2022 CVEs (page 257)
Page 257 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-0487 | Medium | 5.5 | 2022-02-04 | A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove in drivers/memstick/host/rtsx_usb_ms.c in memstick in the Linux kernel. In this flaw, a loca… |
CVE-2022-0484 | High | 8.8 | 2022-02-04 | Lack of validation of URLs causes Mirantis Container Cloud Lens Extension before v3.1.1 to open external programs other than the default browser to perform sig… |
CVE-2022-0481 | High | 7.5 | 2022-02-04 | NULL Pointer Dereference in Homebrew mruby prior to 3.2. |
CVE-2022-0472 | Medium | 5.4 | 2022-02-04 | Unrestricted Upload of File with Dangerous Type in Packagist jsdecena/laracom prior to v2.0.9. |
CVE-2022-0381 | Medium | 6.1 | 2022-02-04 | The Embed Swagger WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient escaping/sanitization and validation via the url paramet… |
CVE-2022-0380 | Medium | 6.1 | 2022-02-04 | The Fotobook WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient escaping and the use of $_SERVER['PHP_SELF'] found in the ~/o… |
CVE-2022-0365 | Critical | 9.1 | 2022-02-04 | The affected product is vulnerable to an authenticated OS command injection, which may allow an attacker to inject and execute arbitrary shell commands as the… |
CVE-2022-0317 | Medium | 4.0 | 2022-02-04 | An improper input validation vulnerability in go-attestation before 0.3.3 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing A… |
CVE-2022-0264 | Medium | 5.5 | 2022-02-04 | A vulnerability was found in the Linux kernel's eBPF verifier when handling internal data structures. Internal memory locations could be returned to userspace… |
CVE-2022-0218 | High | 8.3 | 2022-02-04 | The WP HTML Mail WordPress plugin is vulnerable to unauthorized access which allows unauthenticated attackers to retrieve and modify theme settings due to a mi… |
CVE-2022-23330 | High | 8.8 | 2022-02-04 | A remote code execution (RCE) vulnerability in HelloWorldAddonController.java of jpress v4.2.0 allows attackers to execute arbitrary code via a crafted JAR pac… |
CVE-2022-23329 | Critical | 9.8 | 2022-02-04 | A vulnerability in ${"freemarker.template.utility.Execute"?new() of UJCMS Jspxcms v10.2.0 allows attackers to execute arbitrary commands via uploading maliciou… |
CVE-2022-24348 | High | 7.7 | 2022-02-04 | Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in repository.go. For example… |
CVE-2022-24448 | Low | 3.3 | 2022-02-04 | An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_a… |
CVE-2022-24129 | High | 8.2 | 2022-02-04 | The OIDC OP plugin before 3.0.4 for Shibboleth Identity Provider allows server-side request forgery (SSRF) due to insufficient restriction of the request_uri p… |
CVE-2022-24249 | Medium | 5.5 | 2022-02-04 | A Null Pointer Dereference vulnerability exists in GPAC 1.1.0 via the xtra_box_write function in /box_code_base.c, which causes a Denial of Service. This vulne… |
CVE-2022-24262 | High | 8.8 | 2022-02-04 | The config restore function of Voipmonitor GUI before v24.96 does not properly check files sent as restore archives, allowing remote attackers to execute arbit… |
CVE-2022-24260 | Critical | 9.8 | 2022-02-04 | A SQL injection vulnerability in Voipmonitor GUI before v24.96 allows attackers to escalate privileges to the Administrator level. |
CVE-2022-24259 | Critical | 9.8 | 2022-02-04 | An incorrect check in the component cdr.php of Voipmonitor GUI before v24.96 allows unauthenticated attackers to escalate privileges via a crafted request. |
CVE-2022-23316 | Medium | 4.9 | 2022-02-04 | An issue was discovered in taoCMS v3.0.2. There is an arbitrary file read vulnerability that can read any files via admin.php?action=file&ctrl=download&path=… |
CVE-2022-24172 | High | 7.5 | 2022-02-04 | Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formAddDhcpBindRule. This vulnerability allows attacke… |
CVE-2022-24171 | Critical | 9.8 | 2022-02-04 | Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetPppoeServer. This vulnerabilit… |
CVE-2022-24170 | Critical | 9.8 | 2022-02-04 | Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetIpSecTunnel. This vulnerabilit… |
CVE-2022-24169 | High | 7.5 | 2022-02-04 | Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formIPMacBindAdd. This vulnerability allows attackers… |
CVE-2022-24168 | Critical | 9.8 | 2022-02-04 | Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetIpGroup. This vulnerability al… |
CVE-2022-24167 | Critical | 9.8 | 2022-02-04 | Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetDMZ. This vulnerability allows… |
CVE-2022-24166 | High | 7.5 | 2022-02-04 | Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formSetSysTime. This vulnerability allows attackers to… |
CVE-2022-24165 | Critical | 9.8 | 2022-02-04 | Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetQvlanList. This vulnerability… |
CVE-2022-24164 | High | 7.5 | 2022-02-04 | Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formSetVirtualSer. This vulnerability allows attackers… |
CVE-2022-24163 | High | 7.5 | 2022-02-04 | Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function fromSetSysTime. This vulnerability allows attackers to cause a Denial of S… |
CVE-2022-24162 | High | 7.5 | 2022-02-04 | Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function saveParentControlInfo. This vulnerability allows attackers to cause a Deni… |
CVE-2022-24161 | High | 7.5 | 2022-02-04 | Tenda AX3 v16.03.12.10_CN was discovered to contain a heap overflow in the function GetParentControlInfo. This vulnerability allows attackers to cause a Denial… |
CVE-2022-24160 | High | 7.5 | 2022-02-04 | Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function formSetDeviceName. This vulnerability allows attackers to cause a Denial o… |
CVE-2022-24159 | High | 7.5 | 2022-02-04 | Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function formSetPPTPServer. This vulnerability allows attackers to cause a Denial o… |
CVE-2022-24158 | High | 7.5 | 2022-02-04 | Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function fromSetIpMacBind. This vulnerability allows attackers to cause a Denial of… |
CVE-2022-24157 | High | 7.5 | 2022-02-04 | Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function formSetMacFilterCfg. This vulnerability allows attackers to cause a Denial… |
CVE-2022-24156 | High | 7.5 | 2022-02-04 | Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function formSetVirtualSer. This vulnerability allows attackers to cause a Denial o… |
CVE-2022-24155 | High | 7.5 | 2022-02-04 | Tenda AX3 v16.03.12.10_CN was discovered to contain a heap overflow in the function setSchedWifi. This vulnerability allows attackers to cause a Denial of Serv… |
CVE-2022-24154 | High | 7.5 | 2022-02-04 | Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function formSetRebootTimer. This vulnerability allows attackers to cause a Denial… |
CVE-2022-24153 | High | 7.5 | 2022-02-04 | Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function formAddMacfilterRule. This vulnerability allows attackers to cause a Denia… |
CVE-2022-24152 | High | 7.5 | 2022-02-04 | Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function fromSetRouteStatic. This vulnerability allows attackers to cause a Denial… |
CVE-2022-24151 | High | 7.5 | 2022-02-04 | Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function fromSetWifiGusetBasic. This vulnerability allows attackers to cause a Deni… |
CVE-2022-24150 | Critical | 9.8 | 2022-02-04 | Tenda AX3 v16.03.12.10_CN was discovered to contain a command injection vulnerability in the function formSetSafeWanWebMan. This vulnerability allows attackers… |
CVE-2022-24149 | High | 7.5 | 2022-02-04 | Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function fromSetWirelessRepeat. This vulnerability allows attackers to cause a Deni… |
CVE-2022-24148 | Critical | 9.8 | 2022-02-04 | Tenda AX3 v16.03.12.10_CN was discovered to contain a command injection vulnerability in the function mDMZSetCfg. This vulnerability allows attackers to execut… |
CVE-2022-24147 | High | 7.5 | 2022-02-04 | Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function fromAdvSetMacMtuWan. This vulnerability allows attackers to cause a Denial… |
CVE-2022-24146 | High | 7.5 | 2022-02-04 | Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function formSetQosBand. This vulnerability allows attackers to cause a Denial of S… |
CVE-2022-24145 | High | 7.5 | 2022-02-04 | Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function formWifiBasicSet. This vulnerability allows attackers to cause a Denial of… |
CVE-2022-24144 | Critical | 9.8 | 2022-02-04 | Tenda AX3 v16.03.12.10_CN was discovered to contain a command injection vulnerability in the function WanParameterSetting. This vulnerability allows attackers… |
CVE-2022-24143 | High | 7.5 | 2022-02-04 | Tenda AX3 v16.03.12.10_CN and AX12 22.03.01.2_CN was discovered to contain a stack overflow in the function form_fast_setting_wifi_set. This vulnerability allo… |
CVE-2022-24142 | High | 7.5 | 2022-02-04 | Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function formSetFirewallCfg. This vulnerability allows attackers to cause a Denial… |
CVE-2022-24307 | Critical | 9.8 | 2022-02-03 | Mastodon before 3.3.2 and 3.4.x before 3.4.6 has incorrect access control because it does not compact incoming signed JSON-LD activities. (JSON-LD signing has… |
CVE-2022-21741 | Medium | 6.5 | 2022-02-03 | Tensorflow is an Open Source Machine Learning Framework. ### Impact An attacker can craft a TFLite model that would trigger a division by zero in the implement… |
CVE-2022-21740 | High | 7.6 | 2022-02-03 | Tensorflow is an Open Source Machine Learning Framework. The implementation of `SparseCountSparseOutput` is vulnerable to a heap overflow. The fix will be incl… |
CVE-2022-21739 | Medium | 6.5 | 2022-02-03 | Tensorflow is an Open Source Machine Learning Framework. The implementation of `QuantizedMaxPool` has an undefined behavior where user controlled inputs can tr… |
CVE-2022-21738 | Medium | 6.5 | 2022-02-03 | Tensorflow is an Open Source Machine Learning Framework. The implementation of `SparseCountSparseOutput` can be made to crash a TensorFlow process by an intege… |
CVE-2022-21737 | Medium | 6.5 | 2022-02-03 | Tensorflow is an Open Source Machine Learning Framework. The implementation of `*Bincount` operations allows malicious users to cause denial of service by pass… |
CVE-2022-23569 | Medium | 6.5 | 2022-02-03 | Tensorflow is an Open Source Machine Learning Framework. Multiple operations in TensorFlow can be used to trigger a denial of service via `CHECK`-fails (i.e… |
CVE-2022-21735 | Medium | 6.5 | 2022-02-03 | Tensorflow is an Open Source Machine Learning Framework. The implementation of `FractionalMaxPool` can be made to crash a TensorFlow process via a division by… |
CVE-2022-21734 | Medium | 6.5 | 2022-02-03 | Tensorflow is an Open Source Machine Learning Framework. The implementation of `MapStage` is vulnerable a `CHECK`-fail if the key tensor is not a scalar. The f… |
CVE-2022-21729 | Medium | 6.5 | 2022-02-03 | Tensorflow is an Open Source Machine Learning Framework. The implementation of `UnravelIndex` is vulnerable to a division by zero caused by an integer overflow… |
CVE-2022-21725 | Medium | 6.5 | 2022-02-03 | Tensorflow is an Open Source Machine Learning Framework. The estimator for the cost of some convolution operations can be made to execute a division by 0. The… |
CVE-2022-23568 | Medium | 6.5 | 2022-02-03 | Tensorflow is an Open Source Machine Learning Framework. The implementation of `AddManySparseToTensorsMap` is vulnerable to an integer overflow which results i… |
CVE-2022-23567 | Medium | 6.5 | 2022-02-03 | Tensorflow is an Open Source Machine Learning Framework. The implementations of `Sparse*Cwise*` ops are vulnerable to integer overflows. These can be used to t… |
CVE-2022-21736 | High | 7.6 | 2022-02-03 | Tensorflow is an Open Source Machine Learning Framework. The implementation of `SparseTensorSliceDataset` has an undefined behavior: under certain condition it… |
CVE-2022-21733 | Medium | 4.3 | 2022-02-03 | Tensorflow is an Open Source Machine Learning Framework. The implementation of `StringNGrams` can be used to trigger a denial of service attack by causing an o… |
CVE-2022-21732 | Medium | 4.3 | 2022-02-03 | Tensorflow is an Open Source Machine Learning Framework. The implementation of `ThreadPoolHandle` can be used to trigger a denial of service attack by allocati… |
CVE-2022-21731 | Medium | 6.5 | 2022-02-03 | Tensorflow is an Open Source Machine Learning Framework. The implementation of shape inference for `ConcatV2` can be used to trigger a denial of service attack… |
CVE-2022-21730 | High | 8.1 | 2022-02-03 | Tensorflow is an Open Source Machine Learning Framework. The implementation of `FractionalAvgPoolGrad` does not consider cases where the input tensors are inva… |
CVE-2022-21728 | High | 8.1 | 2022-02-03 | Tensorflow is an Open Source Machine Learning Framework. The implementation of shape inference for `ReverseSequence` does not fully validate the value of `batc… |
CVE-2022-21727 | High | 7.6 | 2022-02-03 | Tensorflow is an Open Source Machine Learning Framework. The implementation of shape inference for `Dequantize` is vulnerable to an integer overflow weakness… |
CVE-2022-21726 | High | 8.1 | 2022-02-03 | Tensorflow is an Open Source Machine Learning Framework. The implementation of `Dequantize` does not fully validate the value of `axis` and can result in heap… |
CVE-2022-24121 | High | 7.5 | 2022-02-03 | SQL Injection vulnerability discovered in Unified Office Total Connect Now that would allow an attacker to extract sensitive information through a cookie param… |
CVE-2022-23873 | High | 8.8 | 2022-02-03 | Victor CMS v1.0 was discovered to contain a SQL injection vulnerability that allows attackers to inject arbitrary commands via 'user_firstname' parameter. |
CVE-2022-23871 | Medium | 5.4 | 2022-02-03 | Multiple cross-site scripting (XSS) vulnerabilities in the component outcomes_addProcess.php of Gibbon CMS v22.0.01 allow attackers to execute arbitrary web sc… |
CVE-2022-23357 | Critical | 9.1 | 2022-02-03 | mozilo2.0 was discovered to be vulnerable to directory traversal attacks via the parameter curent_dir. |
CVE-2022-24031 | High | 8.2 | 2022-02-03 | An issue was discovered in NvmExpressDxe in Insyde InsydeH2O with kernel 5.1 through 5.5. An SMM memory corruption vulnerability allows an attacker to write fi… |
CVE-2022-24030 | High | 7.5 | 2022-02-03 | An issue was discovered in AhciBusDxe in Insyde InsydeH2O with kernel 5.1 through 5.5. An SMM memory corruption vulnerability allows an attacker to write fixed… |
CVE-2022-23833 | High | 7.5 | 2022-02-03 | An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms coul… |
CVE-2022-22818 | Medium | 6.1 | 2022-02-03 | The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead t… |
CVE-2022-24069 | High | 8.2 | 2022-02-03 | An issue was discovered in AhciBusDxe in Insyde InsydeH2O with kernel 5.0 before 05.08.41, 5.1 before 05.16.29, 5.2 before 05.26.29, 5.3 before 05.35.29, 5.4 b… |
CVE-2022-0432 | Medium | 6.1 | 2022-02-02 | Prototype Pollution in GitHub repository mastodon/mastodon prior to 3.5.0. |
CVE-2022-0443 | High | 7.8 | 2022-02-02 | Use After Free in GitHub repository vim/vim prior to 8.2. |
CVE-2022-22510 | High | 7.5 | 2022-02-02 | Codesys Profinet in version V4.2.0.0 is prone to null pointer dereference that allows a denial of service (DoS) attack of an unauthenticated user via SNMP. |
CVE-2022-22509 | High | 8.8 | 2022-02-02 | In Phoenix Contact FL SWITCH Series 2xxx in version 3.00 an incorrect privilege assignment allows an low privileged user to enable full access to the device co… |
CVE-2022-21817 | Critical | 9.3 | 2022-02-02 | NVIDIA Omniverse Launcher contains a Cross-Origin Resource Sharing (CORS) vulnerability which can allow an unprivileged remote attacker, if they can get user t… |
CVE-2022-21724 | High | 7.0 | 2022-02-02 | pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The system us… |
CVE-2022-0366 | High | 8.8 | 2022-02-02 | An authenticated and authorized agent user could potentially gain administrative access via an SQLi vulnerability to Capsule8 Console between versions 4.6.0 an… |
CVE-2022-24301 | Medium | 6.5 | 2022-02-02 | In Minetest before 5.4.0, players can add or subtract items from a different player's inventory. |
CVE-2022-24300 | Critical | 9.8 | 2022-02-02 | Minetest before 5.4.0 allows attackers to add or modify arbitrary meta fields of the same item stack as saved user input, aka ItemStack meta injection. |
CVE-2022-24198 | Medium | 6.5 | 2022-02-01 | iText v7.1.17 was discovered to contain an out-of-bounds exception via the component ARCFOUREncryption.encryptARCFOUR, which allows attackers to cause a Denial… |
CVE-2022-24197 | Medium | 6.5 | 2022-02-01 | iText v7.1.17 was discovered to contain a stack-based buffer overflow via the component ByteBuffer.append, which allows attackers to cause a Denial of Service… |
CVE-2022-24196 | Medium | 6.5 | 2022-02-01 | iText v7.1.17, up to (exluding)": 7.1.18 and 7.2.2 was discovered to contain an out-of-memory error via the component readStreamBytesRaw, which allows attacker… |
CVE-2022-24223 | Critical | 9.8 | 2022-02-01 | AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php. |
CVE-2022-24222 | Critical | 9.8 | 2022-02-01 | eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/edit_user.php. |
CVE-2022-24221 | Critical | 9.8 | 2022-02-01 | eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/functions/functions.php. |
CVE-2022-24220 | Critical | 9.8 | 2022-02-01 | eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/edit_post.php. |
CVE-2022-24219 | Critical | 9.8 | 2022-02-01 | eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/edit_page.php. |
CVE-2022-24218 | Critical | 9.1 | 2022-02-01 | An issue in /admin/delete_image.php of eliteCMS v1.0 allows attackers to delete arbitrary files. |
CVE-2022-23601 | High | 8.1 | 2022-02-01 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony form component provides a CSRF protection mechani… |