2022 CVEs (page 227)
Page 227 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-1346 | Critical | 9.0 | 2022-04-13 | Multiple Stored XSS in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's browser and it ca… |
CVE-2022-1344 | Critical | 9.0 | 2022-04-13 | Stored XSS due to no sanitization in the filename in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts i… |
CVE-2022-1337 | Medium | 4.3 | 2022-04-13 | The image proxy component in Mattermost version 6.4.1 and earlier allocates memory for multiple copies of a proxied image, which allows an authenticated attack… |
CVE-2022-1333 | Low | 3.5 | 2022-04-13 | Mattermost Playbooks plugin v1.24.0 and earlier fails to properly check the limit on the number of webhooks, which allows authenticated and authorized users to… |
CVE-2022-1332 | Medium | 4.3 | 2022-04-13 | One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, which allows the authenticated members with restricted custom… |
CVE-2022-1280 | Medium | 6.3 | 2022-04-13 | A use-after-free vulnerability was found in drm_lease_held in drivers/gpu/drm/drm_lease.c in the Linux kernel due to a race problem. This flaw allows a local u… |
CVE-2022-0221 | Medium | 5.5 | 2022-04-13 | A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could result in information disclosure when opening a malicious solu… |
CVE-2022-28052 | High | 8.0 | 2022-04-13 | Directory Traversal vulnerability in file cn/roothub/store/FileSystemStorageService in function store in Roothub 2.6.0 allows remote attackers with low privleg… |
CVE-2022-27256 | Medium | 6.1 | 2022-04-13 | A PHP Local File inclusion vulnerability in the Redbasic theme for Hubzilla before version 7.2 allows remote attackers to include arbitrary php files via the s… |
CVE-2022-26643 | Medium | 5.3 | 2022-04-13 | An issue in EasyIO CPT Graphics v0.8 allows attackers to discover valid users in the application. |
CVE-2022-26144 | Medium | 6.1 | 2022-04-13 | An XSS issue was discovered in MantisBT before 2.25.3. Improper escaping of a Plugin name allows execution of arbitrary code (if CSP allows it) in manage_plugi… |
CVE-2022-24308 | Medium | 5.5 | 2022-04-13 | Automox Agent prior to version 37 on Windows and Linux and Version 36 on OSX could allow for a non privileged user to obtain sensitive information during the i… |
CVE-2022-27475 | Medium | 6.1 | 2022-04-13 | Cross site scripting (XSS) vulnerability in tramyardg hotel-mgmt-system, allows attackers to execute arbitrary code when when /admin.php is loaded. |
CVE-2022-1339 | High | 7.5 | 2022-04-13 | SQL injection in ElementController.php in GitHub repository pimcore/pimcore prior to 10.3.5. This vulnerability is capable of steal the data |
CVE-2022-29156 | High | 7.8 | 2022-04-13 | drivers/infiniband/ulp/rtrs/rtrs-clt.c in the Linux kernel before 5.16.12 has a double free related to rtrs_clt_dev_release. |
CVE-2022-22279 | Medium | 4.9 | 2022-04-13 | A post-authentication arbitrary file read vulnerability impacting end-of-life Secure Remote Access (SRA) products and older firmware versions of Secure Mobile… |
CVE-2022-26589 | Medium | 6.5 | 2022-04-13 | A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to delete arbitrary pages. |
CVE-2022-26151 | High | 7.2 | 2022-04-13 | Citrix XenMobile Server 10.12 through RP11, 10.13 through RP7, and 10.14 through RP4 allows Command Injection. |
CVE-2022-1330 | Medium | 5.4 | 2022-04-12 | stored xss due to unsantized anchor url in GitHub repository alvarotrigo/fullpage.js prior to 4.0.4. stored xss . |
CVE-2022-0436 | Medium | 5.5 | 2022-04-12 | Path Traversal in GitHub repository gruntjs/grunt prior to 1.5.2. |
CVE-2022-29052 | Medium | 4.3 | 2022-04-12 | Jenkins Google Compute Engine Plugin 4.3.8 and earlier stores private keys unencrypted in cloud agent config.xml files on the Jenkins controller where they can… |
CVE-2022-29051 | Medium | 4.3 | 2022-04-12 | Missing permission checks in Jenkins Publish Over FTP Plugin 1.16 and earlier allow attackers with Overall/Read permission to connect to an FTP server using at… |
CVE-2022-29050 | High | 8.8 | 2022-04-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Publish Over FTP Plugin 1.16 and earlier allows attackers to connect to an FTP server using attack… |
CVE-2022-29049 | Medium | 5.4 | 2022-04-12 | Jenkins promoted builds Plugin 873.v6149db_d64130 and earlier, except 3.10.1, does not validate the names of promotions defined in Job DSL, allowing attackers… |
CVE-2022-29048 | Medium | 4.3 | 2022-04-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Subversion Plugin 2.15.3 and earlier allows attackers to connect to an attacker-specified URL. |
CVE-2022-29047 | Medium | 5.3 | 2022-04-12 | Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a_4eb_b_e039 and earlier, except 2.21.3, allows attackers able to submit pull requests (or equivalent)… |
CVE-2022-29046 | Medium | 5.4 | 2022-04-12 | Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and more) parameters on views displaying paramet… |
CVE-2022-29045 | Medium | 5.4 | 2022-04-12 | Jenkins promoted builds Plugin 873.v6149db_d64130 and earlier, except 3.10.1, does not escape the name and description of Promoted Build parameters on views di… |
CVE-2022-29044 | Medium | 5.4 | 2022-04-12 | Jenkins Node and Label parameter Plugin 1.10.3 and earlier does not escape the name and description of Node and Label parameters on views displaying parameters… |
CVE-2022-29043 | Medium | 5.4 | 2022-04-12 | Jenkins Mask Passwords Plugin 3.0 and earlier does not escape the name and description of Non-Stored Password parameters on views displaying parameters, result… |
CVE-2022-29042 | Medium | 5.4 | 2022-04-12 | Jenkins Job Generator Plugin 1.22 and earlier does not escape the name and description of Generator Parameter and Generator Choice parameters on Job Generator… |
CVE-2022-29041 | Medium | 5.4 | 2022-04-12 | Jenkins Jira Plugin 3.7 and earlier, except 3.6.1, does not escape the name and description of Jira Issue and Jira Release Version parameters on views displayi… |
CVE-2022-29040 | Medium | 5.4 | 2022-04-12 | Jenkins Git Parameter Plugin 0.9.15 and earlier does not escape the name and description of Git parameters on views displaying parameters, resulting in a store… |
CVE-2022-29039 | Medium | 5.4 | 2022-04-12 | Jenkins Gerrit Trigger Plugin 2.35.2 and earlier does not escape the name and description of Base64 Encoded String parameters on views displaying parameters, r… |
CVE-2022-29038 | Medium | 5.4 | 2022-04-12 | Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not escape the name and description of Extended Choice parameters on views display… |
CVE-2022-29037 | Medium | 5.4 | 2022-04-12 | Jenkins CVS Plugin 2.19 and earlier does not escape the name and description of CVS Symbolic Name parameters on views displaying parameters, resulting in a sto… |
CVE-2022-29036 | Medium | 5.4 | 2022-04-12 | Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2, and 2.6.1.1, does not escape the name… |
CVE-2022-27419 | Medium | 5.5 | 2022-04-12 | rtl_433 21.12 was discovered to contain a stack overflow in the function acurite_00275rm_decode at /devices/acurite.c. This vulnerability allows attackers to c… |
CVE-2022-27418 | High | 7.8 | 2022-04-12 | Tcpreplay v4.4.1 has a heap-based buffer overflow in do_checksum_math at /tcpedit/checksum.c. |
CVE-2022-27416 | High | 7.8 | 2022-04-12 | Tcpreplay v4.4.1 was discovered to contain a double-free via __interceptor_free. |
CVE-2022-27387 | High | 7.5 | 2022-04-12 | MariaDB Server v10.7 and below was discovered to contain a global buffer overflow in the component decimal_bin_size, which is exploited via specially crafted S… |
CVE-2022-27386 | High | 7.5 | 2022-04-12 | MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component sql/sql_class.cc. |
CVE-2022-27385 | High | 7.5 | 2022-04-12 | An issue in the component Used_tables_and_const_cache::used_tables_and_const_cache_join of MariaDB Server v10.7 and below was discovered to allow attackers to… |
CVE-2022-27384 | High | 7.5 | 2022-04-12 | An issue in the component Item_subselect::init_expr_cache_tracker of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Serv… |
CVE-2022-27383 | High | 7.5 | 2022-04-12 | MariaDB Server v10.6 and below was discovered to contain an use-after-free in the component my_strcasecmp_8bit, which is exploited via specially crafted SQL st… |
CVE-2022-27382 | High | 7.5 | 2022-04-12 | MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component Item_field::used_tables/update_depend_map_for_order. |
CVE-2022-27381 | High | 7.5 | 2022-04-12 | An issue in the component Field::set_default of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via special… |
CVE-2022-27380 | High | 7.5 | 2022-04-12 | An issue in the component my_decimal::operator= of MariaDB Server v10.6.3 and below was discovered to allow attackers to cause a Denial of Service (DoS) via sp… |
CVE-2022-27379 | High | 7.5 | 2022-04-12 | An issue in the component Arg_comparator::compare_real_fixed of MariaDB Server v10.6.2 and below was discovered to allow attackers to cause a Denial of Service… |
CVE-2022-27378 | High | 7.5 | 2022-04-12 | An issue in the component Create_tmp_table::finalize of MariaDB Server v10.7 and below was discovered to allow attackers to cause a Denial of Service (DoS) via… |
CVE-2022-27377 | High | 7.5 | 2022-04-12 | MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component Item_func_in::cleanup(), which is exploited via specially crafted… |
CVE-2022-27376 | High | 7.5 | 2022-04-12 | MariaDB Server v10.6.5 and below was discovered to contain an use-after-free in the component Item_args::walk_arg, which is exploited via specially crafted SQL… |
CVE-2022-0915 | Medium | 6.0 | 2022-04-12 | There is a Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability in Logitech Sync for Windows prior to 2.4.574. Successful exploitation of these vuln… |
CVE-2022-24842 | High | 8.8 | 2022-04-12 | MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. A security issue was found where an non-admin user is able to… |
CVE-2022-24767 | High | 7.8 | 2022-04-12 | GitHub: Git for Windows' uninstaller vulnerable to DLL hijacking when run under the SYSTEM user account. |
CVE-2022-24765 | Medium | 6.0 | 2022-04-12 | Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users working on multi-user machines, where untrusted parties… |
CVE-2022-24413 | Medium | 4.4 | 2022-04-12 | Dell PowerScale OneFS, versions 8.2.2-9.3.x, contain a time-of-check-to-time-of-use vulnerability. A local user with access to the filesystem could potentially… |
CVE-2022-24412 | High | 7.5 | 2022-04-12 | Dell EMC PowerScale OneFS 8.2.x - 9.3.0.x contain an improper handling of value vulnerability. An unprivileged network attacker could potentially exploit this… |
CVE-2022-24411 | High | 7.8 | 2022-04-12 | Dell PowerScale OneFS 8.2.2 and above contain an elevation of privilege vulnerability. A local attacker with ISI_PRIV_LOGIN_SSH and/or ISI_PRIV_LOGIN_CONSOLE c… |
CVE-2022-24070 | High | 7.5 | 2022-04-12 | Subversion's mod_dav_svn is vulnerable to memory corruption. While looking up path-based authorization rules, mod_dav_svn servers may attempt to use memory whi… |
CVE-2022-23163 | Medium | 4.7 | 2022-04-12 | Dell PowerScale OneFS, 8.2,x, 9.1.0.x, 9.2.1.x, and 9.3.0.x contain a denial of service vulnerability. A local malicious user could potentially exploit this vu… |
CVE-2022-23161 | High | 7.5 | 2022-04-12 | Dell PowerScale OneFS versions 8.2.x - 9.3.0.x contain a denial-of-service vulnerability in SmartConnect. An unprivileged network attacker may potentially expl… |
CVE-2022-23160 | Medium | 5.4 | 2022-04-12 | Dell PowerScale OneFS, versions 8.2.0-9.3.0, contains an Improper Handling of Insufficient Permissions vulnerability. An remote malicious user could potentiall… |
CVE-2022-23159 | Medium | 4.8 | 2022-04-12 | Dell PowerScale OneFS, 8.2.2 - 9.3.0.x, contain a missing release of memory after effective lifetime vulnerability. An authenticated user with ISI_PRIV_LOGIN_S… |
CVE-2022-22565 | Medium | 4.7 | 2022-04-12 | Dell PowerScale OneFS, versions 9.0.0-9.3.0, contain an improper authorization of index containing sensitive information. An authenticated and privileged user… |
CVE-2022-22562 | High | 7.5 | 2022-04-12 | Dell PowerScale OneFS, versions 8.2.0-9.3.0, contain a improper handling of missing values exploit. An unauthenticated network attacker could potentially explo… |
CVE-2022-22561 | High | 8.1 | 2022-04-12 | Dell PowerScale OneFS, versions 8.2.x-9.3.0.x, contain an improper restriction of excessive authentication attempts. An unauthenticated remote attacker could p… |
CVE-2022-22560 | High | 7.1 | 2022-04-12 | Dell EMC PowerScale OneFS 8.1.x - 9.1.x contain hard coded credentials. This allows a local user with knowledge of the credentials to login as the admin user t… |
CVE-2022-22559 | High | 7.5 | 2022-04-12 | Dell PowerScale OneFS, version 9.3.0, contains a use of a broken or risky cryptographic algorithm. An unprivileged network attacker could exploit this vulnerab… |
CVE-2022-22550 | Medium | 6.7 | 2022-04-12 | Dell PowerScale OneFS, versions 8.2.2 and above, contain a password disclosure vulnerability. An unprivileged local attacker could potentially exploit this vul… |
CVE-2022-22549 | High | 7.5 | 2022-04-12 | Dell PowerScale OneFS, 8.2.x-9.3.x, contains a Improper Certificate Validation. A unauthenticated remote attacker could potentially exploit this vulnerability… |
CVE-2022-28795 | Medium | 6.5 | 2022-04-12 | A vulnerability within the Avira Password Manager Browser Extensions provided a potential loophole where, if a user visited a page crafted by an attacker, the… |
CVE-2022-28773 | High | 7.5 | 2022-04-12 | Due to an uncontrolled recursion in SAP Web Dispatcher and SAP Internet Communication Manager, the application may crash, leading to denial of service, but can… |
CVE-2022-28772 | High | 7.5 | 2022-04-12 | By overlong input values an attacker may force overwrite of the internal program stack in SAP Web Dispatcher - versions 7.53, 7.77, 7.81, 7.85, 7.86, or Intern… |
CVE-2022-28770 | Medium | 6.1 | 2022-04-12 | Due to insufficient input validation, SAPUI5 library(vbm) - versions 750, 753, 754, 755, 75, allows an unauthenticated attacker to inject a script into the URL… |
CVE-2022-28397 | Critical | 9.8 | 2022-04-12 | An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file. NOTE: Vend… |
CVE-2022-28216 | Medium | 6.1 | 2022-04-12 | SAP BusinessObjects Business Intelligence Platform (BI Workspace) - version 420, is susceptible to a Cross-Site Scripting attack by an unauthenticated attacker… |
CVE-2022-28215 | Medium | 4.7 | 2022-04-12 | SAP NetWeaver ABAP Server and ABAP Platform - versions 740, 750, 787, allows an unauthenticated attacker to redirect users to a malicious site due to insuffici… |
CVE-2022-28213 | High | 8.1 | 2022-04-12 | When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does not sufficiently validate the XML docume… |
CVE-2022-27952 | Critical | 9.8 | 2022-04-12 | An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafted SVG file. |
CVE-2022-27671 | Medium | 6.5 | 2022-04-12 | A CSRF token visible in the URL may possibly lead to information disclosure vulnerability. |
CVE-2022-27670 | Medium | 6.5 | 2022-04-12 | SAP SQL Anywhere - version 17.0, allows an authenticated attacker to prevent legitimate users from accessing a SQL Anywhere database server by crashing the ser… |
CVE-2022-27669 | High | 7.5 | 2022-04-12 | An unauthenticated user can use functions of XML Data Archiving Service of SAP NetWeaver Application Server for Java - version 7.50, to which access should be… |
CVE-2022-27667 | High | 7.5 | 2022-04-12 | Under certain conditions, SAP BusinessObjects Business Intelligence platform, Client Management Console (CMC) - version 430, allows an attacker to access infor… |
CVE-2022-27657 | Low | 2.7 | 2022-04-12 | A highly privileged remote attacker, can gain unauthorized access to display contents of restricted directories by exploiting insufficient validation of path i… |
CVE-2022-27655 | Medium | 6.5 | 2022-04-12 | When a user opens a manipulated Universal 3D (.u3d, 3difr.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the applicatio… |
CVE-2022-27654 | Medium | 6.5 | 2022-04-12 | When a user opens a manipulated Photoshop Document (.psd, 2d.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the applica… |
CVE-2022-27263 | Critical | 9.8 | 2022-04-12 | An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted file. |
CVE-2022-27262 | Critical | 9.8 | 2022-04-12 | An arbitrary file upload vulnerability in the file upload module of Skipper v0.9.1 allows attackers to execute arbitrary code via a crafted file. |
CVE-2022-27261 | High | 7.5 | 2022-04-12 | An arbitrary file write vulnerability in Express-FileUpload v1.3.1 allows attackers to upload multiple files with the same name, causing an overwrite of files… |
CVE-2022-27260 | Critical | 9.8 | 2022-04-12 | An arbitrary file upload vulnerability in the file upload component of ButterCMS v1.2.8 allows attackers to execute arbitrary code via a crafted SVG file. |
CVE-2022-27140 | Critical | 9.8 | 2022-04-12 | An arbitrary file upload vulnerability in the file upload module of express-fileupload 1.3.1 allows attackers to execute arbitrary code via a crafted PHP file… |
CVE-2022-27139 | Critical | 9.8 | 2022-04-12 | An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary code via a crafted SVG file. NOTE: Vend… |
CVE-2022-26109 | Medium | 6.5 | 2022-04-12 | When a user opens a manipulated Portable Document Format (.pdf, PDFView.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0… |
CVE-2022-26108 | Medium | 6.5 | 2022-04-12 | When a user opens a manipulated Picture Exchange (.pcx, 2d.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the applicati… |
CVE-2022-26107 | Medium | 6.5 | 2022-04-12 | When a user opens a manipulated Jupiter Tesselation (.jt, JTReader.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the a… |
CVE-2022-26106 | Medium | 6.5 | 2022-04-12 | When a user opens a manipulated Computer Graphics Metafile (.cgm, CgmCore.dll) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0… |
CVE-2022-26105 | Medium | 6.1 | 2022-04-12 | SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, is susceptible to script execution attack by an unauthenticated attacker d… |
CVE-2022-24812 | High | 8.0 | 2022-04-12 | Grafana is an open-source platform for monitoring and observability. When fine-grained access control is enabled and a client uses Grafana API Key to make requ… |
CVE-2022-24383 | High | 7.8 | 2022-04-12 | The affected product is vulnerable to an out-of-bounds read, which may result in code execution |