2022 CVEs (page 256)
Page 256 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-21805 | Medium | 6.1 | 2022-02-08 | Reflected cross-site scripting vulnerability in the attached file name of php_mailform versions prior to Version 1.40 allows a remote unauthenticated attacker… |
CVE-2022-21799 | Medium | 5.2 | 2022-02-08 | Cross-site scripting vulnerability in ELECOM LAN router WRC-300FEBK-R firmware v1.13 and earlier allows an attacker on the adjacent network to inject an arbitr… |
CVE-2022-21241 | Critical | 9.6 | 2022-02-08 | Cross-site scripting vulnerability in CSV+ prior to 0.8.1 allows a remote unauthenticated attacker to inject an arbitrary script or an arbitrary OS command via… |
CVE-2022-21193 | High | 7.5 | 2022-02-08 | Directory traversal vulnerability in TransmitMail 2.5.0 to 2.6.1 allows a remote unauthenticated attacker to obtain an arbitrary file on the server via unspeci… |
CVE-2022-21173 | High | 8.8 | 2022-02-08 | Hidden functionality vulnerability in ELECOM LAN routers (WRH-300BK3 firmware v1.05 and earlier, WRH-300WH3 firmware v1.05 and earlier, WRH-300BK3-S firmware v… |
CVE-2022-0508 | Medium | 5.3 | 2022-02-08 | Server-Side Request Forgery (SSRF) in GitHub repository chocobozzz/peertube prior to f33e515991a32885622b217bf2ed1d1b0d9d6832 |
CVE-2022-0506 | Medium | 5.4 | 2022-02-08 | Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-0505 | Medium | 6.5 | 2022-02-08 | Cross-Site Request Forgery (CSRF) in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-0504 | Medium | 6.5 | 2022-02-08 | Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-24450 | High | 8.8 | 2022-02-08 | NATS nats-server before 2.7.2 has Incorrect Access Control. Any authenticated user can obtain the privileges of the System account by misusing the "dynamically… |
CVE-2022-23624 | High | 8.1 | 2022-02-07 | Frourio-express is a minimal full stack framework, for TypeScript. Frourio-express users who uses frourio-express version prior to v0.26.0 and integration with… |
CVE-2022-23623 | High | 8.1 | 2022-02-07 | Frourio is a full stack framework, for TypeScript. Frourio users who uses frourio version prior to v0.26.0 and integration with class-validator through `valida… |
CVE-2022-23613 | High | 7.8 | 2022-02-07 | xrdp is an open source remote desktop protocol (RDP) server. In affected versions an integer underflow leading to a heap overflow in the sesman server allows a… |
CVE-2022-21712 | High | 7.5 | 2022-02-07 | twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-ori… |
CVE-2022-21816 | Medium | 5.5 | 2022-02-07 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko), where a user in the guest OS can cause a GPU interrupt storm on the hyper… |
CVE-2022-21815 | Medium | 5.5 | 2022-02-07 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for private IOCTLs where a NULL pointer derefere… |
CVE-2022-21814 | Medium | 6.1 | 2022-02-07 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel driver package, where improper handling of insufficient permissions or privileges ma… |
CVE-2022-21813 | Medium | 6.1 | 2022-02-07 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel driver, where improper handling of insufficient permissions or privileges may allow… |
CVE-2022-22931 | Medium | 4.3 | 2022-02-07 | Fix of CVE-2021-40525 do not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file reposi… |
CVE-2022-23263 | High | 7.7 | 2022-02-07 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2022-23262 | Medium | 6.3 | 2022-02-07 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2022-23261 | Medium | 5.3 | 2022-02-07 | Microsoft Edge (Chromium-based) Tampering Vulnerability |
CVE-2022-0149 | Medium | 6.1 | 2022-02-07 | The WooCommerce Stored Exporter WordPress plugin before 2.7.1 was affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the woo_ce admin page. |
CVE-2022-0148 | Medium | 5.4 | 2022-02-07 | The All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs WordPress plugin before 2.0.4 was vulnerable to reflected XSS on the my-sticky-eleme… |
CVE-2022-23320 | High | 7.5 | 2022-02-07 | XMPie uStore 12.3.7244.0 allows for administrators to generate reports based on raw SQL queries. Since the application ships with default administrative creden… |
CVE-2022-0474 | Low | 2.4 | 2022-02-07 | Full list of recipients from customer users in a contact field could be disclosed in notification emails event when the notification is set to be sent to each… |
CVE-2022-0473 | Low | 3.8 | 2022-02-07 | OTRS administrators can configure dynamic field and inject malicious JavaScript code in the error message of the regular expression check. When used in the age… |
CVE-2022-23184 | Medium | 6.1 | 2022-02-07 | In affected Octopus Server versions when the server HTTP and HTTPS bindings are configured to localhost, Octopus Server will allow open redirects. |
CVE-2022-22679 | Medium | 6.5 | 2022-02-07 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in support service management in Synology DiskStation Manager (DSM… |
CVE-2022-22680 | Medium | 5.3 | 2022-02-07 | Exposure of sensitive information to an unauthorized actor vulnerability in Web Server in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote… |
CVE-2022-22833 | High | 7.5 | 2022-02-06 | An issue was discovered in Servisnet Tessa 0.0.2. An attacker can obtain sensitive information via a /js/app.js request. |
CVE-2022-24552 | Critical | 9.8 | 2022-02-06 | A flaw was found in the REST API in StarWind Stack. REST command, which manipulates a virtual disk, doesn’t check input parameters. Some of them go directly to… |
CVE-2022-24551 | High | 8.8 | 2022-02-06 | A flaw was found in StarWind Stack. The endpoint for setting a new password doesn’t check the current username and old password. An attacker could reset any lo… |
CVE-2022-22832 | Critical | 9.8 | 2022-02-06 | An issue was discovered in Servisnet Tessa 0.0.2. Authorization data is available via an unauthenticated /data-service/users/ request. |
CVE-2022-22831 | Critical | 9.8 | 2022-02-06 | An issue was discovered in Servisnet Tessa 0.0.2. An attacker can add a new sysadmin user via a manipulation of the Authorization HTTP header. |
CVE-2022-23206 | High | 7.5 | 2022-02-06 | In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST requ… |
CVE-2022-0502 | Medium | 5.4 | 2022-02-06 | Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v. |
CVE-2022-0501 | Medium | 6.1 | 2022-02-05 | Cross-site Scripting (XSS) - Reflected in Packagist ptrofimov/beanstalk_console prior to 1.7.12. |
CVE-2022-0437 | Medium | 6.1 | 2022-02-05 | Cross-site Scripting (XSS) - DOM in NPM karma prior to 6.3.14. |
CVE-2022-24115 | High | 7.8 | 2022-02-04 | Local privilege escalation due to unrestricted loading of unsigned libraries. The following products are affected: Acronis Cyber Protect Home Office (macOS) be… |
CVE-2022-24114 | High | 7.0 | 2022-02-04 | Local privilege escalation due to race condition on application startup. The following products are affected: Acronis Cyber Protect Home Office (macOS) before… |
CVE-2022-24113 | High | 7.8 | 2022-02-04 | Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis Cyber Protect 15 (Windows) be… |
CVE-2022-23980 | Medium | 4.7 | 2022-02-04 | Cross-Site Scripting (XSS) vulnerability discovered in Yasr – Yet Another Stars Rating WordPress plugin (versions <= 2.9.9), vulnerable at parameter 'source'. |
CVE-2022-23947 | High | 7.8 | 2022-02-04 | A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon DCodeNumber parsing functionality of KiCad EDA 6.0.1 and master com… |
CVE-2022-23946 | High | 7.8 | 2022-02-04 | A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon GCodeNumber parsing functionality of KiCad EDA 6.0.1 and master com… |
CVE-2022-23913 | High | 7.5 | 2022-02-04 | In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of memor… |
CVE-2022-23805 | High | 7.1 | 2022-02-04 | A security out-of-bounds read information disclosure vulnerability in Trend Micro Worry-Free Business Security Server could allow a local attacker to send garb… |
CVE-2022-23614 | High | 8.8 | 2022-02-04 | Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being… |
CVE-2022-23611 | High | 8.1 | 2022-02-04 | iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility. In affected versions iTunesRPC-Remastered did not properly sanitize image file p… |
CVE-2022-23609 | High | 8.3 | 2022-02-04 | iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility. In affected versions iTunesRPC-Remastered did not properly sanitize user input u… |
CVE-2022-23605 | Medium | 4.4 | 2022-02-04 | Wire webapp is a web client for the wire messaging protocol. In versions prior to 2022-01-27-production.0 expired ephemeral messages were not reliably removed… |
CVE-2022-23600 | Medium | 5.3 | 2022-02-04 | fleet is an open source device management, built on osquery. Versions prior to 4.9.1 expose a limited ability to spoof SAML authentication with missing audienc… |
CVE-2022-23595 | Medium | 5.3 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. When building an XLA compilation cache, if default settings are used, TensorFlow triggers a null point… |
CVE-2022-23594 | High | 8.8 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. The TFG dialect of TensorFlow (MLIR) makes several assumptions about the incoming `GraphDef` before co… |
CVE-2022-23593 | Medium | 5.9 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. The `simplifyBroadcast` function in the MLIR-TFRT infrastructure in TensorFlow is vulnerable to a segf… |
CVE-2022-23592 | High | 8.1 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. TensorFlow's type inference can cause a heap out of bounds read as the bounds checking is done in a `D… |
CVE-2022-23591 | High | 7.5 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. The `GraphDef` format in TensorFlow does not allow self recursive functions. The runtime assumes that… |
CVE-2022-23590 | Medium | 5.9 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. A `GraphDef` from a TensorFlow `SavedModel` can be maliciously altered to cause a TensorFlow process t… |
CVE-2022-23589 | Medium | 6.5 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. Under certain scenarios, Grappler component of TensorFlow can trigger a null pointer dereference. Ther… |
CVE-2022-23588 | Medium | 6.5 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a `SavedModel` such that Grappler optimizer… |
CVE-2022-23587 | High | 8.8 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. Under certain scenarios, Grappler component of TensorFlow is vulnerable to an integer overflow during… |
CVE-2022-23586 | Medium | 6.5 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a `SavedModel` such that assertions in `fun… |
CVE-2022-23585 | Medium | 4.3 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. When decoding PNG images TensorFlow can produce a memory leak if the image is invalid. After calling `… |
CVE-2022-23584 | High | 7.6 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a use after free behavior when decoding PNG images. After `png::CommonFreeD… |
CVE-2022-23583 | Medium | 6.5 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a `SavedModel` such that any binary op woul… |
CVE-2022-23582 | Medium | 6.5 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a `SavedModel` such that `TensorByteSize` w… |
CVE-2022-23581 | Medium | 6.5 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. The Grappler optimizer in TensorFlow can be used to cause a denial of service by altering a `SavedMode… |
CVE-2022-23580 | Medium | 6.5 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. During shape inference, TensorFlow can allocate a large vector based on a value from a tensor controll… |
CVE-2022-23579 | Medium | 6.5 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. The Grappler optimizer in TensorFlow can be used to cause a denial of service by altering a `SavedMode… |
CVE-2022-23578 | Medium | 4.3 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. If a graph node is invalid, TensorFlow can leak memory in the implementation of `ImmutableExecutorStat… |
CVE-2022-23577 | Medium | 6.5 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. The implementation of `GetInitOp` is vulnerable to a crash caused by dereferencing a null pointer. The… |
CVE-2022-23576 | Medium | 6.5 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. The implementation of `OpLevelCostEstimator::CalculateOutputSize` is vulnerable to an integer overflow… |
CVE-2022-23575 | Medium | 6.5 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. The implementation of `OpLevelCostEstimator::CalculateTensorSize` is vulnerable to an integer overflow… |
CVE-2022-23574 | High | 8.8 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. There is a typo in TensorFlow's `SpecializeType` which results in heap OOB read/write. Due to a typo… |
CVE-2022-23573 | High | 7.6 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. The implementation of `AssignOp` can result in copying uninitialized data to a new tensor. This later… |
CVE-2022-23572 | Medium | 6.5 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. Under certain scenarios, TensorFlow can fail to specialize a type during shape inference. This case is… |
CVE-2022-23571 | Medium | 6.5 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. When decoding a tensor from protobuf, a TensorFlow process can encounter cases where a `CHECK` asserti… |
CVE-2022-23570 | Medium | 6.5 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. When decoding a tensor from protobuf, TensorFlow might do a null-dereference if attributes of some mut… |
CVE-2022-23566 | High | 8.8 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. TensorFlow is vulnerable to a heap OOB write in `Grappler`. The `set_output` function writes to an arr… |
CVE-2022-23565 | Medium | 6.5 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. An attacker can trigger denial of service via assertion failure by altering a `SavedModel` on disk suc… |
CVE-2022-23564 | Medium | 6.5 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. When decoding a resource handle tensor from protobuf, a TensorFlow process can encounter cases where a… |
CVE-2022-23563 | High | 7.1 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. In multiple places, TensorFlow uses `tempfile.mktemp` to create temporary files. While this is accepta… |
CVE-2022-23562 | High | 7.6 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. The implementation of `Range` suffers from integer overflows. These can trigger undefined behavior or… |
CVE-2022-23561 | High | 8.8 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would cause a write outside of bounds of an array in TFLite… |
CVE-2022-23560 | High | 8.8 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would allow limited reads and writes outside of arrays in TF… |
CVE-2022-23559 | High | 8.8 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would cause an integer overflow in embedding lookup operatio… |
CVE-2022-23558 | High | 7.6 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would cause an integer overflow in `TfLiteIntArrayCreate`. T… |
CVE-2022-23557 | Medium | 6.5 | 2022-02-04 | Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would trigger a division by zero in `BiasAndClamp` implement… |
CVE-2022-23379 | Critical | 9.8 | 2022-02-04 | Emlog v6.0 was discovered to contain a SQL injection vulnerability via the $TagID parameter of getblogidsfromtagid(). |
CVE-2022-22987 | Critical | 9.8 | 2022-02-04 | The affected product has a hardcoded private key available inside the project folder, which may allow an attacker to achieve Web Server login and perform furth… |
CVE-2022-22939 | Medium | 4.9 | 2022-02-04 | VMware Cloud Foundation contains an information disclosure vulnerability due to logging of credentials in plain-text within multiple log files on the SDDC Mana… |
CVE-2022-22804 | Medium | 5.4 | 2022-02-04 | A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could allow an authenticated attacker… |
CVE-2022-22727 | High | 8.8 | 2022-02-04 | A CWE-20: Improper Input Validation vulnerability exists that could allow an unauthenticated attacker to view data, change settings, impact availability of the… |
CVE-2022-22726 | Medium | 6.5 | 2022-02-04 | A CWE-20: Improper Input Validation vulnerability exists that could allow arbitrary files on the server to be read by authenticated users through a limited ope… |
CVE-2022-22725 | High | 8.8 | 2022-02-04 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could lead to a buffer overflow causing program crashes and arbitrary code exec… |
CVE-2022-22724 | High | 7.5 | 2022-02-04 | A CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service on ports 80 (HTTP) and 502 (Modbus), when sending a larg… |
CVE-2022-22723 | High | 8.8 | 2022-02-04 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could lead to a buffer overflow causing program crashes and arbitrary code exec… |
CVE-2022-22722 | High | 7.5 | 2022-02-04 | A CWE-798: Use of Hard-coded Credentials vulnerability exists that could result in information disclosure. If an attacker were to obtain the SSH cryptographic… |
CVE-2022-22689 | High | 8.8 | 2022-02-04 | CA Harvest Software Change Manager versions 13.0.3, 13.0.4, 14.0.0, and 14.0.1, contain a vulnerability in the CSV export functionality, due to insufficient in… |
CVE-2022-22150 | High | 8.8 | 2022-02-04 | A memory corruption vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 11.1.0.52543. A specially-crafted PDF document can tr… |