2022 CVEs (page 244)
Page 244 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-21158 | Medium | 5.4 | 2022-03-10 | A stored cross-site scripting vulnerability in marktext versions prior to v0.17.0 due to improper handling of the link (with javascript: scheme) inside the doc… |
CVE-2022-21146 | Medium | 6.3 | 2022-03-10 | Persistent cross-site scripting in the web interface of ipDIO allows an unauthenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS p… |
CVE-2022-21132 | Medium | 6.5 | 2022-03-10 | Directory traversal vulnerability in pfSense-pkg-WireGuard pfSense-pkg-WireGuard 0.1.5 versions prior to 0.1.5_4 and pfSense-pkg-WireGuard 0.1.6 versions prior… |
CVE-2022-21124 | High | 7.8 | 2022-03-10 | Out-of-bounds write vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause information disclosu… |
CVE-2022-20060 | Medium | 6.6 | 2022-03-10 | In preloader (usb), there is a possible permission bypass due to a missing proper image authentication. This could lead to local escalation of privilege, for a… |
CVE-2022-20059 | Medium | 6.6 | 2022-03-10 | In preloader (usb), there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, for an attacker wh… |
CVE-2022-20058 | Medium | 6.6 | 2022-03-10 | In preloader (usb), there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, for an attacker wh… |
CVE-2022-20057 | Medium | 6.5 | 2022-03-10 | In btif, there is a possible memory corruption due to incorrect error handling. This could lead to local escalation of privilege with System execution privileg… |
CVE-2022-20056 | Medium | 6.6 | 2022-03-10 | In preloader (usb), there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, for an attacker wh… |
CVE-2022-20055 | Medium | 6.8 | 2022-03-10 | In preloader (usb), there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, for an attacker wh… |
CVE-2022-20054 | High | 7.8 | 2022-03-10 | In ims service, there is a possible AT command injection due to a missing permission check. This could lead to local escalation of privilege with no additional… |
CVE-2022-20053 | High | 7.8 | 2022-03-10 | In ims service, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additio… |
CVE-2022-20051 | Medium | 5.5 | 2022-03-10 | In ims service, there is a possible unexpected application behavior due to incorrect privilege assignment. This could lead to local denial of service with no a… |
CVE-2022-20050 | Medium | 6.7 | 2022-03-10 | In connsyslogger, there is a possible symbolic link following due to improper link resolution. This could lead to local escalation of privilege with System exe… |
CVE-2022-20049 | Medium | 6.7 | 2022-03-10 | In vpu, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with System execution p… |
CVE-2022-20048 | High | 7.8 | 2022-03-10 | In video decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional ex… |
CVE-2022-20047 | High | 7.8 | 2022-03-10 | In video decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional ex… |
CVE-2022-0904 | Medium | 4.3 | 2022-03-10 | A stack overflow bug in the document extractor in Mattermost Server in versions up to and including 6.3.2 allows an attacker to crash the server via submitting… |
CVE-2022-0903 | Medium | 5.3 | 2022-03-10 | A call stack overflow bug in the SAML login feature in Mattermost server in versions up to and including 6.3.2 allows an attacker to crash the server via submi… |
CVE-2022-0891 | Medium | 6.1 | 2022-03-10 | A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker to trigger unsafe or out of bounds memory… |
CVE-2022-0865 | Medium | 5.5 | 2022-03-10 | Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sourc… |
CVE-2022-0856 | Medium | 6.5 | 2022-03-10 | libcaca is affected by a Divide By Zero issue via img2txt, which allows a remote malicious user to cause a Denial of Service |
CVE-2022-0847 | High | 7.8 | 2022-03-10 | A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe funct… |
CVE-2022-0813 | Medium | 5.3 | 2022-03-10 | PhpMyAdmin 5.1.1 and before allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the… |
CVE-2022-0725 | High | 7.5 | 2022-03-10 | A flaw was found in keepass. The vulnerability occurs due to logging the plain text passwords in system log and leads to an Information Exposure vulnerability… |
CVE-2022-0618 | High | 7.5 | 2022-03-10 | A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HTTP/2 frame. This vulnerabil… |
CVE-2022-0516 | High | 7.8 | 2022-03-10 | A vulnerability was found in kvm_s390_guest_sida_op in the arch/s390/kvm/kvm-s390.c function in KVM for s390 in the Linux kernel. This flaw allows a local atta… |
CVE-2022-0507 | Medium | 5.8 | 2022-03-10 | Found a potential security vulnerability inside the Pandora API. Affected Pandora FMS version range: all versions of NG version, up to OUM 759. This vulnerabil… |
CVE-2022-0433 | Medium | 5.5 | 2022-03-10 | A NULL pointer dereference flaw was found in the Linux kernel's BPF subsystem in the way a user triggers the map_get_next_key function of the BPF bloom filter… |
CVE-2022-0204 | High | 8.8 | 2022-03-10 | A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network access could pass specially crafted files causing an… |
CVE-2022-0906 | Medium | 4.8 | 2022-03-10 | Unrestricted file upload leads to stored XSS in GitHub repository microweber/microweber prior to 1.1.12. |
CVE-2022-0905 | High | 7.1 | 2022-03-10 | Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4. |
CVE-2022-0895 | Critical | 9.8 | 2022-03-10 | Static Code Injection in GitHub repository microweber/microweber prior to 1.3. |
CVE-2022-0890 | Medium | 5.5 | 2022-03-10 | NULL Pointer Dereference in GitHub repository mruby/mruby prior to 3.2. |
CVE-2022-24753 | High | 7.7 | 2022-03-09 | Stripe CLI is a command-line tool for the Stripe eCommerce platform. A vulnerability in Stripe CLI exists on Windows when certain commands are run in a directo… |
CVE-2022-24748 | Medium | 6.8 | 2022-03-09 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In versions prior to 6.4.8.2 it is possible to modif… |
CVE-2022-24747 | Medium | 6.3 | 2022-03-09 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. Affected versions of shopware do no properly set sen… |
CVE-2022-24746 | Medium | 6.1 | 2022-03-09 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions it is possible to inject code v… |
CVE-2022-24745 | Medium | 4.8 | 2022-03-09 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions guest sessions are shared betwe… |
CVE-2022-24744 | Low | 2.6 | 2022-03-09 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions user sessions are not logged ou… |
CVE-2022-24323 | Medium | 5.3 | 2022-03-09 | A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause a disruption of communication between the Modicon control… |
CVE-2022-24322 | Medium | 5.3 | 2022-03-09 | A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a disruption of communication between… |
CVE-2022-24741 | Low | 3.5 | 2022-03-09 | Nextcloud server is an open source, self hosted cloud style services platform. In affected versions an attacker can cause a denial of service by uploading spec… |
CVE-2022-24734 | High | 7.2 | 2022-03-09 | MyBB is a free and open source forum software. In affected versions the Admin CP's Settings management module does not validate setting types correctly on inse… |
CVE-2022-24919 | Low | 3.7 | 2022-03-09 | An authenticated user can create a link with reflected Javascript code inside it for graphs’ page and send it to other users. The payload can be executed only… |
CVE-2022-24918 | Low | 3.7 | 2022-03-09 | An authenticated user can create a link with reflected Javascript code inside it for items’ page and send it to other users. The payload can be executed only w… |
CVE-2022-24917 | Low | 3.7 | 2022-03-09 | An authenticated user can create a link with reflected Javascript code inside it for services’ page and send it to other users. The payload can be executed onl… |
CVE-2022-24732 | Medium | 6.3 | 2022-03-09 | Maddy Mail Server is an open source SMTP compatible email server. Versions of maddy prior to 0.5.4 do not implement password expiry or account expiry checking… |
CVE-2022-24349 | Medium | 4.6 | 2022-03-09 | An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users. Malicious code has access to all the same ob… |
CVE-2022-22806 | Critical | 9.8 | 2022-03-09 | A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause an unauthenticated connection to the UPS when a malformed connection i… |
CVE-2022-22805 | Critical | 9.8 | 2022-03-09 | A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists that could cause remote code execution when an improperl… |
CVE-2022-22511 | Medium | 5.4 | 2022-03-09 | Various configuration pages of the device are vulnerable to reflected XSS (Cross-Site Scripting) attacks. An authorized attacker with user privileges may use t… |
CVE-2022-0715 | Critical | 9.1 | 2022-03-09 | A CWE-287: Improper Authentication vulnerability exists that could cause an attacker to arbitrarily change the behavior of the UPS when a key is leaked and use… |
CVE-2022-0022 | Medium | 4.1 | 2022-03-09 | Usage of a weak cryptographic algorithm in Palo Alto Networks PAN-OS software where the password hashes of administrator and local user accounts are not create… |
CVE-2022-24526 | Medium | 6.1 | 2022-03-09 | Visual Studio Code Spoofing Vulnerability |
CVE-2022-24525 | High | 7.0 | 2022-03-09 | Windows Update Stack Elevation of Privilege Vulnerability |
CVE-2022-24522 | Medium | 6.5 | 2022-03-09 | Skype Extension for Chrome Information Disclosure Vulnerability |
CVE-2022-24520 | High | 7.2 | 2022-03-09 | Azure Site Recovery Remote Code Execution Vulnerability |
CVE-2022-24519 | Medium | 6.5 | 2022-03-09 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-24518 | Medium | 6.5 | 2022-03-09 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-24517 | High | 7.2 | 2022-03-09 | Azure Site Recovery Remote Code Execution Vulnerability |
CVE-2022-24515 | Medium | 6.5 | 2022-03-09 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-24512 | Medium | 6.3 | 2022-03-09 | .NET and Visual Studio Remote Code Execution Vulnerability |
CVE-2022-24511 | Medium | 5.5 | 2022-03-09 | Microsoft Office Word Tampering Vulnerability |
CVE-2022-24510 | High | 7.8 | 2022-03-09 | Microsoft Office Visio Remote Code Execution Vulnerability |
CVE-2022-24509 | High | 7.8 | 2022-03-09 | Microsoft Office Visio Remote Code Execution Vulnerability |
CVE-2022-24508 | High | 8.8 | 2022-03-09 | Win32 File Enumeration Remote Code Execution Vulnerability |
CVE-2022-24507 | High | 7.8 | 2022-03-09 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability |
CVE-2022-24506 | Medium | 6.5 | 2022-03-09 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-24505 | High | 7.0 | 2022-03-09 | Windows ALPC Elevation of Privilege Vulnerability |
CVE-2022-24503 | Medium | 5.4 | 2022-03-09 | Remote Desktop Protocol Client Information Disclosure Vulnerability |
CVE-2022-24502 | Medium | 4.3 | 2022-03-09 | Windows HTML Platforms Security Feature Bypass Vulnerability |
CVE-2022-24501 | High | 7.8 | 2022-03-09 | VP9 Video Extensions Remote Code Execution Vulnerability |
CVE-2022-24471 | High | 7.2 | 2022-03-09 | Azure Site Recovery Remote Code Execution Vulnerability |
CVE-2022-24470 | High | 7.2 | 2022-03-09 | Azure Site Recovery Remote Code Execution Vulnerability |
CVE-2022-24469 | High | 8.1 | 2022-03-09 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-24468 | High | 7.2 | 2022-03-09 | Azure Site Recovery Remote Code Execution Vulnerability |
CVE-2022-24467 | High | 7.2 | 2022-03-09 | Azure Site Recovery Remote Code Execution Vulnerability |
CVE-2022-24465 | Low | 3.3 | 2022-03-09 | Microsoft Intune Portal for iOS Security Feature Bypass Vulnerability |
CVE-2022-24464 | High | 7.5 | 2022-03-09 | .NET and Visual Studio Denial of Service Vulnerability |
CVE-2022-24463 | Medium | 6.5 | 2022-03-09 | Microsoft Exchange Server Spoofing Vulnerability |
CVE-2022-24462 | Medium | 5.5 | 2022-03-09 | Microsoft Word Security Feature Bypass Vulnerability |
CVE-2022-24461 | High | 7.8 | 2022-03-09 | Microsoft Office Visio Remote Code Execution Vulnerability |
CVE-2022-24460 | High | 7.0 | 2022-03-09 | Tablet Windows User Interface Application Elevation of Privilege Vulnerability |
CVE-2022-24459 | High | 7.8 | 2022-03-09 | Windows Fax and Scan Service Elevation of Privilege Vulnerability |
CVE-2022-24457 | High | 7.8 | 2022-03-09 | HEIF Image Extensions Remote Code Execution Vulnerability |
CVE-2022-24456 | High | 7.8 | 2022-03-09 | HEVC Video Extensions Remote Code Execution Vulnerability |
CVE-2022-24455 | High | 7.8 | 2022-03-09 | Windows CD-ROM Driver Elevation of Privilege Vulnerability |
CVE-2022-24454 | High | 7.8 | 2022-03-09 | Windows Security Support Provider Interface Elevation of Privilege Vulnerability |
CVE-2022-24453 | High | 7.8 | 2022-03-09 | HEVC Video Extensions Remote Code Execution Vulnerability |
CVE-2022-24452 | High | 7.8 | 2022-03-09 | HEVC Video Extensions Remote Code Execution Vulnerability |
CVE-2022-24451 | High | 7.8 | 2022-03-09 | VP9 Video Extensions Remote Code Execution Vulnerability |
CVE-2022-23301 | High | 7.8 | 2022-03-09 | HEVC Video Extensions Remote Code Execution Vulnerability |
CVE-2022-23300 | High | 7.8 | 2022-03-09 | Raw Image Extension Remote Code Execution Vulnerability |
CVE-2022-23299 | High | 7.8 | 2022-03-09 | Windows PDEV Elevation of Privilege Vulnerability |
CVE-2022-23298 | High | 7.0 | 2022-03-09 | Windows NT OS Kernel Elevation of Privilege Vulnerability |
CVE-2022-23297 | Medium | 5.5 | 2022-03-09 | Windows NT Lan Manager Datagram Receiver Driver Information Disclosure Vulnerability |
CVE-2022-23296 | High | 7.8 | 2022-03-09 | Windows Installer Elevation of Privilege Vulnerability |
CVE-2022-23295 | High | 7.8 | 2022-03-09 | Raw Image Extension Remote Code Execution Vulnerability |
CVE-2022-23294 | High | 8.8 | 2022-03-09 | Windows Event Tracing Remote Code Execution Vulnerability |