2022 CVEs (page 264)
Page 264 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-21866 | High | 7.0 | 2022-01-11 | Windows System Launcher Elevation of Privilege Vulnerability |
CVE-2022-21865 | High | 7.0 | 2022-01-11 | Connected Devices Platform Service Elevation of Privilege Vulnerability |
CVE-2022-21864 | High | 7.0 | 2022-01-11 | Windows UI Immersive Server API Elevation of Privilege Vulnerability |
CVE-2022-21863 | High | 7.0 | 2022-01-11 | Windows StateRepository API Server file Elevation of Privilege Vulnerability |
CVE-2022-21862 | High | 7.0 | 2022-01-11 | Windows Application Model Core API Elevation of Privilege Vulnerability |
CVE-2022-21861 | High | 7.0 | 2022-01-11 | Task Flow Data Engine Elevation of Privilege Vulnerability |
CVE-2022-21860 | High | 7.0 | 2022-01-11 | Windows AppContracts API Server Elevation of Privilege Vulnerability |
CVE-2022-21859 | High | 7.0 | 2022-01-11 | Windows Accounts Control Elevation of Privilege Vulnerability |
CVE-2022-21858 | High | 7.8 | 2022-01-11 | Windows Bind Filter Driver Elevation of Privilege Vulnerability |
CVE-2022-21857 | High | 8.8 | 2022-01-11 | Active Directory Domain Services Elevation of Privilege Vulnerability |
CVE-2022-21855 | Critical | 9.0 | 2022-01-11 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2022-21852 | High | 7.8 | 2022-01-11 | Windows DWM Core Library Elevation of Privilege Vulnerability |
CVE-2022-21851 | High | 8.8 | 2022-01-11 | Remote Desktop Client Remote Code Execution Vulnerability |
CVE-2022-21850 | High | 8.8 | 2022-01-11 | Remote Desktop Client Remote Code Execution Vulnerability |
CVE-2022-21849 | Critical | 9.8 | 2022-01-11 | Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability |
CVE-2022-21848 | High | 7.5 | 2022-01-11 | Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability |
CVE-2022-21847 | Medium | 6.5 | 2022-01-11 | Windows Hyper-V Denial of Service Vulnerability |
CVE-2022-21846 | Critical | 9.0 | 2022-01-11 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2022-21843 | High | 7.5 | 2022-01-11 | Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability |
CVE-2022-21842 | High | 7.8 | 2022-01-11 | Microsoft Word Remote Code Execution Vulnerability |
CVE-2022-21841 | High | 7.8 | 2022-01-11 | Microsoft Excel Remote Code Execution Vulnerability |
CVE-2022-21840 | High | 8.8 | 2022-01-11 | Microsoft Office Remote Code Execution Vulnerability |
CVE-2022-21839 | Medium | 6.1 | 2022-01-11 | Windows Event Tracing Discretionary Access Control List Denial of Service Vulnerability |
CVE-2022-21838 | Medium | 5.5 | 2022-01-11 | Windows Cleanup Manager Elevation of Privilege Vulnerability |
CVE-2022-21837 | High | 8.3 | 2022-01-11 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2022-21836 | High | 7.8 | 2022-01-11 | Windows Certificate Spoofing Vulnerability |
CVE-2022-21835 | High | 7.8 | 2022-01-11 | Microsoft Cryptographic Services Elevation of Privilege Vulnerability |
CVE-2022-21834 | High | 7.0 | 2022-01-11 | Windows User-mode Driver Framework Reflector Driver Elevation of Privilege Vulnerability |
CVE-2022-21833 | High | 7.8 | 2022-01-11 | Virtual Machine IDE Drive Elevation of Privilege Vulnerability |
CVE-2022-0173 | Medium | 5.5 | 2022-01-11 | radare2 is vulnerable to Out-of-bounds Read |
CVE-2022-0129 | High | 7.4 | 2022-01-11 | Uncontrolled search path element vulnerability in McAfee TechCheck prior to 4.0.0.2 allows a local administrator to load their own Dynamic Link Library (DLL) g… |
CVE-2022-0170 | Medium | 4.3 | 2022-01-11 | peertube is vulnerable to Improper Access Control |
CVE-2022-21671 | High | 8.1 | 2022-01-11 | @replit/crosis is a JavaScript client that speaks Replit's container protocol. A vulnerability that involves exposure of sensitive information exists in versio… |
CVE-2022-21669 | Critical | 9.1 | 2022-01-11 | PuddingBot is a group management bot. In version 0.0.6-b933652 and prior, the bot token is publicly exposed in main.py, making it accessible to malicious actor… |
CVE-2022-0144 | High | 7.1 | 2022-01-11 | shelljs is vulnerable to Improper Privilege Management |
CVE-2022-21672 | Medium | 6.5 | 2022-01-10 | make-ca is a utility to deliver and manage a complete PKI configuration for workstations and servers. Starting with version 0.9 and prior to version 1.10, make… |
CVE-2022-21670 | Medium | 5.3 | 2022-01-10 | markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser signific… |
CVE-2022-21668 | High | 8.0 | 2022-01-10 | pipenv is a Python development workflow tool. Starting with version 2018.10.9 and prior to version 2022.1.8, a flaw in pipenv's parsing of requirements files a… |
CVE-2022-21666 | High | 7.2 | 2022-01-10 | Useful Simple Open-Source CMS (USOC) is a content management system (CMS) for programmers. Versions prior to Pb2.4Bfx3 allowed Sql injection in usersearch.php… |
CVE-2022-0155 | Medium | 6.5 | 2022-01-10 | follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor |
CVE-2022-0174 | Medium | 4.3 | 2022-01-10 | Improper Validation of Specified Quantity in Input vulnerability in dolibarr dolibarr/dolibarr. |
CVE-2022-22121 | High | 8.0 | 2022-01-10 | In NocoDB, versions 0.81.0 through 0.83.8 are affected by CSV Injection vulnerability (Formula Injection). A low privileged attacker can create a new table to… |
CVE-2022-22120 | Medium | 5.3 | 2022-01-10 | In NocoDB, versions 0.9 to 0.83.8 are vulnerable to Observable Discrepancy in the password-reset feature. When requesting a password reset for a given email ad… |
CVE-2022-22117 | Medium | 5.4 | 2022-01-10 | In Directus, versions 9.0.0-alpha.4 through 9.4.1 allow unrestricted file upload of .html files in the media upload functionality, which leads to Cross-Site Sc… |
CVE-2022-22116 | Medium | 5.4 | 2022-01-10 | In Directus, versions 9.0.0-alpha.4 through 9.4.1 are vulnerable to stored Cross-Site Scripting (XSS) vulnerability via SVG file upload in media upload functio… |
CVE-2022-22115 | Critical | 9.0 | 2022-01-10 | In Teedy, versions v1.5 through v1.9 are vulnerable to Stored Cross-Site Scripting (XSS) in the name of a created Tag. Since the Tag name is not being sanitize… |
CVE-2022-22114 | Critical | 9.6 | 2022-01-10 | In Teedy, versions v1.5 through v1.9 are vulnerable to Reflected Cross-Site Scripting (XSS). The “search term" search functionality is not sufficiently sanitiz… |
CVE-2022-0158 | Low | 3.3 | 2022-01-10 | vim is vulnerable to Heap-based Buffer Overflow |
CVE-2022-0157 | Medium | 5.4 | 2022-01-10 | phoronix-test-suite is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2022-0156 | Medium | 5.5 | 2022-01-10 | vim is vulnerable to Use After Free |
CVE-2022-22847 | Critical | 9.8 | 2022-01-10 | Formpipe Lasernet before 9.13.3 allows file inclusion in Client Web Services (either by an authenticated attacker, or in a configuration that does not require… |
CVE-2022-22846 | High | 7.5 | 2022-01-10 | The dnslib package through 0.9.16 for Python does not verify that the ID value in a DNS reply matches an ID value in a query. |
CVE-2022-22845 | Critical | 9.8 | 2022-01-10 | QXIP SIPCAPTURE homer-app before 1.4.28 for HOMER 7.x has the same 167f0db2-f83e-4baa-9736-d56064a5b415 JWT secret key across different customers' installation… |
CVE-2022-22844 | Medium | 5.5 | 2022-01-10 | LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field. |
CVE-2022-22836 | Medium | 6.5 | 2022-01-10 | CoreFTP Server before 727 allows directory traversal (for file creation) by an authenticated attacker via ../ in an HTTP PUT request. |
CVE-2022-22827 | High | 8.8 | 2022-01-10 | storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. |
CVE-2022-22826 | High | 8.8 | 2022-01-10 | nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. |
CVE-2022-22825 | High | 8.8 | 2022-01-10 | lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. |
CVE-2022-22824 | Critical | 9.8 | 2022-01-10 | defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. |
CVE-2022-22823 | Critical | 9.8 | 2022-01-10 | build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. |
CVE-2022-22822 | Critical | 9.8 | 2022-01-10 | addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. |
CVE-2022-22821 | Low | 2.0 | 2022-01-10 | NVIDIA NeMo before 1.6.0 contains a vulnerability in ASR WebApp, in which ../ Path Traversal may lead to deletion of any directory when admin privileges are av… |
CVE-2022-22817 | Critical | 9.8 | 2022-01-10 | PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could a… |
CVE-2022-22816 | Medium | 6.5 | 2022-01-10 | path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path. |
CVE-2022-22815 | Medium | 6.5 | 2022-01-10 | path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path. |
CVE-2022-22702 | Medium | 4.3 | 2022-01-10 | PartKeepr versions up to v1.4.0, in the functionality to upload attachments using a URL when creating a part does not validate that requests can be made to loc… |
CVE-2022-22701 | Medium | 6.5 | 2022-01-10 | PartKeepr versions up to v1.4.0, loads attachments using a URL while creating a part and allows the use of the 'file://' URI scheme, allowing an authenticated… |
CVE-2022-22289 | Medium | 5.3 | 2022-01-10 | Improper access control vulnerability in S Assistant prior to version 7.5 allows attacker to remotely get senstive information. |
CVE-2022-22288 | High | 7.5 | 2022-01-10 | Improper authorization vulnerability in Galaxy Store prior to 4.5.36.5 allows remote app installation of the allowlist. |
CVE-2022-22287 | Low | 3.9 | 2022-01-10 | Abitrary file access vulnerability in Samsung Email prior to 6.1.60.16 allows attacker to read isolated data in sandbox. |
CVE-2022-22286 | Medium | 4.4 | 2022-01-10 | A vulnerability using PendingIntent in Bixby Routines prior to version 3.1.21.8 in Android R(11.0) and 2.6.30.5 in Android Q(10.0) allows attackers to execute… |
CVE-2022-22285 | Medium | 4.4 | 2022-01-10 | A vulnerability using PendingIntent in Reminder prior to version 12.2.05.0 in Android R(11.0) and 12.3.02.1000 in Android S(12.0) allows attackers to execute p… |
CVE-2022-22284 | Medium | 5.7 | 2022-01-10 | Improper authentication vulnerability in Samsung Internet prior to 16.0.2.19 allows attackers to bypass secret mode password authentication |
CVE-2022-22283 | Low | 2.8 | 2022-01-10 | Improper session management vulnerability in Samsung Health prior to 6.20.1.005 prevents logging out from Samsung Health App. |
CVE-2022-22272 | Medium | 4.0 | 2022-01-10 | Improper authorization in TelephonyManager prior to SMR Jan-2022 Release 1 allows attackers to get IMSI without READ_PRIVILEGED_PHONE_STATE permission |
CVE-2022-22271 | Medium | 5.5 | 2022-01-10 | A missing input validation before memory copy in TIMA trustlet prior to SMR Jan-2022 Release 1 allows attackers to copy data from arbitrary memory. |
CVE-2022-22270 | Medium | 4.4 | 2022-01-10 | An implicit Intent hijacking vulnerability in Dialer prior to SMR Jan-2022 Release 1 allows unprivileged applications to access contact information. |
CVE-2022-22269 | Medium | 4.0 | 2022-01-10 | Keeping sensitive data in unprotected BluetoothSettingsProvider prior to SMR Jan-2022 Release 1 allows untrusted applications to get a local Bluetooth MAC addr… |
CVE-2022-22268 | Medium | 6.1 | 2022-01-10 | Incorrect implementation of Knox Guard prior to SMR Jan-2022 Release 1 allows physically proximate attackers to temporary unlock the Knox Guard via Samsung DeX… |
CVE-2022-22267 | Medium | 4.0 | 2022-01-10 | Implicit Intent hijacking vulnerability in ActivityMetricsLogger prior to SMR Jan-2022 Release 1 allows attackers to get running application information. |
CVE-2022-22266 | Medium | 4.0 | 2022-01-10 | (Applicable to China models only) Unprotected WifiEvaluationService in TencentWifiSecurity application prior to SMR Jan-2022 Release 1 allows untrusted applica… |
CVE-2022-22265 | Medium | 5.0 | 2022-01-10 | An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary memory write and code execution. |
CVE-2022-22264 | High | 7.7 | 2022-01-10 | Improper sanitization of incoming intent in Dressroom prior to SMR Jan-2022 Release 1 allows local attackers to read and write arbitrary files without permissi… |
CVE-2022-22263 | Medium | 4.0 | 2022-01-10 | Unprotected dynamic receiver in SecSettings prior to SMR Jan-2022 Release 1 allows untrusted applications to launch arbitrary activity. |
CVE-2022-21823 | Medium | 5.5 | 2022-01-10 | A insecure storage of sensitive information vulnerability exists in Ivanti Workspace Control <2021.2 (10.7.30.0) that could allow an attacker with locally auth… |
CVE-2022-21667 | High | 7.5 | 2022-01-10 | soketi is an open-source WebSockets server. There is an unhandled case when reading POST requests which results in the server crashing if it could not read the… |
CVE-2022-0133 | High | 7.5 | 2022-01-10 | peertube is vulnerable to Improper Access Control |
CVE-2022-0132 | High | 7.5 | 2022-01-10 | peertube is vulnerable to Server-Side Request Forgery (SSRF) |
CVE-2022-21664 | High | 7.4 | 2022-01-06 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to lack of proper sanitization in one of t… |
CVE-2022-21663 | Medium | 6.6 | 2022-01-06 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with Super Admin role ca… |
CVE-2022-21662 | High | 8.0 | 2022-01-06 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Low-privileged authenticated users (like autho… |
CVE-2022-21661 | High | 8.0 | 2022-01-06 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, ther… |
CVE-2022-0128 | High | 7.8 | 2022-01-06 | vim is vulnerable to Out-of-bounds Read |
CVE-2022-22707 | Medium | 5.9 | 2022-01-06 | In lighttpd 1.4.46 through 1.4.63, the mod_extforward_Forwarded function of the mod_extforward plugin has a stack-based buffer overflow (4 bytes representing -… |
CVE-2022-22704 | Critical | 9.8 | 2022-01-06 | The zabbix-agent2 package before 5.4.9-r1 for Alpine Linux sometimes allows privilege escalation to root because the design incorrectly expected that systemd w… |
CVE-2022-0122 | Medium | 6.1 | 2022-01-06 | forge is vulnerable to URL Redirection to Untrusted Site |
CVE-2022-0121 | High | 8.0 | 2022-01-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hoppscotch hoppscotch/hoppscotch.This issue affects hopps… |
CVE-2022-21653 | Medium | 5.9 | 2022-01-05 | Jawn is an open source JSON parser. Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext… |
CVE-2022-21652 | Low | 3.5 | 2022-01-05 | Shopware is an open source e-commerce software platform. In affected versions shopware would not invalidate a user session in the event of a password change. W… |
CVE-2022-21651 | Medium | 6.8 | 2022-01-05 | Shopware is an open source e-commerce software platform. An open redirect vulnerability has been discovered. Users may be arbitrary redirected due to incomplet… |