2022 CVEs (page 258)
Page 258 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-23409 | Medium | 4.9 | 2022-01-31 | The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in Controller.php. |
CVE-2022-24130 | Medium | 5.5 | 2022-01-31 | xterm through Patch 370, when Sixel support is enabled, allows attackers to trigger a buffer overflow in set_sixel in graphics_sixel.c via crafted text. |
CVE-2022-0413 | High | 7.8 | 2022-01-30 | Use After Free in GitHub repository vim/vim prior to 8.2. |
CVE-2022-0408 | High | 7.8 | 2022-01-30 | Stack-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. |
CVE-2022-0407 | High | 7.8 | 2022-01-30 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. |
CVE-2022-0339 | Critical | 9.8 | 2022-01-30 | Server-Side Request Forgery (SSRF) in Pypi calibreweb prior to 0.6.16. |
CVE-2022-0273 | Medium | 6.5 | 2022-01-30 | Improper Access Control in Pypi calibreweb prior to 0.6.16. |
CVE-2022-22919 | Medium | 6.1 | 2022-01-30 | Adenza AxiomSL ControllerView through 10.8.1 allows redirection for SSO login URLs. |
CVE-2022-24032 | Medium | 5.3 | 2022-01-30 | Adenza AxiomSL ControllerView through 10.8.1 is vulnerable to user enumeration. An attacker can identify valid usernames on the platform because a failed login… |
CVE-2022-24124 | High | 7.5 | 2022-01-29 | The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations. |
CVE-2022-24123 | Critical | 9.0 | 2022-01-29 | MarkText through 0.16.3 does not sanitize the input of a mermaid block before rendering. This could lead to Remote Code Execution via a .md file containing a m… |
CVE-2022-24122 | High | 7.8 | 2022-01-29 | kernel/ucount.c in the Linux kernel 5.14 through 5.16.4, when unprivileged user namespaces are enabled, allows a use-after-free and privilege escalation becaus… |
CVE-2022-23599 | Medium | 4.3 | 2022-01-28 | Products.ATContentTypes are the core content types for Plone 2.1 - 4.3. Versions of Plone that are dependent on Products.ATContentTypes prior to version 3.0.6… |
CVE-2022-23598 | Medium | 6.1 | 2022-01-28 | laminas-form is a package for validating and displaying simple and complex forms. When rendering validation error messages via the `formElementErrors()` view h… |
CVE-2022-21721 | Medium | 5.9 | 2022-01-28 | Next.js is a React framework. Starting with version 12.0.0 and prior to version 12.0.9, vulnerable code could allow a bad actor to trigger a denial of service… |
CVE-2022-0395 | Medium | 5.4 | 2022-01-28 | Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v. |
CVE-2022-0393 | High | 7.1 | 2022-01-28 | Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. |
CVE-2022-0392 | High | 7.8 | 2022-01-28 | Heap-based Buffer Overflow in GitHub repository vim prior to 8.2. |
CVE-2022-0352 | Medium | 6.1 | 2022-01-28 | Cross-site Scripting (XSS) - Reflected in Pypi calibreweb prior to 0.6.16. |
CVE-2022-23889 | Medium | 5.3 | 2022-01-28 | The comment function in YzmCMS v6.3 was discovered as being able to be operated concurrently, allowing attackers to create an unusually large number of comment… |
CVE-2022-23888 | High | 8.8 | 2022-01-28 | YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgey (CSRF) via the component /yzmcms/comment/index/init.html. |
CVE-2022-23887 | Medium | 6.5 | 2022-01-28 | YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily delete user accounts via /admin/admin_manage/de… |
CVE-2022-23979 | Medium | 4.8 | 2022-01-28 | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability discovered in Ultimate Reviews WordPress plugin (versions <= 3.0.15). |
CVE-2022-23727 | High | 7.8 | 2022-01-28 | There is a privilege escalation vulnerability in some webOS TVs. Due to wrong setting environments, local attacker is able to perform specific operation to exp… |
CVE-2022-23456 | Medium | 5.5 | 2022-01-28 | Potential arbitrary file deletion vulnerability has been identified in HP Support Assistant software. |
CVE-2022-22994 | High | 8.8 | 2022-01-28 | A remote code execution vulnerability was discovered on Western Digital My Cloud devices where an attacker could trick a NAS device into loading through an uns… |
CVE-2022-22993 | High | 7.8 | 2022-01-28 | A limited SSRF vulnerability was discovered on Western Digital My Cloud devices that could allow an attacker to impersonate a server and reach any page on the… |
CVE-2022-22992 | High | 7.8 | 2022-01-28 | A command injection remote code execution vulnerability was discovered on Western Digital My Cloud Devices that could allow an attacker to execute arbitrary sy… |
CVE-2022-22938 | Medium | 6.5 | 2022-01-28 | VMware Workstation (16.x prior to 16.2.2) and Horizon Client for Windows (5.x prior to 5.5.3) contains a denial-of-service vulnerability in the Cortado ThinPri… |
CVE-2022-22791 | Medium | 6.6 | 2022-01-28 | SYNEL - eharmony Authenticated Blind & Stored XSS. Inject JS code into the "comments" field could lead to potential stealing of cookies, loading of HTML tags a… |
CVE-2022-22790 | Medium | 5.6 | 2022-01-28 | SYNEL - eharmony Directory Traversal. Directory Traversal - is an attack against a server or a Web application aimed at unauthorized access to the file system… |
CVE-2022-21801 | High | 7.5 | 2022-01-28 | A denial of service vulnerability exists in the netserver recv_command functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted network reque… |
CVE-2022-21796 | High | 8.2 | 2022-01-28 | A memory corruption vulnerability exists in the netserver parse_command_list functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP re… |
CVE-2022-21236 | High | 7.5 | 2022-01-28 | An information disclosure vulnerability exists due to a web server misconfiguration in the Reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP reque… |
CVE-2022-21217 | Critical | 9.8 | 2022-01-28 | An out-of-bounds write vulnerability exists in the device TestEmail functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted network request… |
CVE-2022-21199 | Medium | 5.9 | 2022-01-28 | An information disclosure vulnerability exists due to the hardcoded TLS key of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted man-in-the-middle atta… |
CVE-2022-21134 | High | 7.5 | 2022-01-28 | A firmware update vulnerability exists in the "update" firmware checks functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTT… |
CVE-2022-22868 | Medium | 4.8 | 2022-01-28 | Gibbon CMS v22.0.01 was discovered to contain a cross-site scripting (XSS) vulnerability, that allows attackers to inject arbitrary script via name parameters. |
CVE-2022-22294 | Critical | 9.8 | 2022-01-28 | A SQL injection vulnerability exists in ZFAKA<=1.43 which an attacker can use to complete SQL injection in the foreground and add a background administrator ac… |
CVE-2022-23863 | Medium | 6.5 | 2022-01-28 | Zoho ManageEngine Desktop Central before 10.1.2137.10 allows an authenticated user to change any user's login password. |
CVE-2022-23098 | High | 7.5 | 2022-01-28 | An issue was discovered in the DNS proxy in Connman through 1.40. The TCP server reply implementation has an infinite loop if no data is received. |
CVE-2022-23097 | Critical | 9.1 | 2022-01-28 | An issue was discovered in the DNS proxy in Connman through 1.40. forward_dns_reply mishandles a strnlen call, leading to an out-of-bounds read. |
CVE-2022-23096 | Critical | 9.1 | 2022-01-28 | An issue was discovered in the DNS proxy in Connman through 1.40. The TCP server reply implementation lacks a check for the presence of sufficient Header Data… |
CVE-2022-24071 | Medium | 4.3 | 2022-01-28 | A Built-in extension in Whale browser before 3.12.129.46 allows attackers to compromise the rendering process which could lead to controlling browser internal… |
CVE-2022-21720 | Medium | 4.9 | 2022-01-28 | GLPI is a free asset and IT management software package. Prior to version 9.5.7, an entity administrator is capable of retrieving normally inaccessible data vi… |
CVE-2022-0394 | Medium | 5.4 | 2022-01-28 | Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v. |
CVE-2022-21719 | Medium | 6.1 | 2022-01-28 | GLPI is a free asset and IT management software package. All GLPI versions prior to 9.5.7 are vulnerable to reflected cross-site scripting. Version 9.5.7 conta… |
CVE-2022-0348 | Medium | 5.4 | 2022-01-27 | Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2. |
CVE-2022-23181 | High | 7.0 | 2022-01-27 | The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to… |
CVE-2022-0372 | Medium | 5.4 | 2022-01-27 | Cross-site Scripting (XSS) - Stored in Packagist bytefury/crater prior to 6.0.2. |
CVE-2022-22828 | High | 7.5 | 2022-01-27 | An insecure direct object reference for the file-download URL in Synametrics SynaMan before 5.0 allows a remote attacker to access unshared files via a modifie… |
CVE-2022-0387 | Medium | 5.4 | 2022-01-27 | Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v. |
CVE-2022-0370 | Medium | 5.4 | 2022-01-27 | Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v. |
CVE-2022-21723 | Critical | 9.1 | 2022-01-27 | PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN… |
CVE-2022-21722 | Critical | 9.1 | 2022-01-27 | PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN… |
CVE-2022-22852 | Medium | 5.4 | 2022-01-26 | A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodtester Hospital's Patient Records Management System 1.0 via the description parameter in r… |
CVE-2022-21686 | Critical | 9.0 | 2022-01-26 | PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside… |
CVE-2022-23993 | Medium | 6.1 | 2022-01-26 | /usr/local/www/pkg.php in pfSense CE before 2.6.0 and pfSense Plus before 22.01 uses $_REQUEST['pkg_filter'] in a PHP echo call, causing XSS. |
CVE-2022-23990 | High | 7.5 | 2022-01-26 | Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function. |
CVE-2022-22850 | Medium | 5.4 | 2022-01-26 | A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodtester Hospital's Patient Records Management System 1.0 via the description parameter in r… |
CVE-2022-0368 | High | 7.8 | 2022-01-26 | Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. |
CVE-2022-22851 | Medium | 5.4 | 2022-01-26 | A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodtester Hospital's Patient Records Management System 1.0 via the specialization parameter i… |
CVE-2022-0379 | Medium | 5.4 | 2022-01-26 | Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-0378 | Medium | 5.4 | 2022-01-26 | Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-0362 | Critical | 9.8 | 2022-01-26 | SQL Injection in Packagist showdoc/showdoc prior to 2.10.3. |
CVE-2022-0361 | High | 7.8 | 2022-01-26 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. |
CVE-2022-0203 | Medium | 5.3 | 2022-01-26 | Improper Access Control in GitHub repository crater-invoice/crater prior to 6.0.2. |
CVE-2022-0359 | High | 7.8 | 2022-01-26 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. |
CVE-2022-22932 | Medium | 5.3 | 2022-01-26 | Apache Karaf obr:* commands and run goal on the karaf-maven-plugin have partial path traversal which allows to break out of expected folder. The risk is low as… |
CVE-2022-0251 | Medium | 5.4 | 2022-01-26 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.2.10. |
CVE-2022-0375 | Medium | 4.8 | 2022-01-26 | Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v. |
CVE-2022-0374 | Medium | 5.4 | 2022-01-26 | Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v. |
CVE-2022-21944 | High | 7.8 | 2022-01-26 | A UNIX Symbolic Link (Symlink) Following vulnerability in the systemd service file for watchman of openSUSE Backports SLE-15-SP3, Factory allows local attacker… |
CVE-2022-23968 | High | 7.5 | 2022-01-26 | Xerox VersaLink devices on specific versions of firmware before 2022-01-26 allow remote attackers to brick the device via a crafted TIFF file in an unauthentic… |
CVE-2022-0355 | High | 8.8 | 2022-01-26 | Improper Removal of Sensitive Information Before Storage or Transfer in NPM simple-get prior to 4.0.1. |
CVE-2022-23959 | Critical | 9.1 | 2022-01-26 | In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0… |
CVE-2022-23258 | Medium | 4.3 | 2022-01-25 | Microsoft Edge for Android Spoofing Vulnerability |
CVE-2022-23032 | Medium | 5.3 | 2022-01-25 | In all versions before 7.2.1.4, when proxy settings are configured in the network access resource of a BIG-IP APM system, connecting BIG-IP Edge Client on Mac… |
CVE-2022-23031 | Medium | 4.9 | 2022-01-25 | On BIG-IP FPS, ASM, and Advanced WAF versions 16.1.x before 16.1.1, 15.1.x before 15.1.4, and 14.1.x before 14.1.4.4, an XML External Entity (XXE) vulnerabilit… |
CVE-2022-23030 | Medium | 5.3 | 2022-01-25 | On version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.5, and all versions of 13.1.x, when the BIG-IP Virtual Edition (VE) uses the ixlv… |
CVE-2022-23029 | Medium | 5.3 | 2022-01-25 | On BIG-IP version 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, when a FastL4 profile is… |
CVE-2022-23028 | Medium | 5.3 | 2022-01-25 | On BIG-IP AFM version 16.x before 16.1.0, 15.1.x before 15.1.5, 14.1.x before 14.1.4.5, and all versions of 13.1.x, when global AFM SYN cookie protection (TCP… |
CVE-2022-23027 | Medium | 5.3 | 2022-01-25 | On BIG-IP versions 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, 13.1.x beginning in 13.1.3.6, 12.1.5.3-12.1.6, and 11.6.5.2, when a FastL4 profile and an HTTP… |
CVE-2022-23026 | Medium | 4.3 | 2022-01-25 | On BIG-IP ASM & Advanced WAF version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.5, and all versions of 13.1.x and 12.1.x, an authentica… |
CVE-2022-23025 | High | 7.5 | 2022-01-25 | On BIG-IP version 16.1.x before 16.1.1, 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, and all versions of 13.1.x, when a SIP ALG profile is configured on a vir… |
CVE-2022-23024 | High | 7.5 | 2022-01-25 | On BIG-IP AFM version 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.2, and all versions of 13.1.x, when the IPsec application layer gateway… |
CVE-2022-23023 | Medium | 6.5 | 2022-01-25 | On BIG-IP version 16.1.x before 16.1.2.1, 15.1.x before 15.1.5, 14.1.x before 14.1.4.5, and all versions of 13.1.x and 12.1.x, and BIG-IQ all versions of 8.x a… |
CVE-2022-23022 | High | 7.5 | 2022-01-25 | On BIG-IP version 16.1.x before 16.1.2, when an HTTP profile is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkern… |
CVE-2022-23021 | High | 7.5 | 2022-01-25 | On BIG-IP version 16.1.x before 16.1.2, when any of the following configurations are configured on a virtual server, undisclosed requests can cause the Traffic… |
CVE-2022-23020 | High | 7.5 | 2022-01-25 | On BIG-IP version 16.1.x before 16.1.2, when the 'Respond on Error' setting is enabled on the Request Logging profile and configured on a virtual server, undis… |
CVE-2022-23019 | High | 7.5 | 2022-01-25 | On BIG-IP version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x and 12.1.x, when a message routing type virt… |
CVE-2022-23018 | High | 7.5 | 2022-01-25 | On BIG-IP AFM version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.5, and 13.1.x beginning in 13.1.3.4, when a virtual server is configur… |
CVE-2022-23017 | High | 7.5 | 2022-01-25 | On BIG-IP version 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.5, and all versions of 13.1.x, when a virtual server is configured with a DN… |
CVE-2022-23016 | High | 7.5 | 2022-01-25 | On versions 16.1.x before 16.1.2 and 15.1.x before 15.1.4.1, when BIG-IP SSL Forward Proxy with TLS 1.3 is configured on a virtual server, undisclosed requests… |
CVE-2022-23015 | High | 7.5 | 2022-01-25 | On BIG-IP versions 16.x before 16.1.0, 15.1.x before 15.1.4.1, and 14.1.2.6-14.1.4.4, when a Client SSL profile is configured on a virtual server with Client C… |
CVE-2022-23014 | Medium | 6.5 | 2022-01-25 | On versions 16.1.x before 16.1.2 and 15.1.x before 15.1.4.1, when BIG-IP APM portal access is configured on a virtual server, undisclosed requests can cause th… |
CVE-2022-23013 | High | 8.8 | 2022-01-25 | On BIG-IP DNS & GTM version 16.x before 16.1.0, 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, a DOM-based cross… |
CVE-2022-23012 | High | 7.5 | 2022-01-25 | On BIG-IP versions 15.1.x before 15.1.4.1 and 14.1.x before 14.1.4.5, when the HTTP/2 profile is configured on a virtual server, undisclosed requests can cause… |
CVE-2022-23011 | High | 7.5 | 2022-01-25 | On certain hardware BIG-IP platforms, in version 15.1.x before 15.1.4 and 14.1.x before 14.1.3, virtual servers may stop responding while processing TCP traffi… |
CVE-2022-23010 | High | 7.5 | 2022-01-25 | On BIG-IP versions 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, when a FastL4 profile an… |