2022 CVEs (page 262)
Page 262 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-0210 | Medium | 4.8 | 2022-01-18 | The Random Banner WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the category parameter found in the ~/include/… |
CVE-2022-0172 | Medium | 5.3 | 2022-01-18 | An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.3. Under certain conditions it was possible to bypass the IP restriction f… |
CVE-2022-0154 | High | 7.5 | 2022-01-18 | An issue has been discovered in GitLab affecting all versions starting from 7.7 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions st… |
CVE-2022-0152 | Medium | 6.5 | 2022-01-18 | An issue has been discovered in GitLab affecting all versions starting from 13.10 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions… |
CVE-2022-0151 | Medium | 6.5 | 2022-01-18 | An issue has been discovered in GitLab affecting all versions starting from 12.10 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions… |
CVE-2022-0125 | Medium | 4.3 | 2022-01-18 | An issue has been discovered in GitLab affecting all versions starting from 12.0 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions s… |
CVE-2022-0124 | Medium | 4.3 | 2022-01-18 | An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. Gitlab's Slack integration is… |
CVE-2022-0093 | Low | 3.5 | 2022-01-18 | An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab allows a user with an… |
CVE-2022-0090 | Medium | 6.5 | 2022-01-18 | An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab is configured in a way… |
CVE-2022-23307 | High | 8.8 | 2022-01-18 | CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x whe… |
CVE-2022-23305 | Critical | 9.8 | 2022-01-18 | By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLay… |
CVE-2022-23302 | High | 8.8 | 2022-01-18 | JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the… |
CVE-2022-0263 | High | 7.8 | 2022-01-18 | Unrestricted Upload of File with Dangerous Type in Packagist pimcore/pimcore prior to 10.2.7. |
CVE-2022-0262 | Medium | 6.1 | 2022-01-18 | Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.7. |
CVE-2022-0261 | High | 7.8 | 2022-01-18 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. |
CVE-2022-0260 | Medium | 5.4 | 2022-01-18 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.2.7. |
CVE-2022-0245 | Medium | 4.3 | 2022-01-18 | Cross-Site Request Forgery (CSRF) in GitHub repository livehelperchat/livehelperchat prior to 2.0. |
CVE-2022-22703 | Medium | 5.5 | 2022-01-17 | In Stormshield SSO Agent 2.x before 2.1.1 and 3.x before 3.0.2, the cleartext user password and PSK are contained in the log file of the .exe installer. |
CVE-2022-0242 | High | 7.2 | 2022-01-17 | Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0. |
CVE-2022-0258 | High | 8.8 | 2022-01-17 | pimcore is vulnerable to Improper Neutralization of Special Elements used in an SQL Command |
CVE-2022-0257 | Medium | 5.4 | 2022-01-17 | pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2022-0256 | Medium | 5.4 | 2022-01-17 | pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2022-0253 | Medium | 5.4 | 2022-01-17 | livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2022-0240 | High | 7.5 | 2022-01-17 | mruby is vulnerable to NULL Pointer Dereference |
CVE-2022-0184 | Medium | 4.3 | 2022-01-17 | Insufficiently protected credentials vulnerability in 'TEPRA' PRO SR5900P Ver.1.080 and earlier and 'TEPRA' PRO SR-R7900P Ver.1.030 and earlier allows an attac… |
CVE-2022-0183 | Medium | 4.6 | 2022-01-17 | Missing encryption of sensitive data vulnerability in 'MIRUPASS' PW10 firmware all versions and 'MIRUPASS' PW20 firmware all versions allows an attacker who ca… |
CVE-2022-0182 | Medium | 5.4 | 2022-01-17 | Stored cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote authenticated attacker to inject an arbitrary scrip… |
CVE-2022-0181 | Medium | 6.1 | 2022-01-17 | Reflected cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to inject an arbitrary script via unspe… |
CVE-2022-0180 | High | 8.8 | 2022-01-17 | Cross-site request forgery (CSRF) vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to hijack the authentication of admi… |
CVE-2022-0131 | Low | 3.3 | 2022-01-17 | Jimoty App for Android versions prior to 3.7.42 uses a hard-coded API key for an external service. By exploiting this vulnerability, API key for an external se… |
CVE-2022-0239 | Critical | 9.8 | 2022-01-17 | corenlp is vulnerable to Improper Restriction of XML External Entity Reference |
CVE-2022-23304 | Critical | 9.8 | 2022-01-17 | The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a result of cache access pattern… |
CVE-2022-23303 | Critical | 9.8 | 2022-01-17 | The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks as a result of cache access patterns. N… |
CVE-2022-0235 | Medium | 6.1 | 2022-01-16 | node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2022-0238 | Medium | 4.3 | 2022-01-16 | phoronix-test-suite is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2022-23178 | Critical | 9.8 | 2022-01-15 | An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices. When the administrative web interface of the HDMI switcher is accessed unauthenticated, u… |
CVE-2022-23095 | High | 7.8 | 2022-01-15 | Open Design Alliance Drawings SDK before 2022.12.1 mishandles the loading of JPG files. Unchecked input data from a crafted JPG file leads to memory corruption… |
CVE-2022-23094 | High | 7.5 | 2022-01-15 | Libreswan 4.2 through 4.5 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted IKEv1 packet because p… |
CVE-2022-22531 | High | 8.1 | 2022-01-14 | The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, does not check uploaded or downloaded files. This allo… |
CVE-2022-22530 | High | 8.1 | 2022-01-14 | The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, does not check uploaded or downloaded files. This allo… |
CVE-2022-22529 | Medium | 6.1 | 2022-01-14 | SAP Enterprise Threat Detection (ETD) - version 2.0, does not sufficiently encode user-controlled inputs which may lead to an unauthorized attacker possibly ex… |
CVE-2022-22290 | Medium | 6.5 | 2022-01-14 | Incorrect download source UI in Downloads in Samsung Internet prior to 16.0.6.23 allows attackers to perform domain spoofing via a crafted HTML page. |
CVE-2022-21137 | High | 7.8 | 2022-01-14 | Omron CX-One Versions 4.60 and prior are vulnerable to a stack-based buffer overflow while processing specific project files, which may allow an attacker to ex… |
CVE-2022-0130 | High | 8.1 | 2022-01-14 | Tenable.sc versions 5.14.0 through 5.19.1 were found to contain a remote code execution vulnerability which could allow a remote, unauthenticated attacker to e… |
CVE-2022-0226 | Medium | 4.3 | 2022-01-14 | livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2022-23227 | Critical | 9.8 | 2022-01-14 | NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lac… |
CVE-2022-0224 | Critical | 9.8 | 2022-01-14 | dolibarr is vulnerable to Improper Neutralization of Special Elements used in an SQL Command |
CVE-2022-21685 | Medium | 6.5 | 2022-01-14 | Frontier is Substrate's Ethereum compatibility layer. Prior to commit number `8a93fdc6c9f4eb1d2f2a11b7ff1d12d70bf5a664`, a bug in Frontier's MODEXP precompile… |
CVE-2022-21681 | High | 7.5 | 2022-01-14 | Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `inline.reflinkSearch` may cause catastrophic backtracking against so… |
CVE-2022-21680 | High | 7.5 | 2022-01-14 | Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `block.def` may cause catastrophic backtracking against some strings… |
CVE-2022-21677 | Medium | 4.3 | 2022-01-14 | Discourse is an open source discussion platform. Discourse groups can be configured with varying visibility levels for the group as well as the group members… |
CVE-2022-0213 | Medium | 6.6 | 2022-01-14 | vim is vulnerable to Heap-based Buffer Overflow |
CVE-2022-0231 | Medium | 6.5 | 2022-01-14 | livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2022-23222 | High | 7.8 | 2022-01-14 | kernel/bpf/verifier.c in the Linux kernel through 5.15.14 allows local users to gain privileges because of the availability of pointer arithmetic via certain *… |
CVE-2022-23219 | Critical | 9.8 | 2022-01-14 | The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack… |
CVE-2022-23218 | Critical | 9.8 | 2022-01-14 | The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack w… |
CVE-2022-20698 | High | 7.5 | 2022-01-14 | A vulnerability in the OOXML parsing module in Clam AntiVirus (ClamAV) Software version 0.104.1 and LTS version 0.103.4 and prior versions could allow an unaut… |
CVE-2022-22056 | Critical | 9.8 | 2022-01-14 | The Le-yan dental management system contains a hard-coded credentials vulnerability in the web page source code, which allows an unauthenticated remote attacke… |
CVE-2022-22055 | Critical | 9.8 | 2022-01-14 | The Le-yan dental management system contains an SQL-injection vulnerability. An unauthenticated remote attacker can inject SQL commands into the input field of… |
CVE-2022-22054 | Medium | 6.5 | 2022-01-14 | ASUS RT-AX56U’s login function contains a path traversal vulnerability due to its inadequate filtering for special characters in URL parameters, which allows a… |
CVE-2022-20660 | Medium | 4.6 | 2022-01-14 | A vulnerability in the information storage architecture of several Cisco IP Phone models could allow an unauthenticated, physical attacker to obtain confidenti… |
CVE-2022-20658 | Critical | 9.6 | 2022-01-14 | A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal (Unified CCMP) and Cisco Unified Contact Center Domain… |
CVE-2022-20647 | Medium | 6.1 | 2022-01-14 | Multiple vulnerabilities in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct cross-site… |
CVE-2022-20646 | Medium | 6.1 | 2022-01-14 | Multiple vulnerabilities in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct cross-site… |
CVE-2022-20645 | Medium | 6.1 | 2022-01-14 | Multiple vulnerabilities in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct cross-site… |
CVE-2022-20644 | Medium | 6.1 | 2022-01-14 | Multiple vulnerabilities in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct cross-site… |
CVE-2022-20643 | Medium | 6.1 | 2022-01-14 | Multiple vulnerabilities in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct cross-site… |
CVE-2022-20642 | Medium | 6.1 | 2022-01-14 | Multiple vulnerabilities in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct cross-site… |
CVE-2022-20641 | Medium | 6.1 | 2022-01-14 | Multiple vulnerabilities in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct cross-site… |
CVE-2022-20640 | Medium | 6.1 | 2022-01-14 | Multiple vulnerabilities in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct cross-site… |
CVE-2022-20639 | Medium | 6.1 | 2022-01-14 | Multiple vulnerabilities in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct cross-site… |
CVE-2022-20638 | Medium | 6.1 | 2022-01-14 | Multiple vulnerabilities in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct cross-site… |
CVE-2022-20637 | Medium | 6.1 | 2022-01-14 | Multiple vulnerabilities in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct cross-site… |
CVE-2022-20636 | Medium | 6.1 | 2022-01-14 | Multiple vulnerabilities in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct cross-site… |
CVE-2022-20635 | Medium | 6.1 | 2022-01-14 | Multiple vulnerabilities in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct cross-site… |
CVE-2022-0178 | Medium | 6.3 | 2022-01-13 | Missing Authorization vulnerability in snipe snipe/snipe-it.This issue affects snipe/snipe-i before 5.3.8. |
CVE-2022-22991 | High | 7.8 | 2022-01-13 | A malicious user on the same LAN could use DNS spoofing followed by a command injection attack to trick a NAS device into loading through an unsecured HTTP cal… |
CVE-2022-22990 | High | 7.8 | 2022-01-13 | A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate privileges on the My Cl… |
CVE-2022-22989 | Critical | 9.8 | 2022-01-13 | My Cloud OS 5 was vulnerable to a pre-authenticated stack overflow vulnerability on the FTP service that could be exploited by unauthenticated attackers on the… |
CVE-2022-22988 | High | 7.7 | 2022-01-13 | File and directory permissions have been corrected to prevent unintended users from modifying or accessing resources. It would be more difficult for an authent… |
CVE-2022-21684 | Medium | 4.3 | 2022-01-13 | Discourse is an open source discussion platform. Versions prior to 2.7.13 in `stable`, 2.8.0.beta11 in `beta`, and 2.8.0.beta11 in `tests-passed` allow some us… |
CVE-2022-21682 | High | 7.7 | 2022-01-13 | Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. fl… |
CVE-2022-21678 | Medium | 4.3 | 2022-01-13 | Discourse is an open source discussion platform. Prior to version 2.8.0.beta11 in the `tests-passed` branch, version 2.8.0.beta11 in the `beta` branch, and ver… |
CVE-2022-22125 | Medium | 4.8 | 2022-01-13 | In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article tag. An authenticated admin attacker can inject… |
CVE-2022-22124 | Medium | 5.4 | 2022-01-13 | In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the profile image. An authenticated attacker can upload a c… |
CVE-2022-22123 | Medium | 5.4 | 2022-01-13 | In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article title. An authenticated attacker can inject arb… |
CVE-2022-23134 | Low | 3.7 | 2022-01-13 | After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious a… |
CVE-2022-23133 | Medium | 6.3 | 2022-01-13 | An authenticated user can create a hosts group from the configuration with XSS payload, which will be available for other users. When XSS is stored by an authe… |
CVE-2022-23132 | Low | 3.3 | 2022-01-13 | During Zabbix installation from RPM, DAC_OVERRIDE SELinux capability is in use to access PID files in [/var/run/zabbix] folder. In this case, Zabbix Proxy or S… |
CVE-2022-23131 | Critical | 9.1 | 2022-01-13 | In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login st… |
CVE-2022-22113 | High | 8.8 | 2022-01-13 | In DayByDay CRM, versions 2.2.0 through 2.2.1 (latest) are vulnerable to Insufficient Session Expiration. When a password has been changed by the user or by an… |
CVE-2022-22112 | Medium | 5.4 | 2022-01-13 | In DayByDay CRM, versions 1.1 through 2.2.1 (latest) suffer from an application-wide Client-Side Template Injection (CSTI). A low privileged attacker can input… |
CVE-2022-0198 | High | 7.1 | 2022-01-13 | corenlp is vulnerable to Improper Restriction of XML External Entity Reference |
CVE-2022-0197 | High | 8.8 | 2022-01-13 | phoronix-test-suite is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2022-0196 | High | 8.8 | 2022-01-13 | phoronix-test-suite is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2022-23118 | High | 8.8 | 2022-01-12 | Jenkins Debian Package Builder Plugin 1.6.11 and earlier implements functionality that allows agents to invoke command-line `git` at an attacker-specified path… |
CVE-2022-23117 | High | 7.5 | 2022-01-12 | Jenkins Conjur Secrets Plugin 1.0.9 and earlier implements functionality that allows attackers able to control agent processes to retrieve all username/passwor… |
CVE-2022-23116 | High | 7.5 | 2022-01-12 | Jenkins Conjur Secrets Plugin 1.0.9 and earlier implements functionality that allows attackers able to control agent processes to decrypt secrets stored in Jen… |
CVE-2022-23115 | Medium | 5.4 | 2022-01-12 | Cross-site request forgery (CSRF) vulnerabilities in Jenkins batch task Plugin 1.19 and earlier allows attackers with Overall/Read access to retrieve logs, bui… |
CVE-2022-23114 | Low | 3.3 | 2022-01-12 | Jenkins Publish Over SSH Plugin 1.22 and earlier stores password unencrypted in its global configuration file on the Jenkins controller where it can be viewed… |