2022 CVEs (page 242)
Page 242 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-23960 | Medium | 5.6 | 2022-03-13 | Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB. An attacker can leverage the shared… |
CVE-2022-26967 | High | 7.8 | 2022-03-12 | GPAC 2.0 allows a heap-based buffer overflow in gf_base64_encode. It can be triggered via MP4Box. |
CVE-2022-26966 | Medium | 5.5 | 2022-03-12 | An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to obtain sensitive information from heap memory via craf… |
CVE-2022-0930 | Medium | 4.8 | 2022-03-12 | File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12. |
CVE-2022-0929 | Medium | 6.1 | 2022-03-12 | XSS on dynamic_text module in GitHub repository microweber/microweber prior to 1.2.11. |
CVE-2022-0926 | Medium | 4.8 | 2022-03-12 | File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12. |
CVE-2022-0880 | Medium | 5.4 | 2022-03-12 | Cross-site Scripting (XSS) - Stored in GitHub repository star7th/showdoc prior to 2.10.2. |
CVE-2022-26533 | Medium | 6.1 | 2022-03-12 | Alist v2.1.0 and below was discovered to contain a cross-site scripting (XSS) vulnerability via /i/:data/ipa.plist. |
CVE-2022-26276 | Medium | 5.3 | 2022-03-12 | An issue in index.php of OneNav v0.9.14 allows attackers to perform directory traversal. |
CVE-2022-24760 | Critical | 10.0 | 2022-03-12 | Parse Server is an open source http web server backend. In versions prior to 4.10.7 there is a Remote Code Execution (RCE) vulnerability in Parse Server. This… |
CVE-2022-24421 | High | 8.2 | 2022-03-11 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI… |
CVE-2022-24420 | High | 8.2 | 2022-03-11 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI… |
CVE-2022-24419 | High | 8.2 | 2022-03-11 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI… |
CVE-2022-24416 | High | 8.2 | 2022-03-11 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI… |
CVE-2022-24415 | High | 8.2 | 2022-03-11 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI… |
CVE-2022-25839 | Medium | 4.3 | 2022-03-11 | The package url-js before 2.1.0 are vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed… |
CVE-2022-24754 | High | 8.5 | 2022-03-11 | PJSIP is a free and open source multimedia communication library written in C language. In versions prior to and including 2.12 PJSIP there is a stack-buffer o… |
CVE-2022-25621 | Critical | 9.8 | 2022-03-11 | UUNIVERGE WA 1020 Ver8.2.11 and prior, UNIVERGE WA 1510 Ver8.2.11 and prior, UNIVERGE WA 1511 Ver8.2.11 and prior, UNIVERGE WA 1512 Ver8.2.11 and prior, UNIVER… |
CVE-2022-25601 | Medium | 4.7 | 2022-03-11 | Reflected Cross-Site Scripting (XSS) vulnerability affecting parameter &tab discovered in Contact Form X WordPress plugin (versions <= 2.4). |
CVE-2022-25600 | Medium | 5.4 | 2022-03-11 | Cross-Site Request Forgery (CSRF) vulnerability affecting Delete Marker Category, Delete Map, and Copy Map functions in WP Google Map plugin (versions <= 4.2.3… |
CVE-2022-25216 | High | 7.5 | 2022-03-11 | An absolute path traversal vulnerability allows a remote attacker to download any file on the Windows file system for which the user account running DVDFab 12… |
CVE-2022-24097 | High | 7.8 | 2022-03-11 | Adobe After Effects versions 22.2 (and earlier) and 18.4.4 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary co… |
CVE-2022-24096 | High | 7.8 | 2022-03-11 | Adobe After Effects versions 22.2 (and earlier) and 18.4.4 (and earlier) are affected by an Heap-based Buffer Overflow vulnerability that could result in arbit… |
CVE-2022-24095 | High | 7.8 | 2022-03-11 | Adobe After Effects versions 22.2 (and earlier) and 18.4.4 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbit… |
CVE-2022-24094 | High | 7.8 | 2022-03-11 | Adobe After Effects versions 22.2 (and earlier) and 18.4.4 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbit… |
CVE-2022-24090 | Medium | 5.5 | 2022-03-11 | Adobe Photoshop versions 23.1.1 (and earlier) and 22.5.5 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sen… |
CVE-2022-23934 | High | 8.2 | 2022-03-11 | Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution… |
CVE-2022-23933 | High | 8.2 | 2022-03-11 | Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution… |
CVE-2022-23932 | High | 8.2 | 2022-03-11 | Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution… |
CVE-2022-23931 | High | 8.2 | 2022-03-11 | Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution… |
CVE-2022-23930 | High | 8.2 | 2022-03-11 | Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution… |
CVE-2022-23929 | High | 8.2 | 2022-03-11 | Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution… |
CVE-2022-23928 | High | 8.2 | 2022-03-11 | Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution… |
CVE-2022-23927 | High | 8.2 | 2022-03-11 | Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution… |
CVE-2022-23926 | High | 8.2 | 2022-03-11 | Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution… |
CVE-2022-23925 | High | 8.2 | 2022-03-11 | Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution… |
CVE-2022-23924 | High | 8.2 | 2022-03-11 | Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution… |
CVE-2022-23731 | High | 7.8 | 2022-03-11 | V8 javascript engine (heap vulnerability) can cause privilege escalation ,which can impact on some webOS TV models. |
CVE-2022-23730 | Critical | 9.8 | 2022-03-11 | The public API error causes for the attacker to be able to bypass API access control. |
CVE-2022-23625 | Medium | 6.5 | 2022-03-11 | Wire-ios is a messaging application using the wire protocol on apple's ios platform. In versions prior to 3.95 malformed resource identifiers may render the iO… |
CVE-2022-23187 | High | 7.8 | 2022-03-11 | Adobe Illustrator version 26.0.3 (and earlier) is affected by a buffer overflow vulnerability due to insecure handling of a crafted file, potentially resulting… |
CVE-2022-0924 | Medium | 5.5 | 2022-03-11 | Out-of-bounds Read error in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from… |
CVE-2022-0921 | Medium | 6.7 | 2022-03-11 | Abusing Backup/Restore feature to achieve Remote Code Execution in GitHub repository microweber/microweber prior to 1.2.12. |
CVE-2022-0909 | Medium | 5.5 | 2022-03-11 | Divide By Zero error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from so… |
CVE-2022-0908 | High | 7.7 | 2022-03-11 | Null source pointer passed as an argument to memcpy() function within TIFFFetchNormalTag () in tif_dirread.c in libtiff versions up to 4.3.0 could lead to Deni… |
CVE-2022-0907 | Medium | 5.5 | 2022-03-11 | Unchecked Return Value to NULL Pointer Dereference in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For user… |
CVE-2022-0853 | High | 7.5 | 2022-03-11 | A flaw was found in JBoss-client. The vulnerability occurs due to a memory leak on the JBoss client-side, when using UserTransaction repeatedly and leads to in… |
CVE-2022-0002 | Medium | 6.5 | 2022-03-11 | Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an authorized user to potentially enable information disclos… |
CVE-2022-0001 | Medium | 6.5 | 2022-03-11 | Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may allow an authorized user to potentially enable informati… |
CVE-2022-24433 | High | 8.1 | 2022-03-11 | The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. When calling the .fetch(remote, branch, handlerFn) function, bo… |
CVE-2022-0932 | Medium | 6.5 | 2022-03-11 | Missing Authorization in GitHub repository saleor/saleor prior to 3.1.2. |
CVE-2022-21819 | High | 7.6 | 2022-03-11 | NVIDIA distributions of Jetson Linux contain a vulnerability where an error in the IOMMU configuration may allow an unprivileged attacker with physical access… |
CVE-2022-0860 | Critical | 9.1 | 2022-03-11 | Improper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2. |
CVE-2022-0871 | Critical | 9.1 | 2022-03-11 | Missing Authorization in GitHub repository gogs/gogs prior to 0.12.5. |
CVE-2022-0928 | Medium | 5.4 | 2022-03-11 | Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.12. |
CVE-2022-0870 | Medium | 5.3 | 2022-03-11 | Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.5. |
CVE-2022-0913 | High | 7.5 | 2022-03-11 | Integer Overflow or Wraparound in GitHub repository microweber/microweber prior to 1.3. |
CVE-2022-0912 | Medium | 4.8 | 2022-03-11 | Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.2.11. |
CVE-2022-23402 | Critical | 9.8 | 2022-03-11 | The following Yokogawa Electric products hard-code the password for CAMS server applications: CENTUM VP versions from R5.01.00 to R5.04.20 and versions from R6… |
CVE-2022-23401 | High | 7.8 | 2022-03-11 | The following Yokogawa Electric products contain insecure DLL loading issues. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01… |
CVE-2022-22729 | High | 8.8 | 2022-03-11 | CAMS for HIS Server contained in the following Yokogawa Electric products improperly authenticate the receiving packets. The authentication may be bypassed via… |
CVE-2022-22151 | High | 8.1 | 2022-03-11 | CAMS for HIS Log Server contained in the following Yokogawa Electric products fails to properly neutralize log outputs: CENTUM CS 3000 versions from R3.08.10 t… |
CVE-2022-22148 | High | 7.8 | 2022-03-11 | 'Root Service' service implemented in the following Yokogawa Electric products creates some named pipe with improper ACL configuration. CENTUM CS 3000 versions… |
CVE-2022-22145 | High | 8.1 | 2022-03-11 | CAMS for HIS Log Server contained in the following Yokogawa Electric products is vulnerable to uncontrolled resource consumption. CENTUM CS 3000 versions from… |
CVE-2022-22141 | High | 7.8 | 2022-03-11 | 'Long-term Data Archive Package' service implemented in the following Yokogawa Electric products creates some named pipe with imporper ACL configuration. CENTU… |
CVE-2022-21808 | High | 8.8 | 2022-03-11 | Path traversal vulnerability exists in CAMS for HIS Server contained in the following Yokogawa Electric products: CENTUM CS 3000 versions from R3.08.10 to R3.0… |
CVE-2022-21194 | Critical | 9.8 | 2022-03-11 | The following Yokogawa Electric products do not change the passwords of the internal Windows accounts from the initial configuration: CENTUM VP versions from R… |
CVE-2022-21177 | High | 8.1 | 2022-03-11 | There is a path traversal vulnerability in CAMS for HIS Log Server contained in the following Yokogawa Electric products: CENTUM CS 3000 versions from R3.08.10… |
CVE-2022-26878 | Medium | 5.5 | 2022-03-11 | drivers/bluetooth/virtio_bt.c in the Linux kernel before 5.16.3 has a memory leak (socket buffers have memory allocated but not freed). |
CVE-2022-26874 | Medium | 5.4 | 2022-03-11 | lib/Horde/Mime/Viewer/Ooo.php in Horde Mime_Viewer before 2.2.4 allows XSS via an OpenOffice document, leading to account takeover in Horde Groupware Webmail E… |
CVE-2022-0822 | Medium | 5.4 | 2022-03-11 | Cross-site Scripting (XSS) - Reflected in GitHub repository orchardcms/orchardcore prior to 1.3.0. |
CVE-2022-25512 | High | 7.5 | 2022-03-11 | FreeTAKServer-UI v1.9.8 was discovered to leak sensitive API and Websocket keys. |
CVE-2022-25511 | Medium | 6.5 | 2022-03-11 | An issue in the ?filename= argument of the route /DataPackageTable in FreeTAKServer-UI v1.9.8 allows attackers to place arbitrary files anywhere on the system. |
CVE-2022-25510 | High | 8.8 | 2022-03-11 | FreeTAKServer 1.9.8 contains a hardcoded Flask secret key which allows attackers to create crafted cookies to bypass authentication or escalate privileges. |
CVE-2022-25508 | High | 7.5 | 2022-03-11 | An access control issue in the component /ManageRoute/postRoute of FreeTAKServer v1.9.8 allows unauthenticated attackers to cause a Denial of Service (DoS) via… |
CVE-2022-25507 | Medium | 5.4 | 2022-03-11 | FreeTAKServer-UI v1.9.8 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Callsign parameter. |
CVE-2022-25506 | Medium | 6.5 | 2022-03-11 | FreeTAKServer-UI v1.9.8 was discovered to contain a SQL injection vulnerability via the API endpoint /AuthenticateUser. |
CVE-2022-0821 | Medium | 6.5 | 2022-03-11 | Improper Authorization in GitHub repository orchardcms/orchardcore prior to 1.3.0. |
CVE-2022-0820 | Medium | 6.1 | 2022-03-11 | Cross-site Scripting (XSS) - Stored in GitHub repository orchardcms/orchardcore prior to 1.3.0. |
CVE-2022-0815 | Medium | 6.5 | 2022-03-10 | Improper access control vulnerability in McAfee WebAdvisor Chrome and Edge browser extensions up to 8.1.0.1895 allows a remote attacker to gain access to McAfe… |
CVE-2022-0280 | High | 7.5 | 2022-03-10 | A race condition vulnerability exists in the QuickClean feature of McAfee Total Protection for Windows prior to 16.0.43 that allows a local user to gain privil… |
CVE-2022-24750 | High | 8.8 | 2022-03-10 | UltraVNC is a free and open source remote pc access software. A vulnerability has been found in versions prior to 1.3.8.0 in which the DSM plugin module, which… |
CVE-2022-24726 | High | 7.5 | 2022-03-10 | Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, istiod, is vulnerable to a request proces… |
CVE-2022-23042 | High | 7.0 | 2022-03-10 | Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilit… |
CVE-2022-23041 | High | 7.0 | 2022-03-10 | Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilit… |
CVE-2022-23040 | High | 7.0 | 2022-03-10 | Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilit… |
CVE-2022-23039 | High | 7.0 | 2022-03-10 | Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilit… |
CVE-2022-23038 | High | 7.0 | 2022-03-10 | Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilit… |
CVE-2022-23037 | High | 7.0 | 2022-03-10 | Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilit… |
CVE-2022-23036 | High | 7.0 | 2022-03-10 | Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilit… |
CVE-2022-26847 | Medium | 5.3 | 2022-03-10 | SPIP before 3.2.14 and 4.x before 4.0.5 allows unauthenticated access to information about editorial objects. |
CVE-2022-26846 | High | 8.8 | 2022-03-10 | SPIP before 3.2.14 and 4.x before 4.0.5 allows remote authenticated editors to execute arbitrary code. |
CVE-2022-26778 | Medium | 5.3 | 2022-03-10 | Veritas System Recovery (VSR) 18 and 21 stores a network destination password in the Windows registry during configuration of the backup configuration. This co… |
CVE-2022-26662 | High | 7.5 | 2022-03-10 | An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through… |
CVE-2022-26661 | Medium | 6.5 | 2022-03-10 | An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Appli… |
CVE-2022-26652 | Medium | 6.5 | 2022-03-10 | NATS nats-server before 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStream streams. nats-streaming-server befor… |
CVE-2022-26521 | High | 7.2 | 2022-03-10 | Abantecart through 1.3.2 allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Catalog>Media Manage… |
CVE-2022-26520 | Critical | 9.8 | 2022-03-10 | In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the l… |
CVE-2022-26488 | High | 7.0 | 2022-03-10 | In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. The installer may allow a local attacker t… |
CVE-2022-26355 | Medium | 4.4 | 2022-03-10 | Citrix Federated Authentication Service (FAS) 7.17 - 10.6 causes deployments that have been configured to store a registration authority certificate's private… |