2022 CVEs (page 237)
Page 237 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-22688 | High | 8.8 | 2022-03-25 | Improper neutralization of special elements used in a command ('Command Injection') vulnerability in File service functionality in Synology DiskStation Manager… |
CVE-2022-22687 | Critical | 9.8 | 2022-03-25 | Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in Authentication functionality in Synology DiskStation Manager (DSM) befo… |
CVE-2022-25576 | Medium | 4.5 | 2022-03-24 | Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component anchor/routes/posts.php. This vulnerability allows attackers… |
CVE-2022-26301 | Critical | 9.8 | 2022-03-24 | TuziCMS v2.0.6 was discovered to contain a SQL injection vulnerability via the component App\Manage\Controller\ZhuantiController.class.php. |
CVE-2022-26279 | Critical | 9.8 | 2022-03-24 | EyouCMS v1.5.5 was discovered to have no access control in the component /data/sqldata. |
CVE-2022-26272 | Critical | 9.8 | 2022-03-24 | A remote code execution (RCE) vulnerability in Ionize v1.0.8.1 allows attackers to execute arbitrary code via a crafted string written to the file application/… |
CVE-2022-26249 | Critical | 9.8 | 2022-03-24 | Survey King v0.3.0 does not filter data properly when exporting excel files, allowing attackers to execute arbitrary code or access sensitive information via a… |
CVE-2022-25575 | Medium | 6.1 | 2022-03-24 | Multiple cross-site scripting (XSS) vulnerabilities in Parking Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via crafted pay… |
CVE-2022-25571 | High | 7.5 | 2022-03-24 | Bluedon Information Security Technologies Co.,Ltd Internet Access Detector v1.0 was discovered to contain an information leak which allows attackers to access… |
CVE-2022-24782 | Medium | 4.3 | 2022-03-24 | Discourse is an open source discussion platform. Versions 2.8.2 and prior in the `stable` branch, 2.9.0.beta3 and prior in the `beta` branch, and 2.9.0.beta3 a… |
CVE-2022-24781 | High | 7.1 | 2022-03-24 | Geon is a board game based on solving questions about the Pythagorean Theorem. Malicious users can obtain the uuid from other users, spoof that uuid through th… |
CVE-2022-24776 | Medium | 6.1 | 2022-03-24 | Flask-AppBuilder is an application development framework, built on top of the Flask web framework. Flask-AppBuilder contains an open redirect vulnerability whe… |
CVE-2022-24769 | Medium | 5.9 | 2022-03-24 | Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was found in Moby (Docker Engine) prior to version 2… |
CVE-2022-22374 | Critical | 9.1 | 2022-03-24 | The BMC (IBM Power 9 AC922 OP910, OP920, OP930, and OP940) may be subject to a firmware downgrade attack which may affect its ability to operate its host. IBM… |
CVE-2022-25568 | High | 7.5 | 2022-03-24 | MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user p… |
CVE-2022-21820 | Medium | 6.3 | 2022-03-24 | NVIDIA DCGM contains a vulnerability in nvhostengine, where a network user can cause detection of error conditions without action, which may lead to limited co… |
CVE-2022-0153 | High | 7.5 | 2022-03-24 | SQL Injection in GitHub repository forkcms/forkcms prior to 5.11.1. |
CVE-2022-26629 | Critical | 9.1 | 2022-03-24 | An Access Control vulnerability exists in SoroushPlus+ Messenger 1.0.30 in the Lock Screen Security Feature function due to insufficient permissions and privil… |
CVE-2022-1058 | Medium | 6.1 | 2022-03-24 | Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5. |
CVE-2022-0955 | Medium | 4.8 | 2022-03-24 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/data-hub prior to 1.2.4. |
CVE-2022-0551 | High | 7.2 | 2022-03-24 | Improper Input Validation vulnerability in project file upload in Nozomi Networks Guardian and CMC allows an authenticated attacker with admin or import manage… |
CVE-2022-0550 | High | 7.2 | 2022-03-24 | Improper Input Validation vulnerability in custom report logo upload in Nozomi Networks Guardian, and CMC allows an authenticated attacker with admin or report… |
CVE-2022-1052 | Medium | 5.5 | 2022-03-24 | Heap Buffer Overflow in iterate_chained_fixups in GitHub repository radareorg/radare2 prior to 5.6.6. |
CVE-2022-0145 | Medium | 5.4 | 2022-03-24 | Cross-site Scripting (XSS) - Stored in GitHub repository forkcms/forkcms prior to 5.11.1. |
CVE-2022-1061 | High | 7.5 | 2022-03-24 | Heap Buffer Overflow in parseDragons in GitHub repository radareorg/radare2 prior to 5.6.8. |
CVE-2022-0315 | High | 7.5 | 2022-03-24 | Insecure Temporary File in GitHub repository horovod/horovod prior to 0.24.0. |
CVE-2022-27820 | Medium | 4.0 | 2022-03-24 | OWASP Zed Attack Proxy (ZAP) through w2022-03-21 does not verify the TLS certificate chain of an HTTPS server. |
CVE-2022-27811 | Critical | 9.8 | 2022-03-24 | GNOME OCRFeeder before 0.8.4 allows OS command injection via shell metacharacters in a PDF or image filename. |
CVE-2022-27083 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /cgi-bin/uploadAccessCodePic. |
CVE-2022-27082 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/SetInternetLanInfo. |
CVE-2022-27081 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/SetLanInfo. |
CVE-2022-27080 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setWorkmode. |
CVE-2022-27079 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setPicListItem. |
CVE-2022-27078 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setAdInfoDetail. |
CVE-2022-27077 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /cgi-bin/uploadWeiXinPic. |
CVE-2022-27076 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/delAd. |
CVE-2022-26536 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setFixTools. |
CVE-2022-26290 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/WriteFacMac. |
CVE-2022-26289 | Critical | 9.8 | 2022-03-24 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/exeCommand. |
CVE-2022-25269 | Medium | 6.1 | 2022-03-23 | Passwork On-Premise Edition before 4.6.13 has multiple XSS issues. |
CVE-2022-25268 | High | 8.8 | 2022-03-23 | Passwork On-Premise Edition before 4.6.13 allows CSRF via the groups, password, and history subsystems. |
CVE-2022-25267 | High | 8.8 | 2022-03-23 | Passwork On-Premise Edition before 4.6.13 allows migration/uploadExportFile Directory Traversal (to upload files). |
CVE-2022-25266 | Medium | 4.3 | 2022-03-23 | Passwork On-Premise Edition before 4.6.13 allows migration/downloadExportFile Directory Traversal (to read files). |
CVE-2022-27254 | Medium | 5.3 | 2022-03-23 | The remote keyless system on Honda Civic 2018 vehicles sends the same RF signal for each door-open request, which allows for a replay attack, a related issue t… |
CVE-2022-27192 | High | 7.5 | 2022-03-23 | The Reporting module in Aseco Lietuva document management system DVS Avilys before 3.5.58 allows unauthorized file download. An unauthenticated attacker can im… |
CVE-2022-25041 | Medium | 4.3 | 2022-03-23 | OpenEMR v6.0.0 was discovered to contain an incorrect access control issue. |
CVE-2022-24934 | Critical | 9.8 | 2022-03-23 | wpsupdater.exe in Kingsoft WPS Office through 11.2.0.10382 allows remote code execution by modifying HKEY_CURRENT_USER in the registry. |
CVE-2022-24768 | Critical | 9.9 | 2022-03-23 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All unpatched versions of Argo CD starting with 1.0.0 are vulnerable to an improper a… |
CVE-2022-22819 | High | 7.8 | 2022-03-23 | NXP LPC55S66JBD64, LPC55S66JBD100, LPC55S66JEV98, LPC55S69JBD64, LPC55S69JBD100, and LPC55S69JEV98 microcontrollers (ROM version 1B) have a buffer overflow in… |
CVE-2022-24757 | High | 7.5 | 2022-03-23 | The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications. Prior to version 1.15.4, unauthorized… |
CVE-2022-24731 | Medium | 6.8 | 2022-03-23 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.5.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is v… |
CVE-2022-24730 | High | 7.7 | 2022-03-23 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.3.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is v… |
CVE-2022-23881 | Critical | 9.8 | 2022-03-23 | ZZZCMS zzzphp v2.1.0 was discovered to contain a remote command execution (RCE) vulnerability via danger_key() at zzz_template.php. |
CVE-2022-23880 | Critical | 9.8 | 2022-03-23 | An arbitrary file upload vulnerability in the File Management function module of taoCMS v3.0.2 allows attackers to execute arbitrary code via a crafted PHP fil… |
CVE-2022-25609 | Medium | 5.4 | 2022-03-23 | Stored Cross-Site Scripting (XSS) in Yoo Slider – Image Slider & Video Slider (WordPress plugin) allows attackers with contributor or higher user role to injec… |
CVE-2022-25608 | Medium | 5.4 | 2022-03-23 | Cross-Site Request Forgery (CSRF) in Yoo Slider – Image Slider & Video Slider (WordPress plugin) allows attackers to trick authenticated users into unwanted sl… |
CVE-2022-25223 | Medium | 4.3 | 2022-03-23 | Money Transfer Management System Version 1.0 allows an authenticated user to inject SQL queries in 'mtms/admin/?page=transaction/view_details' via the 'id' par… |
CVE-2022-25222 | Critical | 9.8 | 2022-03-23 | Money Transfer Management System Version 1.0 allows an unauthenticated user to inject SQL queries in 'admin/maintenance/manage_branch.php' and 'admin/maintenan… |
CVE-2022-25221 | Medium | 6.1 | 2022-03-23 | Money Transfer Management System Version 1.0 allows an attacker to inject JavaScript code in the URL and then trick a user into visit the link in order to exec… |
CVE-2022-24293 | Critical | 9.8 | 2022-03-23 | Certain HP Print devices may be vulnerable to potential information disclosure, denial of service, or remote code execution. |
CVE-2022-24292 | Critical | 9.8 | 2022-03-23 | Certain HP Print devices may be vulnerable to potential information disclosure, denial of service, or remote code execution. |
CVE-2022-24291 | High | 7.5 | 2022-03-23 | Certain HP Print devices may be vulnerable to potential information disclosure, denial of service, or remote code execution. |
CVE-2022-22952 | Critical | 9.1 | 2022-03-23 | VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains a file upload vulnerabili… |
CVE-2022-22951 | Critical | 9.1 | 2022-03-23 | VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains an OS command injection v… |
CVE-2022-1030 | High | 8.8 | 2022-03-23 | Okta Advanced Server Access Client for Linux and macOS prior to version 1.58.0 was found to be vulnerable to command injection via a specially crafted URL. An… |
CVE-2022-0996 | Medium | 6.5 | 2022-03-23 | A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database to cause improper authentication. |
CVE-2022-0981 | High | 8.8 | 2022-03-23 | A flaw was found in Quarkus. The state and potentially associated permissions can leak from one web request to another in RestEasy Reactive. This flaw allows a… |
CVE-2022-0889 | High | 7.2 | 2022-03-23 | The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to reflected cross-site scripting due to missing sanitization of the files filename par… |
CVE-2022-0888 | Critical | 9.8 | 2022-03-23 | The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~… |
CVE-2022-0854 | Medium | 5.5 | 2022-03-23 | A memory leak flaw was found in the Linux kernel’s DMA subsystem, in the way a user calls DMA_FROM_DEVICE. This flaw allows a local user to read random memory… |
CVE-2022-0834 | High | 7.2 | 2022-03-23 | The Amelia WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the lastName parameter found in the ~/src/Ap… |
CVE-2022-0750 | Medium | 6.4 | 2022-03-23 | The Photoswipe Masonry Gallery WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the thumbnail_width, thu… |
CVE-2022-26243 | High | 7.5 | 2022-03-23 | Tenda AC10-1200 v15.03.06.23_EN was discovered to contain a buffer overflow in the setSmartPowerManagement function. |
CVE-2022-22316 | Medium | 6.5 | 2022-03-23 | IBM MQ Appliance 9.2 CD and 9.2 LTS could allow an authenticated and authorized user to cause a denial of service due to incorrectly configured authorization c… |
CVE-2022-23242 | Medium | 6.3 | 2022-03-23 | TeamViewer Linux versions before 15.28 do not properly execute a deletion command for the connection password in case of a process crash. Knowledge of the cras… |
CVE-2022-0862 | Low | 3.1 | 2022-03-23 | A lack of password change protection vulnerability in a depreciated API of McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote… |
CVE-2022-0861 | Low | 3.5 | 2022-03-23 | A XML Extended entity vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote administrator attacker to upload a… |
CVE-2022-0859 | Medium | 6.5 | 2022-03-23 | McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a local attacker to point an ePO server to an arbitrary SQL server during the resto… |
CVE-2022-0858 | Medium | 4.3 | 2022-03-23 | A cross-site scripting (XSS) vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote attacker to potentially obta… |
CVE-2022-0857 | Medium | 5.4 | 2022-03-23 | A reflected cross-site scripting (XSS) vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote attacker to potent… |
CVE-2022-0842 | Medium | 5.4 | 2022-03-23 | A blind SQL injection vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote authenticated attacker to potential… |
CVE-2022-0635 | High | 7.5 | 2022-03-23 | Versions affected: BIND 9.18.0 When a vulnerable version of named receives a series of specific queries, the named process will eventually terminate due to a f… |
CVE-2022-0396 | Medium | 5.3 | 2022-03-23 | BIND 9.16.11 -> 9.16.26, 9.17.0 -> 9.18.0 and versions 9.16.11-S1 -> 9.16.26-S1 of the BIND Supported Preview Edition. Specifically crafted TCP streams can cau… |
CVE-2022-1033 | High | 7.8 | 2022-03-23 | Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.6. |
CVE-2022-27666 | High | 7.8 | 2022-03-23 | A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw allows a local attacker with a normal… |
CVE-2022-25518 | Medium | 6.5 | 2022-03-22 | In CMDBuild from version 3.0 to 3.3.2 payload requests are saved in a temporary log table, which allows attackers with database access to read the password of… |
CVE-2022-26189 | Critical | 9.8 | 2022-03-22 | TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the langType parameter in the login interface. |
CVE-2022-26188 | Critical | 9.8 | 2022-03-22 | TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via /setting/NTPSyncWithHost. |
CVE-2022-26187 | Critical | 9.8 | 2022-03-22 | TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the pingCheck function. |
CVE-2022-26186 | Critical | 9.8 | 2022-03-22 | TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the exportOvpn interface at cstecgi.cgi. |
CVE-2022-1031 | High | 7.8 | 2022-03-22 | Use After Free in op_is_set_bp in GitHub repository radareorg/radare2 prior to 5.6.6. |
CVE-2022-26260 | Critical | 9.8 | 2022-03-22 | Simple-Plist v1.3.0 was discovered to contain a prototype pollution vulnerability via .parse(). |
CVE-2022-25517 | Critical | 9.8 | 2022-03-22 | MyBatis plus v3.4.3 was discovered to contain a SQL injection vulnerability via the Column parameter in /core/conditions/AbstractWrapper.java. NOTE: the vendor… |
CVE-2022-27228 | Critical | 9.8 | 2022-03-22 | In the vote (aka "Polls, Votes") module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can execute arbitrary code. |
CVE-2022-25484 | Medium | 5.5 | 2022-03-22 | tcpprep v4.4.1 has a reachable assertion (assert(l2len > 0)) in packet2tree() at tree.c in tcpprep v4.4.1. |
CVE-2022-24774 | High | 7.1 | 2022-03-22 | CycloneDX BOM Repository Server is a bill of materials (BOM) repository server for distributing CycloneDX BOMs. CycloneDX BOM Repository Server before version… |
CVE-2022-24764 | High | 7.5 | 2022-03-22 | PJSIP is a free and open source multimedia communication library written in C. Versions 2.12 and prior contain a stack buffer overflow vulnerability that affec… |
CVE-2022-21718 | Low | 3.4 | 2022-03-22 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to `17.0.0-alpha.6`… |
CVE-2022-1036 | High | 7.5 | 2022-03-22 | Able to create an account with long password leads to memory corruption / Integer Overflow in GitHub repository microweber/microweber prior to 1.2.12. |
CVE-2022-0667 | High | 7.5 | 2022-03-22 | When the vulnerability is triggered the BIND process will exit. BIND 9.18.0 |