2022 CVEs (page 251)
Page 251 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-25321 | Medium | 6.1 | 2022-02-18 | An issue was discovered in Cerebrate through 1.4. XSS could occur in the bookmarks component. |
CVE-2022-25320 | Medium | 5.3 | 2022-02-18 | An issue was discovered in Cerebrate through 1.4. Username enumeration could occur. |
CVE-2022-25319 | Medium | 5.3 | 2022-02-18 | An issue was discovered in Cerebrate through 1.4. Endpoints could be open even when not enabled. |
CVE-2022-25318 | Medium | 4.3 | 2022-02-18 | An issue was discovered in Cerebrate through 1.4. An incorrect sharing group ACL allowed an unprivileged user to edit and modify sharing groups. |
CVE-2022-25317 | Medium | 6.1 | 2022-02-18 | An issue was discovered in Cerebrate through 1.4. genericForm allows reflected XSS in form descriptions via a user-controlled description. |
CVE-2022-25315 | Critical | 9.8 | 2022-02-18 | In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. |
CVE-2022-25314 | High | 7.5 | 2022-02-18 | In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString. |
CVE-2022-25313 | Medium | 6.5 | 2022-02-18 | In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element. |
CVE-2022-22922 | Critical | 9.8 | 2022-02-18 | TP-Link TL-WA850RE Wi-Fi Range Extender before v6_200923 was discovered to use highly predictable and easily detectable session keys, allowing attackers to gai… |
CVE-2022-22916 | Critical | 9.8 | 2022-02-17 | O2OA v6.4.7 was discovered to contain a remote code execution (RCE) vulnerability via /x_program_center/jaxrs/invoke. |
CVE-2022-23646 | Medium | 5.9 | 2022-02-17 | Next.js is a React framework. Starting with version 10.0.0 and prior to version 12.1.0, Next.js is vulnerable to User Interface (UI) Misrepresentation of Criti… |
CVE-2022-22914 | High | 7.5 | 2022-02-17 | An incorrect access control issue in the component FileManager of Ovidentia CMS 6.0 allows authenticated attackers to to view and download content in the uploa… |
CVE-2022-22912 | Critical | 9.8 | 2022-02-17 | Prototype pollution vulnerability via .parse() in Plist before v3.0.4 allows attackers to cause a Denial of Service (DoS) and may lead to remote code execution. |
CVE-2022-0633 | Medium | 6.5 | 2022-02-17 | The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the required privileges to access a backup's… |
CVE-2022-0639 | Medium | 5.3 | 2022-02-17 | Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.7. |
CVE-2022-24683 | High | 7.5 | 2022-02-17 | HashiCorp Nomad and Nomad Enterprise 0.9.2 through 1.0.17, 1.1.11, and 1.2.5 allow operators with read-fs and alloc-exec (or job-submit) capabilities to read a… |
CVE-2022-0638 | Medium | 4.3 | 2022-02-17 | Cross-Site Request Forgery (CSRF) in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-23632 | High | 7.4 | 2022-02-17 | Traefik is an HTTP reverse proxy and load balancer. Prior to version 2.6.1, Traefik skips the router transport layer security (TLS) configuration when the host… |
CVE-2022-20750 | Medium | 5.3 | 2022-02-17 | A vulnerability in the checkpoint manager implementation of Cisco Redundancy Configuration Manager (RCM) for Cisco StarOS Software could allow an unauthenticat… |
CVE-2022-20659 | Medium | 6.1 | 2022-02-17 | A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager could allow an unauthe… |
CVE-2022-20653 | High | 7.5 | 2022-02-17 | A vulnerability in the DNS-based Authentication of Named Entities (DANE) email verification component of Cisco AsyncOS Software for Cisco Email Security Applia… |
CVE-2022-23319 | Medium | 5.5 | 2022-02-17 | A segmentation fault during PCF file parsing in pcf2bdf versions >=1.05 allows an attacker to trigger a program crash via a specially crafted PCF font file. Th… |
CVE-2022-23318 | High | 7.1 | 2022-02-17 | A heap-buffer-overflow in pcf2bdf, versions >= 1.05 allows an attacker to trigger unsafe memory access via a specially crafted PCF font file. This out-of-bound… |
CVE-2022-22899 | Medium | 5.5 | 2022-02-17 | Core FTP / SFTP Server v2 Build 725 was discovered to allow unauthenticated attackers to cause a Denial of Service (DoS) via a crafted packet through the SSH s… |
CVE-2022-0629 | High | 7.8 | 2022-02-17 | Stack-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. |
CVE-2022-0623 | Critical | 9.1 | 2022-02-17 | Out-of-bounds Read in Homebrew mruby prior to 3.2. |
CVE-2022-24953 | Medium | 5.3 | 2022-02-17 | The Crypt_GPG extension before 1.6.7 for PHP does not prevent additional options in GPG calls, which presents a risk for certain environments and GPG versions. |
CVE-2022-22901 | Medium | 5.5 | 2022-02-17 | There is an Assertion in 'context_p->next_scanner_info_p->type == SCANNER_TYPE_FUNCTION' failed at parser_parse_function_arguments in /js/js-parser.c of JerryS… |
CVE-2022-0622 | Medium | 5.3 | 2022-02-17 | Generation of Error Message Containing Sensitive Information in Packagist snipe/snipe-it prior to 5.3.11. |
CVE-2022-25270 | Medium | 6.5 | 2022-02-17 | The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the "access in-place editing" permission vie… |
CVE-2022-25271 | High | 7.5 | 2022-02-16 | Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow… |
CVE-2022-24985 | High | 8.8 | 2022-02-16 | Forms generated by JQueryForm.com before 2022-02-05 allows a remote authenticated attacker to bypass authentication and access the administrative section of ot… |
CVE-2022-24984 | Critical | 9.8 | 2022-02-16 | Forms generated by JQueryForm.com before 2022-02-05 (if file-upload capability is enabled) allow remote unauthenticated attackers to upload executable files an… |
CVE-2022-24983 | High | 7.5 | 2022-02-16 | Forms generated by JQueryForm.com before 2022-02-05 allow remote attackers to obtain the URI to any uploaded file by capturing the POST response. When chained… |
CVE-2022-24982 | Medium | 6.5 | 2022-02-16 | Forms generated by JQueryForm.com before 2022-02-05 allows a remote authenticated attacker to access the cleartext credentials of all other form users. admin.p… |
CVE-2022-24981 | Medium | 6.1 | 2022-02-16 | A reflected cross-site scripting (XSS) vulnerability in forms generated by JQueryForm.com before 2022-02-05 allows remote attackers to inject arbitrary web scr… |
CVE-2022-23636 | Medium | 5.1 | 2022-02-16 | Wasmtime is an open source runtime for WebAssembly & WASI. Prior to versions 0.34.1 and 0.33.1, there exists a bug in the pooling instance allocator in Wasmtim… |
CVE-2022-22885 | Critical | 9.8 | 2022-02-16 | Hutool v5.7.18's HttpRequest was discovered to ignore all TLS/SSL certificate validation. |
CVE-2022-22881 | Critical | 9.8 | 2022-02-16 | Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /sys/user/queryUserComponentData. |
CVE-2022-22880 | Critical | 9.8 | 2022-02-16 | Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /jeecg-boot/sys/user/queryUserByDepId. |
CVE-2022-25265 | High | 7.8 | 2022-02-16 | In the Linux kernel through 5.16.10, certain binary files may have the exec-all attribute if they were built in approximately 2003 (e.g., with GCC 3.2.2 and Li… |
CVE-2022-25258 | Medium | 4.6 | 2022-02-16 | An issue was discovered in drivers/usb/gadget/composite.c in the Linux kernel before 5.16.10. The USB Gadget subsystem lacks certain validation of interface OS… |
CVE-2022-25255 | High | 7.8 | 2022-02-16 | In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working directory when not fo… |
CVE-2022-23644 | High | 8.8 | 2022-02-16 | BookWyrm is a decentralized social network for tracking reading habits and reviewing books. The functionality to load a cover via url is vulnerable to a server… |
CVE-2022-22853 | Medium | 5.4 | 2022-02-16 | A stored cross-site scripting (XSS) vulnerability in Hospital Patient Record Management System v1.0 allows attackers to execute arbitrary web scripts or HTML v… |
CVE-2022-24665 | Critical | 9.9 | 2022-02-16 | PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via a WordPress gutenberg block by any user able to edit posts. |
CVE-2022-24664 | Critical | 9.9 | 2022-02-16 | PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress metaboxes, which could be used by any user able to edi… |
CVE-2022-24663 | Critical | 9.9 | 2022-02-16 | PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress shortcodes, which can be used by any authenticated use… |
CVE-2022-24086 | Critical | 9.8 | 2022-02-16 | Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout proces… |
CVE-2022-23804 | High | 7.8 | 2022-02-16 | A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon ReadIJCoord coordinate parsing functionality of KiCad EDA 6.0.1 and… |
CVE-2022-23803 | High | 7.8 | 2022-02-16 | A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon ReadXYCoord coordinate parsing functionality of KiCad EDA 6.0.1 and… |
CVE-2022-23204 | Medium | 5.5 | 2022-02-16 | Adobe Premiere Rush versions 2.0 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker… |
CVE-2022-23203 | High | 7.8 | 2022-02-16 | Adobe Photoshop versions 22.5.4 (and earlier) and 23.1 (and earlier) are affected by a buffer overflow vulnerability due to insecure handling of a crafted file… |
CVE-2022-23202 | High | 7.0 | 2022-02-16 | Adobe Creative Cloud Desktop version 2.7.0.13 (and earlier) is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary cod… |
CVE-2022-23200 | High | 7.8 | 2022-02-16 | Adobe After Effects versions 22.1.1 (and earlier) and 18.4.3 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary… |
CVE-2022-23199 | Medium | 5.5 | 2022-02-16 | Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker… |
CVE-2022-23198 | Medium | 5.5 | 2022-02-16 | Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker… |
CVE-2022-23197 | Medium | 5.5 | 2022-02-16 | Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of s… |
CVE-2022-23196 | Medium | 5.5 | 2022-02-16 | Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of s… |
CVE-2022-23195 | Medium | 5.5 | 2022-02-16 | Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of s… |
CVE-2022-23194 | Medium | 5.5 | 2022-02-16 | Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of s… |
CVE-2022-23193 | Medium | 5.5 | 2022-02-16 | Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of s… |
CVE-2022-23192 | Medium | 5.5 | 2022-02-16 | Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of s… |
CVE-2022-23191 | Medium | 5.5 | 2022-02-16 | Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of s… |
CVE-2022-23190 | Medium | 5.5 | 2022-02-16 | Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of s… |
CVE-2022-23189 | Medium | 5.5 | 2022-02-16 | Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker… |
CVE-2022-23188 | High | 7.8 | 2022-02-16 | Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by a buffer overflow vulnerability due to insecure handling of a crafted… |
CVE-2022-23186 | High | 7.8 | 2022-02-16 | Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary co… |
CVE-2022-22945 | High | 7.8 | 2022-02-16 | VMware NSX Edge contains a CLI shell injection vulnerability. A malicious actor with SSH access to an NSX-Edge appliance can execute arbitrary commands on the… |
CVE-2022-22792 | Medium | 6.6 | 2022-02-16 | MobiSoft - MobiPlus User Take Over and Improper Handling of url Parameters Attacker can navigate to specific url which will expose all the users and password i… |
CVE-2022-0617 | Medium | 5.5 | 2022-02-16 | A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way user triggers udf_file_write_iter function for the malic… |
CVE-2022-0513 | Critical | 9.8 | 2022-02-16 | The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the exclusion_reason parameter found in… |
CVE-2022-23358 | Critical | 9.8 | 2022-02-16 | EasyCMS v1.6 allows for SQL injection via ArticlemAction.class.php. In the background, search terms provided by the user were not sanitized and were used direc… |
CVE-2022-0559 | Critical | 9.8 | 2022-02-16 | Use After Free in GitHub repository radareorg/radare2 prior to 5.6.2. |
CVE-2022-0614 | Medium | 5.5 | 2022-02-16 | Use of Out-of-range Pointer Offset in Homebrew mruby prior to 3.2. |
CVE-2022-0613 | Medium | 6.5 | 2022-02-16 | Authorization Bypass Through User-Controlled Key in NPM urijs prior to 1.19.8. |
CVE-2022-0612 | Medium | 5.4 | 2022-02-16 | Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v. |
CVE-2022-25242 | High | 8.8 | 2022-02-16 | In FileCloud before 21.3, file upload is not protected against Cross-Site Request Forgery (CSRF). |
CVE-2022-25241 | High | 8.8 | 2022-02-16 | In FileCloud before 21.3, the CSV user import functionality is vulnerable to Cross-Site Request Forgery (CSRF). |
CVE-2022-25236 | Critical | 9.8 | 2022-02-16 | xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs. |
CVE-2022-25235 | Critical | 9.8 | 2022-02-16 | xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain con… |
CVE-2022-0611 | Medium | 6.3 | 2022-02-16 | Missing Authorization in Packagist snipe/snipe-it prior to 5.3.11. |
CVE-2022-23643 | Medium | 6.5 | 2022-02-15 | Sourcegraph is a code search and navigation engine. Sourcegraph versions 3.35 and 3.36 reintroduced a previously fixed side-channel vulnerabilitity in the Code… |
CVE-2022-23641 | Medium | 6.5 | 2022-02-15 | Discourse is an open source discussion platform. In versions prior to 2.8.1 in the `stable` branch, 2.9.0.beta2 in the `beta` branch, and 2.9.0.beta2 in the `t… |
CVE-2022-24589 | Medium | 6.1 | 2022-02-15 | Burden v3.0 was discovered to contain a stored cross-site scripting (XSS) in the Add Category function. This vulnerability allows attackers to execute arbitrar… |
CVE-2022-23639 | High | 8.1 | 2022-02-15 | crossbeam-utils provides atomics, synchronization primitives, scoped threads, and other utilities for concurrent programming in Rust. crossbeam-utils prior to… |
CVE-2022-22770 | Critical | 9.8 | 2022-02-15 | The Web Server component of TIBCO Software Inc.'s TIBCO AuditSafe contains an easily exploitable vulnerability that allows an unauthenticated attacker with net… |
CVE-2022-25212 | High | 8.8 | 2022-02-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins SWAMP Plugin 1.2.6 and earlier allows attackers to connect to an attacker-specified web server usi… |
CVE-2022-25211 | High | 8.8 | 2022-02-15 | A missing permission check in Jenkins SWAMP Plugin 1.2.6 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified web serv… |
CVE-2022-25210 | Medium | 6.5 | 2022-02-15 | Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier uses static fields to store job configuration information, allowing attackers with Item/Configure per… |
CVE-2022-25209 | High | 8.8 | 2022-02-15 | Jenkins Chef Sinatra Plugin 1.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-25208 | High | 8.8 | 2022-02-15 | A missing permission check in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers with Overall/Read permission to have Jenkins send an HTTP request t… |
CVE-2022-25207 | High | 8.8 | 2022-02-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers to have Jenkins send an HTTP request to an a… |
CVE-2022-25206 | High | 8.8 | 2022-02-15 | A missing check in Jenkins dbCharts Plugin 0.5.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified database via JDB… |
CVE-2022-25205 | High | 8.8 | 2022-02-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins dbCharts Plugin 0.5.2 and earlier allows attackers to connect to an attacker-specified database vi… |
CVE-2022-25204 | Medium | 5.4 | 2022-02-15 | Jenkins Doktor Plugin 0.4.1 and earlier implements functionality that allows agent processes to render files on the controller as Markdown or Asciidoc, and err… |
CVE-2022-25203 | Medium | 5.4 | 2022-02-15 | Jenkins Team Views Plugin 0.9.0 and earlier does not escape team names, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers… |
CVE-2022-25202 | Medium | 4.8 | 2022-02-15 | Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name of custom promotion levels, resulting in a stored cross-site scripting (XSS) v… |
CVE-2022-25201 | Medium | 6.5 | 2022-02-15 | Missing permission checks in Jenkins Checkmarx Plugin 2022.1.2 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified web… |
CVE-2022-25200 | High | 8.8 | 2022-02-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins Checkmarx Plugin 2022.1.2 and earlier allows attackers to connect to an attacker-specified webserv… |