2022 CVEs (page 243)
Page 243 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-26311 | High | 7.5 | 2022-03-10 | Couchbase Operator 2.2.x before 2.2.3 exposes Sensitive Information to an Unauthorized Actor. Secrets are not redacted in logs collected from Kubernetes enviro… |
CVE-2022-26143 | Critical | 9.8 | 2022-03-10 | The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive i… |
CVE-2022-26131 | Critical | 9.3 | 2022-03-10 | Power Line Communications PLC4TRUCKS J2497 trailer receivers are susceptible to remote RF induced signals. |
CVE-2022-26104 | Medium | 5.3 | 2022-03-10 | SAP Financial Consolidation - version 10.1, does not perform necessary authorization checks for updating homepage messages, resulting for an unauthorized user… |
CVE-2022-26103 | Medium | 5.3 | 2022-03-10 | Under certain conditions, SAP NetWeaver (Real Time Messaging Framework) - version 7.50, allows an attacker to access information which could lead to informatio… |
CVE-2022-26102 | Medium | 5.4 | 2022-03-10 | Due to missing authorization check, SAP NetWeaver Application Server for ABAP - versions 700, 701, 702, 731, allows an authenticated attacker, to access conten… |
CVE-2022-26101 | Medium | 6.1 | 2022-03-10 | Fiori launchpad - versions 754, 755, 756, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. |
CVE-2022-26100 | Critical | 9.8 | 2022-03-10 | SAPCAR - version 7.22, does not contain sufficient input validation on the SAPCAR archive. As a result, the SAPCAR process may crash, and the attacker may obta… |
CVE-2022-25922 | Medium | 6.1 | 2022-03-10 | Power Line Communications PLC4TRUCKS J2497 trailer brake controllers implement diagnostic functions which can be invoked by replaying J2497 messages. There is… |
CVE-2022-25830 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Galaxy Watch3 Plugin prior to version 2.2.09.22012751 allows attacker to access password information of connected WiFiAp… |
CVE-2022-25829 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Watch Active2 Plugin prior to version 2.2.08.22012751 allows attacker to access password information of connected WiFiAp… |
CVE-2022-25828 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Watch Active Plugin prior to version 2.2.07.22012751 allows attacker to access password information of connected WiFiAp i… |
CVE-2022-25827 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Galaxy Watch Plugin prior to version 2.2.05.22012751 allows attacker to access password information of connected WiFiAp i… |
CVE-2022-25826 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Galaxy S3 Plugin prior to version 2.2.03.22012751 allows attacker to access password information of connected WiFiAp in t… |
CVE-2022-25825 | Medium | 6.2 | 2022-03-10 | Improper access control vulnerability in Samsung Account prior to version 13.1.0.1 allows attackers to access to the authcode for sign-in. |
CVE-2022-25824 | Medium | 4.0 | 2022-03-10 | Improper access control vulnerability in BixbyTouch prior to version 2.2.00.6 in China models allows untrusted applications to load arbitrary URL and local fil… |
CVE-2022-25823 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Galaxy Watch Plugin prior to version 2.2.05.220126741 allows attackers to access user information in log. |
CVE-2022-25822 | Medium | 4.0 | 2022-03-10 | An use after free vulnerability in sdp driver prior to SMR Mar-2022 Release 1 allows kernel crash. |
CVE-2022-25821 | Low | 3.3 | 2022-03-10 | Improper use of SMS buffer pointer in Shannon baseband prior to SMR Mar-2022 Release 1 allows OOB read. |
CVE-2022-25820 | Medium | 4.2 | 2022-03-10 | A vulnerable design in fingerprint matching algorithm prior to SMR Mar-2022 Release 1 allows physical attackers to perform brute force attack on screen lock pa… |
CVE-2022-25819 | Medium | 5.3 | 2022-03-10 | OOB read vulnerability in hdcp2 device node prior to SMR Mar-2022 Release 1 allow an attacker to view Kernel stack memory. |
CVE-2022-25818 | Medium | 6.5 | 2022-03-10 | Improper boundary check in UWB stack prior to SMR Mar-2022 Release 1 allows arbitrary code execution. |
CVE-2022-25817 | Medium | 4.0 | 2022-03-10 | Improper authentication in One UI Home prior to SMR Mar-2022 Release 1 allows attacker to generate pinned-shortcut without user consent. |
CVE-2022-25816 | Medium | 4.1 | 2022-03-10 | Improper authentication in Samsung Lock and mask apps setting prior to SMR Mar-2022 Release 1 allows attacker to change enable/disable without authentication |
CVE-2022-25815 | Medium | 5.5 | 2022-03-10 | PendingIntent hijacking vulnerability in Weather application prior to SMR Mar-2022 Release 1 allows local attackers to perform unauthorized action without perm… |
CVE-2022-25814 | Medium | 5.5 | 2022-03-10 | PendingIntent hijacking vulnerability in Wearable Manager Installer prior to SMR Mar-2022 Release 1 allows local attackers to perform unauthorized action witho… |
CVE-2022-25566 | High | 7.5 | 2022-03-10 | Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function saveParentControlInfo. This vulnerability allows attackers to cause a Denial o… |
CVE-2022-25561 | High | 7.5 | 2022-03-10 | Tenda AX12 v22.03.01.21 was discovered to contain a stack overflow in the function sub_42DE00. This vulnerability allows attackers to cause a Denial of Service… |
CVE-2022-25560 | High | 7.5 | 2022-03-10 | Tenda AX12 v22.03.01.21 was discovered to contain a stack overflow in the function sub_4327CC. This vulnerability allows attackers to cause a Denial of Service… |
CVE-2022-25558 | High | 7.5 | 2022-03-10 | Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function formSetProvince. This vulnerability allows attackers to cause a Denial of Serv… |
CVE-2022-25557 | High | 7.5 | 2022-03-10 | Tenda AX1806 v1.0.0.1 was discovered to contain a heap overflow in the function saveParentControlInfo. This vulnerability allows attackers to cause a Denial of… |
CVE-2022-25556 | High | 7.5 | 2022-03-10 | Tenda AX12 v22.03.01.21 was discovered to contain a stack overflow in the function sub_42E328. This vulnerability allows attackers to cause a Denial of Service… |
CVE-2022-25555 | High | 7.5 | 2022-03-10 | Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function fromSetSysTime. This vulnerability allows attackers to cause a Denial of Servi… |
CVE-2022-25554 | High | 7.5 | 2022-03-10 | Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function saveParentControlInfo. This vulnerability allows attackers to cause a Denial o… |
CVE-2022-25553 | High | 7.5 | 2022-03-10 | Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function formSetSysToolDDNS. This vulnerability allows attackers to cause a Denial of S… |
CVE-2022-25552 | High | 7.5 | 2022-03-10 | Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function form_fast_setting_wifi_set. This vulnerability allows attackers to cause a Den… |
CVE-2022-25551 | High | 7.5 | 2022-03-10 | Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function formSetSysToolDDNS. This vulnerability allows attackers to cause a Denial of S… |
CVE-2022-25550 | High | 7.5 | 2022-03-10 | Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function saveParentControlInfo. This vulnerability allows attackers to cause a Denial o… |
CVE-2022-25549 | High | 7.5 | 2022-03-10 | Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function formSetSysToolDDNS. This vulnerability allows attackers to cause a Denial of S… |
CVE-2022-25548 | High | 7.5 | 2022-03-10 | Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function fromSetSysTime. This vulnerability allows attackers to cause a Denial of Servi… |
CVE-2022-25547 | High | 7.5 | 2022-03-10 | Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function fromSetSysTime. This vulnerability allows attackers to cause a Denial of Servi… |
CVE-2022-25546 | High | 7.5 | 2022-03-10 | Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function formSetSysToolDDNS. This vulnerability allows attackers to cause a Denial of S… |
CVE-2022-25368 | Medium | 4.7 | 2022-03-10 | Spectre BHB is a variant of Spectre-v2 in which malicious code uses the shared branch history (stored in the CPU BHB) to influence mispredicted branches in the… |
CVE-2022-25325 | High | 7.8 | 2022-03-10 | Use after free vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause information disclosure an… |
CVE-2022-25294 | High | 7.8 | 2022-03-10 | Proofpoint Insider Threat Management Agent for Windows relies on an inherently dangerous function that could enable an unprivileged local Windows user to run a… |
CVE-2022-25244 | Medium | 6.5 | 2022-03-10 | Vault Enterprise clusters using the tokenization transform feature can expose the tokenization key through the tokenization key configuration endpoint to autho… |
CVE-2022-25243 | Medium | 6.5 | 2022-03-10 | "Vault and Vault Enterprise 1.8.0 through 1.8.8, and 1.9.3 allowed the PKI secrets engine under certain configurations to issue wildcard certificates to author… |
CVE-2022-25234 | High | 7.8 | 2022-03-10 | Out-of-bounds write vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause information disclosu… |
CVE-2022-25230 | High | 7.8 | 2022-03-10 | Use after free vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause information disclosure an… |
CVE-2022-25225 | High | 7.2 | 2022-03-10 | Network Olympus version 1.8.0 allows an authenticated admin user to inject SQL queries in '/api/eventinstance' via the 'sqlparameter' JSON parameter. It is als… |
CVE-2022-25219 | High | 8.4 | 2022-03-10 | A null byte interaction error has been discovered in the code that the telnetd_startup daemon uses to construct a pair of ephemeral passwords that allow a user… |
CVE-2022-25218 | High | 8.1 | 2022-03-10 | The use of the RSA algorithm without OAEP, or any other padding scheme, in telnetd_startup, allows an unauthenticated attacker on the local area network to ach… |
CVE-2022-25217 | High | 7.8 | 2022-03-10 | Use of a hard-coded cryptographic key pair by the telnetd_startup service allows an attacker on the local area network to obtain a root shell on the device ove… |
CVE-2022-25215 | Medium | 5.3 | 2022-03-10 | Improper access control on the LocalMACConfig.asp interface allows an unauthenticated remote attacker to add (or remove) client MAC addresses to (or from) a li… |
CVE-2022-25214 | High | 7.4 | 2022-03-10 | Improper access control on the LocalClientList.asp interface allows an unauthenticated remote attacker to obtain sensitive information concerning devices on th… |
CVE-2022-25213 | Medium | 6.8 | 2022-03-10 | Improper physical access control and use of hard-coded credentials in /etc/passwd permits an attacker with physical access to obtain a root shell via an unprot… |
CVE-2022-25108 | Medium | 5.5 | 2022-03-10 | Foxit PDF Reader and Editor before 11.2.1 and PhantomPDF before 10.1.7 allow a NULL pointer dereference during PDF parsing because the pointer is used without… |
CVE-2022-25090 | High | 8.1 | 2022-03-10 | Printix Secure Cloud Print Management through 1.3.1106.0 creates a temporary temp.ini file in a directory with insecure permissions, leading to privilege escal… |
CVE-2022-24995 | Critical | 9.8 | 2022-03-10 | Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function fromSetSysTime. This vulnerability allows attackers to cause a Denial of S… |
CVE-2022-24960 | Medium | 6.5 | 2022-03-10 | A use after free vulnerability was discovered in PDFTron SDK version 9.2.0. A crafted PDF can overwrite RIP with data previously allocated on the heap. This is… |
CVE-2022-24932 | Medium | 4.2 | 2022-03-10 | Improper Protection of Alternate Path vulnerability in Setup wizard process prior to SMR Mar-2022 Release 1 allows physical attacker package installation befor… |
CVE-2022-24931 | High | 7.9 | 2022-03-10 | Improper access control vulnerability in dynamic receiver in ApkInstaller prior to SMR MAR-2022 Release allows unauthorized attackers to execute arbitrary acti… |
CVE-2022-24930 | Medium | 4.4 | 2022-03-10 | An Improper access control vulnerability in StRetailModeReceiver in Wear OS 3.0 prior to Firmware update MAR-2022 Release allows untrusted applications to rese… |
CVE-2022-24929 | Medium | 4.1 | 2022-03-10 | Unprotected Activity in AppLock prior to SMR Mar-2022 Release 1 allows attacker to change the list of locked app without authentication. |
CVE-2022-24928 | Medium | 5.9 | 2022-03-10 | Security misconfiguration of RKP in kernel prior to SMR Mar-2022 Release 1 allows a system not to be protected by RKP. |
CVE-2022-24915 | High | 8.0 | 2022-03-10 | The absence of filters when loading some sections in the web application of the vulnerable device allows attackers to inject malicious code that will be interp… |
CVE-2022-24652 | Critical | 9.8 | 2022-03-10 | sentcms 4.0.x allows remote attackers to cause arbitrary file uploads through an unauthorized file upload interface, resulting in php code execution in /admin/… |
CVE-2022-24651 | Critical | 9.8 | 2022-03-10 | sentcms 4.0.x allows remote attackers to cause arbitrary file uploads through an unauthorized file upload interface, resulting in PHP code execution through /u… |
CVE-2022-24644 | High | 8.8 | 2022-03-10 | ZZ Inc. KeyMouse Windows 3.08 and prior is affected by a remote code execution vulnerability during an unauthenticated update. To exploit this vulnerability, a… |
CVE-2022-24618 | High | 7.8 | 2022-03-10 | Heimdal.Wizard.exe installer in Heimdal Premium Security 2.5.395 and earlier has insecure permissions, which allows unprivileged local users to elevate privile… |
CVE-2022-24609 | Critical | 9.8 | 2022-03-10 | Luocms v2.0 is affected by an incorrect access control vulnerability. Through /admin/templates/template_manage.php, an attacker can write an arbitrary shell fi… |
CVE-2022-24608 | Medium | 6.1 | 2022-03-10 | Luocms v2.0 is affected by Cross Site Scripting (XSS) in /admin/news/sort_add.php and /inc/function.php. |
CVE-2022-24607 | Critical | 9.8 | 2022-03-10 | Luocms v2.0 is affected by SQL Injection in /admin/news/news_ok.php. |
CVE-2022-24606 | Critical | 9.8 | 2022-03-10 | Luocms v2.0 is affected by SQL Injection in /admin/news/sort_ok.php. |
CVE-2022-24605 | Critical | 9.8 | 2022-03-10 | Luocms v2.0 is affected by SQL Injection in /admin/link/link_ok.php. |
CVE-2022-24604 | Critical | 9.8 | 2022-03-10 | Luocms v2.0 is affected by SQL Injection in /admin/link/link_mod.php. |
CVE-2022-24603 | Critical | 9.8 | 2022-03-10 | Luocms v2.0 is affected by SQL Injection in /admin/news/sort_mod.php. |
CVE-2022-24602 | Critical | 9.8 | 2022-03-10 | Luocms v2.0 is affected by SQL Injection in /admin/news/news_mod.php. |
CVE-2022-24601 | High | 7.5 | 2022-03-10 | Luocms v2.0 is affected by SQL Injection in /admin/manager/admin_mod.php. An attacker can obtain sensitive information through SQL injection statements. |
CVE-2022-24600 | Critical | 9.8 | 2022-03-10 | Luocms v2.0 is affected by SQL Injection through /admin/login.php. An attacker can log in to the background through SQL injection statements. |
CVE-2022-24432 | Medium | 5.5 | 2022-03-10 | Persistent cross-site scripting (XSS) in the web interface of ipDIO allows an authenticated remote attacker to introduce arbitrary JavaScript by injecting an X… |
CVE-2022-24399 | Medium | 6.1 | 2022-03-10 | The SAP Focused Run (Real User Monitoring) - versions 200, 300, REST service does not sufficiently sanitize the input name of the file using multipart/form-dat… |
CVE-2022-24398 | Medium | 6.5 | 2022-03-10 | Under certain conditions SAP Business Objects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker to access information which… |
CVE-2022-24397 | Medium | 6.1 | 2022-03-10 | SAP NetWeaver Enterprise Portal - versions 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scrip… |
CVE-2022-24396 | High | 7.8 | 2022-03-10 | The Simple Diagnostics Agent - versions 1.0 up to version 1.57, does not perform any authentication checks for functionalities that can be accessed via localho… |
CVE-2022-24395 | Medium | 6.1 | 2022-03-10 | SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in reflecte… |
CVE-2022-24286 | High | 7.8 | 2022-03-10 | Acer QuickAccess 2.01.300x before 2.01.3030 and 3.00.30xx before 3.00.3038 contains a local privilege escalation vulnerability. The user process communicates w… |
CVE-2022-24285 | High | 7.8 | 2022-03-10 | Acer Care Center 4.00.30xx before 4.00.3042 contains a local privilege escalation vulnerability. The user process communicates with a service of system authori… |
CVE-2022-24193 | Critical | 9.8 | 2022-03-10 | CasaOS before v0.2.7 was discovered to contain a command injection vulnerability. |
CVE-2022-24177 | Medium | 6.1 | 2022-03-10 | A cross-site scripting (XSS) vulnerability in the component cgi-bin/ej.cgi of Ex libris ALEPH 500 v18.1 and v20 allows attackers to execute arbitrary web scrip… |
CVE-2022-23940 | High | 8.8 | 2022-03-10 | SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution. Authenticated users with access to the Scheduled Reports module can achieve this by… |
CVE-2022-23383 | Critical | 9.1 | 2022-03-10 | YzmCMS v6.3 is affected by broken access control. Without login, unauthorized access to the user's personal home page can be realized. It is necessary to judge… |
CVE-2022-22985 | High | 8.8 | 2022-03-10 | The absence of filters when loading some sections in the web application of the vulnerable device allows attackers to inject malicious code that will be interp… |
CVE-2022-22835 | Medium | 6.5 | 2022-03-10 | An issue was discovered in OverIT Geocall before version 8.0. An authenticated user who has the Test Trasformazione XSL functionality enabled can exploit a XXE… |
CVE-2022-22834 | High | 8.8 | 2022-03-10 | An issue was discovered in OverIT Geocall before 8.0. An authenticated user who has the Test Trasformazione XSL functionality enabled can exploit a XSLT Inject… |
CVE-2022-22814 | Critical | 9.8 | 2022-03-10 | The System Diagnosis service of MyASUS before 3.1.2.0 allows privilege escalation. |
CVE-2022-22795 | Medium | 6.8 | 2022-03-10 | Signiant - Manager+Agents XML External Entity (XXE) - Extract internal files of the affected machine An attacker can read all the system files, the product is… |
CVE-2022-22547 | High | 7.5 | 2022-03-10 | Simple Diagnostics Agent - versions 1.0 (up to version 1.57.), allows an attacker to access information which would otherwise be restricted via a random port 9… |
CVE-2022-21219 | High | 7.8 | 2022-03-10 | Out-of-bounds read vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause information disclosur… |
CVE-2022-21170 | Low | 3.7 | 2022-03-10 | Improper check for certificate revocation in i-FILTER Ver.10.45R01 and earlier, i-FILTER Ver.9.50R10 and earlier, i-FILTER Browser & Cloud MultiAgent for Windo… |