2022 CVEs (page 244)
Page 244 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-24432 | Medium | 5.5 | 2022-03-10 | Persistent cross-site scripting (XSS) in the web interface of ipDIO allows an authenticated remote attacker to introduce arbitrary JavaScript by injecting an X… |
CVE-2022-24399 | Medium | 6.1 | 2022-03-10 | The SAP Focused Run (Real User Monitoring) - versions 200, 300, REST service does not sufficiently sanitize the input name of the file using multipart/form-dat… |
CVE-2022-24398 | Medium | 6.5 | 2022-03-10 | Under certain conditions SAP Business Objects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker to access information which… |
CVE-2022-24397 | Medium | 6.1 | 2022-03-10 | SAP NetWeaver Enterprise Portal - versions 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scrip… |
CVE-2022-24396 | High | 7.8 | 2022-03-10 | The Simple Diagnostics Agent - versions 1.0 up to version 1.57, does not perform any authentication checks for functionalities that can be accessed via localho… |
CVE-2022-24395 | Medium | 6.1 | 2022-03-10 | SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in reflecte… |
CVE-2022-24286 | High | 7.8 | 2022-03-10 | Acer QuickAccess 2.01.300x before 2.01.3030 and 3.00.30xx before 3.00.3038 contains a local privilege escalation vulnerability. The user process communicates w… |
CVE-2022-24285 | High | 7.8 | 2022-03-10 | Acer Care Center 4.00.30xx before 4.00.3042 contains a local privilege escalation vulnerability. The user process communicates with a service of system authori… |
CVE-2022-24193 | Critical | 9.8 | 2022-03-10 | CasaOS before v0.2.7 was discovered to contain a command injection vulnerability. |
CVE-2022-24177 | Medium | 6.1 | 2022-03-10 | A cross-site scripting (XSS) vulnerability in the component cgi-bin/ej.cgi of Ex libris ALEPH 500 v18.1 and v20 allows attackers to execute arbitrary web scrip… |
CVE-2022-23940 | High | 8.8 | 2022-03-10 | SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution. Authenticated users with access to the Scheduled Reports module can achieve this by… |
CVE-2022-23383 | Critical | 9.1 | 2022-03-10 | YzmCMS v6.3 is affected by broken access control. Without login, unauthorized access to the user's personal home page can be realized. It is necessary to judge… |
CVE-2022-22985 | High | 8.8 | 2022-03-10 | The absence of filters when loading some sections in the web application of the vulnerable device allows attackers to inject malicious code that will be interp… |
CVE-2022-22835 | Medium | 6.5 | 2022-03-10 | An issue was discovered in OverIT Geocall before version 8.0. An authenticated user who has the Test Trasformazione XSL functionality enabled can exploit a XXE… |
CVE-2022-22834 | High | 8.8 | 2022-03-10 | An issue was discovered in OverIT Geocall before 8.0. An authenticated user who has the Test Trasformazione XSL functionality enabled can exploit a XSLT Inject… |
CVE-2022-22814 | Critical | 9.8 | 2022-03-10 | The System Diagnosis service of MyASUS before 3.1.2.0 allows privilege escalation. |
CVE-2022-22795 | Medium | 6.8 | 2022-03-10 | Signiant - Manager+Agents XML External Entity (XXE) - Extract internal files of the affected machine An attacker can read all the system files, the product is… |
CVE-2022-22547 | High | 7.5 | 2022-03-10 | Simple Diagnostics Agent - versions 1.0 (up to version 1.57.), allows an attacker to access information which would otherwise be restricted via a random port 9… |
CVE-2022-21219 | High | 7.8 | 2022-03-10 | Out-of-bounds read vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause information disclosur… |
CVE-2022-21170 | Low | 3.7 | 2022-03-10 | Improper check for certificate revocation in i-FILTER Ver.10.45R01 and earlier, i-FILTER Ver.9.50R10 and earlier, i-FILTER Browser & Cloud MultiAgent for Windo… |
CVE-2022-21158 | Medium | 5.4 | 2022-03-10 | A stored cross-site scripting vulnerability in marktext versions prior to v0.17.0 due to improper handling of the link (with javascript: scheme) inside the doc… |
CVE-2022-21146 | Medium | 6.3 | 2022-03-10 | Persistent cross-site scripting in the web interface of ipDIO allows an unauthenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS p… |
CVE-2022-21132 | Medium | 6.5 | 2022-03-10 | Directory traversal vulnerability in pfSense-pkg-WireGuard pfSense-pkg-WireGuard 0.1.5 versions prior to 0.1.5_4 and pfSense-pkg-WireGuard 0.1.6 versions prior… |
CVE-2022-21124 | High | 7.8 | 2022-03-10 | Out-of-bounds write vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause information disclosu… |
CVE-2022-20060 | Medium | 6.6 | 2022-03-10 | In preloader (usb), there is a possible permission bypass due to a missing proper image authentication. This could lead to local escalation of privilege, for a… |
CVE-2022-20059 | Medium | 6.6 | 2022-03-10 | In preloader (usb), there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, for an attacker wh… |
CVE-2022-20058 | Medium | 6.6 | 2022-03-10 | In preloader (usb), there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, for an attacker wh… |
CVE-2022-20057 | Medium | 6.5 | 2022-03-10 | In btif, there is a possible memory corruption due to incorrect error handling. This could lead to local escalation of privilege with System execution privileg… |
CVE-2022-20056 | Medium | 6.6 | 2022-03-10 | In preloader (usb), there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, for an attacker wh… |
CVE-2022-20055 | Medium | 6.8 | 2022-03-10 | In preloader (usb), there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, for an attacker wh… |
CVE-2022-20054 | High | 7.8 | 2022-03-10 | In ims service, there is a possible AT command injection due to a missing permission check. This could lead to local escalation of privilege with no additional… |
CVE-2022-20053 | High | 7.8 | 2022-03-10 | In ims service, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additio… |
CVE-2022-20051 | Medium | 5.5 | 2022-03-10 | In ims service, there is a possible unexpected application behavior due to incorrect privilege assignment. This could lead to local denial of service with no a… |
CVE-2022-20050 | Medium | 6.7 | 2022-03-10 | In connsyslogger, there is a possible symbolic link following due to improper link resolution. This could lead to local escalation of privilege with System exe… |
CVE-2022-20049 | Medium | 6.7 | 2022-03-10 | In vpu, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with System execution p… |
CVE-2022-20048 | High | 7.8 | 2022-03-10 | In video decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional ex… |
CVE-2022-20047 | High | 7.8 | 2022-03-10 | In video decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional ex… |
CVE-2022-0904 | Medium | 4.3 | 2022-03-10 | A stack overflow bug in the document extractor in Mattermost Server in versions up to and including 6.3.2 allows an attacker to crash the server via submitting… |
CVE-2022-0903 | Medium | 5.3 | 2022-03-10 | A call stack overflow bug in the SAML login feature in Mattermost server in versions up to and including 6.3.2 allows an attacker to crash the server via submi… |
CVE-2022-0891 | Medium | 6.1 | 2022-03-10 | A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker to trigger unsafe or out of bounds memory… |
CVE-2022-0865 | Medium | 5.5 | 2022-03-10 | Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sourc… |
CVE-2022-0856 | Medium | 6.5 | 2022-03-10 | libcaca is affected by a Divide By Zero issue via img2txt, which allows a remote malicious user to cause a Denial of Service |
CVE-2022-0847 | High | 7.8 | 2022-03-10 | A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe funct… |
CVE-2022-0813 | Medium | 5.3 | 2022-03-10 | PhpMyAdmin 5.1.1 and before allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the… |
CVE-2022-0725 | High | 7.5 | 2022-03-10 | A flaw was found in keepass. The vulnerability occurs due to logging the plain text passwords in system log and leads to an Information Exposure vulnerability… |
CVE-2022-0618 | High | 7.5 | 2022-03-10 | A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HTTP/2 frame. This vulnerabil… |
CVE-2022-0516 | High | 7.8 | 2022-03-10 | A vulnerability was found in kvm_s390_guest_sida_op in the arch/s390/kvm/kvm-s390.c function in KVM for s390 in the Linux kernel. This flaw allows a local atta… |
CVE-2022-0507 | Medium | 5.8 | 2022-03-10 | Found a potential security vulnerability inside the Pandora API. Affected Pandora FMS version range: all versions of NG version, up to OUM 759. This vulnerabil… |
CVE-2022-0433 | Medium | 5.5 | 2022-03-10 | A NULL pointer dereference flaw was found in the Linux kernel's BPF subsystem in the way a user triggers the map_get_next_key function of the BPF bloom filter… |
CVE-2022-0204 | High | 8.8 | 2022-03-10 | A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network access could pass specially crafted files causing an… |
CVE-2022-0906 | Medium | 4.8 | 2022-03-10 | Unrestricted file upload leads to stored XSS in GitHub repository microweber/microweber prior to 1.1.12. |
CVE-2022-0905 | High | 7.1 | 2022-03-10 | Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4. |
CVE-2022-0895 | Critical | 9.8 | 2022-03-10 | Static Code Injection in GitHub repository microweber/microweber prior to 1.3. |
CVE-2022-0890 | Medium | 5.5 | 2022-03-10 | NULL Pointer Dereference in GitHub repository mruby/mruby prior to 3.2. |
CVE-2022-24753 | High | 7.7 | 2022-03-09 | Stripe CLI is a command-line tool for the Stripe eCommerce platform. A vulnerability in Stripe CLI exists on Windows when certain commands are run in a directo… |
CVE-2022-24748 | Medium | 6.8 | 2022-03-09 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In versions prior to 6.4.8.2 it is possible to modif… |
CVE-2022-24747 | Medium | 6.3 | 2022-03-09 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. Affected versions of shopware do no properly set sen… |
CVE-2022-24746 | Medium | 6.1 | 2022-03-09 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions it is possible to inject code v… |
CVE-2022-24745 | Medium | 4.8 | 2022-03-09 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions guest sessions are shared betwe… |
CVE-2022-24744 | Low | 2.6 | 2022-03-09 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions user sessions are not logged ou… |
CVE-2022-24323 | Medium | 5.3 | 2022-03-09 | A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause a disruption of communication between the Modicon control… |
CVE-2022-24322 | Medium | 5.3 | 2022-03-09 | A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a disruption of communication between… |
CVE-2022-24741 | Low | 3.5 | 2022-03-09 | Nextcloud server is an open source, self hosted cloud style services platform. In affected versions an attacker can cause a denial of service by uploading spec… |
CVE-2022-24734 | High | 7.2 | 2022-03-09 | MyBB is a free and open source forum software. In affected versions the Admin CP's Settings management module does not validate setting types correctly on inse… |
CVE-2022-24919 | Low | 3.7 | 2022-03-09 | An authenticated user can create a link with reflected Javascript code inside it for graphs’ page and send it to other users. The payload can be executed only… |
CVE-2022-24918 | Low | 3.7 | 2022-03-09 | An authenticated user can create a link with reflected Javascript code inside it for items’ page and send it to other users. The payload can be executed only w… |
CVE-2022-24917 | Low | 3.7 | 2022-03-09 | An authenticated user can create a link with reflected Javascript code inside it for services’ page and send it to other users. The payload can be executed onl… |
CVE-2022-24732 | Medium | 6.3 | 2022-03-09 | Maddy Mail Server is an open source SMTP compatible email server. Versions of maddy prior to 0.5.4 do not implement password expiry or account expiry checking… |
CVE-2022-24349 | Medium | 4.6 | 2022-03-09 | An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users. Malicious code has access to all the same ob… |
CVE-2022-22806 | Critical | 9.8 | 2022-03-09 | A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause an unauthenticated connection to the UPS when a malformed connection i… |
CVE-2022-22805 | Critical | 9.8 | 2022-03-09 | A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists that could cause remote code execution when an improperl… |
CVE-2022-22511 | Medium | 5.4 | 2022-03-09 | Various configuration pages of the device are vulnerable to reflected XSS (Cross-Site Scripting) attacks. An authorized attacker with user privileges may use t… |
CVE-2022-0715 | Critical | 9.1 | 2022-03-09 | A CWE-287: Improper Authentication vulnerability exists that could cause an attacker to arbitrarily change the behavior of the UPS when a key is leaked and use… |
CVE-2022-0022 | Medium | 4.1 | 2022-03-09 | Usage of a weak cryptographic algorithm in Palo Alto Networks PAN-OS software where the password hashes of administrator and local user accounts are not create… |
CVE-2022-24526 | Medium | 6.1 | 2022-03-09 | Visual Studio Code Spoofing Vulnerability |
CVE-2022-24525 | High | 7.0 | 2022-03-09 | Windows Update Stack Elevation of Privilege Vulnerability |
CVE-2022-24522 | Medium | 6.5 | 2022-03-09 | Skype Extension for Chrome Information Disclosure Vulnerability |
CVE-2022-24520 | High | 7.2 | 2022-03-09 | Azure Site Recovery Remote Code Execution Vulnerability |
CVE-2022-24519 | Medium | 6.5 | 2022-03-09 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-24518 | Medium | 6.5 | 2022-03-09 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-24517 | High | 7.2 | 2022-03-09 | Azure Site Recovery Remote Code Execution Vulnerability |
CVE-2022-24515 | Medium | 6.5 | 2022-03-09 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-24512 | Medium | 6.3 | 2022-03-09 | .NET and Visual Studio Remote Code Execution Vulnerability |
CVE-2022-24511 | Medium | 5.5 | 2022-03-09 | Microsoft Office Word Tampering Vulnerability |
CVE-2022-24510 | High | 7.8 | 2022-03-09 | Microsoft Office Visio Remote Code Execution Vulnerability |
CVE-2022-24509 | High | 7.8 | 2022-03-09 | Microsoft Office Visio Remote Code Execution Vulnerability |
CVE-2022-24508 | High | 8.8 | 2022-03-09 | Win32 File Enumeration Remote Code Execution Vulnerability |
CVE-2022-24507 | High | 7.8 | 2022-03-09 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability |
CVE-2022-24506 | Medium | 6.5 | 2022-03-09 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-24505 | High | 7.0 | 2022-03-09 | Windows ALPC Elevation of Privilege Vulnerability |
CVE-2022-24503 | Medium | 5.4 | 2022-03-09 | Remote Desktop Protocol Client Information Disclosure Vulnerability |
CVE-2022-24502 | Medium | 4.3 | 2022-03-09 | Windows HTML Platforms Security Feature Bypass Vulnerability |
CVE-2022-24501 | High | 7.8 | 2022-03-09 | VP9 Video Extensions Remote Code Execution Vulnerability |
CVE-2022-24471 | High | 7.2 | 2022-03-09 | Azure Site Recovery Remote Code Execution Vulnerability |
CVE-2022-24470 | High | 7.2 | 2022-03-09 | Azure Site Recovery Remote Code Execution Vulnerability |
CVE-2022-24469 | High | 8.1 | 2022-03-09 | Azure Site Recovery Elevation of Privilege Vulnerability |
CVE-2022-24468 | High | 7.2 | 2022-03-09 | Azure Site Recovery Remote Code Execution Vulnerability |
CVE-2022-24467 | High | 7.2 | 2022-03-09 | Azure Site Recovery Remote Code Execution Vulnerability |
CVE-2022-24465 | Low | 3.3 | 2022-03-09 | Microsoft Intune Portal for iOS Security Feature Bypass Vulnerability |
CVE-2022-24464 | High | 7.5 | 2022-03-09 | .NET and Visual Studio Denial of Service Vulnerability |