2022 CVEs (page 230)
Page 230 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-26414 | Medium | 6.0 | 2022-04-11 | A potential buffer overflow vulnerability was identified in some internal functions of Zyxel VMG3312-T20A firmware version 5.30(ABFX.5)C0, which could be explo… |
CVE-2022-26413 | High | 8.0 | 2022-04-11 | A command injection vulnerability in the CGI program of Zyxel VMG3312-T20A firmware version 5.30(ABFX.5)C0 could allow a local authenticated attacker to execut… |
CVE-2022-1297 | Critical | 9.1 | 2022-04-11 | Out-of-bounds Read in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability may allow attackers to read s… |
CVE-2022-1296 | Critical | 9.1 | 2022-04-11 | Out-of-bounds read in `r_bin_ne_get_relocs` function in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability may allow attackers to read sens… |
CVE-2022-1295 | Critical | 9.8 | 2022-04-11 | Prototype Pollution in GitHub repository alvarotrigo/fullpage.js prior to 4.0.2. |
CVE-2022-0556 | High | 7.3 | 2022-04-11 | A local privilege escalation vulnerability caused by incorrect permission assignment in some directories of the Zyxel AP Configurator (ZAC) version 1.1.4, whic… |
CVE-2022-1252 | High | 8.2 | 2022-04-11 | Use of a Broken or Risky Cryptographic Algorithm in GitHub repository gnuboard/gnuboard5 prior to and including 5.5.5. A vulnerability in gnuboard v5.5.5 and b… |
CVE-2022-1045 | Medium | 5.4 | 2022-04-11 | Stored XSS viva .svg file upload in GitHub repository polonel/trudesk prior to v1.2.0. |
CVE-2022-0936 | Medium | 5.4 | 2022-04-11 | Cross-site Scripting (XSS) - Stored in GitHub repository autolab/autolab prior to 2.8.0. |
CVE-2022-28893 | High | 7.8 | 2022-04-11 | The SUNRPC subsystem in the Linux kernel through 5.17.2 can call xs_xprt_free before ensuring that sockets are in the intended state. |
CVE-2022-27961 | Medium | 5.4 | 2022-04-10 | A cross-site scripting (XSS) vulnerability at /ofcms/company-c-47 in OFCMS v1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted paylo… |
CVE-2022-27960 | Medium | 5.4 | 2022-04-10 | Insecure permissions configured in the user_id parameter at SysUserController.java of OFCMS v1.1.4 allows attackers to access and arbitrarily modify users' per… |
CVE-2022-27958 | Medium | 5.4 | 2022-04-10 | Insecure permissions configured in the userid parameter at /user/getuserprofile of FEBS-Security v1.0 allows attackers to access and arbitrarily modify users'… |
CVE-2022-27477 | Critical | 9.8 | 2022-04-10 | Newbee-Mall v1.0.0 was discovered to contain an arbitrary file upload via the Upload function at /admin/goods/edit. |
CVE-2022-27476 | Medium | 6.1 | 2022-04-10 | A cross-site scripting (XSS) vulnerability at /admin/goods/update in Newbee-Mall v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted… |
CVE-2022-27295 | High | 7.5 | 2022-04-10 | D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formAdvanceSetup. This vulnerability allows attackers to cause a Denial of S… |
CVE-2022-27294 | High | 7.5 | 2022-04-10 | D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formWlanWizardSetup. This vulnerability allows attackers to cause a Denial o… |
CVE-2022-27293 | High | 7.5 | 2022-04-10 | D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formWlanSetup. This vulnerability allows attackers to cause a Denial of Serv… |
CVE-2022-27292 | High | 7.5 | 2022-04-10 | D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formLanguageChange. This vulnerability allows attackers to cause a Denial of… |
CVE-2022-27291 | High | 7.5 | 2022-04-10 | D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formdumpeasysetup. This vulnerability allows attackers to cause a Denial of… |
CVE-2022-27290 | High | 7.5 | 2022-04-10 | D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formSetWanDhcpplus. This vulnerability allows attackers to cause a Denial of… |
CVE-2022-27289 | High | 7.5 | 2022-04-10 | D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formSetWanL2TP. This vulnerability allows attackers to cause a Denial of Ser… |
CVE-2022-27288 | High | 7.5 | 2022-04-10 | D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formSetWanPPTP. This vulnerability allows attackers to cause a Denial of Ser… |
CVE-2022-27287 | High | 7.5 | 2022-04-10 | D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formSetWanPPPoE. This vulnerability allows attackers to cause a Denial of Se… |
CVE-2022-27286 | High | 7.5 | 2022-04-10 | D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formSetWanNonLogin. This vulnerability allows attackers to cause a Denial of… |
CVE-2022-27280 | Medium | 5.4 | 2022-04-10 | InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the web_… |
CVE-2022-27279 | High | 7.5 | 2022-04-10 | InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain an arbitrary file read via the function sub_177E0. |
CVE-2022-27277 | Critical | 9.1 | 2022-04-10 | InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain an arbitrary file deletion vulnerability via the function sub_… |
CVE-2022-27276 | Critical | 9.8 | 2022-04-10 | InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the function s… |
CVE-2022-27275 | Critical | 9.8 | 2022-04-10 | InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the function s… |
CVE-2022-27274 | Critical | 9.8 | 2022-04-10 | InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the function s… |
CVE-2022-27273 | Critical | 9.8 | 2022-04-10 | InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the function s… |
CVE-2022-27272 | Critical | 9.8 | 2022-04-10 | InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the function s… |
CVE-2022-27271 | Critical | 9.8 | 2022-04-10 | InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the component… |
CVE-2022-27270 | Critical | 9.8 | 2022-04-10 | InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the component… |
CVE-2022-27269 | Critical | 9.8 | 2022-04-10 | InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the component… |
CVE-2022-27268 | Critical | 9.8 | 2022-04-10 | InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability via the component… |
CVE-2022-27133 | Critical | 9.1 | 2022-04-10 | zbzcms v1.0 was discovered to contain an arbitrary file deletion vulnerability via /include/up.php. |
CVE-2022-27131 | Critical | 9.8 | 2022-04-10 | An arbitrary file upload vulnerability at /zbzedit/php/zbz.php in zbzcms v1.0 allows attackers to execute arbitrary code via a crafted PHP file. |
CVE-2022-27129 | Critical | 9.8 | 2022-04-10 | An arbitrary file upload vulnerability at /admin/ajax.php in zbzcms v1.0 allows attackers to execute arbitrary code via a crafted PHP file. |
CVE-2022-27128 | Critical | 9.8 | 2022-04-10 | An incorrect access control issue at /admin/run_ajax.php in zbzcms v1.0 allows attackers to arbitrarily add administrator accounts. |
CVE-2022-27127 | Medium | 6.5 | 2022-04-10 | zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php/ajax.php. |
CVE-2022-27126 | Critical | 9.8 | 2022-04-10 | zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the art parameter at /include/make.php. |
CVE-2022-27125 | Medium | 6.1 | 2022-04-10 | zbzcms v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the neirong parameter at /php/ajax.php. |
CVE-2022-1291 | Medium | 5.4 | 2022-04-10 | XSS vulnerability with default `onCellHtmlData` function in GitHub repository hhurz/tableexport.jquery.plugin prior to 1.25.0. Transmitting cookies to third-pa… |
CVE-2022-1290 | Medium | 5.4 | 2022-04-10 | Stored XSS in "Name", "Group Name" & "Title" in GitHub repository polonel/trudesk prior to v1.2.0. This allows attackers to execute malicious scripts in the us… |
CVE-2022-1289 | Medium | 4.3 | 2022-04-10 | A denial of service vulnerability was found in tildearrow Furnace. It has been classified as problematic. This is due to an incomplete fix of CVE-2022-1211. It… |
CVE-2022-1286 | Critical | 9.8 | 2022-04-10 | heap-buffer-overflow in mrb_vm_exec in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited. |
CVE-2022-1276 | Critical | 9.8 | 2022-04-10 | Out-of-bounds Read in mrb_get_args in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited. |
CVE-2022-1288 | Medium | 4.3 | 2022-04-09 | A vulnerability, which was classified as problematic, has been found in School Club Application System 1.0. This issue affects access to /scas/admin/. The mani… |
CVE-2022-1287 | Medium | 6.5 | 2022-04-09 | A vulnerability classified as critical was found in School Club Application System 1.0. This vulnerability affects a request to the file /scas/classes/Users.ph… |
CVE-2022-28365 | Medium | 5.3 | 2022-04-09 | Reprise License Manager 14.2 is affected by an Information Disclosure vulnerability via a GET request to /goforms/rlminfo. No authentication is required. The i… |
CVE-2022-28364 | Medium | 5.4 | 2022-04-09 | Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability (XSS) in the /goform/rlmswitchr_process file parameter via GET. Auth… |
CVE-2022-28363 | Medium | 6.1 | 2022-04-09 | Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability (XSS) in the /goform/login_process username parameter via GET. No au… |
CVE-2022-26877 | Medium | 6.5 | 2022-04-09 | Asana Desktop before 1.6.0 allows remote attackers to exfiltrate local files if they can trick the Asana desktop app into loading a malicious web page. |
CVE-2022-27883 | High | 7.3 | 2022-04-09 | A link following vulnerability in Trend Micro Antivirus for Mac 11.5 could allow an attacker to create a specially-crafted file as a symlink that can lead to p… |
CVE-2022-26588 | Medium | 6.5 | 2022-04-08 | A Cross-Site Request Forgery (CSRF) in IceHrm 31.0.0.OS allows attackers to delete arbitrary users or achieve account takeover via the app/service.php URI. |
CVE-2022-26180 | High | 8.8 | 2022-04-08 | qdPM 9.2 allows Cross-Site Request Forgery (CSRF) via the index.php/myAccount/update URI. |
CVE-2022-26855 | Medium | 5.5 | 2022-04-08 | Dell PowerScale OneFS, versions 8.2.x-9.3.0.x, contains an incorrect default permissions vulnerability. A local malicious user could potentially exploit this v… |
CVE-2022-26854 | High | 8.1 | 2022-04-08 | Dell PowerScale OneFS, versions 8.2.x-9.2.x, contain risky cryptographic algorithms. A remote unprivileged malicious attacker could potentially exploit this vu… |
CVE-2022-26852 | High | 8.1 | 2022-04-08 | Dell PowerScale OneFS, versions 8.2.x-9.3.x, contain a predictable seed in pseudo-random number generator. A remote unauthenticated attacker could potentially… |
CVE-2022-26851 | Critical | 9.1 | 2022-04-08 | Dell PowerScale OneFS, 8.2.2-9.3.x, contains a predictable file name from observable state vulnerability. An unprivileged network attacker could potentially ex… |
CVE-2022-24820 | Medium | 5.3 | 2022-04-08 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to view pages of the wi… |
CVE-2022-24819 | Medium | 5.3 | 2022-04-08 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to view pages of the wi… |
CVE-2022-24428 | Medium | 6.3 | 2022-04-08 | Dell PowerScale OneFS, versions 8.2.x, 9.0.0.x, 9.1.0.x, 9.2.0.x, 9.2.1.x, and 9.3.0.x, contain an improper preservation of privileges. A remote filesystem use… |
CVE-2022-22563 | Medium | 4.4 | 2022-04-08 | Dell EMC Powerscale OneFS 8.2.x - 9.2.x omit security-relevant information in /etc/master.passwd. A high-privileged user can exploit this vulnerability to not… |
CVE-2022-24821 | Medium | 6.8 | 2022-04-08 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Simple users can create global SSX/JSX without specifi… |
CVE-2022-1284 | Medium | 5.5 | 2022-04-08 | heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of inducing denial of service. |
CVE-2022-27152 | Medium | 5.7 | 2022-04-08 | Roku devices running RokuOS v9.4.0 build 4200 or earlier that uses a Realtek WiFi chip is vulnerable to Arbitrary file modification. |
CVE-2022-1283 | Medium | 5.5 | 2022-04-08 | NULL Pointer Dereference in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability allows attackers to cau… |
CVE-2022-27148 | Medium | 5.5 | 2022-04-08 | GPAC mp4box 1.1.0-DEV-rev1663-g881c6a94a-master is vulnerable to Integer Overflow. |
CVE-2022-27147 | Medium | 5.5 | 2022-04-08 | GPAC mp4box 1.1.0-DEV-rev1727-g8be34973d-master has a use-after-free vulnerability in function gf_node_get_attribute_by_tag. |
CVE-2022-27146 | Medium | 5.5 | 2022-04-08 | GPAC mp4box 1.1.0-DEV-rev1759-geb2d1e6dd-has a heap-buffer-overflow vulnerability in function gf_isom_apple_enum_tag. |
CVE-2022-27145 | Medium | 5.5 | 2022-04-08 | GPAC mp4box 1.1.0-DEV-rev1727-g8be34973d-master has a stack-overflow vulnerability in function gf_isom_get_sample_for_movie_time of mp4box. |
CVE-2022-27047 | Critical | 9.8 | 2022-04-08 | mogu_blog_cms 5.2 suffers from upload arbitrary files without any limitation. |
CVE-2022-22339 | High | 7.3 | 2022-04-08 | IBM Planning Analytics 2.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the… |
CVE-2022-27046 | High | 8.8 | 2022-04-08 | libsixel 1.8.6 suffers from a Heap Use After Free vulnerability in in libsixel/src/dither.c:388. |
CVE-2022-27044 | High | 8.8 | 2022-04-08 | libsixel 1.8.6 is affected by Buffer Overflow in libsixel/src/quant.c:876. |
CVE-2022-24229 | Medium | 6.1 | 2022-04-08 | A cross-site scripting (XSS) vulnerability in ONLYOFFICE Document Server Example before v7.0.0 allows remote attackers inject arbitrary HTML or JavaScript thro… |
CVE-2022-28002 | High | 7.5 | 2022-04-08 | Movie Seat Reservation v1 was discovered to contain an unauthenticated file disclosure vulnerability via /index.php?page=home. |
CVE-2022-28001 | Critical | 9.8 | 2022-04-08 | Movie Seat Reservation v1 was discovered to contain a SQL injection vulnerability at /index.php?page=reserve via the id parameter. |
CVE-2022-28000 | High | 8.8 | 2022-04-08 | Car Rental System v1.0 was discovered to contain a SQL injection vulnerability at /Car_Rental/booking.php via the id parameter. |
CVE-2022-27992 | High | 8.8 | 2022-04-08 | Zoo Management System v1.0 was discovered to contain a SQL injection vulnerability at /public_html/animals via the class_id parameter. |
CVE-2022-27991 | Medium | 6.5 | 2022-04-08 | Online Banking System in PHP v1 was discovered to contain multiple SQL injection vulnerabilities at /staff_login.php via the Staff ID and Staff Password parame… |
CVE-2022-27357 | Critical | 9.8 | 2022-04-08 | Ecommerce-Website v1 was discovered to contain an arbitrary file upload vulnerability via /customer_register.php. This vulnerability allows attackers to execut… |
CVE-2022-27352 | High | 8.8 | 2022-04-08 | Simple House Rental System v1 was discovered to contain an arbitrary file upload vulnerability via /app/register.php. This vulnerability allows attackers to ex… |
CVE-2022-27351 | Critical | 9.8 | 2022-04-08 | Zoo Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via /public_html/apply_vacancy. This vulnerability allows attackers… |
CVE-2022-27349 | High | 7.2 | 2022-04-08 | Social Codia SMS v1 was discovered to contain an arbitrary file upload vulnerability via addteacher.php. This vulnerability allows attackers to execute arbitra… |
CVE-2022-27348 | Medium | 4.8 | 2022-04-08 | Social Codia SMS v1 was discovered to contain a stored cross-site scripting (XSS) vulnerability via add_post.php. This vulnerability allows attackers to execut… |
CVE-2022-27346 | High | 8.8 | 2022-04-08 | Ecommece-Website v1.1.0 was discovered to contain an arbitrary file upload vulnerability via /admin/index.php?slides. This vulnerability allows attackers to ex… |
CVE-2022-27064 | High | 8.8 | 2022-04-08 | Musical World v1 was discovered to contain an arbitrary file upload vulnerability via uploaded_songs.php. This vulnerability allows attackers to execute arbitr… |
CVE-2022-27063 | Medium | 6.1 | 2022-04-08 | AeroCMS v0.0.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability via view_all_comments.php. This vulnerability allows attackers to ex… |
CVE-2022-27062 | Medium | 4.8 | 2022-04-08 | AeroCMS v0.0.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability via add_post.php. This vulnerability allows attackers to execute arb… |
CVE-2022-27061 | High | 7.2 | 2022-04-08 | AeroCMS v0.0.1 was discovered to contain an arbitrary file upload vulnerability via the Post Image function under the Admin panel. This vulnerability allows at… |
CVE-2022-26624 | Medium | 6.1 | 2022-04-08 | Bootstrap v3.1.11 and v3.3.7 was discovered to contain a cross-site scripting (XSS) vulnerability via the Title parameter in /vendor/views/add_product.php. |
CVE-2022-1219 | High | 7.5 | 2022-04-08 | SQL injection in RecyclebinController.php in GitHub repository pimcore/pimcore prior to 10.3.5. This vulnerability is capable of steal the data |
CVE-2022-28805 | Critical | 9.1 | 2022-04-08 | singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read t… |
CVE-2022-28796 | High | 7.0 | 2022-04-08 | jbd2_journal_wait_updates in fs/jbd2/transaction.c in the Linux kernel before 5.17.1 has a use-after-free caused by a transaction_t race condition. |
CVE-2022-24681 | Medium | 6.1 | 2022-04-07 | Zoho ManageEngine ADSelfService Plus before 6121 allows XSS via the welcome name attribute to the Reset Password, Unlock Account, or User Must Change Password… |
CVE-2022-26676 | Critical | 9.8 | 2022-04-07 | aEnrich a+HRD has inadequate privilege restrictions, an unauthenticated remote attacker can use the API function to upload and execute malicious scripts to con… |