2022 CVEs (page 242)
Page 242 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-24576 | Medium | 5.5 | 2022-03-14 | GPAC 1.0.1 is affected by Use After Free through MP4Box. |
CVE-2022-24575 | High | 7.8 | 2022-03-14 | GPAC 1.0.1 is affected by a stack-based buffer overflow through MP4Box. |
CVE-2022-24574 | Medium | 5.5 | 2022-03-14 | GPAC 1.0.1 is affected by a NULL pointer dereference in gf_dump_vrml_field.isra (). |
CVE-2022-0946 | Medium | 5.4 | 2022-03-14 | Stored XSS viva cshtm file upload in GitHub repository star7th/showdoc prior to v2.10.4. |
CVE-2022-24387 | Critical | 9.1 | 2022-03-14 | With administrator or admin privileges the application can be tricked into overwriting files in app_data/Config folder, e.g. the systemsettings.xml file. THis… |
CVE-2022-24386 | High | 8.8 | 2022-03-14 | Stored XSS in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010. |
CVE-2022-24385 | Medium | 6.5 | 2022-03-14 | A Direct Object Access vulnerability in SmarterTools SmarterTrack leads to information disclosure This issue affects: SmarterTools SmarterTrack 100.0.8019.1401… |
CVE-2022-24384 | High | 8.8 | 2022-03-14 | Cross-site Scripting (XSS) vulnerability in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010. |
CVE-2022-0941 | Medium | 5.4 | 2022-03-14 | Stored XSS due to Unrestricted File Upload in GitHub repository star7th/showdoc prior to v2.10.4. |
CVE-2022-23943 | Critical | 9.8 | 2022-03-14 | Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. This issue… |
CVE-2022-22721 | Critical | 9.1 | 2022-03-14 | If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out o… |
CVE-2022-22720 | Critical | 9.8 | 2022-03-14 | Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Re… |
CVE-2022-22719 | High | 7.5 | 2022-03-14 | A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52… |
CVE-2022-0940 | Medium | 5.4 | 2022-03-14 | Stored XSS due to Unrestricted File Upload in GitHub repository star7th/showdoc prior to v2.10.4. |
CVE-2022-0938 | Medium | 5.4 | 2022-03-14 | Stored XSS via file upload in GitHub repository star7th/showdoc prior to v2.10.4. |
CVE-2022-0341 | Medium | 5.4 | 2022-03-14 | Cross-site Scripting (XSS) - Stored in GitHub repository vanessa219/vditor prior to 3.8.12. |
CVE-2022-0937 | Medium | 5.4 | 2022-03-14 | Stored xss in showdoc through file upload in GitHub repository star7th/showdoc prior to 2.10.4. |
CVE-2022-26981 | High | 7.8 | 2022-03-13 | Liblouis through 3.21.0 has a buffer overflow in compilePassOpcode in compileTranslationTable.c (called, indirectly, by tools/lou_checktable.c). |
CVE-2022-24696 | High | 7.8 | 2022-03-13 | Mirametrix Glance before 5.1.1.42207 (released on 2018-08-30) allows a local attacker to elevate privileges. NOTE: this is unrelated to products from the glanc… |
CVE-2022-24128 | High | 8.0 | 2022-03-13 | Timescale TimescaleDB 1.x and 2.x before 2.5.2 may allow privilege escalation during extension installation. The installation process uses commands such as CRE… |
CVE-2022-23960 | Medium | 5.6 | 2022-03-13 | Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB. An attacker can leverage the shared… |
CVE-2022-26967 | High | 7.8 | 2022-03-12 | GPAC 2.0 allows a heap-based buffer overflow in gf_base64_encode. It can be triggered via MP4Box. |
CVE-2022-26966 | Medium | 5.5 | 2022-03-12 | An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to obtain sensitive information from heap memory via craf… |
CVE-2022-0930 | Medium | 4.8 | 2022-03-12 | File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12. |
CVE-2022-0929 | Medium | 6.1 | 2022-03-12 | XSS on dynamic_text module in GitHub repository microweber/microweber prior to 1.2.11. |
CVE-2022-0926 | Medium | 4.8 | 2022-03-12 | File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12. |
CVE-2022-0880 | Medium | 5.4 | 2022-03-12 | Cross-site Scripting (XSS) - Stored in GitHub repository star7th/showdoc prior to 2.10.2. |
CVE-2022-26533 | Medium | 6.1 | 2022-03-12 | Alist v2.1.0 and below was discovered to contain a cross-site scripting (XSS) vulnerability via /i/:data/ipa.plist. |
CVE-2022-26276 | Medium | 5.3 | 2022-03-12 | An issue in index.php of OneNav v0.9.14 allows attackers to perform directory traversal. |
CVE-2022-24760 | Critical | 10.0 | 2022-03-12 | Parse Server is an open source http web server backend. In versions prior to 4.10.7 there is a Remote Code Execution (RCE) vulnerability in Parse Server. This… |
CVE-2022-24421 | High | 8.2 | 2022-03-11 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI… |
CVE-2022-24420 | High | 8.2 | 2022-03-11 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI… |
CVE-2022-24419 | High | 8.2 | 2022-03-11 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI… |
CVE-2022-24416 | High | 8.2 | 2022-03-11 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI… |
CVE-2022-24415 | High | 8.2 | 2022-03-11 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI… |
CVE-2022-25839 | Medium | 4.3 | 2022-03-11 | The package url-js before 2.1.0 are vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed… |
CVE-2022-24754 | High | 8.5 | 2022-03-11 | PJSIP is a free and open source multimedia communication library written in C language. In versions prior to and including 2.12 PJSIP there is a stack-buffer o… |
CVE-2022-25621 | Critical | 9.8 | 2022-03-11 | UUNIVERGE WA 1020 Ver8.2.11 and prior, UNIVERGE WA 1510 Ver8.2.11 and prior, UNIVERGE WA 1511 Ver8.2.11 and prior, UNIVERGE WA 1512 Ver8.2.11 and prior, UNIVER… |
CVE-2022-25601 | Medium | 4.7 | 2022-03-11 | Reflected Cross-Site Scripting (XSS) vulnerability affecting parameter &tab discovered in Contact Form X WordPress plugin (versions <= 2.4). |
CVE-2022-25600 | Medium | 5.4 | 2022-03-11 | Cross-Site Request Forgery (CSRF) vulnerability affecting Delete Marker Category, Delete Map, and Copy Map functions in WP Google Map plugin (versions <= 4.2.3… |
CVE-2022-25216 | High | 7.5 | 2022-03-11 | An absolute path traversal vulnerability allows a remote attacker to download any file on the Windows file system for which the user account running DVDFab 12… |
CVE-2022-24097 | High | 7.8 | 2022-03-11 | Adobe After Effects versions 22.2 (and earlier) and 18.4.4 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary co… |
CVE-2022-24096 | High | 7.8 | 2022-03-11 | Adobe After Effects versions 22.2 (and earlier) and 18.4.4 (and earlier) are affected by an Heap-based Buffer Overflow vulnerability that could result in arbit… |
CVE-2022-24095 | High | 7.8 | 2022-03-11 | Adobe After Effects versions 22.2 (and earlier) and 18.4.4 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbit… |
CVE-2022-24094 | High | 7.8 | 2022-03-11 | Adobe After Effects versions 22.2 (and earlier) and 18.4.4 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbit… |
CVE-2022-24090 | Medium | 5.5 | 2022-03-11 | Adobe Photoshop versions 23.1.1 (and earlier) and 22.5.5 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sen… |
CVE-2022-23934 | High | 8.2 | 2022-03-11 | Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution… |
CVE-2022-23933 | High | 8.2 | 2022-03-11 | Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution… |
CVE-2022-23932 | High | 8.2 | 2022-03-11 | Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution… |
CVE-2022-23931 | High | 8.2 | 2022-03-11 | Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution… |
CVE-2022-23930 | High | 8.2 | 2022-03-11 | Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution… |
CVE-2022-23929 | High | 8.2 | 2022-03-11 | Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution… |
CVE-2022-23928 | High | 8.2 | 2022-03-11 | Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution… |
CVE-2022-23927 | High | 8.2 | 2022-03-11 | Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution… |
CVE-2022-23926 | High | 8.2 | 2022-03-11 | Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution… |
CVE-2022-23925 | High | 8.2 | 2022-03-11 | Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution… |
CVE-2022-23924 | High | 8.2 | 2022-03-11 | Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution… |
CVE-2022-23731 | High | 7.8 | 2022-03-11 | V8 javascript engine (heap vulnerability) can cause privilege escalation ,which can impact on some webOS TV models. |
CVE-2022-23730 | Critical | 9.8 | 2022-03-11 | The public API error causes for the attacker to be able to bypass API access control. |
CVE-2022-23625 | Medium | 6.5 | 2022-03-11 | Wire-ios is a messaging application using the wire protocol on apple's ios platform. In versions prior to 3.95 malformed resource identifiers may render the iO… |
CVE-2022-23187 | High | 7.8 | 2022-03-11 | Adobe Illustrator version 26.0.3 (and earlier) is affected by a buffer overflow vulnerability due to insecure handling of a crafted file, potentially resulting… |
CVE-2022-0924 | Medium | 5.5 | 2022-03-11 | Out-of-bounds Read error in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from… |
CVE-2022-0921 | Medium | 6.7 | 2022-03-11 | Abusing Backup/Restore feature to achieve Remote Code Execution in GitHub repository microweber/microweber prior to 1.2.12. |
CVE-2022-0909 | Medium | 5.5 | 2022-03-11 | Divide By Zero error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from so… |
CVE-2022-0908 | High | 7.7 | 2022-03-11 | Null source pointer passed as an argument to memcpy() function within TIFFFetchNormalTag () in tif_dirread.c in libtiff versions up to 4.3.0 could lead to Deni… |
CVE-2022-0907 | Medium | 5.5 | 2022-03-11 | Unchecked Return Value to NULL Pointer Dereference in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For user… |
CVE-2022-0853 | High | 7.5 | 2022-03-11 | A flaw was found in JBoss-client. The vulnerability occurs due to a memory leak on the JBoss client-side, when using UserTransaction repeatedly and leads to in… |
CVE-2022-0002 | Medium | 6.5 | 2022-03-11 | Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an authorized user to potentially enable information disclos… |
CVE-2022-0001 | Medium | 6.5 | 2022-03-11 | Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may allow an authorized user to potentially enable informati… |
CVE-2022-24433 | High | 8.1 | 2022-03-11 | The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. When calling the .fetch(remote, branch, handlerFn) function, bo… |
CVE-2022-0932 | Medium | 6.5 | 2022-03-11 | Missing Authorization in GitHub repository saleor/saleor prior to 3.1.2. |
CVE-2022-21819 | High | 7.6 | 2022-03-11 | NVIDIA distributions of Jetson Linux contain a vulnerability where an error in the IOMMU configuration may allow an unprivileged attacker with physical access… |
CVE-2022-0860 | Critical | 9.1 | 2022-03-11 | Improper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2. |
CVE-2022-0871 | Critical | 9.1 | 2022-03-11 | Missing Authorization in GitHub repository gogs/gogs prior to 0.12.5. |
CVE-2022-0928 | Medium | 5.4 | 2022-03-11 | Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.12. |
CVE-2022-0870 | Medium | 5.3 | 2022-03-11 | Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.5. |
CVE-2022-0913 | High | 7.5 | 2022-03-11 | Integer Overflow or Wraparound in GitHub repository microweber/microweber prior to 1.3. |
CVE-2022-0912 | Medium | 4.8 | 2022-03-11 | Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.2.11. |
CVE-2022-23402 | Critical | 9.8 | 2022-03-11 | The following Yokogawa Electric products hard-code the password for CAMS server applications: CENTUM VP versions from R5.01.00 to R5.04.20 and versions from R6… |
CVE-2022-23401 | High | 7.8 | 2022-03-11 | The following Yokogawa Electric products contain insecure DLL loading issues. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01… |
CVE-2022-22729 | High | 8.8 | 2022-03-11 | CAMS for HIS Server contained in the following Yokogawa Electric products improperly authenticate the receiving packets. The authentication may be bypassed via… |
CVE-2022-22151 | High | 8.1 | 2022-03-11 | CAMS for HIS Log Server contained in the following Yokogawa Electric products fails to properly neutralize log outputs: CENTUM CS 3000 versions from R3.08.10 t… |
CVE-2022-22148 | High | 7.8 | 2022-03-11 | 'Root Service' service implemented in the following Yokogawa Electric products creates some named pipe with improper ACL configuration. CENTUM CS 3000 versions… |
CVE-2022-22145 | High | 8.1 | 2022-03-11 | CAMS for HIS Log Server contained in the following Yokogawa Electric products is vulnerable to uncontrolled resource consumption. CENTUM CS 3000 versions from… |
CVE-2022-22141 | High | 7.8 | 2022-03-11 | 'Long-term Data Archive Package' service implemented in the following Yokogawa Electric products creates some named pipe with imporper ACL configuration. CENTU… |
CVE-2022-21808 | High | 8.8 | 2022-03-11 | Path traversal vulnerability exists in CAMS for HIS Server contained in the following Yokogawa Electric products: CENTUM CS 3000 versions from R3.08.10 to R3.0… |
CVE-2022-21194 | Critical | 9.8 | 2022-03-11 | The following Yokogawa Electric products do not change the passwords of the internal Windows accounts from the initial configuration: CENTUM VP versions from R… |
CVE-2022-21177 | High | 8.1 | 2022-03-11 | There is a path traversal vulnerability in CAMS for HIS Log Server contained in the following Yokogawa Electric products: CENTUM CS 3000 versions from R3.08.10… |
CVE-2022-26878 | Medium | 5.5 | 2022-03-11 | drivers/bluetooth/virtio_bt.c in the Linux kernel before 5.16.3 has a memory leak (socket buffers have memory allocated but not freed). |
CVE-2022-26874 | Medium | 5.4 | 2022-03-11 | lib/Horde/Mime/Viewer/Ooo.php in Horde Mime_Viewer before 2.2.4 allows XSS via an OpenOffice document, leading to account takeover in Horde Groupware Webmail E… |
CVE-2022-0822 | Medium | 5.4 | 2022-03-11 | Cross-site Scripting (XSS) - Reflected in GitHub repository orchardcms/orchardcore prior to 1.3.0. |
CVE-2022-25512 | High | 7.5 | 2022-03-11 | FreeTAKServer-UI v1.9.8 was discovered to leak sensitive API and Websocket keys. |
CVE-2022-25511 | Medium | 6.5 | 2022-03-11 | An issue in the ?filename= argument of the route /DataPackageTable in FreeTAKServer-UI v1.9.8 allows attackers to place arbitrary files anywhere on the system. |
CVE-2022-25510 | High | 8.8 | 2022-03-11 | FreeTAKServer 1.9.8 contains a hardcoded Flask secret key which allows attackers to create crafted cookies to bypass authentication or escalate privileges. |
CVE-2022-25508 | High | 7.5 | 2022-03-11 | An access control issue in the component /ManageRoute/postRoute of FreeTAKServer v1.9.8 allows unauthenticated attackers to cause a Denial of Service (DoS) via… |
CVE-2022-25507 | Medium | 5.4 | 2022-03-11 | FreeTAKServer-UI v1.9.8 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Callsign parameter. |
CVE-2022-25506 | Medium | 6.5 | 2022-03-11 | FreeTAKServer-UI v1.9.8 was discovered to contain a SQL injection vulnerability via the API endpoint /AuthenticateUser. |
CVE-2022-0821 | Medium | 6.5 | 2022-03-11 | Improper Authorization in GitHub repository orchardcms/orchardcore prior to 1.3.0. |
CVE-2022-0820 | Medium | 6.1 | 2022-03-11 | Cross-site Scripting (XSS) - Stored in GitHub repository orchardcms/orchardcore prior to 1.3.0. |
CVE-2022-0815 | Medium | 6.5 | 2022-03-10 | Improper access control vulnerability in McAfee WebAdvisor Chrome and Edge browser extensions up to 8.1.0.1895 allows a remote attacker to gain access to McAfe… |