2022 CVEs (page 240)
Page 240 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-0237 | Medium | 4.0 | 2022-03-17 | Rapid7 Insight Agent versions 3.1.2.38 and earlier suffer from a privilege escalation vulnerability, whereby an attacker can hijack the flow of execution due t… |
CVE-2022-24302 | Medium | 5.9 | 2022-03-17 | In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure. |
CVE-2022-26504 | High | 8.8 | 2022-03-17 | Improper authentication in Veeam Backup & Replication 9.5U3, 9.5U4,10.x and 11.x component used for Microsoft System Center Virtual Machine Manager (SCVMM) all… |
CVE-2022-26501 | Critical | 9.8 | 2022-03-17 | Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2). |
CVE-2022-26500 | High | 8.8 | 2022-03-17 | Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions… |
CVE-2022-24770 | High | 8.8 | 2022-03-17 | `gradio` is an open source framework for building interactive machine learning models and demos. Prior to version 2.8.11, `gradio` suffers from Improper Neutra… |
CVE-2022-21822 | High | 7.5 | 2022-03-17 | NVIDIA FLARE contains a vulnerability in the admin interface, where an un-authorized attacker can cause Allocation of Resources Without Limits or Throttling, w… |
CVE-2022-26511 | High | 7.8 | 2022-03-17 | WPS Presentation 11.8.0.5745 insecurely load d3dx9_41.dll when opening .pps files('current directory type' DLL loading). |
CVE-2022-26081 | High | 7.8 | 2022-03-17 | The installer of WPS Office Version 10.8.0.5745 insecurely load shcore.dll, allowing an attacker to execute arbitrary code with the privilege of the user invok… |
CVE-2022-25969 | High | 7.8 | 2022-03-17 | The installer of WPS Office Version 10.8.0.6186 insecurely load VERSION.DLL (or some other DLLs), allowing an attacker to execute arbitrary code with the privi… |
CVE-2022-25949 | High | 7.8 | 2022-03-17 | The kernel mode driver kwatch3 of KINGSOFT Internet Security 9 Plus Version 2010.06.23.247 fails to properly handle crafted inputs, leading to stack-based buff… |
CVE-2022-26503 | High | 7.8 | 2022-03-17 | Deserialization of untrusted data in Veeam Agent for Windows 2.0, 2.1, 2.2, 3.0.2, 4.x, and 5.x allows local users to run arbitrary code with local system priv… |
CVE-2022-25364 | High | 8.1 | 2022-03-17 | In Gradle Enterprise before 2021.4.2, the default built-in build cache configuration allowed anonymous write access. If this was not manually changed, a malici… |
CVE-2022-24759 | High | 8.1 | 2022-03-17 | `@chainsafe/libp2p-noise` contains TypeScript implementation of noise protocol, an encryption protocol used in libp2p. `@chainsafe/libp2p-noise` before 4.1.2 a… |
CVE-2022-26526 | High | 7.8 | 2022-03-17 | Anaconda Anaconda3 (Anaconda Distribution) through 2021.11.0.0 and Miniconda3 through 4.11.0.0 can create a world-writable directory under %PROGRAMDATA% and pl… |
CVE-2022-24761 | High | 7.5 | 2022-03-17 | Waitress is a Web Server Gateway Interface server for Python 2 and 3. When using Waitress versions 2.1.0 and prior behind a proxy that does not properly valida… |
CVE-2022-25760 | High | 7.1 | 2022-03-17 | All versions of package accesslog are vulnerable to Arbitrary Code Injection due to the usage of the Function constructor without input sanitization. If (attac… |
CVE-2022-25354 | High | 8.6 | 2022-03-17 | The package set-in before 2.0.3 are vulnerable to Prototype Pollution via the setIn method, as it allows an attacker to merge object prototypes into it. **Note… |
CVE-2022-25352 | High | 7.5 | 2022-03-17 | The package libnested before 1.5.2 are vulnerable to Prototype Pollution via the set function in index.js. **Note:** This vulnerability derives from an incompl… |
CVE-2022-25296 | Medium | 6.3 | 2022-03-17 | The package bodymen from 0.0.0 are vulnerable to Prototype Pollution via the handler function which could be tricked into adding or modifying properties of Obj… |
CVE-2022-21221 | Medium | 5.9 | 2022-03-17 | The package github.com/valyala/fasthttp before 1.34.0 are vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is pos… |
CVE-2022-0749 | High | 7.4 | 2022-03-17 | This affects all versions of package SinGooCMS.Utility. The socket client in the package can pass in the payload via the user-controllable input after it has b… |
CVE-2022-0748 | Critical | 9.8 | 2022-03-17 | The package post-loader from 0.0.0 are vulnerable to Arbitrary Code Execution which uses a markdown parser in an unsafe way so that any javascript code inside… |
CVE-2022-1000 | Critical | 9.8 | 2022-03-17 | Path Traversal in GitHub repository prasathmani/tinyfilemanager prior to 2.4.7. |
CVE-2022-24075 | Medium | 6.5 | 2022-03-17 | Whale browser before 3.12.129.18 allowed extensions to replace JavaScript files of the HWP viewer website which could access to local HWP files. When the HWP f… |
CVE-2022-24074 | Critical | 9.8 | 2022-03-17 | Whale Bridge, a default extension in Whale browser before 3.12.129.18, allowed to receive any SendMessage request from the content script itself that could lea… |
CVE-2022-24073 | High | 7.1 | 2022-03-17 | The Web Request API in Whale browser before 3.12.129.18 allowed to deny access to the extension store or redirect to any URL when users access the store. |
CVE-2022-24072 | Medium | 6.1 | 2022-03-17 | The devtools API in Whale browser before 3.12.129.18 allowed extension developers to inject arbitrary JavaScript into the extension store web page via devtools… |
CVE-2022-22273 | Critical | 9.8 | 2022-03-17 | Improper neutralization of Special Elements leading to OS Command Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products and older f… |
CVE-2022-25516 | Medium | 6.5 | 2022-03-17 | stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function stbtt__find_table at stb_truetype.h. NOTE: Third party has disputed stat… |
CVE-2022-25515 | Medium | 6.5 | 2022-03-17 | stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function ttULONG() at stb_truetype.h. NOTE: Third party has disputed stating that… |
CVE-2022-25514 | High | 7.5 | 2022-03-17 | stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function ttUSHORT() at stb_truetype.h. NOTE: Third party has disputed stating tha… |
CVE-2022-26534 | High | 7.5 | 2022-03-17 | FISCO-BCOS release-3.0.0-rc2 was discovered to contain an issue where a malicious node, via a malicious viewchange packet, will cause normal nodes to change vi… |
CVE-2022-26300 | High | 7.5 | 2022-03-17 | EOS v2.1.0 was discovered to contain a heap-buffer-overflow via the function txn_test_gen_plugin. |
CVE-2022-26295 | Medium | 5.4 | 2022-03-16 | A stored cross-site scripting (XSS) vulnerability in /ptms/?page=user of Online Project Time Management System v1.0 allows attackers to execute arbitrary web s… |
CVE-2022-26293 | Critical | 9.8 | 2022-03-16 | Online Project Time Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the function save_employee at /ptms/… |
CVE-2022-23610 | Critical | 9.1 | 2022-03-16 | wire-server provides back end services for Wire, an open source messenger. In versions of wire-server prior to the 2022-01-27 release, it was possible to craft… |
CVE-2022-24729 | Medium | 6.5 | 2022-03-16 | CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vu… |
CVE-2022-24728 | Medium | 5.4 | 2022-03-16 | CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all… |
CVE-2022-23812 | Critical | 9.8 | 2022-03-16 | This affects the package node-ipc from 10.1.1 and before 10.1.3. This package contains malicious code, that targets users with IP located in Russia or Belarus… |
CVE-2022-21164 | Low | 3.7 | 2022-03-16 | The package node-lmdb before 0.9.7 are vulnerable to Denial of Service (DoS) when defining a non-invokable ToString value, which will cause a crash during type… |
CVE-2022-26660 | High | 7.5 | 2022-03-16 | RunAsSpc 4.0 uses a universal and recoverable encryption key. In possession of a file encrypted by RunAsSpc, an attacker can recover the credentials that were… |
CVE-2022-26354 | Low | 3.2 | 2022-03-16 | A flaw was found in the vhost-vsock device of QEMU. In case of error, an invalid element was not detached from the virtqueue before freeing its memory, leading… |
CVE-2022-26353 | High | 7.5 | 2022-03-16 | A flaw was found in the virtio-net device of QEMU. This flaw was inadvertently introduced with the fix for CVE-2021-3748, which forgot to unmap the cached virt… |
CVE-2022-25252 | High | 7.5 | 2022-03-16 | When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) when receiving certain input throws an excepti… |
CVE-2022-25251 | Critical | 9.8 | 2022-03-16 | When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send certain XML mess… |
CVE-2022-25250 | High | 7.5 | 2022-03-16 | When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send a certain comman… |
CVE-2022-25249 | High | 7.5 | 2022-03-16 | When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) (disregarding Axeda agent v6.9.2 and v6.9.3) i… |
CVE-2022-25248 | Medium | 5.3 | 2022-03-16 | When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) supplies the event log of the specific service. |
CVE-2022-25247 | Critical | 9.8 | 2022-03-16 | Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send certain commands to a specific port without authen… |
CVE-2022-25246 | Critical | 9.8 | 2022-03-16 | Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) uses hard-coded credentials for its UltraVNC installation. Successful exploitati… |
CVE-2022-23234 | Medium | 5.5 | 2022-03-16 | SnapCenter versions prior to 4.5 are susceptible to a vulnerability which could allow a local authenticated attacker to discover plaintext HANA credentials. |
CVE-2022-0982 | Critical | 9.8 | 2022-03-16 | The telnet_input_char function in opt/src/accel-pppd/cli/telnet.c suffers from a memory corruption vulnerability, whereby user input cmdline_len is copied into… |
CVE-2022-0959 | Medium | 6.5 | 2022-03-16 | A malicious, but authorised and authenticated user can construct an HTTP request using their existing CSRF token and session cookie to manually upload files to… |
CVE-2022-0918 | High | 7.5 | 2022-03-16 | A vulnerability was discovered in the 389 Directory Server that allows an unauthenticated attacker with network access to the LDAP port to cause a denial of se… |
CVE-2022-0811 | High | 8.8 | 2022-03-16 | A flaw was found in CRI-O in the way it set kernel options for a pod. This issue allows anyone with rights to deploy a pod on a Kubernetes cluster that uses th… |
CVE-2022-24751 | Medium | 5.4 | 2022-03-16 | Zulip is an open source group chat application. Starting with version 4.0 and prior to version 4.11, Zulip is vulnerable to a race condition during account dea… |
CVE-2022-0986 | Medium | 6.1 | 2022-03-16 | Reflected Cross-site Scripting (XSS) Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.11. |
CVE-2022-0705 | Medium | 5.4 | 2022-03-16 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0. |
CVE-2022-21946 | Medium | 5.3 | 2022-03-16 | A Incorrect Permission Assignment for Critical Resource vulnerability in the sudoers configuration in cscreen of openSUSE Factory allows any local users to gai… |
CVE-2022-21945 | Medium | 5.1 | 2022-03-16 | A Insecure Temporary File vulnerability in cscreen of openSUSE Factory allows local attackers to cause DoS for cscreen and a system DoS for non-default systems… |
CVE-2022-0704 | Medium | 5.4 | 2022-03-16 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0. |
CVE-2022-0911 | Medium | 5.4 | 2022-03-16 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0. |
CVE-2022-27225 | Medium | 6.5 | 2022-03-16 | Gradle Enterprise before 2021.4.3 relies on cleartext data transmission in some situations. It uses Keycloak for identity management services. During the sign-… |
CVE-2022-27223 | High | 8.8 | 2022-03-16 | In drivers/usb/gadget/udc/udc-xilinx.c in the Linux kernel before 5.16.12, the endpoint index is not validated and might be manipulated by the host for out-of-… |
CVE-2022-27005 | Critical | 9.8 | 2022-03-15 | Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the setWanCf… |
CVE-2022-27004 | Critical | 9.8 | 2022-03-15 | Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the Tunnel 6… |
CVE-2022-27003 | Critical | 9.8 | 2022-03-15 | Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the Tunnel 6… |
CVE-2022-27002 | Critical | 9.8 | 2022-03-15 | Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the ddns function via the ddns_name, ddns_pwd, h_ddns、ddns_host parameters… |
CVE-2022-27001 | Critical | 9.8 | 2022-03-15 | Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the dhcp function via the hostname parameter. This vulnerability allows at… |
CVE-2022-27000 | Critical | 9.8 | 2022-03-15 | Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the time and time zone function via the h_primary_ntp_server, h_backup_ntp_… |
CVE-2022-26999 | Critical | 9.8 | 2022-03-15 | Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the static ip settings function via the wan_ip_stat, wan_mask_stat, wan_gw_… |
CVE-2022-26998 | Critical | 9.8 | 2022-03-15 | Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the wps setting function via the wps_enrolee_pin parameter. This vulnerabil… |
CVE-2022-26997 | Critical | 9.8 | 2022-03-15 | Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the upnp function via the upnp_ttl parameter. This vulnerability allows att… |
CVE-2022-26996 | Critical | 9.8 | 2022-03-15 | Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the pppoe function via the pppoe_username, pppoe_passwd, and pppoe_servicen… |
CVE-2022-26995 | Critical | 9.8 | 2022-03-15 | Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the pptp (wan_pptp.html) function via the pptp_fix_ip, pptp_fix_mask, pptp_… |
CVE-2022-26994 | Critical | 9.8 | 2022-03-15 | Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the pptp f… |
CVE-2022-26993 | Critical | 9.8 | 2022-03-15 | Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the pppoe… |
CVE-2022-26992 | Critical | 9.8 | 2022-03-15 | Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the ddns f… |
CVE-2022-26991 | Critical | 9.8 | 2022-03-15 | Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the ntp fu… |
CVE-2022-26990 | Critical | 9.8 | 2022-03-15 | Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the firewa… |
CVE-2022-26214 | Critical | 9.8 | 2022-03-15 | Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B2020112… |
CVE-2022-26213 | Critical | 9.8 | 2022-03-15 | Totolink X5000R_Firmware v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function setNtpCfg, via the tz parameters. T… |
CVE-2022-26212 | Critical | 9.8 | 2022-03-15 | Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B2020112… |
CVE-2022-26211 | Critical | 9.8 | 2022-03-15 | Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B2020112… |
CVE-2022-26210 | Critical | 9.8 | 2022-03-15 | Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B2020112… |
CVE-2022-26209 | Critical | 9.8 | 2022-03-15 | Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B2020112… |
CVE-2022-26208 | Critical | 9.8 | 2022-03-15 | Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B2020112… |
CVE-2022-26207 | Critical | 9.8 | 2022-03-15 | Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B2020112… |
CVE-2022-26206 | Critical | 9.8 | 2022-03-15 | Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B2020112… |
CVE-2022-23989 | High | 7.5 | 2022-03-15 | In Stormshield Network Security (SNS) before 3.7.25, 3.8.x through 3.11.x before 3.11.13, 4.x before 4.2.10, and 4.3.x before 4.3.5, a flood of connections to… |
CVE-2022-25498 | Critical | 9.8 | 2022-03-15 | CuppaCMS v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the saveConfigData function in /classes/ajax/Functions.php. |
CVE-2022-25497 | Medium | 5.3 | 2022-03-15 | CuppaCMS v1.0 was discovered to contain an arbitrary file read via the copy function. |
CVE-2022-25495 | Critical | 9.8 | 2022-03-15 | The component /jquery_file_upload/server/php/index.php of CuppaCMS v1.0 allows attackers to upload arbitrary files and execute arbitrary code via a crafted PHP… |
CVE-2022-25494 | Critical | 9.8 | 2022-03-15 | Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via staff_login.php. |
CVE-2022-25493 | Medium | 6.1 | 2022-03-15 | HMS v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via treatmentrecord.php. |
CVE-2022-25492 | Critical | 9.8 | 2022-03-15 | HMS v1.0 was discovered to contain a SQL injection vulnerability via the medicineid parameter in ajaxmedicine.php. |
CVE-2022-25491 | High | 7.5 | 2022-03-15 | HMS v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in appointment.php. |
CVE-2022-25490 | Critical | 9.8 | 2022-03-15 | HMS v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in department.php. |
CVE-2022-25489 | Medium | 5.4 | 2022-03-15 | Atom CMS v2.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the "A" parameter in /widgets/debug.php. |