2022 CVEs (page 246)
Page 246 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-26490 | High | 7.8 | 2022-03-06 | st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c in the Linux kernel through 5.16.12 has EVT_TRANSACTION buffer overflows because of untrusted… |
CVE-2022-0845 | Critical | 9.8 | 2022-03-05 | Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0. |
CVE-2022-24921 | High | 7.5 | 2022-03-05 | regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression. |
CVE-2022-0849 | Medium | 5.5 | 2022-03-05 | Use After Free in r_reg_get_name_idx in GitHub repository radareorg/radare2 prior to 5.6.6. |
CVE-2022-25465 | High | 7.8 | 2022-03-05 | Espruino 2v11 release was discovered to contain a stack buffer overflow via src/jsvar.c in jsvGetNextSibling. |
CVE-2022-25044 | High | 7.8 | 2022-03-05 | Espruino 2v11.251 was discovered to contain a stack buffer overflow via src/jsvar.c in jsvNewFromString. |
CVE-2022-25069 | Critical | 9.6 | 2022-03-05 | Mark Text v0.16.3 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability which allows attackers to perform remote code execution (RCE)… |
CVE-2022-25312 | Critical | 9.1 | 2022-03-05 | An XML external entity (XXE) injection vulnerability was discovered in the Any23 RDFa XSLTStylesheet extractor and is known to affect Any23 versions < 2.7. XML… |
CVE-2022-25106 | Medium | 5.5 | 2022-03-04 | D-Link DIR-859 v1.05 was discovered to contain a stack-based buffer overflow via the function genacgi_main. This vulnerability allows attackers to cause a Deni… |
CVE-2022-23915 | High | 7.2 | 2022-03-04 | The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Aut… |
CVE-2022-26484 | Medium | 4.9 | 2022-03-04 | An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2 Patch 600 and 8.x before 8.0.0 Patch 100. The web server fails to sanitize… |
CVE-2022-26483 | Medium | 4.8 | 2022-03-04 | An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2 Patch 600 and 8.x before 8.0.0 Patch 100. A reflected cross-site scripting… |
CVE-2022-0855 | Medium | 6.1 | 2022-03-04 | Improper Resolution of Path Equivalence in GitHub repository microweber-dev/whmcs_plugin prior to 0.0.4. |
CVE-2022-26318 | Critical | 9.8 | 2022-03-04 | On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. This vulnerability impacts Fireware OS before 12.7… |
CVE-2022-23233 | High | 7.5 | 2022-03-04 | StorageGRID (formerly StorageGRID Webscale) versions prior to 11.6.0 are susceptible to a vulnerability which when successfully exploited could lead to Denial… |
CVE-2022-23232 | Medium | 4.9 | 2022-03-04 | StorageGRID (formerly StorageGRID Webscale) versions prior to 11.6.0 are susceptible to a vulnerability which when successfully exploited could allow disabled… |
CVE-2022-25623 | High | 7.8 | 2022-03-04 | The Symantec Management Agent is susceptible to a privilege escalation vulnerability. A low privilege local account can be elevated to the SYSTEM level through… |
CVE-2022-21828 | High | 7.2 | 2022-03-04 | A user with high privilege access to the Incapptic Connect web console can remotely execute code on the Incapptic Connect server using a unspecified attack vec… |
CVE-2022-26336 | Medium | 5.5 | 2022-03-04 | A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception. This package is used to read TNEF file… |
CVE-2022-23729 | High | 7.8 | 2022-03-04 | When the device is in factory state, it can be access the shell without adb authentication process. The LG ID is LVE-SMP-210010. |
CVE-2022-22946 | Medium | 5.5 | 2022-03-04 | In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or trusted certificates are set will be co… |
CVE-2022-23397 | Medium | 6.1 | 2022-03-04 | The Cedar Gate EZ-NET portal 6.5.5 6.8.0 Internet portal has a call to display messages to users which does not properly sanitize data sent in through a URL pa… |
CVE-2022-0839 | Critical | 9.8 | 2022-03-04 | Improper Restriction of XML External Entity Reference in GitHub repository liquibase/liquibase prior to 4.8.0. |
CVE-2022-26201 | Critical | 9.8 | 2022-03-04 | Victor CMS v1.0 was discovered to contain a SQL injection vulnerability. |
CVE-2022-0832 | Medium | 5.4 | 2022-03-04 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3. |
CVE-2022-0831 | Medium | 5.4 | 2022-03-04 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3. |
CVE-2022-23328 | High | 7.5 | 2022-03-04 | A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas price from one account that all fully spen… |
CVE-2022-23327 | High | 7.5 | 2022-03-04 | A design flaw in Go-Ethereum 1.10.12 and older versions allows an attacker node to send 5120 future transactions with a high gas price in one message, which ca… |
CVE-2022-0752 | Medium | 6.1 | 2022-03-04 | Cross-site Scripting (XSS) - Generic in GitHub repository hestiacp/hestiacp prior to 1.5.9. |
CVE-2022-0848 | Critical | 9.8 | 2022-03-04 | OS Command Injection in GitHub repository part-db/part-db prior to 0.5.11. |
CVE-2022-0838 | Medium | 6.1 | 2022-03-04 | Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.5.10. |
CVE-2022-0730 | Critical | 9.8 | 2022-03-03 | Under certain ldap conditions, Cacti authentication can be bypassed with certain credential types. |
CVE-2022-25220 | Medium | 4.8 | 2022-03-03 | PeteReport Version 0.5 allows an authenticated admin user to inject persistent JavaScript code inside the markdown descriptions while creating a product, repor… |
CVE-2022-24725 | Medium | 6.2 | 2022-03-03 | Shescape is a shell escape package for JavaScript. An issue in versions 1.4.0 to 1.5.1 allows for exposure of the home directory on Unix systems when using Bas… |
CVE-2022-23710 | Medium | 6.1 | 2022-03-03 | A cross-site-scripting (XSS) vulnerability was discovered in the Data Preview Pane (previously known as Index Pattern Preview Pane) which could allow arbitrary… |
CVE-2022-23709 | Medium | 4.3 | 2022-03-03 | A flaw was discovered in Kibana in which users with Read access to the Uptime feature could modify alerting rules. A user with this privilege would be able to… |
CVE-2022-23708 | Medium | 4.3 | 2022-03-03 | A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the sec… |
CVE-2022-23052 | Medium | 6.5 | 2022-03-03 | PeteReport Version 0.5 contains a Cross Site Request Forgery (CSRF) vulnerability allowing an attacker to trick users into deleting users, products, reports an… |
CVE-2022-23051 | Medium | 5.4 | 2022-03-03 | PeteReport Version 0.5 allows an authenticated admin user to inject persistent JavaScript code while adding an 'Attack Tree' by modifying the 'svg_file' parame… |
CVE-2022-22947 | Critical | 10.0 | 2022-03-03 | In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enab… |
CVE-2022-22943 | Medium | 6.7 | 2022-03-03 | VMware Tools for Windows (11.x.y and 10.x.y prior to 12.0.0) contains an uncontrolled search path vulnerability. A malicious actor with local administrative pr… |
CVE-2022-0265 | Critical | 9.8 | 2022-03-03 | Improper Restriction of XML External Entity Reference in GitHub repository hazelcast/hazelcast in 5.1-BETA-1. |
CVE-2022-24723 | Medium | 5.3 | 2022-03-03 | URI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol, so URLs are not p… |
CVE-2022-21716 | High | 7.5 | 2022-03-03 | Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to acce… |
CVE-2022-24724 | High | 8.8 | 2022-03-03 | cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Prior to versions 0.29.0.gfm.3 and 0.28.3.gfm.21, an integer overflow i… |
CVE-2022-25125 | Critical | 9.8 | 2022-03-03 | MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via search.do in the file /mdiy/dict/listExcludeApp. |
CVE-2022-23899 | Critical | 9.8 | 2022-03-03 | MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via search.do in the file /web/MCmsAction.java. |
CVE-2022-23898 | Critical | 9.8 | 2022-03-03 | MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via the categoryId parameter in the file IContentDao.xml. |
CVE-2022-22700 | Medium | 5.3 | 2022-03-03 | CyberArk Identity versions up to and including 22.1 in the 'StartAuthentication' resource, exposes the response header 'X-CFY-TX-TM'. In certain configurations… |
CVE-2022-0492 | High | 7.8 | 2022-03-03 | A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, a… |
CVE-2022-26129 | High | 7.8 | 2022-03-03 | Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to wrong checks on the subtlv length in the functions, parse_hello_subtlv, parse_ihu_subtl… |
CVE-2022-26128 | High | 7.8 | 2022-03-03 | A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to a wrong check on the input packet length in the babel_packet_examin function in babeld… |
CVE-2022-26127 | High | 7.8 | 2022-03-03 | A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to missing a check on the input packet length in the babel_packet_examin function in babe… |
CVE-2022-26126 | High | 7.8 | 2022-03-03 | Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to the use of strdup with a non-zero-terminated binary string in isis_nb_notifications.c. |
CVE-2022-26125 | High | 7.8 | 2022-03-03 | Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to wrong checks on the input packet length in isisd/isis_tlvs.c. |
CVE-2022-25138 | Medium | 5.4 | 2022-03-03 | Axelor Open Suite v5.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Name parameter. |
CVE-2022-0841 | Critical | 9.8 | 2022-03-03 | OS Command Injection in GitHub repository ljharb/npm-lockfile in v2.0.3 and v2.0.4. |
CVE-2022-0753 | Medium | 6.1 | 2022-03-03 | Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.5.9. |
CVE-2022-25031 | High | 7.8 | 2022-03-03 | Remote Desktop Commander Suite Agent before v4.8 contains an unquoted service path which allows attackers to escalate privileges to the system level. |
CVE-2022-22706 | High | 7.8 | 2022-03-03 | Arm Mali GPU Kernel Driver allows a non-privileged user to achieve write access to read-only memory pages. This affects Midgard r26p0 through r31p0, Bifrost r0… |
CVE-2022-23648 | High | 7.5 | 2022-03-03 | containerd is a container runtime available as a daemon for Linux and Windows. A bug was found in containerd prior to versions 1.6.1, 1.5.10, and 1.14.12 where… |
CVE-2022-0528 | Medium | 6.5 | 2022-03-03 | Server-Side Request Forgery (SSRF) in GitHub repository transloadit/uppy prior to 3.3.1. |
CVE-2022-23849 | Medium | 6.6 | 2022-03-03 | The biometric lock in Devolutions Password Hub for iOS before 2021.3.4 allows attackers to access the application because of authentication bypass. An attacker… |
CVE-2022-24573 | Medium | 6.1 | 2022-03-03 | A stored cross-site scripting (XSS) vulnerability in the admin interface in Element-IT HTTP Commander 7.0.0 allows unauthenticated users to get admin access by… |
CVE-2022-24563 | Medium | 5.4 | 2022-03-03 | In Genixcms v1.1.11, a stored Cross-Site Scripting (XSS) vulnerability exists in /gxadmin/index.php?page=themes&view=options" via the intro_title and intro_ima… |
CVE-2022-25471 | High | 8.1 | 2022-03-03 | An Insecure Direct Object Reference (IDOR) vulnerability in OpenEMR 6.0.0 allows any authenticated attacker to access and modify unauthorized areas via a craft… |
CVE-2022-25146 | Medium | 5.3 | 2022-03-03 | The Remote App module in Liferay Portal Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the origin of event mess… |
CVE-2022-25089 | Critical | 9.8 | 2022-03-03 | Printix Secure Cloud Print Management through 1.3.1106.0 incorrectly uses Privileged APIs to modify values in HKEY_LOCAL_MACHINE via UITasks.PersistentRegistry… |
CVE-2022-22909 | High | 8.8 | 2022-03-03 | HotelDruid v3.0.3 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via an attacker inserting a crafted payload into the… |
CVE-2022-26171 | Critical | 9.8 | 2022-03-02 | Bank Management System v1.o was discovered to contain a SQL injection vulnerability via the email parameter. |
CVE-2022-26170 | Critical | 9.8 | 2022-03-02 | Simple Mobile Comparison Website v1.0 was discovered to contain a SQL injection vulnerability via the search parameter. |
CVE-2022-26169 | Critical | 9.8 | 2022-03-02 | Air Cargo Management System v1.0 was discovered to contain a SQL injection vulnerability via the ref_code parameter. |
CVE-2022-25399 | Critical | 9.8 | 2022-03-02 | Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter. |
CVE-2022-25398 | Critical | 9.8 | 2022-03-02 | Auto Spare Parts Management v1.0 was discovered to contain a SQL injection vulnerability via the user parameter. |
CVE-2022-25396 | Critical | 9.8 | 2022-03-02 | Cosmetics and Beauty Product Online Store v1.0 was discovered to contain a SQL injection vulnerability via the search parameter. |
CVE-2022-25395 | Critical | 9.6 | 2022-03-02 | Cosmetics and Beauty Product Online Store v1.0 was discovered to contain multiple reflected cross-site scripting (XSS) attacks via the search parameter under t… |
CVE-2022-25394 | Critical | 9.8 | 2022-03-02 | Medical Store Management System v1.0 was discovered to contain a SQL injection vulnerability via the cid parameter under customer-add.php. |
CVE-2022-25393 | High | 7.5 | 2022-03-02 | Simple Bakery Shop Management v1.0 was discovered to contain a SQL injection vulnerability via the username parameter. |
CVE-2022-25115 | High | 7.8 | 2022-03-02 | A remote code execution (RCE) vulnerability in the Avatar parameter under /admin/?page=user/manage_user of Home Owners Collection Management System v1.0 allows… |
CVE-2022-25114 | Medium | 6.1 | 2022-03-02 | Event Management v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the full_name parameter under register.php. |
CVE-2022-24722 | High | 8.1 | 2022-03-02 | VIewComponent is a framework for building view components in Ruby on Rails. Versions prior to 2.31.2 and 2.49.1 contain a cross-site scripting vulnerability th… |
CVE-2022-23958 | Medium | 5.5 | 2022-03-02 | Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service. |
CVE-2022-23957 | Medium | 5.5 | 2022-03-02 | Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service. |
CVE-2022-23955 | Medium | 5.5 | 2022-03-02 | Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service. |
CVE-2022-23954 | Medium | 5.5 | 2022-03-02 | Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service. |
CVE-2022-0711 | High | 7.5 | 2022-03-02 | A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP respon… |
CVE-2022-25045 | Critical | 9.8 | 2022-03-02 | Home Owners Collection Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admi… |
CVE-2022-23956 | Medium | 5.5 | 2022-03-02 | Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service. |
CVE-2022-23953 | Medium | 5.5 | 2022-03-02 | Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service. |
CVE-2022-23656 | Medium | 4.6 | 2022-03-02 | Zulip is an open source team chat app. The `main` development branch of Zulip Server from June 2021 and later is vulnerable to a cross-site scripting vulnerabi… |
CVE-2022-22944 | Medium | 5.4 | 2022-03-02 | VMware Workspace ONE Boxer contains a stored cross-site scripting (XSS) vulnerability. Due to insufficient sanitization and validation, in VMware Workspace ONE… |
CVE-2022-0675 | Medium | 5.6 | 2022-03-02 | In certain situations it is possible for an unmanaged rule to exist on the target system that has the same comment as the rule specified in the manifest. This… |
CVE-2022-23640 | Critical | 9.8 | 2022-03-02 | Excel-Streaming-Reader is an easy-to-use implementation of a streaming Excel reader using Apache POI. Prior to xlsx-streamer 2.1.0, the XML parser that was use… |
CVE-2022-23878 | Critical | 9.8 | 2022-03-02 | seacms V11.5 is affected by an arbitrary code execution vulnerability in admin_config.php. |
CVE-2022-25016 | Critical | 9.8 | 2022-03-02 | Home Owners Collection Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /student_attendance/index.php… |
CVE-2022-22350 | Medium | 5.5 | 2022-03-02 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in CAA to cause a denial of service. IBM X-Force ID: 220… |
CVE-2022-0819 | High | 8.8 | 2022-03-02 | Code Injection in GitHub repository dolibarr/dolibarr prior to 15.0.1. |
CVE-2022-25634 | High | 7.5 | 2022-03-02 | Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory. |
CVE-2022-24447 | Medium | 6.5 | 2022-03-02 | An issue was discovered in Zoho ManageEngine Key Manager Plus before 6200. A service exposed by the application allows a user, with the level Operator, to acce… |
CVE-2022-24306 | Critical | 9.8 | 2022-03-02 | Zoho ManageEngine SharePoint Manager Plus before 4329 allows account takeover because authorization is mishandled. |