2022 CVEs (page 229)
Page 229 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-25831 | Low | 2.0 | 2022-04-11 | Improper access control vulnerability in S Secure prior to SMR Apr-2022 Release 1 allows physical attackers to access secured data in certain conditions. |
CVE-2022-25796 | High | 7.8 | 2022-04-11 | A Double Free vulnerability allows remote malicious actors to execute arbitrary code on DWF file in Autodesk Navisworks 2022 within affected installations. Use… |
CVE-2022-25794 | High | 7.8 | 2022-04-11 | An Out-Of-Bounds Read Vulnerability in Autodesk FBX Review version 1.5.2 and prior may lead to code execution through maliciously crafted ActionScript Byte Cod… |
CVE-2022-25792 | High | 7.8 | 2022-04-11 | A maliciously crafted DXF file in Autodesk AutoCAD 2022, 2021, 2020, 2019 and Autodesk Navisworks 2022 can be used to write beyond the allocated buffer through… |
CVE-2022-25791 | High | 7.8 | 2022-04-11 | A Memory Corruption vulnerability for DWF and DWFX files in Autodesk AutoCAD 2022, 2021, 2020, 2019 and Autodesk Navisworks 2022 may lead to code execution thr… |
CVE-2022-25790 | High | 7.8 | 2022-04-11 | A maliciously crafted DWF file in Autodesk AutoCAD 2022, 2021, 2020, 2019 and Autodesk Navisworks 2022 can be used to write beyond the allocated boundaries whe… |
CVE-2022-25789 | High | 7.8 | 2022-04-11 | A maliciously crafted DWF, 3DS and DWFX files in Autodesk AutoCAD 2022, 2021, 2020, 2019 can be used to trigger use-after-free vulnerability. Exploitation of t… |
CVE-2022-25615 | Medium | 4.3 | 2022-04-11 | Cross-Site Request Forgery (CSRF) in StylemixThemes eRoom – Zoom Meetings & Webinar (WordPress plugin) <= 1.3.8 allows cache deletion. |
CVE-2022-25614 | Medium | 4.3 | 2022-04-11 | Cross-Site Request Forgery (CSRF) in StylemixThemes eRoom – Zoom Meetings & Webinar (WordPress plugin) <= 1.3.7 allows an attacker to Sync with Zoom Meetings. |
CVE-2022-24829 | High | 8.1 | 2022-04-11 | Garden is an automation platform for Kubernetes development and testing. In versions prior to 0.12.39 multiple endpoints did not require authentication. In som… |
CVE-2022-24815 | High | 8.1 | 2022-04-11 | JHipster is a development platform to quickly generate, develop, & deploy modern web applications & microservice architectures. SQL Injection vulnerability in… |
CVE-2022-24804 | Medium | 5.3 | 2022-04-11 | Discourse is an open source platform for community discussion. In stable versions prior to 2.8.3 and beta versions prior 2.9.0.beta4 erroneously expose groups… |
CVE-2022-22964 | High | 7.8 | 2022-04-11 | VMware Horizon Agent for Linux (prior to 22.x) contains a local privilege escalation that allows a user to escalate to root due to a vulnerable configuration f… |
CVE-2022-22962 | High | 7.8 | 2022-04-11 | VMware Horizon Agent for Linux (prior to 22.x) contains a local privilege escalation as a user is able to change the default shared folder location due to a vu… |
CVE-2022-22954 | Critical | 9.8 | 2022-04-11 | VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with ne… |
CVE-2022-22572 | High | 8.8 | 2022-04-11 | A non-admin user with user management permission can escalate his privilege to admin user via password reset functionality. The vulnerability affects Incapptic… |
CVE-2022-22571 | Medium | 4.8 | 2022-04-11 | An authenticated high privileged user can perform a stored XSS attack due to incorrect output encoding in Incapptic connect and affects all current versions. |
CVE-2022-22258 | Critical | 9.8 | 2022-04-11 | The Wi-Fi module has an event notification vulnerability.Successful exploitation of this vulnerability may allow third-party applications to intercept event no… |
CVE-2022-22257 | High | 7.5 | 2022-04-11 | The customization framework has a vulnerability of improper permission control.Successful exploitation of this vulnerability may affect data integrity. |
CVE-2022-22256 | High | 7.5 | 2022-04-11 | The DFX module has an access control vulnerability.Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2022-22255 | High | 7.5 | 2022-04-11 | The application framework has a common DoS vulnerability.Successful exploitation of this vulnerability may affect the availability. |
CVE-2022-22254 | High | 7.5 | 2022-04-11 | A permission bypass vulnerability exists when the NFC CAs access the TEE.Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2022-22253 | High | 7.5 | 2022-04-11 | The DFX module has a vulnerability of improper validation of integrity check values.Successful exploitation of this vulnerability may affect system stability. |
CVE-2022-20081 | Medium | 5.9 | 2022-04-11 | In A-GPS, there is a possible man in the middle attack due to improper certificate validation. This could lead to remote information disclosure with no additio… |
CVE-2022-20080 | Medium | 6.4 | 2022-04-11 | In SUB2AF, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges nee… |
CVE-2022-20079 | Medium | 4.4 | 2022-04-11 | In vow, there is a possible read of uninitialized data due to a improper input validation. This could lead to local information disclosure with System executio… |
CVE-2022-20078 | Medium | 6.4 | 2022-04-11 | In vow, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2022-20077 | Medium | 6.4 | 2022-04-11 | In vow, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2022-20076 | Medium | 4.4 | 2022-04-11 | In ged, there is a possible memory corruption due to an incorrect error handling. This could lead to local information disclosure with System execution privile… |
CVE-2022-20075 | Medium | 6.7 | 2022-04-11 | In ged, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges n… |
CVE-2022-20074 | Medium | 6.6 | 2022-04-11 | In preloader (partition), there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, for an attac… |
CVE-2022-20073 | Medium | 6.6 | 2022-04-11 | In preloader (usb), there is a possible out of bounds write due to a integer underflow. This could lead to local escalation of privilege, for an attacker who h… |
CVE-2022-20072 | Medium | 6.7 | 2022-04-11 | In search engine service, there is a possible way to change the default search engine due to an incorrect comparison. This could lead to local escalation of pr… |
CVE-2022-20071 | Medium | 6.7 | 2022-04-11 | In ccu, there is a possible escalation of privilege due to a missing certificate validation. This could lead to local escalation of privilege with System execu… |
CVE-2022-20070 | Medium | 6.7 | 2022-04-11 | In ssmr, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileg… |
CVE-2022-20069 | Medium | 6.6 | 2022-04-11 | In preloader (usb), there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege, for an attacker who h… |
CVE-2022-20068 | Medium | 6.7 | 2022-04-11 | In mobile_log_d, there is a possible symbolic link following due to an improper link resolution. This could lead to local escalation of privilege with System e… |
CVE-2022-20067 | Medium | 6.7 | 2022-04-11 | In mdp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2022-20066 | Medium | 4.4 | 2022-04-11 | In atf (hwfde), there is a possible leak of sensitive information due to incorrect error handling. This could lead to local information disclosure with System… |
CVE-2022-20065 | Medium | 6.7 | 2022-04-11 | In ccci, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges… |
CVE-2022-20064 | Medium | 6.7 | 2022-04-11 | In ccci, there is a possible leak of kernel pointer due to an incorrect bounds check. This could lead to local information disclosure with System execution pri… |
CVE-2022-20063 | Medium | 6.5 | 2022-04-11 | In atf (spm), there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution pri… |
CVE-2022-20062 | Medium | 6.7 | 2022-04-11 | In mdp, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2022-20052 | Medium | 6.5 | 2022-04-11 | In mdp, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2022-1316 | High | 8.8 | 2022-04-11 | Incorrect Permission Assignment for Critical Resource in GitHub repository zerotier/zerotierone prior to 1.8.8. Local Privilege Escalation |
CVE-2022-1262 | High | 7.8 | 2022-04-11 | A command injection vulnerability in the protest binary allows an attacker with access to the remote command line interface to execute arbitrary commands as ro… |
CVE-2022-1193 | Medium | 4.3 | 2022-04-11 | Improper access control in GitLab CE/EE versions 10.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows a malicious actor to obtain detail… |
CVE-2022-1161 | Critical | 10.0 | 2022-04-11 | An attacker with the ability to modify a user program may change user program code on some ControlLogix, CompactLogix, and GuardLogix Control systems. Studio 5… |
CVE-2022-1157 | Low | 2.6 | 2022-04-11 | Missing sanitization of logged exception messages in all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 of GitLab CE/EE causes potent… |
CVE-2022-1067 | Medium | 6.5 | 2022-04-11 | Navigating to a specific URL with a patient ID number will result in the server generating a PDF of a lab report without authentication and rate limiting. |
CVE-2022-0999 | High | 8.8 | 2022-04-11 | An authenticated user may be able to misuse parameters to inject arbitrary operating system commands into mySCADA myPRO versions 8.25.0 and prior. |
CVE-2022-0835 | High | 8.1 | 2022-04-11 | AVEVA System Platform 2020 stores sensitive information in cleartext, which may allow access to an attacker or a low-privileged user. |
CVE-2022-0552 | Medium | 5.9 | 2022-04-11 | A flaw was found in the original fix for the netty-codec-http CVE-2021-21409, where the OpenShift Logging openshift-logging/elasticsearch6-rhel8 container was… |
CVE-2022-29035 | Low | 3.3 | 2022-04-11 | In JetBrains Ktor Native before version 2.0.0 random values used for nonce generation weren't using SecureRandom implementations |
CVE-2022-27156 | Medium | 5.4 | 2022-04-11 | Daylight Studio Fuel CMS 1.5.1 is vulnerable to HTML Injection. |
CVE-2022-27115 | Critical | 9.8 | 2022-04-11 | In Studio-42 elFinder 2.1.60, there is a vulnerability that causes remote code execution through file name bypass for file upload. |
CVE-2022-27111 | Medium | 5.4 | 2022-04-11 | Jfinal_CMS 5.1.0 allows attackers to use the feedback function to send malicious XSS code to the administrator backend and execute it. |
CVE-2022-1023 | High | 7.2 | 2022-04-11 | The Podcast Importer SecondLine WordPress plugin before 1.3.8 does not sanitise and properly escape some imported data, which could allow SQL injection attacks… |
CVE-2022-1008 | High | 7.2 | 2022-04-11 | The One Click Demo Import WordPress plugin before 3.1.0 does not validate the imported file, allowing high privilege users such as admin to upload arbitrary fi… |
CVE-2022-1007 | Medium | 6.1 | 2022-04-11 | The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the room parameter before outputting it back in an admin page, leading… |
CVE-2022-1006 | High | 7.2 | 2022-04-11 | The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the id parameter when editing Calendars, which could allow high privil… |
CVE-2022-0989 | High | 7.5 | 2022-04-11 | An unprivileged user could use the functionality of the NS WooCommerce Watermark WordPress plugin through 2.11.3 to load images that hide malware for example f… |
CVE-2022-0969 | Medium | 4.8 | 2022-04-11 | The Image optimization & Lazy Load by Optimole WordPress plugin before 3.3.2 does not sanitise and escape its "Lazyload background images for selectors" settin… |
CVE-2022-0949 | Critical | 9.8 | 2022-04-11 | The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 6.930 does not properly sanitise and escape the fing… |
CVE-2022-0920 | High | 7.5 | 2022-04-11 | The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its endpoints, which could allow customers to… |
CVE-2022-0919 | Medium | 5.3 | 2022-04-11 | The Salon booking system Free and pro WordPress plugins before 7.6.3 do not have proper authorisation when searching bookings, allowing any unauthenticated use… |
CVE-2022-0914 | Medium | 6.5 | 2022-04-11 | The Export All URLs WordPress plugin before 4.3 does not have CSRF in place when exporting data, which could allow attackers to make a logged in admin export a… |
CVE-2022-0892 | Medium | 6.1 | 2022-04-11 | The Export All URLs WordPress plugin before 4.2 does not sanitise and escape the CSV filename before outputting it back in the page, leading to a Reflected Cro… |
CVE-2022-0840 | Medium | 4.8 | 2022-04-11 | The Easy Social Icons WordPress plugin before 3.2.1 does not properly escape the image_file field when adding a new social icon, allowing high privileged users… |
CVE-2022-0828 | High | 7.5 | 2022-04-11 | The Download Manager WordPress plugin before 3.2.34 uses the uniqid php function to generate the master key for a download, allowing an attacker to brute force… |
CVE-2022-0728 | Medium | 4.8 | 2022-04-11 | The Easy Smooth Scroll Links WordPress plugin before 2.23.1 does not sanitise and escape its settings, which could allow high privilege users such as admin to… |
CVE-2022-0531 | Medium | 6.1 | 2022-04-11 | The Migration, Backup, Staging WordPress plugin before 0.9.70 does not sanitise and escape the sub_page parameter before outputting it back in the page, leadin… |
CVE-2022-0471 | Medium | 6.1 | 2022-04-11 | The Favicon by RealFaviconGenerator WordPress plugin before 1.3.23 does not properly sanitise and escape the json_result_url parameter before outputting it bac… |
CVE-2022-0447 | Medium | 6.4 | 2022-04-11 | The Post Grid WordPress plugin before 2.1.16 does not sanitise and escape the post_types parameter before outputting it back in the response of the post_grid_u… |
CVE-2022-0314 | Medium | 6.1 | 2022-04-11 | The Nimble Page Builder WordPress plugin before 3.2.2 does not sanitise and escape the preview-level-guid parameter before outputting it back in the page, lead… |
CVE-2022-0271 | Medium | 6.1 | 2022-04-11 | The LearnPress WordPress plugin before 4.1.6 does not sanitise and escape the lp-dismiss-notice before outputting it back via the lp_background_single_email AJ… |
CVE-2022-0246 | Medium | 4.9 | 2022-04-11 | The settings of the iQ Block Country WordPress plugin before 1.2.13 can be exported or imported using its backup functionality. An authorized user can import p… |
CVE-2022-27089 | High | 7.8 | 2022-04-11 | In Fujitsu PlugFree Network <= 7.3.0.3, an Unquoted service path in PFNService.exe software allows a local attacker to potentially escalate privileges to syste… |
CVE-2022-27088 | High | 7.8 | 2022-04-11 | Ivanti DSM Remote <= 6.3.1.1862 is vulnerable to an unquoted service path allowing local users to launch processes with elevated privileges. |
CVE-2022-27041 | High | 7.5 | 2022-04-11 | Due to lack of protection, parameter student_id in OpenSIS Classic 8.0 /modules/eligibility/Student.php can be used to inject SQL queries to extract informatio… |
CVE-2022-26414 | Medium | 6.0 | 2022-04-11 | A potential buffer overflow vulnerability was identified in some internal functions of Zyxel VMG3312-T20A firmware version 5.30(ABFX.5)C0, which could be explo… |
CVE-2022-26413 | High | 8.0 | 2022-04-11 | A command injection vulnerability in the CGI program of Zyxel VMG3312-T20A firmware version 5.30(ABFX.5)C0 could allow a local authenticated attacker to execut… |
CVE-2022-1297 | Critical | 9.1 | 2022-04-11 | Out-of-bounds Read in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability may allow attackers to read s… |
CVE-2022-1296 | Critical | 9.1 | 2022-04-11 | Out-of-bounds read in `r_bin_ne_get_relocs` function in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability may allow attackers to read sens… |
CVE-2022-1295 | Critical | 9.8 | 2022-04-11 | Prototype Pollution in GitHub repository alvarotrigo/fullpage.js prior to 4.0.2. |
CVE-2022-0556 | High | 7.3 | 2022-04-11 | A local privilege escalation vulnerability caused by incorrect permission assignment in some directories of the Zyxel AP Configurator (ZAC) version 1.1.4, whic… |
CVE-2022-1252 | High | 8.2 | 2022-04-11 | Use of a Broken or Risky Cryptographic Algorithm in GitHub repository gnuboard/gnuboard5 prior to and including 5.5.5. A vulnerability in gnuboard v5.5.5 and b… |
CVE-2022-1045 | Medium | 5.4 | 2022-04-11 | Stored XSS viva .svg file upload in GitHub repository polonel/trudesk prior to v1.2.0. |
CVE-2022-0936 | Medium | 5.4 | 2022-04-11 | Cross-site Scripting (XSS) - Stored in GitHub repository autolab/autolab prior to 2.8.0. |
CVE-2022-28893 | High | 7.8 | 2022-04-11 | The SUNRPC subsystem in the Linux kernel through 5.17.2 can call xs_xprt_free before ensuring that sockets are in the intended state. |
CVE-2022-27961 | Medium | 5.4 | 2022-04-10 | A cross-site scripting (XSS) vulnerability at /ofcms/company-c-47 in OFCMS v1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted paylo… |
CVE-2022-27960 | Medium | 5.4 | 2022-04-10 | Insecure permissions configured in the user_id parameter at SysUserController.java of OFCMS v1.1.4 allows attackers to access and arbitrarily modify users' per… |
CVE-2022-27958 | Medium | 5.4 | 2022-04-10 | Insecure permissions configured in the userid parameter at /user/getuserprofile of FEBS-Security v1.0 allows attackers to access and arbitrarily modify users'… |
CVE-2022-27477 | Critical | 9.8 | 2022-04-10 | Newbee-Mall v1.0.0 was discovered to contain an arbitrary file upload via the Upload function at /admin/goods/edit. |
CVE-2022-27476 | Medium | 6.1 | 2022-04-10 | A cross-site scripting (XSS) vulnerability at /admin/goods/update in Newbee-Mall v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted… |
CVE-2022-27295 | High | 7.5 | 2022-04-10 | D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formAdvanceSetup. This vulnerability allows attackers to cause a Denial of S… |
CVE-2022-27294 | High | 7.5 | 2022-04-10 | D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formWlanWizardSetup. This vulnerability allows attackers to cause a Denial o… |
CVE-2022-27293 | High | 7.5 | 2022-04-10 | D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formWlanSetup. This vulnerability allows attackers to cause a Denial of Serv… |
CVE-2022-27292 | High | 7.5 | 2022-04-10 | D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formLanguageChange. This vulnerability allows attackers to cause a Denial of… |
CVE-2022-27291 | High | 7.5 | 2022-04-10 | D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formdumpeasysetup. This vulnerability allows attackers to cause a Denial of… |