2022 CVEs (page 250)
Page 250 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-25366 | High | 7.8 | 2022-02-19 | Cryptomator through 1.6.5 allows DYLIB injection because, although it has the flag 0x1000 for Hardened Runtime, it has the com.apple.security.cs.disable-librar… |
CVE-2022-25365 | High | 7.8 | 2022-02-19 | Docker Desktop before 4.5.1 on Windows allows attackers to move arbitrary files. NOTE: this issue exists because of an incomplete fix for CVE-2022-23774. |
CVE-2022-25256 | Medium | 6.1 | 2022-02-19 | SAS Web Report Studio 4.4 allows XSS. /SASWebReportStudio/logonAndRender.do has two parameters: saspfs_request_backlabel_list and saspfs_request_backurl_list… |
CVE-2022-25137 | Critical | 9.8 | 2022-02-19 | A command injection vulnerability in the function recvSlaveUpgstatus of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firm… |
CVE-2022-25136 | Critical | 9.8 | 2022-02-19 | A command injection vulnerability in the function meshSlaveUpdate of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmwar… |
CVE-2022-25135 | Critical | 9.8 | 2022-02-19 | A command injection vulnerability in the function recv_mesh_info_sync of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attacker… |
CVE-2022-25134 | Critical | 9.8 | 2022-02-19 | A command injection vulnerability in the function setUpgradeFW of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to ex… |
CVE-2022-25133 | Critical | 9.8 | 2022-02-19 | A command injection vulnerability in the function isAssocPriDevice of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers t… |
CVE-2022-25132 | Critical | 9.8 | 2022-02-19 | A command injection vulnerability in the function meshSlaveDlfw of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to e… |
CVE-2022-25131 | Critical | 9.8 | 2022-02-19 | A command injection vulnerability in the function recvSlaveCloudCheckStatus of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10… |
CVE-2022-25130 | Critical | 9.8 | 2022-02-19 | A command injection vulnerability in the function updateWifiInfo of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware… |
CVE-2022-23642 | High | 8.8 | 2022-02-18 | Sourcegraph is a code search and navigation engine. Sourcegraph prior to version 3.37 is vulnerable to remote code execution in the `gitserver` service. The se… |
CVE-2022-25358 | Medium | 5.3 | 2022-02-18 | A ..%2F path traversal vulnerability exists in the path handler of awful-salmonella-tar before 0.0.4. Attackers can only list directories (not read files). Thi… |
CVE-2022-23650 | High | 7.2 | 2022-02-18 | Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there is a hard-coded cry… |
CVE-2022-23649 | Low | 3.3 | 2022-02-18 | Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project. Prior to version 1.5.2, Cosign can be manipulated to… |
CVE-2022-23228 | High | 7.5 | 2022-02-18 | Pexip Infinity before 27.0 has improper WebRTC input validation. An unauthenticated remote attacker can use excessive resources, temporarily causing denial of… |
CVE-2022-23645 | Medium | 6.2 | 2022-02-18 | swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-… |
CVE-2022-24971 | High | 8.8 | 2022-02-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required t… |
CVE-2022-24370 | Medium | 6.5 | 2022-02-18 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader Foxit reader 11.0.1.0719 macOS. User… |
CVE-2022-24369 | High | 8.8 | 2022-02-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required t… |
CVE-2022-24368 | Medium | 6.5 | 2022-02-18 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is re… |
CVE-2022-24367 | High | 8.8 | 2022-02-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required t… |
CVE-2022-24366 | High | 8.8 | 2022-02-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required t… |
CVE-2022-24365 | High | 8.8 | 2022-02-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required t… |
CVE-2022-24364 | High | 8.8 | 2022-02-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required t… |
CVE-2022-24363 | High | 8.8 | 2022-02-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required t… |
CVE-2022-24362 | High | 8.8 | 2022-02-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required t… |
CVE-2022-24361 | High | 8.8 | 2022-02-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required t… |
CVE-2022-24360 | High | 8.8 | 2022-02-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required t… |
CVE-2022-24359 | High | 8.8 | 2022-02-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required t… |
CVE-2022-24358 | High | 8.8 | 2022-02-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required t… |
CVE-2022-24357 | High | 8.8 | 2022-02-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required t… |
CVE-2022-24356 | High | 8.8 | 2022-02-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader Foxit reader 11.0.1.0719 macOS. User interac… |
CVE-2022-24355 | High | 8.8 | 2022-02-18 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR940N 3.20.1 Build 200316 Rel.34392n (5… |
CVE-2022-24354 | High | 8.8 | 2022-02-18 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link AC1750 prior to 1.1.4 Build 20211022 rel.59… |
CVE-2022-24064 | High | 7.8 | 2022-02-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 11.8.8.0. User interaction is required… |
CVE-2022-24063 | High | 7.8 | 2022-02-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 13.2.0.21165. User interaction is requ… |
CVE-2022-24062 | High | 7.8 | 2022-02-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 13.2.0.21165. User interaction is requ… |
CVE-2022-24061 | Medium | 5.5 | 2022-02-18 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Sante DICOM Viewer Pro 11.8.7.0. User interaction is… |
CVE-2022-24060 | Medium | 5.5 | 2022-02-18 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Sante DICOM Viewer Pro 11.8.7.0. User interaction is… |
CVE-2022-24059 | High | 7.8 | 2022-02-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 11.8.7.0. User interaction is required… |
CVE-2022-24058 | High | 7.8 | 2022-02-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 11.8.7.0. User interaction is required… |
CVE-2022-24057 | High | 7.8 | 2022-02-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 11.8.7.0. User interaction is required… |
CVE-2022-24056 | High | 7.8 | 2022-02-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 11.8.7.0. User interaction is required… |
CVE-2022-24055 | Medium | 5.5 | 2022-02-18 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Sante DICOM Viewer Pro 11.8.7.0. User interaction is… |
CVE-2022-24052 | High | 7.8 | 2022-02-18 | MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges… |
CVE-2022-24051 | High | 7.8 | 2022-02-18 | MariaDB CONNECT Storage Engine Format String Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected i… |
CVE-2022-24050 | High | 7.8 | 2022-02-18 | MariaDB CONNECT Storage Engine Use-After-Free Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected… |
CVE-2022-24049 | Critical | 9.8 | 2022-02-18 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sonos One Speaker prior to 3.4.1 (S2 systems) and 11.2.13 bui… |
CVE-2022-24048 | High | 7.8 | 2022-02-18 | MariaDB CONNECT Storage Engine Stack-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges… |
CVE-2022-24047 | Critical | 9.8 | 2022-02-18 | This vulnerability allows remote attackers to bypass authentication on affected installations of BMC Track-It! 20.21.01.102. Authentication is not required to… |
CVE-2022-24046 | High | 8.8 | 2022-02-18 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sonos One Speaker prior to 3.4.1 (S2 systems) and 1… |
CVE-2022-0543 | Critical | 10.0 | 2022-02-18 | It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could resul… |
CVE-2022-25337 | Critical | 9.8 | 2022-02-18 | Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows injection attacks via image filenames. |
CVE-2022-25336 | Medium | 5.3 | 2022-02-18 | Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows Insecure Direct Object Reference (IDOR) attacks against image files bec… |
CVE-2022-25335 | High | 7.5 | 2022-02-18 | RigoBlock Dragos through 2022-02-17 lacks the onlyOwner modifier for setMultipleAllowances. This enables token manipulation, as exploited in the wild in Februa… |
CVE-2022-23982 | Medium | 4.3 | 2022-02-18 | The vulnerability discovered in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4) allows server information exposure. |
CVE-2022-23981 | Medium | 4.3 | 2022-02-18 | The vulnerability allows Subscriber+ level users to create brands in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4). |
CVE-2022-21800 | Medium | 6.5 | 2022-02-18 | MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 uses the MD5 a… |
CVE-2022-21215 | Critical | 10.0 | 2022-02-18 | This vulnerability could allow an attacker to force the server to create and execute a web request granting access to backend APIs that are only accessible to… |
CVE-2022-21196 | Critical | 10.0 | 2022-02-18 | MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not perfo… |
CVE-2022-21176 | High | 8.6 | 2022-02-18 | MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not prope… |
CVE-2022-21143 | High | 7.5 | 2022-02-18 | MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not prope… |
CVE-2022-21141 | Critical | 10.0 | 2022-02-18 | MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not perfo… |
CVE-2022-0673 | Medium | 6.5 | 2022-02-18 | A flaw was found in LemMinX in versions prior to 0.19.0. Cache poisoning of external schema files due to directory traversal. |
CVE-2022-0672 | Medium | 5.5 | 2022-02-18 | A flaw was found in LemMinX in versions prior to 0.19.0. Insecure redirect could allow unauthorized access to sensitive information locally if LemMinX is run u… |
CVE-2022-0671 | Critical | 9.1 | 2022-02-18 | A flaw was found in vscode-xml in versions prior to 0.19.0. Schema download could lead to blind SSRF or DoS via a large file. |
CVE-2022-0646 | High | 7.8 | 2022-02-18 | A flaw use after free in the Linux kernel Management Component Transport Protocol (MCTP) subsystem was found in the way user triggers cancel_work_sync after th… |
CVE-2022-0585 | Medium | 4.3 | 2022-02-18 | Large loops in multiple protocol dissectors in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allow denial of service via packet injection or crafted capture file |
CVE-2022-0138 | High | 7.5 | 2022-02-18 | MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 has a deserial… |
CVE-2022-25323 | Medium | 6.1 | 2022-02-18 | ZEROF Web Server 2.0 allows /admin.back XSS. |
CVE-2022-25322 | Critical | 9.8 | 2022-02-18 | ZEROF Web Server 2.0 allows /HandleEvent SQL Injection. |
CVE-2022-23647 | High | 7.5 | 2022-02-18 | Prism is a syntax highlighting library. Starting with version 1.14.0 and prior to version 1.27.0, Prism's command line plugin can be used by attackers to achie… |
CVE-2022-0666 | High | 7.5 | 2022-02-18 | CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-0664 | Critical | 9.8 | 2022-02-18 | Use of Hard-coded Cryptographic Key in Go github.com/gravitl/netmaker prior to 0.8.5,0.9.4,0.10.0,0.10.1. |
CVE-2022-0631 | Critical | 9.8 | 2022-02-18 | Heap-based Buffer Overflow in Homebrew mruby prior to 3.2. |
CVE-2022-0451 | Medium | 6.5 | 2022-02-18 | Dart SDK contains the HTTPClient in dart:io library whcih includes authorization headers when handling cross origin redirects. These headers may be explicitly… |
CVE-2022-25299 | Critical | 9.8 | 2022-02-18 | This affects the package cesanta/mongoose before 7.6. The unsafe handling of file names during upload using mg_http_upload() method may enable attackers to wri… |
CVE-2022-25298 | High | 7.5 | 2022-02-18 | This affects the package sprinfall/webcc before 0.3.0. It is possible to traverse directories to fetch arbitrary files from the server. |
CVE-2022-0660 | High | 7.5 | 2022-02-18 | Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-25321 | Medium | 6.1 | 2022-02-18 | An issue was discovered in Cerebrate through 1.4. XSS could occur in the bookmarks component. |
CVE-2022-25320 | Medium | 5.3 | 2022-02-18 | An issue was discovered in Cerebrate through 1.4. Username enumeration could occur. |
CVE-2022-25319 | Medium | 5.3 | 2022-02-18 | An issue was discovered in Cerebrate through 1.4. Endpoints could be open even when not enabled. |
CVE-2022-25318 | Medium | 4.3 | 2022-02-18 | An issue was discovered in Cerebrate through 1.4. An incorrect sharing group ACL allowed an unprivileged user to edit and modify sharing groups. |
CVE-2022-25317 | Medium | 6.1 | 2022-02-18 | An issue was discovered in Cerebrate through 1.4. genericForm allows reflected XSS in form descriptions via a user-controlled description. |
CVE-2022-25315 | Critical | 9.8 | 2022-02-18 | In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. |
CVE-2022-25314 | High | 7.5 | 2022-02-18 | In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString. |
CVE-2022-25313 | Medium | 6.5 | 2022-02-18 | In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element. |
CVE-2022-22922 | Critical | 9.8 | 2022-02-18 | TP-Link TL-WA850RE Wi-Fi Range Extender before v6_200923 was discovered to use highly predictable and easily detectable session keys, allowing attackers to gai… |
CVE-2022-22916 | Critical | 9.8 | 2022-02-17 | O2OA v6.4.7 was discovered to contain a remote code execution (RCE) vulnerability via /x_program_center/jaxrs/invoke. |
CVE-2022-23646 | Medium | 5.9 | 2022-02-17 | Next.js is a React framework. Starting with version 10.0.0 and prior to version 12.1.0, Next.js is vulnerable to User Interface (UI) Misrepresentation of Criti… |
CVE-2022-22914 | High | 7.5 | 2022-02-17 | An incorrect access control issue in the component FileManager of Ovidentia CMS 6.0 allows authenticated attackers to to view and download content in the uploa… |
CVE-2022-22912 | Critical | 9.8 | 2022-02-17 | Prototype pollution vulnerability via .parse() in Plist before v3.0.4 allows attackers to cause a Denial of Service (DoS) and may lead to remote code execution. |
CVE-2022-0633 | Medium | 6.5 | 2022-02-17 | The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the required privileges to access a backup's… |
CVE-2022-0639 | Medium | 5.3 | 2022-02-17 | Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.7. |
CVE-2022-24683 | High | 7.5 | 2022-02-17 | HashiCorp Nomad and Nomad Enterprise 0.9.2 through 1.0.17, 1.1.11, and 1.2.5 allow operators with read-fs and alloc-exec (or job-submit) capabilities to read a… |
CVE-2022-0638 | Medium | 4.3 | 2022-02-17 | Cross-Site Request Forgery (CSRF) in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-23632 | High | 7.4 | 2022-02-17 | Traefik is an HTTP reverse proxy and load balancer. Prior to version 2.6.1, Traefik skips the router transport layer security (TLS) configuration when the host… |
CVE-2022-20750 | Medium | 5.3 | 2022-02-17 | A vulnerability in the checkpoint manager implementation of Cisco Redundancy Configuration Manager (RCM) for Cisco StarOS Software could allow an unauthenticat… |
CVE-2022-20659 | Medium | 6.1 | 2022-02-17 | A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager could allow an unauthe… |