2022 CVEs (page 262)
Page 262 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-21694 | Low | 3.7 | 2022-01-18 | OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. The website m… |
CVE-2022-21692 | Medium | 4.3 | 2022-01-18 | OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected v… |
CVE-2022-21690 | High | 8.7 | 2022-01-18 | OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected v… |
CVE-2022-21695 | Medium | 4.3 | 2022-01-18 | OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected v… |
CVE-2022-21693 | Medium | 6.3 | 2022-01-18 | OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected v… |
CVE-2022-21691 | Medium | 4.3 | 2022-01-18 | OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected v… |
CVE-2022-21689 | High | 7.5 | 2022-01-18 | OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected v… |
CVE-2022-21688 | High | 7.5 | 2022-01-18 | OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Affected vers… |
CVE-2022-21673 | Medium | 4.3 | 2022-01-18 | Grafana is an open-source platform for monitoring and observability. In affected versions when a data source has the Forward OAuth Identity feature enabled, se… |
CVE-2022-23408 | Critical | 9.1 | 2022-01-18 | wolfSSL 5.x before 5.1.1 uses non-random IV values in certain situations. This affects connections (without AEAD) using AES-CBC or DES3 with TLS 1.1 or 1.2 or… |
CVE-2022-21696 | Medium | 4.3 | 2022-01-18 | OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected v… |
CVE-2022-21683 | Low | 3.5 | 2022-01-18 | Wagtail is a Django based content management system focused on flexibility and user experience. When notifications for new replies in comment threads are sent… |
CVE-2022-23083 | Medium | 6.1 | 2022-01-18 | NetMaster 12.2 Network Management for TCP/IP and NetMaster File Transfer Management contain a XSS (Cross-Site Scripting) vulnerability in ReportCenter UI due t… |
CVE-2022-22691 | Medium | 6.8 | 2022-01-18 | The password reset component deployed within Umbraco uses the hostname supplied within the request host header when building a password reset URL. It may be po… |
CVE-2022-22690 | High | 8.6 | 2022-01-18 | Within the Umbraco CMS, a configuration element named "UmbracoApplicationUrl" (or just "ApplicationUrl") is used whenever application code needs to build a URL… |
CVE-2022-0244 | High | 8.6 | 2022-01-18 | An issue has been discovered in GitLab CE/EE affecting all versions starting with 14.5. Arbitrary file read was possible by importing a group was due to incorr… |
CVE-2022-0236 | High | 7.5 | 2022-01-18 | The WP Import Export WordPress plugin (both free and premium versions) is vulnerable to unauthenticated sensitive data disclosure due to a missing capability c… |
CVE-2022-0233 | Medium | 6.4 | 2022-01-18 | The ProfileGrid – User Profiles, Memberships, Groups and Communities WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping… |
CVE-2022-0232 | Medium | 4.8 | 2022-01-18 | The User Registration, Login & Landing Pages WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the loader_text par… |
CVE-2022-0215 | High | 8.8 | 2022-01-18 | The Login/Signup Popup, Waitlist Woocommerce ( Back in stock notifier ), and Side Cart Woocommerce (Ajax) WordPress plugins by XootiX are vulnerable to Cross-S… |
CVE-2022-0210 | Medium | 4.8 | 2022-01-18 | The Random Banner WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the category parameter found in the ~/include/… |
CVE-2022-0172 | Medium | 5.3 | 2022-01-18 | An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.3. Under certain conditions it was possible to bypass the IP restriction f… |
CVE-2022-0154 | High | 7.5 | 2022-01-18 | An issue has been discovered in GitLab affecting all versions starting from 7.7 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions st… |
CVE-2022-0152 | Medium | 6.5 | 2022-01-18 | An issue has been discovered in GitLab affecting all versions starting from 13.10 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions… |
CVE-2022-0151 | Medium | 6.5 | 2022-01-18 | An issue has been discovered in GitLab affecting all versions starting from 12.10 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions… |
CVE-2022-0125 | Medium | 4.3 | 2022-01-18 | An issue has been discovered in GitLab affecting all versions starting from 12.0 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions s… |
CVE-2022-0124 | Medium | 4.3 | 2022-01-18 | An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. Gitlab's Slack integration is… |
CVE-2022-0093 | Low | 3.5 | 2022-01-18 | An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab allows a user with an… |
CVE-2022-0090 | Medium | 6.5 | 2022-01-18 | An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab is configured in a way… |
CVE-2022-23307 | High | 8.8 | 2022-01-18 | CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x whe… |
CVE-2022-23305 | Critical | 9.8 | 2022-01-18 | By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLay… |
CVE-2022-23302 | High | 8.8 | 2022-01-18 | JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the… |
CVE-2022-0263 | High | 7.8 | 2022-01-18 | Unrestricted Upload of File with Dangerous Type in Packagist pimcore/pimcore prior to 10.2.7. |
CVE-2022-0262 | Medium | 6.1 | 2022-01-18 | Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.7. |
CVE-2022-0261 | High | 7.8 | 2022-01-18 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. |
CVE-2022-0260 | Medium | 5.4 | 2022-01-18 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.2.7. |
CVE-2022-0245 | Medium | 4.3 | 2022-01-18 | Cross-Site Request Forgery (CSRF) in GitHub repository livehelperchat/livehelperchat prior to 2.0. |
CVE-2022-22703 | Medium | 5.5 | 2022-01-17 | In Stormshield SSO Agent 2.x before 2.1.1 and 3.x before 3.0.2, the cleartext user password and PSK are contained in the log file of the .exe installer. |
CVE-2022-0242 | High | 7.2 | 2022-01-17 | Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0. |
CVE-2022-0258 | High | 8.8 | 2022-01-17 | pimcore is vulnerable to Improper Neutralization of Special Elements used in an SQL Command |
CVE-2022-0257 | Medium | 5.4 | 2022-01-17 | pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2022-0256 | Medium | 5.4 | 2022-01-17 | pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2022-0253 | Medium | 5.4 | 2022-01-17 | livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2022-0240 | High | 7.5 | 2022-01-17 | mruby is vulnerable to NULL Pointer Dereference |
CVE-2022-0184 | Medium | 4.3 | 2022-01-17 | Insufficiently protected credentials vulnerability in 'TEPRA' PRO SR5900P Ver.1.080 and earlier and 'TEPRA' PRO SR-R7900P Ver.1.030 and earlier allows an attac… |
CVE-2022-0183 | Medium | 4.6 | 2022-01-17 | Missing encryption of sensitive data vulnerability in 'MIRUPASS' PW10 firmware all versions and 'MIRUPASS' PW20 firmware all versions allows an attacker who ca… |
CVE-2022-0182 | Medium | 5.4 | 2022-01-17 | Stored cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote authenticated attacker to inject an arbitrary scrip… |
CVE-2022-0181 | Medium | 6.1 | 2022-01-17 | Reflected cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to inject an arbitrary script via unspe… |
CVE-2022-0180 | High | 8.8 | 2022-01-17 | Cross-site request forgery (CSRF) vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to hijack the authentication of admi… |
CVE-2022-0131 | Low | 3.3 | 2022-01-17 | Jimoty App for Android versions prior to 3.7.42 uses a hard-coded API key for an external service. By exploiting this vulnerability, API key for an external se… |
CVE-2022-0239 | Critical | 9.8 | 2022-01-17 | corenlp is vulnerable to Improper Restriction of XML External Entity Reference |
CVE-2022-23304 | Critical | 9.8 | 2022-01-17 | The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a result of cache access pattern… |
CVE-2022-23303 | Critical | 9.8 | 2022-01-17 | The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks as a result of cache access patterns. N… |
CVE-2022-0235 | Medium | 6.1 | 2022-01-16 | node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2022-0238 | Medium | 4.3 | 2022-01-16 | phoronix-test-suite is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2022-23178 | Critical | 9.8 | 2022-01-15 | An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices. When the administrative web interface of the HDMI switcher is accessed unauthenticated, u… |
CVE-2022-23095 | High | 7.8 | 2022-01-15 | Open Design Alliance Drawings SDK before 2022.12.1 mishandles the loading of JPG files. Unchecked input data from a crafted JPG file leads to memory corruption… |
CVE-2022-23094 | High | 7.5 | 2022-01-15 | Libreswan 4.2 through 4.5 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted IKEv1 packet because p… |
CVE-2022-22531 | High | 8.1 | 2022-01-14 | The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, does not check uploaded or downloaded files. This allo… |
CVE-2022-22530 | High | 8.1 | 2022-01-14 | The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, does not check uploaded or downloaded files. This allo… |
CVE-2022-22529 | Medium | 6.1 | 2022-01-14 | SAP Enterprise Threat Detection (ETD) - version 2.0, does not sufficiently encode user-controlled inputs which may lead to an unauthorized attacker possibly ex… |
CVE-2022-22290 | Medium | 6.5 | 2022-01-14 | Incorrect download source UI in Downloads in Samsung Internet prior to 16.0.6.23 allows attackers to perform domain spoofing via a crafted HTML page. |
CVE-2022-21137 | High | 7.8 | 2022-01-14 | Omron CX-One Versions 4.60 and prior are vulnerable to a stack-based buffer overflow while processing specific project files, which may allow an attacker to ex… |
CVE-2022-0130 | High | 8.1 | 2022-01-14 | Tenable.sc versions 5.14.0 through 5.19.1 were found to contain a remote code execution vulnerability which could allow a remote, unauthenticated attacker to e… |
CVE-2022-0226 | Medium | 4.3 | 2022-01-14 | livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2022-23227 | Critical | 9.8 | 2022-01-14 | NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lac… |
CVE-2022-0224 | Critical | 9.8 | 2022-01-14 | dolibarr is vulnerable to Improper Neutralization of Special Elements used in an SQL Command |
CVE-2022-21685 | Medium | 6.5 | 2022-01-14 | Frontier is Substrate's Ethereum compatibility layer. Prior to commit number `8a93fdc6c9f4eb1d2f2a11b7ff1d12d70bf5a664`, a bug in Frontier's MODEXP precompile… |
CVE-2022-21681 | High | 7.5 | 2022-01-14 | Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `inline.reflinkSearch` may cause catastrophic backtracking against so… |
CVE-2022-21680 | High | 7.5 | 2022-01-14 | Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `block.def` may cause catastrophic backtracking against some strings… |
CVE-2022-21677 | Medium | 4.3 | 2022-01-14 | Discourse is an open source discussion platform. Discourse groups can be configured with varying visibility levels for the group as well as the group members… |
CVE-2022-0213 | Medium | 6.6 | 2022-01-14 | vim is vulnerable to Heap-based Buffer Overflow |
CVE-2022-0231 | Medium | 6.5 | 2022-01-14 | livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2022-23222 | High | 7.8 | 2022-01-14 | kernel/bpf/verifier.c in the Linux kernel through 5.15.14 allows local users to gain privileges because of the availability of pointer arithmetic via certain *… |
CVE-2022-23219 | Critical | 9.8 | 2022-01-14 | The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack… |
CVE-2022-23218 | Critical | 9.8 | 2022-01-14 | The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack w… |
CVE-2022-20698 | High | 7.5 | 2022-01-14 | A vulnerability in the OOXML parsing module in Clam AntiVirus (ClamAV) Software version 0.104.1 and LTS version 0.103.4 and prior versions could allow an unaut… |
CVE-2022-22056 | Critical | 9.8 | 2022-01-14 | The Le-yan dental management system contains a hard-coded credentials vulnerability in the web page source code, which allows an unauthenticated remote attacke… |
CVE-2022-22055 | Critical | 9.8 | 2022-01-14 | The Le-yan dental management system contains an SQL-injection vulnerability. An unauthenticated remote attacker can inject SQL commands into the input field of… |
CVE-2022-22054 | Medium | 6.5 | 2022-01-14 | ASUS RT-AX56U’s login function contains a path traversal vulnerability due to its inadequate filtering for special characters in URL parameters, which allows a… |
CVE-2022-20660 | Medium | 4.6 | 2022-01-14 | A vulnerability in the information storage architecture of several Cisco IP Phone models could allow an unauthenticated, physical attacker to obtain confidenti… |
CVE-2022-20658 | Critical | 9.6 | 2022-01-14 | A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal (Unified CCMP) and Cisco Unified Contact Center Domain… |
CVE-2022-20647 | Medium | 6.1 | 2022-01-14 | Multiple vulnerabilities in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct cross-site… |
CVE-2022-20646 | Medium | 6.1 | 2022-01-14 | Multiple vulnerabilities in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct cross-site… |
CVE-2022-20645 | Medium | 6.1 | 2022-01-14 | Multiple vulnerabilities in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct cross-site… |
CVE-2022-20644 | Medium | 6.1 | 2022-01-14 | Multiple vulnerabilities in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct cross-site… |
CVE-2022-20643 | Medium | 6.1 | 2022-01-14 | Multiple vulnerabilities in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct cross-site… |
CVE-2022-20642 | Medium | 6.1 | 2022-01-14 | Multiple vulnerabilities in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct cross-site… |
CVE-2022-20641 | Medium | 6.1 | 2022-01-14 | Multiple vulnerabilities in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct cross-site… |
CVE-2022-20640 | Medium | 6.1 | 2022-01-14 | Multiple vulnerabilities in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct cross-site… |
CVE-2022-20639 | Medium | 6.1 | 2022-01-14 | Multiple vulnerabilities in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct cross-site… |
CVE-2022-20638 | Medium | 6.1 | 2022-01-14 | Multiple vulnerabilities in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct cross-site… |
CVE-2022-20637 | Medium | 6.1 | 2022-01-14 | Multiple vulnerabilities in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct cross-site… |
CVE-2022-20636 | Medium | 6.1 | 2022-01-14 | Multiple vulnerabilities in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct cross-site… |
CVE-2022-20635 | Medium | 6.1 | 2022-01-14 | Multiple vulnerabilities in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct cross-site… |
CVE-2022-0178 | Medium | 6.3 | 2022-01-13 | Missing Authorization vulnerability in snipe snipe/snipe-it.This issue affects snipe/snipe-i before 5.3.8. |
CVE-2022-22991 | High | 7.8 | 2022-01-13 | A malicious user on the same LAN could use DNS spoofing followed by a command injection attack to trick a NAS device into loading through an unsecured HTTP cal… |
CVE-2022-22990 | High | 7.8 | 2022-01-13 | A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate privileges on the My Cl… |
CVE-2022-22989 | Critical | 9.8 | 2022-01-13 | My Cloud OS 5 was vulnerable to a pre-authenticated stack overflow vulnerability on the FTP service that could be exploited by unauthenticated attackers on the… |
CVE-2022-22988 | High | 7.7 | 2022-01-13 | File and directory permissions have been corrected to prevent unintended users from modifying or accessing resources. It would be more difficult for an authent… |