2022 CVEs (page 232)
Page 232 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-22355 | Medium | 5.3 | 2022-04-05 | IBM MQ Appliance 9.2 CD and 9.2 LTS are vulnerable to a denial of service in the Login component of the application which could allow an attacker to cause a dr… |
CVE-2022-27463 | Medium | 6.1 | 2022-04-05 | Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a crafted url to the log… |
CVE-2022-27462 | Medium | 6.1 | 2022-04-05 | Cross Site Scripting (XSS) vulnerability in objects/function.php in function getDeviceID in WWBN AVideo through 11.6, via the yptDevice parameter to view/inclu… |
CVE-2022-24795 | Medium | 5.9 | 2022-04-05 | yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of `yajl` contain an integer overflow which leads t… |
CVE-2022-0602 | Medium | 5.4 | 2022-04-05 | Cross-site Scripting (XSS) - DOM in GitHub repository tastyigniter/tastyigniter prior to 3.3.0. |
CVE-2022-26986 | High | 7.2 | 2022-04-05 | SQL Injection in ImpressCMS 1.4.3 and earlier allows remote attackers to inject into the code in unintended way, this allows an attacker to read and modify the… |
CVE-2022-26982 | High | 7.2 | 2022-04-05 | SimpleMachinesForum 2.1.1 and earlier allows remote authenticated administrators to execute arbitrary code by inserting a vulnerable php code because the theme… |
CVE-2022-1243 | Medium | 6.1 | 2022-04-05 | CRHTLF can lead to invalid protocol extraction potentially leading to XSS in GitHub repository medialize/uri.js prior to 1.19.11. |
CVE-2022-26361 | High | 7.8 | 2022-04-05 | IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilitie… |
CVE-2022-26360 | High | 7.8 | 2022-04-05 | IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilitie… |
CVE-2022-26359 | High | 7.8 | 2022-04-05 | IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilitie… |
CVE-2022-26358 | High | 7.8 | 2022-04-05 | IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilitie… |
CVE-2022-26357 | High | 7.0 | 2022-04-05 | race in VT-d domain ID cleanup Xen domain IDs are up to 15 bits wide. VT-d hardware may allow for only less than 15 bits to hold a domain ID associating a phys… |
CVE-2022-26356 | Medium | 5.6 | 2022-04-05 | Racy interactions between dirty vram tracking and paging log dirty hypercalls Activation of log dirty mode done by XEN_DMOP_track_dirty_vram (was named HVMOP_t… |
CVE-2022-1236 | Medium | 6.5 | 2022-04-05 | Weak Password Requirements in GitHub repository weseek/growi prior to v5.0.0. |
CVE-2022-1235 | High | 8.2 | 2022-04-05 | Weak secrethash can be brute-forced in GitHub repository livehelperchat/livehelperchat prior to 3.96. |
CVE-2022-25154 | High | 7.3 | 2022-04-05 | A DLL hijacking vulnerability in Samsung portable SSD T5 PC software before 1.6.9 could allow a local attacker to escalate privileges. (An attacker must alread… |
CVE-2022-23909 | High | 7.8 | 2022-04-05 | There is an unquoted service path in Sherpa Connector Service (SherpaConnectorService.exe) 2020.2.20328.2050. This might allow a local user to escalate privile… |
CVE-2022-1213 | High | 8.1 | 2022-04-05 | SSRF filter bypass port 80, 433 in GitHub repository livehelperchat/livehelperchat prior to 3.67v. An attacker could make the application perform arbitrary req… |
CVE-2022-1212 | Critical | 9.8 | 2022-04-05 | Use-After-Free in str_escape in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited. |
CVE-2022-26615 | Medium | 5.4 | 2022-04-05 | A cross-site scripting (XSS) vulnerability in College Website Content Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a cr… |
CVE-2022-26281 | High | 7.5 | 2022-04-05 | BigAnt Server v5.6.06 was discovered to contain an incorrect access control issue. |
CVE-2022-25356 | Medium | 5.3 | 2022-04-05 | Alt-N MDaemon Security Gateway through 8.5.0 allows SecurityGateway.dll?view=login XML Injection. |
CVE-2022-24231 | Critical | 9.8 | 2022-04-05 | Simple Student Information System v1.0 was discovered to contain a SQL injection vulnerability via add/Student. |
CVE-2022-26619 | High | 7.5 | 2022-04-05 | Halo Blog CMS v1.4.17 was discovered to allow attackers to upload arbitrary files via the Attachment Upload function. |
CVE-2022-26585 | Critical | 9.8 | 2022-04-05 | Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability via /cms/content/list. |
CVE-2022-25584 | High | 7.5 | 2022-04-05 | Seyeon Tech Co., Ltd FlexWATCH FW3170-PS-E Network Video System 4.23-3000_GY allows attackers to access sensitive information. |
CVE-2022-0809 | High | 8.8 | 2022-04-05 | Out of bounds memory access in WebXR in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2022-0808 | High | 8.8 | 2022-04-05 | Use after free in Chrome OS Shell in Google Chrome on Chrome OS prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in a series of u… |
CVE-2022-0807 | Medium | 6.5 | 2022-04-05 | Inappropriate implementation in Autofill in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to bypass navigation restrictions via a crafted HTML… |
CVE-2022-0806 | Medium | 6.5 | 2022-04-05 | Data leak in Canvas in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in screen sharing to potentially leak cross… |
CVE-2022-0805 | High | 8.8 | 2022-04-05 | Use after free in Browser Switcher in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in specific user interaction… |
CVE-2022-0804 | Medium | 6.5 | 2022-04-05 | Inappropriate implementation in Full screen mode in Google Chrome on Android prior to 99.0.4844.51 allowed a remote attacker to hide the contents of the Omnibo… |
CVE-2022-0803 | Medium | 6.5 | 2022-04-05 | Inappropriate implementation in Permissions in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to tamper with the contents of the Omnibox (URL ba… |
CVE-2022-0802 | Medium | 6.5 | 2022-04-05 | Inappropriate implementation in Full screen mode in Google Chrome on Android prior to 99.0.4844.51 allowed a remote attacker to hide the contents of the Omnibo… |
CVE-2022-0800 | High | 8.8 | 2022-04-05 | Heap buffer overflow in Cast UI in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in specific user interaction to… |
CVE-2022-0799 | High | 8.8 | 2022-04-05 | Insufficient policy enforcement in Installer in Google Chrome on Windows prior to 99.0.4844.51 allowed a remote attacker to perform local privilege escalation… |
CVE-2022-0798 | High | 8.8 | 2022-04-05 | Use after free in MediaStream in Google Chrome prior to 99.0.4844.51 allowed an attacker who convinced a user to install a malicious extension to potentially e… |
CVE-2022-0797 | High | 8.8 | 2022-04-05 | Out of bounds memory access in Mojo in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to perform an out of bounds memory write via a crafted HTM… |
CVE-2022-0796 | High | 8.8 | 2022-04-05 | Use after free in Media in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-0795 | High | 8.8 | 2022-04-05 | Type confusion in Blink Layout in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-0794 | High | 8.8 | 2022-04-05 | Use after free in WebShare in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in specific user interaction to pote… |
CVE-2022-0793 | High | 8.8 | 2022-04-05 | Use after free in Cast in Google Chrome prior to 99.0.4844.51 allowed an attacker who convinced a user to install a malicious extension and engage in specific… |
CVE-2022-0792 | Medium | 6.5 | 2022-04-05 | Out of bounds read in ANGLE in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-0791 | High | 8.8 | 2022-04-05 | Use after free in Omnibox in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in specific user interactions to pote… |
CVE-2022-0790 | Critical | 9.6 | 2022-04-05 | Use after free in Cast UI in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in specific user interaction to poten… |
CVE-2022-0789 | High | 8.8 | 2022-04-05 | Heap buffer overflow in ANGLE in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-0470 | High | 8.8 | 2022-04-05 | Out of bounds memory access in V8 in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa… |
CVE-2022-0469 | High | 8.8 | 2022-04-05 | Use after free in Cast in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who convinced a user to engage in specific interactions to potentially… |
CVE-2022-0468 | High | 8.8 | 2022-04-05 | Use after free in Payments in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-0467 | High | 8.8 | 2022-04-05 | Inappropriate implementation in Pointer Lock in Google Chrome on Windows prior to 98.0.4758.80 allowed a remote attacker to bypass navigation restrictions via… |
CVE-2022-0466 | Critical | 9.6 | 2022-04-05 | Inappropriate implementation in Extensions Platform in Google Chrome prior to 98.0.4758.80 allowed an attacker who convinced a user to install a malicious exte… |
CVE-2022-0465 | High | 8.8 | 2022-04-05 | Use after free in Extensions in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via user interaction. |
CVE-2022-0464 | High | 8.8 | 2022-04-05 | Use after free in Accessibility in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who convinced a user to engage in specific user interaction to… |
CVE-2022-0463 | High | 8.8 | 2022-04-05 | Use after free in Accessibility in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who convinced a user to engage in specific user interaction to… |
CVE-2022-0462 | Medium | 6.5 | 2022-04-05 | Inappropriate implementation in Scroll in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2022-0461 | Medium | 6.5 | 2022-04-05 | Policy bypass in COOP in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to bypass iframe sandbox via a crafted HTML page. |
CVE-2022-0460 | High | 8.8 | 2022-04-05 | Use after free in Window Dialogue in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa… |
CVE-2022-0459 | High | 8.8 | 2022-04-05 | Use after free in Screen Capture in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who had compromised the renderer process and convinced a user… |
CVE-2022-0458 | High | 8.8 | 2022-04-05 | Use after free in Thumbnail Tab Strip in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTM… |
CVE-2022-0457 | High | 8.8 | 2022-04-05 | Type confusion in V8 in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-0456 | High | 8.8 | 2022-04-05 | Use after free in Web Search in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via profile destruction. |
CVE-2022-0455 | Medium | 6.5 | 2022-04-05 | Inappropriate implementation in Full Screen Mode in Google Chrome on Android prior to 98.0.4758.80 allowed a remote attacker to spoof the contents of the Omnib… |
CVE-2022-0454 | High | 8.8 | 2022-04-05 | Heap buffer overflow in ANGLE in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-0453 | High | 8.8 | 2022-04-05 | Use after free in Reader Mode in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who had compromised the renderer process to potentially exploit… |
CVE-2022-0452 | Critical | 9.6 | 2022-04-05 | Use after free in Safe Browsing in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML pag… |
CVE-2022-23732 | High | 8.8 | 2022-04-05 | A path traversal vulnerability was identified in GitHub Enterprise Server management console that allowed the bypass of CSRF protections. This could potentiall… |
CVE-2022-0610 | High | 8.8 | 2022-04-05 | Inappropriate implementation in Gamepad API in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a craf… |
CVE-2022-0609 | High | 8.8 | 2022-04-05 | Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-0608 | High | 8.8 | 2022-04-05 | Integer overflow in Mojo in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-0607 | High | 8.8 | 2022-04-05 | Use after free in GPU in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-0606 | High | 8.8 | 2022-04-05 | Use after free in ANGLE in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-0605 | High | 8.8 | 2022-04-05 | Use after free in Webstore API in Google Chrome prior to 98.0.4758.102 allowed an attacker who convinced a user to install a malicious extension and convinced… |
CVE-2022-0604 | High | 8.8 | 2022-04-05 | Heap buffer overflow in Tab Groups in Google Chrome prior to 98.0.4758.102 allowed an attacker who convinced a user to install a malicious extension and engage… |
CVE-2022-0603 | High | 8.8 | 2022-04-05 | Use after free in File Manager in Google Chrome on Chrome OS prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a craf… |
CVE-2022-27442 | High | 7.5 | 2022-04-04 | TPCMS v3.2 allows attackers to access the ThinkPHP log directory and obtain sensitive information such as the administrator's user name and password. |
CVE-2022-27441 | Medium | 4.8 | 2022-04-04 | A stored cross-site scripting (XSS) vulnerability in TPCMS v3.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into t… |
CVE-2022-27651 | Medium | 6.8 | 2022-04-04 | A flaw was found in buildah where containers were incorrectly started with non-empty default permissions. A bug was found in Moby (Docker Engine) where contain… |
CVE-2022-27650 | High | 7.5 | 2022-04-04 | A flaw was found in crun where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) where… |
CVE-2022-27649 | High | 7.5 | 2022-04-04 | A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), wh… |
CVE-2022-27609 | Medium | 6.0 | 2022-04-04 | Forcepoint One Endpoint prior to version 22.01 installed on Microsoft Windows does not provide sufficient anti-tampering protection of services by users with A… |
CVE-2022-27608 | Medium | 6.0 | 2022-04-04 | Forcepoint One Endpoint prior to version 22.01 installed on Microsoft Windows is vulnerable to registry key tampering by users with Administrator privileges. T… |
CVE-2022-25618 | Low | 3.4 | 2022-04-04 | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in wpDataTables (WordPress plugin) versions <= 2.1.27 |
CVE-2022-25613 | Medium | 4.1 | 2022-04-04 | Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in FV Flowplayer Video Player (WordPress plugin) versions <= 7.5.18.727 via &fv_wp_flowplayer… |
CVE-2022-23700 | Medium | 5.5 | 2022-04-04 | A local unauthorized read access to files vulnerability was discovered in HPE OneView version(s): Prior to 6.6. HPE has provided a software update to resolve t… |
CVE-2022-23699 | High | 7.8 | 2022-04-04 | A local authentication restriction bypass vulnerability was discovered in HPE OneView version(s): Prior to 6.6. HPE has provided a software update to resolve t… |
CVE-2022-23698 | High | 7.5 | 2022-04-04 | A remote unauthenticated disclosure of information vulnerability was discovered in HPE OneView version(s): Prior to 6.6. HPE has provided a software update to… |
CVE-2022-23697 | Medium | 6.1 | 2022-04-04 | A remote cross-site scripting (xss) vulnerability was discovered in HPE OneView version(s): Prior to 6.6. HPE has provided a software update to resolve this vu… |
CVE-2022-1233 | Medium | 6.1 | 2022-04-04 | URL Confusion When Scheme Not Supplied in GitHub repository medialize/uri.js prior to 1.19.11. |
CVE-2022-1190 | High | 8.7 | 2022-04-04 | Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to exploit a s… |
CVE-2022-1189 | Low | 3.1 | 2022-04-04 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.2 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versio… |
CVE-2022-1188 | Low | 3.7 | 2022-04-04 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.1 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versio… |
CVE-2022-1185 | Medium | 6.5 | 2022-04-04 | A denial of service vulnerability when rendering RDoc files in GitLab CE/EE versions 10 to 14.7.7, 14.8.0 to 14.8.5, and 14.9.0 to 14.9.2 allows an attacker to… |
CVE-2022-1175 | High | 8.7 | 2022-04-04 | Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14… |
CVE-2022-1174 | Medium | 4.3 | 2022-04-04 | A potential DoS vulnerability was discovered in Gitlab CE/EE versions 13.7 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting… |
CVE-2022-1162 | Critical | 9.1 | 2022-04-04 | A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 pr… |
CVE-2022-1148 | Medium | 5.3 | 2022-04-04 | Improper authorization in GitLab Pages included with GitLab CE/EE affecting all versions from 11.5 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14… |
CVE-2022-1121 | Medium | 5.3 | 2022-04-04 | A lack of appropriate timeouts in GitLab Pages included in GitLab CE/EE all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an… |
CVE-2022-1120 | Medium | 4.8 | 2022-04-04 | Missing filtering in an error message in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 exposed sensitive… |
CVE-2022-1111 | Low | 2.4 | 2022-04-04 | A business logic error in Project Import in GitLab CE/EE versions 14.9 prior to 14.9.2, 14.8 prior to 14.8.5, and 14.0 prior to 14.7.7 under certain conditions… |