2022 CVEs (page 246)
Page 246 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-22946 | Medium | 5.5 | 2022-03-04 | In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or trusted certificates are set will be co… |
CVE-2022-23397 | Medium | 6.1 | 2022-03-04 | The Cedar Gate EZ-NET portal 6.5.5 6.8.0 Internet portal has a call to display messages to users which does not properly sanitize data sent in through a URL pa… |
CVE-2022-0839 | Critical | 9.8 | 2022-03-04 | Improper Restriction of XML External Entity Reference in GitHub repository liquibase/liquibase prior to 4.8.0. |
CVE-2022-26201 | Critical | 9.8 | 2022-03-04 | Victor CMS v1.0 was discovered to contain a SQL injection vulnerability. |
CVE-2022-0832 | Medium | 5.4 | 2022-03-04 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3. |
CVE-2022-0831 | Medium | 5.4 | 2022-03-04 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3. |
CVE-2022-23328 | High | 7.5 | 2022-03-04 | A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas price from one account that all fully spen… |
CVE-2022-23327 | High | 7.5 | 2022-03-04 | A design flaw in Go-Ethereum 1.10.12 and older versions allows an attacker node to send 5120 future transactions with a high gas price in one message, which ca… |
CVE-2022-0752 | Medium | 6.1 | 2022-03-04 | Cross-site Scripting (XSS) - Generic in GitHub repository hestiacp/hestiacp prior to 1.5.9. |
CVE-2022-0848 | Critical | 9.8 | 2022-03-04 | OS Command Injection in GitHub repository part-db/part-db prior to 0.5.11. |
CVE-2022-0838 | Medium | 6.1 | 2022-03-04 | Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.5.10. |
CVE-2022-0730 | Critical | 9.8 | 2022-03-03 | Under certain ldap conditions, Cacti authentication can be bypassed with certain credential types. |
CVE-2022-25220 | Medium | 4.8 | 2022-03-03 | PeteReport Version 0.5 allows an authenticated admin user to inject persistent JavaScript code inside the markdown descriptions while creating a product, repor… |
CVE-2022-24725 | Medium | 6.2 | 2022-03-03 | Shescape is a shell escape package for JavaScript. An issue in versions 1.4.0 to 1.5.1 allows for exposure of the home directory on Unix systems when using Bas… |
CVE-2022-23710 | Medium | 6.1 | 2022-03-03 | A cross-site-scripting (XSS) vulnerability was discovered in the Data Preview Pane (previously known as Index Pattern Preview Pane) which could allow arbitrary… |
CVE-2022-23709 | Medium | 4.3 | 2022-03-03 | A flaw was discovered in Kibana in which users with Read access to the Uptime feature could modify alerting rules. A user with this privilege would be able to… |
CVE-2022-23708 | Medium | 4.3 | 2022-03-03 | A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the sec… |
CVE-2022-23052 | Medium | 6.5 | 2022-03-03 | PeteReport Version 0.5 contains a Cross Site Request Forgery (CSRF) vulnerability allowing an attacker to trick users into deleting users, products, reports an… |
CVE-2022-23051 | Medium | 5.4 | 2022-03-03 | PeteReport Version 0.5 allows an authenticated admin user to inject persistent JavaScript code while adding an 'Attack Tree' by modifying the 'svg_file' parame… |
CVE-2022-22947 | Critical | 10.0 | 2022-03-03 | In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enab… |
CVE-2022-22943 | Medium | 6.7 | 2022-03-03 | VMware Tools for Windows (11.x.y and 10.x.y prior to 12.0.0) contains an uncontrolled search path vulnerability. A malicious actor with local administrative pr… |
CVE-2022-0265 | Critical | 9.8 | 2022-03-03 | Improper Restriction of XML External Entity Reference in GitHub repository hazelcast/hazelcast in 5.1-BETA-1. |
CVE-2022-24723 | Medium | 5.3 | 2022-03-03 | URI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol, so URLs are not p… |
CVE-2022-21716 | High | 7.5 | 2022-03-03 | Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to acce… |
CVE-2022-24724 | High | 8.8 | 2022-03-03 | cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Prior to versions 0.29.0.gfm.3 and 0.28.3.gfm.21, an integer overflow i… |
CVE-2022-25125 | Critical | 9.8 | 2022-03-03 | MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via search.do in the file /mdiy/dict/listExcludeApp. |
CVE-2022-23899 | Critical | 9.8 | 2022-03-03 | MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via search.do in the file /web/MCmsAction.java. |
CVE-2022-23898 | Critical | 9.8 | 2022-03-03 | MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via the categoryId parameter in the file IContentDao.xml. |
CVE-2022-22700 | Medium | 5.3 | 2022-03-03 | CyberArk Identity versions up to and including 22.1 in the 'StartAuthentication' resource, exposes the response header 'X-CFY-TX-TM'. In certain configurations… |
CVE-2022-0492 | High | 7.8 | 2022-03-03 | A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, a… |
CVE-2022-26129 | High | 7.8 | 2022-03-03 | Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to wrong checks on the subtlv length in the functions, parse_hello_subtlv, parse_ihu_subtl… |
CVE-2022-26128 | High | 7.8 | 2022-03-03 | A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to a wrong check on the input packet length in the babel_packet_examin function in babeld… |
CVE-2022-26127 | High | 7.8 | 2022-03-03 | A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to missing a check on the input packet length in the babel_packet_examin function in babe… |
CVE-2022-26126 | High | 7.8 | 2022-03-03 | Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to the use of strdup with a non-zero-terminated binary string in isis_nb_notifications.c. |
CVE-2022-26125 | High | 7.8 | 2022-03-03 | Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to wrong checks on the input packet length in isisd/isis_tlvs.c. |
CVE-2022-25138 | Medium | 5.4 | 2022-03-03 | Axelor Open Suite v5.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Name parameter. |
CVE-2022-0841 | Critical | 9.8 | 2022-03-03 | OS Command Injection in GitHub repository ljharb/npm-lockfile in v2.0.3 and v2.0.4. |
CVE-2022-0753 | Medium | 6.1 | 2022-03-03 | Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.5.9. |
CVE-2022-25031 | High | 7.8 | 2022-03-03 | Remote Desktop Commander Suite Agent before v4.8 contains an unquoted service path which allows attackers to escalate privileges to the system level. |
CVE-2022-22706 | High | 7.8 | 2022-03-03 | Arm Mali GPU Kernel Driver allows a non-privileged user to achieve write access to read-only memory pages. This affects Midgard r26p0 through r31p0, Bifrost r0… |
CVE-2022-23648 | High | 7.5 | 2022-03-03 | containerd is a container runtime available as a daemon for Linux and Windows. A bug was found in containerd prior to versions 1.6.1, 1.5.10, and 1.14.12 where… |
CVE-2022-0528 | Medium | 6.5 | 2022-03-03 | Server-Side Request Forgery (SSRF) in GitHub repository transloadit/uppy prior to 3.3.1. |
CVE-2022-23849 | Medium | 6.6 | 2022-03-03 | The biometric lock in Devolutions Password Hub for iOS before 2021.3.4 allows attackers to access the application because of authentication bypass. An attacker… |
CVE-2022-24573 | Medium | 6.1 | 2022-03-03 | A stored cross-site scripting (XSS) vulnerability in the admin interface in Element-IT HTTP Commander 7.0.0 allows unauthenticated users to get admin access by… |
CVE-2022-24563 | Medium | 5.4 | 2022-03-03 | In Genixcms v1.1.11, a stored Cross-Site Scripting (XSS) vulnerability exists in /gxadmin/index.php?page=themes&view=options" via the intro_title and intro_ima… |
CVE-2022-25471 | High | 8.1 | 2022-03-03 | An Insecure Direct Object Reference (IDOR) vulnerability in OpenEMR 6.0.0 allows any authenticated attacker to access and modify unauthorized areas via a craft… |
CVE-2022-25146 | Medium | 5.3 | 2022-03-03 | The Remote App module in Liferay Portal Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the origin of event mess… |
CVE-2022-25089 | Critical | 9.8 | 2022-03-03 | Printix Secure Cloud Print Management through 1.3.1106.0 incorrectly uses Privileged APIs to modify values in HKEY_LOCAL_MACHINE via UITasks.PersistentRegistry… |
CVE-2022-22909 | High | 8.8 | 2022-03-03 | HotelDruid v3.0.3 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via an attacker inserting a crafted payload into the… |
CVE-2022-26171 | Critical | 9.8 | 2022-03-02 | Bank Management System v1.o was discovered to contain a SQL injection vulnerability via the email parameter. |
CVE-2022-26170 | Critical | 9.8 | 2022-03-02 | Simple Mobile Comparison Website v1.0 was discovered to contain a SQL injection vulnerability via the search parameter. |
CVE-2022-26169 | Critical | 9.8 | 2022-03-02 | Air Cargo Management System v1.0 was discovered to contain a SQL injection vulnerability via the ref_code parameter. |
CVE-2022-25399 | Critical | 9.8 | 2022-03-02 | Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter. |
CVE-2022-25398 | Critical | 9.8 | 2022-03-02 | Auto Spare Parts Management v1.0 was discovered to contain a SQL injection vulnerability via the user parameter. |
CVE-2022-25396 | Critical | 9.8 | 2022-03-02 | Cosmetics and Beauty Product Online Store v1.0 was discovered to contain a SQL injection vulnerability via the search parameter. |
CVE-2022-25395 | Critical | 9.6 | 2022-03-02 | Cosmetics and Beauty Product Online Store v1.0 was discovered to contain multiple reflected cross-site scripting (XSS) attacks via the search parameter under t… |
CVE-2022-25394 | Critical | 9.8 | 2022-03-02 | Medical Store Management System v1.0 was discovered to contain a SQL injection vulnerability via the cid parameter under customer-add.php. |
CVE-2022-25393 | High | 7.5 | 2022-03-02 | Simple Bakery Shop Management v1.0 was discovered to contain a SQL injection vulnerability via the username parameter. |
CVE-2022-25115 | High | 7.8 | 2022-03-02 | A remote code execution (RCE) vulnerability in the Avatar parameter under /admin/?page=user/manage_user of Home Owners Collection Management System v1.0 allows… |
CVE-2022-25114 | Medium | 6.1 | 2022-03-02 | Event Management v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the full_name parameter under register.php. |
CVE-2022-24722 | High | 8.1 | 2022-03-02 | VIewComponent is a framework for building view components in Ruby on Rails. Versions prior to 2.31.2 and 2.49.1 contain a cross-site scripting vulnerability th… |
CVE-2022-23958 | Medium | 5.5 | 2022-03-02 | Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service. |
CVE-2022-23957 | Medium | 5.5 | 2022-03-02 | Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service. |
CVE-2022-23955 | Medium | 5.5 | 2022-03-02 | Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service. |
CVE-2022-23954 | Medium | 5.5 | 2022-03-02 | Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service. |
CVE-2022-0711 | High | 7.5 | 2022-03-02 | A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP respon… |
CVE-2022-25045 | Critical | 9.8 | 2022-03-02 | Home Owners Collection Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admi… |
CVE-2022-23956 | Medium | 5.5 | 2022-03-02 | Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service. |
CVE-2022-23953 | Medium | 5.5 | 2022-03-02 | Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service. |
CVE-2022-23656 | Medium | 4.6 | 2022-03-02 | Zulip is an open source team chat app. The `main` development branch of Zulip Server from June 2021 and later is vulnerable to a cross-site scripting vulnerabi… |
CVE-2022-22944 | Medium | 5.4 | 2022-03-02 | VMware Workspace ONE Boxer contains a stored cross-site scripting (XSS) vulnerability. Due to insufficient sanitization and validation, in VMware Workspace ONE… |
CVE-2022-0675 | Medium | 5.6 | 2022-03-02 | In certain situations it is possible for an unmanaged rule to exist on the target system that has the same comment as the rule specified in the manifest. This… |
CVE-2022-23640 | Critical | 9.8 | 2022-03-02 | Excel-Streaming-Reader is an easy-to-use implementation of a streaming Excel reader using Apache POI. Prior to xlsx-streamer 2.1.0, the XML parser that was use… |
CVE-2022-23878 | Critical | 9.8 | 2022-03-02 | seacms V11.5 is affected by an arbitrary code execution vulnerability in admin_config.php. |
CVE-2022-25016 | Critical | 9.8 | 2022-03-02 | Home Owners Collection Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /student_attendance/index.php… |
CVE-2022-22350 | Medium | 5.5 | 2022-03-02 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in CAA to cause a denial of service. IBM X-Force ID: 220… |
CVE-2022-0819 | High | 8.8 | 2022-03-02 | Code Injection in GitHub repository dolibarr/dolibarr prior to 15.0.1. |
CVE-2022-25634 | High | 7.5 | 2022-03-02 | Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory. |
CVE-2022-24447 | Medium | 6.5 | 2022-03-02 | An issue was discovered in Zoho ManageEngine Key Manager Plus before 6200. A service exposed by the application allows a user, with the level Operator, to acce… |
CVE-2022-24306 | Critical | 9.8 | 2022-03-02 | Zoho ManageEngine SharePoint Manager Plus before 4329 allows account takeover because authorization is mishandled. |
CVE-2022-24305 | Critical | 9.8 | 2022-03-02 | Zoho ManageEngine SharePoint Manager Plus before 4329 is vulnerable to a sensitive data leak that leads to privilege escalation. |
CVE-2022-23779 | Medium | 5.3 | 2022-03-02 | Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname can be discovered by reading HTTP redir… |
CVE-2022-23395 | Medium | 6.1 | 2022-03-02 | jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS). |
CVE-2022-0829 | High | 8.1 | 2022-03-02 | Improper Authorization in GitHub repository webmin/webmin prior to 1.990. |
CVE-2022-0824 | High | 8.8 | 2022-03-02 | Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990. |
CVE-2022-22303 | Low | 2.8 | 2022-03-02 | An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiManager versions prior to 7.0.2, 6.4.7 and 6.2.9… |
CVE-2022-22301 | High | 7.8 | 2022-03-02 | An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] in FortiAP-C console 5.4.0 through 5.4.3, 5.2.0 through 5.2.1 may a… |
CVE-2022-0577 | Medium | 6.5 | 2022-03-02 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1. |
CVE-2022-25051 | Medium | 5.5 | 2022-03-02 | An Off-by-one Error occurs in cmr113_decode of rtl_433 21.12 when decoding a crafted file. |
CVE-2022-25050 | Medium | 5.5 | 2022-03-02 | rtl_433 21.12 was discovered to contain a stack overflow in the function somfy_iohc_decode(). This vulnerability allows attackers to cause a Denial of Service… |
CVE-2022-25012 | Medium | 5.5 | 2022-03-01 | Argus Surveillance DVR v4.0 employs weak password encryption. |
CVE-2022-25010 | Critical | 9.1 | 2022-03-01 | The component /rootfs in RageFile of Stepmania v5.1b2 and below allows attackers access to the entire file system. |
CVE-2022-24720 | Critical | 9.8 | 2022-03-01 | image_processing is an image processing wrapper for libvips and ImageMagick/GraphicsMagick. Prior to version 1.12.2, using the `#apply` method from image_proce… |
CVE-2022-24255 | High | 8.8 | 2022-03-01 | Extensis Portfolio v4.0 was discovered to contain hardcoded credentials which allows attackers to gain administrator privileges. |
CVE-2022-24254 | High | 8.8 | 2022-03-01 | An unrestricted file upload vulnerability in the Backup/Restore Archive component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code… |
CVE-2022-24253 | High | 8.8 | 2022-03-01 | Extensis Portfolio v4.0 was discovered to contain an authenticated unrestricted file upload vulnerability via the component AdminFileTransferServlet. |
CVE-2022-24252 | High | 8.8 | 2022-03-01 | An unrestricted file upload vulnerability in the FileTransferServlet component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via… |
CVE-2022-24251 | High | 8.8 | 2022-03-01 | Extensis Portfolio v4.0 was discovered to contain an authenticated unrestricted file upload vulnerability via the Catalog Asset Upload function. |
CVE-2022-24719 | Low | 2.6 | 2022-03-01 | Fluture-Node is a FP-style HTTP and streaming utils for Node based on Fluture. Using `followRedirects` or `followRedirectsWith` with any of the redirection str… |
CVE-2022-24718 | High | 7.6 | 2022-03-01 | ssr-pages is an HTML page builder for the purpose of server-side rendering (SSR). In versions prior to 0.1.4, a path traversal issue can occur when providing u… |