2022 CVEs (page 259)
Page 259 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-23009 | High | 7.2 | 2022-01-25 | On BIG-IQ Centralized Management 8.x before 8.1.0, an authenticated administrative role user on a BIG-IQ managed BIG-IP device can access other BIG-IP devices… |
CVE-2022-23008 | Medium | 5.4 | 2022-01-25 | On NGINX Controller API Management versions 3.18.0-3.19.0, an authenticated attacker with access to the "user" or "admin" role can use undisclosed API endpoint… |
CVE-2022-22789 | Medium | 6.1 | 2022-01-25 | Charactell - FormStorm Enterprise Account takeover – An attacker can modify (add, remove and update) passwords file for all the users. The xx_users.ini file in… |
CVE-2022-0335 | High | 8.8 | 2022-01-25 | A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The "delete badge alignment" functionali… |
CVE-2022-0334 | Medium | 4.3 | 2022-01-25 | A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lea… |
CVE-2022-0333 | Low | 3.8 | 2022-01-25 | A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The calendar:manageentries capability al… |
CVE-2022-0332 | Critical | 9.8 | 2022-01-25 | A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for fetching user attem… |
CVE-2022-0270 | High | 8.8 | 2022-01-25 | Prior to v0.6.1, bored-agent failed to sanitize incoming kubernetes impersonation headers allowing a user to override assigned user name and groups. |
CVE-2022-0351 | High | 7.8 | 2022-01-25 | Access of Memory Location Before Start of Buffer in GitHub repository vim/vim prior to 8.2. |
CVE-2022-23035 | Medium | 4.6 | 2022-01-25 | Insufficient cleanup of passed-through device IRQs The management of IRQs associated with physical devices exposed to x86 HVM guests involves an iterative oper… |
CVE-2022-23034 | Medium | 5.5 | 2022-01-25 | A PV guest could DoS Xen while unmapping a grant To address XSA-380, reference counting was introduced for grant mappings for the case where a PV guest would h… |
CVE-2022-23033 | High | 7.8 | 2022-01-25 | arm: guest_physmap_remove_page not removing the p2m mappings The functions to remove one or more entries from a guest p2m pagetable on Arm (p2m_remove_mapping… |
CVE-2022-21697 | Medium | 6.3 | 2022-01-25 | Jupyter Server Proxy is a Jupyter notebook server extension to proxy web services. Versions of Jupyter Server Proxy prior to 3.2.1 are vulnerable to Server-Sid… |
CVE-2022-23945 | High | 7.5 | 2022-01-25 | Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1. |
CVE-2022-23944 | Critical | 9.1 | 2022-01-25 | User can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1. |
CVE-2022-23223 | High | 7.5 | 2022-01-25 | On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade to version 2.4.2 or… |
CVE-2022-0268 | Medium | 5.4 | 2022-01-25 | Cross-site Scripting (XSS) - Stored in Packagist getgrav/grav prior to 1.7.28. |
CVE-2022-0338 | Medium | 4.3 | 2022-01-25 | Insertion of Sensitive Information into Log File in Conda loguru prior to 0.5.3. |
CVE-2022-23935 | High | 7.8 | 2022-01-25 | lib/Image/ExifTool.pm in ExifTool before 12.38 mishandles a $file =~ /\|$/ check, leading to command injection. |
CVE-2022-22554 | High | 8.2 | 2022-01-24 | Dell EMC System Update, version 1.9.2 and prior, contain an Unprotected Storage of Credentials vulnerability. A local attacker with user privleges could potent… |
CVE-2022-21715 | Medium | 5.4 | 2022-01-24 | CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A cross-site scripting (XSS) vulnerability was found in `API\ResponseTrait` in C… |
CVE-2022-21711 | High | 7.1 | 2022-01-24 | elfspirit is an ELF static analysis and injection framework that parses, manipulates, and camouflages ELF files. When analyzing the ELF file format in versions… |
CVE-2022-21710 | Medium | 4.7 | 2022-01-24 | ShortDescription is a MediaWiki extension that provides local short description support. A cross-site scripting (XSS) vulnerability exists in versions prior to… |
CVE-2022-23126 | Critical | 9.8 | 2022-01-24 | TeslaMate before 1.25.1 (when using the default Docker configuration) allows attackers to open doors of Tesla vehicles, start Keyless Driving, and interfere wi… |
CVE-2022-23437 | Medium | 6.5 | 2022-01-24 | There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML… |
CVE-2022-22296 | Medium | 5.3 | 2022-01-24 | Sourcecodester Hospital's Patient Records Management System 1.0 is vulnerable to Insecure Permissions via the id parameter in manage_user endpoint. Simply chan… |
CVE-2022-0269 | High | 8.0 | 2022-01-24 | Cross-Site Request Forgery (CSRF) in Packagist yetiforce/yetiforce-crm prior to 6.3.0. |
CVE-2022-23858 | High | 8.8 | 2022-01-24 | A flaw was found in the REST API. An improperly handled REST API call could allow any logged user to elevate privileges up to the system account. This affects… |
CVE-2022-23857 | Medium | 6.5 | 2022-01-24 | model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists. An authenticated user cou… |
CVE-2022-23856 | Medium | 5.3 | 2022-01-24 | An issue was discovered in Saviynt Enterprise Identity Cloud (EIC) 5.5 SP2.x. An attacker can enumerate users by changing the id parameter, such as for the ECM… |
CVE-2022-23855 | Critical | 9.8 | 2022-01-24 | An issue was discovered in Saviynt Enterprise Identity Cloud (EIC) 5.5 SP2.x. An authentication bypass in ECM/maintenance/forgotpasswordstep1 allows an unauthe… |
CVE-2022-23852 | Critical | 9.8 | 2022-01-24 | Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES. |
CVE-2022-23850 | High | 7.8 | 2022-01-23 | xhtml_translate_entity in xhtml.c in epub2txt (aka epub2txt2) through 2.02 allows a stack-based buffer overflow via a crafted EPUB document. |
CVE-2022-23808 | Medium | 6.1 | 2022-01-22 | An issue was discovered in phpMyAdmin 5.1 before 5.1.2. An attacker can inject malicious code into aspects of the setup script, which can allow XSS or HTML inj… |
CVE-2022-23807 | Medium | 4.3 | 2022-01-22 | An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their accou… |
CVE-2022-23366 | Critical | 9.8 | 2022-01-21 | HMS v1.0 was discovered to contain a SQL injection vulnerability via patientlogin.php. |
CVE-2022-23365 | Critical | 9.8 | 2022-01-21 | HMS v1.0 was discovered to contain a SQL injection vulnerability via doctorlogin.php. |
CVE-2022-23364 | Critical | 9.8 | 2022-01-21 | HMS v1.0 was discovered to contain a SQL injection vulnerability via adminlogin.php. |
CVE-2022-23363 | Critical | 9.8 | 2022-01-21 | Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via index.php. |
CVE-2022-21708 | Medium | 6.5 | 2022-01-21 | graphql-go is a GraphQL server with a focus on ease of use. In versions prior to 1.3.0 there exists a DoS vulnerability that is possible due to a bug in the li… |
CVE-2022-21707 | Medium | 6.3 | 2022-01-21 | wasmCloud Host Runtime is a server process that securely hosts and provides dispatch for web assembly (WASM) actors and capability providers. In versions prior… |
CVE-2022-23837 | High | 7.5 | 2022-01-21 | In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting… |
CVE-2022-22553 | High | 8.1 | 2022-01-21 | Dell EMC AppSync versions 3.9 to 4.3 contain an Improper Restriction of Excessive Authentication Attempts Vulnerability that can be exploited from UI and CLI… |
CVE-2022-22552 | Medium | 6.9 | 2022-01-21 | Dell EMC AppSync versions 3.9 to 4.3 contain a clickjacking vulnerability in AppSync. A remote unauthenticated attacker could potentially exploit this vulnerab… |
CVE-2022-22551 | High | 8.3 | 2022-01-21 | DELL EMC AppSync versions 3.9 to 4.3 use GET request method with sensitive query strings. An Adjacent, unauthenticated attacker could potentially exploit this… |
CVE-2022-23728 | Medium | 6.1 | 2022-01-21 | Attacker can reset the device with AT Command in the process of rebooting the device. The LG ID is LVE-SMP-210011. |
CVE-2022-23130 | Medium | 5.9 | 2022-01-21 | Buffer Over-read vulnerability in Mitsubishi Electric MC Works64 versions 4.00A to 4.04E, Mitsubishi Electric GENESIS64 versions 10.97 and prior, Mitsubishi El… |
CVE-2022-23129 | Medium | 5.5 | 2022-01-21 | Plaintext Storage of a Password vulnerability in Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior and ICONICS GENESIS64 versions 10.90 to… |
CVE-2022-23128 | Critical | 9.8 | 2022-01-21 | Incomplete List of Disallowed Inputs vulnerability in Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01), ICONICS GENESIS64 v… |
CVE-2022-23127 | Medium | 6.1 | 2022-01-21 | Cross-site Scripting vulnerability in Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior and ICONICS MobileHMI versions 10.96.2 and prior a… |
CVE-2022-0323 | High | 8.8 | 2022-01-21 | Improper Neutralization of Special Elements Used in a Template Engine in Packagist mustache/mustache prior to 2.14.1. |
CVE-2022-23220 | High | 7.8 | 2022-01-21 | USBView 2.1 before 2.2 allows some local users (e.g., ones logged in via SSH) to execute arbitrary code as root because certain Polkit settings (e.g., allow_an… |
CVE-2022-0319 | Medium | 5.5 | 2022-01-21 | Out-of-bounds Read in vim/vim prior to 8.2. |
CVE-2022-0318 | Critical | 9.8 | 2022-01-21 | Heap-based Buffer Overflow in vim/vim prior to 8.2. |
CVE-2022-21933 | Medium | 6.7 | 2022-01-21 | ASUS VivoMini/Mini PC device has an improper input validation vulnerability. A local attacker with system privilege can use system management interrupt (SMI) t… |
CVE-2022-0326 | Medium | 5.5 | 2022-01-21 | NULL Pointer Dereference in Homebrew mruby prior to 3.2. |
CVE-2022-23315 | Critical | 9.8 | 2022-01-21 | MCMS v5.2.4 was discovered to contain an arbitrary file upload vulnerability via the component /ms/template/writeFileContent.do. |
CVE-2022-23314 | Critical | 9.8 | 2022-01-21 | MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via /ms/mdiy/model/importJson.do. |
CVE-2022-22930 | Critical | 9.8 | 2022-01-21 | A remote code execution (RCE) vulnerability in the Template Management function of MCMS v5.2.4 allows attackers to execute arbitrary code via a crafted payload. |
CVE-2022-22929 | Critical | 9.8 | 2022-01-21 | MCMS v5.2.4 was discovered to have an arbitrary file upload vulnerability in the New Template module, which allows attackers to execute arbitrary code via a cr… |
CVE-2022-22928 | Critical | 9.8 | 2022-01-21 | MCMS v5.2.4 was discovered to have a hardcoded shiro-key, allowing attackers to exploit the key and execute arbitrary code. |
CVE-2022-22895 | High | 7.8 | 2022-01-21 | Jerryscript 3.0.0 was discovered to contain a heap-buffer-overflow via ecma_utf8_string_to_number_by_radix in /jerry-core/ecma/base/ecma-helpers-conversion.c. |
CVE-2022-22894 | High | 7.8 | 2022-01-21 | Jerryscript 3.0.0 was discovered to contain a stack overflow via ecma_lcache_lookup in /jerry-core/ecma/base/ecma-lcache.c. |
CVE-2022-22893 | High | 7.8 | 2022-01-21 | Jerryscript 3.0.0 was discovered to contain a stack overflow via vm_loop.lto_priv.304 in /jerry-core/vm/vm.c. |
CVE-2022-22892 | Medium | 5.5 | 2022-01-21 | There is an Assertion 'ecma_is_value_undefined (value) || ecma_is_value_null (value) || ecma_is_value_boolean (value) || ecma_is_value_number (value) || ecma_i… |
CVE-2022-22891 | Medium | 5.5 | 2022-01-21 | Jerryscript 3.0.0 was discovered to contain a SEGV vulnerability via ecma_ref_object_inline in /jerry-core/ecma/base/ecma-gc.c. |
CVE-2022-22890 | Medium | 5.5 | 2022-01-20 | There is an Assertion 'arguments_type != SCANNER_ARGUMENTS_PRESENT && arguments_type != SCANNER_ARGUMENTS_PRESENT_NO_REG' failed at /jerry-core/parser/js/js-sc… |
CVE-2022-22888 | High | 7.8 | 2022-01-20 | Jerryscript 3.0.0 was discovered to contain a stack overflow via ecma_op_object_find_own in /ecma/operations/ecma-objects.c. |
CVE-2022-23120 | High | 7.8 | 2022-01-20 | A code injection vulnerability in Trend Micro Deep Security and Cloud One - Workload Security Agent for Linux version 20 and below could allow an attacker to e… |
CVE-2022-23119 | High | 7.5 | 2022-01-20 | A directory traversal vulnerability in Trend Micro Deep Security and Cloud One - Workload Security Agent for Linux version 20 and below could allow an attacker… |
CVE-2022-21658 | High | 7.3 | 2022-01-20 | Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG… |
CVE-2022-0219 | Medium | 5.5 | 2022-01-20 | Improper Restriction of XML External Entity Reference in GitHub repository skylot/jadx prior to 1.3.2. |
CVE-2022-0285 | Medium | 5.4 | 2022-01-20 | Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.9. |
CVE-2022-22820 | Medium | 5.5 | 2022-01-20 | Due to the lack of media file checks before rendering, it was possible for an attacker to cause abnormal CPU consumption for message recipient by sending speci… |
CVE-2022-0282 | Medium | 4.3 | 2022-01-20 | Cross-site Scripting in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-22733 | Medium | 6.5 | 2022-01-20 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache ShardingSphere ElasticJob-UI allows an attacker who has guest account to do… |
CVE-2022-0281 | High | 7.5 | 2022-01-20 | Exposure of Sensitive Information to an Unauthorized Actor in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-0278 | Medium | 5.4 | 2022-01-20 | Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-0277 | Medium | 6.5 | 2022-01-20 | Incorrect Permission Assignment for Critical Resource in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-21704 | Medium | 5.5 | 2022-01-19 | log4js-node is a port of log4js to node.js. In affected versions default file permissions for log files created by the file, fileSync and dateFile appenders ar… |
CVE-2022-21701 | Medium | 5.0 | 2022-01-19 | Istio is an open platform to connect, manage, and secure microservices. In versions 1.12.0 and 1.12.1 Istio is vulnerable to a privilege escalation attack. Use… |
CVE-2022-21699 | High | 8.2 | 2022-01-19 | IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming la… |
CVE-2022-21679 | Medium | 6.8 | 2022-01-19 | Istio is an open platform to connect, manage, and secure microservices. In Istio 1.12.0 and 1.12.1 The authorization policy with hosts and notHosts might be ac… |
CVE-2022-23046 | High | 7.2 | 2022-01-19 | PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via app/admin/routing/edit-bgp-map… |
CVE-2022-23045 | Medium | 4.8 | 2022-01-19 | PhpIPAM v1.4.4 allows an authenticated admin user to inject persistent JavaScript code inside the "Site title" parameter while updating the site settings. The… |
CVE-2022-22769 | High | 8.0 | 2022-01-19 | The Web server component of TIBCO Software Inc.'s TIBCO EBX, TIBCO EBX, TIBCO EBX, TIBCO EBX Add-ons, TIBCO EBX Add-ons, TIBCO EBX Add-ons, and TIBCO Product a… |
CVE-2022-0243 | Medium | 5.4 | 2022-01-19 | Cross-site Scripting (XSS) - Stored in NuGet OrchardCore.Application.Cms.Targets prior to 1.2.2. |
CVE-2022-0274 | Medium | 5.4 | 2022-01-19 | Cross-site Scripting (XSS) - Stored in NuGet OrchardCore.Application.Cms.Targets prior to 1.2.2. |
CVE-2022-23221 | Critical | 9.8 | 2022-01-19 | H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREAT… |
CVE-2022-22310 | Medium | 6.5 | 2022-01-19 | IBM WebSphere Application Server Liberty 21.0.0.10 through 21.0.0.12 could provide weaker than expected security. A remote attacker could exploit this weakness… |
CVE-2022-21403 | Medium | 6.6 | 2022-01-19 | Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation Engine). Supported versions that are affec… |
CVE-2022-21402 | Medium | 4.8 | 2022-01-19 | Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation Engine). Supported versions that are affec… |
CVE-2022-21401 | Medium | 6.6 | 2022-01-19 | Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation Engine). Supported versions that are affec… |
CVE-2022-21400 | Medium | 5.4 | 2022-01-19 | Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation Engine). Supported versions that are affec… |
CVE-2022-21399 | Medium | 6.6 | 2022-01-19 | Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation Engine). Supported versions that are affec… |
CVE-2022-21398 | Medium | 5.4 | 2022-01-19 | Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation Engine). Supported versions that are affec… |
CVE-2022-21397 | Medium | 5.4 | 2022-01-19 | Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation Engine). Supported versions that are affec… |
CVE-2022-21396 | Medium | 5.4 | 2022-01-19 | Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation Engine). Supported versions that are affec… |
CVE-2022-21395 | High | 7.2 | 2022-01-19 | Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Mediation Engine). Supported versions that are affec… |
CVE-2022-21394 | Medium | 6.5 | 2022-01-19 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.32. Easily… |