2022 CVEs (page 249)
Page 249 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-24435 | Medium | 6.1 | 2022-02-24 | Cross-site scripting vulnerability in phpUploader v1.2 and earlier allows a remote unauthenticated attacker to inject an arbitrary script via unspecified vecto… |
CVE-2022-24407 | High | 8.8 | 2022-02-24 | In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement. |
CVE-2022-24374 | Medium | 6.1 | 2022-02-24 | Cross-site scripting vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.75, Ver.2.9.x series versions prior to Ver.2.9.40, Ver.2.10.x serie… |
CVE-2022-23986 | High | 7.5 | 2022-02-24 | SQL injection vulnerability in the phpUploader v1.2 and earlier allows a remote unauthenticated attacker to obtain the information in the database via unspecif… |
CVE-2022-23916 | Medium | 6.1 | 2022-02-24 | Cross-site scripting vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.75, Ver.2.9.x series versions prior to Ver.2.9.40, Ver.2.10.x serie… |
CVE-2022-23810 | Medium | 6.5 | 2022-02-24 | Template injection (Improper Neutralization of Special Elements Used in a Template Engine) vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2… |
CVE-2022-23176 | High | 8.8 | 2022-02-24 | WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via expos… |
CVE-2022-23043 | High | 7.2 | 2022-02-24 | Zenario CMS 9.2 allows an authenticated admin user to bypass the file upload restriction by creating a new 'File/MIME Types' using the '.phar' extension. Then… |
CVE-2022-21179 | Medium | 4.3 | 2022-02-24 | Cross-site request forgery (CSRF) vulnerability in EC-CUBE plugin 'Mail Magazine Management Plugin' ver4.0.0 to 4.1.1 (for EC-CUBE 4 series) and ver1.0.0 to 1… |
CVE-2022-21142 | Critical | 9.8 | 2022-02-24 | Authentication bypass vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.74, Ver.2.9.x series versions prior to Ver.2.9.39, Ver.2.10.x seri… |
CVE-2022-0695 | Medium | 5.5 | 2022-02-24 | Denial of Service in GitHub repository radareorg/radare2 prior to 5.6.4. |
CVE-2022-25331 | High | 7.5 | 2022-02-24 | Uncaught exceptions that can be generated in Trend Micro ServerProtection 6.0/5.8 Information Server could allow a remote attacker to crash the process. |
CVE-2022-25330 | Critical | 9.8 | 2022-02-24 | Integer overflow conditions that exist in Trend Micro ServerProtect 6.0/5.8 Information Server could allow a remote attacker to crash the process or achieve re… |
CVE-2022-25329 | Critical | 9.8 | 2022-02-24 | Trend Micro ServerProtect 6.0/5.8 Information Server uses a static credential to perform authentication when a specific command is typed in the console. An una… |
CVE-2022-24680 | High | 7.8 | 2022-02-24 | A security link following local privilege escalation vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service, Trend Micro Worry-Free Business… |
CVE-2022-24679 | High | 7.8 | 2022-02-24 | A security link following local privilege escalation vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service, Trend Micro Worry-Free Business… |
CVE-2022-24678 | High | 7.5 | 2022-02-24 | An security agent resource exhaustion denial-of-service vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service, Trend Micro Worry-Free Busine… |
CVE-2022-24671 | High | 7.8 | 2022-02-24 | A link following privilege escalation vulnerability in Trend Micro Antivirus for Max 11.0.2150 and below could allow a local attacker to modify a file during t… |
CVE-2022-23655 | Medium | 4.8 | 2022-02-24 | Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. Affected versions of OctoberCMS did not validate gateway server signatures. As a r… |
CVE-2022-23653 | Medium | 4.7 | 2022-02-23 | B2 Command Line Tool is the official command line tool for the backblaze cloud storage service. Linux and Mac releases of the B2 command-line tool version 3.2… |
CVE-2022-23651 | Medium | 4.7 | 2022-02-23 | b2-sdk-python is a python library to access cloud storage provided by backblaze. Linux and Mac releases of the SDK version 1.14.0 and below contain a key discl… |
CVE-2022-24409 | Medium | 5.9 | 2022-02-23 | Dell BSAFE SSL-J contains remediation for a covert timing channel vulnerability that may be exploited by malicious users to compromise the affected system. Onl… |
CVE-2022-22336 | High | 7.5 | 2022-02-23 | IBM Sterling External Authentication Server and IBM Sterling Secure Proxy 6.0.3.0, 6.0.2.0, and 3.4.3.2 could allow a remote user to consume resources causing… |
CVE-2022-22333 | Medium | 6.5 | 2022-02-23 | IBM Sterling Secure Proxy 6.0.3.0, 6.0.2.0, and 3.4.3.2 and IBM Sterling External Authentication Server are vulnerable a buffer overflow, due to the Jetty base… |
CVE-2022-21705 | High | 7.2 | 2022-02-23 | Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. In affected versions user input was not properly sanitized before rendering. An au… |
CVE-2022-0731 | Medium | 6.5 | 2022-02-23 | Improper Access Control (IDOR) in GitHub repository dolibarr/dolibarr prior to 16.0. |
CVE-2022-20650 | High | 8.8 | 2022-02-23 | A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges… |
CVE-2022-20625 | Medium | 4.3 | 2022-02-23 | A vulnerability in the Cisco Discovery Protocol service of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to ca… |
CVE-2022-20624 | High | 8.6 | 2022-02-23 | A vulnerability in the Cisco Fabric Services over IP (CFSoIP) feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial… |
CVE-2022-20623 | High | 8.6 | 2022-02-23 | A vulnerability in the rate limiter for Bidirectional Forwarding Detection (BFD) traffic of Cisco NX-OS Software for Cisco Nexus 9000 Series Switches could all… |
CVE-2022-0476 | Medium | 5.5 | 2022-02-23 | Denial of Service in GitHub repository radareorg/radare2 prior to 5.6.4. |
CVE-2022-0729 | High | 8.8 | 2022-02-23 | Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. |
CVE-2022-0727 | Medium | 5.4 | 2022-02-23 | Improper Access Control in GitHub repository chocobozzz/peertube prior to 4.1.0. |
CVE-2022-0726 | Medium | 5.4 | 2022-02-23 | Missing Authorization in GitHub repository chocobozzz/peertube prior to 4.1.0. |
CVE-2022-0724 | Medium | 6.5 | 2022-02-23 | Insecure Storage of Sensitive Information in GitHub repository microweber/microweber prior to 1.3. |
CVE-2022-0721 | Medium | 6.5 | 2022-02-23 | Insertion of Sensitive Information Into Debugging Code in GitHub repository microweber/microweber prior to 1.3. |
CVE-2022-0719 | Medium | 5.4 | 2022-02-23 | Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.3. |
CVE-2022-0736 | High | 7.5 | 2022-02-23 | Insecure Temporary File in GitHub repository mlflow/mlflow prior to 1.23.1. |
CVE-2022-0717 | Critical | 9.1 | 2022-02-23 | Out-of-bounds Read in GitHub repository mruby/mruby prior to 3.2. |
CVE-2022-0654 | High | 7.5 | 2022-02-23 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository fgribreau/node-request-retry prior to 7.0.0. |
CVE-2022-23612 | High | 7.5 | 2022-02-22 | OpenMRS is a patient-based medical record system focusing on giving providers a free customizable electronic medical record system. Affected versions are subje… |
CVE-2022-23606 | Medium | 4.4 | 2022-02-22 | Envoy is an open source edge and service proxy, designed for cloud-native applications. When a cluster is deleted via Cluster Discovery Service (CDS) all idle… |
CVE-2022-21657 | Medium | 6.8 | 2022-02-22 | Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions Envoy does not restrict the set of certificates it… |
CVE-2022-21656 | High | 7.4 | 2022-02-22 | Envoy is an open source edge and service proxy, designed for cloud-native applications. The default_validator.cc implementation used to implement the default c… |
CVE-2022-21655 | High | 7.5 | 2022-02-22 | Envoy is an open source edge and service proxy, designed for cloud-native applications. The envoy common router will segfault if an internal redirect selects a… |
CVE-2022-21654 | High | 7.4 | 2022-02-22 | Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have chang… |
CVE-2022-23635 | High | 7.5 | 2022-02-22 | Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, `istiod`, is vulnerable to a request proc… |
CVE-2022-23654 | High | 8.1 | 2022-02-22 | Wiki.js is a wiki app built on Node.js. In affected versions an authenticated user with write access on a restricted set of paths can update a page outside the… |
CVE-2022-23652 | High | 8.8 | 2022-02-22 | capsule-proxy is a reverse proxy for Capsule Operator which provides multi-tenancy in Kubernetes. In versions prior to 0.2.1 an attacker with a proper authenti… |
CVE-2022-23608 | High | 8.1 | 2022-02-22 | PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN… |
CVE-2022-0714 | Medium | 5.5 | 2022-02-22 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4436. |
CVE-2022-0713 | High | 7.1 | 2022-02-22 | Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.4. |
CVE-2022-0712 | Medium | 5.5 | 2022-02-22 | NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.4. |
CVE-2022-0665 | Medium | 6.5 | 2022-02-22 | Path Traversal in GitHub repository pimcore/pimcore prior to 10.3.2. |
CVE-2022-0676 | High | 7.8 | 2022-02-22 | Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.4. |
CVE-2022-24564 | Medium | 6.1 | 2022-02-21 | Checkmk <=2.0.0p19 contains a Cross Site Scripting (XSS) vulnerability. While creating or editing a user attribute, the Help Text is subject to HTML injection… |
CVE-2022-0696 | Medium | 5.5 | 2022-02-21 | NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4428. |
CVE-2022-0563 | Medium | 5.5 | 2022-02-21 | A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to… |
CVE-2022-25599 | Medium | 5.4 | 2022-02-21 | Cross-Site Request Forgery (CSRF) vulnerability leading to event deletion was discovered in Spiffy Calendar WordPress plugin (versions <= 4.9.0). |
CVE-2022-24295 | High | 8.8 | 2022-02-21 | Okta Advanced Server Access Client for Windows prior to version 1.57.0 was found to be vulnerable to command injection via a specially crafted URL. |
CVE-2022-23984 | Low | 3.7 | 2022-02-21 | Sensitive information disclosure discovered in wpDiscuz WordPress plugin (versions <= 7.3.11). |
CVE-2022-23983 | Medium | 4.3 | 2022-02-21 | Cross-Site Request Forgery (CSRF) vulnerability leading to plugin Settings Update discovered in WP Content Copy Protection & No Right Click WordPress plugin (v… |
CVE-2022-22308 | High | 7.8 | 2022-02-21 | IBM Planning Analytics 2.0 is vulnerable to a Remote File Include (RFI) attack. User input could be passed into file include commands and the web application c… |
CVE-2022-0708 | Medium | 4.3 | 2022-02-21 | Mattermost 6.3.0 and earlier fails to protect email addresses of the creator of the team via one of the APIs, which allows authenticated team members to access… |
CVE-2022-0564 | Medium | 5.3 | 2022-02-21 | A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts. An attacker could exploit this vulnerabil… |
CVE-2022-0692 | Medium | 6.1 | 2022-02-21 | Open Redirect on Rudloff/alltube in Packagist rudloff/alltube prior to 3.0.1. |
CVE-2022-24553 | Critical | 9.8 | 2022-02-21 | An issue was found in Zfaka <= 1.4.5. The verification of the background file upload function check is not strict, resulting in remote command execution. |
CVE-2022-0313 | Medium | 4.3 | 2022-02-21 | The Float menu WordPress plugin before 4.3.1 does not have CSRF check in place when deleting menu, which could allow attackers to make a logged in admin delete… |
CVE-2022-0288 | Medium | 6.1 | 2022-02-21 | The Ad Inserter WordPress plugin before 2.7.10, Ad Inserter Pro WordPress plugin before 2.7.10 do not sanitise and escape the html_element_selection parameter… |
CVE-2022-0279 | Low | 3.1 | 2022-02-21 | The AnyComment WordPress plugin before 0.2.18 is affected by a race condition when liking/disliking a comment/reply, which could allow any authenticated user t… |
CVE-2022-0255 | High | 7.2 | 2022-02-21 | The Database Backup for WordPress plugin before 2.5.1 does not properly sanitise and escape the fragment parameter before using it in a SQL statement in the ad… |
CVE-2022-0252 | Medium | 6.1 | 2022-02-21 | The GiveWP WordPress plugin before 2.17.3 does not escape the json parameter before outputting it back in an attribute in the Import admin dashboard, leading t… |
CVE-2022-0234 | Medium | 6.1 | 2022-02-21 | The WOOCS WordPress plugin before 1.3.7.5 does not sanitise and escape the woocs_in_order_currency parameter of the woocs_get_products_price_html AJAX action (… |
CVE-2022-0228 | High | 7.2 | 2022-02-21 | The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in a SQL statement in… |
CVE-2022-0211 | Medium | 4.8 | 2022-02-21 | The Shield Security WordPress plugin before 13.0.6 does not sanitise and escape admin notes, which could allow high privilege users to perform Cross-Site Scrip… |
CVE-2022-0199 | Medium | 4.3 | 2022-02-21 | The Coming soon and Maintenance mode WordPress plugin before 3.6.8 does not have CSRF check in its coming_soon_send_mail AJAX action, allowing attackers to mak… |
CVE-2022-0186 | Medium | 5.4 | 2022-02-21 | The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.5.3 does not sanitise and escape the Description field when editing a gallery, allowing user… |
CVE-2022-0164 | Medium | 4.3 | 2022-02-21 | The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not have authorisation and CSRF checks in its coming_soon_send_mail AJAX action, allowi… |
CVE-2022-0134 | High | 8.8 | 2022-02-21 | The AnyComment WordPress plugin before 0.2.18 does not have CSRF checks in the Import and Revert HyperComments features, allowing attackers to make logged in a… |
CVE-2022-0691 | Critical | 9.8 | 2022-02-21 | Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9. |
CVE-2022-25297 | High | 7.5 | 2022-02-21 | This affects the package drogonframework/drogon before 1.7.5. The unsafe handling of file names during upload using HttpFile::save() method may enable attacker… |
CVE-2022-25375 | Medium | 5.5 | 2022-02-20 | An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The RNDIS USB gadget lacks validation of the size of the RND… |
CVE-2022-25372 | High | 7.8 | 2022-02-20 | Pritunl Client through 1.2.3019.52 on Windows allows local privilege escalation, related to an ACL entry for CREATOR OWNER in platform_windows.go. |
CVE-2022-23848 | Critical | 9.8 | 2022-02-20 | In Alluxio before 2.7.3, the logserver does not validate the input stream. NOTE: this is not the same as the CVE-2021-44228 Log4j vulnerability. |
CVE-2022-23054 | Medium | 6.1 | 2022-02-20 | Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Summary Widget” element, that allows the injection of malicious JavaScript into the… |
CVE-2022-23053 | Medium | 6.1 | 2022-02-20 | Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Condition Widget” element, that allows the injection of malicious JavaScript into th… |
CVE-2022-22126 | Medium | 6.1 | 2022-02-20 | Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Web Page” element, that allows the injection of malicious JavaScript into the ‘URL’… |
CVE-2022-0688 | Medium | 4.9 | 2022-02-20 | Business Logic Errors in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-0686 | Critical | 9.1 | 2022-02-20 | Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8. |
CVE-2022-0685 | High | 7.8 | 2022-02-20 | Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4418. |
CVE-2022-0690 | Medium | 6.1 | 2022-02-19 | Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-23376 | Medium | 6.1 | 2022-02-19 | WikiDocs version 0.1.18 has multiple reflected XSS vulnerabilities on different pages. |
CVE-2022-23375 | High | 8.8 | 2022-02-19 | WikiDocs version 0.1.18 has an authenticated remote code execution vulnerability. An attacker can upload a malicious file using the image upload form through i… |
CVE-2022-0689 | Medium | 5.3 | 2022-02-19 | Use multiple time the one-time coupon in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-0632 | Medium | 5.5 | 2022-02-19 | NULL Pointer Dereference in Homebrew mruby prior to 3.2. |
CVE-2022-0630 | High | 7.1 | 2022-02-19 | Out-of-bounds Read in Homebrew mruby prior to 3.2. |
CVE-2022-0678 | Medium | 6.1 | 2022-02-19 | Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-0409 | High | 7.8 | 2022-02-19 | Unrestricted Upload of File with Dangerous Type in Packagist showdoc/showdoc prior to 2.10.2. |
CVE-2022-24980 | High | 7.5 | 2022-02-19 | An issue was discovered in the Kitodo.Presentation (aka dif) extension before 2.3.2, 3.x before 3.2.3, and 3.3.x before 3.3.4 for TYPO3. A missing access check… |
CVE-2022-24979 | Medium | 5.3 | 2022-02-19 | An issue was discovered in the Varnishcache extension before 2.0.1 for TYPO3. The Edge Site Includes (ESI) content element renderer component does not include… |