2022 CVEs (page 252)
Page 252 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-25199 | High | 8.8 | 2022-02-15 | A missing permission check in Jenkins SCP publisher Plugin 1.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SS… |
CVE-2022-25198 | High | 8.8 | 2022-02-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins SCP publisher Plugin 1.8 and earlier allows attackers to connect to an attacker-specified SSH serv… |
CVE-2022-25197 | Medium | 6.5 | 2022-02-15 | Jenkins HashiCorp Vault Plugin 336.v182c0fbaaeb7 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins contro… |
CVE-2022-25196 | Medium | 5.4 | 2022-02-15 | Jenkins GitLab Authentication Plugin 1.13 and earlier records the HTTP Referer header as part of the URL query parameters when the authentication process start… |
CVE-2022-25195 | Medium | 4.3 | 2022-02-15 | A missing permission check in Jenkins autonomiq Plugin 1.15 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL u… |
CVE-2022-25194 | High | 8.8 | 2022-02-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins autonomiq Plugin 1.15 and earlier allows attackers to connect to an attacker-specified URL server… |
CVE-2022-25193 | Medium | 6.5 | 2022-02-15 | Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified we… |
CVE-2022-25192 | High | 8.8 | 2022-02-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins Snow Commander Plugin 1.10 and earlier allows attackers to connect to an attacker-specified webser… |
CVE-2022-25191 | Medium | 5.4 | 2022-02-15 | Jenkins Agent Server Parameter Plugin 1.0 and earlier does not escape parameter names of agent server parameters, resulting in a stored cross-site scripting (X… |
CVE-2022-25190 | Medium | 4.3 | 2022-02-15 | A missing permission check in Jenkins Conjur Secrets Plugin 1.0.11 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of cr… |
CVE-2022-25189 | Medium | 5.4 | 2022-02-15 | Jenkins Custom Checkbox Parameter Plugin 1.1 and earlier does not escape parameter names of custom checkbox parameters, resulting in a stored cross-site script… |
CVE-2022-25188 | Medium | 4.3 | 2022-02-15 | Jenkins Fortify Plugin 20.2.34 and earlier does not sanitize the appName and appVersion parameters of its Pipeline steps, allowing attackers with Item/Configur… |
CVE-2022-25187 | Medium | 6.5 | 2022-02-15 | Jenkins Support Core Plugin 2.79 and earlier does not redact some sensitive information in the support bundle. |
CVE-2022-25186 | Medium | 6.5 | 2022-02-15 | Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use on the agent, allow… |
CVE-2022-25185 | Medium | 5.4 | 2022-02-15 | Jenkins Generic Webhook Trigger Plugin 1.81 and earlier does not escape the build cause when using the webhook, resulting in a stored cross-site scripting (XSS… |
CVE-2022-25184 | Medium | 6.5 | 2022-02-15 | Jenkins Pipeline: Build Step Plugin 2.15 and earlier reveals password parameter default values when generating a pipeline script using the Pipeline Snippet Gen… |
CVE-2022-25183 | High | 8.8 | 2022-02-15 | Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the names of Pipeline libraries to create cache directories without any san… |
CVE-2022-25182 | High | 8.8 | 2022-02-15 | A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/Configure permissio… |
CVE-2022-25181 | High | 8.8 | 2022-02-15 | A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/Configure permissio… |
CVE-2022-25180 | Medium | 4.3 | 2022-02-15 | Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier includes password parameters from the original build in replayed builds, allowing attackers with… |
CVE-2022-25179 | Medium | 6.5 | 2022-02-15 | Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM… |
CVE-2022-25178 | Medium | 6.5 | 2022-02-15 | Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier does not restrict the names of resources passed to the libraryResource step, all… |
CVE-2022-25177 | Medium | 6.5 | 2022-02-15 | Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier follows symbolic links to locations outside of the expected Pipeline library whe… |
CVE-2022-25176 | Medium | 6.5 | 2022-02-15 | Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM whe… |
CVE-2022-25175 | High | 8.8 | 2022-02-15 | Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing atta… |
CVE-2022-25174 | High | 8.8 | 2022-02-15 | Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the same checkout directories for distinct SCMs for Pipeline libraries, all… |
CVE-2022-25173 | High | 8.8 | 2022-02-15 | Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier uses the same checkout directories for distinct SCMs when reading the script file (typically Jen… |
CVE-2022-24590 | Medium | 5.4 | 2022-02-15 | A stored cross-site scripting (XSS) vulnerability in the Add Link function of BackdropCMS v1.21.1 allows attackers to execute arbitrary web scripts or HTML. |
CVE-2022-24588 | Medium | 5.4 | 2022-02-15 | Flatpress v1.2.1 was discovered to contain a cross-site scripting (XSS) vulnerability in the Upload SVG File function. |
CVE-2022-24587 | Medium | 5.4 | 2022-02-15 | A stored cross-site scripting (XSS) vulnerability in the component core/admin/medias.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or… |
CVE-2022-24585 | Medium | 5.4 | 2022-02-15 | A stored cross-site scripting (XSS) vulnerability in the component /core/admin/comment.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts o… |
CVE-2022-24226 | High | 7.5 | 2022-02-15 | Hospital Management System v4.0 was discovered to contain a blind SQL injection vulnerability via the register function in func2.php. |
CVE-2022-23604 | High | 8.8 | 2022-02-15 | x26-Cogs is a repository of cogs made by Twentysix for the Red Discord bot. Among these cogs is the Defender cog, a tool for Discord server moderation. A vulne… |
CVE-2022-21698 | High | 7.5 | 2022-02-15 | client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers… |
CVE-2022-24684 | Medium | 6.5 | 2022-02-15 | HashiCorp Nomad and Nomad Enterprise 0.9.0 through 1.0.16, 1.1.11, and 1.2.5 allow operators with job-submit capabilities to use the spread stanza to panic ser… |
CVE-2022-24227 | Medium | 6.1 | 2022-02-15 | A cross-site scripting (XSS) vulnerability in BoltWire v7.10 and v 8.00 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the… |
CVE-2022-24586 | Medium | 5.4 | 2022-02-15 | A stored cross-site scripting (XSS) vulnerability in the component /core/admin/categories.php of PluXml v5.8.7 allows attackers to execute arbitrary web script… |
CVE-2022-0597 | Medium | 6.1 | 2022-02-15 | Open Redirect in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-0596 | Medium | 4.3 | 2022-02-15 | Improper Validation of Specified Quantity in Input in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-23384 | High | 8.8 | 2022-02-15 | YzmCMS v6.3 is affected by Cross Site Request Forgery (CSRF) in /admin.add |
CVE-2022-23317 | High | 7.5 | 2022-02-15 | CobaltStrike <=4.5 HTTP(S) listener does not determine whether the request URL begins with "/", and attackers can obtain relevant information by specifying the… |
CVE-2022-0589 | Medium | 5.4 | 2022-02-15 | Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.1.0. |
CVE-2022-0588 | High | 7.1 | 2022-02-15 | Missing Authorization in Packagist librenms/librenms prior to 22.2.0. |
CVE-2022-0587 | Medium | 6.5 | 2022-02-15 | Improper Authorization in Packagist librenms/librenms prior to 22.2.0. |
CVE-2022-21818 | Medium | 5.4 | 2022-02-15 | NVIDIA License System contains a vulnerability in the installation scripts for the DLS virtual appliance, where a user on a network after signing in to the por… |
CVE-2022-0580 | High | 7.1 | 2022-02-14 | Incorrect Authorization in Packagist librenms/librenms prior to 22.2.0. |
CVE-2022-25139 | Critical | 9.8 | 2022-02-14 | njs through 0.7.0, used in NGINX, was discovered to contain a heap use-after-free in njs_await_fulfilled. |
CVE-2022-24705 | Critical | 9.8 | 2022-02-14 | The rad_packet_recv function in radius/packet.c suffers from a memcpy buffer overflow, resulting in an overly-large recvfrom into a fixed buffer that causes a… |
CVE-2022-24704 | Critical | 9.8 | 2022-02-14 | The rad_packet_recv function in opt/src/accel-pppd/radius/packet.c suffers from a buffer overflow vulnerability, whereby user input len is copied into a fixed… |
CVE-2022-23992 | Critical | 9.8 | 2022-02-14 | XCOM Data Transport for Windows, Linux, and UNIX 11.6 releases contain a vulnerability due to insufficient input validation that could potentially allow remote… |
CVE-2022-23410 | High | 7.8 | 2022-02-14 | AXIS IP Utility before 4.18.0 allows for remote code execution and local privilege escalation by the means of DLL hijacking. IPUtility.exe would attempt to loa… |
CVE-2022-0586 | Medium | 6.3 | 2022-02-14 | Infinite loop in RTMPT protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file |
CVE-2022-0583 | Medium | 6.3 | 2022-02-14 | Crash in the PVFS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file |
CVE-2022-0582 | Medium | 6.3 | 2022-02-14 | Unaligned access in the CSN.1 protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted captu… |
CVE-2022-0581 | Medium | 6.3 | 2022-02-14 | Crash in the CMS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file |
CVE-2022-24206 | Critical | 9.8 | 2022-02-14 | Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in /mobile_seal/get_seal.php via the DEVICE_LIST parameter. |
CVE-2022-23902 | Critical | 9.8 | 2022-02-14 | Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in export_data.php via the d_name parameter. |
CVE-2022-23638 | Medium | 6.2 | 2022-02-14 | svg-sanitizer is a SVG/XML sanitizer written in PHP. A cross-site scripting vulnerability impacts all users of the `svg-sanitizer` library prior to version 0.1… |
CVE-2022-23637 | Medium | 6.1 | 2022-02-14 | K-Box is a web-based application to manage documents, images, videos and geodata. Prior to version 0.33.1, a stored Cross-Site-Scripting (XSS) vulnerability is… |
CVE-2022-23391 | Medium | 6.1 | 2022-02-14 | A cross-site scripting (XSS) vulnerability in Pybbs v6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the Sear… |
CVE-2022-23390 | Critical | 9.8 | 2022-02-14 | An issue in the getType function of BBS Forum v5.3 and below allows attackers to upload arbitrary files. |
CVE-2022-23389 | Critical | 9.8 | 2022-02-14 | PublicCMS v4.0 was discovered to contain a remote code execution (RCE) vulnerability via the cmdarray parameter. |
CVE-2022-23337 | Critical | 9.8 | 2022-02-14 | DedeCMS v5.7.87 was discovered to contain a SQL injection vulnerability in article_coonepage_rule.php via the ids parameter. |
CVE-2022-23336 | Critical | 9.8 | 2022-02-14 | S-CMS v5.0 was discovered to contain a SQL injection vulnerability in member_pay.php via the O_id parameter. |
CVE-2022-23335 | Critical | 9.8 | 2022-02-14 | Metinfo v7.5.0 was discovered to contain a SQL injection vulnerability in language_general.class.php via doModifyParameter. |
CVE-2022-22295 | Critical | 9.8 | 2022-02-14 | Metinfo v7.5.0 was discovered to contain a SQL injection vulnerability in parameter_admin.class.php via the table_para parameter. |
CVE-2022-24988 | Critical | 9.8 | 2022-02-14 | In galois_2p8 before 0.1.2, PrimitivePolynomialField::new has an off-by-one buffer overflow for a vector. |
CVE-2022-25150 | High | 7.8 | 2022-02-14 | In Malwarebytes Binisoft Windows Firewall Control before 6.8.1.0, programs executed from the Tools tab can be used to escalate privileges. |
CVE-2022-0579 | Medium | 6.5 | 2022-02-14 | Missing Authorization in Packagist snipe/snipe-it prior to 5.3.9. |
CVE-2022-23367 | Medium | 6.1 | 2022-02-14 | Fulusso v1.1 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability in /BindAccount/SuccessTips.js. This vulnerability allows attackers… |
CVE-2022-22854 | High | 8.8 | 2022-02-14 | An access control issue in hprms/admin/?page=user/list of Hospital Patient Record Management System v1.0 allows attackers to escalate privileges via accessing… |
CVE-2022-0512 | Medium | 5.3 | 2022-02-14 | Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.6. |
CVE-2022-24686 | Medium | 5.9 | 2022-02-14 | HashiCorp Nomad and Nomad Enterprise 0.3.0 through 1.0.17, 1.1.11, and 1.2.5 artifact download functionality has a race condition such that the Nomad client ag… |
CVE-2022-24977 | Critical | 9.8 | 2022-02-14 | ImpressCMS before 1.4.2 allows unauthenticated remote code execution via ...../// directory traversal in origName or imageName, leading to unsafe interaction w… |
CVE-2022-24976 | Critical | 9.1 | 2022-02-14 | Atheme IRC Services before 7.2.12, when used in conjunction with InspIRCd, allows authentication bypass by ending an IRC handshake at a certain point during a… |
CVE-2022-24110 | Medium | 6.5 | 2022-02-14 | Kiteworks MFT 7.5 may allow an unauthorized user to reset other users' passwords. This is fixed in version 7.6 and later. |
CVE-2022-0576 | Medium | 6.1 | 2022-02-14 | Cross-site Scripting (XSS) - Generic in Packagist librenms/librenms prior to 22.1.0. |
CVE-2022-0575 | Medium | 5.4 | 2022-02-14 | Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.2.0. |
CVE-2022-0572 | High | 7.8 | 2022-02-14 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. |
CVE-2022-0571 | Medium | 6.1 | 2022-02-14 | Cross-site Scripting (XSS) - Reflected in GitHub repository phoronix-test-suite/phoronix-test-suite prior to 10.8.2. |
CVE-2022-0570 | Critical | 9.8 | 2022-02-14 | Heap-based Buffer Overflow in Homebrew mruby prior to 3.2. |
CVE-2022-0569 | Medium | 5.3 | 2022-02-14 | Observable Discrepancy in Packagist snipe/snipe-it prior to v5.3.9. |
CVE-2022-0565 | High | 7.6 | 2022-02-14 | Cross-site Scripting in Packagist pimcore/pimcore prior to 10.3.1. |
CVE-2022-0214 | High | 7.5 | 2022-02-14 | The Custom Popup Builder WordPress plugin before 1.3.1 autoload data from its popup on every pages, as such data can be sent by unauthenticated user, and is no… |
CVE-2022-0212 | Medium | 6.1 | 2022-02-14 | The SpiderCalendar WordPress plugin through 1.5.65 does not sanitise and escape the callback parameter before outputting it back in the page via the window AJA… |
CVE-2022-0208 | Medium | 6.1 | 2022-02-14 | The MapPress Maps for WordPress plugin before 2.73.4 does not sanitise and escape the mapid parameter before outputting it back in the "Bad mapid" error messag… |
CVE-2022-0206 | Medium | 6.1 | 2022-02-14 | The NewStatPress WordPress plugin before 1.3.6 does not properly escape the whatX parameters before outputting them back in attributes, leading to Reflected Cr… |
CVE-2022-0201 | Medium | 6.1 | 2022-02-14 | The Permalink Manager Lite WordPress plugin before 2.2.15 and Permalink Manager Pro WordPress plugin before 2.2.15 do not sanitise and escape query parameters… |
CVE-2022-0200 | Medium | 5.4 | 2022-02-14 | Themify Portfolio Post WordPress plugin before 1.1.7 does not sanitise and escape the num_of_pages parameter before outputting it back the response of the them… |
CVE-2022-0193 | Medium | 6.1 | 2022-02-14 | The Complianz WordPress plugin before 6.0.0 does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected… |
CVE-2022-0190 | High | 8.8 | 2022-02-14 | The Ad Invalid Click Protector (AICP) WordPress plugin before 1.2.6 is affected by a SQL Injection in the id parameter of the delete action. |
CVE-2022-0188 | Medium | 5.3 | 2022-02-14 | The CMP WordPress plugin before 4.0.19 allows any user, even not logged in, to arbitrarily change the coming soon page layout. |
CVE-2022-0176 | Medium | 6.1 | 2022-02-14 | The PowerPack Lite for Beaver Builder WordPress plugin before 1.2.9.3 does not sanitise and escape the tab parameter before outputting it back in an admin page… |
CVE-2022-22765 | High | 8.0 | 2022-02-12 | BD Viper LT system, versions 2.0 and later, contains hardcoded credentials. If exploited, threat actors may be able to access, modify or delete sensitive infor… |
CVE-2022-0311 | High | 8.8 | 2022-02-12 | Heap buffer overflow in Task Manager in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who convinced a user to engage in specific user interacti… |
CVE-2022-0310 | High | 8.8 | 2022-02-12 | Heap buffer overflow in Task Manager in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via specific user… |
CVE-2022-0309 | Medium | 6.5 | 2022-02-12 | Inappropriate implementation in Autofill in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to bypass navigation restrictions via a crafted HTML… |
CVE-2022-0308 | High | 8.8 | 2022-02-12 | Use after free in Data Transfer in Google Chrome on Chrome OS prior to 97.0.4692.99 allowed a remote attacker who convinced a user to engage in specific user i… |
CVE-2022-0307 | High | 8.8 | 2022-02-12 | Use after free in Optimization Guide in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who convinced a user to engage in specific user interacti… |
CVE-2022-0306 | High | 8.8 | 2022-02-12 | Heap buffer overflow in PDFium in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |