2022 CVEs (page 234)
Page 234 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-27052 | High | 7.8 | 2022-03-31 | FreeFtpd version 1.0.13 and below contains an unquoted service path vulnerability which allows local users to launch processes with elevated privileges. |
CVE-2022-27050 | High | 7.8 | 2022-03-31 | BitComet Service for Windows before version 1.8.6 contains an unquoted service path vulnerability which allows attackers to escalate privileges to the system l… |
CVE-2022-27049 | Low | 2.0 | 2022-03-31 | Raidrive before v2021.12.35 allows attackers to arbitrarily move log files by pre-creating a mountpoint and log files before Raidrive is installed. |
CVE-2022-24798 | High | 7.5 | 2022-03-31 | Internet Routing Registry daemon version 4 is an IRR database server, processing IRR objects in the RPSL format. IRRd did not always filter password hashes in… |
CVE-2022-24797 | Medium | 6.5 | 2022-03-31 | Pomerium is an identity-aware access proxy. In distributed service mode, Pomerium's Authenticate service exposes pprof debug and prometheus metrics handlers to… |
CVE-2022-24796 | Critical | 10.0 | 2022-03-31 | RaspberryMatic is a free and open-source operating system for running a cloud-free smart-home using the homematicIP / HomeMatic hardware line of IoT devices. A… |
CVE-2022-24794 | High | 7.5 | 2022-03-31 | Express OpenID Connect is an Express JS middleware implementing sign on for Express web apps using OpenID Connect. Users of the `requiresAuth` middleware, eith… |
CVE-2022-24791 | High | 8.1 | 2022-03-31 | Wasmtime is a standalone JIT-style runtime for WebAssembly, using Cranelift. There is a use after free vulnerability in Wasmtime when both running Wasm that us… |
CVE-2022-24758 | High | 7.5 | 2022-03-31 | The Jupyter notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.9, unauthorized actors can access sensitive informatio… |
CVE-2022-26546 | Critical | 9.1 | 2022-03-31 | Hospital Management System v1.0 was discovered to lack an authorization component, allowing attackers to access sensitive information and obtain the admin pass… |
CVE-2022-22311 | Medium | 6.5 | 2022-03-31 | IBM Security Verify Access could allow a user, using man in the middle techniques, to obtain sensitive information or possibly change some information due to i… |
CVE-2022-0350 | Medium | 5.4 | 2022-03-31 | Cross-site Scripting (XSS) - Stored in GitHub repository vanessa219/vditor prior to 3.8.13. |
CVE-2022-24136 | Critical | 9.8 | 2022-03-31 | Hospital Management System v1.0 is affected by an unrestricted upload of dangerous file type vulerability in treatmentrecord.php. To exploit, an attacker can u… |
CVE-2022-1176 | High | 7.5 | 2022-03-31 | Loose comparison causes IDOR on multiple endpoints in GitHub repository livehelperchat/livehelperchat prior to 3.96. |
CVE-2022-25915 | High | 8.8 | 2022-03-31 | Improper access control vulnerability in ELECOM LAN routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmw… |
CVE-2022-1191 | High | 8.1 | 2022-03-31 | SSRF on index.php/cobrowse/proxycss/ in GitHub repository livehelperchat/livehelperchat prior to 3.96. |
CVE-2022-28128 | High | 7.8 | 2022-03-31 | Untrusted search path vulnerability in AttacheCase ver.3.6.1.0 and earlier allows an attacker to gain privileges and execute arbitrary code via a Trojan horse… |
CVE-2022-27496 | Medium | 6.1 | 2022-03-31 | Cross-site scripting vulnerability in Zero-channel BBS Plus v0.7.4 and earlier allows a remote attacker to inject an arbitrary script via unspecified vectors. |
CVE-2022-26019 | High | 8.8 | 2022-03-31 | Improper access control vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 2… |
CVE-2022-25348 | High | 7.8 | 2022-03-31 | Untrusted search path vulnerability in AttacheCase ver.4.0.2.7 and earlier allows an attacker to gain privileges and execute arbitrary code via a Trojan horse… |
CVE-2022-24299 | High | 8.8 | 2022-03-31 | Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to… |
CVE-2022-23183 | Medium | 6.5 | 2022-03-31 | Missing authorization vulnerability in Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1 allows a remote… |
CVE-2022-22986 | High | 8.8 | 2022-03-31 | Netcommunity OG410X and OG810X series (Netcommunity OG410Xa, OG410Xi, OG810Xa, and OG810Xi firmware Ver.2.28 and earlier) allow an attacker on the adjacent net… |
CVE-2022-26646 | Critical | 9.8 | 2022-03-30 | Online Banking System Protect v1.0 was discovered to contain a local file inclusion (LFI) vulnerability via the pages parameter. |
CVE-2022-26645 | Critical | 9.8 | 2022-03-30 | A remote code execution (RCE) vulnerability in Online Banking System Protect v1.0 allows attackers to execute arbitrary code via a crafted PHP file uploaded th… |
CVE-2022-26644 | Medium | 6.1 | 2022-03-30 | Online Banking System Protect v1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via parameters on user profile, system_info an… |
CVE-2022-25008 | High | 8.8 | 2022-03-30 | totolink EX300_v2 V4.0.3c.140_B20210429 and EX1200T V4.1.2cu.5230_B20210706 does not contain an authentication mechanism. |
CVE-2022-24790 | Critical | 9.1 | 2022-03-30 | Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate tha… |
CVE-2022-24763 | High | 7.5 | 2022-03-30 | PJSIP is a free and open source multimedia communication library written in the C language. Versions 2.12 and prior contain a denial-of-service vulnerability t… |
CVE-2022-1160 | High | 7.8 | 2022-03-30 | heap buffer overflow in get_one_sourceline in GitHub repository vim/vim prior to 8.2.4647. |
CVE-2022-28223 | Critical | 9.1 | 2022-03-30 | Tekon KIO devices through 2022-03-30 allow an authenticated admin user to escalate privileges to root by uploading a malicious Lua plugin. |
CVE-2022-27772 | High | 7.8 | 2022-03-30 | spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot… |
CVE-2022-24135 | Medium | 6.1 | 2022-03-30 | QingScan 1.3.0 is affected by Cross Site Scripting (XSS) vulnerability in all search functions. |
CVE-2022-24132 | High | 7.5 | 2022-03-30 | phpshe V1.8 is affected by a denial of service (DoS) attack in the registry's verification code, which can paralyze the target service. |
CVE-2022-22772 | High | 8.5 | 2022-03-30 | The cfsend, cfrecv, and CyberResp components of TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for UNIX and TIBCO Managed File Transfer Plat… |
CVE-2022-27907 | Medium | 4.3 | 2022-03-30 | Sonatype Nexus Repository Manager 3.x before 3.38.0 allows SSRF. |
CVE-2022-23801 | Medium | 6.1 | 2022-03-30 | An issue was discovered in Joomla! 4.0.0 through 4.1.0. Possible XSS atack vector through SVG embedding in com_media. |
CVE-2022-23800 | Medium | 6.1 | 2022-03-30 | An issue was discovered in Joomla! 4.0.0 through 4.1.0. Inadequate content filtering leads to XSS vulnerabilities in various components. |
CVE-2022-23799 | Critical | 9.8 | 2022-03-30 | An issue was discovered in Joomla! 4.0.0 through 4.1.0. Under specific circumstances, JInput pollutes method-specific input bags with $_REQUEST data. |
CVE-2022-23798 | Medium | 6.1 | 2022-03-30 | An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate validation of URLs could result into an invalid check whether an redi… |
CVE-2022-23797 | Critical | 9.8 | 2022-03-30 | An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate filtering on the selected Ids on an request could resulted into an po… |
CVE-2022-23796 | Medium | 6.1 | 2022-03-30 | An issue was discovered in Joomla! 3.7.0 through 3.10.6. Lack of input validation could allow an XSS attack using com_fields. |
CVE-2022-23795 | Critical | 9.8 | 2022-03-30 | An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. A user row was not bound to a specific authentication mechanism which could unde… |
CVE-2022-23794 | Medium | 5.3 | 2022-03-30 | An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Uploading a file name of an excess length causes the error. This error brings up… |
CVE-2022-23793 | High | 7.5 | 2022-03-30 | An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Extracting an specifilcy crafted tar package could write files outside of the in… |
CVE-2022-23136 | Medium | 5.4 | 2022-03-30 | There is a stored XSS vulnerability in ZTE home gateway product. An attacker could modify the gateway name by inserting special characters and trigger an XSS a… |
CVE-2022-22996 | High | 7.8 | 2022-03-30 | The G-RAID 4/8 Software Utility setups for Windows were affected by a DLL hijacking vulnerability. Successful exploitation could lead to arbitrary code executi… |
CVE-2022-20002 | High | 7.8 | 2022-03-30 | In incfs, there is a possible way of mounting on arbitrary paths due to a missing permission check. This could lead to local escalation of privilege with Syste… |
CVE-2022-0998 | High | 7.8 | 2022-03-30 | An integer overflow flaw was found in the Linux kernel’s virtio device driver code in the way a user triggers the vhost_vdpa_config_validate function. This fla… |
CVE-2022-25620 | Low | 3.8 | 2022-03-30 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Group Functionality of Profelis IT Consultancy SambaBox allows A… |
CVE-2022-25619 | Low | 3.8 | 2022-03-30 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in ping tool of Profelis IT Consultancy SambaBox allows AUTHE… |
CVE-2022-1155 | High | 7.4 | 2022-03-30 | Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10. |
CVE-2022-24131 | Medium | 6.1 | 2022-03-30 | DouPHP v1.6 Release 20220121 is affected by Cross Site Scripting (XSS) through /admin/login.php in the background, which will lead to JavaScript code execution. |
CVE-2022-1181 | Medium | 5.4 | 2022-03-30 | Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.2. |
CVE-2022-1180 | Low | 3.5 | 2022-03-30 | Reflected Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4. |
CVE-2022-1179 | Medium | 5.4 | 2022-03-30 | Non-Privilege User Can Created New Rule and Lead to Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4. |
CVE-2022-1178 | Medium | 5.4 | 2022-03-30 | Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4. |
CVE-2022-1154 | High | 7.8 | 2022-03-30 | Use after free in utf_ptr2char in GitHub repository vim/vim prior to 8.2.4646. |
CVE-2022-23869 | Medium | 6.5 | 2022-03-30 | In RuoYi v4.7.2 through the WebUI, user test1 does not have permission to reset the password of user test3, but the password of user test3 can be reset through… |
CVE-2022-23868 | High | 7.8 | 2022-03-30 | RuoYi v4.7.2 contains a CSV injection vulnerability through ruoyi-admin when a victim opens .xlsx log file. |
CVE-2022-1177 | Medium | 4.3 | 2022-03-30 | Accounting User Can Download Patient Reports in openemr in GitHub repository openemr/openemr prior to 6.1.0. |
CVE-2022-25598 | High | 7.5 | 2022-03-30 | Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks, Apache DolphinScheduler users should upgrade to v… |
CVE-2022-1172 | Medium | 5.0 | 2022-03-30 | Null Pointer Dereference Caused Segmentation Fault in GitHub repository gpac/gpac prior to 2.1.0-DEV. |
CVE-2022-28209 | Critical | 9.8 | 2022-03-30 | An issue was discovered in Mediawiki through 1.37.1. The check for the override-antispoof permission in the AntiSpoof extension is incorrect. |
CVE-2022-28206 | Critical | 9.8 | 2022-03-30 | An issue was discovered in MediaWiki through 1.37.1. ImportPlanValidator.php in the FileImporter extension mishandles the check for edit rights. |
CVE-2022-28205 | Critical | 9.8 | 2022-03-30 | An issue was discovered in MediaWiki through 1.37.1. The CentralAuth extension mishandles a ttl issue for groups expiring in the future. |
CVE-2022-1163 | Medium | 4.8 | 2022-03-30 | Cross-site Scripting (XSS) - Stored in GitHub repository mineweb/minewebcms prior to next. |
CVE-2022-28202 | Medium | 6.1 | 2022-03-30 | An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes properties… |
CVE-2022-27816 | High | 7.1 | 2022-03-30 | SWHKD 1.1.5 unsafely uses the /tmp/swhks.pid pathname. There can be data loss or a denial of service. |
CVE-2022-24693 | Critical | 9.8 | 2022-03-30 | Baicells Nova436Q and Neutrino 430 devices with firmware through QRTB 2.7.8 have hardcoded credentials that are easily discovered, and can be used by remote at… |
CVE-2022-27815 | High | 7.8 | 2022-03-30 | SWHKD 1.1.5 unsafely uses the /tmp/swhkd.pid pathname. There can be an information leak or denial of service. |
CVE-2022-27432 | High | 8.8 | 2022-03-30 | A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to change the password of any given user by exploiting this feature leading to accoun… |
CVE-2022-26951 | Medium | 6.5 | 2022-03-30 | Archer 6.x through 6.10 (6.10.0.0) contains a reflected XSS vulnerability. A remote SAML-unauthenticated malicious Archer user could potentially exploit this v… |
CVE-2022-26950 | Medium | 5.4 | 2022-03-30 | Archer 6.x through 6.9 P2 (6.9.0.2) is affected by an open redirect vulnerability. A remote unprivileged attacker may potentially redirect legitimate users to… |
CVE-2022-26949 | Medium | 5.3 | 2022-03-30 | Archer 6.x through 6.9 SP2 P1 (6.9.2.1) contains an improper access control vulnerability on attachments. A remote authenticated malicious user could potential… |
CVE-2022-26948 | Medium | 5.8 | 2022-03-30 | The Archer RSS feed integration for Archer 6.x through 6.9 SP1 (6.9.1.0) is affected by an insecure credential storage vulnerability. A malicious attacker may… |
CVE-2022-26947 | Medium | 6.3 | 2022-03-30 | Archer 6.x through 6.9 SP3 (6.9.3.0) contains a reflected XSS vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulner… |
CVE-2022-26244 | Medium | 5.4 | 2022-03-30 | A stored cross-site scripting (XSS) vulnerability in Hospital Patient Record Management System v1.0 allows attackers to execute arbitrary web scripts or HTML v… |
CVE-2022-26871 | Critical | 9.8 | 2022-03-29 | An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead… |
CVE-2022-21821 | High | 7.8 | 2022-03-29 | NVIDIA CUDA Toolkit SDK contains an integer overflow vulnerability in cuobjdump.To exploit this vulnerability, a remote attacker would require a local user to… |
CVE-2022-22948 | Medium | 6.5 | 2022-03-29 | The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to th… |
CVE-2022-1122 | Medium | 5.5 | 2022-03-29 | A flaw was found in the opj2_decompress program in openjpeg2 2.4.0 in the way it handles an input directory with a large number of files. When it fails to allo… |
CVE-2022-27175 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in GetCalcTagList. This allows an attacker… |
CVE-2022-26887 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_loopmapHandler.ashx. This allows an atta… |
CVE-2022-26839 | High | 7.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) is vulnerable to an incorrect default permission in the DIAEnergie application, which may allow… |
CVE-2022-26836 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerExport.ashx/Calendar. This allows… |
CVE-2022-26667 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in GetDemandAnalysisData. This allows an at… |
CVE-2022-26666 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerECC.ashx. This allows an attacker to i… |
CVE-2022-26514 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in DIAE_tagHandler.ashx. This allows an att… |
CVE-2022-26349 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in DIAE_eccoefficientHandler.ashx. This all… |
CVE-2022-26338 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerPageP_KID.ashx. This allows an attacke… |
CVE-2022-26069 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerPage_KID.ashx. This allows an att… |
CVE-2022-26065 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in GetLatestDemandNode. This allows an attacker… |
CVE-2022-26059 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in GetQueryData. This allows an attacker to… |
CVE-2022-26013 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in DIAE_dmdsetHandler.ashx. This allows an… |
CVE-2022-25980 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerCommon.ashx. This allows an attac… |
CVE-2022-25880 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerTag_KID.ashx. This allows an attacker… |
CVE-2022-25347 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) is vulnerable to path traversal attacks, which may allow an attacker to write arbitrary files t… |
CVE-2022-22941 | High | 8.8 | 2022-03-29 | An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publisher_acl, if a user co… |
CVE-2022-22936 | High | 8.8 | 2022-03-29 | An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Job publishes and file server replies are susceptible to replay attacks, w… |