2022 CVEs (page 231)
Page 231 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-0677 | High | 7.5 | 2022-04-07 | Improper Handling of Length Parameter Inconsistency vulnerability in the Update Server component of Bitdefender Endpoint Security Tools (in relay role), Gravit… |
CVE-2022-27022 | Critical | 9.8 | 2022-04-07 | There is a stack overflow vulnerability in the SetSysTimeCfg() function in the httpd service of Tenda AC9 V15.03.2.21_cn. The attacker can obtain a stable root… |
CVE-2022-27016 | Critical | 9.8 | 2022-04-07 | There is a stack overflow vulnerability in the SetStaticRouteCfg() function in the httpd service of Tenda AC9 15.03.2.21_cn. |
CVE-2022-26627 | High | 8.8 | 2022-04-07 | Online Project Time Management System v1.0 was discovered to contain an arbitrary file write vulnerability which allows attackers to execute arbitrary code via… |
CVE-2022-25339 | Medium | 5.5 | 2022-04-07 | ownCloud owncloud/android 2.20 has Incorrect Access Control for local attackers. |
CVE-2022-25338 | Medium | 6.8 | 2022-04-07 | ownCloud owncloud/android before 2.20 has Incorrect Access Control for physically proximate attackers. |
CVE-2022-23900 | Critical | 9.8 | 2022-04-07 | A command injection vulnerability in the API of the Wavlink WL-WN531P3 router, version M31G3.V5030.201204, allows an attacker to achieve unauthorized remote co… |
CVE-2022-27819 | Medium | 5.3 | 2022-04-07 | SWHKD 1.1.5 allows unsafe parsing via the -c option. An information leak might occur but there is a simple denial of service (memory exhaustion) upon an attemp… |
CVE-2022-27818 | Critical | 9.1 | 2022-04-07 | SWHKD 1.1.5 unsafely uses the /tmp/swhkd.sock pathname. There can be an information leak or denial of service. |
CVE-2022-26613 | Critical | 9.8 | 2022-04-06 | PHP-CMS v1.0 was discovered to contain a SQL injection vulnerability via the category parameter in categorymenu.php. |
CVE-2022-26607 | High | 7.2 | 2022-04-06 | A remote code execution (RCE) vulnerability in baigo CMS v3.0-alpha-2 was discovered to allow attackers to execute arbitrary code via uploading a crafted PHP f… |
CVE-2022-26605 | High | 8.8 | 2022-04-06 | eZiosuite v2.0.7 contains an authenticated arbitrary file upload via the Avatar upload functionality. |
CVE-2022-26591 | High | 7.5 | 2022-04-06 | FANTEC GmbH MWiD25-DS Firmware v2.000.030 allows unauthenticated attackers to access and download arbitrary files via a crafted GET request. |
CVE-2022-20782 | Medium | 6.5 | 2022-04-06 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive… |
CVE-2022-20781 | Medium | 5.4 | 2022-04-06 | A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) could allow an authenticated, remote att… |
CVE-2022-20774 | Medium | 6.8 | 2022-04-06 | A vulnerability in the web-based management interface of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware could allow an unauthenticated… |
CVE-2022-20763 | Medium | 5.4 | 2022-04-06 | A vulnerability in the login authorization components of Cisco Webex Meetings could allow an authenticated, remote attacker to inject arbitrary Java code. This… |
CVE-2022-20762 | High | 7.8 | 2022-04-06 | A vulnerability in the Common Execution Environment (CEE) ConfD CLI of Cisco Ultra Cloud Core - Subscriber Microservices Infrastructure (SMI) software could al… |
CVE-2022-20756 | High | 8.6 | 2022-04-06 | A vulnerability in the RADIUS feature of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause the affected system to s… |
CVE-2022-20755 | Critical | 9.0 | 2022-04-06 | Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) coul… |
CVE-2022-20754 | Critical | 9.0 | 2022-04-06 | Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) coul… |
CVE-2022-20741 | Medium | 5.4 | 2022-04-06 | A vulnerability in the web-based management interface of the Network Diagrams application for Cisco Secure Network Analytics, formerly Stealthwatch Enterprise… |
CVE-2022-20675 | Medium | 5.3 | 2022-04-06 | A vulnerability in the TCP/IP stack of Cisco Email Security Appliance (ESA), Cisco Web Security Appliance (WSA), and Cisco Secure Email and Web Manager, former… |
CVE-2022-20665 | Medium | 6.0 | 2022-04-06 | A vulnerability in the CLI of Cisco StarOS could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due… |
CVE-2022-26850 | Medium | 4.3 | 2022-04-06 | When creating or updating credentials for single-user access, Apache NiFi wrote a copy of the Login Identity Providers configuration to the operating system te… |
CVE-2022-24822 | High | 7.5 | 2022-04-06 | Podium is a library for building micro frontends. @podium/layout is a module for building a Podium layout server, and @podium/proxy is a module for proxying HT… |
CVE-2022-20784 | Medium | 5.8 | 2022-04-06 | A vulnerability in the Web-Based Reputation Score (WBRS) engine of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) could allow an unauthenticated… |
CVE-2022-22410 | High | 7.2 | 2022-04-06 | IBM Watson Query with Cloud Pak for Data as a Service could allow an authenticated user to obtain sensitive information that would allow them to examine or alt… |
CVE-2022-27110 | Medium | 5.4 | 2022-04-06 | OrangeHRM 4.10 is vulnerable to a Host header injection redirect via viewPersonalDetails endpoint. |
CVE-2022-27109 | Medium | 5.4 | 2022-04-06 | OrangeHRM 4.10 suffers from a Referer header injection redirect vulnerability. |
CVE-2022-27108 | Medium | 4.3 | 2022-04-06 | OrangeHRM 4.10 is vulnerable to Insecure Direct Object Reference (IDOR) via the end point symfony/web/index.php/time/createTimesheet`. Any user can create a ti… |
CVE-2022-27107 | Medium | 5.4 | 2022-04-06 | OrangeHRM 4.10 is vulnerable to Stored XSS in the "Share Video" section under "OrangeBuzz" via the GET/POST "createVideo[linkAddress]" parameter |
CVE-2022-24793 | High | 7.5 | 2022-04-06 | PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.12 and prior affects applications… |
CVE-2022-24786 | Critical | 9.8 | 2022-04-06 | PJSIP is a free and open source multimedia communication library written in C. PJSIP versions 2.12 and prior do not parse incoming RTCP feedback RPSI (Referenc… |
CVE-2022-1253 | Critical | 9.8 | 2022-04-06 | Heap-based Buffer Overflow in GitHub repository strukturag/libde265 prior to and including 1.0.8. The fix is established in commit 8e89fe0e175d2870c39486fdd092… |
CVE-2022-1240 | High | 7.8 | 2022-04-06 | Heap buffer overflow in libr/bin/format/mach0/mach0.c in GitHub repository radareorg/radare2 prior to 5.8.6. If address sanitizer is disabled during the compil… |
CVE-2022-23440 | High | 7.8 | 2022-04-06 | A use of hard-coded cryptographic key vulnerability [CWE-321] in the registration mechanism of FortiEDR collectors versions 5.0.2, 5.0.1, 5.0.0, 4.0.0 may allo… |
CVE-2022-1238 | High | 7.8 | 2022-04-06 | Out-of-bounds Write in libr/bin/format/ne/ne.c in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is heap overflow and may be exploitabl… |
CVE-2022-1237 | High | 7.8 | 2022-04-06 | Improper Validation of Array Index in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is heap overflow and may be exploitable. For more… |
CVE-2022-23446 | Medium | 4.4 | 2022-04-06 | A improper control of a resource through its lifetime in Fortinet FortiEDR version 5.0.3 and earlier allows attacker to make the whole application unresponsive… |
CVE-2022-23441 | Critical | 9.1 | 2022-04-06 | A use of hard-coded cryptographic key vulnerability [CWE-321] in FortiEDR versions 5.0.2, 5.0.1, 5.0.0, 4.0.0 may allow an unauthenticated attacker on the netw… |
CVE-2022-1234 | Medium | 6.1 | 2022-04-06 | XSS in livehelperchat in GitHub repository livehelperchat/livehelperchat prior to 3.97. This vulnerability has the potential to deface websites, result in comp… |
CVE-2022-1248 | High | 7.3 | 2022-04-06 | A vulnerability was found in SAP Information System 1.0 which has been rated as critical. Affected by this issue is the file /SAP_Information_System/controller… |
CVE-2022-26110 | High | 8.8 | 2022-04-06 | An issue was discovered in HTCondor 8.8.x before 8.8.16, 9.0.x before 9.0.10, and 9.1.x before 9.6.0. When a user authenticates to an HTCondor daemon via the C… |
CVE-2022-26953 | High | 7.5 | 2022-04-06 | Digi Passport Firmware through 1.5.1,1 is affected by a buffer overflow. An attacker can supply a string in the page parameter for reboot.asp endpoint, allowin… |
CVE-2022-26952 | High | 7.5 | 2022-04-06 | Digi Passport Firmware through 1.5.1,1 is affected by a buffer overflow in the function for building the Location header string when an unauthenticated user is… |
CVE-2022-26251 | High | 7.2 | 2022-04-06 | The HTTP interface of Synaman v5.1 and below was discovered to allow authenticated attackers to execute arbitrary code and escalate privileges. |
CVE-2022-26250 | High | 7.8 | 2022-04-06 | Synaman v5.1 and below was discovered to contain weak file permissions which allows authenticated attackers to escalate privileges. |
CVE-2022-28468 | Critical | 9.8 | 2022-04-05 | Payroll Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter. |
CVE-2022-28467 | Critical | 9.8 | 2022-04-05 | Online Student Admission v1.0 was discovered to contain a SQL injection vulnerability via the txtapplicationID parameter. |
CVE-2022-28116 | Critical | 9.8 | 2022-04-05 | Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter. |
CVE-2022-28115 | Critical | 9.8 | 2022-04-05 | Online Sports Complex Booking v1.0 was discovered to contain a SQL injection vulnerability via the id parameter. |
CVE-2022-27304 | Critical | 9.8 | 2022-04-05 | Student Grading System v1.0 was discovered to contain a SQL injection vulnerability via the user parameter. |
CVE-2022-27124 | Critical | 9.8 | 2022-04-05 | Insurance Management System 1.0 was discovered to contain a SQL injection vulnerability via the username parameter. |
CVE-2022-27123 | Critical | 9.8 | 2022-04-05 | Employee Performance Evaluation v1.0 was discovered to contain a SQL injection vulnerability via the email parameter. |
CVE-2022-26912 | High | 8.3 | 2022-04-05 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2022-26909 | High | 8.3 | 2022-04-05 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2022-26908 | High | 8.3 | 2022-04-05 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2022-26900 | High | 8.3 | 2022-04-05 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2022-26895 | High | 8.3 | 2022-04-05 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2022-26894 | High | 8.3 | 2022-04-05 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2022-26891 | High | 8.3 | 2022-04-05 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2022-26628 | Critical | 9.8 | 2022-04-05 | Matrimony v1.0 was discovered to contain a SQL injection vulnerability via the Password parameter. |
CVE-2022-24523 | Medium | 4.3 | 2022-04-05 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2022-24475 | High | 8.3 | 2022-04-05 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2022-23974 | High | 7.5 | 2022-04-05 | In 0.9.3 or older versions of Apache Pinot segment upload path allowed segment directories to be imported into pinot tables. In pinot installations that allow… |
CVE-2022-28219 | Critical | 9.8 | 2022-04-05 | Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution. |
CVE-2022-25373 | Medium | 5.4 | 2022-04-05 | Zoho ManageEngine SupportCenter Plus before 11020 allows Stored XSS in the request history. |
CVE-2022-25245 | Medium | 5.3 | 2022-04-05 | Zoho ManageEngine ServiceDesk Plus before 13001 allows anyone to know the organisation's default currency name. |
CVE-2022-24978 | High | 8.8 | 2022-04-05 | Zoho ManageEngine ADAudit Plus before 7055 allows authenticated Privilege Escalation on Integrated products. This occurs because a password field is present in… |
CVE-2022-24811 | Medium | 5.4 | 2022-04-05 | Combodi iTop is a web based IT Service Management tool. Prior to versions 2.7.6 and 3.0.0, cross-site scripting is possible for scripts outside of script tags… |
CVE-2022-24780 | High | 8.8 | 2022-04-05 | Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG code to the server by… |
CVE-2022-1244 | Medium | 5.5 | 2022-04-05 | heap-buffer-overflow in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of inducing denial of service. |
CVE-2022-28651 | High | 8.4 | 2022-04-05 | In JetBrains IntelliJ IDEA before 2021.3.3 it was possible to get passwords from protected fields |
CVE-2022-28650 | High | 7.3 | 2022-04-05 | In JetBrains YouTrack before 2022.1.43700 it was possible to inject JavaScript into Markdown in the YouTrack Classic UI |
CVE-2022-28649 | Medium | 4.6 | 2022-04-05 | In JetBrains YouTrack before 2022.1.43563 it was possible to include an iframe from a third-party domain in the issue description |
CVE-2022-28648 | Medium | 5.7 | 2022-04-05 | In JetBrains YouTrack before 2022.1.43563 HTML code from the issue description was being rendered |
CVE-2022-26630 | High | 8.8 | 2022-04-05 | Jellycms v3.8.1 and below was discovered to contain an arbitrary file upload vulnerability via \app.\admin\Controllers\db.php. |
CVE-2022-26635 | Critical | 9.8 | 2022-04-05 | PHP-Memcached v2.2.0 and below contains an improper NULL termination which allows attackers to execute CLRF injection. Note: Third parties have disputed this a… |
CVE-2022-22356 | Medium | 6.5 | 2022-04-05 | IBM MQ Appliance 9.2 CD and 9.2 LTS could allow an attacker to enumerate account credentials due to an observable discrepancy in valid and invalid login attemp… |
CVE-2022-22355 | Medium | 5.3 | 2022-04-05 | IBM MQ Appliance 9.2 CD and 9.2 LTS are vulnerable to a denial of service in the Login component of the application which could allow an attacker to cause a dr… |
CVE-2022-27463 | Medium | 6.1 | 2022-04-05 | Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a crafted url to the log… |
CVE-2022-27462 | Medium | 6.1 | 2022-04-05 | Cross Site Scripting (XSS) vulnerability in objects/function.php in function getDeviceID in WWBN AVideo through 11.6, via the yptDevice parameter to view/inclu… |
CVE-2022-24795 | Medium | 5.9 | 2022-04-05 | yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of `yajl` contain an integer overflow which leads t… |
CVE-2022-0602 | Medium | 5.4 | 2022-04-05 | Cross-site Scripting (XSS) - DOM in GitHub repository tastyigniter/tastyigniter prior to 3.3.0. |
CVE-2022-26986 | High | 7.2 | 2022-04-05 | SQL Injection in ImpressCMS 1.4.3 and earlier allows remote attackers to inject into the code in unintended way, this allows an attacker to read and modify the… |
CVE-2022-26982 | High | 7.2 | 2022-04-05 | SimpleMachinesForum 2.1.1 and earlier allows remote authenticated administrators to execute arbitrary code by inserting a vulnerable php code because the theme… |
CVE-2022-1243 | Medium | 6.1 | 2022-04-05 | CRHTLF can lead to invalid protocol extraction potentially leading to XSS in GitHub repository medialize/uri.js prior to 1.19.11. |
CVE-2022-26361 | High | 7.8 | 2022-04-05 | IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilitie… |
CVE-2022-26360 | High | 7.8 | 2022-04-05 | IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilitie… |
CVE-2022-26359 | High | 7.8 | 2022-04-05 | IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilitie… |
CVE-2022-26358 | High | 7.8 | 2022-04-05 | IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilitie… |
CVE-2022-26357 | High | 7.0 | 2022-04-05 | race in VT-d domain ID cleanup Xen domain IDs are up to 15 bits wide. VT-d hardware may allow for only less than 15 bits to hold a domain ID associating a phys… |
CVE-2022-26356 | Medium | 5.6 | 2022-04-05 | Racy interactions between dirty vram tracking and paging log dirty hypercalls Activation of log dirty mode done by XEN_DMOP_track_dirty_vram (was named HVMOP_t… |
CVE-2022-1236 | Medium | 6.5 | 2022-04-05 | Weak Password Requirements in GitHub repository weseek/growi prior to v5.0.0. |
CVE-2022-1235 | High | 8.2 | 2022-04-05 | Weak secrethash can be brute-forced in GitHub repository livehelperchat/livehelperchat prior to 3.96. |
CVE-2022-25154 | High | 7.3 | 2022-04-05 | A DLL hijacking vulnerability in Samsung portable SSD T5 PC software before 1.6.9 could allow a local attacker to escalate privileges. (An attacker must alread… |
CVE-2022-23909 | High | 7.8 | 2022-04-05 | There is an unquoted service path in Sherpa Connector Service (SherpaConnectorService.exe) 2020.2.20328.2050. This might allow a local user to escalate privile… |
CVE-2022-1213 | High | 8.1 | 2022-04-05 | SSRF filter bypass port 80, 433 in GitHub repository livehelperchat/livehelperchat prior to 3.67v. An attacker could make the application perform arbitrary req… |
CVE-2022-1212 | Critical | 9.8 | 2022-04-05 | Use-After-Free in str_escape in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited. |