2022 CVEs (page 235)
Page 235 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-22948 | Medium | 6.5 | 2022-03-29 | The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to th… |
CVE-2022-1122 | Medium | 5.5 | 2022-03-29 | A flaw was found in the opj2_decompress program in openjpeg2 2.4.0 in the way it handles an input directory with a large number of files. When it fails to allo… |
CVE-2022-27175 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in GetCalcTagList. This allows an attacker… |
CVE-2022-26887 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_loopmapHandler.ashx. This allows an atta… |
CVE-2022-26839 | High | 7.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) is vulnerable to an incorrect default permission in the DIAEnergie application, which may allow… |
CVE-2022-26836 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerExport.ashx/Calendar. This allows… |
CVE-2022-26667 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in GetDemandAnalysisData. This allows an at… |
CVE-2022-26666 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerECC.ashx. This allows an attacker to i… |
CVE-2022-26514 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in DIAE_tagHandler.ashx. This allows an att… |
CVE-2022-26349 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in DIAE_eccoefficientHandler.ashx. This all… |
CVE-2022-26338 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerPageP_KID.ashx. This allows an attacke… |
CVE-2022-26069 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerPage_KID.ashx. This allows an att… |
CVE-2022-26065 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in GetLatestDemandNode. This allows an attacker… |
CVE-2022-26059 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in GetQueryData. This allows an attacker to… |
CVE-2022-26013 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in DIAE_dmdsetHandler.ashx. This allows an… |
CVE-2022-25980 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerCommon.ashx. This allows an attac… |
CVE-2022-25880 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerTag_KID.ashx. This allows an attacker… |
CVE-2022-25347 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) is vulnerable to path traversal attacks, which may allow an attacker to write arbitrary files t… |
CVE-2022-22941 | High | 8.8 | 2022-03-29 | An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publisher_acl, if a user co… |
CVE-2022-22936 | High | 8.8 | 2022-03-29 | An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Job publishes and file server replies are susceptible to replay attacks, w… |
CVE-2022-22935 | Low | 3.7 | 2022-03-29 | An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authentication denial of service can cause a MiTM attacker to for… |
CVE-2022-22934 | High | 8.8 | 2022-03-29 | An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which c… |
CVE-2022-1050 | High | 8.8 | 2022-03-29 | A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to execute HW commands when shared buf… |
CVE-2022-0923 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerDialog_KID.ashx. This allows an a… |
CVE-2022-0343 | Low | 3.3 | 2022-03-29 | A local attacker, as a different local user, may be able to send a HTTP request to 127.0.0.1:10000 after the user (typically a developer) manually invoked the… |
CVE-2022-1055 | High | 7.8 | 2022-03-29 | A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain privilege escalation. The exploit requires unprivileged… |
CVE-2022-28160 | Medium | 6.5 | 2022-03-29 | Jenkins Tests Selector Plugin 1.3.3 and earlier allows users with Item/Configure permission to read arbitrary files on the Jenkins controller. |
CVE-2022-28159 | Medium | 5.4 | 2022-03-29 | Jenkins Tests Selector Plugin 1.3.3 and earlier does not escape the Properties File Path option for Choosing Tests parameters, resulting in a stored cross-site… |
CVE-2022-28158 | Medium | 6.5 | 2022-03-29 | A missing permission check in Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Overall/Read permission to enumerate credentials… |
CVE-2022-28157 | Medium | 6.5 | 2022-03-29 | Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller… |
CVE-2022-28156 | Medium | 6.5 | 2022-03-29 | Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Item/Configure permission to copy arbitrary files and directories from the Jenk… |
CVE-2022-28155 | High | 8.1 | 2022-03-29 | Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-28154 | High | 8.1 | 2022-03-29 | Jenkins Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-28153 | Medium | 5.4 | 2022-03-29 | Jenkins SiteMonitor Plugin 0.6 and earlier does not escape URLs of sites to monitor in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability… |
CVE-2022-28152 | Medium | 4.3 | 2022-03-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers to restore the default ownership… |
CVE-2022-28151 | Medium | 4.3 | 2022-03-29 | A missing permission check in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers with Item/Read permission to change the owners and item… |
CVE-2022-28150 | High | 8.8 | 2022-03-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers to change the owners and item-sp… |
CVE-2022-28149 | Medium | 5.4 | 2022-03-29 | Jenkins Job and Node ownership Plugin 0.13.0 and earlier does not escape the names of the secondary owners, resulting in a stored cross-site scripting (XSS) vu… |
CVE-2022-28148 | Medium | 6.5 | 2022-03-29 | The file browser in Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier may interpret some paths to files as absolute on Windows, resulting in… |
CVE-2022-28147 | Medium | 4.3 | 2022-03-29 | A missing permission check in Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier allows attackers with Overall/Read permission to check for t… |
CVE-2022-28146 | Medium | 6.5 | 2022-03-29 | Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier allows attackers with Item/Configure permission to read arbitrary files on the Jenkins con… |
CVE-2022-28145 | Medium | 5.4 | 2022-03-29 | Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier does not apply Content-Security-Policy headers to report files it serves, resulting in a s… |
CVE-2022-28144 | Medium | 6.5 | 2022-03-29 | Jenkins Proxmox Plugin 0.7.0 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to conn… |
CVE-2022-28143 | Medium | 6.5 | 2022-03-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins Proxmox Plugin 0.7.0 and earlier allows attackers to connect to an attacker-specified host using a… |
CVE-2022-28142 | High | 7.5 | 2022-03-29 | Jenkins Proxmox Plugin 0.6.0 and earlier disables SSL/TLS certificate validation globally for the Jenkins controller JVM when configured to ignore SSL/TLS issu… |
CVE-2022-28141 | Medium | 6.5 | 2022-03-29 | Jenkins Proxmox Plugin 0.5.0 and earlier stores the Proxmox Datacenter password unencrypted in the global config.xml file on the Jenkins controller where it ca… |
CVE-2022-28140 | High | 8.1 | 2022-03-29 | Jenkins Flaky Test Handler Plugin 1.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-28139 | Medium | 4.3 | 2022-03-29 | A missing permission check in Jenkins RocketChat Notifier Plugin 1.4.10 and earlier allows attackers with Overall/Read permission to connect to an attacker-spe… |
CVE-2022-28138 | Medium | 4.3 | 2022-03-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins RocketChat Notifier Plugin 1.4.10 and earlier allows attackers to connect to an attacker-specified… |
CVE-2022-28137 | Medium | 4.3 | 2022-03-29 | A missing permission check in Jenkins JiraTestResultReporter Plugin 165.v817928553942 and earlier allows attackers with Overall/Read permission to connect to a… |
CVE-2022-28136 | High | 8.8 | 2022-03-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins JiraTestResultReporter Plugin 165.v817928553942 and earlier allows attackers to connect to an atta… |
CVE-2022-28135 | Medium | 6.5 | 2022-03-29 | Jenkins instant-messaging Plugin 1.41 and earlier stores passwords for group chats unencrypted in the global configuration file of plugins based on Jenkins ins… |
CVE-2022-28134 | Medium | 5.4 | 2022-03-29 | Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Rea… |
CVE-2022-28133 | Medium | 5.4 | 2022-03-29 | Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not limit URL schemes for callback URLs on OAuth consumers, resulting in a stored cross-site… |
CVE-2022-23903 | Medium | 5.4 | 2022-03-29 | A Cross Site Scripting (XSS) vulnerability exists in pearadmin pear-admin-think <=5.0.6, which allows a login account to access arbitrary functions and cause s… |
CVE-2022-23901 | Critical | 9.8 | 2022-03-29 | A stack overflow re2c 2.2 exists due to infinite recursion issues in src/dfa/dead_rules.cc. |
CVE-2022-23059 | Medium | 4.8 | 2022-03-29 | A Stored Cross Site Scripting (XSS) vulnerability exists in Shopizer versions 2.0 through 2.17.0 via the “Manage Images” tab, which allows an attacker to uploa… |
CVE-2022-1032 | High | 7.2 | 2022-03-29 | Insecure deserialization of not validated module file in GitHub repository crater-invoice/crater prior to 6.0.6. |
CVE-2022-1087 | Low | 3.5 | 2022-03-29 | A vulnerability, which was classified as problematic, has been found in htmly 5.3 whis affects the component Edit Profile Module. The manipulation of the field… |
CVE-2022-1086 | Low | 3.5 | 2022-03-29 | A vulnerability was found in DolphinPHP up to 1.5.0 and classified as problematic. Affected by this issue is the User Management Page. The manipulation leads t… |
CVE-2022-1085 | Low | 3.5 | 2022-03-29 | A vulnerability was found in CLTPHP up to 6.0. It has been declared as problematic. Affected by this vulnerability is the POST Parameter Handler. The manipulat… |
CVE-2022-1084 | High | 7.3 | 2022-03-29 | A vulnerability classified as critical was found in SourceCodester One Church Management System 1.0. Affected by this vulnerability is an unknown functionality… |
CVE-2022-1083 | High | 7.3 | 2022-03-29 | A vulnerability classified as critical has been found in Microfinance Management System. The manipulation of arguments like customer_type_number/account_number… |
CVE-2022-1082 | High | 7.3 | 2022-03-29 | A vulnerability was found in SourceCodester Microfinance Management System 1.0. It has been rated as critical. This issue affects the file /mims/login.php of t… |
CVE-2022-1081 | Medium | 4.3 | 2022-03-29 | A vulnerability was found in SourceCodester Microfinance Management System 1.0. It has been declared as problematic. This vulnerability affects the file /mims/… |
CVE-2022-1080 | High | 7.3 | 2022-03-29 | A vulnerability was found in SourceCodester One Church Management System 1.0. It has been declared as critical. This vulnerability affects code of the file att… |
CVE-2022-1079 | Medium | 4.3 | 2022-03-29 | A vulnerability classified as problematic has been found in SourceCodester One Church Management System. Affected are multiple files and parameters which are p… |
CVE-2022-1078 | High | 7.3 | 2022-03-29 | A vulnerability was found in SourceCodester College Website Management System 1.0. It has been classified as critical. Affected is the file /cwms/admin/?page=a… |
CVE-2022-1077 | Medium | 5.3 | 2022-03-29 | A vulnerability was found in TEM FLEX-1080 and FLEX-1085 1.6.0. It has been declared as problematic. This vulnerability log.cgi of the component Log Handler. A… |
CVE-2022-1076 | Medium | 4.3 | 2022-03-29 | A vulnerability was found in Automatic Question Paper Generator System 1.0. It has been classified as problematic. This affects the file /aqpg/users/login.php… |
CVE-2022-1075 | Low | 3.5 | 2022-03-29 | A vulnerability was found in College Website Management System 1.0 and classified as problematic. Affected by this issue is the file /cwms/classes/Master.php?f… |
CVE-2022-1074 | Medium | 4.3 | 2022-03-29 | A vulnerability has been found in TEM FLEX-1085 1.6.0 and classified as problematic. Using the input <h1>HTML Injection</h1> in the WiFi settings of the dashbo… |
CVE-2022-1073 | High | 7.3 | 2022-03-29 | A vulnerability was found in Automatic Question Paper Generator 1.0. It has been declared as critical. An attack leads to privilege escalation. The attack can… |
CVE-2022-25420 | Critical | 9.8 | 2022-03-29 | NTT Resonant Incorporated goo blog App Web Application 1.0 is vulnerable to CLRF injection. This vulnerability allows attackers to execute arbitrary code via a… |
CVE-2022-24957 | Medium | 5.4 | 2022-03-29 | DHC Vision eQMS through 5.4.8.322 has Persistent XSS due to insufficient encoding of untrusted input/output. To exploit the vulnerability, the attacker has to… |
CVE-2022-24956 | Medium | 6.5 | 2022-03-29 | An issue was discovered in Shopware B2B-Suite through 4.4.1. The sort-by parameter of the search functionality of b2border and b2borderlist allows SQL injectio… |
CVE-2022-23937 | Medium | 5.3 | 2022-03-29 | In Wind River VxWorks 6.9 and 7, a specific crafted packet may lead to an out-of-bounds read during an IKE initial exchange scenario. |
CVE-2022-26269 | Medium | 4.6 | 2022-03-29 | Suzuki Connect v1.0.15 allows attackers to tamper with displayed messages via spoofed CAN messages. |
CVE-2022-25521 | Critical | 9.8 | 2022-03-29 | NUUO v03.11.00 was discovered to contain access control issue. |
CVE-2022-0331 | Medium | 5.3 | 2022-03-29 | An information disclosure vulnerability in Webadmin allows an unauthenticated remote attacker to read the device serial number in Sophos Firewall version v18.5… |
CVE-2022-26642 | High | 7.2 | 2022-03-28 | TP-LINK TL-WR840N(ES)_V6.20 was discovered to contain a buffer overflow via the X_TP_ClonedMACAddress parameter. |
CVE-2022-26641 | High | 7.2 | 2022-03-28 | TP-LINK TL-WR840N(ES)_V6.20 was discovered to contain a buffer overflow via the httpRemotePort parameter. |
CVE-2022-26640 | High | 7.2 | 2022-03-28 | TP-LINK TL-WR840N(ES)_V6.20 was discovered to contain a buffer overflow via the minAddress parameter. |
CVE-2022-26639 | High | 7.2 | 2022-03-28 | TP-LINK TL-WR840N(ES)_V6.20 was discovered to contain a buffer overflow via the DNSServers parameter. |
CVE-2022-26296 | Medium | 5.5 | 2022-03-28 | BOOM: The Berkeley Out-of-Order RISC-V Processor commit d77c2c3 was discovered to allow unauthorized disclosure of information to an attacker with local user a… |
CVE-2022-26291 | Medium | 5.5 | 2022-03-28 | lrzip v0.641 was discovered to contain a multiple concurrency use-after-free between the functions zpaq_decompress_buf() and clear_rulist(). This vulnerability… |
CVE-2022-26280 | Medium | 6.5 | 2022-03-28 | Libarchive v3.6.0 was discovered to contain an out-of-bounds read via the component zipx_lzma_alone_init. |
CVE-2022-24789 | High | 7.6 | 2022-03-28 | C1 CMS is an open-source, .NET based Content Management System (CMS). Versions prior to 6.12 allow an authenticated user to exploit Server Side Request Forgery… |
CVE-2022-26278 | Critical | 9.8 | 2022-03-28 | Tenda AC9 v15.03.2.21_cn was discovered to contain a stack overflow via the time parameter in the PowerSaveSet function. |
CVE-2022-27658 | High | 7.5 | 2022-03-28 | Under certain conditions, SAP Innovation management - version 2.0, allows an attacker to access information which could lead to information gathering for furth… |
CVE-2022-26980 | Medium | 6.1 | 2022-03-28 | Teampass 2.1.26 allows reflected XSS via the index.php PATH_INFO. |
CVE-2022-1056 | Medium | 5.5 | 2022-03-28 | Out-of-bounds Read error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff fro… |
CVE-2022-0751 | Medium | 6.5 | 2022-03-28 | Inaccurate display of Snippet files containing special characters in all versions of GitLab CE/EE allows an attacker to create Snippets with misleading content… |
CVE-2022-0738 | Medium | 4.2 | 2022-03-28 | An issue has been discovered in GitLab affecting all versions starting from 14.6 before 14.6.5, all versions starting from 14.7 before 14.7.4, all versions sta… |
CVE-2022-0735 | Critical | 10.0 | 2022-03-28 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions starting from 14.7 before 14.7.4, all versi… |
CVE-2022-0549 | Medium | 6.5 | 2022-03-28 | An issue has been discovered in GitLab CE/EE affecting all versions before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14… |
CVE-2022-0488 | Low | 3.5 | 2022-03-28 | An issue has been discovered in GitLab CE/EE affecting all versions starting with version 8.10. It was possible to trigger a timeout on a page with markdown by… |
CVE-2022-0427 | High | 7.7 | 2022-03-28 | Missing sanitization of HTML attributes in Jupyter notebooks in all versions of GitLab CE/EE since version 14.5 allows an attacker to perform arbitrary HTTP PO… |
CVE-2022-0371 | Medium | 4.3 | 2022-03-28 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.4 before 14.5.4, all versions starting from 14.6 before 14.6.4, all versio… |
CVE-2022-0344 | Low | 3.1 | 2022-03-28 | An issue has been discovered in GitLab affecting all versions starting from 10.0 before 14.5.4, all versions starting from 10.1 before 14.6.4, all versions sta… |