2022 CVEs (page 230)
Page 230 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-27290 | High | 7.5 | 2022-04-10 | D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formSetWanDhcpplus. This vulnerability allows attackers to cause a Denial of… |
CVE-2022-27289 | High | 7.5 | 2022-04-10 | D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formSetWanL2TP. This vulnerability allows attackers to cause a Denial of Ser… |
CVE-2022-27288 | High | 7.5 | 2022-04-10 | D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formSetWanPPTP. This vulnerability allows attackers to cause a Denial of Ser… |
CVE-2022-27287 | High | 7.5 | 2022-04-10 | D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formSetWanPPPoE. This vulnerability allows attackers to cause a Denial of Se… |
CVE-2022-27286 | High | 7.5 | 2022-04-10 | D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formSetWanNonLogin. This vulnerability allows attackers to cause a Denial of… |
CVE-2022-27280 | Medium | 5.4 | 2022-04-10 | InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the web_… |
CVE-2022-27279 | High | 7.5 | 2022-04-10 | InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain an arbitrary file read via the function sub_177E0. |
CVE-2022-27277 | Critical | 9.1 | 2022-04-10 | InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain an arbitrary file deletion vulnerability via the function sub_… |
CVE-2022-27276 | Critical | 9.8 | 2022-04-10 | InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the function s… |
CVE-2022-27275 | Critical | 9.8 | 2022-04-10 | InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the function s… |
CVE-2022-27274 | Critical | 9.8 | 2022-04-10 | InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the function s… |
CVE-2022-27273 | Critical | 9.8 | 2022-04-10 | InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the function s… |
CVE-2022-27272 | Critical | 9.8 | 2022-04-10 | InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the function s… |
CVE-2022-27271 | Critical | 9.8 | 2022-04-10 | InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the component… |
CVE-2022-27270 | Critical | 9.8 | 2022-04-10 | InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the component… |
CVE-2022-27269 | Critical | 9.8 | 2022-04-10 | InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the component… |
CVE-2022-27268 | Critical | 9.8 | 2022-04-10 | InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the component… |
CVE-2022-27133 | Critical | 9.1 | 2022-04-10 | zbzcms v1.0 was discovered to contain an arbitrary file deletion vulnerability via /include/up.php. |
CVE-2022-27131 | Critical | 9.8 | 2022-04-10 | An arbitrary file upload vulnerability at /zbzedit/php/zbz.php in zbzcms v1.0 allows attackers to execute arbitrary code via a crafted PHP file. |
CVE-2022-27129 | Critical | 9.8 | 2022-04-10 | An arbitrary file upload vulnerability at /admin/ajax.php in zbzcms v1.0 allows attackers to execute arbitrary code via a crafted PHP file. |
CVE-2022-27128 | Critical | 9.8 | 2022-04-10 | An incorrect access control issue at /admin/run_ajax.php in zbzcms v1.0 allows attackers to arbitrarily add administrator accounts. |
CVE-2022-27127 | Medium | 6.5 | 2022-04-10 | zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php/ajax.php. |
CVE-2022-27126 | Critical | 9.8 | 2022-04-10 | zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the art parameter at /include/make.php. |
CVE-2022-27125 | Medium | 6.1 | 2022-04-10 | zbzcms v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the neirong parameter at /php/ajax.php. |
CVE-2022-1291 | Medium | 5.4 | 2022-04-10 | XSS vulnerability with default `onCellHtmlData` function in GitHub repository hhurz/tableexport.jquery.plugin prior to 1.25.0. Transmitting cookies to third-pa… |
CVE-2022-1290 | Medium | 5.4 | 2022-04-10 | Stored XSS in "Name", "Group Name" & "Title" in GitHub repository polonel/trudesk prior to v1.2.0. This allows attackers to execute malicious scripts in the us… |
CVE-2022-1289 | Medium | 4.3 | 2022-04-10 | A denial of service vulnerability was found in tildearrow Furnace. It has been classified as problematic. This is due to an incomplete fix of CVE-2022-1211. It… |
CVE-2022-1286 | Critical | 9.8 | 2022-04-10 | heap-buffer-overflow in mrb_vm_exec in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited. |
CVE-2022-1276 | Critical | 9.8 | 2022-04-10 | Out-of-bounds Read in mrb_get_args in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited. |
CVE-2022-1288 | Medium | 4.3 | 2022-04-09 | A vulnerability, which was classified as problematic, has been found in School Club Application System 1.0. This issue affects access to /scas/admin/. The mani… |
CVE-2022-1287 | Medium | 6.5 | 2022-04-09 | A vulnerability classified as critical was found in School Club Application System 1.0. This vulnerability affects a request to the file /scas/classes/Users.ph… |
CVE-2022-28365 | Medium | 5.3 | 2022-04-09 | Reprise License Manager 14.2 is affected by an Information Disclosure vulnerability via a GET request to /goforms/rlminfo. No authentication is required. The i… |
CVE-2022-28364 | Medium | 5.4 | 2022-04-09 | Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability (XSS) in the /goform/rlmswitchr_process file parameter via GET. Auth… |
CVE-2022-28363 | Medium | 6.1 | 2022-04-09 | Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability (XSS) in the /goform/login_process username parameter via GET. No au… |
CVE-2022-26877 | Medium | 6.5 | 2022-04-09 | Asana Desktop before 1.6.0 allows remote attackers to exfiltrate local files if they can trick the Asana desktop app into loading a malicious web page. |
CVE-2022-27883 | High | 7.3 | 2022-04-09 | A link following vulnerability in Trend Micro Antivirus for Mac 11.5 could allow an attacker to create a specially-crafted file as a symlink that can lead to p… |
CVE-2022-26588 | Medium | 6.5 | 2022-04-08 | A Cross-Site Request Forgery (CSRF) in IceHrm 31.0.0.OS allows attackers to delete arbitrary users or achieve account takeover via the app/service.php URI. |
CVE-2022-26180 | High | 8.8 | 2022-04-08 | qdPM 9.2 allows Cross-Site Request Forgery (CSRF) via the index.php/myAccount/update URI. |
CVE-2022-26855 | Medium | 5.5 | 2022-04-08 | Dell PowerScale OneFS, versions 8.2.x-9.3.0.x, contains an incorrect default permissions vulnerability. A local malicious user could potentially exploit this v… |
CVE-2022-26854 | High | 8.1 | 2022-04-08 | Dell PowerScale OneFS, versions 8.2.x-9.2.x, contain risky cryptographic algorithms. A remote unprivileged malicious attacker could potentially exploit this vu… |
CVE-2022-26852 | High | 8.1 | 2022-04-08 | Dell PowerScale OneFS, versions 8.2.x-9.3.x, contain a predictable seed in pseudo-random number generator. A remote unauthenticated attacker could potentially… |
CVE-2022-26851 | Critical | 9.1 | 2022-04-08 | Dell PowerScale OneFS, 8.2.2-9.3.x, contains a predictable file name from observable state vulnerability. An unprivileged network attacker could potentially ex… |
CVE-2022-24820 | Medium | 5.3 | 2022-04-08 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to view pages of the wi… |
CVE-2022-24819 | Medium | 5.3 | 2022-04-08 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to view pages of the wi… |
CVE-2022-24428 | Medium | 6.3 | 2022-04-08 | Dell PowerScale OneFS, versions 8.2.x, 9.0.0.x, 9.1.0.x, 9.2.0.x, 9.2.1.x, and 9.3.0.x, contain an improper preservation of privileges. A remote filesystem use… |
CVE-2022-22563 | Medium | 4.4 | 2022-04-08 | Dell EMC Powerscale OneFS 8.2.x - 9.2.x omit security-relevant information in /etc/master.passwd. A high-privileged user can exploit this vulnerability to not… |
CVE-2022-24821 | Medium | 6.8 | 2022-04-08 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Simple users can create global SSX/JSX without specifi… |
CVE-2022-1284 | Medium | 5.5 | 2022-04-08 | heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of inducing denial of service. |
CVE-2022-27152 | Medium | 5.7 | 2022-04-08 | Roku devices running RokuOS v9.4.0 build 4200 or earlier that uses a Realtek WiFi chip is vulnerable to Arbitrary file modification. |
CVE-2022-1283 | Medium | 5.5 | 2022-04-08 | NULL Pointer Dereference in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability allows attackers to cau… |
CVE-2022-27148 | Medium | 5.5 | 2022-04-08 | GPAC mp4box 1.1.0-DEV-rev1663-g881c6a94a-master is vulnerable to Integer Overflow. |
CVE-2022-27147 | Medium | 5.5 | 2022-04-08 | GPAC mp4box 1.1.0-DEV-rev1727-g8be34973d-master has a use-after-free vulnerability in function gf_node_get_attribute_by_tag. |
CVE-2022-27146 | Medium | 5.5 | 2022-04-08 | GPAC mp4box 1.1.0-DEV-rev1759-geb2d1e6dd-has a heap-buffer-overflow vulnerability in function gf_isom_apple_enum_tag. |
CVE-2022-27145 | Medium | 5.5 | 2022-04-08 | GPAC mp4box 1.1.0-DEV-rev1727-g8be34973d-master has a stack-overflow vulnerability in function gf_isom_get_sample_for_movie_time of mp4box. |
CVE-2022-27047 | Critical | 9.8 | 2022-04-08 | mogu_blog_cms 5.2 suffers from upload arbitrary files without any limitation. |
CVE-2022-22339 | High | 7.3 | 2022-04-08 | IBM Planning Analytics 2.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the… |
CVE-2022-27046 | High | 8.8 | 2022-04-08 | libsixel 1.8.6 suffers from a Heap Use After Free vulnerability in in libsixel/src/dither.c:388. |
CVE-2022-27044 | High | 8.8 | 2022-04-08 | libsixel 1.8.6 is affected by Buffer Overflow in libsixel/src/quant.c:876. |
CVE-2022-24229 | Medium | 6.1 | 2022-04-08 | A cross-site scripting (XSS) vulnerability in ONLYOFFICE Document Server Example before v7.0.0 allows remote attackers inject arbitrary HTML or JavaScript thro… |
CVE-2022-28002 | High | 7.5 | 2022-04-08 | Movie Seat Reservation v1 was discovered to contain an unauthenticated file disclosure vulnerability via /index.php?page=home. |
CVE-2022-28001 | Critical | 9.8 | 2022-04-08 | Movie Seat Reservation v1 was discovered to contain a SQL injection vulnerability at /index.php?page=reserve via the id parameter. |
CVE-2022-28000 | High | 8.8 | 2022-04-08 | Car Rental System v1.0 was discovered to contain a SQL injection vulnerability at /Car_Rental/booking.php via the id parameter. |
CVE-2022-27992 | High | 8.8 | 2022-04-08 | Zoo Management System v1.0 was discovered to contain a SQL injection vulnerability at /public_html/animals via the class_id parameter. |
CVE-2022-27991 | Medium | 6.5 | 2022-04-08 | Online Banking System in PHP v1 was discovered to contain multiple SQL injection vulnerabilities at /staff_login.php via the Staff ID and Staff Password parame… |
CVE-2022-27357 | Critical | 9.8 | 2022-04-08 | Ecommerce-Website v1 was discovered to contain an arbitrary file upload vulnerability via /customer_register.php. This vulnerability allows attackers to execut… |
CVE-2022-27352 | High | 8.8 | 2022-04-08 | Simple House Rental System v1 was discovered to contain an arbitrary file upload vulnerability via /app/register.php. This vulnerability allows attackers to ex… |
CVE-2022-27351 | Critical | 9.8 | 2022-04-08 | Zoo Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via /public_html/apply_vacancy. This vulnerability allows attackers… |
CVE-2022-27349 | High | 7.2 | 2022-04-08 | Social Codia SMS v1 was discovered to contain an arbitrary file upload vulnerability via addteacher.php. This vulnerability allows attackers to execute arbitra… |
CVE-2022-27348 | Medium | 4.8 | 2022-04-08 | Social Codia SMS v1 was discovered to contain a stored cross-site scripting (XSS) vulnerability via add_post.php. This vulnerability allows attackers to execut… |
CVE-2022-27346 | High | 8.8 | 2022-04-08 | Ecommece-Website v1.1.0 was discovered to contain an arbitrary file upload vulnerability via /admin/index.php?slides. This vulnerability allows attackers to ex… |
CVE-2022-27064 | High | 8.8 | 2022-04-08 | Musical World v1 was discovered to contain an arbitrary file upload vulnerability via uploaded_songs.php. This vulnerability allows attackers to execute arbitr… |
CVE-2022-27063 | Medium | 6.1 | 2022-04-08 | AeroCMS v0.0.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability via view_all_comments.php. This vulnerability allows attackers to ex… |
CVE-2022-27062 | Medium | 4.8 | 2022-04-08 | AeroCMS v0.0.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability via add_post.php. This vulnerability allows attackers to execute arb… |
CVE-2022-27061 | High | 7.2 | 2022-04-08 | AeroCMS v0.0.1 was discovered to contain an arbitrary file upload vulnerability via the Post Image function under the Admin panel. This vulnerability allows at… |
CVE-2022-26624 | Medium | 6.1 | 2022-04-08 | Bootstrap v3.1.11 and v3.3.7 was discovered to contain a cross-site scripting (XSS) vulnerability via the Title parameter in /vendor/views/add_product.php. |
CVE-2022-1219 | High | 7.5 | 2022-04-08 | SQL injection in RecyclebinController.php in GitHub repository pimcore/pimcore prior to 10.3.5. This vulnerability is capable of steal the data |
CVE-2022-28805 | Critical | 9.1 | 2022-04-08 | singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read t… |
CVE-2022-28796 | High | 7.0 | 2022-04-08 | jbd2_journal_wait_updates in fs/jbd2/transaction.c in the Linux kernel before 5.17.1 has a use-after-free caused by a transaction_t race condition. |
CVE-2022-24681 | Medium | 6.1 | 2022-04-07 | Zoho ManageEngine ADSelfService Plus before 6121 allows XSS via the welcome name attribute to the Reset Password, Unlock Account, or User Must Change Password… |
CVE-2022-26676 | Critical | 9.8 | 2022-04-07 | aEnrich a+HRD has inadequate privilege restrictions, an unauthenticated remote attacker can use the API function to upload and execute malicious scripts to con… |
CVE-2022-26675 | High | 7.5 | 2022-04-07 | aEnrich a+HRD has inadequate filtering for special characters in URLs. An unauthenticated remote attacker can bypass authentication and perform path traversal… |
CVE-2022-26671 | High | 7.3 | 2022-04-07 | Taiwan Secom Dr.ID Access Control system’s login page has a hard-coded credential in the source code. An unauthenticated remote attacker can use the hard-coded… |
CVE-2022-26670 | High | 8.8 | 2022-04-07 | D-Link DIR-878 has inadequate filtering for special characters in the webpage input field. An unauthenticated LAN attacker can perform command injection attack… |
CVE-2022-26612 | Critical | 9.8 | 2022-04-07 | In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes. As a result, a TAR entry may… |
CVE-2022-25597 | High | 8.8 | 2022-04-07 | ASUS RT-AC86U’s LPD service has insufficient filtering for special characters in the user request, which allows an unauthenticated LAN attacker to perform comm… |
CVE-2022-25596 | High | 8.8 | 2022-04-07 | ASUS RT-AC56U’s configuration function has a heap-based buffer overflow vulnerability due to insufficient validation for the decryption parameter length, which… |
CVE-2022-25595 | Medium | 6.5 | 2022-04-07 | ASUS RT-AC86U has improper user request handling, which allows an unauthenticated LAN attacker to cause a denial of service by sending particular request a ser… |
CVE-2022-25594 | Medium | 5.3 | 2022-04-07 | Microprogram’s parking lot management system is vulnerable to sensitive information exposure. An unauthorized remote attacker can input specific URLs to acquir… |
CVE-2022-23973 | High | 8.8 | 2022-04-07 | ASUS RT-AX56U’s user profile configuration function is vulnerable to stack-based buffer overflow due to insufficient validation for parameter length. An unauth… |
CVE-2022-23972 | High | 8.8 | 2022-04-07 | ASUS RT-AX56U’s SQL handling function has an SQL injection vulnerability due to insufficient user input validation. An unauthenticated LAN attacker to inject a… |
CVE-2022-23971 | High | 8.1 | 2022-04-07 | ASUS RT-AX56U’s update_PLC/PORT file has a path traversal vulnerability due to insufficient filtering for special characters in the URL parameter. An unauthent… |
CVE-2022-23970 | High | 8.1 | 2022-04-07 | ASUS RT-AX56U’s update_json function has a path traversal vulnerability due to insufficient filtering for special characters in the URL parameter. An unauthent… |
CVE-2022-22519 | High | 7.5 | 2022-04-07 | A remote, unauthenticated attacker can send a specific crafted HTTP or HTTPS requests causing a buffer over-read resulting in a crash of the webserver of the C… |
CVE-2022-22518 | Medium | 6.5 | 2022-04-07 | A bug in CmpUserMgr component can lead to only partially applied security policies. This can result in enabled, anonymous access to components part of the appl… |
CVE-2022-22517 | High | 7.5 | 2022-04-07 | An unauthenticated, remote attacker can disrupt existing communication channels between CODESYS products by guessing a valid channel ID and injecting packets… |
CVE-2022-22516 | High | 7.8 | 2022-04-07 | The SysDrv3S driver in the CODESYS Control runtime system on Microsoft Windows allows any system user to read and write within restricted memory space. |
CVE-2022-22515 | High | 8.1 | 2022-04-07 | A remote, authenticated attacker could utilize the control program of the CODESYS Control runtime system to use the vulnerability in order to read and modify t… |
CVE-2022-22514 | High | 7.1 | 2022-04-07 | An authenticated, remote attacker can gain access to a dereferenced pointer contained in a request. The accesses can subsequently lead to local overwriting of… |
CVE-2022-22513 | Medium | 6.5 | 2022-04-07 | An authenticated remote attacker can cause a null pointer dereference in the CmpSettings component of the affected CODESYS products which leads to a crash. |
CVE-2022-0935 | High | 8.8 | 2022-04-07 | Host Header injection in password Reset in GitHub repository livehelperchat/livehelperchat prior to 3.97. |