2022 CVEs (page 243)
Page 243 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-0280 | High | 7.5 | 2022-03-10 | A race condition vulnerability exists in the QuickClean feature of McAfee Total Protection for Windows prior to 16.0.43 that allows a local user to gain privil… |
CVE-2022-24750 | High | 8.8 | 2022-03-10 | UltraVNC is a free and open source remote pc access software. A vulnerability has been found in versions prior to 1.3.8.0 in which the DSM plugin module, which… |
CVE-2022-24726 | High | 7.5 | 2022-03-10 | Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, istiod, is vulnerable to a request proces… |
CVE-2022-23042 | High | 7.0 | 2022-03-10 | Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilit… |
CVE-2022-23041 | High | 7.0 | 2022-03-10 | Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilit… |
CVE-2022-23040 | High | 7.0 | 2022-03-10 | Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilit… |
CVE-2022-23039 | High | 7.0 | 2022-03-10 | Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilit… |
CVE-2022-23038 | High | 7.0 | 2022-03-10 | Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilit… |
CVE-2022-23037 | High | 7.0 | 2022-03-10 | Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilit… |
CVE-2022-23036 | High | 7.0 | 2022-03-10 | Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilit… |
CVE-2022-26847 | Medium | 5.3 | 2022-03-10 | SPIP before 3.2.14 and 4.x before 4.0.5 allows unauthenticated access to information about editorial objects. |
CVE-2022-26846 | High | 8.8 | 2022-03-10 | SPIP before 3.2.14 and 4.x before 4.0.5 allows remote authenticated editors to execute arbitrary code. |
CVE-2022-26778 | Medium | 5.3 | 2022-03-10 | Veritas System Recovery (VSR) 18 and 21 stores a network destination password in the Windows registry during configuration of the backup configuration. This co… |
CVE-2022-26662 | High | 7.5 | 2022-03-10 | An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through… |
CVE-2022-26661 | Medium | 6.5 | 2022-03-10 | An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Appli… |
CVE-2022-26652 | Medium | 6.5 | 2022-03-10 | NATS nats-server before 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStream streams. nats-streaming-server befor… |
CVE-2022-26521 | High | 7.2 | 2022-03-10 | Abantecart through 1.3.2 allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Catalog>Media Manage… |
CVE-2022-26520 | Critical | 9.8 | 2022-03-10 | In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the l… |
CVE-2022-26488 | High | 7.0 | 2022-03-10 | In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. The installer may allow a local attacker t… |
CVE-2022-26355 | Medium | 4.4 | 2022-03-10 | Citrix Federated Authentication Service (FAS) 7.17 - 10.6 causes deployments that have been configured to store a registration authority certificate's private… |
CVE-2022-26311 | High | 7.5 | 2022-03-10 | Couchbase Operator 2.2.x before 2.2.3 exposes Sensitive Information to an Unauthorized Actor. Secrets are not redacted in logs collected from Kubernetes enviro… |
CVE-2022-26143 | Critical | 9.8 | 2022-03-10 | The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive i… |
CVE-2022-26131 | Critical | 9.3 | 2022-03-10 | Power Line Communications PLC4TRUCKS J2497 trailer receivers are susceptible to remote RF induced signals. |
CVE-2022-26104 | Medium | 5.3 | 2022-03-10 | SAP Financial Consolidation - version 10.1, does not perform necessary authorization checks for updating homepage messages, resulting for an unauthorized user… |
CVE-2022-26103 | Medium | 5.3 | 2022-03-10 | Under certain conditions, SAP NetWeaver (Real Time Messaging Framework) - version 7.50, allows an attacker to access information which could lead to informatio… |
CVE-2022-26102 | Medium | 5.4 | 2022-03-10 | Due to missing authorization check, SAP NetWeaver Application Server for ABAP - versions 700, 701, 702, 731, allows an authenticated attacker, to access conten… |
CVE-2022-26101 | Medium | 6.1 | 2022-03-10 | Fiori launchpad - versions 754, 755, 756, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. |
CVE-2022-26100 | Critical | 9.8 | 2022-03-10 | SAPCAR - version 7.22, does not contain sufficient input validation on the SAPCAR archive. As a result, the SAPCAR process may crash, and the attacker may obta… |
CVE-2022-25922 | Medium | 6.1 | 2022-03-10 | Power Line Communications PLC4TRUCKS J2497 trailer brake controllers implement diagnostic functions which can be invoked by replaying J2497 messages. There is… |
CVE-2022-25830 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Galaxy Watch3 Plugin prior to version 2.2.09.22012751 allows attacker to access password information of connected WiFiAp… |
CVE-2022-25829 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Watch Active2 Plugin prior to version 2.2.08.22012751 allows attacker to access password information of connected WiFiAp… |
CVE-2022-25828 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Watch Active Plugin prior to version 2.2.07.22012751 allows attacker to access password information of connected WiFiAp i… |
CVE-2022-25827 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Galaxy Watch Plugin prior to version 2.2.05.22012751 allows attacker to access password information of connected WiFiAp i… |
CVE-2022-25826 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Galaxy S3 Plugin prior to version 2.2.03.22012751 allows attacker to access password information of connected WiFiAp in t… |
CVE-2022-25825 | Medium | 6.2 | 2022-03-10 | Improper access control vulnerability in Samsung Account prior to version 13.1.0.1 allows attackers to access to the authcode for sign-in. |
CVE-2022-25824 | Medium | 4.0 | 2022-03-10 | Improper access control vulnerability in BixbyTouch prior to version 2.2.00.6 in China models allows untrusted applications to load arbitrary URL and local fil… |
CVE-2022-25823 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Galaxy Watch Plugin prior to version 2.2.05.220126741 allows attackers to access user information in log. |
CVE-2022-25822 | Medium | 4.0 | 2022-03-10 | An use after free vulnerability in sdp driver prior to SMR Mar-2022 Release 1 allows kernel crash. |
CVE-2022-25821 | Low | 3.3 | 2022-03-10 | Improper use of SMS buffer pointer in Shannon baseband prior to SMR Mar-2022 Release 1 allows OOB read. |
CVE-2022-25820 | Medium | 4.2 | 2022-03-10 | A vulnerable design in fingerprint matching algorithm prior to SMR Mar-2022 Release 1 allows physical attackers to perform brute force attack on screen lock pa… |
CVE-2022-25819 | Medium | 5.3 | 2022-03-10 | OOB read vulnerability in hdcp2 device node prior to SMR Mar-2022 Release 1 allow an attacker to view Kernel stack memory. |
CVE-2022-25818 | Medium | 6.5 | 2022-03-10 | Improper boundary check in UWB stack prior to SMR Mar-2022 Release 1 allows arbitrary code execution. |
CVE-2022-25817 | Medium | 4.0 | 2022-03-10 | Improper authentication in One UI Home prior to SMR Mar-2022 Release 1 allows attacker to generate pinned-shortcut without user consent. |
CVE-2022-25816 | Medium | 4.1 | 2022-03-10 | Improper authentication in Samsung Lock and mask apps setting prior to SMR Mar-2022 Release 1 allows attacker to change enable/disable without authentication |
CVE-2022-25815 | Medium | 5.5 | 2022-03-10 | PendingIntent hijacking vulnerability in Weather application prior to SMR Mar-2022 Release 1 allows local attackers to perform unauthorized action without perm… |
CVE-2022-25814 | Medium | 5.5 | 2022-03-10 | PendingIntent hijacking vulnerability in Wearable Manager Installer prior to SMR Mar-2022 Release 1 allows local attackers to perform unauthorized action witho… |
CVE-2022-25566 | High | 7.5 | 2022-03-10 | Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function saveParentControlInfo. This vulnerability allows attackers to cause a Denial o… |
CVE-2022-25561 | High | 7.5 | 2022-03-10 | Tenda AX12 v22.03.01.21 was discovered to contain a stack overflow in the function sub_42DE00. This vulnerability allows attackers to cause a Denial of Service… |
CVE-2022-25560 | High | 7.5 | 2022-03-10 | Tenda AX12 v22.03.01.21 was discovered to contain a stack overflow in the function sub_4327CC. This vulnerability allows attackers to cause a Denial of Service… |
CVE-2022-25558 | High | 7.5 | 2022-03-10 | Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function formSetProvince. This vulnerability allows attackers to cause a Denial of Serv… |
CVE-2022-25557 | High | 7.5 | 2022-03-10 | Tenda AX1806 v1.0.0.1 was discovered to contain a heap overflow in the function saveParentControlInfo. This vulnerability allows attackers to cause a Denial of… |
CVE-2022-25556 | High | 7.5 | 2022-03-10 | Tenda AX12 v22.03.01.21 was discovered to contain a stack overflow in the function sub_42E328. This vulnerability allows attackers to cause a Denial of Service… |
CVE-2022-25555 | High | 7.5 | 2022-03-10 | Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function fromSetSysTime. This vulnerability allows attackers to cause a Denial of Servi… |
CVE-2022-25554 | High | 7.5 | 2022-03-10 | Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function saveParentControlInfo. This vulnerability allows attackers to cause a Denial o… |
CVE-2022-25553 | High | 7.5 | 2022-03-10 | Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function formSetSysToolDDNS. This vulnerability allows attackers to cause a Denial of S… |
CVE-2022-25552 | High | 7.5 | 2022-03-10 | Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function form_fast_setting_wifi_set. This vulnerability allows attackers to cause a Den… |
CVE-2022-25551 | High | 7.5 | 2022-03-10 | Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function formSetSysToolDDNS. This vulnerability allows attackers to cause a Denial of S… |
CVE-2022-25550 | High | 7.5 | 2022-03-10 | Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function saveParentControlInfo. This vulnerability allows attackers to cause a Denial o… |
CVE-2022-25549 | High | 7.5 | 2022-03-10 | Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function formSetSysToolDDNS. This vulnerability allows attackers to cause a Denial of S… |
CVE-2022-25548 | High | 7.5 | 2022-03-10 | Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function fromSetSysTime. This vulnerability allows attackers to cause a Denial of Servi… |
CVE-2022-25547 | High | 7.5 | 2022-03-10 | Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function fromSetSysTime. This vulnerability allows attackers to cause a Denial of Servi… |
CVE-2022-25546 | High | 7.5 | 2022-03-10 | Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function formSetSysToolDDNS. This vulnerability allows attackers to cause a Denial of S… |
CVE-2022-25368 | Medium | 4.7 | 2022-03-10 | Spectre BHB is a variant of Spectre-v2 in which malicious code uses the shared branch history (stored in the CPU BHB) to influence mispredicted branches in the… |
CVE-2022-25325 | High | 7.8 | 2022-03-10 | Use after free vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause information disclosure an… |
CVE-2022-25294 | High | 7.8 | 2022-03-10 | Proofpoint Insider Threat Management Agent for Windows relies on an inherently dangerous function that could enable an unprivileged local Windows user to run a… |
CVE-2022-25244 | Medium | 6.5 | 2022-03-10 | Vault Enterprise clusters using the tokenization transform feature can expose the tokenization key through the tokenization key configuration endpoint to autho… |
CVE-2022-25243 | Medium | 6.5 | 2022-03-10 | "Vault and Vault Enterprise 1.8.0 through 1.8.8, and 1.9.3 allowed the PKI secrets engine under certain configurations to issue wildcard certificates to author… |
CVE-2022-25234 | High | 7.8 | 2022-03-10 | Out-of-bounds write vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause information disclosu… |
CVE-2022-25230 | High | 7.8 | 2022-03-10 | Use after free vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause information disclosure an… |
CVE-2022-25225 | High | 7.2 | 2022-03-10 | Network Olympus version 1.8.0 allows an authenticated admin user to inject SQL queries in '/api/eventinstance' via the 'sqlparameter' JSON parameter. It is als… |
CVE-2022-25219 | High | 8.4 | 2022-03-10 | A null byte interaction error has been discovered in the code that the telnetd_startup daemon uses to construct a pair of ephemeral passwords that allow a user… |
CVE-2022-25218 | High | 8.1 | 2022-03-10 | The use of the RSA algorithm without OAEP, or any other padding scheme, in telnetd_startup, allows an unauthenticated attacker on the local area network to ach… |
CVE-2022-25217 | High | 7.8 | 2022-03-10 | Use of a hard-coded cryptographic key pair by the telnetd_startup service allows an attacker on the local area network to obtain a root shell on the device ove… |
CVE-2022-25215 | Medium | 5.3 | 2022-03-10 | Improper access control on the LocalMACConfig.asp interface allows an unauthenticated remote attacker to add (or remove) client MAC addresses to (or from) a li… |
CVE-2022-25214 | High | 7.4 | 2022-03-10 | Improper access control on the LocalClientList.asp interface allows an unauthenticated remote attacker to obtain sensitive information concerning devices on th… |
CVE-2022-25213 | Medium | 6.8 | 2022-03-10 | Improper physical access control and use of hard-coded credentials in /etc/passwd permits an attacker with physical access to obtain a root shell via an unprot… |
CVE-2022-25108 | Medium | 5.5 | 2022-03-10 | Foxit PDF Reader and Editor before 11.2.1 and PhantomPDF before 10.1.7 allow a NULL pointer dereference during PDF parsing because the pointer is used without… |
CVE-2022-25090 | High | 8.1 | 2022-03-10 | Printix Secure Cloud Print Management through 1.3.1106.0 creates a temporary temp.ini file in a directory with insecure permissions, leading to privilege escal… |
CVE-2022-24995 | Critical | 9.8 | 2022-03-10 | Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function fromSetSysTime. This vulnerability allows attackers to cause a Denial of S… |
CVE-2022-24960 | Medium | 6.5 | 2022-03-10 | A use after free vulnerability was discovered in PDFTron SDK version 9.2.0. A crafted PDF can overwrite RIP with data previously allocated on the heap. This is… |
CVE-2022-24932 | Medium | 4.2 | 2022-03-10 | Improper Protection of Alternate Path vulnerability in Setup wizard process prior to SMR Mar-2022 Release 1 allows physical attacker package installation befor… |
CVE-2022-24931 | High | 7.9 | 2022-03-10 | Improper access control vulnerability in dynamic receiver in ApkInstaller prior to SMR MAR-2022 Release allows unauthorized attackers to execute arbitrary acti… |
CVE-2022-24930 | Medium | 4.4 | 2022-03-10 | An Improper access control vulnerability in StRetailModeReceiver in Wear OS 3.0 prior to Firmware update MAR-2022 Release allows untrusted applications to rese… |
CVE-2022-24929 | Medium | 4.1 | 2022-03-10 | Unprotected Activity in AppLock prior to SMR Mar-2022 Release 1 allows attacker to change the list of locked app without authentication. |
CVE-2022-24928 | Medium | 5.9 | 2022-03-10 | Security misconfiguration of RKP in kernel prior to SMR Mar-2022 Release 1 allows a system not to be protected by RKP. |
CVE-2022-24915 | High | 8.0 | 2022-03-10 | The absence of filters when loading some sections in the web application of the vulnerable device allows attackers to inject malicious code that will be interp… |
CVE-2022-24652 | Critical | 9.8 | 2022-03-10 | sentcms 4.0.x allows remote attackers to cause arbitrary file uploads through an unauthorized file upload interface, resulting in php code execution in /admin/… |
CVE-2022-24651 | Critical | 9.8 | 2022-03-10 | sentcms 4.0.x allows remote attackers to cause arbitrary file uploads through an unauthorized file upload interface, resulting in PHP code execution through /u… |
CVE-2022-24644 | High | 8.8 | 2022-03-10 | ZZ Inc. KeyMouse Windows 3.08 and prior is affected by a remote code execution vulnerability during an unauthenticated update. To exploit this vulnerability, a… |
CVE-2022-24618 | High | 7.8 | 2022-03-10 | Heimdal.Wizard.exe installer in Heimdal Premium Security 2.5.395 and earlier has insecure permissions, which allows unprivileged local users to elevate privile… |
CVE-2022-24609 | Critical | 9.8 | 2022-03-10 | Luocms v2.0 is affected by an incorrect access control vulnerability. Through /admin/templates/template_manage.php, an attacker can write an arbitrary shell fi… |
CVE-2022-24608 | Medium | 6.1 | 2022-03-10 | Luocms v2.0 is affected by Cross Site Scripting (XSS) in /admin/news/sort_add.php and /inc/function.php. |
CVE-2022-24607 | Critical | 9.8 | 2022-03-10 | Luocms v2.0 is affected by SQL Injection in /admin/news/news_ok.php. |
CVE-2022-24606 | Critical | 9.8 | 2022-03-10 | Luocms v2.0 is affected by SQL Injection in /admin/news/sort_ok.php. |
CVE-2022-24605 | Critical | 9.8 | 2022-03-10 | Luocms v2.0 is affected by SQL Injection in /admin/link/link_ok.php. |
CVE-2022-24604 | Critical | 9.8 | 2022-03-10 | Luocms v2.0 is affected by SQL Injection in /admin/link/link_mod.php. |
CVE-2022-24603 | Critical | 9.8 | 2022-03-10 | Luocms v2.0 is affected by SQL Injection in /admin/news/sort_mod.php. |
CVE-2022-24602 | Critical | 9.8 | 2022-03-10 | Luocms v2.0 is affected by SQL Injection in /admin/news/news_mod.php. |
CVE-2022-24601 | High | 7.5 | 2022-03-10 | Luocms v2.0 is affected by SQL Injection in /admin/manager/admin_mod.php. An attacker can obtain sensitive information through SQL injection statements. |
CVE-2022-24600 | Critical | 9.8 | 2022-03-10 | Luocms v2.0 is affected by SQL Injection through /admin/login.php. An attacker can log in to the background through SQL injection statements. |