2022 CVEs (page 249)
Page 249 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-25081 | Critical | 9.8 | 2022-02-24 | TOTOLink T10 V5.9c.5061_B20200511 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to ex… |
CVE-2022-25080 | Critical | 9.8 | 2022-02-24 | TOTOLink A830R V5.9c.4729_B20191112 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to… |
CVE-2022-25079 | Critical | 9.8 | 2022-02-24 | TOTOLink A810R V4.1.2cu.5182_B20201026 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers… |
CVE-2022-25078 | Critical | 9.8 | 2022-02-24 | TOTOLink A3600R V4.1.2cu.5182_B20201102 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers… |
CVE-2022-25077 | Critical | 9.8 | 2022-02-24 | TOTOLink A3100R V4.1.2cu.5050_B20200504 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers… |
CVE-2022-25076 | Critical | 9.8 | 2022-02-24 | TOTOLink A800R V4.1.2cu.5137_B20200730 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers… |
CVE-2022-25075 | Critical | 9.8 | 2022-02-24 | TOTOLink A3000RU V5.9c.2280_B20180512 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers t… |
CVE-2022-25074 | Critical | 9.8 | 2022-02-24 | TP-Link TL-WR902AC(US)_V3_191209 routers were discovered to contain a stack overflow in the function DM_ Fillobjbystr(). This vulnerability allows unauthentica… |
CVE-2022-25073 | Critical | 9.8 | 2022-02-24 | TL-WR841Nv14_US_0.9.1_4.18 routers were discovered to contain a stack overflow in the function dm_fillObjByStr(). This vulnerability allows unauthenticated att… |
CVE-2022-25072 | Critical | 9.8 | 2022-02-24 | TP-Link Archer A54 Archer A54(US)_V1_210111 routers were discovered to contain a stack overflow in the function DM_ Fillobjbystr(). This vulnerability allows u… |
CVE-2022-24633 | Medium | 5.3 | 2022-02-24 | All versions of FileCloud prior to 21.3 are vulnerable to user enumeration. The vulnerability exists in the parameter "path" passing "/SHARED/<username>". A ma… |
CVE-2022-24620 | Medium | 5.4 | 2022-02-24 | Piwigo version 12.2.0 is vulnerable to stored cross-site scripting (XSS), which can lead to privilege escalation. In this way, admin can steal webmaster's cook… |
CVE-2022-24615 | Medium | 5.5 | 2022-02-24 | zip4j up to v2.10.0 can throw various uncaught exceptions while parsing a specially crafted ZIP file, which could result in an application crash. This could be… |
CVE-2022-24614 | Medium | 5.5 | 2022-02-24 | When reading a specially crafted JPEG file, metadata-extractor up to 2.16.0 can be made to allocate large amounts of memory that finally leads to an out-of-mem… |
CVE-2022-24613 | Medium | 5.5 | 2022-02-24 | metadata-extractor up to 2.16.0 can throw various uncaught exceptions while parsing a specially crafted JPEG file, which could result in an application crash… |
CVE-2022-24610 | High | 8.6 | 2022-02-24 | Settings/network settings/wireless settings on the Alecto DVC-215IP camera version 63.1.1.173 and below shows the Wi-Fi passphrase hidden, but by editing/remov… |
CVE-2022-24599 | Medium | 6.5 | 2022-02-24 | In autofile Audio File Library 0.3.6, there exists one memory leak vulnerability in printfileinfo, in printinfo.c, which allows an attacker to leak sensitive i… |
CVE-2022-24582 | Medium | 5.4 | 2022-02-24 | Accounting Journal Management 1.0 is vulnerable to XSS-PHPSESSID-Hijacking. The parameter manage_user from User lists is vulnerable to XSS-Stored and PHPSESSID… |
CVE-2022-24566 | Medium | 5.4 | 2022-02-24 | In Checkmk <=2.0.0p19 fixed in 2.0.0p20 and Checkmk <=1.6.0p27 fixed in 1.6.0p28, the title of a Predefined condition is not properly escaped when shown as con… |
CVE-2022-24565 | Medium | 5.4 | 2022-02-24 | Checkmk <=2.0.0p19 Fixed in 2.0.0p20 and Checkmk <=1.6.0p27 Fixed in 1.6.0p28 are affected by a Cross Site Scripting (XSS) vulnerability. The Alias of a site w… |
CVE-2022-24435 | Medium | 6.1 | 2022-02-24 | Cross-site scripting vulnerability in phpUploader v1.2 and earlier allows a remote unauthenticated attacker to inject an arbitrary script via unspecified vecto… |
CVE-2022-24407 | High | 8.8 | 2022-02-24 | In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement. |
CVE-2022-24374 | Medium | 6.1 | 2022-02-24 | Cross-site scripting vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.75, Ver.2.9.x series versions prior to Ver.2.9.40, Ver.2.10.x serie… |
CVE-2022-23986 | High | 7.5 | 2022-02-24 | SQL injection vulnerability in the phpUploader v1.2 and earlier allows a remote unauthenticated attacker to obtain the information in the database via unspecif… |
CVE-2022-23916 | Medium | 6.1 | 2022-02-24 | Cross-site scripting vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.75, Ver.2.9.x series versions prior to Ver.2.9.40, Ver.2.10.x serie… |
CVE-2022-23810 | Medium | 6.5 | 2022-02-24 | Template injection (Improper Neutralization of Special Elements Used in a Template Engine) vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2… |
CVE-2022-23176 | High | 8.8 | 2022-02-24 | WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via expos… |
CVE-2022-23043 | High | 7.2 | 2022-02-24 | Zenario CMS 9.2 allows an authenticated admin user to bypass the file upload restriction by creating a new 'File/MIME Types' using the '.phar' extension. Then… |
CVE-2022-21179 | Medium | 4.3 | 2022-02-24 | Cross-site request forgery (CSRF) vulnerability in EC-CUBE plugin 'Mail Magazine Management Plugin' ver4.0.0 to 4.1.1 (for EC-CUBE 4 series) and ver1.0.0 to 1… |
CVE-2022-21142 | Critical | 9.8 | 2022-02-24 | Authentication bypass vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.74, Ver.2.9.x series versions prior to Ver.2.9.39, Ver.2.10.x seri… |
CVE-2022-0695 | Medium | 5.5 | 2022-02-24 | Denial of Service in GitHub repository radareorg/radare2 prior to 5.6.4. |
CVE-2022-25331 | High | 7.5 | 2022-02-24 | Uncaught exceptions that can be generated in Trend Micro ServerProtection 6.0/5.8 Information Server could allow a remote attacker to crash the process. |
CVE-2022-25330 | Critical | 9.8 | 2022-02-24 | Integer overflow conditions that exist in Trend Micro ServerProtect 6.0/5.8 Information Server could allow a remote attacker to crash the process or achieve re… |
CVE-2022-25329 | Critical | 9.8 | 2022-02-24 | Trend Micro ServerProtect 6.0/5.8 Information Server uses a static credential to perform authentication when a specific command is typed in the console. An una… |
CVE-2022-24680 | High | 7.8 | 2022-02-24 | A security link following local privilege escalation vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service, Trend Micro Worry-Free Business… |
CVE-2022-24679 | High | 7.8 | 2022-02-24 | A security link following local privilege escalation vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service, Trend Micro Worry-Free Business… |
CVE-2022-24678 | High | 7.5 | 2022-02-24 | An security agent resource exhaustion denial-of-service vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service, Trend Micro Worry-Free Busine… |
CVE-2022-24671 | High | 7.8 | 2022-02-24 | A link following privilege escalation vulnerability in Trend Micro Antivirus for Max 11.0.2150 and below could allow a local attacker to modify a file during t… |
CVE-2022-23655 | Medium | 4.8 | 2022-02-24 | Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. Affected versions of OctoberCMS did not validate gateway server signatures. As a r… |
CVE-2022-23653 | Medium | 4.7 | 2022-02-23 | B2 Command Line Tool is the official command line tool for the backblaze cloud storage service. Linux and Mac releases of the B2 command-line tool version 3.2… |
CVE-2022-23651 | Medium | 4.7 | 2022-02-23 | b2-sdk-python is a python library to access cloud storage provided by backblaze. Linux and Mac releases of the SDK version 1.14.0 and below contain a key discl… |
CVE-2022-24409 | Medium | 5.9 | 2022-02-23 | Dell BSAFE SSL-J contains remediation for a covert timing channel vulnerability that may be exploited by malicious users to compromise the affected system. Onl… |
CVE-2022-22336 | High | 7.5 | 2022-02-23 | IBM Sterling External Authentication Server and IBM Sterling Secure Proxy 6.0.3.0, 6.0.2.0, and 3.4.3.2 could allow a remote user to consume resources causing… |
CVE-2022-22333 | Medium | 6.5 | 2022-02-23 | IBM Sterling Secure Proxy 6.0.3.0, 6.0.2.0, and 3.4.3.2 and IBM Sterling External Authentication Server are vulnerable a buffer overflow, due to the Jetty base… |
CVE-2022-21705 | High | 7.2 | 2022-02-23 | Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. In affected versions user input was not properly sanitized before rendering. An au… |
CVE-2022-0731 | Medium | 6.5 | 2022-02-23 | Improper Access Control (IDOR) in GitHub repository dolibarr/dolibarr prior to 16.0. |
CVE-2022-20650 | High | 8.8 | 2022-02-23 | A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges… |
CVE-2022-20625 | Medium | 4.3 | 2022-02-23 | A vulnerability in the Cisco Discovery Protocol service of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to ca… |
CVE-2022-20624 | High | 8.6 | 2022-02-23 | A vulnerability in the Cisco Fabric Services over IP (CFSoIP) feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial… |
CVE-2022-20623 | High | 8.6 | 2022-02-23 | A vulnerability in the rate limiter for Bidirectional Forwarding Detection (BFD) traffic of Cisco NX-OS Software for Cisco Nexus 9000 Series Switches could all… |
CVE-2022-0476 | Medium | 5.5 | 2022-02-23 | Denial of Service in GitHub repository radareorg/radare2 prior to 5.6.4. |
CVE-2022-0729 | High | 8.8 | 2022-02-23 | Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. |
CVE-2022-0727 | Medium | 5.4 | 2022-02-23 | Improper Access Control in GitHub repository chocobozzz/peertube prior to 4.1.0. |
CVE-2022-0726 | Medium | 5.4 | 2022-02-23 | Missing Authorization in GitHub repository chocobozzz/peertube prior to 4.1.0. |
CVE-2022-0724 | Medium | 6.5 | 2022-02-23 | Insecure Storage of Sensitive Information in GitHub repository microweber/microweber prior to 1.3. |
CVE-2022-0721 | Medium | 6.5 | 2022-02-23 | Insertion of Sensitive Information Into Debugging Code in GitHub repository microweber/microweber prior to 1.3. |
CVE-2022-0719 | Medium | 5.4 | 2022-02-23 | Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.3. |
CVE-2022-0736 | High | 7.5 | 2022-02-23 | Insecure Temporary File in GitHub repository mlflow/mlflow prior to 1.23.1. |
CVE-2022-0717 | Critical | 9.1 | 2022-02-23 | Out-of-bounds Read in GitHub repository mruby/mruby prior to 3.2. |
CVE-2022-0654 | High | 7.5 | 2022-02-23 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository fgribreau/node-request-retry prior to 7.0.0. |
CVE-2022-23612 | High | 7.5 | 2022-02-22 | OpenMRS is a patient-based medical record system focusing on giving providers a free customizable electronic medical record system. Affected versions are subje… |
CVE-2022-23606 | Medium | 4.4 | 2022-02-22 | Envoy is an open source edge and service proxy, designed for cloud-native applications. When a cluster is deleted via Cluster Discovery Service (CDS) all idle… |
CVE-2022-21657 | Medium | 6.8 | 2022-02-22 | Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions Envoy does not restrict the set of certificates it… |
CVE-2022-21656 | High | 7.4 | 2022-02-22 | Envoy is an open source edge and service proxy, designed for cloud-native applications. The default_validator.cc implementation used to implement the default c… |
CVE-2022-21655 | High | 7.5 | 2022-02-22 | Envoy is an open source edge and service proxy, designed for cloud-native applications. The envoy common router will segfault if an internal redirect selects a… |
CVE-2022-21654 | High | 7.4 | 2022-02-22 | Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have chang… |
CVE-2022-23635 | High | 7.5 | 2022-02-22 | Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, `istiod`, is vulnerable to a request proc… |
CVE-2022-23654 | High | 8.1 | 2022-02-22 | Wiki.js is a wiki app built on Node.js. In affected versions an authenticated user with write access on a restricted set of paths can update a page outside the… |
CVE-2022-23652 | High | 8.8 | 2022-02-22 | capsule-proxy is a reverse proxy for Capsule Operator which provides multi-tenancy in Kubernetes. In versions prior to 0.2.1 an attacker with a proper authenti… |
CVE-2022-23608 | High | 8.1 | 2022-02-22 | PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN… |
CVE-2022-0714 | Medium | 5.5 | 2022-02-22 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4436. |
CVE-2022-0713 | High | 7.1 | 2022-02-22 | Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.4. |
CVE-2022-0712 | Medium | 5.5 | 2022-02-22 | NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.4. |
CVE-2022-0665 | Medium | 6.5 | 2022-02-22 | Path Traversal in GitHub repository pimcore/pimcore prior to 10.3.2. |
CVE-2022-0676 | High | 7.8 | 2022-02-22 | Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.4. |
CVE-2022-24564 | Medium | 6.1 | 2022-02-21 | Checkmk <=2.0.0p19 contains a Cross Site Scripting (XSS) vulnerability. While creating or editing a user attribute, the Help Text is subject to HTML injection… |
CVE-2022-0696 | Medium | 5.5 | 2022-02-21 | NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4428. |
CVE-2022-0563 | Medium | 5.5 | 2022-02-21 | A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to… |
CVE-2022-25599 | Medium | 5.4 | 2022-02-21 | Cross-Site Request Forgery (CSRF) vulnerability leading to event deletion was discovered in Spiffy Calendar WordPress plugin (versions <= 4.9.0). |
CVE-2022-24295 | High | 8.8 | 2022-02-21 | Okta Advanced Server Access Client for Windows prior to version 1.57.0 was found to be vulnerable to command injection via a specially crafted URL. |
CVE-2022-23984 | Low | 3.7 | 2022-02-21 | Sensitive information disclosure discovered in wpDiscuz WordPress plugin (versions <= 7.3.11). |
CVE-2022-23983 | Medium | 4.3 | 2022-02-21 | Cross-Site Request Forgery (CSRF) vulnerability leading to plugin Settings Update discovered in WP Content Copy Protection & No Right Click WordPress plugin (v… |
CVE-2022-22308 | High | 7.8 | 2022-02-21 | IBM Planning Analytics 2.0 is vulnerable to a Remote File Include (RFI) attack. User input could be passed into file include commands and the web application c… |
CVE-2022-0708 | Medium | 4.3 | 2022-02-21 | Mattermost 6.3.0 and earlier fails to protect email addresses of the creator of the team via one of the APIs, which allows authenticated team members to access… |
CVE-2022-0564 | Medium | 5.3 | 2022-02-21 | A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts. An attacker could exploit this vulnerabil… |
CVE-2022-0692 | Medium | 6.1 | 2022-02-21 | Open Redirect on Rudloff/alltube in Packagist rudloff/alltube prior to 3.0.1. |
CVE-2022-24553 | Critical | 9.8 | 2022-02-21 | An issue was found in Zfaka <= 1.4.5. The verification of the background file upload function check is not strict, resulting in remote command execution. |
CVE-2022-0313 | Medium | 4.3 | 2022-02-21 | The Float menu WordPress plugin before 4.3.1 does not have CSRF check in place when deleting menu, which could allow attackers to make a logged in admin delete… |
CVE-2022-0288 | Medium | 6.1 | 2022-02-21 | The Ad Inserter WordPress plugin before 2.7.10, Ad Inserter Pro WordPress plugin before 2.7.10 do not sanitise and escape the html_element_selection parameter… |
CVE-2022-0279 | Low | 3.1 | 2022-02-21 | The AnyComment WordPress plugin before 0.2.18 is affected by a race condition when liking/disliking a comment/reply, which could allow any authenticated user t… |
CVE-2022-0255 | High | 7.2 | 2022-02-21 | The Database Backup for WordPress plugin before 2.5.1 does not properly sanitise and escape the fragment parameter before using it in a SQL statement in the ad… |
CVE-2022-0252 | Medium | 6.1 | 2022-02-21 | The GiveWP WordPress plugin before 2.17.3 does not escape the json parameter before outputting it back in an attribute in the Import admin dashboard, leading t… |
CVE-2022-0234 | Medium | 6.1 | 2022-02-21 | The WOOCS WordPress plugin before 1.3.7.5 does not sanitise and escape the woocs_in_order_currency parameter of the woocs_get_products_price_html AJAX action (… |
CVE-2022-0228 | High | 7.2 | 2022-02-21 | The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in a SQL statement in… |
CVE-2022-0211 | Medium | 4.8 | 2022-02-21 | The Shield Security WordPress plugin before 13.0.6 does not sanitise and escape admin notes, which could allow high privilege users to perform Cross-Site Scrip… |
CVE-2022-0199 | Medium | 4.3 | 2022-02-21 | The Coming soon and Maintenance mode WordPress plugin before 3.6.8 does not have CSRF check in its coming_soon_send_mail AJAX action, allowing attackers to mak… |
CVE-2022-0186 | Medium | 5.4 | 2022-02-21 | The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.5.3 does not sanitise and escape the Description field when editing a gallery, allowing user… |
CVE-2022-0164 | Medium | 4.3 | 2022-02-21 | The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not have authorisation and CSRF checks in its coming_soon_send_mail AJAX action, allowi… |
CVE-2022-0134 | High | 8.8 | 2022-02-21 | The AnyComment WordPress plugin before 0.2.18 does not have CSRF checks in the Import and Revert HyperComments features, allowing attackers to make logged in a… |
CVE-2022-0691 | Critical | 9.8 | 2022-02-21 | Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9. |