2022 CVEs (page 263)
Page 263 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-21684 | Medium | 4.3 | 2022-01-13 | Discourse is an open source discussion platform. Versions prior to 2.7.13 in `stable`, 2.8.0.beta11 in `beta`, and 2.8.0.beta11 in `tests-passed` allow some us… |
CVE-2022-21682 | High | 7.7 | 2022-01-13 | Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. fl… |
CVE-2022-21678 | Medium | 4.3 | 2022-01-13 | Discourse is an open source discussion platform. Prior to version 2.8.0.beta11 in the `tests-passed` branch, version 2.8.0.beta11 in the `beta` branch, and ver… |
CVE-2022-22125 | Medium | 4.8 | 2022-01-13 | In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article tag. An authenticated admin attacker can inject… |
CVE-2022-22124 | Medium | 5.4 | 2022-01-13 | In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the profile image. An authenticated attacker can upload a c… |
CVE-2022-22123 | Medium | 5.4 | 2022-01-13 | In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article title. An authenticated attacker can inject arb… |
CVE-2022-23134 | Low | 3.7 | 2022-01-13 | After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious a… |
CVE-2022-23133 | Medium | 6.3 | 2022-01-13 | An authenticated user can create a hosts group from the configuration with XSS payload, which will be available for other users. When XSS is stored by an authe… |
CVE-2022-23132 | Low | 3.3 | 2022-01-13 | During Zabbix installation from RPM, DAC_OVERRIDE SELinux capability is in use to access PID files in [/var/run/zabbix] folder. In this case, Zabbix Proxy or S… |
CVE-2022-23131 | Critical | 9.1 | 2022-01-13 | In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login st… |
CVE-2022-22113 | High | 8.8 | 2022-01-13 | In DayByDay CRM, versions 2.2.0 through 2.2.1 (latest) are vulnerable to Insufficient Session Expiration. When a password has been changed by the user or by an… |
CVE-2022-22112 | Medium | 5.4 | 2022-01-13 | In DayByDay CRM, versions 1.1 through 2.2.1 (latest) suffer from an application-wide Client-Side Template Injection (CSTI). A low privileged attacker can input… |
CVE-2022-0198 | High | 7.1 | 2022-01-13 | corenlp is vulnerable to Improper Restriction of XML External Entity Reference |
CVE-2022-0197 | High | 8.8 | 2022-01-13 | phoronix-test-suite is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2022-0196 | High | 8.8 | 2022-01-13 | phoronix-test-suite is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2022-23118 | High | 8.8 | 2022-01-12 | Jenkins Debian Package Builder Plugin 1.6.11 and earlier implements functionality that allows agents to invoke command-line `git` at an attacker-specified path… |
CVE-2022-23117 | High | 7.5 | 2022-01-12 | Jenkins Conjur Secrets Plugin 1.0.9 and earlier implements functionality that allows attackers able to control agent processes to retrieve all username/passwor… |
CVE-2022-23116 | High | 7.5 | 2022-01-12 | Jenkins Conjur Secrets Plugin 1.0.9 and earlier implements functionality that allows attackers able to control agent processes to decrypt secrets stored in Jen… |
CVE-2022-23115 | Medium | 5.4 | 2022-01-12 | Cross-site request forgery (CSRF) vulnerabilities in Jenkins batch task Plugin 1.19 and earlier allows attackers with Overall/Read access to retrieve logs, bui… |
CVE-2022-23114 | Low | 3.3 | 2022-01-12 | Jenkins Publish Over SSH Plugin 1.22 and earlier stores password unencrypted in its global configuration file on the Jenkins controller where it can be viewed… |
CVE-2022-23113 | Medium | 4.3 | 2022-01-12 | Jenkins Publish Over SSH Plugin 1.22 and earlier performs a validation of the file name specifying whether it is present or not, resulting in a path traversal… |
CVE-2022-23112 | Medium | 6.5 | 2022-01-12 | A missing permission check in Jenkins Publish Over SSH Plugin 1.22 and earlier allows attackers with Overall/Read access to connect to an attacker-specified SS… |
CVE-2022-23111 | Medium | 4.3 | 2022-01-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Publish Over SSH Plugin 1.22 and earlier allows attackers to connect to an attacker-specified SSH… |
CVE-2022-23110 | Medium | 4.8 | 2022-01-12 | Jenkins Publish Over SSH Plugin 1.22 and earlier does not escape the SSH server name, resulting in a stored cross-site scripting (XSS) vulnerability exploitabl… |
CVE-2022-23109 | Medium | 6.5 | 2022-01-12 | Jenkins HashiCorp Vault Plugin 3.7.0 and earlier does not mask Vault credentials in Pipeline build logs or in Pipeline step descriptions when Pipeline: Groovy… |
CVE-2022-23108 | Medium | 5.4 | 2022-01-12 | Jenkins Badge Plugin 1.9 and earlier does not escape the description and does not check for allowed protocols when creating a badge, resulting in a stored cros… |
CVE-2022-23107 | High | 8.1 | 2022-01-12 | Jenkins Warnings Next Generation Plugin 9.10.2 and earlier does not restrict the name of a file when configuring custom ID, allowing attackers with Item/Config… |
CVE-2022-23106 | Medium | 5.3 | 2022-01-12 | Jenkins Configuration as Code Plugin 1.55 and earlier used a non-constant time comparison function when validating an authentication token allowing attackers t… |
CVE-2022-23105 | Medium | 6.5 | 2022-01-12 | Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active Directory servers in most… |
CVE-2022-20621 | Medium | 5.5 | 2022-01-12 | Jenkins Metrics Plugin 4.0.2.8 and earlier stores an access key unencrypted in its global configuration file on the Jenkins controller where it can be viewed b… |
CVE-2022-20620 | Medium | 4.3 | 2022-01-12 | Missing permission checks in Jenkins SSH Agent Plugin 1.23 and earlier allows attackers with Overall/Read access to enumerate credentials IDs of credentials st… |
CVE-2022-20619 | High | 7.1 | 2022-01-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers to connect to an att… |
CVE-2022-20618 | Medium | 4.3 | 2022-01-12 | A missing permission check in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers with Overall/Read access to enumerate crede… |
CVE-2022-20617 | High | 8.8 | 2022-01-12 | Jenkins Docker Commons Plugin 1.17 and earlier does not sanitize the name of an image or a tag, resulting in an OS command execution vulnerability exploitable… |
CVE-2022-20616 | Medium | 4.3 | 2022-01-12 | Jenkins Credentials Binding Plugin 1.27 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overa… |
CVE-2022-20615 | Medium | 5.4 | 2022-01-12 | Jenkins Matrix Project Plugin 1.19 and earlier does not escape HTML metacharacters in node and label names, and label descriptions, resulting in a stored cross… |
CVE-2022-20614 | Medium | 4.3 | 2022-01-12 | A missing permission check in Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier allows attackers with Overall/Read access to use the DNS used by the Jenki… |
CVE-2022-20613 | Medium | 4.3 | 2022-01-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier allows attackers to use the DNS used by the Jenkins… |
CVE-2022-20612 | Medium | 4.3 | 2022-01-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without parame… |
CVE-2022-21676 | High | 7.5 | 2022-01-12 | Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP reques… |
CVE-2022-21675 | Critical | 9.9 | 2022-01-12 | Bytecode Viewer (BCV) is a Java/Android reverse engineering suite. Versions of the package prior to 2.11.0 are vulnerable to Arbitrary File Write via Archive E… |
CVE-2022-0015 | High | 7.8 | 2022-01-12 | A local privilege escalation (PE) vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables an authenticated local user to execute programs… |
CVE-2022-0014 | Medium | 6.7 | 2022-01-12 | An untrusted search path vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables a local attacker with file creation privilege in the Wind… |
CVE-2022-0013 | Medium | 5.0 | 2022-01-12 | A file information exposure vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables a local attacker to read the contents of arbitrary fil… |
CVE-2022-0012 | Medium | 6.1 | 2022-01-12 | An improper link resolution before file access vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables a local user t… |
CVE-2022-0179 | Medium | 5.4 | 2022-01-12 | snipe-it is vulnerable to Missing Authorization |
CVE-2022-0159 | Medium | 5.4 | 2022-01-12 | orchardcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2022-0087 | Medium | 6.1 | 2022-01-12 | keystone is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2022-21646 | High | 8.1 | 2022-01-11 | SpiceDB is a database system for managing security-critical application permissions. Any user making use of a wildcard relationship under the right hand branch… |
CVE-2022-21970 | Medium | 6.1 | 2022-01-11 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2022-21969 | Critical | 9.0 | 2022-01-11 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2022-21964 | Medium | 5.5 | 2022-01-11 | Remote Desktop Licensing Diagnoser Information Disclosure Vulnerability |
CVE-2022-21963 | Medium | 6.4 | 2022-01-11 | Windows Resilient File System (ReFS) Remote Code Execution Vulnerability |
CVE-2022-21962 | Medium | 6.8 | 2022-01-11 | Windows Resilient File System (ReFS) Remote Code Execution Vulnerability |
CVE-2022-21961 | Medium | 6.8 | 2022-01-11 | Windows Resilient File System (ReFS) Remote Code Execution Vulnerability |
CVE-2022-21960 | Medium | 6.8 | 2022-01-11 | Windows Resilient File System (ReFS) Remote Code Execution Vulnerability |
CVE-2022-21959 | Medium | 6.8 | 2022-01-11 | Windows Resilient File System (ReFS) Remote Code Execution Vulnerability |
CVE-2022-21958 | Medium | 6.8 | 2022-01-11 | Windows Resilient File System (ReFS) Remote Code Execution Vulnerability |
CVE-2022-21954 | Medium | 6.1 | 2022-01-11 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2022-21932 | High | 7.6 | 2022-01-11 | Microsoft Dynamics 365 Customer Engagement Cross-Site Scripting Vulnerability |
CVE-2022-21931 | Medium | 4.2 | 2022-01-11 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2022-21930 | Medium | 4.2 | 2022-01-11 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2022-21929 | Low | 2.5 | 2022-01-11 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2022-21928 | Medium | 6.3 | 2022-01-11 | Windows Resilient File System (ReFS) Remote Code Execution Vulnerability |
CVE-2022-21925 | Medium | 5.3 | 2022-01-11 | Windows BackupKey Remote Protocol Security Feature Bypass Vulnerability |
CVE-2022-21924 | Medium | 5.3 | 2022-01-11 | Workstation Service Remote Protocol Security Feature Bypass Vulnerability |
CVE-2022-21922 | High | 8.8 | 2022-01-11 | Remote Procedure Call Runtime Remote Code Execution Vulnerability |
CVE-2022-21921 | Medium | 4.4 | 2022-01-11 | Windows Defender Credential Guard Security Feature Bypass Vulnerability |
CVE-2022-21920 | High | 8.8 | 2022-01-11 | Windows Kerberos Elevation of Privilege Vulnerability |
CVE-2022-21919 | High | 7.0 | 2022-01-11 | Windows User Profile Service Elevation of Privilege Vulnerability |
CVE-2022-21918 | Medium | 6.5 | 2022-01-11 | DirectX Graphics Kernel File Denial of Service Vulnerability |
CVE-2022-21917 | High | 7.8 | 2022-01-11 | HEVC Video Extensions Remote Code Execution Vulnerability |
CVE-2022-21916 | High | 7.8 | 2022-01-11 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
CVE-2022-21915 | Medium | 6.5 | 2022-01-11 | Windows GDI+ Information Disclosure Vulnerability |
CVE-2022-21914 | High | 7.8 | 2022-01-11 | Windows Remote Access Connection Manager Elevation of Privilege Vulnerability |
CVE-2022-21913 | Medium | 5.3 | 2022-01-11 | Local Security Authority (Domain Policy) Remote Protocol Security Feature Bypass |
CVE-2022-21912 | High | 7.8 | 2022-01-11 | DirectX Graphics Kernel Remote Code Execution Vulnerability |
CVE-2022-21911 | High | 7.5 | 2022-01-11 | .NET Framework Denial of Service Vulnerability |
CVE-2022-21910 | High | 7.8 | 2022-01-11 | Microsoft Cluster Port Driver Elevation of Privilege Vulnerability |
CVE-2022-21908 | High | 7.8 | 2022-01-11 | Windows Installer Elevation of Privilege Vulnerability |
CVE-2022-21907 | Critical | 9.8 | 2022-01-11 | HTTP Protocol Stack Remote Code Execution Vulnerability |
CVE-2022-21906 | Medium | 5.5 | 2022-01-11 | Windows Defender Application Control Security Feature Bypass Vulnerability |
CVE-2022-21905 | Medium | 4.6 | 2022-01-11 | Windows Hyper-V Security Feature Bypass Vulnerability |
CVE-2022-21904 | High | 7.5 | 2022-01-11 | Windows GDI Information Disclosure Vulnerability |
CVE-2022-21903 | High | 7.0 | 2022-01-11 | Windows GDI Elevation of Privilege Vulnerability |
CVE-2022-21902 | High | 7.8 | 2022-01-11 | Windows DWM Core Library Elevation of Privilege Vulnerability |
CVE-2022-21901 | Critical | 9.0 | 2022-01-11 | Windows Hyper-V Elevation of Privilege Vulnerability |
CVE-2022-21900 | Medium | 4.6 | 2022-01-11 | Windows Hyper-V Security Feature Bypass Vulnerability |
CVE-2022-21899 | Medium | 5.5 | 2022-01-11 | Windows Extensible Firmware Interface Security Feature Bypass Vulnerability |
CVE-2022-21898 | High | 7.8 | 2022-01-11 | DirectX Graphics Kernel Remote Code Execution Vulnerability |
CVE-2022-21897 | High | 7.8 | 2022-01-11 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
CVE-2022-21896 | High | 7.0 | 2022-01-11 | Windows DWM Core Library Elevation of Privilege Vulnerability |
CVE-2022-21895 | High | 7.8 | 2022-01-11 | Windows User Profile Service Elevation of Privilege Vulnerability |
CVE-2022-21894 | Medium | 4.4 | 2022-01-11 | Secure Boot Security Feature Bypass Vulnerability |
CVE-2022-21893 | High | 8.0 | 2022-01-11 | Remote Desktop Protocol Remote Code Execution Vulnerability |
CVE-2022-21892 | Medium | 6.8 | 2022-01-11 | Windows Resilient File System (ReFS) Remote Code Execution Vulnerability |
CVE-2022-21891 | High | 7.6 | 2022-01-11 | Microsoft Dynamics 365 (on-premises) Spoofing Vulnerability |
CVE-2022-21890 | High | 7.5 | 2022-01-11 | Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability |
CVE-2022-21889 | High | 7.5 | 2022-01-11 | Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability |
CVE-2022-21888 | High | 7.8 | 2022-01-11 | Windows Modern Execution Server Remote Code Execution Vulnerability |