2022 CVEs (page 227)
Page 227 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-29052 | Medium | 4.3 | 2022-04-12 | Jenkins Google Compute Engine Plugin 4.3.8 and earlier stores private keys unencrypted in cloud agent config.xml files on the Jenkins controller where they can… |
CVE-2022-29051 | Medium | 4.3 | 2022-04-12 | Missing permission checks in Jenkins Publish Over FTP Plugin 1.16 and earlier allow attackers with Overall/Read permission to connect to an FTP server using at… |
CVE-2022-29050 | High | 8.8 | 2022-04-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Publish Over FTP Plugin 1.16 and earlier allows attackers to connect to an FTP server using attack… |
CVE-2022-29049 | Medium | 5.4 | 2022-04-12 | Jenkins promoted builds Plugin 873.v6149db_d64130 and earlier, except 3.10.1, does not validate the names of promotions defined in Job DSL, allowing attackers… |
CVE-2022-29048 | Medium | 4.3 | 2022-04-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Subversion Plugin 2.15.3 and earlier allows attackers to connect to an attacker-specified URL. |
CVE-2022-29047 | Medium | 5.3 | 2022-04-12 | Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a_4eb_b_e039 and earlier, except 2.21.3, allows attackers able to submit pull requests (or equivalent)… |
CVE-2022-29046 | Medium | 5.4 | 2022-04-12 | Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and more) parameters on views displaying paramet… |
CVE-2022-29045 | Medium | 5.4 | 2022-04-12 | Jenkins promoted builds Plugin 873.v6149db_d64130 and earlier, except 3.10.1, does not escape the name and description of Promoted Build parameters on views di… |
CVE-2022-29044 | Medium | 5.4 | 2022-04-12 | Jenkins Node and Label parameter Plugin 1.10.3 and earlier does not escape the name and description of Node and Label parameters on views displaying parameters… |
CVE-2022-29043 | Medium | 5.4 | 2022-04-12 | Jenkins Mask Passwords Plugin 3.0 and earlier does not escape the name and description of Non-Stored Password parameters on views displaying parameters, result… |
CVE-2022-29042 | Medium | 5.4 | 2022-04-12 | Jenkins Job Generator Plugin 1.22 and earlier does not escape the name and description of Generator Parameter and Generator Choice parameters on Job Generator… |
CVE-2022-29041 | Medium | 5.4 | 2022-04-12 | Jenkins Jira Plugin 3.7 and earlier, except 3.6.1, does not escape the name and description of Jira Issue and Jira Release Version parameters on views displayi… |
CVE-2022-29040 | Medium | 5.4 | 2022-04-12 | Jenkins Git Parameter Plugin 0.9.15 and earlier does not escape the name and description of Git parameters on views displaying parameters, resulting in a store… |
CVE-2022-29039 | Medium | 5.4 | 2022-04-12 | Jenkins Gerrit Trigger Plugin 2.35.2 and earlier does not escape the name and description of Base64 Encoded String parameters on views displaying parameters, r… |
CVE-2022-29038 | Medium | 5.4 | 2022-04-12 | Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not escape the name and description of Extended Choice parameters on views display… |
CVE-2022-29037 | Medium | 5.4 | 2022-04-12 | Jenkins CVS Plugin 2.19 and earlier does not escape the name and description of CVS Symbolic Name parameters on views displaying parameters, resulting in a sto… |
CVE-2022-29036 | Medium | 5.4 | 2022-04-12 | Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2, and 2.6.1.1, does not escape the name… |
CVE-2022-27419 | Medium | 5.5 | 2022-04-12 | rtl_433 21.12 was discovered to contain a stack overflow in the function acurite_00275rm_decode at /devices/acurite.c. This vulnerability allows attackers to c… |
CVE-2022-27418 | High | 7.8 | 2022-04-12 | Tcpreplay v4.4.1 has a heap-based buffer overflow in do_checksum_math at /tcpedit/checksum.c. |
CVE-2022-27416 | High | 7.8 | 2022-04-12 | Tcpreplay v4.4.1 was discovered to contain a double-free via __interceptor_free. |
CVE-2022-27387 | High | 7.5 | 2022-04-12 | MariaDB Server v10.7 and below was discovered to contain a global buffer overflow in the component decimal_bin_size, which is exploited via specially crafted S… |
CVE-2022-27386 | High | 7.5 | 2022-04-12 | MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component sql/sql_class.cc. |
CVE-2022-27385 | High | 7.5 | 2022-04-12 | An issue in the component Used_tables_and_const_cache::used_tables_and_const_cache_join of MariaDB Server v10.7 and below was discovered to allow attackers to… |
CVE-2022-27384 | High | 7.5 | 2022-04-12 | An issue in the component Item_subselect::init_expr_cache_tracker of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Serv… |
CVE-2022-27383 | High | 7.5 | 2022-04-12 | MariaDB Server v10.6 and below was discovered to contain an use-after-free in the component my_strcasecmp_8bit, which is exploited via specially crafted SQL st… |
CVE-2022-27382 | High | 7.5 | 2022-04-12 | MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component Item_field::used_tables/update_depend_map_for_order. |
CVE-2022-27381 | High | 7.5 | 2022-04-12 | An issue in the component Field::set_default of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via special… |
CVE-2022-27380 | High | 7.5 | 2022-04-12 | An issue in the component my_decimal::operator= of MariaDB Server v10.6.3 and below was discovered to allow attackers to cause a Denial of Service (DoS) via sp… |
CVE-2022-27379 | High | 7.5 | 2022-04-12 | An issue in the component Arg_comparator::compare_real_fixed of MariaDB Server v10.6.2 and below was discovered to allow attackers to cause a Denial of Service… |
CVE-2022-27378 | High | 7.5 | 2022-04-12 | An issue in the component Create_tmp_table::finalize of MariaDB Server v10.7 and below was discovered to allow attackers to cause a Denial of Service (DoS) via… |
CVE-2022-27377 | High | 7.5 | 2022-04-12 | MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component Item_func_in::cleanup(), which is exploited via specially crafted… |
CVE-2022-27376 | High | 7.5 | 2022-04-12 | MariaDB Server v10.6.5 and below was discovered to contain an use-after-free in the component Item_args::walk_arg, which is exploited via specially crafted SQL… |
CVE-2022-0915 | Medium | 6.0 | 2022-04-12 | There is a Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability in Logitech Sync for Windows prior to 2.4.574. Successful exploitation of these vuln… |
CVE-2022-24842 | High | 8.8 | 2022-04-12 | MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. A security issue was found where an non-admin user is able to… |
CVE-2022-24767 | High | 7.8 | 2022-04-12 | GitHub: Git for Windows' uninstaller vulnerable to DLL hijacking when run under the SYSTEM user account. |
CVE-2022-24765 | Medium | 6.0 | 2022-04-12 | Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users working on multi-user machines, where untrusted parties… |
CVE-2022-24413 | Medium | 4.4 | 2022-04-12 | Dell PowerScale OneFS, versions 8.2.2-9.3.x, contain a time-of-check-to-time-of-use vulnerability. A local user with access to the filesystem could potentially… |
CVE-2022-24412 | High | 7.5 | 2022-04-12 | Dell EMC PowerScale OneFS 8.2.x - 9.3.0.x contain an improper handling of value vulnerability. An unprivileged network attacker could potentially exploit this… |
CVE-2022-24411 | High | 7.8 | 2022-04-12 | Dell PowerScale OneFS 8.2.2 and above contain an elevation of privilege vulnerability. A local attacker with ISI_PRIV_LOGIN_SSH and/or ISI_PRIV_LOGIN_CONSOLE c… |
CVE-2022-24070 | High | 7.5 | 2022-04-12 | Subversion's mod_dav_svn is vulnerable to memory corruption. While looking up path-based authorization rules, mod_dav_svn servers may attempt to use memory whi… |
CVE-2022-23163 | Medium | 4.7 | 2022-04-12 | Dell PowerScale OneFS, 8.2,x, 9.1.0.x, 9.2.1.x, and 9.3.0.x contain a denial of service vulnerability. A local malicious user could potentially exploit this vu… |
CVE-2022-23161 | High | 7.5 | 2022-04-12 | Dell PowerScale OneFS versions 8.2.x - 9.3.0.x contain a denial-of-service vulnerability in SmartConnect. An unprivileged network attacker may potentially expl… |
CVE-2022-23160 | Medium | 5.4 | 2022-04-12 | Dell PowerScale OneFS, versions 8.2.0-9.3.0, contains an Improper Handling of Insufficient Permissions vulnerability. An remote malicious user could potentiall… |
CVE-2022-23159 | Medium | 4.8 | 2022-04-12 | Dell PowerScale OneFS, 8.2.2 - 9.3.0.x, contain a missing release of memory after effective lifetime vulnerability. An authenticated user with ISI_PRIV_LOGIN_S… |
CVE-2022-22565 | Medium | 4.7 | 2022-04-12 | Dell PowerScale OneFS, versions 9.0.0-9.3.0, contain an improper authorization of index containing sensitive information. An authenticated and privileged user… |
CVE-2022-22562 | High | 7.5 | 2022-04-12 | Dell PowerScale OneFS, versions 8.2.0-9.3.0, contain a improper handling of missing values exploit. An unauthenticated network attacker could potentially explo… |
CVE-2022-22561 | High | 8.1 | 2022-04-12 | Dell PowerScale OneFS, versions 8.2.x-9.3.0.x, contain an improper restriction of excessive authentication attempts. An unauthenticated remote attacker could p… |
CVE-2022-22560 | High | 7.1 | 2022-04-12 | Dell EMC PowerScale OneFS 8.1.x - 9.1.x contain hard coded credentials. This allows a local user with knowledge of the credentials to login as the admin user t… |
CVE-2022-22559 | High | 7.5 | 2022-04-12 | Dell PowerScale OneFS, version 9.3.0, contains a use of a broken or risky cryptographic algorithm. An unprivileged network attacker could exploit this vulnerab… |
CVE-2022-22550 | Medium | 6.7 | 2022-04-12 | Dell PowerScale OneFS, versions 8.2.2 and above, contain a password disclosure vulnerability. An unprivileged local attacker could potentially exploit this vul… |
CVE-2022-22549 | High | 7.5 | 2022-04-12 | Dell PowerScale OneFS, 8.2.x-9.3.x, contains a Improper Certificate Validation. A unauthenticated remote attacker could potentially exploit this vulnerability… |
CVE-2022-28795 | Medium | 6.5 | 2022-04-12 | A vulnerability within the Avira Password Manager Browser Extensions provided a potential loophole where, if a user visited a page crafted by an attacker, the… |
CVE-2022-28773 | High | 7.5 | 2022-04-12 | Due to an uncontrolled recursion in SAP Web Dispatcher and SAP Internet Communication Manager, the application may crash, leading to denial of service, but can… |
CVE-2022-28772 | High | 7.5 | 2022-04-12 | By overlong input values an attacker may force overwrite of the internal program stack in SAP Web Dispatcher - versions 7.53, 7.77, 7.81, 7.85, 7.86, or Intern… |
CVE-2022-28770 | Medium | 6.1 | 2022-04-12 | Due to insufficient input validation, SAPUI5 library(vbm) - versions 750, 753, 754, 755, 75, allows an unauthenticated attacker to inject a script into the URL… |
CVE-2022-28397 | Critical | 9.8 | 2022-04-12 | An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file. NOTE: Vend… |
CVE-2022-28216 | Medium | 6.1 | 2022-04-12 | SAP BusinessObjects Business Intelligence Platform (BI Workspace) - version 420, is susceptible to a Cross-Site Scripting attack by an unauthenticated attacker… |
CVE-2022-28215 | Medium | 4.7 | 2022-04-12 | SAP NetWeaver ABAP Server and ABAP Platform - versions 740, 750, 787, allows an unauthenticated attacker to redirect users to a malicious site due to insuffici… |
CVE-2022-28213 | High | 8.1 | 2022-04-12 | When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does not sufficiently validate the XML docume… |
CVE-2022-27952 | Critical | 9.8 | 2022-04-12 | An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafted SVG file. |
CVE-2022-27671 | Medium | 6.5 | 2022-04-12 | A CSRF token visible in the URL may possibly lead to information disclosure vulnerability. |
CVE-2022-27670 | Medium | 6.5 | 2022-04-12 | SAP SQL Anywhere - version 17.0, allows an authenticated attacker to prevent legitimate users from accessing a SQL Anywhere database server by crashing the ser… |
CVE-2022-27669 | High | 7.5 | 2022-04-12 | An unauthenticated user can use functions of XML Data Archiving Service of SAP NetWeaver Application Server for Java - version 7.50, to which access should be… |
CVE-2022-27667 | High | 7.5 | 2022-04-12 | Under certain conditions, SAP BusinessObjects Business Intelligence platform, Client Management Console (CMC) - version 430, allows an attacker to access infor… |
CVE-2022-27657 | Low | 2.7 | 2022-04-12 | A highly privileged remote attacker, can gain unauthorized access to display contents of restricted directories by exploiting insufficient validation of path i… |
CVE-2022-27655 | Medium | 6.5 | 2022-04-12 | When a user opens a manipulated Universal 3D (.u3d, 3difr.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the applicatio… |
CVE-2022-27654 | Medium | 6.5 | 2022-04-12 | When a user opens a manipulated Photoshop Document (.psd, 2d.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the applica… |
CVE-2022-27263 | Critical | 9.8 | 2022-04-12 | An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted file. |
CVE-2022-27262 | Critical | 9.8 | 2022-04-12 | An arbitrary file upload vulnerability in the file upload module of Skipper v0.9.1 allows attackers to execute arbitrary code via a crafted file. |
CVE-2022-27261 | High | 7.5 | 2022-04-12 | An arbitrary file write vulnerability in Express-FileUpload v1.3.1 allows attackers to upload multiple files with the same name, causing an overwrite of files… |
CVE-2022-27260 | Critical | 9.8 | 2022-04-12 | An arbitrary file upload vulnerability in the file upload component of ButterCMS v1.2.8 allows attackers to execute arbitrary code via a crafted SVG file. |
CVE-2022-27140 | Critical | 9.8 | 2022-04-12 | An arbitrary file upload vulnerability in the file upload module of express-fileupload 1.3.1 allows attackers to execute arbitrary code via a crafted PHP file… |
CVE-2022-27139 | Critical | 9.8 | 2022-04-12 | An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary code via a crafted SVG file. NOTE: Vend… |
CVE-2022-26109 | Medium | 6.5 | 2022-04-12 | When a user opens a manipulated Portable Document Format (.pdf, PDFView.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0… |
CVE-2022-26108 | Medium | 6.5 | 2022-04-12 | When a user opens a manipulated Picture Exchange (.pcx, 2d.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the applicati… |
CVE-2022-26107 | Medium | 6.5 | 2022-04-12 | When a user opens a manipulated Jupiter Tesselation (.jt, JTReader.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the a… |
CVE-2022-26106 | Medium | 6.5 | 2022-04-12 | When a user opens a manipulated Computer Graphics Metafile (.cgm, CgmCore.dll) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0… |
CVE-2022-26105 | Medium | 6.1 | 2022-04-12 | SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, is susceptible to script execution attack by an unauthenticated attacker d… |
CVE-2022-24812 | High | 8.0 | 2022-04-12 | Grafana is an open-source platform for monitoring and observability. When fine-grained access control is enabled and a client uses Grafana API Key to make requ… |
CVE-2022-24383 | High | 7.8 | 2022-04-12 | The affected product is vulnerable to an out-of-bounds read, which may result in code execution |
CVE-2022-23703 | High | 7.5 | 2022-04-12 | A security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays, HPE Nimble Storage All Flash Arrays and HPE Nimble Storage Secondary Fl… |
CVE-2022-23702 | Medium | 6.7 | 2022-04-12 | A potential security vulnerability has been identified in HPE Superdome Flex and Superdome Flex 280 Servers. The vulnerability could be locally exploited to al… |
CVE-2022-22541 | Medium | 6.5 | 2022-04-12 | SAP BusinessObjects Business Intelligence Platform - versions 420, 430, may allow legitimate users to access information they shouldn't see through relational… |
CVE-2022-21228 | High | 7.8 | 2022-04-12 | The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code. |
CVE-2022-21214 | High | 7.8 | 2022-04-12 | The affected product is vulnerable to a heap-based buffer overflow, which may lead to code execution. |
CVE-2022-21202 | Low | 3.3 | 2022-04-12 | The affected product is vulnerable to an out-of-bounds read, which may result in disclosure of sensitive information. |
CVE-2022-21168 | Low | 3.3 | 2022-04-12 | The affected product is vulnerable due to an invalid pointer initialization, which may lead to information disclosure. |
CVE-2022-21155 | High | 7.5 | 2022-04-12 | A specially crafted packet sent to the Fernhill SCADA Server Version 3.77 and earlier may cause an exception, causing the server process (FHSvrService.exe) to… |
CVE-2022-28036 | Critical | 9.8 | 2022-04-12 | AtomCMS 2.0 is vulnerable to SQL Injection via Atom.CMS_admin_ajax_navigation.php |
CVE-2022-28035 | Critical | 9.8 | 2022-04-12 | Atom.CMS 2.0 is vulnerable to SQL Injection via Atom.CMS_admin_ajax_blur-save.php |
CVE-2022-28034 | Critical | 9.8 | 2022-04-12 | AtomCMS 2.0 is vulnerabie to SQL Injection via Atom.CMS_admin_ajax_list-sort.php |
CVE-2022-28033 | Critical | 9.8 | 2022-04-12 | Atom.CMS 2.0 is vulnerable to SQL Injection via Atom.CMS_admin_uploads.php |
CVE-2022-28032 | Critical | 9.8 | 2022-04-12 | AtomCMS 2.0 is vulnerable to SQL Injection via Atom.CMS_admin_ajax_pages.php |
CVE-2022-27473 | Critical | 9.8 | 2022-04-12 | SQL injection vulnerability in Topics Searching feature of Roothub 2.6.0 allows unauthorized attackers to execute arbitrary SQL commands via the "s" parameter… |
CVE-2022-27472 | Critical | 9.8 | 2022-04-12 | SQL injection vulnerability in Topics Counting feature of Roothub 2.6.0 allows unauthorized attackers to execute arbitrary SQL commands via the "s" parameter r… |
CVE-2022-27165 | Critical | 9.8 | 2022-04-12 | CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Plugin_manager_setstatus |
CVE-2022-27164 | Critical | 9.8 | 2022-04-12 | CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Users_viewUsers |
CVE-2022-27163 | Critical | 9.8 | 2022-04-12 | CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Users_editUser |
CVE-2022-27162 | Critical | 9.8 | 2022-04-12 | CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Members_editUser |
CVE-2022-27161 | Critical | 9.8 | 2022-04-12 | Csz Cms 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Members_viewUsers |