |
CVE-2022-1304 | High | 7.8 | 2022-04-14 | An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a s… |
CVE-2022-28711 | Critical | 9.8 | 2022-04-14 | A memory corruption vulnerability exists in the cgi.c unescape functionality of ArduPilot APWeb master branch 50b6b7ac - master branch 46177cb9. A specially-cr… |
CVE-2022-22149 | High | 8.8 | 2022-04-14 | A SQL injection vulnerability exists in the HelpdeskEmailActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. A specially-crafted HTTP request can cau… |
CVE-2022-21234 | High | 8.8 | 2022-04-14 | An SQL injection vulnerability exists in the EchoAssets.aspx functionality of Lansweeper lansweeper 9.1.20.2. A specially-crafted HTTP request can cause SQL in… |
CVE-2022-21210 | High | 8.8 | 2022-04-14 | An SQL injection vulnerability exists in the AssetActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. A specially-crafted HTTP request can cause SQL… |
CVE-2022-21154 | High | 7.8 | 2022-04-14 | An integer overflow vulnerability exists in the fltSaveCMP functionality of Leadtools 22. A specially-crafted BMP file can lead to an integer overflow, that in… |
CVE-2022-21145 | Medium | 4.8 | 2022-04-14 | A stored cross-site scripting vulnerability exists in the WebUserActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. A specially-crafted HTTP request… |
CVE-2022-22391 | Medium | 4.3 | 2022-04-14 | IBM Aspera High-Speed Transfer 4.3.1 and earlier could allow an authenticated user to obtain information from non sensitive operating system files that they sh… |
CVE-2022-27817 | Medium | 4.4 | 2022-04-14 | SWHKD 1.1.5 consumes the keyboard events of unintended users. This could potentially cause an information leak, but is usually a denial of functionality. |
CVE-2022-27814 | Low | 3.3 | 2022-04-14 | SWHKD 1.1.5 allows arbitrary file-existence tests via the -c option. |
CVE-2022-25166 | Medium | 5.0 | 2022-04-14 | An issue was discovered in Amazon AWS VPN Client 2.0.0. It is possible to include a UNC path in the OpenVPN configuration file when referencing file paths for… |
CVE-2022-25165 | High | 7.0 | 2022-04-14 | An issue was discovered in Amazon AWS VPN Client 2.0.0. A TOCTOU race condition exists during the validation of VPN configuration files. This allows parameters… |
CVE-2022-22198 | High | 7.5 | 2022-04-14 | An Access of Uninitialized Pointer vulnerability in the SIP ALG of Juniper Networks Junos OS allows an unauthenticated network-based attacker to cause a Denial… |
CVE-2022-22197 | High | 7.5 | 2022-04-14 | An Operation on a Resource after Expiration or Release vulnerability in the Routing Protocol Daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved all… |
CVE-2022-22196 | Medium | 6.5 | 2022-04-14 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved al… |
CVE-2022-22195 | High | 7.5 | 2022-04-14 | An Improper Update of Reference Count vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to tri… |
CVE-2022-22194 | High | 7.5 | 2022-04-14 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the packetIO daemon of Juniper Networks Junos OS Evolved on PTX10003, PTX10004, and PT… |
CVE-2022-22193 | Medium | 5.5 | 2022-04-14 | An Improper Handling of Unexpected Data Type vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a loca… |
CVE-2022-22191 | Medium | 6.5 | 2022-04-14 | A Denial of Service (DoS) vulnerability in the processing of a flood of specific ARP traffic in Juniper Networks Junos OS on the EX4300 switch, sent from the l… |
CVE-2022-22190 | High | 7.4 | 2022-04-14 | An Improper Access Control vulnerability in the Juniper Networks Paragon Active Assurance Control Center allows an unauthenticated attacker to leverage a craft… |
CVE-2022-22189 | High | 7.3 | 2022-04-14 | An Incorrect Ownership Assignment vulnerability in Juniper Networks Contrail Service Orchestration (CSO) allows a locally authenticated user to have their perm… |
CVE-2022-22188 | High | 7.5 | 2022-04-14 | An Uncontrolled Memory Allocation vulnerability leading to a Heap-based Buffer Overflow in the packet forwarding engine (PFE) of Juniper Networks Junos OS allo… |
CVE-2022-22187 | High | 7.8 | 2022-04-14 | An Improper Privilege Management vulnerability in the Windows Installer framework used in the Juniper Networks Juniper Identity Management Service (JIMS) allow… |
CVE-2022-22186 | High | 7.2 | 2022-04-14 | Due to an Improper Initialization vulnerability in Juniper Networks Junos OS on EX4650 devices, packets received on the management interface (em0) but not dest… |
CVE-2022-22185 | High | 7.5 | 2022-04-14 | A vulnerability in Juniper Networks Junos OS on SRX Series, allows a network-based unauthenticated attacker to cause a Denial of Service (DoS) by sending a spe… |
CVE-2022-22183 | High | 7.5 | 2022-04-14 | An Improper Access Control vulnerability in Juniper Networks Junos OS Evolved allows a network-based unauthenticated attacker who is able to connect to a speci… |
CVE-2022-22182 | High | 8.8 | 2022-04-14 | A Cross-site Scripting (XSS) vulnerability in Juniper Networks Junos OS J-Web allows an attacker to construct a URL that when visited by another user enables t… |
CVE-2022-22181 | High | 8.0 | 2022-04-14 | A reflected Cross-site Scripting (XSS) vulnerability in J-Web of Juniper Networks Junos OS allows a network-based authenticated attacker to run malicious scrip… |
CVE-2022-27008 | High | 7.5 | 2022-04-14 | nginx njs 0.7.2 is vulnerable to Buffer Overflow. Type confused in Array.prototype.concat() when a slow array appended element is fast array. |
CVE-2022-27007 | Critical | 9.8 | 2022-04-14 | nginx njs 0.7.2 is affected suffers from Use-after-free in njs_function_frame_alloc() when it try to invoke from a restored frame saved with njs_function_frame… |
CVE-2022-1258 | High | 8.4 | 2022-04-14 | A blind SQL injection vulnerability in the ePolicy Orchestrator (ePO) extension of MA prior to 5.7.6 can be exploited by an authenticated administrator on ePO… |
CVE-2022-1257 | Medium | 6.1 | 2022-04-14 | Insecure storage of sensitive information vulnerability in MA for Linux, macOS, and Windows prior to 5.7.6 allows a local user to gain access to sensitive info… |
CVE-2022-1256 | High | 7.8 | 2022-04-14 | A local privilege escalation vulnerability in MA for Windows prior to 5.7.6 allows a local low privileged user to gain system privileges through running the re… |
CVE-2022-27457 | High | 7.5 | 2022-04-14 | MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component my_mb_wc_latin1 at /strings/ctype-latin1.c. |
CVE-2022-27456 | High | 7.5 | 2022-04-14 | MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component VDec::VDec at /sql/sql_type.cc. |
CVE-2022-27455 | High | 7.5 | 2022-04-14 | MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component my_wildcmp_8bit_impl at /strings/ctype-simple.c. |
CVE-2022-27452 | High | 7.5 | 2022-04-14 | MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_cmpfunc.cc. |
CVE-2022-27451 | High | 7.5 | 2022-04-14 | MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/field_conv.cc. |
CVE-2022-27449 | High | 7.5 | 2022-04-14 | MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_func.cc:148. |
CVE-2022-27448 | High | 7.5 | 2022-04-14 | There is an Assertion failure in MariaDB Server v10.9 and below via 'node->pcur->rel_pos == BTR_PCUR_ON' at /row/row0mysql.cc. |
CVE-2022-27447 | High | 7.5 | 2022-04-14 | MariaDB Server v10.9 and below was discovered to contain a use-after-free via the component Binary_string::free_buffer() at /sql/sql_string.h. |
CVE-2022-27446 | High | 7.5 | 2022-04-14 | MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_cmpfunc.h. |
CVE-2022-27445 | High | 7.5 | 2022-04-14 | MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/sql_window.cc. |
CVE-2022-27444 | High | 7.5 | 2022-04-14 | MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_subselect.cc. |
CVE-2022-26507 | Critical | 9.8 | 2022-04-14 | A heap-based buffer overflow exists in XML Decompression DecodeTreeBlock in AT&T Labs Xmill 0.7. A crafted input file can lead to remote code execution. This i… |
CVE-2022-1351 | Medium | 5.4 | 2022-04-14 | Stored XSS in Tooltip in GitHub repository pimcore/pimcore prior to 10.4. |
CVE-2022-1279 | Medium | 6.5 | 2022-04-14 | A vulnerability in the encryption implementation of EBICS messages in the open source librairy ebics-java/ebics-java-client allows an attacker sniffing network… |
CVE-2022-1350 | Medium | 4.3 | 2022-04-14 | A vulnerability classified as problematic was found in GhostPCL 9.55.0. This vulnerability affects the function chunk_free_object of the file gsmchunk.c. The m… |
CVE-2022-24847 | High | 7.2 | 2022-04-13 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The GeoServer security mechanism can perform a… |
CVE-2022-24845 | High | 8.8 | 2022-04-13 | Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In affected versions, the return of `<iface>.returns_int128()` is not validated t… |
CVE-2022-24843 | High | 7.5 | 2022-04-13 | Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin 2.50 has arbitrary fil… |
CVE-2022-24844 | High | 8.1 | 2022-04-13 | Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. The problem occurs in the following… |
CVE-2022-24828 | High | 8.3 | 2022-04-13 | Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call `VcsDriver::getFileContent` can have a code injectio… |
CVE-2022-24818 | High | 8.2 | 2022-04-13 | GeoTools is an open source Java library that provides tools for geospatial data. The GeoTools library has a number of data sources that can perform unchecked J… |
CVE-2022-24816 | Critical | 10.0 | 2022-04-13 | JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request… |
CVE-2022-27479 | Critical | 9.8 | 2022-04-13 | Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests. Users should update to 1.4.2 or higher which addresses this issue. |
CVE-2022-24788 | High | 7.1 | 2022-04-13 | Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Versions of vyper prior to 0.3.2 suffer from a potential buffer overrun. Importin… |
CVE-2022-1347 | High | 8.4 | 2022-04-13 | Stored XSS in the "Username" & "Email" input fields leads to account takeover of Admin & Co-admin users in GitHub repository causefx/organizr prior to 2.1.1810… |
CVE-2022-1345 | Critical | 9.0 | 2022-04-13 | Stored XSS viva .svg file upload in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's brow… |
CVE-2022-0023 | Medium | 5.9 | 2022-04-13 | An improper handling of exceptional conditions vulnerability exists in the DNS proxy feature of Palo Alto Networks PAN-OS software that enables a meddler-in-th… |
CVE-2022-27847 | Medium | 4.3 | 2022-04-13 | Cross-Site Request Forgery (CSRF) vulnerability in Yooslider Yoo Slider <= 2.0.0 on WordPress allows attackers to import templates. |
CVE-2022-27846 | Medium | 4.3 | 2022-04-13 | Cross-Site Request Forgery (CSRF) vulnerability in Yooslider Yoo Slider <= 2.0.0 on WordPress allows attackers to create or modify slider. |
CVE-2022-27524 | High | 7.1 | 2022-04-13 | An out-of-bounds read can be exploited in Autodesk TrueView 2022 may lead to an exposure of sensitive information or a crash through using a maliciously crafte… |
CVE-2022-27523 | High | 7.1 | 2022-04-13 | A buffer over-read can be exploited in Autodesk TrueView 2022 may lead to an exposure of sensitive information or a crash through using a maliciously crafted D… |
CVE-2022-27506 | Low | 2.7 | 2022-04-13 | Hard-coded credentials allow administrators to access the shell via the SD-WAN CLI |
CVE-2022-27505 | Medium | 6.1 | 2022-04-13 | Reflected cross site scripting (XSS) |
CVE-2022-27503 | Medium | 6.1 | 2022-04-13 | Cross-site Scripting (XSS) vulnerability in Citrix StoreFront affects version 1912 before CU5 and version 3.12 before CU9 |
CVE-2022-25797 | High | 7.8 | 2022-04-13 | A maliciously crafted PDF file in Autodesk AutoCAD 2022, 2021, 2020, 2019 can be used to dereference for a write beyond the allocated buffer while parsing PDF… |
CVE-2022-25795 | High | 7.8 | 2022-04-13 | A Memory Corruption Vulnerability in Autodesk TrueView 2022 and 2021 may lead to remote code execution through maliciously crafted DWG files. |
CVE-2022-22961 | Medium | 5.3 | 2022-04-13 | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an information disclosure vulnerability due to returning excess information. A ma… |
CVE-2022-22960 | High | 7.8 | 2022-04-13 | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scrip… |
CVE-2022-22959 | Medium | 4.3 | 2022-04-13 | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a cross site request forgery vulnerability. A malicious actor can trick a user th… |
CVE-2022-22958 | High | 7.2 | 2022-04-13 | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A ma… |
CVE-2022-22957 | High | 7.2 | 2022-04-13 | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A ma… |
CVE-2022-22956 | Critical | 9.8 | 2022-04-13 | VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. A malicious actor may… |
CVE-2022-22955 | Critical | 9.8 | 2022-04-13 | VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. A malicious actor may… |
CVE-2022-1346 | Critical | 9.0 | 2022-04-13 | Multiple Stored XSS in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's browser and it ca… |
CVE-2022-1344 | Critical | 9.0 | 2022-04-13 | Stored XSS due to no sanitization in the filename in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts i… |
CVE-2022-1337 | Medium | 4.3 | 2022-04-13 | The image proxy component in Mattermost version 6.4.1 and earlier allocates memory for multiple copies of a proxied image, which allows an authenticated attack… |
CVE-2022-1333 | Low | 3.5 | 2022-04-13 | Mattermost Playbooks plugin v1.24.0 and earlier fails to properly check the limit on the number of webhooks, which allows authenticated and authorized users to… |
CVE-2022-1332 | Medium | 4.3 | 2022-04-13 | One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, which allows the authenticated members with restricted custom… |
CVE-2022-1280 | Medium | 6.3 | 2022-04-13 | A use-after-free vulnerability was found in drm_lease_held in drivers/gpu/drm/drm_lease.c in the Linux kernel due to a race problem. This flaw allows a local u… |
CVE-2022-0221 | Medium | 5.5 | 2022-04-13 | A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could result in information disclosure when opening a malicious solu… |
CVE-2022-28052 | High | 8.0 | 2022-04-13 | Directory Traversal vulnerability in file cn/roothub/store/FileSystemStorageService in function store in Roothub 2.6.0 allows remote attackers with low privleg… |
CVE-2022-27256 | Medium | 6.1 | 2022-04-13 | A PHP Local File inclusion vulnerability in the Redbasic theme for Hubzilla before version 7.2 allows remote attackers to include arbitrary php files via the s… |
CVE-2022-26643 | Medium | 5.3 | 2022-04-13 | An issue in EasyIO CPT Graphics v0.8 allows attackers to discover valid users in the application. |
CVE-2022-26144 | Medium | 6.1 | 2022-04-13 | An XSS issue was discovered in MantisBT before 2.25.3. Improper escaping of a Plugin name allows execution of arbitrary code (if CSP allows it) in manage_plugi… |
CVE-2022-24308 | Medium | 5.5 | 2022-04-13 | Automox Agent prior to version 37 on Windows and Linux and Version 36 on OSX could allow for a non privileged user to obtain sensitive information during the i… |
CVE-2022-27475 | Medium | 6.1 | 2022-04-13 | Cross site scripting (XSS) vulnerability in tramyardg hotel-mgmt-system, allows attackers to execute arbitrary code when when /admin.php is loaded. |
CVE-2022-1339 | High | 7.5 | 2022-04-13 | SQL injection in ElementController.php in GitHub repository pimcore/pimcore prior to 10.3.5. This vulnerability is capable of steal the data |
CVE-2022-29156 | High | 7.8 | 2022-04-13 | drivers/infiniband/ulp/rtrs/rtrs-clt.c in the Linux kernel before 5.16.12 has a double free related to rtrs_clt_dev_release. |
CVE-2022-22279 | Medium | 4.9 | 2022-04-13 | A post-authentication arbitrary file read vulnerability impacting end-of-life Secure Remote Access (SRA) products and older firmware versions of Secure Mobile… |
CVE-2022-26589 | Medium | 6.5 | 2022-04-13 | A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to delete arbitrary pages. |
CVE-2022-26151 | High | 7.2 | 2022-04-13 | Citrix XenMobile Server 10.12 through RP11, 10.13 through RP7, and 10.14 through RP4 allows Command Injection. |
CVE-2022-1330 | Medium | 5.4 | 2022-04-12 | stored xss due to unsantized anchor url in GitHub repository alvarotrigo/fullpage.js prior to 4.0.4. stored xss . |
CVE-2022-0436 | Medium | 5.5 | 2022-04-12 | Path Traversal in GitHub repository gruntjs/grunt prior to 1.5.2. |