2022 CVEs (page 251)
Page 251 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-20653 | High | 7.5 | 2022-02-17 | A vulnerability in the DNS-based Authentication of Named Entities (DANE) email verification component of Cisco AsyncOS Software for Cisco Email Security Applia… |
CVE-2022-23319 | Medium | 5.5 | 2022-02-17 | A segmentation fault during PCF file parsing in pcf2bdf versions >=1.05 allows an attacker to trigger a program crash via a specially crafted PCF font file. Th… |
CVE-2022-23318 | High | 7.1 | 2022-02-17 | A heap-buffer-overflow in pcf2bdf, versions >= 1.05 allows an attacker to trigger unsafe memory access via a specially crafted PCF font file. This out-of-bound… |
CVE-2022-22899 | Medium | 5.5 | 2022-02-17 | Core FTP / SFTP Server v2 Build 725 was discovered to allow unauthenticated attackers to cause a Denial of Service (DoS) via a crafted packet through the SSH s… |
CVE-2022-0629 | High | 7.8 | 2022-02-17 | Stack-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. |
CVE-2022-0623 | Critical | 9.1 | 2022-02-17 | Out-of-bounds Read in Homebrew mruby prior to 3.2. |
CVE-2022-24953 | Medium | 5.3 | 2022-02-17 | The Crypt_GPG extension before 1.6.7 for PHP does not prevent additional options in GPG calls, which presents a risk for certain environments and GPG versions. |
CVE-2022-22901 | Medium | 5.5 | 2022-02-17 | There is an Assertion in 'context_p->next_scanner_info_p->type == SCANNER_TYPE_FUNCTION' failed at parser_parse_function_arguments in /js/js-parser.c of JerryS… |
CVE-2022-0622 | Medium | 5.3 | 2022-02-17 | Generation of Error Message Containing Sensitive Information in Packagist snipe/snipe-it prior to 5.3.11. |
CVE-2022-25270 | Medium | 6.5 | 2022-02-17 | The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the "access in-place editing" permission vie… |
CVE-2022-25271 | High | 7.5 | 2022-02-16 | Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow… |
CVE-2022-24985 | High | 8.8 | 2022-02-16 | Forms generated by JQueryForm.com before 2022-02-05 allows a remote authenticated attacker to bypass authentication and access the administrative section of ot… |
CVE-2022-24984 | Critical | 9.8 | 2022-02-16 | Forms generated by JQueryForm.com before 2022-02-05 (if file-upload capability is enabled) allow remote unauthenticated attackers to upload executable files an… |
CVE-2022-24983 | High | 7.5 | 2022-02-16 | Forms generated by JQueryForm.com before 2022-02-05 allow remote attackers to obtain the URI to any uploaded file by capturing the POST response. When chained… |
CVE-2022-24982 | Medium | 6.5 | 2022-02-16 | Forms generated by JQueryForm.com before 2022-02-05 allows a remote authenticated attacker to access the cleartext credentials of all other form users. admin.p… |
CVE-2022-24981 | Medium | 6.1 | 2022-02-16 | A reflected cross-site scripting (XSS) vulnerability in forms generated by JQueryForm.com before 2022-02-05 allows remote attackers to inject arbitrary web scr… |
CVE-2022-23636 | Medium | 5.1 | 2022-02-16 | Wasmtime is an open source runtime for WebAssembly & WASI. Prior to versions 0.34.1 and 0.33.1, there exists a bug in the pooling instance allocator in Wasmtim… |
CVE-2022-22885 | Critical | 9.8 | 2022-02-16 | Hutool v5.7.18's HttpRequest was discovered to ignore all TLS/SSL certificate validation. |
CVE-2022-22881 | Critical | 9.8 | 2022-02-16 | Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /sys/user/queryUserComponentData. |
CVE-2022-22880 | Critical | 9.8 | 2022-02-16 | Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /jeecg-boot/sys/user/queryUserByDepId. |
CVE-2022-25265 | High | 7.8 | 2022-02-16 | In the Linux kernel through 5.16.10, certain binary files may have the exec-all attribute if they were built in approximately 2003 (e.g., with GCC 3.2.2 and Li… |
CVE-2022-25258 | Medium | 4.6 | 2022-02-16 | An issue was discovered in drivers/usb/gadget/composite.c in the Linux kernel before 5.16.10. The USB Gadget subsystem lacks certain validation of interface OS… |
CVE-2022-25255 | High | 7.8 | 2022-02-16 | In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working directory when not fo… |
CVE-2022-23644 | High | 8.8 | 2022-02-16 | BookWyrm is a decentralized social network for tracking reading habits and reviewing books. The functionality to load a cover via url is vulnerable to a server… |
CVE-2022-22853 | Medium | 5.4 | 2022-02-16 | A stored cross-site scripting (XSS) vulnerability in Hospital Patient Record Management System v1.0 allows attackers to execute arbitrary web scripts or HTML v… |
CVE-2022-24665 | Critical | 9.9 | 2022-02-16 | PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via a WordPress gutenberg block by any user able to edit posts. |
CVE-2022-24664 | Critical | 9.9 | 2022-02-16 | PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress metaboxes, which could be used by any user able to edi… |
CVE-2022-24663 | Critical | 9.9 | 2022-02-16 | PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress shortcodes, which can be used by any authenticated use… |
CVE-2022-24086 | Critical | 9.8 | 2022-02-16 | Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout proces… |
CVE-2022-23804 | High | 7.8 | 2022-02-16 | A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon ReadIJCoord coordinate parsing functionality of KiCad EDA 6.0.1 and… |
CVE-2022-23803 | High | 7.8 | 2022-02-16 | A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon ReadXYCoord coordinate parsing functionality of KiCad EDA 6.0.1 and… |
CVE-2022-23204 | Medium | 5.5 | 2022-02-16 | Adobe Premiere Rush versions 2.0 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker… |
CVE-2022-23203 | High | 7.8 | 2022-02-16 | Adobe Photoshop versions 22.5.4 (and earlier) and 23.1 (and earlier) are affected by a buffer overflow vulnerability due to insecure handling of a crafted file… |
CVE-2022-23202 | High | 7.0 | 2022-02-16 | Adobe Creative Cloud Desktop version 2.7.0.13 (and earlier) is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary cod… |
CVE-2022-23200 | High | 7.8 | 2022-02-16 | Adobe After Effects versions 22.1.1 (and earlier) and 18.4.3 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary… |
CVE-2022-23199 | Medium | 5.5 | 2022-02-16 | Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker… |
CVE-2022-23198 | Medium | 5.5 | 2022-02-16 | Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker… |
CVE-2022-23197 | Medium | 5.5 | 2022-02-16 | Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of s… |
CVE-2022-23196 | Medium | 5.5 | 2022-02-16 | Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of s… |
CVE-2022-23195 | Medium | 5.5 | 2022-02-16 | Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of s… |
CVE-2022-23194 | Medium | 5.5 | 2022-02-16 | Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of s… |
CVE-2022-23193 | Medium | 5.5 | 2022-02-16 | Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of s… |
CVE-2022-23192 | Medium | 5.5 | 2022-02-16 | Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of s… |
CVE-2022-23191 | Medium | 5.5 | 2022-02-16 | Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of s… |
CVE-2022-23190 | Medium | 5.5 | 2022-02-16 | Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of s… |
CVE-2022-23189 | Medium | 5.5 | 2022-02-16 | Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker… |
CVE-2022-23188 | High | 7.8 | 2022-02-16 | Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by a buffer overflow vulnerability due to insecure handling of a crafted… |
CVE-2022-23186 | High | 7.8 | 2022-02-16 | Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary co… |
CVE-2022-22945 | High | 7.8 | 2022-02-16 | VMware NSX Edge contains a CLI shell injection vulnerability. A malicious actor with SSH access to an NSX-Edge appliance can execute arbitrary commands on the… |
CVE-2022-22792 | Medium | 6.6 | 2022-02-16 | MobiSoft - MobiPlus User Take Over and Improper Handling of url Parameters Attacker can navigate to specific url which will expose all the users and password i… |
CVE-2022-0617 | Medium | 5.5 | 2022-02-16 | A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way user triggers udf_file_write_iter function for the malic… |
CVE-2022-0513 | Critical | 9.8 | 2022-02-16 | The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the exclusion_reason parameter found in… |
CVE-2022-23358 | Critical | 9.8 | 2022-02-16 | EasyCMS v1.6 allows for SQL injection via ArticlemAction.class.php. In the background, search terms provided by the user were not sanitized and were used direc… |
CVE-2022-0559 | Critical | 9.8 | 2022-02-16 | Use After Free in GitHub repository radareorg/radare2 prior to 5.6.2. |
CVE-2022-0614 | Medium | 5.5 | 2022-02-16 | Use of Out-of-range Pointer Offset in Homebrew mruby prior to 3.2. |
CVE-2022-0613 | Medium | 6.5 | 2022-02-16 | Authorization Bypass Through User-Controlled Key in NPM urijs prior to 1.19.8. |
CVE-2022-0612 | Medium | 5.4 | 2022-02-16 | Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v. |
CVE-2022-25242 | High | 8.8 | 2022-02-16 | In FileCloud before 21.3, file upload is not protected against Cross-Site Request Forgery (CSRF). |
CVE-2022-25241 | High | 8.8 | 2022-02-16 | In FileCloud before 21.3, the CSV user import functionality is vulnerable to Cross-Site Request Forgery (CSRF). |
CVE-2022-25236 | Critical | 9.8 | 2022-02-16 | xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs. |
CVE-2022-25235 | Critical | 9.8 | 2022-02-16 | xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain con… |
CVE-2022-0611 | Medium | 6.3 | 2022-02-16 | Missing Authorization in Packagist snipe/snipe-it prior to 5.3.11. |
CVE-2022-23643 | Medium | 6.5 | 2022-02-15 | Sourcegraph is a code search and navigation engine. Sourcegraph versions 3.35 and 3.36 reintroduced a previously fixed side-channel vulnerabilitity in the Code… |
CVE-2022-23641 | Medium | 6.5 | 2022-02-15 | Discourse is an open source discussion platform. In versions prior to 2.8.1 in the `stable` branch, 2.9.0.beta2 in the `beta` branch, and 2.9.0.beta2 in the `t… |
CVE-2022-24589 | Medium | 6.1 | 2022-02-15 | Burden v3.0 was discovered to contain a stored cross-site scripting (XSS) in the Add Category function. This vulnerability allows attackers to execute arbitrar… |
CVE-2022-23639 | High | 8.1 | 2022-02-15 | crossbeam-utils provides atomics, synchronization primitives, scoped threads, and other utilities for concurrent programming in Rust. crossbeam-utils prior to… |
CVE-2022-22770 | Critical | 9.8 | 2022-02-15 | The Web Server component of TIBCO Software Inc.'s TIBCO AuditSafe contains an easily exploitable vulnerability that allows an unauthenticated attacker with net… |
CVE-2022-25212 | High | 8.8 | 2022-02-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins SWAMP Plugin 1.2.6 and earlier allows attackers to connect to an attacker-specified web server usi… |
CVE-2022-25211 | High | 8.8 | 2022-02-15 | A missing permission check in Jenkins SWAMP Plugin 1.2.6 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified web serv… |
CVE-2022-25210 | Medium | 6.5 | 2022-02-15 | Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier uses static fields to store job configuration information, allowing attackers with Item/Configure per… |
CVE-2022-25209 | High | 8.8 | 2022-02-15 | Jenkins Chef Sinatra Plugin 1.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-25208 | High | 8.8 | 2022-02-15 | A missing permission check in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers with Overall/Read permission to have Jenkins send an HTTP request t… |
CVE-2022-25207 | High | 8.8 | 2022-02-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers to have Jenkins send an HTTP request to an a… |
CVE-2022-25206 | High | 8.8 | 2022-02-15 | A missing check in Jenkins dbCharts Plugin 0.5.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified database via JDB… |
CVE-2022-25205 | High | 8.8 | 2022-02-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins dbCharts Plugin 0.5.2 and earlier allows attackers to connect to an attacker-specified database vi… |
CVE-2022-25204 | Medium | 5.4 | 2022-02-15 | Jenkins Doktor Plugin 0.4.1 and earlier implements functionality that allows agent processes to render files on the controller as Markdown or Asciidoc, and err… |
CVE-2022-25203 | Medium | 5.4 | 2022-02-15 | Jenkins Team Views Plugin 0.9.0 and earlier does not escape team names, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers… |
CVE-2022-25202 | Medium | 4.8 | 2022-02-15 | Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name of custom promotion levels, resulting in a stored cross-site scripting (XSS) v… |
CVE-2022-25201 | Medium | 6.5 | 2022-02-15 | Missing permission checks in Jenkins Checkmarx Plugin 2022.1.2 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified web… |
CVE-2022-25200 | High | 8.8 | 2022-02-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins Checkmarx Plugin 2022.1.2 and earlier allows attackers to connect to an attacker-specified webserv… |
CVE-2022-25199 | High | 8.8 | 2022-02-15 | A missing permission check in Jenkins SCP publisher Plugin 1.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SS… |
CVE-2022-25198 | High | 8.8 | 2022-02-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins SCP publisher Plugin 1.8 and earlier allows attackers to connect to an attacker-specified SSH serv… |
CVE-2022-25197 | Medium | 6.5 | 2022-02-15 | Jenkins HashiCorp Vault Plugin 336.v182c0fbaaeb7 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins contro… |
CVE-2022-25196 | Medium | 5.4 | 2022-02-15 | Jenkins GitLab Authentication Plugin 1.13 and earlier records the HTTP Referer header as part of the URL query parameters when the authentication process start… |
CVE-2022-25195 | Medium | 4.3 | 2022-02-15 | A missing permission check in Jenkins autonomiq Plugin 1.15 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL u… |
CVE-2022-25194 | High | 8.8 | 2022-02-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins autonomiq Plugin 1.15 and earlier allows attackers to connect to an attacker-specified URL server… |
CVE-2022-25193 | Medium | 6.5 | 2022-02-15 | Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified we… |
CVE-2022-25192 | High | 8.8 | 2022-02-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins Snow Commander Plugin 1.10 and earlier allows attackers to connect to an attacker-specified webser… |
CVE-2022-25191 | Medium | 5.4 | 2022-02-15 | Jenkins Agent Server Parameter Plugin 1.0 and earlier does not escape parameter names of agent server parameters, resulting in a stored cross-site scripting (X… |
CVE-2022-25190 | Medium | 4.3 | 2022-02-15 | A missing permission check in Jenkins Conjur Secrets Plugin 1.0.11 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of cr… |
CVE-2022-25189 | Medium | 5.4 | 2022-02-15 | Jenkins Custom Checkbox Parameter Plugin 1.1 and earlier does not escape parameter names of custom checkbox parameters, resulting in a stored cross-site script… |
CVE-2022-25188 | Medium | 4.3 | 2022-02-15 | Jenkins Fortify Plugin 20.2.34 and earlier does not sanitize the appName and appVersion parameters of its Pipeline steps, allowing attackers with Item/Configur… |
CVE-2022-25187 | Medium | 6.5 | 2022-02-15 | Jenkins Support Core Plugin 2.79 and earlier does not redact some sensitive information in the support bundle. |
CVE-2022-25186 | Medium | 6.5 | 2022-02-15 | Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use on the agent, allow… |
CVE-2022-25185 | Medium | 5.4 | 2022-02-15 | Jenkins Generic Webhook Trigger Plugin 1.81 and earlier does not escape the build cause when using the webhook, resulting in a stored cross-site scripting (XSS… |
CVE-2022-25184 | Medium | 6.5 | 2022-02-15 | Jenkins Pipeline: Build Step Plugin 2.15 and earlier reveals password parameter default values when generating a pipeline script using the Pipeline Snippet Gen… |
CVE-2022-25183 | High | 8.8 | 2022-02-15 | Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the names of Pipeline libraries to create cache directories without any san… |
CVE-2022-25182 | High | 8.8 | 2022-02-15 | A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/Configure permissio… |
CVE-2022-25181 | High | 8.8 | 2022-02-15 | A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/Configure permissio… |
CVE-2022-25180 | Medium | 4.3 | 2022-02-15 | Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier includes password parameters from the original build in replayed builds, allowing attackers with… |