2022 CVEs (page 240)
Page 240 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-21221 | Medium | 5.9 | 2022-03-17 | The package github.com/valyala/fasthttp before 1.34.0 are vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is pos… |
CVE-2022-0749 | High | 7.4 | 2022-03-17 | This affects all versions of package SinGooCMS.Utility. The socket client in the package can pass in the payload via the user-controllable input after it has b… |
CVE-2022-0748 | Critical | 9.8 | 2022-03-17 | The package post-loader from 0.0.0 are vulnerable to Arbitrary Code Execution which uses a markdown parser in an unsafe way so that any javascript code inside… |
CVE-2022-1000 | Critical | 9.8 | 2022-03-17 | Path Traversal in GitHub repository prasathmani/tinyfilemanager prior to 2.4.7. |
CVE-2022-24075 | Medium | 6.5 | 2022-03-17 | Whale browser before 3.12.129.18 allowed extensions to replace JavaScript files of the HWP viewer website which could access to local HWP files. When the HWP f… |
CVE-2022-24074 | Critical | 9.8 | 2022-03-17 | Whale Bridge, a default extension in Whale browser before 3.12.129.18, allowed to receive any SendMessage request from the content script itself that could lea… |
CVE-2022-24073 | High | 7.1 | 2022-03-17 | The Web Request API in Whale browser before 3.12.129.18 allowed to deny access to the extension store or redirect to any URL when users access the store. |
CVE-2022-24072 | Medium | 6.1 | 2022-03-17 | The devtools API in Whale browser before 3.12.129.18 allowed extension developers to inject arbitrary JavaScript into the extension store web page via devtools… |
CVE-2022-22273 | Critical | 9.8 | 2022-03-17 | Improper neutralization of Special Elements leading to OS Command Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products and older f… |
CVE-2022-25516 | Medium | 6.5 | 2022-03-17 | stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function stbtt__find_table at stb_truetype.h. NOTE: Third party has disputed stat… |
CVE-2022-25515 | Medium | 6.5 | 2022-03-17 | stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function ttULONG() at stb_truetype.h. NOTE: Third party has disputed stating that… |
CVE-2022-25514 | High | 7.5 | 2022-03-17 | stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function ttUSHORT() at stb_truetype.h. NOTE: Third party has disputed stating tha… |
CVE-2022-26534 | High | 7.5 | 2022-03-17 | FISCO-BCOS release-3.0.0-rc2 was discovered to contain an issue where a malicious node, via a malicious viewchange packet, will cause normal nodes to change vi… |
CVE-2022-26300 | High | 7.5 | 2022-03-17 | EOS v2.1.0 was discovered to contain a heap-buffer-overflow via the function txn_test_gen_plugin. |
CVE-2022-26295 | Medium | 5.4 | 2022-03-16 | A stored cross-site scripting (XSS) vulnerability in /ptms/?page=user of Online Project Time Management System v1.0 allows attackers to execute arbitrary web s… |
CVE-2022-26293 | Critical | 9.8 | 2022-03-16 | Online Project Time Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the function save_employee at /ptms/… |
CVE-2022-23610 | Critical | 9.1 | 2022-03-16 | wire-server provides back end services for Wire, an open source messenger. In versions of wire-server prior to the 2022-01-27 release, it was possible to craft… |
CVE-2022-24729 | Medium | 6.5 | 2022-03-16 | CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vu… |
CVE-2022-24728 | Medium | 5.4 | 2022-03-16 | CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all… |
CVE-2022-23812 | Critical | 9.8 | 2022-03-16 | This affects the package node-ipc from 10.1.1 and before 10.1.3. This package contains malicious code, that targets users with IP located in Russia or Belarus… |
CVE-2022-21164 | Low | 3.7 | 2022-03-16 | The package node-lmdb before 0.9.7 are vulnerable to Denial of Service (DoS) when defining a non-invokable ToString value, which will cause a crash during type… |
CVE-2022-26660 | High | 7.5 | 2022-03-16 | RunAsSpc 4.0 uses a universal and recoverable encryption key. In possession of a file encrypted by RunAsSpc, an attacker can recover the credentials that were… |
CVE-2022-26354 | Low | 3.2 | 2022-03-16 | A flaw was found in the vhost-vsock device of QEMU. In case of error, an invalid element was not detached from the virtqueue before freeing its memory, leading… |
CVE-2022-26353 | High | 7.5 | 2022-03-16 | A flaw was found in the virtio-net device of QEMU. This flaw was inadvertently introduced with the fix for CVE-2021-3748, which forgot to unmap the cached virt… |
CVE-2022-25252 | High | 7.5 | 2022-03-16 | When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) when receiving certain input throws an excepti… |
CVE-2022-25251 | Critical | 9.8 | 2022-03-16 | When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send certain XML mess… |
CVE-2022-25250 | High | 7.5 | 2022-03-16 | When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send a certain comman… |
CVE-2022-25249 | High | 7.5 | 2022-03-16 | When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) (disregarding Axeda agent v6.9.2 and v6.9.3) i… |
CVE-2022-25248 | Medium | 5.3 | 2022-03-16 | When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) supplies the event log of the specific service. |
CVE-2022-25247 | Critical | 9.8 | 2022-03-16 | Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send certain commands to a specific port without authen… |
CVE-2022-25246 | Critical | 9.8 | 2022-03-16 | Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) uses hard-coded credentials for its UltraVNC installation. Successful exploitati… |
CVE-2022-23234 | Medium | 5.5 | 2022-03-16 | SnapCenter versions prior to 4.5 are susceptible to a vulnerability which could allow a local authenticated attacker to discover plaintext HANA credentials. |
CVE-2022-0982 | Critical | 9.8 | 2022-03-16 | The telnet_input_char function in opt/src/accel-pppd/cli/telnet.c suffers from a memory corruption vulnerability, whereby user input cmdline_len is copied into… |
CVE-2022-0959 | Medium | 6.5 | 2022-03-16 | A malicious, but authorised and authenticated user can construct an HTTP request using their existing CSRF token and session cookie to manually upload files to… |
CVE-2022-0918 | High | 7.5 | 2022-03-16 | A vulnerability was discovered in the 389 Directory Server that allows an unauthenticated attacker with network access to the LDAP port to cause a denial of se… |
CVE-2022-0811 | High | 8.8 | 2022-03-16 | A flaw was found in CRI-O in the way it set kernel options for a pod. This issue allows anyone with rights to deploy a pod on a Kubernetes cluster that uses th… |
CVE-2022-24751 | Medium | 5.4 | 2022-03-16 | Zulip is an open source group chat application. Starting with version 4.0 and prior to version 4.11, Zulip is vulnerable to a race condition during account dea… |
CVE-2022-0986 | Medium | 6.1 | 2022-03-16 | Reflected Cross-site Scripting (XSS) Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.11. |
CVE-2022-0705 | Medium | 5.4 | 2022-03-16 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0. |
CVE-2022-21946 | Medium | 5.3 | 2022-03-16 | A Incorrect Permission Assignment for Critical Resource vulnerability in the sudoers configuration in cscreen of openSUSE Factory allows any local users to gai… |
CVE-2022-21945 | Medium | 5.1 | 2022-03-16 | A Insecure Temporary File vulnerability in cscreen of openSUSE Factory allows local attackers to cause DoS for cscreen and a system DoS for non-default systems… |
CVE-2022-0704 | Medium | 5.4 | 2022-03-16 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0. |
CVE-2022-0911 | Medium | 5.4 | 2022-03-16 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0. |
CVE-2022-27225 | Medium | 6.5 | 2022-03-16 | Gradle Enterprise before 2021.4.3 relies on cleartext data transmission in some situations. It uses Keycloak for identity management services. During the sign-… |
CVE-2022-27223 | High | 8.8 | 2022-03-16 | In drivers/usb/gadget/udc/udc-xilinx.c in the Linux kernel before 5.16.12, the endpoint index is not validated and might be manipulated by the host for out-of-… |
CVE-2022-27005 | Critical | 9.8 | 2022-03-15 | Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the setWanCf… |
CVE-2022-27004 | Critical | 9.8 | 2022-03-15 | Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the Tunnel 6… |
CVE-2022-27003 | Critical | 9.8 | 2022-03-15 | Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the Tunnel 6… |
CVE-2022-27002 | Critical | 9.8 | 2022-03-15 | Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the ddns function via the ddns_name, ddns_pwd, h_ddns、ddns_host parameters… |
CVE-2022-27001 | Critical | 9.8 | 2022-03-15 | Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the dhcp function via the hostname parameter. This vulnerability allows at… |
CVE-2022-27000 | Critical | 9.8 | 2022-03-15 | Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the time and time zone function via the h_primary_ntp_server, h_backup_ntp_… |
CVE-2022-26999 | Critical | 9.8 | 2022-03-15 | Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the static ip settings function via the wan_ip_stat, wan_mask_stat, wan_gw_… |
CVE-2022-26998 | Critical | 9.8 | 2022-03-15 | Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the wps setting function via the wps_enrolee_pin parameter. This vulnerabil… |
CVE-2022-26997 | Critical | 9.8 | 2022-03-15 | Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the upnp function via the upnp_ttl parameter. This vulnerability allows att… |
CVE-2022-26996 | Critical | 9.8 | 2022-03-15 | Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the pppoe function via the pppoe_username, pppoe_passwd, and pppoe_servicen… |
CVE-2022-26995 | Critical | 9.8 | 2022-03-15 | Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the pptp (wan_pptp.html) function via the pptp_fix_ip, pptp_fix_mask, pptp_… |
CVE-2022-26994 | Critical | 9.8 | 2022-03-15 | Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the pptp f… |
CVE-2022-26993 | Critical | 9.8 | 2022-03-15 | Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the pppoe… |
CVE-2022-26992 | Critical | 9.8 | 2022-03-15 | Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the ddns f… |
CVE-2022-26991 | Critical | 9.8 | 2022-03-15 | Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the ntp fu… |
CVE-2022-26990 | Critical | 9.8 | 2022-03-15 | Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the firewa… |
CVE-2022-26214 | Critical | 9.8 | 2022-03-15 | Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B2020112… |
CVE-2022-26213 | Critical | 9.8 | 2022-03-15 | Totolink X5000R_Firmware v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function setNtpCfg, via the tz parameters. T… |
CVE-2022-26212 | Critical | 9.8 | 2022-03-15 | Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B2020112… |
CVE-2022-26211 | Critical | 9.8 | 2022-03-15 | Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B2020112… |
CVE-2022-26210 | Critical | 9.8 | 2022-03-15 | Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B2020112… |
CVE-2022-26209 | Critical | 9.8 | 2022-03-15 | Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B2020112… |
CVE-2022-26208 | Critical | 9.8 | 2022-03-15 | Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B2020112… |
CVE-2022-26207 | Critical | 9.8 | 2022-03-15 | Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B2020112… |
CVE-2022-26206 | Critical | 9.8 | 2022-03-15 | Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B2020112… |
CVE-2022-23989 | High | 7.5 | 2022-03-15 | In Stormshield Network Security (SNS) before 3.7.25, 3.8.x through 3.11.x before 3.11.13, 4.x before 4.2.10, and 4.3.x before 4.3.5, a flood of connections to… |
CVE-2022-25498 | Critical | 9.8 | 2022-03-15 | CuppaCMS v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the saveConfigData function in /classes/ajax/Functions.php. |
CVE-2022-25497 | Medium | 5.3 | 2022-03-15 | CuppaCMS v1.0 was discovered to contain an arbitrary file read via the copy function. |
CVE-2022-25495 | Critical | 9.8 | 2022-03-15 | The component /jquery_file_upload/server/php/index.php of CuppaCMS v1.0 allows attackers to upload arbitrary files and execute arbitrary code via a crafted PHP… |
CVE-2022-25494 | Critical | 9.8 | 2022-03-15 | Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via staff_login.php. |
CVE-2022-25493 | Medium | 6.1 | 2022-03-15 | HMS v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via treatmentrecord.php. |
CVE-2022-25492 | Critical | 9.8 | 2022-03-15 | HMS v1.0 was discovered to contain a SQL injection vulnerability via the medicineid parameter in ajaxmedicine.php. |
CVE-2022-25491 | High | 7.5 | 2022-03-15 | HMS v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in appointment.php. |
CVE-2022-25490 | Critical | 9.8 | 2022-03-15 | HMS v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in department.php. |
CVE-2022-25489 | Medium | 5.4 | 2022-03-15 | Atom CMS v2.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the "A" parameter in /widgets/debug.php. |
CVE-2022-25488 | Critical | 9.8 | 2022-03-15 | Atom CMS v2.0 was discovered to contain a SQL injection vulnerability via the id parameter in /admin/ajax/avatar.php. |
CVE-2022-25487 | Critical | 9.8 | 2022-03-15 | Atom CMS v2.0 was discovered to contain a remote code execution (RCE) vulnerability via /admin/uploads.php. |
CVE-2022-25486 | High | 7.8 | 2022-03-15 | CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertConfigField.php. |
CVE-2022-25485 | High | 7.8 | 2022-03-15 | CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertLightbox.php. |
CVE-2022-27218 | Medium | 4.3 | 2022-03-15 | Jenkins incapptic connect uploader Plugin 1.15 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed… |
CVE-2022-27217 | Medium | 6.5 | 2022-03-15 | Jenkins Vmware vRealize CodeStream Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be view… |
CVE-2022-27216 | Medium | 6.5 | 2022-03-15 | Jenkins dbCharts Plugin 0.5.2 and earlier stores JDBC connection passwords unencrypted in its global configuration file on the Jenkins controller where they ca… |
CVE-2022-27215 | Medium | 4.3 | 2022-03-15 | A missing permission check in Jenkins Release Helper Plugin 1.3.3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified… |
CVE-2022-27214 | Medium | 4.3 | 2022-03-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins Release Helper Plugin 1.3.3 and earlier allows attackers to connect to an attacker-specified URL u… |
CVE-2022-27213 | Medium | 5.4 | 2022-03-15 | Jenkins Environment Dashboard Plugin 1.1.10 and earlier does not escape the Environment order and the Component order configuration values in its views, result… |
CVE-2022-27212 | Medium | 5.4 | 2022-03-15 | Jenkins List Git Branches Parameter Plugin 0.0.9 and earlier does not escape the name of the 'List Git branches (and more)' parameter, resulting in a stored cr… |
CVE-2022-27211 | Medium | 6.5 | 2022-03-15 | A missing permission check in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers with Overall/Read permission to connect to an atta… |
CVE-2022-27210 | Medium | 6.5 | 2022-03-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers to connect to an attacker-s… |
CVE-2022-27209 | Medium | 6.5 | 2022-03-15 | A missing permission check in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers with Overall/Read permission to enumerate credenti… |
CVE-2022-27208 | Medium | 6.5 | 2022-03-15 | Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows users with Credentials/Create permission to read arbitrary files on the Jenkins controller. |
CVE-2022-27207 | Medium | 4.8 | 2022-03-15 | Jenkins global-build-stats Plugin 1.5 and earlier does not escape multiple fields in the chart configuration on the 'Global Build Stats' page, resulting in a s… |
CVE-2022-27206 | Medium | 6.5 | 2022-03-15 | Jenkins GitLab Authentication Plugin 1.13 and earlier stores the GitLab client secret unencrypted in the global config.xml file on the Jenkins controller where… |
CVE-2022-27205 | Medium | 4.3 | 2022-03-15 | A missing permission check in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Overall/Read permission to connect… |
CVE-2022-27204 | High | 8.8 | 2022-03-15 | A cross-site request forgery vulnerability in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers to connect to an attacke… |
CVE-2022-27203 | Medium | 6.5 | 2022-03-15 | Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Item/Configure permission to read values from arbitrary JSON and… |