2022 CVEs (page 237)
Page 237 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-0551 | High | 7.2 | 2022-03-24 | Improper Input Validation vulnerability in project file upload in Nozomi Networks Guardian and CMC allows an authenticated attacker with admin or import manage… |
CVE-2022-0550 | High | 7.2 | 2022-03-24 | Improper Input Validation vulnerability in custom report logo upload in Nozomi Networks Guardian, and CMC allows an authenticated attacker with admin or report… |
CVE-2022-1052 | Medium | 5.5 | 2022-03-24 | Heap Buffer Overflow in iterate_chained_fixups in GitHub repository radareorg/radare2 prior to 5.6.6. |
CVE-2022-0145 | Medium | 5.4 | 2022-03-24 | Cross-site Scripting (XSS) - Stored in GitHub repository forkcms/forkcms prior to 5.11.1. |
CVE-2022-1061 | High | 7.5 | 2022-03-24 | Heap Buffer Overflow in parseDragons in GitHub repository radareorg/radare2 prior to 5.6.8. |
CVE-2022-0315 | High | 7.5 | 2022-03-24 | Insecure Temporary File in GitHub repository horovod/horovod prior to 0.24.0. |
CVE-2022-27820 | Medium | 4.0 | 2022-03-24 | OWASP Zed Attack Proxy (ZAP) through w2022-03-21 does not verify the TLS certificate chain of an HTTPS server. |
CVE-2022-27811 | Critical | 9.8 | 2022-03-24 | GNOME OCRFeeder before 0.8.4 allows OS command injection via shell metacharacters in a PDF or image filename. |
CVE-2022-27083 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /cgi-bin/uploadAccessCodePic. |
CVE-2022-27082 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/SetInternetLanInfo. |
CVE-2022-27081 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/SetLanInfo. |
CVE-2022-27080 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setWorkmode. |
CVE-2022-27079 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setPicListItem. |
CVE-2022-27078 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setAdInfoDetail. |
CVE-2022-27077 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /cgi-bin/uploadWeiXinPic. |
CVE-2022-27076 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/delAd. |
CVE-2022-26536 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setFixTools. |
CVE-2022-26290 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/WriteFacMac. |
CVE-2022-26289 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/exeCommand. |
CVE-2022-25269 | Medium | 6.1 | 2022-03-23 | Passwork On-Premise Edition before 4.6.13 has multiple XSS issues. |
CVE-2022-25268 | High | 8.8 | 2022-03-23 | Passwork On-Premise Edition before 4.6.13 allows CSRF via the groups, password, and history subsystems. |
CVE-2022-25267 | High | 8.8 | 2022-03-23 | Passwork On-Premise Edition before 4.6.13 allows migration/uploadExportFile Directory Traversal (to upload files). |
CVE-2022-25266 | Medium | 4.3 | 2022-03-23 | Passwork On-Premise Edition before 4.6.13 allows migration/downloadExportFile Directory Traversal (to read files). |
CVE-2022-27254 | Medium | 5.3 | 2022-03-23 | The remote keyless system on Honda Civic 2018 vehicles sends the same RF signal for each door-open request, which allows for a replay attack, a related issue t… |
CVE-2022-27192 | High | 7.5 | 2022-03-23 | The Reporting module in Aseco Lietuva document management system DVS Avilys before 3.5.58 allows unauthorized file download. An unauthenticated attacker can im… |
CVE-2022-25041 | Medium | 4.3 | 2022-03-23 | OpenEMR v6.0.0 was discovered to contain an incorrect access control issue. |
CVE-2022-24934 | Critical | 9.8 | 2022-03-23 | wpsupdater.exe in Kingsoft WPS Office through 11.2.0.10382 allows remote code execution by modifying HKEY_CURRENT_USER in the registry. |
CVE-2022-24768 | Critical | 9.9 | 2022-03-23 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All unpatched versions of Argo CD starting with 1.0.0 are vulnerable to an improper a… |
CVE-2022-22819 | High | 7.8 | 2022-03-23 | NXP LPC55S66JBD64, LPC55S66JBD100, LPC55S66JEV98, LPC55S69JBD64, LPC55S69JBD100, and LPC55S69JEV98 microcontrollers (ROM version 1B) have a buffer overflow in… |
CVE-2022-24757 | High | 7.5 | 2022-03-23 | The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications. Prior to version 1.15.4, unauthorized… |
CVE-2022-24731 | Medium | 6.8 | 2022-03-23 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.5.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is v… |
CVE-2022-24730 | High | 7.7 | 2022-03-23 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.3.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is v… |
CVE-2022-23881 | Critical | 9.8 | 2022-03-23 | ZZZCMS zzzphp v2.1.0 was discovered to contain a remote command execution (RCE) vulnerability via danger_key() at zzz_template.php. |
CVE-2022-23880 | Critical | 9.8 | 2022-03-23 | An arbitrary file upload vulnerability in the File Management function module of taoCMS v3.0.2 allows attackers to execute arbitrary code via a crafted PHP fil… |
CVE-2022-25609 | Medium | 5.4 | 2022-03-23 | Stored Cross-Site Scripting (XSS) in Yoo Slider – Image Slider & Video Slider (WordPress plugin) allows attackers with contributor or higher user role to injec… |
CVE-2022-25608 | Medium | 5.4 | 2022-03-23 | Cross-Site Request Forgery (CSRF) in Yoo Slider – Image Slider & Video Slider (WordPress plugin) allows attackers to trick authenticated users into unwanted sl… |
CVE-2022-25223 | Medium | 4.3 | 2022-03-23 | Money Transfer Management System Version 1.0 allows an authenticated user to inject SQL queries in 'mtms/admin/?page=transaction/view_details' via the 'id' par… |
CVE-2022-25222 | Critical | 9.8 | 2022-03-23 | Money Transfer Management System Version 1.0 allows an unauthenticated user to inject SQL queries in 'admin/maintenance/manage_branch.php' and 'admin/maintenan… |
CVE-2022-25221 | Medium | 6.1 | 2022-03-23 | Money Transfer Management System Version 1.0 allows an attacker to inject JavaScript code in the URL and then trick a user into visit the link in order to exec… |
CVE-2022-24293 | Critical | 9.8 | 2022-03-23 | Certain HP Print devices may be vulnerable to potential information disclosure, denial of service, or remote code execution. |
CVE-2022-24292 | Critical | 9.8 | 2022-03-23 | Certain HP Print devices may be vulnerable to potential information disclosure, denial of service, or remote code execution. |
CVE-2022-24291 | High | 7.5 | 2022-03-23 | Certain HP Print devices may be vulnerable to potential information disclosure, denial of service, or remote code execution. |
CVE-2022-22952 | Critical | 9.1 | 2022-03-23 | VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains a file upload vulnerabili… |
CVE-2022-22951 | Critical | 9.1 | 2022-03-23 | VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains an OS command injection v… |
CVE-2022-1030 | High | 8.8 | 2022-03-23 | Okta Advanced Server Access Client for Linux and macOS prior to version 1.58.0 was found to be vulnerable to command injection via a specially crafted URL. An… |
CVE-2022-0996 | Medium | 6.5 | 2022-03-23 | A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database to cause improper authentication. |
CVE-2022-0981 | High | 8.8 | 2022-03-23 | A flaw was found in Quarkus. The state and potentially associated permissions can leak from one web request to another in RestEasy Reactive. This flaw allows a… |
CVE-2022-0889 | High | 7.2 | 2022-03-23 | The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to reflected cross-site scripting due to missing sanitization of the files filename par… |
CVE-2022-0888 | Critical | 9.8 | 2022-03-23 | The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~… |
CVE-2022-0854 | Medium | 5.5 | 2022-03-23 | A memory leak flaw was found in the Linux kernel’s DMA subsystem, in the way a user calls DMA_FROM_DEVICE. This flaw allows a local user to read random memory… |
CVE-2022-0834 | High | 7.2 | 2022-03-23 | The Amelia WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the lastName parameter found in the ~/src/Ap… |
CVE-2022-0750 | Medium | 6.4 | 2022-03-23 | The Photoswipe Masonry Gallery WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the thumbnail_width, thu… |
CVE-2022-26243 | High | 7.5 | 2022-03-23 | Tenda AC10-1200 v15.03.06.23_EN was discovered to contain a buffer overflow in the setSmartPowerManagement function. |
CVE-2022-22316 | Medium | 6.5 | 2022-03-23 | IBM MQ Appliance 9.2 CD and 9.2 LTS could allow an authenticated and authorized user to cause a denial of service due to incorrectly configured authorization c… |
CVE-2022-23242 | Medium | 6.3 | 2022-03-23 | TeamViewer Linux versions before 15.28 do not properly execute a deletion command for the connection password in case of a process crash. Knowledge of the cras… |
CVE-2022-0862 | Low | 3.1 | 2022-03-23 | A lack of password change protection vulnerability in a depreciated API of McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote… |
CVE-2022-0861 | Low | 3.5 | 2022-03-23 | A XML Extended entity vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote administrator attacker to upload a… |
CVE-2022-0859 | Medium | 6.5 | 2022-03-23 | McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a local attacker to point an ePO server to an arbitrary SQL server during the resto… |
CVE-2022-0858 | Medium | 4.3 | 2022-03-23 | A cross-site scripting (XSS) vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote attacker to potentially obta… |
CVE-2022-0857 | Medium | 5.4 | 2022-03-23 | A reflected cross-site scripting (XSS) vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote attacker to potent… |
CVE-2022-0842 | Medium | 5.4 | 2022-03-23 | A blind SQL injection vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote authenticated attacker to potential… |
CVE-2022-0635 | High | 7.5 | 2022-03-23 | Versions affected: BIND 9.18.0 When a vulnerable version of named receives a series of specific queries, the named process will eventually terminate due to a f… |
CVE-2022-0396 | Medium | 5.3 | 2022-03-23 | BIND 9.16.11 -> 9.16.26, 9.17.0 -> 9.18.0 and versions 9.16.11-S1 -> 9.16.26-S1 of the BIND Supported Preview Edition. Specifically crafted TCP streams can cau… |
CVE-2022-1033 | High | 7.8 | 2022-03-23 | Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.6. |
CVE-2022-27666 | High | 7.8 | 2022-03-23 | A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw allows a local attacker with a normal… |
CVE-2022-25518 | Medium | 6.5 | 2022-03-22 | In CMDBuild from version 3.0 to 3.3.2 payload requests are saved in a temporary log table, which allows attackers with database access to read the password of… |
CVE-2022-26189 | Critical | 9.8 | 2022-03-22 | TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the langType parameter in the login interface. |
CVE-2022-26188 | Critical | 9.8 | 2022-03-22 | TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via /setting/NTPSyncWithHost. |
CVE-2022-26187 | Critical | 9.8 | 2022-03-22 | TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the pingCheck function. |
CVE-2022-26186 | Critical | 9.8 | 2022-03-22 | TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the exportOvpn interface at cstecgi.cgi. |
CVE-2022-1031 | High | 7.8 | 2022-03-22 | Use After Free in op_is_set_bp in GitHub repository radareorg/radare2 prior to 5.6.6. |
CVE-2022-26260 | Critical | 9.8 | 2022-03-22 | Simple-Plist v1.3.0 was discovered to contain a prototype pollution vulnerability via .parse(). |
CVE-2022-25517 | Critical | 9.8 | 2022-03-22 | MyBatis plus v3.4.3 was discovered to contain a SQL injection vulnerability via the Column parameter in /core/conditions/AbstractWrapper.java. NOTE: the vendor… |
CVE-2022-27228 | Critical | 9.8 | 2022-03-22 | In the vote (aka "Polls, Votes") module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can execute arbitrary code. |
CVE-2022-25484 | Medium | 5.5 | 2022-03-22 | tcpprep v4.4.1 has a reachable assertion (assert(l2len > 0)) in packet2tree() at tree.c in tcpprep v4.4.1. |
CVE-2022-24774 | High | 7.1 | 2022-03-22 | CycloneDX BOM Repository Server is a bill of materials (BOM) repository server for distributing CycloneDX BOMs. CycloneDX BOM Repository Server before version… |
CVE-2022-24764 | High | 7.5 | 2022-03-22 | PJSIP is a free and open source multimedia communication library written in C. Versions 2.12 and prior contain a stack buffer overflow vulnerability that affec… |
CVE-2022-21718 | Low | 3.4 | 2022-03-22 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to `17.0.0-alpha.6`… |
CVE-2022-1036 | High | 7.5 | 2022-03-22 | Able to create an account with long password leads to memory corruption / Integer Overflow in GitHub repository microweber/microweber prior to 1.2.12. |
CVE-2022-0667 | High | 7.5 | 2022-03-22 | When the vulnerability is triggered the BIND process will exit. BIND 9.18.0 |
CVE-2022-1034 | High | 7.2 | 2022-03-22 | There is a Unrestricted Upload of File vulnerability in ShowDoc v2.10.3 in GitHub repository star7th/showdoc prior to 2.10.4. |
CVE-2022-0652 | Low | 3.3 | 2022-03-22 | Confd log files contain local users', including root’s, SHA512crypt password hashes with insecure access permissions. This allows a local attacker to attempt o… |
CVE-2022-0386 | High | 8.8 | 2022-03-22 | A post-auth SQL injection vulnerability in the Mail Manager potentially allows an authenticated attacker to execute code in Sophos UTM before version 9.710. |
CVE-2022-27607 | High | 8.1 | 2022-03-21 | Bento4 1.6.0-639 has a heap-based buffer over-read in the AP4_HvccAtom class, a different issue than CVE-2018-14531. |
CVE-2022-26285 | Critical | 9.8 | 2022-03-21 | Simple Subscription Website v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the apply endpoint. This vulnerability allows… |
CVE-2022-26284 | Critical | 9.8 | 2022-03-21 | Simple Client Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the manage_client endpoint. This vulnerabi… |
CVE-2022-26283 | Critical | 9.8 | 2022-03-21 | Simple Subscription Website v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the view_plan endpoint. This vulnerability all… |
CVE-2022-27333 | High | 7.5 | 2022-03-21 | idcCMS v1.10 was discovered to contain an issue which allows attackers to arbitrarily delete the install.lock file, resulting in a reset of the CMS settings an… |
CVE-2022-27090 | Medium | 5.4 | 2022-03-21 | Cscms Music Portal System v4.2 was discovered to contain a redirection vulnerability via the backurl parameter. |
CVE-2022-26184 | Critical | 9.8 | 2022-03-21 | Poetry v1.1.9 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute Poetry… |
CVE-2022-26183 | High | 8.8 | 2022-03-21 | PNPM v6.15.1 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute PNPM com… |
CVE-2022-26174 | Critical | 9.8 | 2022-03-21 | A remote code execution (RCE) vulnerability in Beekeeper Studio v3.2.0 allows attackers to execute arbitrary code via a crafted payload injected into the displ… |
CVE-2022-26148 | Critical | 9.8 | 2022-03-21 | An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When t… |
CVE-2022-23352 | High | 7.5 | 2022-03-21 | An issue in BigAnt Software BigAnt Server v5.6.06 can lead to a Denial of Service (DoS). |
CVE-2022-23350 | Medium | 5.4 | 2022-03-21 | BigAnt Software BigAnt Server v5.6.06 was discovered to contain a cross-site scripting (XSS) vulnerability. |
CVE-2022-23349 | High | 8.8 | 2022-03-21 | BigAnt Software BigAnt Server v5.6.06 was discovered to contain a Cross-Site Request Forgery (CSRF). |
CVE-2022-23348 | Medium | 5.3 | 2022-03-21 | BigAnt Software BigAnt Server v5.6.06 was discovered to utilize weak password hashes. |
CVE-2022-23347 | High | 7.5 | 2022-03-21 | BigAnt Software BigAnt Server v5.6.06 was discovered to be vulnerable to directory traversal attacks. |
CVE-2022-23346 | High | 8.8 | 2022-03-21 | BigAnt Software BigAnt Server v5.6.06 was discovered to contain incorrect access control issues. |
CVE-2022-23345 | High | 7.5 | 2022-03-21 | BigAnt Software BigAnt Server v5.6.06 was discovered to contain incorrect access control. |