2022 CVEs (page 254)
Page 254 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-0011 | Medium | 6.5 | 2022-02-10 | PAN-OS software provides options to exclude specific websites from URL category enforcement and those websites are blocked or allowed (depending on your rules)… |
CVE-2022-24111 | Medium | 5.3 | 2022-02-10 | In Mahara 21.04 before 21.04.3 and 21.10 before 21.10.1, portfolios created in groups that have not been shared with non-group members and portfolios created o… |
CVE-2022-0558 | Medium | 5.4 | 2022-02-10 | Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-24668 | High | 7.5 | 2022-02-09 | A program using swift-nio-http2 is vulnerable to a denial of service attack caused by a network peer sending ALTSVC or ORIGIN frames. This attack affects all s… |
CVE-2022-24667 | High | 7.5 | 2022-02-09 | A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HPACK-encoded header block. T… |
CVE-2022-24666 | High | 7.5 | 2022-02-09 | A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HTTP/2 frame. This attack aff… |
CVE-2022-24321 | High | 7.5 | 2022-02-09 | A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause Denial of Service against the Geo SCADA server when recei… |
CVE-2022-24320 | Medium | 5.9 | 2022-02-09 | A CWE-295: Improper Certificate Validation vulnerability exists that could allow a Man-in-theMiddle attack when communications between the client and Geo SCADA… |
CVE-2022-24319 | Medium | 5.9 | 2022-02-09 | A CWE-295: Improper Certificate Validation vulnerability exists that could allow a Man-in-theMiddle attack when communications between the client and Geo SCADA… |
CVE-2022-24318 | High | 7.5 | 2022-02-09 | A CWE-326: Inadequate Encryption Strength vulnerability exists that could cause non-encrypted communication with the server when outdated versions of the ViewX… |
CVE-2022-24317 | High | 7.5 | 2022-02-09 | A CWE-862: Missing Authorization vulnerability exists that could cause information exposure when an attacker sends a specific message. Affected Product: Intera… |
CVE-2022-24316 | High | 7.5 | 2022-02-09 | A CWE-665: Improper Initialization vulnerability exists that could cause information exposure when an attacker sends a specially crafted message. Affected Prod… |
CVE-2022-24315 | High | 7.5 | 2022-02-09 | A CWE-125: Out-of-bounds Read vulnerability exists that could cause denial of service when an attacker repeatedly sends a specially crafted message. Affected P… |
CVE-2022-24314 | High | 7.5 | 2022-02-09 | A CWE-125: Out-of-bounds Read vulnerability exists that could cause memory leaks potentially resulting in denial of service when an attacker repeatedly sends a… |
CVE-2022-24313 | Critical | 9.8 | 2022-02-09 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow potentially leading to remote code ex… |
CVE-2022-24312 | Critical | 9.8 | 2022-02-09 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause modification of an existing file by adding at end o… |
CVE-2022-24311 | Critical | 9.8 | 2022-02-09 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause modification of an existing file by inserting at be… |
CVE-2022-24310 | Critical | 9.8 | 2022-02-09 | A CWE-190: Integer Overflow or Wraparound vulnerability exists that could cause heap-based buffer overflow, leading to denial of service and potentially remote… |
CVE-2022-23049 | Medium | 5.4 | 2022-02-09 | Exponent CMS 2.6.0patch2 allows an authenticated user to inject persistent JavaScript code on the "User-Agent" header when logging in. When an administrator us… |
CVE-2022-23048 | High | 7.2 | 2022-02-09 | Exponent CMS 2.6.0patch2 allows an authenticated admin user to upload a malicious extension in the format of a ZIP file with a PHP file inside it. After upload… |
CVE-2022-23047 | Medium | 4.8 | 2022-02-09 | Exponent CMS 2.6.0patch2 allows an authenticated admin user to inject persistent JavaScript code inside the "Site/Organization Name","Site Title" and "Site Hea… |
CVE-2022-22813 | Critical | 9.8 | 2022-02-09 | A CWE-798: Use of Hard-coded Credentials vulnerability exists. If an attacker were to obtain the TLS cryptographic key and take active control of the Courier t… |
CVE-2022-22812 | Medium | 6.1 | 2022-02-09 | A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause a web session compromise w… |
CVE-2022-22811 | High | 8.1 | 2022-02-09 | A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists that could induce users to perform unintended actions, leading to the override of the system�… |
CVE-2022-22810 | Critical | 9.8 | 2022-02-09 | A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to manipulate the admin after numerous a… |
CVE-2022-22809 | Medium | 5.3 | 2022-02-09 | A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow modifications of the touch configurations in an unauthorized mann… |
CVE-2022-22808 | High | 8.8 | 2022-02-09 | A CWE-352: Cross-Site Request Forgery (CSRF) exists that could cause a remote attacker to gain unauthorized access to the product when conducting cross-domain… |
CVE-2022-22807 | High | 7.4 | 2022-02-09 | A CWE-1021 Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause unintended modifications of the product settings or user… |
CVE-2022-22780 | Medium | 4.7 | 2022-02-09 | The Zoom Client for Meetings chat functionality was susceptible to Zip bombing attacks in the following product versions: Android before version 5.8.6, iOS bef… |
CVE-2022-22779 | Low | 3.7 | 2022-02-09 | The Keybase Clients for macOS and Windows before version 5.9.0 fails to properly remove exploded messages initiated by a user. This can occur if the receiving… |
CVE-2022-22546 | Medium | 5.4 | 2022-02-09 | Due to improper HTML encoding in input control summary, an authorized attacker can execute XSS vulnerability in SAP Business Objects Web Intelligence (BI Launc… |
CVE-2022-22545 | Medium | 4.9 | 2022-02-09 | A high privileged user who has access to transaction SM59 can read connection details stored with the destination for http calls in SAP NetWeaver Application S… |
CVE-2022-22544 | Critical | 9.1 | 2022-02-09 | Solution Manager (Diagnostics Root Cause Analysis Tools) - version 720, allows an administrator to execute code on all connected Diagnostics Agents and browse… |
CVE-2022-22543 | High | 7.5 | 2022-02-09 | SAP NetWeaver Application Server for ABAP (Kernel) and ABAP Platform (Kernel) - versions KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, KRNL64UC… |
CVE-2022-22542 | Medium | 6.5 | 2022-02-09 | S/4HANA Supplier Factsheet exposes the private address and bank details of an Employee Business Partner with Supplier Role, AND Enterprise Search for Customer… |
CVE-2022-22540 | High | 7.5 | 2022-02-09 | SAP NetWeaver AS ABAP (Workplace Server) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 787, allows an attacker to execute crafted data… |
CVE-2022-22539 | Medium | 6.5 | 2022-02-09 | When a user opens a manipulated JPEG file format (.jpg, 2d.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the applicati… |
CVE-2022-22538 | Medium | 6.5 | 2022-02-09 | When a user opens a manipulated Adobe Illustrator file format (.ai, ai.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, t… |
CVE-2022-22537 | Medium | 6.5 | 2022-02-09 | When a user opens a manipulated Tagged Image File Format (.tiff, 2d.x3d)) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the… |
CVE-2022-22536 | Critical | 10.0 | 2022-02-09 | SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for… |
CVE-2022-22535 | Medium | 6.5 | 2022-02-09 | SAP ERP HCM Portugal - versions 600, 604, 608, does not perform necessary authorization checks for a report that reads the payroll data of employees in a certa… |
CVE-2022-22534 | Medium | 6.1 | 2022-02-09 | Due to insufficient encoding of user input, SAP NetWeaver allows an unauthenticated attacker to inject code that may expose sensitive data like user ID and pas… |
CVE-2022-22533 | High | 7.5 | 2022-02-09 | Due to improper error handling in SAP NetWeaver Application Server Java - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7… |
CVE-2022-22532 | Critical | 9.8 | 2022-02-09 | In SAP NetWeaver Application Server Java - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, an unauthentic… |
CVE-2022-22528 | High | 7.8 | 2022-02-09 | SAP Adaptive Server Enterprise (ASE) - version 16.0, installation makes an entry in the system PATH environment variable in Windows platform which, under certa… |
CVE-2022-21825 | High | 7.8 | 2022-02-09 | An Improper Access Control vulnerability exists in Citrix Workspace App for Linux 2012 - 2111 with App Protection installed that can allow an attacker to perfo… |
CVE-2022-21226 | Medium | 5.5 | 2022-02-09 | Out-of-bounds read in the Intel(R) Trace Analyzer and Collector before version 2021.5 may allow an authenticated user to potentially enable information disclos… |
CVE-2022-21220 | High | 7.8 | 2022-02-09 | Improper restriction of XML external entity for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an authenticated user to potentially enable… |
CVE-2022-21218 | Medium | 5.5 | 2022-02-09 | Uncaught exception in the Intel(R) Trace Analyzer and Collector before version 2021.5 may allow an authenticated user to potentially enable information disclos… |
CVE-2022-21205 | High | 7.5 | 2022-02-09 | Improper restriction of XML external entity reference in DSP Builder Pro for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an unauthentic… |
CVE-2022-21204 | High | 7.8 | 2022-02-09 | Improper permissions for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an authenticated user to potentially enable escalation of privileg… |
CVE-2022-21203 | High | 7.8 | 2022-02-09 | Improper permissions in the SafeNet Sentinel driver for Intel(R) Quartus(R) Prime Standard Edition before version 21.1 may allow an authenticated user to poten… |
CVE-2022-21174 | High | 7.8 | 2022-02-09 | Improper access control in a third-party component of Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an authenticated user to potentially… |
CVE-2022-21157 | Medium | 5.5 | 2022-02-09 | Improper access control in the Intel(R) Smart Campus Android application before version 6.1 may allow authenticated user to potentially enable information disc… |
CVE-2022-21156 | Medium | 5.5 | 2022-02-09 | Access of uninitialized pointer in the Intel(R) Trace Analyzer and Collector before version 2021.5 may allow an authenticated user to potentially enable denial… |
CVE-2022-21153 | Medium | 5.5 | 2022-02-09 | Improper access control in the Intel(R) Capital Global Summit Android application may allow an authenticated user to potentially enable information disclosure… |
CVE-2022-21133 | Medium | 5.5 | 2022-02-09 | Out-of-bounds read in the Intel(R) Trace Analyzer and Collector before version 2021.5 may allow an authenticated user to potentially enable denial of service v… |
CVE-2022-20046 | Medium | 5.5 | 2022-02-09 | In Bluetooth, there is a possible memory corruption due to a logic error. This could lead to local denial of service with no additional execution privileges ne… |
CVE-2022-20045 | High | 7.8 | 2022-02-09 | In Bluetooth, there is a possible service crash due to a use after free. This could lead to local escalation of privilege with no additional execution privileg… |
CVE-2022-20044 | High | 7.8 | 2022-02-09 | In Bluetooth, there is a possible service crash due to a use after free. This could lead to local escalation of privilege with no additional execution privileg… |
CVE-2022-20043 | High | 7.8 | 2022-02-09 | In Bluetooth, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additiona… |
CVE-2022-20042 | Medium | 5.5 | 2022-02-09 | In Bluetooth, there is a possible information disclosure due to incorrect error handling. This could lead to local information disclosure with no additional ex… |
CVE-2022-20041 | High | 7.8 | 2022-02-09 | In Bluetooth, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additiona… |
CVE-2022-20040 | High | 7.8 | 2022-02-09 | In power_hal_manager_service, there is a possible permission bypass due to a stack-based buffer overflow. This could lead to local escalation of privilege with… |
CVE-2022-20039 | Medium | 6.7 | 2022-02-09 | In ccu driver, there is a possible memory corruption due to an integer overflow. This could lead to local escalation of privilege with System execution privile… |
CVE-2022-20038 | Medium | 6.7 | 2022-02-09 | In ccu driver, there is a possible memory corruption due to an incorrect bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2022-20037 | Medium | 5.5 | 2022-02-09 | In ion driver, there is a possible information disclosure due to an incorrect bounds check. This could lead to local information disclosure with no additional… |
CVE-2022-20036 | Medium | 5.5 | 2022-02-09 | In ion driver, there is a possible information disclosure due to an incorrect bounds check. This could lead to local information disclosure with no additional… |
CVE-2022-20035 | Medium | 4.4 | 2022-02-09 | In vcu driver, there is a possible information disclosure due to a use after free. This could lead to local escalation of privilege with System execution privi… |
CVE-2022-20034 | Medium | 6.8 | 2022-02-09 | In Preloader XFLASH, there is a possible escalation of privilege due to an improper certificate validation. This could lead to local escalation of privilege fo… |
CVE-2022-20033 | Medium | 4.4 | 2022-02-09 | In camera driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System executio… |
CVE-2022-20032 | Medium | 4.1 | 2022-02-09 | In vow driver, there is a possible memory corruption due to a race condition. This could lead to local information disclosure with System execution privileges… |
CVE-2022-20031 | High | 7.8 | 2022-02-09 | In fb driver, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution priv… |
CVE-2022-20030 | Medium | 6.7 | 2022-02-09 | In vow driver, there is a possible out of bounds write due to a stack-based buffer overflow. This could lead to local escalation of privilege with System execu… |
CVE-2022-20029 | Medium | 4.4 | 2022-02-09 | In cmdq driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution… |
CVE-2022-20028 | High | 7.8 | 2022-02-09 | In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execut… |
CVE-2022-20027 | High | 7.8 | 2022-02-09 | In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execut… |
CVE-2022-20026 | High | 7.8 | 2022-02-09 | In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execut… |
CVE-2022-20025 | High | 7.8 | 2022-02-09 | In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execut… |
CVE-2022-20024 | High | 7.8 | 2022-02-09 | In system service, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional… |
CVE-2022-20017 | Medium | 5.5 | 2022-02-09 | In ion driver, there is a possible information disclosure due to an incorrect bounds check. This could lead to local information disclosure with no additional… |
CVE-2022-0534 | Medium | 5.5 | 2022-02-09 | A vulnerability was found in htmldoc version 1.9.15 where the stack out-of-bounds read takes place in gif_get_code() and occurs when opening a malicious GIF fi… |
CVE-2022-0532 | Medium | 4.2 | 2022-02-09 | An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified for the cluster will b… |
CVE-2022-0530 | Medium | 5.5 | 2022-02-09 | A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This f… |
CVE-2022-0529 | Medium | 5.5 | 2022-02-09 | A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This f… |
CVE-2022-0391 | High | 7.5 | 2022-02-09 | A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The is… |
CVE-2022-0162 | High | 8.4 | 2022-02-09 | The vulnerability exists in TP-Link TL-WR841N V11 3.16.9 Build 160325 Rel.62500n wireless router due to transmission of authentication information in cleartext… |
CVE-2022-23631 | Critical | 9.0 | 2022-02-09 | superjson is a program to allow JavaScript expressions to be serialized to a superset of JSON. In versions prior to 1.8.1 superjson allows input to run arbitra… |
CVE-2022-23628 | Medium | 6.3 | 2022-02-09 | OPA is an open source, general-purpose policy engine. Under certain conditions, pretty-printing an abstract syntax tree (AST) that contains synthetic nodes cou… |
CVE-2022-23622 | High | 7.4 | 2022-02-09 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions there is a cross site scripting (… |
CVE-2022-23621 | Medium | 5.5 | 2022-02-09 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can re… |
CVE-2022-23620 | Medium | 6.8 | 2022-02-09 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions AbstractSxExportURLFactoryActionH… |
CVE-2022-23619 | Medium | 5.3 | 2022-02-09 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to guess if a user… |
CVE-2022-23618 | Medium | 4.7 | 2022-02-09 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions there is no protection against UR… |
CVE-2022-23617 | Medium | 6.5 | 2022-02-09 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with edit right can copy… |
CVE-2022-23616 | High | 8.8 | 2022-02-09 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible for an unprivileged… |
CVE-2022-23615 | Medium | 5.4 | 2022-02-09 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can sa… |
CVE-2022-22567 | Medium | 4.7 | 2022-02-09 | Select Dell Client Commercial and Consumer platforms are vulnerable to an insufficient verification of data authenticity vulnerability. An authenticated malici… |
CVE-2022-22566 | Medium | 6.9 | 2022-02-09 | Select Dell Client Commercial and Consumer platforms contain a pre-boot direct memory access (DMA) vulnerability. An authenticated attacker with physical acces… |
CVE-2022-21660 | High | 8.1 | 2022-02-09 | Gin-vue-admin is a backstage management system based on vue and gin. In versions prior to 2.4.7 low privilege users are able to modify higher privilege users… |