2022 CVEs (page 27)
Page 27 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-48645 | Medium | 5.5 | 2024-04-28 | In the Linux kernel, the following vulnerability has been resolved: net: enetc: deny offload of tc-based TSN features on VF interfaces TSN features on the EN… |
CVE-2022-48644 | Medium | 5.5 | 2024-04-28 | In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: avoid disabling offload when it was never enabled In an incredibly str… |
CVE-2022-48643 | Medium | 5.5 | 2024-04-28 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix nft_counters_enabled underflow at nf_tables_addchain() syzbot i… |
CVE-2022-48642 | Medium | 5.5 | 2024-04-28 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix percpu memory leak at nf_tables_addchain() It seems to me that… |
CVE-2022-48641 | Medium | 5.5 | 2024-04-28 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: fix memory leak when blob is malformed The bug fix was incomplete, i… |
CVE-2022-48640 | Medium | 5.5 | 2024-04-28 | In the Linux kernel, the following vulnerability has been resolved: bonding: fix NULL deref in bond_rr_gen_slave_id Fix a NULL dereference of the struct bond… |
CVE-2022-48639 | Medium | 5.5 | 2024-04-28 | In the Linux kernel, the following vulnerability has been resolved: net: sched: fix possible refcount leak in tc_new_tfilter() tfilter_put need to be called… |
CVE-2022-48638 | Medium | 5.3 | 2024-04-28 | In the Linux kernel, the following vulnerability has been resolved: cgroup: cgroup_get_from_id() must check the looked-up kn is a directory cgroup has to be… |
CVE-2022-48637 | High | 7.8 | 2024-04-28 | In the Linux kernel, the following vulnerability has been resolved: bnxt: prevent skb UAF after handing over to PTP worker When reading the timestamp is requ… |
CVE-2022-48636 | High | 7.8 | 2024-04-28 | In the Linux kernel, the following vulnerability has been resolved: s390/dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup Fix Oops in dasd_… |
CVE-2022-48635 | Medium | 6.2 | 2024-04-28 | In the Linux kernel, the following vulnerability has been resolved: fsdax: Fix infinite loop in dax_iomap_rw() I got an infinite loop and a WARNING report wh… |
CVE-2022-48634 | Medium | 5.3 | 2024-04-28 | In the Linux kernel, the following vulnerability has been resolved: drm/gma500: Fix BUG: sleeping function called from invalid context errors gma_crtc_page_f… |
CVE-2022-48633 | Medium | 5.5 | 2024-04-28 | In the Linux kernel, the following vulnerability has been resolved: drm/gma500: Fix WARN_ON(lock->magic != lock) error psb_gem_unpin() calls dma_resv_lock()… |
CVE-2022-48632 | High | 7.8 | 2024-04-28 | In the Linux kernel, the following vulnerability has been resolved: i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() memcpy() is cal… |
CVE-2022-48631 | Medium | 5.5 | 2024-04-28 | In the Linux kernel, the following vulnerability has been resolved: ext4: fix bug in extents parsing when eh_entries == 0 and eh_depth > 0 When walking throu… |
CVE-2022-48685 | High | 7.7 | 2024-04-27 | An issue was discovered in Logpoint 7.1 before 7.1.2. The daily executed cron file clean_secbi_old_logs is writable by all users and is executed as root, leadi… |
CVE-2022-48684 | High | 8.4 | 2024-04-27 | An issue was discovered in Logpoint before 7.1.1. Template injection was seen in the search template. The search template uses jinja templating for generating… |
CVE-2022-48611 | High | 7.8 | 2024-04-26 | A logic issue was addressed with improved checks. This issue is fixed in iTunes 12.12.4 for Windows. A local attacker may be able to elevate their privileges. |
CVE-2022-40975 | Medium | 5.4 | 2024-04-26 | Missing Authorization vulnerability in Aazztech Post Slider.This issue affects Post Slider: from n/a through 1.6.7. |
CVE-2022-48682 | Medium | 6.0 | 2024-04-26 | In deletefiles in FDUPES before 2.2.0, a TOCTOU race condition allows arbitrary file deletion via a symlink. |
CVE-2022-36029 | Critical | 9.1 | 2024-04-25 | Greenlight is an end-user interface for BigBlueButton servers. Versions prior to 2.13.0 have an open redirect vulnerability in the Login page due to unchecked… |
CVE-2022-36028 | Critical | 9.1 | 2024-04-25 | Greenlight is an end-user interface for BigBlueButton servers. Versions prior to 2.13.0 have an open redirect vulnerability in the Login page due to unchecked… |
CVE-2022-45852 | Medium | 6.5 | 2024-04-24 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in FormAssembly / Drew Buschhorn WP-FormAssembly allows Path Trave… |
CVE-2022-46897 | Medium | 5.3 | 2024-04-22 | An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. The CapsuleIFWUSmm driver does not check the return value from a method or function. T… |
CVE-2022-35503 | High | 7.5 | 2024-04-22 | Improper verification of a user input in Open Source MANO v7-v12 allows an authenticated attacker to execute arbitrary code within the LCM module container via… |
CVE-2022-34562 | Medium | 6.1 | 2024-04-22 | A cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the s… |
CVE-2022-34561 | Medium | 4.3 | 2024-04-22 | A cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the v… |
CVE-2022-34560 | High | 7.1 | 2024-04-22 | A cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the H… |
CVE-2022-40745 | Medium | 5.5 | 2024-04-19 | IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to obtain sensitive information due to weaker than expected security. IBM X-Force ID: 236452. |
CVE-2022-47151 | High | 8.6 | 2024-04-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plug… |
CVE-2022-41698 | Medium | 6.5 | 2024-04-17 | Missing Authorization vulnerability in Layered If Menu.This issue affects If Menu: from n/a through 0.16.3. |
CVE-2022-24810 | Medium | 6.5 | 2024-04-16 | net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-write credentials can use a malfor… |
CVE-2022-24809 | Medium | 6.5 | 2024-04-16 | net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-only credentials can use a malform… |
CVE-2022-24808 | Medium | 6.5 | 2024-04-16 | net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-write credentials can use a malfor… |
CVE-2022-24807 | Medium | 6.5 | 2024-04-16 | net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a malformed OID in a SET request to `SNMP-VIEW-BASE… |
CVE-2022-24806 | Medium | 6.5 | 2024-04-16 | net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-write credentials can exploit an I… |
CVE-2022-24805 | Medium | 6.5 | 2024-04-16 | net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a buffer overflow in the handling of the `INDEX` of… |
CVE-2022-40211 | Medium | 5.9 | 2024-04-12 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GiveWP allows Stored XSS.This issue affects GiveWP: from… |
CVE-2022-47604 | Medium | 4.3 | 2024-04-11 | Missing Authorization vulnerability in junkcoder, ristoniinemets AJAX Thumbnail Rebuild.This issue affects AJAX Thumbnail Rebuild: from n/a through 1.13. |
CVE-2022-44633 | Medium | 6.5 | 2024-04-11 | Missing Authorization vulnerability in YITH YITH WooCommerce Gift Cards Premium.This issue affects YITH WooCommerce Gift Cards Premium: from n/a through 3.23.1. |
CVE-2022-4965 | Medium | 6.1 | 2024-04-09 | The Invitation Code Content Restriction Plugin from CreativeMinds plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘target_id’ para… |
CVE-2022-47894 | Medium | 5.3 | 2024-04-09 | Improper Input Validation vulnerability in Apache Zeppelin SAP.This issue affects Apache Zeppelin SAP: from 0.8.0 before 0.11.0. As this project is retired, w… |
CVE-2022-43216 | Critical | 9.1 | 2024-04-08 | AbrhilSoft Employee's Portal before v5.6.2 was discovered to contain a SQL injection vulnerability in the login page. |
CVE-2022-4966 | Low | 3.5 | 2024-04-01 | A vulnerability was found in sequentech admin-console up to 6.1.7 and classified as problematic. Affected by this issue is some unknown functionality of the co… |
CVE-2022-47153 | High | 7.1 | 2024-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPJobBoard Jobeleon Theme allows Reflected XSS.This issue… |
CVE-2022-45850 | Medium | 6.1 | 2024-03-28 | Cross-Site Request Forgery (CSRF) vulnerability in Nickys Image Map Pro allows Stored XSS.This issue affects Image Map Pro: from n/a before 5.6.9. |
CVE-2022-45847 | Medium | 6.1 | 2024-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in WPAssist.Me WordPress Countdown Widget allows Cross-Site Scripting (XSS).This issue affects WordPress Countd… |
CVE-2022-45851 | Medium | 5.4 | 2024-03-25 | Missing Authorization vulnerability in ShareThis ShareThis Dashboard for Google Analytics.This issue affects ShareThis Dashboard for Google Analytics: from n/a… |
CVE-2022-45356 | Medium | 5.4 | 2024-03-25 | Missing Authorization vulnerability in Muffingroup Betheme.This issue affects Betheme: from n/a through 26.6.1. |
CVE-2022-45352 | Medium | 5.4 | 2024-03-25 | Missing Authorization vulnerability in Muffingroup Betheme.This issue affects Betheme: from n/a through 26.6.1. |
CVE-2022-45351 | Medium | 5.4 | 2024-03-25 | Missing Authorization vulnerability in Muffingroup Betheme.This issue affects Betheme: from n/a through 26.6.1. |
CVE-2022-45349 | Medium | 4.3 | 2024-03-25 | Missing Authorization vulnerability in Muffingroup Betheme.This issue affects Betheme: from n/a through 26.6.1. |
CVE-2022-44626 | Medium | 6.3 | 2024-03-25 | Missing Authorization vulnerability in Squirrly SEO Plugin by Squirrly SEO.This issue affects SEO Plugin by Squirrly SEO: from n/a through 12.1.20. |
CVE-2022-38057 | Medium | 6.5 | 2024-03-25 | Missing Authorization vulnerability in ThemeHunk Advance WordPress Search Plugin.This issue affects Advance WordPress Search Plugin: from n/a through 1.2.1. |
CVE-2022-36407 | Critical | 9.9 | 2024-03-25 | Insertion of Sensitive Information into Log File vulnerability in Hitachi Virtual Storage Platform, Hitachi Virtual Storage Platform VP9500, Hitachi Virtual St… |
CVE-2022-32756 | Low | 2.7 | 2024-03-22 | IBM Security Verify Directory 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the b… |
CVE-2022-32754 | Medium | 4.8 | 2024-03-22 | IBM Security Verify Directory 10.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI th… |
CVE-2022-32753 | Medium | 4.5 | 2024-03-22 | IBM Security Verify Directory 10.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information… |
CVE-2022-32751 | Medium | 5.3 | 2024-03-22 | IBM Security Verify Directory 10.0.0 could disclose sensitive server information that could be used in further attacks against the system. IBM X-Force ID: 22… |
CVE-2022-44595 | Medium | 5.3 | 2024-03-21 | Improper Authentication vulnerability in Melapress WP 2FA allows Authentication Bypass.This issue affects WP 2FA: from n/a through 2.2.0. |
CVE-2022-4963 | Medium | 5.5 | 2024-03-21 | A vulnerability was found in Folio Spring Module Core up to 1.1.5. It has been rated as critical. Affected by this issue is the function dropSchema of the file… |
CVE-2022-47037 | High | 7.5 | 2024-03-18 | Siklu TG Terragraph devices before 2.1.1 allow attackers to discover valid, randomly generated credentials via GetCredentials. |
CVE-2022-47036 | Critical | 9.8 | 2024-03-18 | Siklu TG Terragraph devices before approximately 2.1.1 have a hardcoded root password that has been revealed via a brute force attack on an MD5 hash. It can be… |
CVE-2022-34321 | High | 8.2 | 2024-03-12 | Improper Authentication vulnerability in Apache Pulsar Proxy allows an attacker to connect to the /proxy-stats endpoint without authentication. The vulnerable… |
CVE-2022-32257 | Critical | 9.8 | 2024-03-12 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2). The affected application consists of a web service that lacks proper… |
CVE-2022-46070 | High | 7.5 | 2024-03-11 | GV-ASManager V6.0.1.0 contains a Local File Inclusion vulnerability in GeoWebServer via Path. |
CVE-2022-43855 | Medium | 6.2 | 2024-03-08 | IBM SPSS Statistics 26.0, 27.0.1, and 28.0 IO Module could allow a local user to create multiple files that could exhaust the file handles capacity and cause a… |
CVE-2022-46499 | High | 8.8 | 2024-03-07 | Hospital Management System 1.0 was discovered to contain a SQL injection vulnerability via the pat_number parameter at his_admin_view_single_patient.php. |
CVE-2022-46498 | Low | 2.7 | 2024-03-07 | Hospital Management System 1.0 was discovered to contain a SQL injection vulnerability via the doc_number parameter at his_admin_view_single_employee.php. |
CVE-2022-46497 | High | 8.1 | 2024-03-07 | Hospital Management System 1.0 was discovered to contain a SQL injection vulnerability via the pat_number parameter at his_doc_view_single_patien.php. |
CVE-2022-46091 | Medium | 4.7 | 2024-03-07 | Cross Site Scripting (XSS) vulnerability in the feedback form of Online Flight Booking Management System v1.0 allows attackers to execute arbitrary web scripts… |
CVE-2022-46089 | Medium | 6.1 | 2024-03-07 | Cross Site Scripting (XSS) vulnerability in the add-airline form of Online Flight Booking Management System v1.0 allows attackers to execute arbitrary web scri… |
CVE-2022-22399 | Medium | 5.4 | 2024-03-05 | IBM Aspera Faspex 5.0.0 and 5.0.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an atta… |
CVE-2022-46088 | Medium | 6.1 | 2024-03-05 | Online Flight Booking Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the feedback form. |
CVE-2022-48630 | Medium | 5.5 | 2024-03-05 | In the Linux kernel, the following vulnerability has been resolved: crypto: qcom-rng - fix infinite loop on requests not multiple of WORD_SZ The commit refer… |
CVE-2022-48629 | High | 8.1 | 2024-03-05 | In the Linux kernel, the following vulnerability has been resolved: crypto: qcom-rng - ensure buffer for generate is completely filled The generate function… |
CVE-2022-43890 | Medium | 5.3 | 2024-03-04 | IBM Security Verify Privilege On-Premises 11.5 could disclose sensitive information through an HTTP request that could aid an attacker in further attacks again… |
CVE-2022-43880 | Medium | 4.4 | 2024-03-03 | IBM QRadar WinCollect Agent 10.0 through 10.1.2 could allow a privileged user to cause a denial of service. IBM X-Force ID: 240151. |
CVE-2022-48628 | Medium | 5.5 | 2024-03-02 | In the Linux kernel, the following vulnerability has been resolved: ceph: drop messages from MDS when unmounting When unmounting all the dirty buffers will b… |
CVE-2022-48627 | Medium | 5.5 | 2024-03-02 | In the Linux kernel, the following vulnerability has been resolved: vt: fix memory overlapping when deleting chars in the buffer A memory overlapping copy oc… |
CVE-2022-36677 | Medium | 6.1 | 2024-02-29 | Obsidian Mind Map v1.1.0 allows attackers to execute arbitrary code via a crafted payload injected into an uploaded document. |
CVE-2022-34270 | Critical | 9.8 | 2024-02-29 | An issue was discovered in RWS WorldServer before 11.7.3. Regular users can create users with the Administrator role via UserWSUserManager. |
CVE-2022-34269 | High | 8.8 | 2024-02-29 | An issue was discovered in RWS WorldServer before 11.7.3. An authenticated, remote attacker can perform a ws-legacy/load_dtd?system_id= blind SSRF attack to de… |
CVE-2022-48626 | High | 7.8 | 2024-02-26 | In the Linux kernel, the following vulnerability has been resolved: moxart: fix potential use-after-free on remove path It was reported that the mmc host str… |
CVE-2022-34357 | Medium | 6.5 | 2024-02-26 | IBM Cognos Analytics Mobile Server 11.1.7, 11.2.4, and 12.0.0 is vulnerable to Denial of Service due to due to weak or absence of rate limiting. By making unli… |
CVE-2022-43842 | High | 8.6 | 2024-02-23 | IBM Aspera Console 3.4.0 through 3.4.2 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the att… |
CVE-2022-25377 | High | 7.5 | 2024-02-22 | The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ directory traversal. I… |
CVE-2022-45179 | Medium | 5.4 | 2024-02-21 | An issue was discovered in LIVEBOX Collaboration vDesk through v031. A basic XSS vulnerability exists under the /api/v1/vdeskintegration/todo/createorupdate en… |
CVE-2022-45177 | High | 7.5 | 2024-02-21 | An issue was discovered in LIVEBOX Collaboration vDesk through v031. An Observable Response Discrepancy can occur under the /api/v1/vdeskintegration/user/isena… |
CVE-2022-45169 | Medium | 5.4 | 2024-02-21 | An issue was discovered in LIVEBOX Collaboration vDesk through v031. A URL Redirection to an Untrusted Site (Open Redirect) can occur under the /api/v1/notific… |
CVE-2022-45320 | Medium | 6.3 | 2024-02-20 | Liferay Portal before 7.4.3.16 and Liferay DXP before 7.2 fix pack 19, 7.3 before update 6, and 7.4 before update 16 allow remote authenticated users to become… |
CVE-2022-48625 | High | 7.5 | 2024-02-20 | Yealink Config Encrypt Tool add RSA before 1.2 has a built-in RSA key pair, and thus there is a risk of decryption by an adversary. |
CVE-2022-48624 | High | 7.8 | 2024-02-19 | close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE. |
CVE-2022-48621 | High | 7.5 | 2024-02-18 | Vulnerability of missing authentication for critical functions in the Wi-Fi module.Successful exploitation of this vulnerability may affect service confidentia… |
CVE-2022-42443 | Low | 2.2 | 2024-02-17 | An undisclosed issue in Trusteer iOS SDK for mobile versions prior to 5.7 and Trusteer Android SDK for mobile versions prior to 5.7 may allow uploading of file… |
CVE-2022-41738 | High | 7.5 | 2024-02-17 | IBM Storage Scale Container Native Storage Access 5.1.2.1 -through 5.1.7.0 could allow an attacker to initiate connections to containers from external networks… |
CVE-2022-41737 | High | 7.1 | 2024-02-17 | IBM Storage Scale Container Native Storage Access 5.1.2.1 through 5.1.7.0 could allow a local attacker to initiate connections from a container outside the cur… |
CVE-2022-23093 | Medium | 6.5 | 2024-02-15 | ping reads raw IP packets from the network to process responses in the pr_pack() function. As part of processing a response ping has to reconstruct the IP hea… |
CVE-2022-23092 | High | 8.8 | 2024-02-15 | The implementation of lib9p's handling of RWALK messages was missing a bounds check needed when unpacking the message contents. The missing check means that t… |
CVE-2022-23091 | Medium | 4.0 | 2024-02-15 | A particular case of memory sharing is mishandled in the virtual memory system. This is very similar to SA-21:08.vm, but with a different root cause. An unpr… |